Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
Order_002376662-579588_Date 24082022.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
||
C:\Users\user\AppData\Local\Temp\nsb3C99.tmp\System.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
modified
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Forhaanet.Nab
|
ASCII text, with very long lines, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\GPUPowerSavingConfigEditor.dll
|
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\face-cool.png
|
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Kalligraferendes\Quantisers\Aqua_20.bmp
|
JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data,
big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Noneffervescently.Cre
|
data
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Tilegnelserne\Suppegrydernes79\iso_3166-1.json
|
UTF-8 Unicode text
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe
|
"C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe"
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://crl.certum.pl/ctnca2.crl0l
|
unknown
|
||
http://repository.certum.pl/ctnca2.cer09
|
unknown
|
||
http://crl.certum.pl/ctsca2021.crl0o
|
unknown
|
||
http://nsis.sf.net/NSIS_Error
|
unknown
|
||
http://repository.certum.pl/ctnca.cer09
|
unknown
|
||
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
||
http://repository.certum.pl/ctsca2021.cer0
|
unknown
|
||
http://crl.certum.pl/ctnca.crl0k
|
unknown
|
||
http://subca.ocsp-certum.com05
|
unknown
|
||
http://www.certum.pl/CPS0
|
unknown
|
||
http://subca.ocsp-certum.com02
|
unknown
|
||
http://subca.ocsp-certum.com01
|
unknown
|
There are 2 hidden URLs, click here to show them.
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Platooned\Ananthropism
|
Swithen
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Trakeotomis
|
Brndboringen
|
||
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fallalishly
|
Navigationsskoler
|
||
HKEY_CURRENT_USER\Software\Outsnores\Begre\Bonusernes\Skovdistrikts
|
Chold146
|
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
30C0000
|
direct allocation
|
page execute and read and write
|
||
7717B77000
|
stack
|
page read and write
|
||
1E962030000
|
heap
|
page read and write
|
||
13FFFA29000
|
heap
|
page read and write
|
||
7F8000
|
heap
|
page read and write
|
||
14000102000
|
heap
|
page read and write
|
||
24D2FB00000
|
heap
|
page read and write
|
||
7F2000
|
heap
|
page read and write
|
||
13FFF9F0000
|
trusted library allocation
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
24D2FA53000
|
heap
|
page read and write
|
||
14004F02000
|
heap
|
page read and write
|
||
C6CE7A000
|
stack
|
page read and write
|
||
78E000
|
stack
|
page read and write
|
||
7F5000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
1883A452000
|
heap
|
page read and write
|
||
14000118000
|
heap
|
page read and write
|
||
1883A44B000
|
heap
|
page read and write
|
||
14000015000
|
heap
|
page read and write
|
||
702E27F000
|
stack
|
page read and write
|
||
13FFFA13000
|
heap
|
page read and write
|
||
22F88254000
|
heap
|
page read and write
|
||
277A000
|
trusted library allocation
|
page read and write
|
||
702E577000
|
stack
|
page read and write
|
||
1883A421000
|
heap
|
page read and write
|
||
2424000
|
heap
|
page read and write
|
||
24D2F900000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
13FFFA79000
|
heap
|
page read and write
|
||
13FFF9C0000
|
heap
|
page read and write
|
||
14004E3D000
|
heap
|
page read and write
|
||
13FFFAA1000
|
heap
|
page read and write
|
||
14004EB7000
|
heap
|
page read and write
|
||
40A000
|
unkown
|
page write copy
|
||
239F000
|
stack
|
page read and write
|
||
1B8AEF9000
|
stack
|
page read and write
|
||
14005024000
|
trusted library allocation
|
page read and write
|
||
1883A44D000
