Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
r8gcHFIf3x.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Roaming\svchost.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
|
CSV text
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Oct 31 18:08:58
2024, mtime=Thu Oct 31 18:08:58 2024, atime=Thu Oct 31 18:08:58 2024, length=334336, window=hide
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\r8gcHFIf3x.exe
|
"C:\Users\user\Desktop\r8gcHFIf3x.exe"
|
|
|
|
C:\Users\user\AppData\Roaming\svchost.exe
|
"C:\Users\user\AppData\Roaming\svchost.exe"
|
|
|
|
C:\Users\user\AppData\Roaming\svchost.exe
|
"C:\Users\user\AppData\Roaming\svchost.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
23.ip.gl.ply.gg
|
|
||
|
127.0.0.1
|
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
23.ip.gl.ply.gg
|
147.185.221.23
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
147.185.221.23
|
23.ip.gl.ply.gg
|
United States
|
|
|
|
127.0.0.1
|
unknown
|
unknown
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
svchost
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
13251000
|
trusted library allocation
|
page read and write
|
|
|
|
F22000
|
unkown
|
page readonly
|
|
|
|
2BAC000
|
trusted library allocation
|
page read and write
|
||
|
13241000
|
trusted library allocation
|
page read and write
|
||
|
12FF000
|
stack
|
page read and write
|
||
|
1610000
|
heap
|
page read and write
|
||
|
1326000
|
heap
|
page read and write
|
||
|
138E000
|
heap
|
page read and write
|
||
|
17BE000
|
stack
|
page read and write
|
||
|
160E000
|
stack
|
page read and write
|
||
|
9B0000
|
trusted library allocation
|
page read and write
|
||
|
14F0000
|
heap
|
page read and write
|
||
|
7FFD9B820000
|
trusted library allocation
|
page read and write
|
||
|
FD0000
|
heap
|
page execute and read and write
|
||
|
1102000
|
heap
|
page read and write
|
||
|
E00000
|
heap
|
page read and write
|
||
|
1BC00000
|
heap
|
page execute and read and write
|
||
|
1C1AE000
|
stack
|
page read and write
|
||
|
1C7FF000
|
stack
|
page read and write
|
||
|
7FFD9B794000
|
trusted library allocation
|
page read and write
|
||
|
AF4000
|
stack
|
page read and write
|
||
|
A41000
|
heap
|
page read and write
|
||
|
1329A000
|
trusted library allocation
|
page read and write
|
||
|
C2D000
|
heap
|
page read and write
|
||
|
A2D000
|
heap
|
page read and write
|
||
|
970000
|
heap
|
page read and write
|
||
|
C3F000
|
heap
|
page read and write
|
||
|
9F0000
|
heap
|
page execute and read and write
|
||
|
1C2B0000
|
heap
|
page read and write
|
||
|
7FFD9B932000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B794000
|
trusted library allocation
|
page read and write
|
||
|
3444000
|
trusted library allocation
|
page read and write
|
||
|
3130000
|
heap
|
page read and write
|
||
|
12BA8000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B7A4000
|
trusted library allocation
|
page read and write
|
||
|
3241000
|
trusted library allocation
|
page read and write
|
||
|
AC6000
|
heap
|
page read and write
|
||
|
F0F000
|
stack
|
page read and write
|
||
|
F74000
|
unkown
|
page readonly
|
||
|
2BB1000
|
trusted library allocation
|
page read and write
|
||
|
1CB9A000
|
stack
|
page read and write
|
||
|
7FFD9B850000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B876000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B793000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C790000
|
heap
|
page read and write
|
||
|
3063000
|
trusted library allocation
|
page read and write
|
||
|
12BA1000
|
trusted library allocation
|
page read and write
|
||
|
B02000
|
heap
|
page read and write
|
||
|
1B5C6000
|
heap
|
page read and write
|
||
|
1360000
|
heap
|
page read and write
|
||
|
1CAFE000
|
stack
|
page read and write
|
||
|
7FFD9B7A0000
|
trusted library allocation
|
page read and write
|
