Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
Occipitomental.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
||
C:\Users\user\AppData\Local\Temp\nslA8AC.tmp\System.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
modified
|
||
C:\Users\user\AppData\Local\barberknivene\Valonia\Erstattende.som
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\barberknivene\Valonia\Memnon.afb
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\barberknivene\Valonia\Undvige.por
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\barberknivene\Valonia\chechako.com
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\barberknivene\Valonia\chirality.tan
|
Matlab v4 mat-file (little endian) \313, numeric, rows 0, columns 0
|
dropped
|
||
C:\Users\user\AppData\Local\barberknivene\Valonia\fortraeffelige.txt
|
ASCII text, with very long lines (372), with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\barberknivene\Valonia\krigsforbrydelser.pre
|
data
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\engelskgrs.ini
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\Occipitomental.exe
|
"C:\Users\user\Desktop\Occipitomental.exe"
|
||
C:\Users\user\Desktop\Occipitomental.exe
|
"C:\Users\user\Desktop\Occipitomental.exe"
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
|
unknown
|
||
https://www.google.com
|
unknown
|
||
http://www.ftp.ftp://ftp.gopher.
|
unknown
|
||
https://drive.usercontent.google.com/
|
unknown
|
||
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
|
unknown
|
||
http://nsis.sf.net/NSIS_Error
|
unknown
|
||
https://apis.google.com
|
unknown
|
||
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
||
https://drive.google.com/%v
|
unknown
|
||
https://drive.google.com/5v-z
|
unknown
|
||
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
|
unknown
|
There are 1 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
drive.google.com
|
142.250.186.78
|
||
drive.usercontent.google.com
|
142.250.186.97
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
142.250.186.78
|
drive.google.com
|
United States
|
||
142.250.186.97
|
drive.usercontent.google.com
|
United States
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\forlbsmodellers\Uninstall\indsyes\prelatial
|
unthick
|
||
HKEY_CURRENT_USER\Carinulate\personalise\Mytologis
|
gaas
|
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
215F000
|
remote allocation
|
page execute and read and write
|
||
35330000
|
direct allocation
|
page read and write
|
||
3A2F000
|
direct allocation
|
page execute and read and write
|
||
35461000
|
heap
|
page read and write
|
||
3505F000
|
stack
|
page read and write
|
||
436000
|
unkown
|
page read and write
|
||
3519E000
|
stack
|
page read and write
|
||
4EF000
|
heap
|
page read and write
|
||
5688000
|
heap
|
page read and write
|
||
563E000
|
heap
|
page read and write
|
||
35380000
|
direct allocation
|
page read and write
|
||
25EC000
|
heap
|
page read and write
|
||
55B0000
|
direct allocation
|
page read and write
|
||
5689000
|
heap
|
page read and write
|
||
562D000
|
heap
|
page read and write
|
||
35380000
|
direct allocation
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
35961000
|
direct allocation
|
page execute and read and write
|
||
2100000
|
heap
|
page read and write
|
||
4EF000
|
heap
|
page read and write
|
||
54E0000
|
heap
|
page read and write
|
||
5613000
|
heap
|
page read and write
|
||
35160000
|
remote allocation
|
page read and write
|
||
5689000
|
heap
|
page read and write
|
||
5620000
|
heap
|
page read and write
|
||
545E000
|
stack
|
page read and write
|
||
1660000
|
remote allocation
|
page execute and read and write
|
||
34AA0000
|
direct allocation
|
page read and write
|
||
5340000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
35680000
|
heap
|
page read and write
|
||
470000
|
direct allocation
|
page read and write
|
||
5640000
|
heap
|
page read and write
|
||
3532D000
|
stack
|
page read and write
|
||
25E7000
|
heap
|
page read and write
|
||
35160000
|
remote allocation
|
page read and write
|
||
4F2000
|
heap
|
page read and write