|
heap
|
page read and write
|
||
24D2FA29000
|
heap
|
page read and write
|
||
1883A488000
|
heap
|
page read and write
|
||
14004DC0000
|
trusted library allocation
|
page read and write
|
||
C6D07F000
|
stack
|
page read and write
|
||
1883A43C000
|
heap
|
page read and write
|
||
24D2FA4B000
|
heap
|
page read and write
|
||
690127D000
|
stack
|
page read and write
|
||
C6CCF9000
|
stack
|
page read and write
|
||
14000BF1000
|
trusted library allocation
|
page read and write
|
||
24D2FB08000
|
heap
|
page read and write
|
||
690117F000
|
stack
|
page read and write
|
||
14004DF0000
|
trusted library allocation
|
page read and write
|
||
13FFFAB3000
|
heap
|
page read and write
|
||
69009DB000
|
stack
|
page read and write
|
||
24D2FB02000
|
heap
|
page read and write
|
||
14005004000
|
trusted library allocation
|
page read and write
|
||
24D2FA82000
|
heap
|
page read and write
|
||
14004DD0000
|
trusted library allocation
|
page read and write
|
||
2420000
|
heap
|
page read and write
|
||
C6C4F7000
|
stack
|
page read and write
|
||
1883A44C000
|
heap
|
page read and write
|
||
43C000
|
unkown
|
page readonly
|
||
1E962052000
|
heap
|
page read and write
|
||
14004E00000
|
heap
|
page read and write
|
||
1E96201F000
|
heap
|
page read and write
|
||
13FFF950000
|
heap
|
page read and write
|
||
1E961F10000
|
heap
|
page read and write
|
||
1883A467000
|
heap
|
page read and write
|
||
14004EAD000
|
heap
|
page read and write
|
||
13FFFAFE000
|
heap
|
page read and write
|
||
14004EFB000
|
heap
|
page read and write
|
||
C6CB7F000
|
stack
|
page read and write
|
||
702DFBD000
|
stack
|
page read and write
|
||
13FFFFD0000
|
trusted library section
|
page read and write
|
||
1883A508000
|
heap
|
page read and write
|
||
22F87FF0000
|
heap
|
page read and write
|
||
1883A449000
|
heap
|
page read and write
|
||
1E961F60000
|
heap
|
page read and write
|
||
13FFFA72000
|
heap
|
page read and write
|
||
771787F000
|
stack
|
page read and write
|
||
24D2FA52000
|
heap
|
page read and write
|
||
14004C30000
|
trusted library allocation
|
page read and write
|
||
1883A2F0000
|
heap
|
page read and write
|
||
24D2FA70000
|
heap
|
page read and write
|
||
1E962029000
|
heap
|
page read and write
|
||
3040000
|
trusted library allocation
|
page read and write
|
||
22F88202000
|
heap
|
page read and write
|
||
99000
|
stack
|
page read and write
|
||
14005090000
|
trusted library allocation
|
page read and write
|
||
1B8ADFE000
|
stack
|
page read and write
|
||
13FFFB26000
|
heap
|
page read and write
|
||
13FFF960000
|
heap
|
page read and write
|
||
24D2FA25000
|
heap
|
page read and write
|
||
13FFFA00000
|
heap
|
page read and write
|
||
24D2F970000
|
heap
|
page read and write
|
||
14004F00000
|
heap
|
page read and write
|
||
408000
|
unkown
|
page readonly
|
||
240D000
|
stack
|
page read and write
|
||
1B8AFFF000
|
stack
|
page read and write
|
||
14004DC0000
|
trusted library allocation
|
page read and write
|
||
426000
|
unkown
|
page read and write
|
||
1883A429000
|
heap
|
page read and write
|
||
1883A463000
|
heap
|
page read and write
|
||
14004EAA000
|
heap
|
page read and write
|
||
14005000000
|
trusted library allocation
|
page read and write
|
||
14004E4A000
|
heap
|
page read and write
|
||
14000000000
|
heap
|
page read and write
|
||
14000860000
|
trusted library section
|
page readonly
|
||
1883A3F0000
|
trusted library allocation
|
page read and write
|
||
14004E62000
|
heap
|
page read and write
|
||
1883A413000
|
heap
|
page read and write
|
||
7DF000
|
heap
|
page read and write
|
||
14004CA0000
|
trusted library allocation
|
page read and write
|
||
14004F06000
|
heap
|
page read and write
|
||
702DF3C000
|
stack
|
page read and write
|
||
1E961F00000
|
heap
|
page read and write
|
||
1883A465000
|
heap
|
page read and write
|
||