||
|
1BEAE000
|
stack
|
page read and write
|
||
|
1002000
|
heap
|
page read and write
|
||
|
C41000
|
heap
|
page read and write
|
||
|
A0B000
|
heap
|
page read and write
|
||
|
F80000
|
heap
|
page read and write
|
||
|
1C6FF000
|
stack
|
page read and write
|
||
|
7FF414870000
|
trusted library allocation
|
page execute and read and write
|
||
|
129A8000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B8B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1880000
|
heap
|
page read and write
|
||
|
1CA9C000
|
stack
|
page read and write
|
||
|
A4B000
|
heap
|
page read and write
|
||
|
7FFD9B793000
|
trusted library allocation
|
page execute and read and write
|
||
|
A13000
|
heap
|
page read and write
|
||
|
FCE000
|
stack
|
page read and write
|
||
|
1C72E000
|
stack
|
page read and write
|
||
|
138C000
|
heap
|
page read and write
|
||
|
29AC000
|
trusted library allocation
|
page read and write
|
||
|
1102000
|
heap
|
page read and write
|
||
|
7FFD9B82C000
|
trusted library allocation
|
page execute and read and write
|
||
|
C24000
|
heap
|
page read and write
|
||
|
1B270000
|
trusted library allocation
|
page read and write
|
||
|
3030000
|
trusted library allocation
|
page read and write
|
||
|
1300000
|
heap
|
page read and write
|
||
|
9D0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B876000
|
trusted library allocation
|
page execute and read and write
|
||
|
A28000
|
heap
|
page read and write
|
||
|
7FFD9B783000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B912000
|
trusted library allocation
|
page read and write
|
||
|
1C53F000
|
stack
|
page read and write
|
||
|
1C9FE000
|
stack
|
page read and write
|
||
|
3060000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B773000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B7B0000
|
trusted library allocation
|
page read and write
|
||
|
1AE1D000
|
stack
|
page read and write
|
||
|
1352000
|
heap
|
page read and write
|
||
|
7FFD9B790000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B7AD000
|
trusted library allocation
|
page execute and read and write
|
||
|
1350000
|
heap
|
page read and write
|
||
|
7FFD9B8B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
A26000
|
heap
|
page read and write
|
||
|
C13000
|
heap
|
page read and write
|
||
|
12BA3000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B7EC000
|
trusted library allocation
|
page execute and read and write
|
||
|
3050000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B830000
|
trusted library allocation
|
page execute and read and write
|
||
|
CC3000
|
heap
|
page read and write
|
||
|
B00000
|
heap
|
page read and write
|
||
|
A46000
|
heap
|
page read and write
|
||
|
F10000
|
heap
|
page read and write
|
||
|
A38000
|
heap
|
page read and write
|
||
|
7FFD9B774000
|
trusted library allocation
|
page read and write
|
||
|
F50000
|
trusted library allocation
|
page read and write
|
||
|
1C5A4000
|
stack
|
page read and write
|
||
|
930000
|
heap
|
page read and write
|
||
|
1C8FE000
|
stack
|
page read and write
|
||
|
AD3000
|
heap
|
page read and write
|
||
|
2B9E000
|
stack
|
page read and write
|
||
|
560000
|
unkown
|
page readonly
|
||
|
A00000
|
heap
|
page read and write
|
||
|
3120000
|
heap
|
page execute and read and write
|
||
|
B20000
|
heap
|
page read and write
|
||
|
1BC10000
|
heap
|
page read and write
|
||
|
1320000
|
heap
|
page read and write
|
||
|
1885000
|
heap
|
page read and write
|
||
|
ECE000
|
stack
|
page read and write
|
||
|
2BA1000
|
trusted library allocation
|
page read and write
|
||
|
13E3000
|
heap
|
page read and write
|
||
|
2BAF000
|
trusted library allocation
|
page read and write
|
||
|
1C602000
|
heap
|
page read and write
|
||
|
7FFD9B826000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B79D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1AF2E000
|