|
||
3582E000
|
direct allocation
|
page execute and read and write
|
||
4F0000
|
heap
|
page read and write
|
||
34E6E000
|
stack
|
page read and write
|
||
35330000
|
direct allocation
|
page read and write
|
||
407000
|
unkown
|
page readonly
|
||
5620000
|
heap
|
page read and write
|
||
34A70000
|
direct allocation
|
page read and write
|
||
357BD000
|
direct allocation
|
page execute and read and write
|
||
4F3000
|
heap
|
page read and write
|
||
2F30000
|
direct allocation
|
page execute and read and write
|
||
55FB000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
568C000
|
heap
|
page read and write
|
||
54DE000
|
stack
|
page read and write
|
||
25E6000
|
heap
|
page read and write
|
||
54F5000
|
heap
|
page read and write
|
||
4DE000
|
heap
|
page read and write
|
||
3560F000
|
heap
|
page read and write
|
||
5688000
|
heap
|
page read and write
|
||
34F2E000
|
stack
|
page read and write
|
||
5560000
|
direct allocation
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
5640000
|
heap
|
page read and write
|
||
409000
|
unkown
|
page write copy
|
||
449000
|
unkown
|
page readonly
|
||
6F0000
|
direct allocation
|
page read and write
|
||
34AB0000
|
direct allocation
|
page read and write
|
||
4F0000
|
heap
|
page read and write
|
||
4EB000
|
heap
|
page read and write
|
||
4EF000
|
heap
|
page read and write
|
||
3501E000
|
stack
|
page read and write
|
||
5EE000
|
unkown
|
page execute read
|
||
350CE000
|
stack
|
page read and write
|
||
5643000
|
heap
|
page read and write
|
||
4DE000
|
heap
|
page read and write
|
||
3F5F000
|
remote allocation
|
page execute and read and write
|
||
4DE000
|
heap
|
page read and write
|
||
490000
|
direct allocation
|
page read and write
|
||
25E8000
|
heap
|
page read and write
|
||
568C000
|
heap
|
page read and write
|
||
17E000
|
stack
|
page read and write
|
||
357B9000
|
direct allocation
|
page execute and read and write
|
||
354E2000
|
heap
|
page read and write
|
||
5F0000
|
unkown
|
page execute read
|
||
563E000
|
heap
|
page read and write
|
||
4DE000
|
heap
|
page read and write
|
||
35160000
|
remote allocation
|
page read and write
|
||
4A0000
|
direct allocation
|
page read and write
|
||
421000
|
unkown
|
page read and write
|
||
355F000
|
remote allocation
|
page execute and read and write
|
||
4EB000
|
heap
|
page read and write
|
||
55D8000
|
heap
|
page read and write
|
||
5643000
|
heap
|
page read and write
|
||
5688000
|
heap
|
page read and write
|
||
5683000
|
heap
|
page read and write
|
||
5570000
|
direct allocation
|
page read and write
|
||
55A0000
|
direct allocation
|
page read and write
|
||
460000
|
heap
|
page read and write
|
||
55C0000
|
heap
|
page read and write
|
||
2B5F000
|
remote allocation
|
page execute and read and write
|
||
439000
|
unkown
|
page readonly
|
||
6C0000
|
direct allocation
|
page read and write
|
||
4EB000
|
heap
|
page read and write
|
||
563E000
|
heap
|
page read and write
|
||
5E0000
|
heap
|
page read and write
|
||
567F000
|
heap
|
page read and write
|
||
6D0000
|
direct allocation
|
page read and write
|
||
3510F000
|
stack
|
page read and write
|
||
35380000
|
direct allocation
|
page read and write
|
||
582F000
|
direct allocation
|
page execute and read and write
|
||
34EEE000
|
stack
|
page read and write
|
||
495F000
|
remote allocation
|
page execute and read and write
|
||
4EF000
|
heap
|
page read and write
|
||
563E000
|
heap
|
page read and write
|
||
442F000
|
direct allocation
|
page execute and read and write
|
||
710000
|
direct allocation
|
page read and write
|
||
5E4000
|
unkown
|
page execute read
|
||
5550000
|
direct allocation
|
page read and write
|
||
626000
|
unkown
|
page execute read
|
||
5580000
|
direct allocation
|
page read and write
|
||
34F6D000
|
stack
|
page read and write
|
||
4EF000
|
heap
|
page read and write
|
||
409000
|
unkown
|
page read and write
|
||
553F000
|
stack
|
page read and write
|
||
5640000
|
heap
|
page read and write
|
||
4EB000
|
heap
|
page read and write
|
||
2260000
|
heap
|
page read and write
|
||
649000
|
unkown
|
page execute read
