Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
450707124374000811.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Canton.Chr
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Grundfladernes.Qua
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\img-1.jpg
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 999x605, components
3
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\nannie.tek
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\nonpendency.age
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\rimsmeds.txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\skreddene.spo
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\450707124374000811.exe
|
"C:\Users\user\Desktop\450707124374000811.exe"
|
|
|
|
C:\Users\user\Desktop\450707124374000811.exe
|
"C:\Users\user\Desktop\450707124374000811.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://alfacen.com/GZgWeuQ77.bin
|
193.107.36.30
|
||
|
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
|
unknown
|
||
|
http://www.ftp.ftp://ftp.gopher.
|
unknown
|
||
|
https://alfacen.com/GZgWeuQ77.binf
|
unknown
|
||
|
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
|
unknown
|
||
|
https://alfacen.com/GZgWeuQ77.bine
|
unknown
|
||
|
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
||
|
https://alfacen.com/
|
unknown
|
||
|
https://alfacen.com/GZgWeuQ77.bine/Q
|
unknown
|
||
|
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
alfacen.com
|
193.107.36.30
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
193.107.36.30
|
alfacen.com
|
Bulgaria
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CLI\Start
|
CLI start
|
||
|
HKEY_CURRENT_USER\Ailurophilia\Pectinidae
|
Lacqueying
|
||
|
HKEY_CURRENT_USER\Eksportforbuddets\Uninstall\telltruth\suede
|
frihandlens
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Service
|
System_Check
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Service
|
System_Check
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2BF8000
|
direct allocation
|
page execute and read and write
|
|
|
|
35BC1000
|
direct allocation
|
page execute and read and write
|
||
|
5678000
|
heap
|
page read and write
|
||
|
56BE000
|
heap
|
page read and write
|
||
|
436000
|
unkown
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
2350000
|
heap
|
page read and write
|
||
|
5653000
|
heap
|
page read and write
|
||
|
351CE000
|
stack
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
34CC0000
|
direct allocation
|
page read and write
|
||
|
34CF0000
|
direct allocation
|
page read and write
|
||
|
49D8000
|
remote allocation
|
page execute and read and write
|
||
|
356C1000
|
heap
|
page read and write
|
||
|
170000
|
direct allocation
|
page read and write
|
||
|
570000
|
heap
|
page read and write
|
||
|
3559E000
|
heap
|
page read and write
|
||
|
49F8000
|
direct allocation
|
page execute and read and write
|
||
|
5638000
|
heap
|
page read and write
|
||
|
353C0000
|
remote allocation
|
page read and write
|
||
|
21D8000
|
remote allocation
|
page execute and read and write
|
||
|
1E0000
|
heap
|
page read and write
|
||
|
35873000
|
heap
|
page read and write
|
||
|
70000
|
heap
|
page read and write
|
||
|
4E0000
|
direct allocation
|
page read and write
|
||
|
34D10000
|
direct allocation
|
page read and write
|
||
|
34CE0000
|
direct allocation
|
page read and write
|
||
|
500000
|
direct allocation
|
page read and write
|
||
|
71000
|
heap
|
page read and write
|
||
|
5684000
|
heap
|
page read and write
|
||
|
170000
|
direct allocation
|
page read and write
|
||
|
626000
|
unkown
|
page execute read
|
||
|
408000
|
unkown
|
page readonly
|
||
|
5EA000
|
unkown
|
page execute read
|
||
|
55D0000
|
heap
|
page read and write
|
||
|
5AD000
|
heap
|
page read and write
|
||
|
5618000
|
heap
|
page read and write
|
||
|
170000
|
direct allocation
|
page read and write
|
||
|
46A000
|
unkown
|
page readonly
|
||
|
35A19000
|
direct allocation
|
page execute and read and write
|
||
|
34D20000
|
direct allocation
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
35BBD000
|
direct allocation
|
page execute and read and write
|
||
|
5E4000
|
unkown
|
page execute read
|
||
|
4C0000
|
direct allocation
|
page read and write
|
||
|
2120000
|
heap
|
page read and write
|
||
|
67F8000
|
direct allocation
|
page execute and read and write
|
||
|
96000
|
stack
|
page read and write
|
||
|
34CD0000
|
direct allocation
|
page read and write
|
||
|
3FF8000
|
direct allocation
|
page execute and read and write
|
||
|
2125000
|
heap
|
page read and write
|
||
|
46A000
|
unkown
|
page readonly
|
||
|
2A80000
|
direct allocation
|
page execute and read and write
|
||
|
2340000
|
heap
|
page read and write
|
||
|
53D8000
|
remote allocation
|
page execute and read and write
|
||
|
5900000
|
direct allocation
|
page read and write
|
||
|
2998000
|
heap
|
page read and write
|
||
|
3586F000
|
heap
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
22F0000
|
heap
|
page read and write
|
||
|
1E4000
|
heap
|
page read and write
|
||
|
740000
|
direct allocation
|
page read and write
|
||
|
71000
|
heap
|
page read and write
|
||
|
5E8000
|
unkown
|
page execute read
|
||
|
58F0000
|
direct allocation
|
page read and write
|
||
|
5684000
|
heap
|
page read and write
|
||
|
35D8000
|
remote allocation
|
page execute and read and write
|
||
|
46A000
|
unkown
|
page readonly
|
||
|
770000
|
direct allocation
|
