Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
450707124374000811.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
||
C:\Users\user\AppData\Local\Temp\nsqA869.tmp\System.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Canton.Chr
|
data
|
dropped
|
||
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\Grundfladernes.Qua
|
data
|
dropped
|
||
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\img-1.jpg
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 999x605, components
3
|
dropped
|
||
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\nannie.tek
|
data
|
dropped
|
||
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\nonpendency.age
|
data
|
dropped
|
||
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\rimsmeds.txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\pechay\transskribere\jon\skreddene.spo
|
data
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\450707124374000811.exe
|
"C:\Users\user\Desktop\450707124374000811.exe"
|
||
C:\Users\user\Desktop\450707124374000811.exe
|
"C:\Users\user\Desktop\450707124374000811.exe"
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://alfacen.com/GZgWeuQ77.bin
|
193.107.36.30
|
||
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
|
unknown
|
||
http://www.ftp.ftp://ftp.gopher.
|
unknown
|
||
https://alfacen.com/GZgWeuQ77.binf
|
unknown
|
||
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
|
unknown
|
||
https://alfacen.com/GZgWeuQ77.bine
|
unknown
|
||
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
||
https://alfacen.com/
|
unknown
|
||
https://alfacen.com/GZgWeuQ77.bine/Q
|
unknown
|
||
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
|
unknown
|
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
alfacen.com
|
193.107.36.30
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
193.107.36.30
|
alfacen.com
|
Bulgaria
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CLI\Start
|
CLI start
|
||
HKEY_CURRENT_USER\Ailurophilia\Pectinidae
|
Lacqueying
|
||
HKEY_CURRENT_USER\Eksportforbuddets\Uninstall\telltruth\suede
|
frihandlens
|
||
HKEY_CURRENT_USER\SOFTWARE\Service
|
System_Check
|
||
HKEY_CURRENT_USER\SOFTWARE\Service
|
System_Check
|
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
2BF8000
|
direct allocation
|
page execute and read and write
|
||
35BC1000
|
direct allocation
|
page execute and read and write
|
||
5678000
|
heap
|
page read and write
|
||
56BE000
|
heap
|
page read and write
|
||
436000
|
unkown
|
page read and write
|
||
5D4000
|
heap
|
page read and write
|
||
2350000
|
heap
|
page read and write
|
||
5653000
|
heap
|
page read and write
|
||
351CE000
|
stack
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
34CC0000
|
direct allocation
|
page read and write
|
||
34CF0000
|
direct allocation
|
page read and write
|
||
49D8000
|
remote allocation
|
page execute and read and write
|
||
356C1000
|
heap
|
page read and write
|
||
170000
|
direct allocation
|
page read and write
|
||
570000
|
heap
|
page read and write
|
||
3559E000
|
heap
|
page read and write
|
||
49F8000
|
direct allocation
|
page execute and read and write
|
||
5638000
|
heap
|
page read and write
|
||
353C0000
|
remote allocation
|
page read and write
|
||
21D8000
|
remote allocation
|
page execute and read and write
|
||
1E0000
|
heap
|
page read and write
|
||
35873000
|
heap
|
page read and write
|
||
70000
|
heap
|
page read and write
|
||
4E0000
|
direct allocation
|
page read and write
|
||
34D10000
|
direct allocation
|
page read and write
|
||
34CE0000
|
direct allocation
|
page read and write
|
||
500000
|
direct allocation
|
page read and write
|
||
71000
|
heap
|
page read and write
|
||
5684000
|
heap
|
page read and write
|
||
170000
|
direct allocation
|
page read and write
|
||
626000
|
unkown
|
page execute read
|
||
408000
|
unkown
|
page readonly
|
||
5EA000
|
unkown
|
page execute read
|
||
55D0000
|
heap
|
page read and write
|
||
5AD000
|
heap
|
page read and write
|
||
5618000
|
heap
|
page read and write
|
||
170000
|
direct allocation
|
page read and write
|
||
46A000
|
unkown
|
page readonly
|
||
35A19000
|
direct allocation
|
page execute and read and write
|
||
34D20000
|
direct allocation
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
35BBD000
|
direct allocation
|
page execute and read and write
|
||
5E4000
|
unkown
|
page execute read
|
||
4C0000
|
direct allocation
|
page read and write
|
||
2120000
|
heap
|
page read and write
|
||
67F8000
|
direct allocation
|
page execute and read and write
|
||
96000
|
stack
|
page read and write
|
||
34CD0000
|
direct allocation
|
page read and write
|
||
3FF8000
|
direct allocation
|
page execute and read and write
|
||
2125000
|
heap
|
page read and write
|
||
46A000
|
unkown
|
page readonly
|
||
2A80000
|
direct allocation
|
page execute and read and write
|
||
2340000
|
heap
|
page read and write
|
||
53D8000
|
remote allocation
|
page execute and read and write
|
||
5900000
|
direct allocation
|
page read and write
|
||
2998000
|
heap
|
page read and write
|
||
3586F000
|
heap
|
page read and write
|
||
408000
|
unkown
|
page readonly
|
||
22F0000
|
heap
|
page read and write
|
||
1E4000
|
heap
|
page read and write
|
||
740000
|
direct allocation
|
page read and write
|
||
71000
|
heap
|
page read and write
|
||
5E8000
|
unkown
|
page execute read
|
||
58F0000
|
direct allocation
|
page read and write
|
||
5684000
|
heap
|
