Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
gjswzjReaderper-3.0.20.0830-setup.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
||
|
C:\Users\user\AppData\Local\Temp\nse9EE9.tmp\FindProcDLL.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nse9EE9.tmp\System.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nse9EE9.tmp\modern-header.bmp
|
PC bitmap, Windows 3.x format, 150 x 57 x 8, resolution 2834 x 2834 px/m, cbSize 9744, bits offset 1078
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nse9EE9.tmp\modern-wizard.bmp
|
PC bitmap, Windows 3.x format, 164 x 314 x 24, image size 154488, resolution 3780 x 3780 px/m, cbSize 154542, bits offset
54
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nse9EE9.tmp\nsDialogs.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\nse9EE9.tmp\nsExec.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\gjswzjReaderper-3.0.20.0830-setup.exe
|
"C:\Users\user\Desktop\gjswzjReaderper-3.0.20.0830-setup.exe"
|
||
|
C:\Windows\SysWOW64\taskkill.exe
|
taskkill /f /t /im gjswzjReader.exe
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
8EB000
|
heap
|
page read and write
|
||
|
2F7A000
|
heap
|
page read and write
|
||
|
314F000
|
stack
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
890000
|
heap
|
page read and write
|
||
|
29C0000
|
heap
|
page read and write
|
||
|
4E9F000
|
stack
|
page read and write
|
||
|
2F60000
|
heap
|
page read and write
|
||
|
2F8D000
|
heap
|
page read and write
|
||
|
2F7A000
|
heap
|
page read and write
|
||
|
5D1000
|
unkown
|
page readonly
|
||
|
2F85000
|
heap
|
page read and write
|
||
|
904000
|
heap
|
page read and write
|
||
|
4F60000
|
heap
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
2F94000
|
heap
|
page read and write
|
||
|
2E10000
|
heap
|
page read and write
|
||
|
28D0000
|
direct allocation
|
page read and write
|
||
|
2EA0000
|
heap
|
page read and write
|
||
|
412000
|
unkown
|
page read and write
|
||
|
6EE0D000
|
unkown
|
page read and write
|
||
|
916000
|
heap
|
page read and write
|
||
|
2FAB000
|
heap
|
page read and write
|
||
|
2B6C000
|
stack
|
page read and write
|
||
|
6C0000
|
heap
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
710000
|
heap
|
page read and write
|
||
|
218E000
|
stack
|
page read and write
|
||
|
914000
|
heap
|
page read and write
|
||
|
8BA000
|
heap
|
page read and write
|
||
|
2F7D000
|
heap
|
page read and write
|
||
|
2FBD000
|
heap
|
page read and write
|
||
|
2FA8000
|
heap
|
page read and write
|
||
|
2F88000
|
heap
|
page read and write
|
||
|
2F7E000
|
heap
|
page read and write
|
||
|
2A80000
|
heap
|
page read and write
|
||
|
4E5E000
|
stack
|
page read and write
|
||
|
4F1F000
|
stack
|
page read and write
|
||
|
2F94000
|
heap
|
page read and write
|
||
|
6EDF0000
|
unkown
|
page readonly
|
||
|
2A51000
|
unkown
|
page execute read
|
||
|
921000
|
heap
|
page read and write
|
||
|
2A56000
|
unkown
|
page readonly
|
||
|
2F5C000
|
heap
|
page read and write
|
||
|
2F5C000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
2E9E000
|
unkown
|
page read and write
|
||
|
2A91000
|
heap
|
page read and write
|
||
|
2284000
|
heap
|
page read and write
|
||
|
2A84000
|
heap
|
page read and write
|
||
|
4F30000
|
heap
|
page read and write
|
||
|
98000
|
stack
|
page read and write
|
||
|
2FA2000
|
heap
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
2FBF000
|
heap
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
2F91000
|
heap
|
page read and write
|
||
|
955000
|
heap
|
page read and write
|
||
|
5D1000
|
unkown
|
page readonly
|
||
|
900000
|
heap
|
