Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\AsOpenFile.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\Tusindtallig.Syn
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Folkedansens\Suffigere\Glaucophane\prowl.Dgn
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nsq493.tmp\System.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
modified
|
||
|
C:\Users\user\AppData\Roaming\5D4ACB\B73EF6.lck
|
very short file (no magic)
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3425316567-2969588382-3778222414-1001\1b1d0082738e9f9011266f86ab9723d2_11389406-0377-47ed-98c7-d564e683c6eb
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
|
C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
|
|
|
|
C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
|
C:\Users\user\Desktop\REQUEST FOR OFFER 30-12-2022#U00b7pdf.exe
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 1980
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://157.245.36.27/~dokterpol/?page=2874
|
157.245.36.27
|
|
|
|
https://doc-0g-8k-docs.googleusercontent.com/%%doc-0g-8k-docs.googleusercontent.com
|
unknown
|
||
|
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
|
unknown
|
||
|
https://doc-0g-8k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/65eu063p0f9eoc2qkjfmonuuk5gkqmq4/1669764675000/03238822727237126472/*/1ZppbncXCwboWfcBo0A5zlqzevMjFwzpW?e=download&uuid=c4bc146b-22c6-4e17-89b8-c96a6eb96fab
|
142.250.185.161
|
||
|
https://drive.google.com/
|
unknown
|
||
|
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
|
unknown
|
||
|
https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external
|
unknown
|
||
|
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
|
unknown
|
||
|
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
|
unknown
|
||
|
https://doc-0g-8k-docs.googleusercontent.com/)
|
unknown
|
||
|
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
||
|
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
|
unknown
|
||
|
http://www.gopher.ftp://ftp.
|
unknown
|
||
|
https://doc-0g-8k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/65eu063p
|
unknown
|
||
|
https://doc-0g-8k-docs.googleusercontent.com/
|
unknown
|
There are 5 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
drive.google.com
|
142.250.185.238
|
||
|
googlehosted.l.googleusercontent.com
|
142.250.185.161
|
||
|
doc-0g-8k-docs.googleusercontent.com
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
157.245.36.27
|
unknown
|
United States
|
|
|
|
142.250.185.161
|
googlehosted.l.googleusercontent.com
|
United States
|
||
|
142.250.185.238
|
drive.google.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Procentuelles232\Frafaldsprocents\Forarbejdendes\Inceration
|
Pythius
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Sammenlgningens\Tjurunga\Pakkeforsendelserne\Thiophthene
|
Etaper
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Compoundedness
|
Caballo
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bekvemmeligheder
|
Hovedbibliotekerne
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7CC000
|
heap
|
page read and write
|
|
|
|
32D0000
|
direct allocation
|
page execute and read and write
|
|
|
|
1660000
|
remote allocation
|
page execute and read and write
|
|
|
|
2510000
|
trusted library allocation
|
page read and write
|
||
|
469000
|
unkown
|
page readonly
|
||
|
3420000
|
heap
|
page read and write
|
||
|
1984000
|
heap
|
page read and write
|
||
|
2295000
|
heap
|
page read and write
|
||
|
1F117D13000
|
heap
|
page read and write
|
||
|
1D49D000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
1D4A6000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
1A70000
|
trusted library allocation
|
page read and write
|
||
|
3AA0000
|
trusted library allocation
|
page read and write
|
||
|
5F2000
|
unkown
|
page write copy
|
||
|
1930000
|
heap
|
page read and write
|
||
|
3560000
|
trusted library allocation
|
page read and write
|
||
|
1F117D00000
|
heap
|
page read and write
|
||
|
427000
|
unkown
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
1D50E000
|
stack
|
page read and write
|
||
|
1F117A13000
|
unkown
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
23B0000
|
heap
|
page read and write
|
||
|
1981000
|
heap
|
page read and write
|
||
|
1F117A02000
|
unkown
|
page read and write
|
||
|
3B20000
|
trusted library allocation
|
page read and write
|
||
|
2299000
|
heap
|
page read and write
|
||
|
1F117B00000
|
trusted library allocation
|
