IOC Report
Quotation.scr.exe

loading gif

Files

File Path
Type
Category
Malicious
Quotation.scr.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\nsiBEB3.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsiBEB3.tmp\nsExec.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\filigraners\nonforming\gumphion\Feltbeskrivelsernes\akilleshles.bur
data
dropped
C:\Users\user\AppData\Roaming\filigraners\nonforming\gumphion\Feltbeskrivelsernes\citerens.bra
data
dropped
C:\Users\user\AppData\Roaming\filigraners\nonforming\gumphion\Feltbeskrivelsernes\henneth.boh
data
dropped
C:\Users\user\AppData\Roaming\filigraners\nonforming\gumphion\Feltbeskrivelsernes\irresiliency.fen
data
dropped
C:\Users\user\AppData\Roaming\filigraners\nonforming\gumphion\Feltbeskrivelsernes\maniform.lic
data
dropped
C:\Users\user\AppData\Roaming\filigraners\nonforming\gumphion\Hudormene.svr
data
dropped
C:\Users\user\AppData\Roaming\filigraners\nonforming\gumphion\Nationalbudgetternes.Oms
data
dropped
C:\Users\user\AppData\Roaming\filigraners\nonforming\gumphion\Rhodosperm.Tra
data
dropped
C:\Users\user\AppData\Roaming\filigraners\nonforming\gumphion\Tolvmandsforeningernes\Trod.txt
ASCII text, with CRLF line terminators
dropped
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Quotation.scr.exe
"C:\Users\user\Desktop\Quotation.scr.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "220^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
 malicious
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\Conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 119 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://nsis.sf.net/NSIS_Error
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
656000
heap
page read and write
 malicious
68E3000
direct allocation
page execute and read and write
 malicious
681000
heap
page read and write
 malicious
66A000
heap
page read and write
 malicious
9AE3000
direct allocation
page execute and read and write
73F10000
unkown
page readonly
282A000
heap
page read and write
643000
heap
page read and write
610000
heap
page read and write
408000
unkown
page readonly
66A000
heap
page read and write
66A000
heap
page read and write
2826000
heap
page read and write
54E3000
direct allocation
page execute and read and write
437000
unkown
page readonly
656000
heap
page read and write
A09000
heap
page read and write
644000
heap
page read and write
98000
stack
page read and write
652000
heap
page read and write
A05000
heap
page read and write
940000
heap
page read and write
652000
heap
page read and write
64E000
heap
page read and write
90E3000
direct allocation
page execute and read and write
670000
heap
page read and write
66A000
heap
page read and write
437000
unkown
page readonly
66A000
heap
page read and write
434000
unkown
page read and write
643000
heap
page read and write
64E000
heap
page read and write
910000
heap
page read and write
656000
heap
page read and write
80F000
stack
page read and write
652000
heap
page read and write
401000
unkown
page execute read
643000
heap
page read and write
656000
heap
page read and write
618000
heap
page read and write
656000
heap
page read and write
282B000
heap
page read and write
73F14000
unkown
page readonly
656000
heap
page read and write
426000
unkown
page read and write
652000
heap
page read and write
656000
heap
page read and write
652000
heap
page read and write
86E3000
direct allocation
page execute and read and write
643000
heap
page read and write
2826000
heap
page read and write
66A000
heap
page read and write
656000
heap
page read and write
643000
heap
page read and write
450000
heap
page read and write
643000
heap
page read and write
2822000
heap
page read and write
429000
unkown
page read and write
66A000
heap
page read and write
66A000
heap
page read and write
64E000
heap
page read and write
66A000
heap
page read and write
3820000
trusted library allocation
page read and write
66A000
heap
page read and write
656000
heap
page read and write
652000
heap
page read and write
72E3000
direct allocation
page execute and read and write
19A000
stack
page read and write
652000
heap
page read and write
408000
unkown
page readonly
64E000
heap
page read and write
282E000
heap
page read and write
2825000
heap
page read and write
22D0000
heap
page read and write
656000
heap
page read and write
73F11000
unkown
page execute read
64E000
heap
page read and write
652000
heap
page read and write
2720000
heap
page read and write
652000
heap
page read and write
656000
heap
page read and write
40A000
unkown
page write copy
40A000
unkown
page read and write
56E000
stack
page read and write
2821000
heap
page read and write
643000
heap
page read and write
570000
heap
page read and write
673000
heap
page read and write
64E000
heap
page read and write
66A000
heap
page read and write
422000
unkown
page read and write
64E000
heap
page read and write
643000
heap
page read and write
3280000
heap
page read and write
652000
heap
page read and write
400000
unkown
page readonly
282C000
heap
page read and write
405C000
stack
page read and write
401000
unkown
page execute read
580000
heap
page read and write
64E000
heap
page read and write
585000
heap
page read and write
643000
heap
page read and write
5EE3000
direct allocation
page execute and read and write
282D000
heap
page read and write
652000
heap
page read and write
64E000
heap
page read and write
22D4000
heap
page read and write
2829000
heap
page read and write
643000
heap
page read and write
A00000
heap
page read and write
282E000
heap
page read and write
415C000
stack
page read and write
66A000
heap
page read and write
73F16000
unkown
page readonly
656000
heap
page read and write
64E000
heap
page read and write
7CE3000
direct allocation
page execute and read and write
5440000
direct allocation
page execute and read and write
3790000
heap
page read and write
64E000
heap
page read and write
652000
heap
page read and write
64E000
heap
page read and write
400000
unkown
page readonly
There are 114 hidden memdumps, click here to show them.