page read and write
|
||
|
5638000
|
heap
|
page read and write
|
||
|
2980000
|
heap
|
page read and write
|
||
|
5E6000
|
unkown
|
page execute read
|
||
|
53F8000
|
direct allocation
|
page execute and read and write
|
||
|
468000
|
unkown
|
page read and write
|
||
|
5667000
|
heap
|
page read and write
|
||
|
5910000
|
heap
|
page read and write
|
||
|
23C0000
|
heap
|
page read and write
|
||
|
40A000
|
unkown
|
page read and write
|
||
|
3558D000
|
stack
|
page read and write
|
||
|
3535F000
|
stack
|
page read and write
|
||
|
216E000
|
stack
|
page read and write
|
||
|
5CB000
|
heap
|
page read and write
|
||
|
540000
|
heap
|
page read and write
|
||
|
5682000
|
heap
|
page read and write
|
||
|
56C2000
|
heap
|
page read and write
|
||
|
170000
|
direct allocation
|
page read and write
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
581E000
|
stack
|
page read and write
|
||
|
589E000
|
stack
|
page read and write
|
||
|
530000
|
direct allocation
|
page read and write
|
||
|
353C0000
|
remote allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
4F0000
|
direct allocation
|
page read and write
|
||
|
350CE000
|
stack
|
page read and write
|
||
|
5653000
|
heap
|
page read and write
|
||
|
5C1000
|
heap
|
page read and write
|
||
|
5600000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
3510F000
|
stack
|
page read and write
|
||
|
353FE000
|
stack
|
page read and write
|
||
|
55E0000
|
heap
|
page read and write
|
||
|
170000
|
direct allocation
|
page read and write
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
431000
|
unkown
|
page read and write
|
||
|
1F6000
|
heap
|
page read and write
|
||
|
3514D000
|
stack
|
page read and write
|
||
|
35A1D000
|
direct allocation
|
page execute and read and write
|
||
|
5665000
|
heap
|
page read and write
|
||
|
353C0000
|
remote allocation
|
page read and write
|
||
|
1660000
|
remote allocation
|
page execute and read and write
|
||
|
566C000
|
heap
|
page read and write
|
||
|
3FD8000
|
remote allocation
|
page execute and read and write
|
||
|
520000
|
direct allocation
|
page read and write
|
||
|
4B0000
|
heap
|
page read and write
|
||
|
5678000
|
heap
|
page read and write
|
||
|
10005000
|
unkown
|
page readonly
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
22EF000
|
stack
|
page read and write
|
||
|
578000
|
heap
|
page read and write
|
||
|
5653000
|
heap
|
page read and write
|
||
|
34D00000
|
direct allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
585E000
|
stack
|
page read and write
|
||
|
35C32000
|
direct allocation
|
page execute and read and write
|
||
|
5678000
|
heap
|
page read and write
|
||
|
10003000
|
unkown
|
page readonly
|
||
|
58E0000
|
direct allocation
|
page read and write
|
||
|
19A000
|
stack
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
401000
|
unkown
|
page execute read
|
||
|
565B000
|
heap
|
page read and write
|
||
|
56C2000
|
heap
|
page read and write
|
||
|
3520E000
|
stack
|
page read and write
|
||
|
750000
|
direct allocation
|
page read and write
|
||
|
35590000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
649000
|
unkown
|
page execute read
|
||
|
1E4000
|
heap
|
page read and write
|
||
|
58DF000
|
stack
|
page read and write
|
||
|
3518D000
|
stack
|
page read and write
|
||
|
352CF000
|
stack
|
page read and write
|
||
|
43F000
|
unkown
|
page read and write
|
||
|
565C000
|
heap
|
page read and write
|
||
|
5683000
|
heap
|
page read and write
|
||
|
358E4000
|
heap
|
page read and write
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
21E0000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
17D8000
|
remote allocation
|
page execute and read and write
|
||
|
5684000
|
heap
|
page read and write
|
||
|
1E4000
|
heap
|
page read and write
|
||
|
5F2000
|
unkown
|
page execute read
|
||
|
5F0000
|
unkown
|
page execute read
|
||
|
358F0000
|
direct allocation
|
page execute and read and write
|
||
|
23C4000
|
heap
|
page read and write
|
||
|
5DF8000
|
direct allocation
|
page execute and read and write
|
||
|
5EC000
|
unkown
|
page execute read
|
||
|
5EE000
|
unkown
|
page execute read
|
||
|
35746000
|
heap
|
page read and write
|
||
|
5610000
|
heap
|
page read and write
|
||
|
2BD8000
|
remote allocation
|
page execute and read and write
|
||
|
760000
|
direct allocation
|
page read and write
|
||
|
510000
|
direct allocation
|
page read and write
|
||
|
5665000
|
heap
|
page read and write
|
||
|
3528E000
|
stack
|
page read and write
|
||
|
3548E000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
566C000
|
heap
|
page read and write
|
||
|
567F000
|
heap
|
page read and write
|
||
|
34D30000
|
direct allocation
|
page read and write
|
||
|
4D0000
|
direct allocation
|
page read and write
|
||
|
5684000
|
heap
|
page read and write
|
||
|
170000
|
direct allocation
|
page read and write
|
||
|
35F8000
|
direct allocation
|
page execute and read and write
|
||
|
566C000
|
heap
|
page read and write
|
||
|
35A8E000
|
direct allocation
|
page execute and read and write
|
||
|
5639000
|
heap
|
page read and write
|
||
|
565B000
|
heap
|
page read and write
|
||
|
562B000
|
heap
|
page read and write
|
||
|
3531E000
|
stack
|
page read and write
|
||
|
170000
|
direct allocation
|
page read and write
|
||
|
5682000
|
heap
|
page read and write
|
||
|
3543F000
|
stack
|
page read and write
|
There are 173 hidden memdumps, click here to show them.