page read and write
|
||
|
1D04F000
|
stack
|
page read and write
|
||
|
1BF0000
|
trusted library allocation
|
page read and write
|
||
|
2564000
|
heap
|
page read and write
|
||
|
1C50000
|
heap
|
page read and write
|
||
|
1985000
|
heap
|
page read and write
|
||
|
1F117D13000
|
heap
|
page read and write
|
||
|
1D4A0000
|
direct allocation
|
page read and write
|
||
|
1D26D000
|
stack
|
page read and write
|
||
|
57E000
|
stack
|
page read and write
|
||
|
3421000
|
heap
|
page read and write
|
||
|
20000
|
unclassified section
|
page readonly
|
||
|
226E000
|
stack
|
page read and write
|
||
|
469000
|
unkown
|
page readonly
|
||
|
1F117A2A000
|
heap
|
page read and write
|
||
|
5E8000
|
unkown
|
page write copy
|
||
|
1CB11000
|
heap
|
page read and write
|
||
|
1D22D000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
40A000
|
unkown
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
24D0000
|
trusted library allocation
|
page read and write
|
||
|
1860000
|
heap
|
page read and write
|
||
|
1995000
|
heap
|
page read and write
|
||
|
5EC000
|
unkown
|
page write copy
|
||
|
1D4B0000
|
direct allocation
|
page read and write
|
||
|
1D12E000
|
stack
|
page read and write
|
||
|
1943000
|
heap
|
page read and write
|
||
|
1A2E000
|
stack
|
page read and write
|
||
|
5BE000
|
stack
|
page read and write
|
||
|
198F000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
1D16F000
|
stack
|
page read and write
|
||
|
24BF000
|
stack
|
page read and write
|
||
|
1D0CE000
|
stack
|
page read and write
|
||
|
234E000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
1D2D0000
|
remote allocation
|
page read and write
|
||
|
1F117B40000
|
heap
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
1901000
|
heap
|
page read and write
|
||
|
1D4B0000
|
direct allocation
|
page read and write
|
||
|
1D2D0000
|
remote allocation
|
page read and write
|
||
|
1930000
|
heap
|
page read and write
|
||
|
1D0000
|
unclassified section
|
page readonly
|
||
|
A6F000
|
stack
|
page read and write
|
||
|
1C0000
|
remote allocation
|
page read and write
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
198F000
|
heap
|
page read and write
|
||
|
10005000
|
unkown
|
page readonly
|
||
|
469000
|
unkown
|
page readonly
|
||
|
469000
|
unkown
|
page readonly
|
||
|
7B3000
|
heap
|
page read and write
|
||
|
1925000
|
heap
|
page read and write
|
||
|
445D000
|
stack
|
page read and write
|
||
|
1D4C0000
|
direct allocation
|
page read and write
|
||
|
1943000
|
heap
|
page read and write
|
||
|
42D000
|
unkown
|
page read and write
|
||
|
193D000
|
heap
|
page read and write
|
||
|
1CF8E000
|
stack
|
page read and write
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
96E000
|
stack
|
page read and write
|
||
|
60000
|
direct allocation
|
page read and write
|
||
|
1D2D0000
|
remote allocation
|
page read and write
|
||
|
1F117A10000
|
unkown
|
page read and write
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
1933000
|
heap
|
page read and write
|
||
|
98000
|
stack
|
page read and write
|
||
|
1F117A00000
|
unkown
|
page read and write
|
||
|
75E000
|
stack
|
page read and write
|
||
|
1F117D02000
|
heap
|
page read and write
|
||
|
29B1000
|
trusted library allocation
|
page read and write
|
||
|
1C0000
|
remote allocation
|
page read and write
|
||
|
29AF000
|
stack
|
page read and write
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
1C5CEF9000
|
stack
|
page read and write
|
||
|
30000
|
heap
|
page read and write
|
||
|
29B3000
|
trusted library allocation
|
page read and write
|
||
|
1AEE000
|
stack
|
page read and write
|
||
|
30000
|
heap
|
page read and write
|
||
|
1984000
|
heap
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
408000
|
unkown
|
page readonly
|
||
|
1D60F000
|
stack
|
page read and write
|
||
|
1D34F000
|
stack
|
page read and write
|
||
|
770000
|
heap
|
page read and write
|
||
|
1C0000
|
remote allocation
|
page read and write
|
||
|
3449000
|
trusted library allocation
|
page read and write
|
||
|
2560000
|
heap
|
page read and write
|
||
|
71F000
|
stack
|
page read and write
|
||
|
192C000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
1CFCF000
|
stack
|
page read and write
|
||
|
649000
|
unkown
|
page write copy
|
||
|
401000
|
unkown
|
page execute read
|
||
|
778000
|
heap
|
page read and write
|
||
|
1D4C0000
|
direct allocation
|
page read and write
|
||
|
1D4B0000
|
direct allocation
|
page read and write
|
||
|