stack
|
page read and write
|
||
|
C77000
|
heap
|
page read and write
|
||
|
960000
|
heap
|
page read and write
|
||
|
1C0FD000
|
stack
|
page read and write
|
||
|
13E1000
|
heap
|
page read and write
|
||
|
7FFD9B78D000
|
trusted library allocation
|
page execute and read and write
|
||
|
323E000
|
stack
|
page read and write
|
||
|
7FFD9B920000
|
trusted library allocation
|
page execute and read and write
|
||
|
AAC000
|
heap
|
page read and write
|
||
|
AA2000
|
heap
|
page read and write
|
||
|
950000
|
heap
|
page read and write
|
||
|
132C000
|
heap
|
page read and write
|
||
|
7FFD9B770000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B840000
|
trusted library allocation
|
page read and write
|
||
|
1C362000
|
heap
|
page read and write
|
||
|
7FFD9B780000
|
trusted library allocation
|
page read and write
|
||
|
C43000
|
heap
|
page read and write
|
||
|
C00000
|
heap
|
page read and write
|
||
|
9E0000
|
heap
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
C9A000
|
heap
|
page read and write
|
||
|
1C402000
|
heap
|
page read and write
|
||
|
7FFD9B79D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C0AE000
|
stack
|
page read and write
|
||
|
C38000
|
heap
|
page read and write
|
||
|
FD0000
|
heap
|
page read and write
|
||
|
1BFAE000
|
stack
|
page read and write
|
||
|
DCE000
|
stack
|
page read and write
|
||
|
7FFD9B932000
|
trusted library allocation
|
page read and write
|
||
|
1BC63000
|
heap
|
page read and write
|
||
|
A88000
|
heap
|
page read and write
|
||
|
F32000
|
unkown
|
page readonly
|
||
|
F70000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B7A4000
|
trusted library allocation
|
page read and write
|
||
|
C51000
|
heap
|
page read and write
|
||
|
F90000
|
heap
|
page execute and read and write
|
||
|
1AE20000
|
heap
|
page execute and read and write
|
||
|
129A3000
|
trusted library allocation
|
page read and write
|
||
|
A51000
|
heap
|
page read and write
|
||
|
7FFD9B7CC000
|
trusted library allocation
|
page execute and read and write
|
||
|
C11000
|
heap
|
page read and write
|
||
|
1393000
|
heap
|
page read and write
|
||
|
CB8000
|
heap
|
page read and write
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
134B000
|
heap
|
page read and write
|
||
|
177C000
|
stack
|
page read and write
|
||
|
7FFD9B7EC000
|
trusted library allocation
|
page execute and read and write
|
||
|
29A1000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B890000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C8FE000
|
stack
|
page read and write
|
||
|
13248000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B79D000
|
trusted library allocation
|
page execute and read and write
|
||
|
F20000
|
unkown
|
page readonly
|
||
|
1340000
|
heap
|
page read and write
|
||
|
1C99C000
|
stack
|
page read and write
|
||
|
C22000
|
heap
|
page read and write
|
||
|
1363000
|
heap
|
page read and write
|
||
|
C46000
|
heap
|
page read and write
|
||
|
C3C000
|
heap
|
page read and write
|
||
|
1BC60000
|
heap
|
page read and write
|
||
|
7FFD9B77D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1002000
|
heap
|
page read and write
|
||
|
129A1000
|
trusted library allocation
|
page read and write
|
||
|
D02000
|
heap
|
page read and write
|
||
|
1665000
|
heap
|
page read and write
|
||
|
8F4000
|
stack
|
page read and write
|
||
|
1630000
|
heap
|
page read and write
|
||
|
1660000
|
heap
|
page read and write
|
||
|
1B7CD000
|
stack
|
page read and write
|
||
|
7FFD9B7AD000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C2DF000
|
heap
|
page read and write
|
||
|
7FFD9B856000
|
trusted library allocation
|
page execute and read and write
|
||
|
12F4000
|
stack
|
page read and write
|
||
|
1C4AA000
|
stack
|
page read and write
|
||
|
A3E000
|
heap
|
page read and write
|
There are 189 hidden memdumps, click here to show them.