Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
ndvdikok.vbs
|
ASCII text, with CRLF line terminators
|
initial sample
|
 |
|
|
C:\NwiQ\AutoHotkey.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\NwiQ\file.zip
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
||
|
C:\NwiQ\script.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\NwiQ\test.txt
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\fykbmgsz[1]
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\heeeaAd
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ndvdikok.vbs"
|
|
|
|
C:\NwiQ\AutoHotkey.exe
|
"C:\NwiQ\Autohotkey.exe" "c:\NwiQ\script.ahk"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://backupssupport.com/fykbmgsz
|
205.234.201.153
|
|
|
|
http://backupssupport.com/fykbmgszj
|
unknown
|
||
|
https://autohotkey.com
|
unknown
|
||
|
http://backupssupport.com/fykbmgsz6
|
unknown
|
||
|
https://autohotkey.comCould
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
backupssupport.com
|
205.234.201.153
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
205.234.201.153
|
backupssupport.com
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
|
{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} {000214E6-0000-0000-C000-000000000046} 0xFFFF
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
|
Implementing
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4840000
|
direct allocation
|
page execute and read and write
|
|
|
|
48AA000
|
direct allocation
|
page execute and read and write
|
|
|
|
1D5A667C000
|
heap
|
page read and write
|
||
|
1D5A3EC9000
|
heap
|
page read and write
|
||
|
1D5A6659000
|
heap
|
page read and write
|
||
|
14E000
|
stack
|
page read and write
|
||
|
1D5A3D5D000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
4AE1000
|
heap
|
page read and write
|
||
|
1D5A6604000
|
heap
|
page read and write
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
4AD000
|
unkown
|
page readonly
|
||
|
1D5A661D000
|
heap
|
page read and write
|
||
|
1D5A3D5D000
|
heap
|
page read and write
|
||
|
1D5A5B30000
|
heap
|
page read and write
|
||
|
1D5A6663000
|
heap
|
page read and write
|
||
|
1D5A6668000
|
heap
|
page read and write
|
||
|
1D5A3D00000
|
heap
|
page read and write
|
||
|
4AB5000
|
heap
|
page read and write
|
||
|
1D5A663C000
|
heap
|
page read and write
|
||
|
ACB000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
1D5A5F11000
|
heap
|
page read and write
|
||
|
1D5A65EF000
|
heap
|
page read and write
|
||
|
A50000
|
heap
|
page read and write
|
||
|
1D5A3D0E000
|
heap
|
page read and write
|
||
|
452A8FB000
|
stack
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
1D5A663A000
|
heap
|
page read and write
|
||
|
1D5A663A000
|
heap
|
page read and write
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
1D5A666C000
|
heap
|
page read and write
|
||
|
2DA4000
|
direct allocation
|
page read and write
|
||
|
1D5A5F06000
|
heap
|
page read and write
|
||
|
1D5A5B38000
|
heap
|
page read and write
|
||
|
1D5A3CFC000
|
heap
|
page read and write
|
||
|
1D5A5F21000
|
heap
|
page read and write
|
||
|
1D5A5F31000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
493D000
|
heap
|
page read and write
|
||
|
1D5A5F25000
|
heap
|
page read and write
|
||
|
1D5A5ED0000
|
heap
|
page read and write
|
||
|
1D5A5EFF000
|
heap
|
page read and write
|
||
|
1D5A5B32000
|
heap
|
page read and write
|
||
|
1D5A3CE7000
|
heap
|
page read and write
|
||
|
1D5A6606000
|
heap
|
page read and write
|
||
|
1D5A6654000
|
heap
|
page read and write
|
||
|
A94000
|
heap
|
page read and write
|
||
|
1D5A6660000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
2EA1000
|
heap
|
page read and write
|
||
|
1D5A3D40000
|
heap
|
page read and write
|
||
|
1D5A5F0B000
|
heap
|
page read and write
