Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
b34J4bxnmN.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Roaming\app
|
Unicode text, UTF-8 (with BOM) text, with no line terminators
|
dropped
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\b34J4bxnmN.exe
|
"C:\Users\user\Desktop\b34J4bxnmN.exe"
|
|
|
|
C:\Windows\SysWOW64\netsh.exe
|
netsh firewall add allowedprogram "C:\Users\user\Desktop\b34J4bxnmN.exe" "b34J4bxnmN.exe" ENABLE
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
147.185.221.18
|
unknown
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Environment
|
SEE_MASK_NOZONECHECKS
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
31B1000
|
trusted library allocation
|
page read and write
|
|
|
|
41B9000
|
trusted library allocation
|
page read and write
|
|
|
|
5810000
|
trusted library section
|
page read and write
|
|
|
|
11D5000
|
heap
|
page read and write
|
||
|
2FB0000
|
trusted library allocation
|
page read and write
|
||
|
51FC000
|
heap
|
page read and write
|
||
|
520A000
|
heap
|
page read and write
|
||
|
C53000
|
heap
|
page read and write
|
||
|
5990000
|
trusted library allocation
|
page read and write
|
||
|
B3B000
|
stack
|
page read and write
|
||
|
C5C000
|
heap
|
page read and write
|
||
|
13DE000
|
stack
|
page read and write
|
||
|
CA6000
|
heap
|
page read and write
|
||
|
51CF000
|
stack
|
page read and write
|
||
|
1390000
|
heap
|
page read and write
|
||
|
C5C000
|
heap
|
page read and write
|
||
|
5920000
|
heap
|
page execute and read and write
|
||
|
6190000
|
trusted library allocation
|
page execute and read and write
|
||
|
C55000
|
heap
|
page read and write
|
||
|
1340000
|
heap
|
page read and write
|
||
|
18C0000
|
trusted library allocation
|
page read and write
|
||
|
65EE000
|
stack
|
page read and write
|
||
|
2F08000
|
trusted library allocation
|
page read and write
|
||
|
C59000
|
heap
|
page read and write
|
||
|
5208000
|
heap
|
page read and write
|
||
|
6F2E000
|
stack
|
page read and write
|
||
|
1562000
|
trusted library allocation
|
page read and write
|
||
|
C2A000
|
heap
|
page read and write
|
||
|
CC6000
|
heap
|
page read and write
|
||
|
1368000
|
heap
|
page read and write
|
||
|
5A80000
|
trusted library allocation
|
page execute and read and write
|
||
|
C81000
|
heap
|
page read and write
|
||
|
3020000
|
trusted library allocation
|
page read and write
|
||
|
51F1000
|
heap
|
page read and write
|
||
|
C15000
|
heap
|
page read and write
|
||
|
C45000
|
heap
|
page read and write
|
||
|
C5E000
|
heap
|
page read and write
|
||
|
C22000
|
heap
|
page read and write
|
||
|
155A000
|
trusted library allocation
|
page execute and read and write
|
||
|
3488000
|
trusted library allocation
|
page read and write
|
||
|
CC5000
|
heap
|
page read and write
|
||
|
C4F000
|
heap
|
page read and write
|
||
|
151E000
|
stack
|
page read and write
|
||
|
18B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5200000
|
heap
|
page read and write
|
||
|
5206000
|
heap
|
page read and write
|
||
|
15CE000
|
stack
|
page read and write
|
||
|
C24000
|
heap
|
page read and write
|
||
|
18E0000
|
heap
|
page read and write
|
||
|
5A70000
|
trusted library allocation
|
page execute and read and write
|
||
|
C41000
|
heap
|
page read and write
|
||
|
4C90000
|
heap
|
page read and write
|
||
|
5201000
|
heap
|
page read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
41B1000
|
trusted library allocation
|
page read and write
|
||
|
C15000
|
heap
|
page read and write
|
||
|
1617000
|
heap
|
page read and write
|
||
|
C3D000
|
heap
|
page read and write
|
||
|
5971000
|
trusted library allocation
|
page read and write
|
||
|
C3D000
|
heap
|
page read and write
|
||
|
5660000
|
trusted library allocation
|
page read and write
|
||
|
30A0000
|
heap
|
page read and write
|
||
|
6DEE000
|
stack
|
page read and write
|
||
|
CA6000
|
heap
|
page read and write
|
||
|
C5B000
|
heap
|
page read and write
|
||
|
C5E000
|
heap
|
page read and write
|
||
|
1450000
|
heap
|
page read and write
|
||
|
C5A000
|
heap
|
page read and write
|
||
|
5850000
|
trusted library allocation
|
page execute and read and write
|
||
|
5A00000
|
trusted library allocation
|
page execute and read and write
|
||
|
CA3000
|
heap
|
page read and write
|
||
|
C59000
|
heap
|
page read and write
|
||
|
