Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Gxm6KI51wl.exe
|
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Gxm6KI51wl.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\d3d9x.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Gxm6KI51wl.exe
|
"C:\Users\user\Desktop\Gxm6KI51wl.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
bg.microsoft.map.fastly.net
|
199.232.214.172
|
||
|
time.windows.com
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
802000
|
remote allocation
|
page execute and read and write
|
|
|
|
6D86B000
|
unkown
|
page read and write
|
|
|
|
AB8000
|
heap
|
page read and write
|
||
|
4CD0000
|
trusted library allocation
|
page read and write
|
||
|
880000
|
heap
|
page read and write
|
||
|
E07000
|
trusted library allocation
|
page execute and read and write
|
||
|
DAE000
|
stack
|
page read and write
|
||
|
4DF0000
|
heap
|
page read and write
|
||
|
E6E000
|
stack
|
page read and write
|
||
|
8C0000
|
heap
|
page read and write
|
||
|
AF1000
|
heap
|
page read and write
|
||
|
E70000
|
heap
|
page read and write
|
||
|
4DFC000
|
heap
|
page read and write
|
||
|
63C000
|
stack
|
page read and write
|
||
|
4EF0000
|
trusted library allocation
|
page read and write
|
||
|
2C0000
|
unkown
|
page readonly
|
||
|
2C2000
|
unkown
|
page readonly
|
||
|
4C72000
|
trusted library allocation
|
page read and write
|
||
|
47AE000
|
stack
|
page read and write
|
||
|
2870000
|
trusted library allocation
|
page read and write
|
||
|
27E0000
|
trusted library allocation
|
page read and write
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
AC7000
|
heap
|
page read and write
|
||
|
4DF8000
|
heap
|
page read and write
|
||
|
5960000
|
heap
|
page read and write
|
||
|
4C6D000
|
trusted library allocation
|
page read and write
|
||
|
A3B000
|
heap
|
page read and write
|
||
|
6D841000
|
unkown
|
page execute read
|
||
|
538D000
|
stack
|
page read and write
|
||
|
4F70000
|
trusted library section
|
page readonly
|
||
|
48FC000
|
stack
|
page read and write
|
||
|
800000
|
remote allocation
|
page execute and read and write
|
||
|
50C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
27F0000
|
heap
|
page execute and read and write
|
||
|
4C10000
|
trusted library allocation
|
page read and write
|
||
|
A18000
|
heap
|
page read and write
|
||
|
4FB5000
|
heap
|
page read and write
|
||
|
6A50000
|
heap
|
page read and write
|
||
|
B90000
|
trusted library allocation
|
page read and write
|
||
|
4C95000
|
trusted library allocation
|
page read and write
|
||
|
B77000
|
trusted library allocation
|
page execute and read and write
|
||
|
A10000
|
heap
|
page read and write
|
||
|
5950000
|
heap
|
page read and write
|
||
|
4FA0000
|
trusted library allocation
|
page read and write
|
||
|
A5F000
|
heap
|
page read and write
|
||
|
A33000
|
trusted library allocation
|
page execute and read and write
|
||
|
A4E000
|
heap
|
page read and write
|
||
|
4D20000
|
heap
|
page read and write
|
||
|
A80000
|
heap
|
page read and write
|
||
|
B4D000
|
trusted library allocation
|
page execute and read and write
|
||
|
4C44000
|
trusted library allocation
|
page read and write
|
||
|
85E000
|
remote allocation
|
page execute and read and write
|
||
|
724D000
|
stack
|
page read and write
|
||
|
F90000
|
trusted library allocation
|
page read and write
|
||
|
523E000
|
stack
|
page read and write
|
||
|
4C80000
|
trusted library allocation
|
page read and write
|
||
|
AB3000
|
heap
|
page read and write
|
||
|
4F6B000
|
stack
|
page read and write
|
||
|
EBD000
|
stack
|
page read and write
|
||
|
738E000
|
stack
|
page read and write
|
||
|
B66000
|
trusted library allocation
|
page execute and read and write
|
||
|
50B0000
|
trusted library allocation
|
page read and write
|
||
|
7130000
|
trusted library allocation
|
page read and write
|
||
|
4CAE000
|
trusted library allocation
|
page read and write
|
||
|
A0E000
|
stack
|
page read and write
|
||
|
25DE000
|
stack
|
page read and write
|
||
|
9CE000
|
stack
|
page read and write
|
||
|
7140000
|
heap
|
page execute and read and write
|
||
|
4FC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
980000
|
heap
|
page read and write
|
||
|
4C40000
|
trusted library allocation
|
page read and write
|
||
|
DEF000
|
stack
|
page read and write
|
||
|
4C4B000
|
trusted library allocation
|
page read and write
|
||
|
A34000
|
trusted library allocation
|
page read and write
|
||
|
4F00000
|
trusted library allocation
|
page read and write
|
||
|
A4E000
|
heap
|
page read and write
|
||
|
9CE000
|
stack
|
page read and write
|
||
|
BA0000
|
heap
|
page read and write
|
||
|
4FB0000
|
heap
|
page read and write
|
||
|
A40000
|
heap
|
page read and write
|
||
|
B6A000
|
trusted library allocation
|
page execute and read and write
|
||
|
B5D000
|
trusted library allocation
|
page execute and read and write
|
||
|
41B3000
|
trusted library allocation