page read and write
|
||
35D8000
|
remote allocation
|
page execute and read and write
|
||
46A000
|
unkown
|
page readonly
|
||
770000
|
direct allocation
|
page read and write
|
||
5638000
|
heap
|
page read and write
|
||
2980000
|
heap
|
page read and write
|
||
5E6000
|
unkown
|
page execute read
|
||
53F8000
|
direct allocation
|
page execute and read and write
|
||
468000
|
unkown
|
page read and write
|
||
5667000
|
heap
|
page read and write
|
||
5910000
|
heap
|
page read and write
|
||
23C0000
|
heap
|
page read and write
|
||
40A000
|
unkown
|
page read and write
|
||
3558D000
|
stack
|
page read and write
|
||
3535F000
|
stack
|
page read and write
|
||
216E000
|
stack
|
page read and write
|
||
5CB000
|
heap
|
page read and write
|
||
540000
|
heap
|
page read and write
|
||
5682000
|
heap
|
page read and write
|
||
56C2000
|
heap
|
page read and write
|
||
170000
|
direct allocation
|
page read and write
|
||
40A000
|
unkown
|
page write copy
|
||
581E000
|
stack
|
page read and write
|
||
589E000
|
stack
|
page read and write
|
||
530000
|
direct allocation
|
page read and write
|
||
353C0000
|
remote allocation
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
4F0000
|
direct allocation
|
page read and write
|
||
350CE000
|
stack
|
page read and write
|
||
5653000
|
heap
|
page read and write
|
||
5C1000
|
heap
|
page read and write
|
||
5600000
|
direct allocation
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
3510F000
|
stack
|
page read and write
|
||
353FE000
|
stack
|
page read and write
|
||
55E0000
|
heap
|
page read and write
|
||
170000
|
direct allocation
|
page read and write
|
||
40A000
|
unkown
|
page write copy
|
||
431000
|
unkown
|
page read and write
|
||
1F6000
|
heap
|
page read and write
|
||
3514D000
|
stack
|
page read and write
|
||
35A1D000
|
direct allocation
|
page execute and read and write
|
||
5665000
|
heap
|
page read and write
|
||
353C0000
|
remote allocation
|
page read and write
|
||
1660000
|
remote allocation
|
page execute and read and write
|
||
566C000
|
heap
|
page read and write
|
||
3FD8000
|
remote allocation
|
page execute and read and write
|
||
520000
|
direct allocation
|
page read and write
|
||
4B0000
|
heap
|
page read and write
|
||
5678000
|
heap
|
page read and write
|
||
10005000
|
unkown
|
page readonly
|
||
1F0000
|
heap
|
page read and write
|
||
22EF000
|
stack
|
page read and write
|
||
578000
|
heap
|
page read and write
|
||
5653000
|
heap
|
page read and write
|
||
34D00000
|
direct allocation
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
585E000
|
stack
|
page read and write
|
||
35C32000
|
direct allocation
|
page execute and read and write
|
||
5678000
|
heap
|
page read and write
|
||
10003000
|
unkown
|
page readonly
|
||
58E0000
|
direct allocation
|
page read and write
|
||
19A000
|
stack
|
page read and write
|
||
408000
|
unkown
|
page readonly
|
||
401000
|
unkown
|
page execute read
|
||
565B000
|
heap
|
page read and write
|
||
56C2000
|
heap
|
page read and write
|
||
3520E000
|
stack
|
page read and write
|
||
750000
|
direct allocation
|
page read and write
|
||
35590000
|
direct allocation
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
649000
|
unkown
|
page execute read
|
||
1E4000
|
heap
|
page read and write
|
||
58DF000
|
stack
|
page read and write
|
||
3518D000
|
stack
|
page read and write
|
||
352CF000
|
stack
|
page read and write
|
||
43F000
|
unkown
|
page read and write
|
||
565C000
|
heap
|
page read and write
|
||
5683000
|
heap
|
page read and write
|
||
358E4000
|
heap
|
page read and write
|
||
5A0000
|
heap
|
page read and write
|
||
21E0000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
17D8000
|
remote allocation
|
page execute and read and write
|
||
5684000
|
heap
|
page read and write
|
||
1E4000
|
heap
|
page read and write
|
||
5F2000
|
unkown
|
page execute read
|
||
5F0000
|
unkown
|
page execute read
|
||
358F0000
|
direct allocation
|
page execute and read and write
|
||
23C4000
|
heap
|
page read and write
|
||
5DF8000
|
direct allocation
|
page execute and read and write
|
||
5EC000
|
unkown
|
page execute read
|
||
5EE000
|
unkown
|
page execute read
|
||
35746000
|
heap
|
page read and write
|
||
5610000
|
heap
|
page read and write
|
||
2BD8000
|
remote allocation
|
page execute and read and write
|
||
760000
|
direct allocation
|
page read and write
|
||
510000
|
direct allocation
|
page read and write
|
||
5665000
|
heap
|
page read and write
|
||
3528E000
|
stack
|
page read and write
|
||
3548E000
|
stack
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
566C000
|
heap
|
page read and write
|
||
567F000
|
heap
|
page read and write
|
||
34D30000
|
direct allocation
|
page read and write
|
||
4D0000
|
direct allocation
|
page read and write
|
||
5684000
|
heap
|
page read and write
|
||
170000
|
direct allocation
|
page read and write
|
||
35F8000
|
direct allocation
|
page execute and read and write
|
||
566C000
|
heap
|
page read and write
|
||
35A8E000
|
direct allocation
|
page execute and read and write
|
||
5639000
|
heap
|
page read and write
|
||
565B000
|
heap
|
page read and write
|
||
562B000
|
heap
|
page read and write
|
||
3531E000
|
stack
|
page read and write
|
||
170000
|
direct allocation
|
page read and write
|
||
5682000
|
heap
|
page read and write
|
||
3543F000
|
stack
|
page read and write
|
There are 173 hidden memdumps, click here to show them.