Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
rOr__amentoprim.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\konked
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\rOr__amentoprim.exe
|
"C:\Users\user\Desktop\rOr__amentoprim.exe"
|
|
|
|
C:\Windows\SysWOW64\svchost.exe
|
"C:\Users\user\Desktop\rOr__amentoprim.exe"
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
8E0000
|
direct allocation
|
page read and write
|
|
|
|
400000
|
system
|
page execute and read and write
|
|
|
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
1328000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C02000
|
heap
|
page read and write
|
||
|
36D1000
|
direct allocation
|
page execute and read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2990000
|
direct allocation
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2E05000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2F01000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
3123000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
359E000
|
direct allocation
|
page execute and read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
EDC000
|
unkown
|
page write copy
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
3400000
|
direct allocation
|
page execute and read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
312B000
|
heap
|
page read and write
|
||
|
339E000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
760000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
3742000
|
direct allocation
|
page execute and read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
1328000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2E17000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
72D000
|
stack
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
1387000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
352D000
|
direct allocation
|
page execute and read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
3529000
|
direct allocation
|
page execute and read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2E12000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
332D000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2990000
|
direct allocation
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
3329000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
2E00000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
34A8000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
8A0000
|
direct allocation
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
36CD000
|
direct allocation
|
page execute and read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
890000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
1379000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
3000000
|
heap
|
page read and write
|
||
|
EAC000
|
unkown
|
page readonly
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
E10000
|
unkown
|
page readonly
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2E05000
|
heap
|
page read and write
|
||
|
ED2000
|
unkown
|
page readonly
|
||
|
32AA000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
3079000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
2990000
|
direct allocation
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
307A000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
2990000
|
direct allocation
|
page read and write
|
||
|
3578000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
1378000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
7B0000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
3201000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
137A000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2990000
|
direct allocation
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
780000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2E17000
|
heap
|
page read and write
|
||
|
6ED000
|
stack
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
8DE000
|
stack
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
E11000
|
unkown
|
page execute read
|
||
|
139B000
|
heap
|
page read and write
|
||
|
3200000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
EE4000
|
unkown
|
page readonly
|
||
|
139B000
|
heap
|
page read and write
|
||
|
31FF000
|
stack
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
2C13000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
EE0000
|
unkown
|
page write copy
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
97E000
|
stack
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
30FF000
|
stack
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2C00000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
2990000
|
direct allocation
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
There are 394 hidden memdumps, click here to show them.