page read and write
|
||
|
2F96000
|
heap
|
page read and write
|
||
|
2ED0000
|
heap
|
page read and write
|
||
|
2F87000
|
heap
|
page read and write
|
||
|
90F000
|
heap
|
page read and write
|
||
|
28F0000
|
heap
|
page read and write
|
||
|
31F6000
|
heap
|
page read and write
|
||
|
2BAC000
|
stack
|
page read and write
|
||
|
2F93000
|
heap
|
page read and write
|
||
|
28F4000
|
heap
|
page read and write
|
||
|
2F90000
|
heap
|
page read and write
|
||
|
41E000
|
unkown
|
page read and write
|
||
|
92F000
|
heap
|
page read and write
|
||
|
469000
|
unkown
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
2F7A000
|
heap
|
page read and write
|
||
|
8FB000
|
heap
|
page read and write
|
||
|
21DE000
|
stack
|
page read and write
|
||
|
2F48000
|
heap
|
page read and write
|
||
|
2FB9000
|
heap
|
page read and write
|
||
|
6EE0F000
|
unkown
|
page readonly
|
||
|
2A50000
|
unkown
|
page readonly
|
||
|
2270000
|
heap
|
page read and write
|
||
|
2F84000
|
heap
|
page read and write
|
||
|
2E5D000
|
unkown
|
page read and write
|
||
|
715000
|
heap
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
909000
|
heap
|
page read and write
|
||
|
2280000
|
heap
|
page read and write
|
||
|
954000
|
heap
|
page read and write
|
||
|
2F40000
|
heap
|
page read and write
|
||
|
27CE000
|
stack
|
page read and write
|
||
|
2F60000
|
heap
|
page read and write
|
||
|
4EDE000
|
stack
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
10005000
|
unkown
|
page readonly
|
||
|
2F1E000
|
stack
|
page read and write
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
19A000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
408000
|
unkown
|
page readonly
|
||
|
8B0000
|
heap
|
page read and write
|
||
|
8FB000
|
heap
|
page read and write
|
||
|
31F0000
|
heap
|
page read and write
|
||
|
8FB000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2F6A000
|
heap
|
page read and write
|
||
|
2FAA000
|
heap
|
page read and write
|
||
|
8FB000
|
heap
|
page read and write
|
||
|
31CF000
|
stack
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2F89000
|
heap
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
935000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
2ED5000
|
heap
|
page read and write
|
||
|
2A53000
|
unkown
|
page readonly
|
||
|
2FA4000
|
heap
|
page read and write
|
||
|
40A000
|
unkown
|
page read and write
|
||
|
2F94000
|
heap
|
page read and write
|
||
|
2F82000
|
heap
|
page read and write
|
||
|
6EE06000
|
unkown
|
page readonly
|
||
|
318E000
|
stack
|
page read and write
|
||
|
28CF000
|
stack
|
page read and write
|
||
|
21E5000
|
heap
|
page read and write
|
||
|
2900000
|
direct allocation
|
page read and write
|
||
|
2FAE000
|
heap
|
page read and write
|
||
|
2FBA000
|
heap
|
page read and write
|
||
|
8BE000
|
heap
|
page read and write
|
||
|
2FB1000
|
heap
|
page read and write
|
||
|
10003000
|
unkown
|
page readonly
|
||
|
2F7A000
|
heap
|
page read and write
|
||
|
2F5E000
|
heap
|
page read and write
|
||
|
2F94000
|
heap
|
page read and write
|
||
|
910000
|
heap
|
page read and write
|
||
|
2A90000
|
heap
|
page read and write
|
||
|
717000
|
heap
|
page read and write
|
||
|
6EDF1000
|
unkown
|
page execute read
|
||
|
2F69000
|
heap
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
2F88000
|
heap
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
935000
|
heap
|
page read and write
|
||
|
2FA0000
|
heap
|
page read and write
|
||
|
911000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
21E0000
|
heap
|
page read and write
|
There are 138 hidden memdumps, click here to show them.