808000
|
heap
|
page read and write
|
||
1883A448000
|
heap
|
page read and write
|
||
2290000
|
heap
|
page read and write
|
||
22F88190000
|
remote allocation
|
page read and write
|
||
14000770000
|
trusted library allocation
|
page read and write
|
||
14000890000
|
trusted library section
|
page readonly
|
||
1883A280000
|
heap
|
page read and write
|
||
36BB000
|
stack
|
page read and write
|
||
C6C0AB000
|
stack
|
page read and write
|
||
22F88190000
|
remote allocation
|
page read and write
|
||
C6CBFE000
|
stack
|
page read and write
|
||
69010FD000
|
stack
|
page read and write
|
||
24D2FA4D000
|
heap
|
page read and write
|
||
1883A502000
|
heap
|
page read and write
|
||
22F88220000
|
heap
|
page read and write
|
||
1883A450000
|
heap
|
page read and write
|
||
14004DD0000
|
trusted library allocation
|
page read and write
|
||
22F8823D000
|
heap
|
page read and write
|
||
1883A500000
|
heap
|
page read and write
|
||
1E962027000
|
heap
|
page read and write
|
||
22F88200000
|
heap
|
page read and write
|
||
1883A476000
|
heap
|
page read and write
|
||
C6C6FA000
|
stack
|
page read and write
|
||
14005000000
|
trusted library allocation
|
page read and write
|
||
24D2FB13000
|
heap
|
page read and write
|
||
771797B000
|
stack
|
page read and write
|
||
6900E7E000
|
stack
|
page read and write
|
||
24D2FA4A000
|
heap
|
page read and write
|
||
C6CD7E000
|
stack
|
page read and write
|
||
5D0000
|
heap
|
page read and write
|
||
C6CAFF000
|
stack
|
page read and write
|
||
14000C13000
|
trusted library allocation
|
page read and write
|
||
6900EFC000
|
stack
|
page read and write
|
||
560000
|
trusted library allocation
|
page read and write
|
||
1B8B0FE000
|
stack
|
page read and write
|
||
43A000
|
unkown
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
14005120000
|
remote allocation
|
page read and write
|
||
22F88160000
|
trusted library allocation
|
page read and write
|
||
1B8A9FB000
|
stack
|
page read and write
|
||
14005021000
|
trusted library allocation
|
page read and write
|
||
24D2FA3C000
|
heap
|
page read and write
|
||
13FFFB02000
|
heap
|
page read and write
|
||
14004EA2000
|
heap
|
page read and write
|
||
22F88213000
|
heap
|
page read and write
|
||
24D2FA77000
|
heap
|
page read and write
|
||
140050E0000
|
trusted library allocation
|
page read and write
|
||
C6CA7F000
|
stack
|
page read and write
|
||
1883A513000
|
heap
|
page read and write
|
||
1883A46A000
|
heap
|
page read and write
|
||
13FFFB13000
|
heap
|
page read and write
|
||
10005000
|
unkown
|
page readonly
|
||
14000100000
|
heap
|
page read and write
|
||
14005120000
|
remote allocation
|
page read and write
|
||
14005008000
|
trusted library allocation
|
page read and write
|
||
7717C7E000
|
stack
|
page read and write
|
||
24D2FA4C000
|
heap
|
page read and write
|
||
14004EEE000
|
heap
|
page read and write
|
||
22F88000000
|
heap
|
page read and write
|
||
13FFFA94000
|
heap
|
page read and write
|
||
1883A481000
|
heap
|
page read and write
|
||
140050D0000
|
trusted library allocation
|
page read and write
|
||
14000113000
|
heap
|
page read and write
|
||
1E962002000
|
heap
|
page read and write
|
||
C6C9FF000
|
stack
|
page read and write
|
||
43C000
|
unkown
|
page readonly
|
||
77173BB000
|
stack
|
page read and write
|
||
14000870000
|
trusted library section
|
page readonly
|
||
30000
|
heap
|
page read and write
|
||
14004EA0000
|
heap
|
page read and write
|
||
702E77F000
|
stack
|
page read and write
|
||
13FFFA8D000
|
heap
|
page read and write
|
||
19A000
|
stack
|
page read and write
|
||
C6C7FF000
|
stack
|
page read and write
|
||
1883A44F000
|
heap
|
page read and write
|
||
24D2FA00000
|
heap
|
page read and write
|
||
10003000
|
unkown
|
page readonly
|
||
13FFFA3D000
|
heap
|
page read and write
|
||
24D2F9A0000
|
