Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SharkHCShark.exe
|
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SharkHCShark.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\d3d9x.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\SharkHCShark.exe
|
"C:\Users\user\Desktop\SharkHCShark.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
||
|
fp2e7a.wpc.phicdn.net
|
192.229.221.95
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
402000
|
remote allocation
|
page execute and read and write
|
|
|
|
6D41A000
|
unkown
|
page read and write
|
|
|
|
184E000
|
stack
|
page read and write
|
||
|
FC0000
|
heap
|
page read and write
|
||
|
56FE000
|
heap
|
page read and write
|
||
|
2CE1000
|
trusted library allocation
|
page read and write
|
||
|
7E0F000
|
stack
|
page read and write
|
||
|
1600000
|
heap
|
page read and write
|
||
|
2D56000
|
trusted library allocation
|
page read and write
|
||
|
167C000
|
heap
|
page read and write
|
||
|
E70000
|
heap
|
page read and write
|
||
|
15B4000
|
trusted library allocation
|
page read and write
|
||
|
42B5000
|
trusted library allocation
|
page read and write
|
||
|
F13000
|
heap
|
page read and write
|
||
|
51D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
D27000
|
heap
|
page read and write
|
||
|
7BC0000
|
trusted library allocation
|
page read and write
|
||
|
2D51000
|
trusted library allocation
|
page read and write
|
||
|
51E0000
|
trusted library allocation
|
page read and write
|
||
|
D10000
|
heap
|
page read and write
|
||
|
29CD000
|
trusted library allocation
|
page execute and read and write
|
||
|
8B90000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A8B000
|
stack
|
page read and write
|
||
|
5600000
|
heap
|
page read and write
|
||
|
ECC000
|
unkown
|
page readonly
|
||
|
F29000
|
heap
|
page read and write
|
||
|
162B000
|
heap
|
page read and write
|
||
|
51B0000
|
heap
|
page read and write
|
||
|
514D000
|
trusted library allocation
|
page read and write
|
||
|
EE8000
|
heap
|
page read and write
|
||
|
15EB000
|
trusted library allocation
|
page execute and read and write
|
||
|
F15000
|
heap
|
page read and write
|
||
|
57EF000
|
stack
|
page read and write
|
||
|
E4D000
|
stack
|
page read and write
|
||
|
8CEE000
|
stack
|
page read and write
|
||
|
29D6000
|
trusted library allocation
|
page execute and read and write
|
||
|
29DA000
|
trusted library allocation
|
page execute and read and write
|
||
|
15E0000
|
trusted library allocation
|
page read and write
|
||
|
55C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A00000
|
trusted library allocation
|
page read and write
|
||
|
2AC0000
|
trusted library allocation
|
page read and write
|
||
|
17FF000
|
stack
|
page read and write
|
||
|
526B000
|
stack
|
page read and write
|
||
|
F1D000
|
heap
|
page read and write
|
||
|
D20000
|
heap
|
page read and write
|
||
|
2A4E000
|
stack
|
page read and write
|
||
|
E98000
|
heap
|
page read and write
|
||
|
15E7000
|
trusted library allocation
|
page execute and read and write
|
||
|
55F0000
|
heap
|
page read and write
|
||
|
160E000
|
heap
|
page read and write
|
||
|
31A0000
|
heap
|
page read and write
|
||
|
29B3000
|
trusted library allocation
|
page execute and read and write
|
||
|
2BA0000
|
trusted library allocation
|
page read and write
|
||
|
5800000
|
trusted library allocation
|
page read and write
|
||
|
29C3000
|
trusted library allocation
|
page read and write
|
||
|
18F0000
|
heap
|
page read and write
|
||
|
12FB000
|
stack
|
page read and write
|
||
|
5141000
|
trusted library allocation
|
page read and write
|
||
|
5624000
|
heap
|
page read and write
|
||
|
1450000
|
heap
|
page read and write
|
||
|
29D0000
|
trusted library allocation
|
page read and write
|
||
|
4DDD000
|
stack
|
page read and write
|
||
|
51C0000
|
trusted library allocation
|
page read and write
|
||
|
1634000
|
heap
|
page read and write
|
||
|
29E0000
|
trusted library allocation
|
page read and write
|
||
|
30DE000
|
stack
|
page read and write
|
||
|
F5C000
|
stack
|
page read and write
|
||
|
53AE000
|
stack
|
page read and write
|
||
|
512E000
|
trusted library allocation
|
page read and write
|
||
|
29EB000
|
trusted library allocation
|
page execute and read and write
|
||
|
ECC000
|
heap
|
page read and write
|
||
|
F6B000
|
heap
|
page read and write
|
||
|
512B000
|
trusted library allocation
|
page read and write
|
||
|
8B7E000
|
stack
|
page read and write
|
||
|
5273000
|
heap
|
page read and write
|
||
|
D30000
|
heap
|
page read and write
|
||
|
553D000
|
stack
|
page read and write
|
||
|
56F0000
|
heap
|
page read and write
|
||
|
159E000
|
stack
|
page read and write
|
||
|
5146000
|
trusted library allocation
|
page read and write
|
||
|
6D3F1000
|
unkown
|
page execute read
|
||
|
318E000
|
stack
|
page read and write
|
||
|
55D0000
|
trusted library allocation
|
page read and write
|
||
|
E22000
|