|
||
|
1D5A65C0000
|
heap
|
page read and write
|
||
|
1D5A5F2B000
|
heap
|
page read and write
|
||
|
452ABFE000
|
stack
|
page read and write
|
||
|
1D5A5F06000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
1D5A3CC1000
|
heap
|
page read and write
|
||
|
1D5A5F25000
|
heap
|
page read and write
|
||
|
4AD000
|
unkown
|
page readonly
|
||
|
1D5A3D04000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
AC3000
|
heap
|
page read and write
|
||
|
1D5A5F0A000
|
heap
|
page read and write
|
||
|
1D5A5F33000
|
heap
|
page read and write
|
||
|
AA8000
|
heap
|
page read and write
|
||
|
1D5A3D5D000
|
heap
|
page read and write
|
||
|
1D5A6663000
|
heap
|
page read and write
|
||
|
1D5A6650000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A5B49000
|
heap
|
page read and write
|
||
|
1D5A5F25000
|
heap
|
page read and write
|
||
|
1D5A3D01000
|
heap
|
page read and write
|
||
|
4908000
|
heap
|
page read and write
|
||
|
4529F94000
|
stack
|
page read and write
|
||
|
1D5A3CE7000
|
heap
|
page read and write
|
||
|
4AF9000
|
heap
|
page read and write
|
||
|
1D5A5EE3000
|
heap
|
page read and write
|
||
|
1D5A5780000
|
heap
|
page read and write
|
||
|
8BE000
|
stack
|
page read and write
|
||
|
1D5A3CE7000
|
heap
|
page read and write
|
||
|
1D5A6654000
|
heap
|
page read and write
|
||
|
1D5A5F20000
|
heap
|
page read and write
|
||
|
452A5FE000
|
stack
|
page read and write
|
||
|
1D5A5F25000
|
heap
|
page read and write
|
||
|
4C0000
|
unkown
|
page readonly
|
||
|
1D5A5F10000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
1D5A5F17000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A3C8A000
|
heap
|
page read and write
|
||
|
1D5A5F06000
|
heap
|
page read and write
|
||
|
1D5A5F0A000
|
heap
|
page read and write
|
||
|
1D5A666B000
|
heap
|
page read and write
|
||
|
190000
|
heap
|
page read and write
|
||
|
AE8000
|
heap
|
page read and write
|
||
|
1D5A5F33000
|
heap
|
page read and write
|
||
|
1D5A5D00000
|
heap
|
page read and write
|
||
|
1D5A6632000
|
heap
|
page read and write
|
||
|
ACF000
|
heap
|
page read and write
|
||
|
4846000
|
heap
|
page read and write
|
||
|
1D5A661B000
|
heap
|
page read and write
|
||
|
1D5A65F0000
|
heap
|
page read and write
|
||
|
1D5A5F1F000
|
heap
|
page read and write
|
||
|
1D5A6632000
|
heap
|
page read and write
|
||
|
1D5A5F20000
|
heap
|
page read and write
|
||
|
1B7000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
1D5A5F06000
|
heap
|
page read and write
|
||
|
1D5A5F21000
|
heap
|
page read and write
|
||
|
1D5A3C40000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
1D5A6663000
|
heap
|
page read and write
|
||
|
1D5A3C90000
|
heap
|
page read and write
|
||
|
1D5A3D4B000
|
heap
|
page read and write
|
||
|
1D5A3C95000
|
heap
|
page read and write
|
||
|
1D5A3CE7000
|
heap
|
page read and write
|
||
|
4843000
|
heap
|
page read and write
|
||
|
1D5A5FDE000
|
heap
|
page read and write
|
||
|
100000
|
heap
|
page read and write
|
||
|
1D5A66B2000
|
heap
|
page read and write
|
||
|
1D5A57B5000
|
heap
|
page read and write
|
||
|
1D5A65CB000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
AB7000
|
heap
|
page read and write
|
||
|
1D5A3C10000
|
heap
|
page read and write
|
||
|
1D5A5F36000
|
heap
|
page read and write
|
||
|
1D5A5F20000
|
heap
|
page read and write
|
||
|
4D4000
|
unkown
|
page read and write
|
||
|
1D5A5F3B000
|
heap
|
page read and write
|
||
|
1D5A60B0000
|
heap
|
page read and write
|
||
|
1D5A3D0F000
|
heap
|
page read and write
|
||
|
1D5A3CBF000
|
heap
|
page read and write
|
||
|
4C0000
|
unkown
|
page readonly
|
||
|
1D5A5F20000
|
heap
|
page read and write
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
1D5A665E000
|
heap
|
page read and write
|
||
|
1D5A660A000
|
heap
|
