Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\1vQ6RSHmz5.exe
|
"C:\Users\user\Desktop\1vQ6RSHmz5.exe"
|
 |
|
|
C:\Program Files (x86)\Internet Explorer\iexplore.exe
|
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
narutochwan.duckdns.org
|
|
||
|
http://176.223.134.190/
|
unknown
|
||
|
http://geoplugin.net/json.gp
|
unknown
|
||
|
http://176.223.134.190/:D
|
unknown
|
||
|
http://176.223.134.190/x/re.txt__vbaFreeVarList__vbaObjVarjC:
|
unknown
|
||
|
http://176.223.134.190/x/re.txt
|
unknown
|
||
|
http://geoplugin.net/json.gp/C
|
unknown
|
||
|
http://176.223.134.190:80/x/re.txt
|
unknown
|
||
|
http://176.223.134.190/mD
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
narutochwan.duckdns.org
|
91.92.242.76
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
91.92.242.76
|
narutochwan.duckdns.org
|
Bulgaria
|
|
|
|
176.223.134.190
|
unknown
|
Lithuania
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Rmc-1VT363
|
exepath
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\Rmc-1VT363
|
licence
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\Rmc-1VT363
|
time
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
C4B000
|
heap
|
page read and write
|
|
|
|
3051000
|
heap
|
page read and write
|
|
|
|
400000
|
remote allocation
|
page execute and read and write
|
|
|
|
453000
|
heap
|
page read and write
|
||
|
C00000
|
heap
|
page read and write
|
||
|
2080000
|
heap
|
page read and write
|
||
|
77E000
|
stack
|
page read and write
|
||
|
299E000
|
stack
|
page read and write
|
||
|
2070000
|
heap
|
page read and write
|
||
|
43A000
|
heap
|
page read and write
|
||
|
410000
|
heap
|
page read and write
|
||
|
48B000
|
heap
|
page read and write
|
||
|
2860000
|
heap
|
page read and write
|
||
|
73F000
|
stack
|
page read and write
|
||
|
51A000
|
heap
|
page read and write
|
||
|
2100000
|
remote allocation
|
page read and write
|
||
|
BB0000
|
heap
|
page read and write
|
||
|
430000
|
heap
|
page read and write
|
||
|
2120000
|
trusted library allocation
|
page read and write
|
||
|
2100000
|
remote allocation
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
49E000
|
heap
|
page read and write
|
||
|
BFE000
|
stack
|
page read and write
|
||
|
3141000
|
heap
|
page read and write
|
||
|
329F000
|
stack
|
page read and write
|
||
|
29DE000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
B40000
|
heap
|
page read and write
|
||
|
4A3000
|
heap
|
page read and write
|
||
|
474000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
77C000
|
stack
|
page read and write
|
||
|
2040000
|
trusted library allocation
|
page execute read
|
||
|
87F000
|
stack
|
page read and write
|
||
|
2C00000
|
heap
|
page read and write
|
||
|
420000
|
heap
|
page read and write
|
||
|
2F4E000
|
stack
|
page read and write
|
||
|
512F000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
51A000
|
heap
|
page read and write
|
||
|
2B2E000
|
stack
|
page read and write
|
||
|
46E000
|
heap
|
page read and write
|
||
|
B3E000
|
stack
|
page read and write
|
||
|
3050000
|
heap
|
page read and write
|
||
|
20D0000
|
heap
|
page read and write
|
||
|
2F0F000
|
stack
|
page read and write
|
||
|
1E0000
|
heap
|
page read and write
|
||
|
2A1E000
|
stack
|
page read and write
|
||
|
2110000
|
heap
|
page read and write
|
||
|
474000
|
heap
|
page read and write
|
||
|
2A29000
|
heap
|
page read and write
|
||
|
48B000
|
heap
|
page read and write
|
||
|
49E000
|
heap
|
page read and write
|
||
|
48B000
|
heap
|
page read and write
|
||
|
46B000
|
heap
|
page read and write
|
||
|
1E5000
|
heap
|
page read and write
|
||
|
404000
|
unkown
|
page read and write
|
||
|
518000
|
heap
|
page read and write
|
||
|
32B0000
|
direct allocation
|
page execute and read and write
|
||
|
45D000
|
heap
|
page read and write
|
||
|
4A0F000
|
stack
|
page read and write
|
||
|
20C0000
|
heap
|
page read and write
|
||
|
AFC000
|
stack
|
page read and write
|
||
|
46B000
|
heap
|
page read and write
|
||
|
43E000
|
heap
|
page read and write
|
||
|
304F000
|
stack
|
page read and write
|
||
|
49E000
|
heap
|
page read and write
|
||
|
DBE000
|
stack
|
page read and write
|
||
|
48D000
|
heap
|
page read and write
|
||
|
51A000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
C40000
|
heap
|
page read and write
|
||
|
474000
|
remote allocation
|
page execute and read and write
|
||
|
453000
|
heap
|
page read and write
|
||
|
319E000
|
stack
|
page read and write
|
||
|
7E0000
|
heap
|
page read and write
|
||
|
502F000
|
stack
|
page read and write
|
||
|
2E0F000
|
stack
|
page read and write
|
||
|
48F000
|
heap
|
page read and write
|
||
|
405000
|
unkown
|
page readonly
|
||
|
470000
|
heap
|
page read and write
|
||
|
4A4000
|
heap
|
page read and write
|
||
|
474000
|
heap
|
page read and write
|
||
|
4A4E000
|
stack
|
page read and write
|
||
|
45A000
|
heap
|
page read and write
|
||
|
7F0000
|
heap
|
page readonly
|
||
|
2D0D000
|
stack
|
page read and write
|
||
|
44C000
|
heap
|
page read and write
|
||
|
2A20000
|
heap
|
page read and write
|
||
|
405000
|
unkown
|
page readonly
|
||
|
2B6E000
|
stack
|
page read and write
|
||
|
478000
|
remote allocation
|
page execute and read and write
|
||
|
306F000
|
stack
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
4AE0000
|
heap
|
page read and write
|
||
|
518000
|
heap
|
page read and write
|
||
|
63E000
|
stack
|
page read and write
|
||
|
BB5000
|
heap
|
page read and write
|
||
|
2100000
|
remote allocation
|
page read and write
|
There are 89 hidden memdumps, click here to show them.