Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\AsOpenFile.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\Tusindtallig.Syn
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\prowl.Dgn
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsgC6C9.tmp\System.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
modified
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
|
C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Software\Procentuelles232\Frafaldsprocents\Forarbejdendes\Inceration
|
Pythius
|
||
|
HKEY_CURRENT_USER\Software\Sammenlgningens\Tjurunga\Pakkeforsendelserne\Thiophthene
|
Etaper
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Compoundedness
|
Caballo
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Bekvemmeligheder
|
Hovedbibliotekerne
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
30F0000
|
direct allocation
|
page execute and read and write
|
|
|
|
694000
|
heap
|
page read and write
|
|
|
|
1DAAB080000
|
trusted library allocation
|
page read and write
|
||
|
1DAAA15C000
|
heap
|
page read and write
|
||
|
580000
|
trusted library allocation
|
page read and write
|
||
|
435000
|
unkown
|
page read and write
|
||
|
690000
|
heap
|
page read and write
|
||
|
1DAAA167000
|
heap
|
page read and write
|
||
|
6AE000
|
heap
|
page read and write
|
||
|
3EFD000
|
stack
|
page read and write
|
||
|
1DAAB020000
|
trusted library allocation
|
page read and write
|
||
|
19A000
|
stack
|
page read and write
|
||
|
216E000
|
stack
|
page read and write
|
||
|
1DAAA240000
|
trusted library allocation
|
page read and write
|
||
|
1DAAA150000
|
heap
|
page read and write
|
||
|
1DAAA14E000
|
heap
|
page read and write
|
||
|
1DAAA100000
|
heap
|
page read and write
|
||
|
25DF000
|
stack
|
page read and write
|
||
|
1DAAB000000
|
trusted library allocation
|
page read and write
|
||
|
67B000
|
heap
|
page read and write
|
||
|
2184000
|
heap
|
page read and write
|
||
|
650000
|
heap
|
page read and write
|
||
|
1DAAA290000
|
trusted library allocation
|
page read and write
|
||
|
30721F9000
|
stack
|
page read and write
|
||
|
1DAAB010000
|
heap
|
page readonly
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
2190000
|
heap
|
page read and write
|
||
|
1DAAA0D0000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
422000
|
unkown
|
page read and write
|
||
|
1DAAA260000
|
trusted library allocation
|
page read and write
|
||
|
467000
|
unkown
|
page read and write
|
||
|
40A000
|
unkown
|
page read and write
|
||
|
1DAAA289000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
620000
|
heap
|
page read and write
|
||
|
2196000
|
heap
|
page read and write
|
||
|
2180000
|
heap
|
page read and write
|
||
|
1DAAA14E000
|
heap
|
page read and write
|
||
|
307227E000
|
stack
|
page read and write
|
||
|
657000
|
heap
|
page read and write
|
||
|
68B000
|
heap
|
page read and write
|
||
|
3020000
|
trusted library allocation
|
page read and write
|
||
|
3071DAC000
|
stack
|
page read and write
|
||
|
10003000
|
unkown
|
page readonly
|
||
|
400000
|
unkown
|
page readonly
|
||
|
42D000
|
unkown
|
page read and write
|
||
|
10005000
|
unkown
|
page readonly
|
||
|
3030000
|
trusted library allocation
|
page read and write
|
||
|
469000
|
unkown
|
page readonly
|
||
|
35C0000
|
trusted library allocation
|
page read and write
|
||
|
30000
|
heap
|
page read and write
|
||
|
1DAAADD0000
|
trusted library allocation
|
page read and write
|
||
|
2199000
|
heap
|
page read and write
|
||
|
1DAAA0B0000
|
heap
|
page read and write
|
||
|
99000
|
stack
|
page read and write
|
||
|
1DAAA14E000
|
heap
|
page read and write
|
||
|
30722F9000
|
stack
|
page read and write
|
||
|
212E000
|
stack
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
590000
|
heap
|
page read and write
|
||
|
26DF000
|
stack
|
page read and write
|
||
|
469000
|
unkown
|
page readonly
|
||
|
1DAAA108000
|
heap
|
page read and write
|
||
|
3DFD000
|
stack
|
page read and write
|
||
|
600000
|
heap
|
page read and write
|
||
|
1DAA9F70000
|
heap
|
page read and write
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
400000
|
unkown
|
page readonly
|
||
|
408000
|
unkown
|
page readonly
|
||
|
2712000
|
trusted library allocation
|
page read and write
|
||
|
307217D000
|
stack
|
page read and write
|
||
|
1DAA9F80000
|
trusted library allocation
|
page read and write
|
||
|
1DAAA285000
|
heap
|
page read and write
|
||
|
1DAAB030000
|
trusted library allocation
|
page read and write
|
||
|
427000
|
unkown
|
page read and write
|
||
|
1DAAA280000
|
heap
|
page read and write
|
||
|
3040000
|
trusted library allocation
|
page read and write
|
||
|
2714000
|
trusted library allocation
|
page read and write
|
||
|
1DAAA250000
|
trusted library allocation
|
page read and write
|
||
|
1DAAA146000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
595000
|
heap
|
page read and write
|
There are 73 hidden memdumps, click here to show them.