unkown
|
page readonly
|
||
|
6D3F0000
|
unkown
|
page readonly
|
||
|
32AE000
|
stack
|
page read and write
|
||
|
32B1000
|
trusted library allocation
|
page read and write
|
||
|
29E7000
|
trusted library allocation
|
page execute and read and write
|
||
|
2AB0000
|
trusted library allocation
|
page read and write
|
||
|
FE0000
|
heap
|
page read and write
|
||
|
5160000
|
trusted library allocation
|
page read and write
|
||
|
2BB0000
|
trusted library allocation
|
page execute and read and write
|
||
|
8A7E000
|
stack
|
page read and write
|
||
|
7D0D000
|
stack
|
page read and write
|
||
|
32BB000
|
trusted library allocation
|
page read and write
|
||
|
51C2000
|
trusted library allocation
|
page read and write
|
||
|
EB4000
|
heap
|
page read and write
|
||
|
2ADF000
|
trusted library allocation
|
page read and write
|
||
|
15B3000
|
trusted library allocation
|
page execute and read and write
|
||
|
F35000
|
heap
|
page read and write
|
||
|
1495000
|
heap
|
page read and write
|
||
|
8D2E000
|
stack
|
page read and write
|
||
|
8F6F000
|
stack
|
page read and write
|
||
|
32B9000
|
trusted library allocation
|
page read and write
|
||
|
314E000
|
stack
|
page read and write
|
||
|
2CDE000
|
stack
|
page read and write
|
||
|
2B9C000
|
trusted library allocation
|
page read and write
|
||
|
7C00000
|
heap
|
page execute and read and write
|
||
|
29A0000
|
trusted library allocation
|
page read and write
|
||
|
2BC5000
|
trusted library allocation
|
page read and write
|
||
|
E50000
|
heap
|
page read and write
|
||
|
5420000
|
heap
|
page read and write
|
||
|
29B0000
|
trusted library allocation
|
page read and write
|
||
|
8E6E000
|
stack
|
page read and write
|
||
|
6D48B000
|
unkown
|
page execute read
|
||
|
D35000
|
heap
|
page read and write
|
||
|
2BD0000
|
heap
|
page execute and read and write
|
||
|
32BF000
|
trusted library allocation
|
page read and write
|
||
|
2AD0000
|
trusted library allocation
|
page read and write
|
||
|
10CD000
|
stack
|
page read and write
|
||
|
2BC0000
|
trusted library allocation
|
page read and write
|
||
|
3CE1000
|
trusted library allocation
|
page read and write
|
||
|
73E2000
|
trusted library allocation
|
page read and write
|
||
|
E90000
|
heap
|
page read and write
|
||
|
140E000
|
stack
|
page read and write
|
||
|
CF7000
|
stack
|
page read and write
|
||
|
6D495000
|
unkown
|
page readonly
|
||
|
F23000
|
heap
|
page read and write
|
||
|
1626000
|
heap
|
page read and write
|
||
|
5620000
|
heap
|
page read and write
|
||
|
1800000
|
trusted library allocation
|
page read and write
|
||
|
15C4000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
5225000
|
heap
|
page read and write
|
||
|
5220000
|
heap
|
page read and write
|
||
|
29E2000
|
trusted library allocation
|
page read and write
|
||
|
5124000
|
trusted library allocation
|
page read and write
|
||
|
45E000
|
remote allocation
|
page execute and read and write
|
||
|
FD0000
|
heap
|
page read and write
|
||
|
6D413000
|
unkown
|
page readonly
|
||
|
29B4000
|
trusted library allocation
|
page read and write
|
||
|
2AA0000
|
trusted library allocation
|
page read and write
|
||
|
7BBE000
|
stack
|
page read and write
|
||
|
55E0000
|
heap
|
page read and write
|
||
|
5210000
|
trusted library section
|
page readonly
|
||
|
1490000
|
heap
|
page read and write
|
||
|
5270000
|
heap
|
page read and write
|
||
|
3190000
|
heap
|
page execute and read and write
|
||
|
5410000
|
heap
|
page read and write
|
||
|
5120000
|
trusted library allocation
|
page read and write
|
||
|
2AE0000
|
heap
|
page read and write
|
||
|
2B92000
|
trusted library allocation
|
page read and write
|
||
|
3100000
|
trusted library allocation
|
page read and write
|
||
|
8E2E000
|
stack
|
page read and write
|
||
|
513E000
|
trusted library allocation
|
page read and write
|
||
|
108E000
|
stack
|
page read and write
|
||
|
30E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1642000
|
heap
|
page read and write
|
||
|
42B1000
|
trusted library allocation
|
page read and write
|
||
|
15A0000
|
trusted library allocation
|
page read and write
|
||
|
11DF000
|
stack
|
page read and write
|
||
|
4B5B000
|
trusted library allocation
|
page read and write
|
||
|
30F0000
|
trusted library allocation
|
page read and write
|
||
|
9A9000
|
stack
|
page read and write
|
||
|
8BEE000
|
stack
|
page read and write
|
||
|
15C0000
|
trusted library allocation
|
page read and write
|
||
|
2A90000
|
trusted library allocation
|
page execute and read and write
|
||
|
E20000
|
unkown
|
page readonly
|
||
|
144E000
|
stack
|
page read and write
|
||
|
5430000
|
heap
|
page execute and read and write
|
||
|
10D0000
|
heap
|
page read and write
|
||
|
29BD000
|
trusted library allocation
|
page execute and read and write
|
||
|
5152000
|
trusted library allocation
|
page read and write
|
There are 163 hidden memdumps, click here to show them.