trusted library allocation
|
page read and write
|
||
14004C20000
|
trusted library allocation
|
page read and write
|
||
1883A426000
|
heap
|
page read and write
|
||
14005120000
|
remote allocation
|
page read and write
|
||
1E962045000
|
heap
|
page read and write
|
||
13FFFA9D000
|
heap
|
page read and write
|
||
7717D7E000
|
stack
|
page read and write
|
||
1E962102000
|
heap
|
page read and write
|
||
24D2FA49000
|
heap
|
page read and write
|
||
13FFFA77000
|
heap
|
page read and write
|
||
140008A0000
|
trusted library section
|
page readonly
|
||
1E96203C000
|
heap
|
page read and write
|
||
422000
|
unkown
|
page read and write
|
||
24D2F910000
|
heap
|
page read and write
|
||
1400500E000
|
trusted library allocation
|
page read and write
|
||
702E47B000
|
stack
|
page read and write
|
||
77176FD000
|
stack
|
page read and write
|
||
13FFFA26000
|
heap
|
page read and write
|
||
24D2FA13000
|
heap
|
page read and write
|
||
1E962A02000
|
trusted library allocation
|
page read and write
|
||
14000C10000
|
trusted library allocation
|
page read and write
|
||
1883AC02000
|
trusted library allocation
|
page read and write
|
||
14004E1D000
|
heap
|
page read and write
|
||
7DA000
|
heap
|
page read and write
|
||
1883A400000
|
heap
|
page read and write
|
||
14000002000
|
heap
|
page read and write
|
||
1883A290000
|
heap
|
page read and write
|
||
C6C5FB000
|
stack
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
73E000
|
stack
|
page read and write
|
||
24D2FA4F000
|
heap
|
page read and write
|
||
771767E000
|
stack
|
page read and write
|
||
702E67F000
|
stack
|
page read and write
|
||
5E0000
|
heap
|
page read and write
|
||
7717A7F000
|
stack
|
page read and write
|
||
7A0000
|
heap
|
page read and write
|
||
22F88229000
|
heap
|
page read and write
|
||
24D30402000
|
trusted library allocation
|
page read and write
|
||
14000880000
|
trusted library section
|
page readonly
|
||
1883A48E000
|
heap
|
page read and write
|
||
13FFFA7C000
|
heap
|
page read and write
|
||
22F8825C000
|
heap
|
page read and write
|
||
14005100000
|
trusted library allocation
|
page read and write
|
||
42A000
|
unkown
|
page read and write
|
||
7A7000
|
heap
|
page read and write
|
||
14004E12000
|
heap
|
page read and write
|
||
14000850000
|
trusted library section
|
page readonly
|
||
1E962000000
|
heap
|
page read and write
|
||
22F88302000
|
heap
|
page read and write
|
||
C6C8FB000
|
stack
|
page read and write
|
||
14000118000
|
heap
|
page read and write
|
||
14004F03000
|
heap
|
page read and write
|
||
408000
|
unkown
|
page readonly
|
||
13FFFA58000
|
heap
|
page read and write
|
||
1E962013000
|
heap
|
page read and write
|
||
1883A46B000
|
heap
|
page read and write
|
||
14004E2B000
|
heap
|
page read and write
|
||
1E961F90000
|
trusted library allocation
|
page read and write
|
||
69012FC000
|
stack
|
page read and write
|
||
24D2FA50000
|
heap
|
page read and write
|
||
40A000
|
unkown
|
page read and write
|
||
23C0000
|
trusted library allocation
|
page read and write
|
||
140050F0000
|
trusted library allocation
|
page read and write
|
||
22F88060000
|
heap
|
page read and write
|
||
14004DF0000
|
trusted library allocation
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
14000C20000
|
trusted library allocation
|
page read and write
|
||
7E3000
|
heap
|
page read and write
|
||
14004E55000
|
heap
|
page read and write
|
||
223F000
|
stack
|
page read and write
|
||
22F88190000
|
remote allocation
|
page read and write
|
||
13FFFA8F000
|
heap
|
page read and write
|
||
22F88A02000
|
trusted library allocation
|
page read and write
|
||
14006000000
|
heap
|
page read and write
|
||
14004EF3000
|
heap
|
page read and write
|
||
14004CB0000
|
trusted library allocation
|
page read and write
|
There are 260 hidden memdumps, click here to show them.