page read and write
|
||
|
1B0000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A5F15000
|
heap
|
page read and write
|
||
|
1D5A5FDE000
|
heap
|
page read and write
|
||
|
1D5A3C8F000
|
heap
|
page read and write
|
||
|
18E000
|
stack
|
page read and write
|
||
|
1D5A5F20000
|
heap
|
page read and write
|
||
|
1D5A3D5D000
|
heap
|
page read and write
|
||
|
F9E000
|
stack
|
page read and write
|
||
|
1D5A5F13000
|
heap
|
page read and write
|
||
|
1D5A5EF2000
|
heap
|
page read and write
|
||
|
1D5A3D40000
|
heap
|
page read and write
|
||
|
1D5A5F17000
|
heap
|
page read and write
|
||
|
1D5A6632000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
452A9FE000
|
stack
|
page read and write
|
||
|
1D5A5F20000
|
heap
|
page read and write
|
||
|
139F000
|
stack
|
page read and write
|
||
|
1D5A664F000
|
heap
|
page read and write
|
||
|
1D5A5F12000
|
heap
|
page read and write
|
||
|
1D5A5EF5000
|
heap
|
page read and write
|
||
|
1D5A666C000
|
heap
|
page read and write
|
||
|
1D5A5F20000
|
heap
|
page read and write
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
1D5A3C9F000
|
heap
|
page read and write
|
||
|
AC8000
|
heap
|
page read and write
|
||
|
1D5A5F21000
|
heap
|
page read and write
|
||
|
1D5A5F17000
|
heap
|
page read and write
|
||
|
2D90000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
1D5A64C0000
|
heap
|
page read and write
|
||
|
1D5A5B4B000
|
heap
|
page read and write
|
||
|
1D5A6653000
|
heap
|
page read and write
|
||
|
1D5A665E000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
452A6FF000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
452AEFF000
|
stack
|
page read and write
|
||
|
1D5A65ED000
|
heap
|
page read and write
|
||
|
1D5A6668000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
1D5A666C000
|
heap
|
page read and write
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
1D5A3CB1000
|
heap
|
page read and write
|
||
|
1D5A5F16000
|
heap
|
page read and write
|
||
|
1D5A3ECA000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A6659000
|
heap
|
page read and write
|
||
|
1D5A5F17000
|
heap
|
page read and write
|
||
|
1D5A3D40000
|
heap
|
page read and write
|
||
|
8CF000
|
stack
|
page read and write
|
||
|
4AC3000
|
heap
|
page read and write
|
||
|
1D5A3C60000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
1B5000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
ACB000
|
heap
|
page read and write
|
||
|
1D5A5FDE000
|
heap
|
page read and write
|
||
|
2EA0000
|
heap
|
page read and write
|
||
|
4DE000
|
unkown
|
page readonly
|
||
|
8C5000
|
stack
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A65C1000
|
heap
|
page read and write
|
||
|
1D5A3EC5000
|
heap
|
page read and write
|
||
|
452ACFB000
|
stack
|
page read and write
|
||
|
4D4000
|
unkown
|
page write copy
|
||
|
9C0000
|
heap
|
page read and write
|
||
|
1D5A6653000
|
heap
|
page read and write
|
||
|
1D5A5EE0000
|
heap
|
page read and write
|
||
|
4937000
|
heap
|
page read and write
|
||
|
1D5A5FDE000
|
heap
|
page read and write
|
||
|
1D5A6604000
|
heap
|
page read and write
|
||
|
1D5A3C90000
|
heap
|
page read and write
|
||
|
1D5A5F15000
|
heap
|
page read and write
|
||
|
1D5A57B0000
|
heap
|
page read and write
|
||
|
1D5A6654000
|
heap
|
page read and write
|
||
|
1D5A65C9000
|
heap
|
page read and write
|
||
|
1D5A6632000
|
heap
|
page read and write
|
||
|
8EC000
|
stack
|
page read and write
|
||
|
452AAFF000
|
stack
|
page read and write
|
||
|
1D5A3CAD000
|
heap
|
page read and write
|
||
|
1D5A6661000
|
heap
|
page read and write
|
||
|
1D5A5EC0000
|
heap
|
page read and write
|
||
|
1D5A5F25000
|
heap
|
page read and write
|
||
|
1D5A665F000
|
heap
|
page read and write
|
||
|
1D5A3C96000
|
heap
|
page read and write
|
||
|
1D5A661D000
|
heap
|