|
page read and write
|
||
|
4D5E000
|
stack
|
page read and write
|
||
|
6D840000
|
unkown
|
page readonly
|
||
|
26BB000
|
trusted library allocation
|
page read and write
|
||
|
26A0000
|
heap
|
page execute and read and write
|
||
|
850000
|
heap
|
page read and write
|
||
|
770000
|
heap
|
page read and write
|
||
|
AB7000
|
heap
|
page read and write
|
||
|
4CA0000
|
trusted library allocation
|
page read and write
|
||
|
597000
|
stack
|
page read and write
|
||
|
27D0000
|
trusted library allocation
|
page read and write
|
||
|
728E000
|
stack
|
page read and write
|
||
|
89E000
|
stack
|
page read and write
|
||
|
3F68000
|
trusted library allocation
|
page read and write
|
||
|
4C61000
|
trusted library allocation
|
page read and write
|
||
|
B30000
|
trusted library allocation
|
page read and write
|
||
|
4C5E000
|
trusted library allocation
|
page read and write
|
||
|
276E000
|
stack
|
page read and write
|
||
|
2801000
|
trusted library allocation
|
page read and write
|
||
|
985000
|
heap
|
page read and write
|
||
|
527E000
|
stack
|
page read and write
|
||
|
FA7000
|
heap
|
page read and write
|
||
|
F80000
|
trusted library allocation
|
page execute and read and write
|
||
|
EC0000
|
heap
|
page read and write
|
||
|
36B5000
|
trusted library allocation
|
page read and write
|
||
|
AAA000
|
heap
|
page read and write
|
||
|
ABD000
|
heap
|
page read and write
|
||
|
26BF000
|
trusted library allocation
|
page read and write
|
||
|
5280000
|
heap
|
page read and write
|
||
|
4DD0000
|
trusted library allocation
|
page execute and read and write
|
||
|
4E32000
|
heap
|
page read and write
|
||
|
714F000
|
stack
|
page read and write
|
||
|
AD3000
|
heap
|
page read and write
|
||
|
6D864000
|
unkown
|
page readonly
|
||
|
73B000
|
stack
|
page read and write
|
||
|
A6B000
|
heap
|
page read and write
|
||
|
2690000
|
trusted library allocation
|
page read and write
|
||
|
A0E000
|
stack
|
page read and write
|
||
|
B44000
|
trusted library allocation
|
page read and write
|
||
|
26B1000
|
trusted library allocation
|
page read and write
|
||
|
B7B000
|
trusted library allocation
|
page execute and read and write
|
||
|
863F000
|
stack
|
page read and write
|
||
|
6D8EF000
|
unkown
|
page readonly
|
||
|
4B20000
|
heap
|
page read and write
|
||
|
4F80000
|
heap
|
page read and write
|
||
|
6D8E5000
|
unkown
|
page execute read
|
||
|
A2F000
|
heap
|
page read and write
|
||
|
718E000
|
stack
|
page read and write
|
||
|
4C66000
|
trusted library allocation
|
page read and write
|
||
|
27B0000
|
heap
|
page read and write
|
||
|
B60000
|
trusted library allocation
|
page read and write
|
||
|
26B9000
|
trusted library allocation
|
page read and write
|
||
|
51FE000
|
stack
|
page read and write
|
||
|
AC2000
|
heap
|
page read and write
|
||
|
853E000
|
stack
|
page read and write
|
||
|
B40000
|
trusted library allocation
|
page read and write
|
||
|
2680000
|
trusted library allocation
|
page execute and read and write
|
||
|
2660000
|
heap
|
page read and write
|
||
|
E0B000
|
trusted library allocation
|
page execute and read and write
|
||
|
711E000
|
stack
|
page read and write
|
||
|
4C90000
|
trusted library allocation
|
page read and write
|
||
|
36B1000
|
trusted library allocation
|
page read and write
|
||
|
A48000
|
heap
|
page read and write
|
||
|
4F90000
|
heap
|
page read and write
|
||
|
A20000
|
trusted library allocation
|
page read and write
|
||
|
B53000
|
trusted library allocation
|
page read and write
|
||
|
8C5000
|
heap
|
page read and write
|
||
|
CD4000
|
trusted library allocation
|
page read and write
|
||
|
27AC000
|
stack
|
page read and write
|
||
|
4C8F000
|
trusted library allocation
|
page read and write
|
||
|
A74000
|
heap
|
page read and write
|
||
|
CE0000
|
heap
|
page read and write
|
||
|
B43000
|
trusted library allocation
|
page execute and read and write
|
||
|
3801000
|
trusted library allocation
|
page read and write
|
||
|
6B60000
|
trusted library allocation
|
page execute and read and write
|
||
|
4FD0000
|
heap
|
page execute and read and write
|
||
|
4C4E000
|
trusted library allocation
|
page read and write
|
||
|
499000
|
stack
|
page read and write
|
||
|
B72000
|
trusted library allocation
|
page read and write
|
||
|
4AF0000
|
heap
|
page read and write
|
||
|
4DE0000
|
heap
|
page read and write
|
||
|
873E000
|
stack
|
page read and write
|
||
|
4CB0000
|
trusted library allocation
|
page read and write
|
||
|
CD0000
|
trusted library allocation
|
page read and write
|
||
|
F7E000
|
stack
|
page read and write
|
||
|
4B10000
|
heap
|
page read and write
|
||
|
4C5E000
|
stack
|
page read and write
|
||
|
CAE000
|
stack
|
page read and write
|
||
|
960000
|
heap
|
page read and write
|
||
|
4DE3000
|
heap
|
page read and write
|
||
|
4E0C000
|
heap
|
page read and write
|
There are 163 hidden memdumps, click here to show them.