|
||
449000
|
unkown
|
page readonly
|
||
5590000
|
direct allocation
|
page read and write
|
||
34FAD000
|
stack
|
page read and write
|
||
4EB000
|
heap
|
page read and write
|
||
25E1000
|
heap
|
page read and write
|
||
5E6000
|
unkown
|
page execute read
|
||
401000
|
unkown
|
page execute read
|
||
55D0000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
5637000
|
heap
|
page read and write
|
||
5643000
|
heap
|
page read and write
|
||
4B0000
|
heap
|
page read and write
|
||
5B0000
|
heap
|
page read and write
|
||
439000
|
unkown
|
page readonly
|
||
4B8000
|
heap
|
page read and write
|
||
562D000
|
heap
|
page read and write
|
||
34EAF000
|
stack
|
page read and write
|
||
5F2000
|
unkown
|
page execute read
|
||
480000
|
direct allocation
|
page read and write
|
||
5622000
|
heap
|
page read and write
|
||
54F7000
|
heap
|
page read and write
|
||
4EF000
|
heap
|
page read and write
|
||
4EB000
|
heap
|
page read and write
|
||
302F000
|
direct allocation
|
page execute and read and write
|
||
25E2000
|
heap
|
page read and write
|
||
562D000
|
heap
|
page read and write
|
||
4DE000
|
heap
|
page read and write
|
||
359D2000
|
direct allocation
|
page execute and read and write
|
||
4EB000
|
heap
|
page read and write
|
||
34A90000
|
direct allocation
|
page read and write
|
||
4EF000
|
heap
|
page read and write
|
||
4E2F000
|
direct allocation
|
page execute and read and write
|
||
4EB000
|
heap
|
page read and write
|
||
5640000
|
heap
|
page read and write
|
||
70000
|
heap
|
page read and write
|
||
730000
|
direct allocation
|
page read and write
|
||
3560B000
|
heap
|
page read and write
|
||
5E8000
|
unkown
|
page execute read
|
||
407000
|
unkown
|
page readonly
|
||
3595D000
|
direct allocation
|
page execute and read and write
|
||
9B000
|
stack
|
page read and write
|
||
34A80000
|
direct allocation
|
page read and write
|
||
449000
|
unkown
|
page readonly
|
||
4DE000
|
heap
|
page read and write
|
||
5637000
|
heap
|
page read and write
|
||
4EB000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
2290000
|
heap
|
page read and write
|
||
71000
|
heap
|
page read and write
|
||
5EA000
|
unkown
|
page execute read
|
||
549F000
|
stack
|
page read and write
|
||
6E0000
|
direct allocation
|
page read and write
|
||
5637000
|
heap
|
page read and write
|
||
35380000
|
direct allocation
|
page read and write
|
||
25EC000
|
heap
|
page read and write
|
||
567C000
|
heap
|
page read and write
|
||
4EF000
|
heap
|
page read and write
|
||
25EE000
|
heap
|
page read and write
|
||
409000
|
unkown
|
page write copy
|
||
5643000
|
heap
|
page read and write
|
||
567F000
|
heap
|
page read and write
|
||
407000
|
unkown
|
page readonly
|
||
700000
|
direct allocation
|
page read and write
|
||
563E000
|
heap
|
page read and write
|
||
622F000
|
direct allocation
|
page execute and read and write
|
||
567F000
|
heap
|
page read and write
|
||
4DE000
|
heap
|
page read and write
|
||
5E5000
|
heap
|
page read and write
|
||
3522E000
|
stack
|
page read and write
|
||
10005000
|
unkown
|
page readonly
|
||
720000
|
direct allocation
|
page read and write
|
||
5EC000
|
unkown
|
page execute read
|
||
5643000
|
heap
|
page read and write
|
||
351DF000
|
stack
|
page read and write
|
||
5622000
|
heap
|
page read and write
|
||
35380000
|
direct allocation
|
page read and write
|
||
35690000
|
direct allocation
|
page execute and read and write
|
||
54F0000
|
heap
|
page read and write
|
||
25EA000
|
heap
|
page read and write
|
||
35380000
|
direct allocation
|
page read and write
|
||
5643000
|
heap
|
page read and write
|
||
3533E000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
4DE000
|
heap
|
page read and write
|
||
5640000
|
heap
|
page read and write
|
||
439000
|
unkown
|
page readonly
|
||
10003000
|
unkown
|
page readonly
|
||
429000
|
unkown
|
page read and write
|
||
562D000
|
heap
|
page read and write
|
||
175F000
|
remote allocation
|
page execute and read and write
|
||
35060000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
There are 207 hidden memdumps, click here to show them.