Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
runonce.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
||
|
C:\Users\user\AppData\Local\Temp\DellPair-1.2.4-in.log
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsjF7BA.tmp\AccessControl.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsjF7BA.tmp\LogEx.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsjF7BA.tmp\System.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsjF7BA.tmp\nsExec.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\runonce.exe
|
"C:\Users\user\Desktop\runonce.exe"
|
 |
|
|
C:\Windows\SysWOW64\wbem\WMIC.exe
|
wmic /NAMESPACE:\\root\CIMV2 path Win32_BIOS get Manufacturer
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://opensource.dell.com
|
unknown
|
||
|
http://opensource.dell.com/
|
unknown
|
||
|
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
323F000
|
stack
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
7C0000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
3006000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2F3A000
|
heap
|
page read and write
|
||
|
3729000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2460000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
3733000
|
heap
|
page read and write
|
||
|
5102000
|
heap
|
page read and write
|
||
|
7F2000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2B30000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2F90000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
19A000
|
stack
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2FEB000
|
heap
|
page read and write
|
||
|
3298000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
3008000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
57F0000
|
trusted library allocation
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
7DD000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2B00000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2F37000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
605000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
5FE000
|
stack
|
page read and write
|
||
|
3001000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2DEE000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2EC0000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2F10000
|
heap
|
page read and write
|
||
|
2FD2000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2FE9000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
372E000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2F80000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
372A000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
329D000
|
heap
|
page read and write
|
||
|
431000
|
unkown
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
5101000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
3001000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
441000
|
unkown
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
803000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
7F4000
|
heap
|
page read and write
|
||
|
2FF6000
|
heap
|
page read and write
|
||
|
4AD000
|
unkown
|
page readonly
|
||
|
2CD0000
|
heap
|
page read and write
|
||
|
7FA000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
3726000
|
heap
|
page read and write
|
||
|
2FF6000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
9FE000
|
stack
|
page read and write
|
||
|
814000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
74E000
|
stack
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C0000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
3725000
|
heap
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
5109000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
3729000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
600000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2FEA000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
31FE000
|
stack
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
40D000
|
unkown
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
7C8000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2EBE000
|
stack
|
page read and write
|
||
|
2C78000
|
stack
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2F30000
|
heap
|
page read and write
|
||
|
2480000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
81F000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2FC0000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
7F4000
|
heap
|
page read and write
|
||
|
3290000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
9BF000
|
stack
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2FE9000
|
heap
|
page read and write
|
||
|
3013000
|
heap
|
page read and write
|
||
|
2FCC000
|
heap
|
page read and write
|
||
|
827000
|
heap
|
page read and write
|
||
|
7F2000
|
heap
|
page read and write
|
||
|
3730000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
7FA000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
46B000
|
unkown
|
page readonly
|
||
|
4E0000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2EF0000
|
heap
|
page read and write
|
||
|
7E0000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
300F000
|
heap
|
page read and write
|
||
|
5105000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
7A0000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
234E000
|
stack
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
3724000
|
heap
|
page read and write
|
||
|
80A000
|
heap
|
page read and write
|
||
|
2ED0000
|
trusted library allocation
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E2E000
|
stack
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
329D000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
42F000
|
unkown
|
page read and write
|
||
|
2FCF000
|
heap
|
page read and write
|
||
|
3017000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
5109000
|
heap
|
page read and write
|
||
|
27D9000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E6E000
|
stack
|
page read and write
|
||
|
2ED0000
|
trusted library allocation
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
4FFF000
|
stack
|
page read and write
|
||
|
2F32000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
3720000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
70F000
|
stack
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2C3B000
|
stack
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2FE9000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
5109000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
3001000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
3727000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
5109000
|
heap
|
page read and write
|
||
|
2F39000
|
heap
|
page read and write
|
||
|
2E70000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
5100000
|
heap
|
page read and write
|
||
|
750000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
AFF000
|
stack
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
3726000
|
heap
|
page read and write
|
||
|
2AE0000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2FD2000
|
heap
|
page read and write
|
||
|
244F000
|
stack
|
page read and write
|
||
|
2F36000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
B10000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
4AD000
|
unkown
|
page readonly
|
||
|
2FF5000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
372D000
|
heap
|
page read and write
|
||
|
3731000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
327E000
|
stack
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
827000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
40A000
|
unkown
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
372D000
|
heap
|
page read and write
|
||
|
507F000
|
stack
|
page read and write
|
||
|
3009000
|
heap
|
page read and write
|
||
|
B19000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
B15000
|
heap
|
page read and write
|
||
|
329C000
|
heap
|
page read and write
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
503E000
|
stack
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
46B000
|
unkown
|
page readonly
|
||
|
2F33000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
3017000
|
heap
|
page read and write
|
||
|
2484000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
3005000
|
heap
|
page read and write
|
||
|
30C1000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
||
|
2E74000
|
heap
|
page read and write
|
There are 350 hidden memdumps, click here to show them.