193C000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
18B8000
|
heap
|
page read and write
|
||
|
19EE000
|
stack
|
page read and write
|
||
|
1F117C00000
|
heap
|
page read and write
|
||
|
1D180000
|
heap
|
page read and write
|
||
|
1A6F000
|
stack
|
page read and write
|
||
|
10059000
|
trusted library allocation
|
page read and write
|
||
|
1F117C13000
|
heap
|
page read and write
|
||
|
610000
|
heap
|
page read and write
|
||
|
615000
|
heap
|
page read and write
|
||
|
2290000
|
heap
|
page read and write
|
||
|
422000
|
unkown
|
page read and write
|
||
|
1F117C02000
|
heap
|
page read and write
|
||
|
1D08E000
|
stack
|
page read and write
|
||
|
1943000
|
heap
|
page read and write
|
||
|
22A0000
|
heap
|
page read and write
|
||
|
1933000
|
heap
|
page read and write
|
||
|
1C0000
|
remote allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
1F117920000
|
trusted library allocation
|
page read and write
|
||
|
1CB11000
|
heap
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
1D4C0000
|
direct allocation
|
page read and write
|
||
|
1943000
|
heap
|
page read and write
|
||
|
1984000
|
heap
|
page read and write
|
||
|
1D4A0000
|
direct allocation
|
page read and write
|
||
|
1D4C0000
|
direct allocation
|
page read and write
|
||
|
79E000
|
heap
|
page read and write
|
||
|
10003000
|
unkown
|
page readonly
|
||
|
469000
|
unkown
|
page readonly
|
||
|
1F117950000
|
unclassified section
|
page readonly
|
||
|
5EA000
|
unkown
|
page write copy
|
||
|
1933000
|
heap
|
page read and write
|
||
|
1F117A38000
|
heap
|
page read and write
|
||
|
1D4B0000
|
direct allocation
|
page read and write
|
||
|
1F117B15000
|
trusted library allocation
|
page read and write
|
||
|
435000
|
unkown
|
page read and write
|
||
|
18B0000
|
heap
|
page read and write
|
||
|
192D000
|
heap
|
page read and write
|
||
|
1F117960000
|
unclassified section
|
page readonly
|
||
|
1984000
|
heap
|
page read and write
|
||
|
7D2000
|
heap
|
page read and write
|
||
|
1D0000
|
unclassified section
|
page readonly
|
||
|
1991000
|
heap
|
page read and write
|
||
|
1C0000
|
remote allocation
|
page read and write
|
||
|
5F0000
|
unkown
|
page write copy
|
||
|
1CB10000
|
heap
|
page read and write
|
||
|
20000
|
unclassified section
|
page readonly
|
||
|
1049000
|
unkown
|
page write copy
|
||
|
7AE000
|
heap
|
page read and write
|
||
|
1F1177B0000
|
heap
|
page read and write
|
||
|
1D4B0000
|
direct allocation
|
page read and write
|
||
|
1C10000
|
trusted library allocation
|
page read and write
|
||
|
1D4B0000
|
trusted library allocation
|
page read and write
|
||
|
1660000
|
remote allocation
|
page execute and read and write
|
||
|
435C000
|
stack
|
page read and write
|
||
|
1D00E000
|
stack
|
page read and write
|
||
|
626000
|
unkown
|
page write copy
|
||
|
1864000
|
heap
|
page read and write
|
||
|
469000
|
unkown
|
page readonly
|
||
|
1933000
|
heap
|
page read and write
|
||
|
1B2F000
|
stack
|
page read and write
|
||
|
1F117D02000
|
heap
|
page read and write
|
||
|
1F117D00000
|
heap
|
page read and write
|
||
|
467000
|
unkown
|
page read and write
|
||
|
18E5000
|
heap
|
page read and write
|
||
|
5C0000
|
trusted library allocation
|
page read and write
|
||
|
1C0000
|
remote allocation
|
page read and write
|
||
|
7B7000
|
heap
|
page read and write
|
||
|
471000
|
unkown
|
page write copy
|
||
|
1F117B02000
|
trusted library allocation
|
page read and write
|
||
|
5EE000
|
unkown
|
page write copy
|
||
|
1D30E000
|
stack
|
page read and write
|
||
|
1C5CB7F000
|
stack
|
page read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
1BB0000
|
trusted library allocation
|
page read and write
|
||
|
192A000
|
heap
|
page read and write
|
||
|
18AE000
|
stack
|
page read and write
|
||
|
1985000
|
heap
|
page read and write
|
||
|
1D39C000
|
stack
|
page read and write
|
||
|
19A000
|
stack
|
page read and write
|
||
|
18FA000
|
heap
|
page read and write
|
||
|
35A0000
|
trusted library allocation
|
page read and write
|
||
|
408000
|
unkown
|
page readonly
|
||
|
1D4AA000
|
direct allocation
|
page read and write
|
||
|
617000
|
heap
|
page read and write
|
||
|
10020000
|
trusted library allocation
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
40A000
|
unkown
|
page write copy
|
||
|
1C5C74D000
|
stack
|
page read and write
|
||
|
1F117820000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
400000
|
unkown
|
page readonly
|
There are 211 hidden memdumps, click here to show them.