Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
pago12_14299038859.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\~DF56158A8C389C0AF7.TMP
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
 |
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\pago12_14299038859.exe
|
"C:\Users\user\Desktop\pago12_14299038859.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\subideal\Eyeliners
|
HARNISKKLDT
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4D20000
|
unkown
|
page execute and read and write
|
|
|
|
20E14CE1000
|
unkown
|
page read and write
|
|
|
|
7FF5AB560000
|
unkown image
|
page readonly
|
|
|
|
7DF5E91F2000
|
unkown image
|
page readonly
|
|
|
|
210F5113000
|
unkown
|
page read and write
|
|
|
|
18C757A0000
|
unkown image
|
page readonly
|
|
|
|
7DF5C06E0000
|
unkown image
|
page readonly
|
|
|
|
2100000
|
heap private
|
page read and write
|
|
|
|
7FF5AB5C8000
|
unkown image
|
page readonly
|
|
|
|
22135E4D000
|
unkown
|
page read and write
|
|
|
|
7FFC0000
|
unkown image
|
page readonly
|
|
|
|
22135E58000
|
unkown
|
page read and write
|
|
|
|
2462E850000
|
unkown image
|
page readonly
|
|
|
|
20E15561000
|
unkown
|
page read and write
|
|
|
|
7FF5AB175000
|
unkown image
|
page readonly
|
|
|
|
2462EBA0000
|
unkown image
|
page readonly
|
|
|
|
7FF58B3FE000
|
unkown image
|
page readonly
|
|
|
|
7DF5C06F0000
|
unkown image
|
page readonly
|
|
|
|
7FF53EE65000
|
unkown image
|
page readonly
|
|
|
|
7FF5AB513000
|
unkown image
|
page readonly
|
|
|
|
1A0000
|
unkown image
|
page readonly
|
|
|
|
7FFC2000
|
unkown image
|
page readonly
|
|
|
|
3C2A4FF000
|
stack
|
page read and write
|
|
|
|
7FF53EF51000
|
unkown image
|
page readonly
|
|
|
|
7FF5AB0CE000
|
unkown image
|
page readonly
|
|
|
|
7FF58B417000
|
unkown image
|
page readonly
|
|
|
|
2462E8E0000
|
unkown
|
page read and write
|
|
|
|
7FF5AB58F000
|
unkown image
|
page readonly
|
|
|
|
20E155A4000
|
unkown
|
page read and write
|
|
|
|
20E155A2000
|
unkown
|
page read and write
|
|
|
|
2EB0000
|
unkown image
|
page readonly
|
|
|
|
7FF5AB5D9000
|
unkown image
|
page readonly
|
|
|
|
7DF5C06D0000
|
unkown image
|
page readonly
|
|
|
|
D318C7F000
|
stack
|
page read and write
|
|
|
|
210F505F000
|
unkown
|
page read and write
|
|
|
|
210F5100000
|
unkown
|
page read and write
|
|
|
|
9EA487F000
|
stack
|
page read and write
|
|
|
|
7DF506AE0000
|
unkown image
|
page readonly
|
|
|
|
210F5000000
|
unkown
|
page read and write
|
|
|
|
2462E8D0000
|
unkown
|
page read and write
|
|
|
|
210F5013000
|
unkown
|
page read and write
|
|
|
|
20E15A02000
|
unkown
|
page read and write
|
|
|
|
7FF4F1851000
|
unkown image
|
page readonly
|
|
|
|
20E15A6A000
|
unkown
|
page read and write
|
|
|
|
1F0000
|
unkown
|
page read and write
|
|
|
|
2462E810000
|
heap private
|
page read and write
|
|
|
|
3C2AAF7000
|
stack
|
page read and write
|
|
|
|
2462E8DF000
|
unkown
|
page read and write
|
|
|
|
7FF4F199C000
|
unkown image
|
page readonly
|
|
|
|
20E14C4D000
|
unkown
|
page read and write
|
|
|
|
20E15530000
|
unkown
|
page read and write
|
|
|
|
7DF5C06D0000
|
unkown image
|
page readonly
|
|
|
|
22135CA0000
|
unkown image
|
page read and write
|
|
|
|
7FF4F19E6000
|
unkown image
|
page readonly
|
|
|
|
7FF4F196E000
|
unkown image
|
page readonly
|
|
|
|
7FF58B2A3000
|
unkown image
|
page readonly
|
|
|
|
2120000
|
unkown image
|
page read and write
|
|
|
|
22135CB0000
|
heap private
|
page read and write
|
|
|
|
210F5102000
|
unkown
|
page read and write
|
|
|
|
20E1555F000
|
unkown
|
page read and write
|
|
|
|
210F4F60000
|
unkown image
|
page readonly
|
|
|
|
22136602000
|
unkown
|
page read and write
|
|
|
|
7FFB0000
|
unkown image
|
page readonly
|
|
|
|
20E155C4000
|
unkown
|
page read and write
|
|
|
|
7FF5D40E6000
|
unkown image
|
page readonly
|
|
|
|
21E5000
|
heap private
|
page read and write
|
|
|
|
2070000
|
unkown
|
page execute read
|
|
|
|
40000
|
unkown image
|
page readonly
|
|
|
|
20F0000
|
unkown image
|
page readonly
|
|
|
|
20E14CA7000
|
unkown
|
page read and write
|
|
|
|
7FF5D3F51000
|
unkown image
|
page readonly
|
|
|
|
7FF5AB360000
|
unkown image
|
page readonly
|
|
|
|
7FF53EF4A000
|
unkown image
|
page readonly
|
|