page read and write
|
||
|
1D5A5F21000
|
heap
|
page read and write
|
||
|
AA0000
|
heap
|
page read and write
|
||
|
1D5A5FDE000
|
heap
|
page read and write
|
||
|
1D5A5F25000
|
heap
|
page read and write
|
||
|
1D5A3CC1000
|
heap
|
page read and write
|
||
|
1D5A5F1F000
|
heap
|
page read and write
|
||
|
1D5A3CBF000
|
heap
|
page read and write
|
||
|
1D5A5F35000
|
heap
|
page read and write
|
||
|
1D5A5F36000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
4918000
|
heap
|
page read and write
|
||
|
1D5A3C8B000
|
heap
|
page read and write
|
||
|
1D5A663C000
|
heap
|
page read and write
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
1D5A5F21000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A3EC0000
|
heap
|
page read and write
|
||
|
8DF000
|
stack
|
page read and write
|
||
|
1D5A5F20000
|
heap
|
page read and write
|
||
|
1D5A661D000
|
heap
|
page read and write
|
||
|
1D5A3C20000
|
heap
|
page read and write
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
1D5A6661000
|
heap
|
page read and write
|
||
|
1D5A5F05000
|
heap
|
page read and write
|
||
|
1D5A3D19000
|
heap
|
page read and write
|
||
|
452A2FE000
|
stack
|
page read and write
|
||
|
1D5A3CAE000
|
heap
|
page read and write
|
||
|
1D5A5D20000
|
heap
|
page read and write
|
||
|
1D5A662E000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A6659000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1490000
|
heap
|
page read and write
|
||
|
8DB000
|
stack
|
page read and write
|
||
|
1D5A65C1000
|
heap
|
page read and write
|
||
|
1D5A3D4D000
|
heap
|
page read and write
|
||
|
AD0000
|
heap
|
page read and write
|
||
|
1D5A5F29000
|
heap
|
page read and write
|
||
|
1D5A5F25000
|
heap
|
page read and write
|
||
|
4910000
|
heap
|
page read and write
|
||
|
1D5A5B32000
|
heap
|
page read and write
|
||
|
1D5A665B000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A5F25000
|
heap
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A6659000
|
heap
|
page read and write
|
||
|
1D5A5FDE000
|
heap
|
page read and write
|
||
|
2DA0000
|
direct allocation
|
page read and write
|
||
|
1D5A662F000
|
heap
|
page read and write
|
||
|
1D5A5F2B000
|
heap
|
page read and write
|
||
|
1D5A5F31000
|
heap
|
page read and write
|
||
|
1D5A3CAF000
|
heap
|
page read and write
|
||
|
8B3000
|
stack
|
page read and write
|
||
|
1D5A65C2000
|
heap
|
page read and write
|
||
|
1D5A5FDE000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
1D5A665B000
|
heap
|
page read and write
|
||
|
A90000
|
heap
|
page read and write
|
||
|
1D5A6604000
|
heap
|
page read and write
|
||
|
1D5A5F36000
|
heap
|
page read and write
|
||
|
1D5A3D13000
|
heap
|
page read and write
|
||
|
1D5A667C000
|
heap
|
page read and write
|
||
|
2D40000
|
trusted library allocation
|
page read and write
|
||
|
1D5A6656000
|
heap
|
page read and write
|
||
|
1D5A60C0000
|
trusted library allocation
|
page read and write
|
||
|
1D5A6665000
|
heap
|
page read and write
|
||
|
452A3FE000
|
stack
|
page read and write
|
||
|
1D5A6672000
|
heap
|
page read and write
|
||
|
1D5A5F06000
|
heap
|
page read and write
|
||
|
1D5A5F31000
|
heap
|
page read and write
|
||
|
1D5A57E0000
|
heap
|
page read and write
|
||
|
1D5A5F06000
|
heap
|
page read and write
|
||
|
1D5A6653000
|
heap
|
page read and write
|
||
|
2C51000
|
heap
|
page read and write
|
||
|
452A7FF000
|
stack
|
page read and write
|
||
|
4DE000
|
unkown
|
page readonly
|
||
|
1D5A3C9E000
|
heap
|
page read and write
|
||
|
1D5A5FDE000
|
heap
|
page read and write
|
||
|
2C40000
|
heap
|
page read and write
|
||
|
4AD1000
|
heap
|
page read and write
|
||
|
1D5A666E000
|
heap
|
page read and write
|
||
|
1D5A663C000
|
heap
|
page read and write
|
There are 303 hidden memdumps, click here to show them.