2FA0000
|
trusted library allocation
|
page read and write
|
||
|
EA0000
|
heap
|
page read and write
|
||
|
CC5000
|
heap
|
page read and write
|
||
|
5A13000
|
trusted library allocation
|
page read and write
|
||
|
11AD000
|
stack
|
page read and write
|
||
|
C44000
|
heap
|
page read and write
|
||
|
11D8000
|
heap
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
3028000
|
trusted library allocation
|
page read and write
|
||
|
6BB0000
|
heap
|
page read and write
|
||
|
596E000
|
stack
|
page read and write
|
||
|
C80000
|
heap
|
page read and write
|
||
|
C26000
|
heap
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
C50000
|
heap
|
page read and write
|
||
|
5A20000
|
trusted library allocation
|
page execute and read and write
|
||
|
58F0000
|
trusted library allocation
|
page read and write
|
||
|
CCD000
|
heap
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
5A40000
|
trusted library allocation
|
page execute and read and write
|
||
|
C1B000
|
heap
|
page read and write
|
||
|
644C000
|
stack
|
page read and write
|
||
|
C56000
|
heap
|
page read and write
|
||
|
C21000
|
heap
|
page read and write
|
||
|
C55000
|
heap
|
page read and write
|
||
|
62CF000
|
stack
|
page read and write
|
||
|
CA6000
|
heap
|
page read and write
|
||
|
58E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
61C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
B55000
|
heap
|
page read and write
|
||
|
C45000
|
heap
|
page read and write
|
||
|
CA0000
|
heap
|
page read and write
|
||
|
C4D000
|
heap
|
page read and write
|
||
|
CC3000
|
heap
|
page read and write
|
||
|
C4D000
|
heap
|
page read and write
|
||
|
18E7000
|
heap
|
page read and write
|
||
|
10F7000
|
stack
|
page read and write
|
||
|
71F0000
|
heap
|
page read and write
|
||
|
1580000
|
trusted library allocation
|
page read and write
|
||
|
5200000
|
heap
|
page read and write
|
||
|
CA6000
|
heap
|
page read and write
|
||
|
CCA000
|
heap
|
page read and write
|
||
|
64B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
C4E000
|
heap
|
page read and write
|
||
|
1386000
|
heap
|
page read and write
|
||
|
C40000
|
heap
|
page read and write
|
||
|
160C000
|
stack
|
page read and write
|
||
|
133D000
|
trusted library allocation
|
page execute and read and write
|
||
|
51F2000
|
heap
|
page read and write
|
||
|
C1B000
|
heap
|
page read and write
|
||
|
B80000
|
heap
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
156B000
|
trusted library allocation
|
page execute and read and write
|
||
|
59A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5AE2000
|
heap
|
page read and write
|
||
|
C5E000
|
heap
|
page read and write
|
||
|
C41000
|
heap
|
page read and write
|
||
|
C4A000
|
heap
|
page read and write
|
||
|
C3F000
|
heap
|
page read and write
|
||
|
55F0000
|
trusted library allocation
|
page read and write
|
||
|
5840000
|
trusted library allocation
|
page read and write
|
||
|
C27000
|
heap
|
page read and write
|
||
|
51D0000
|
heap
|
page read and write
|
||
|
C28000
|
heap
|
page read and write
|
||
|
44F9000
|
trusted library allocation
|
page read and write
|
||
|
5200000
|
heap
|
page read and write
|
||
|
2FE0000
|
trusted library allocation
|
page read and write
|
||
|
5200000
|
heap
|
page read and write
|
||
|
64E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
378F000
|
trusted library allocation
|
page read and write
|
||
|
69AC000
|
stack
|
page read and write
|
||
|
C46000
|
heap
|
page read and write
|
||
|
C59000
|
heap
|
page read and write
|
||
|
14B0000
|
heap
|
page read and write
|
||
|
5200000
|
heap
|
page read and write
|
||
|
C3D000
|
heap
|
page read and write
|
||
|
C5F000
|
heap
|
page read and write
|
||
|
5830000
|
trusted library allocation
|
page execute and read and write
|
||
|
3030000
|
trusted library allocation
|
page read and write
|
||
|
C4D000
|
heap
|
page read and write
|
||
|
11D0000
|
heap
|
page read and write
|
||
|
5640000
|
trusted library allocation
|
page read and write
|
||
|
CC1000
|
heap
|
page read and write
|
||
|
C59000
|
heap
|
page read and write
|
||
|
3060000
|
trusted library allocation
|
page read and write
|
||
|
CA6000
|
heap
|
page read and write
|
||
|
64A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
B3E000
|
stack
|
page read and write
|
||
|
CA3000
|
heap
|
page read and write
|
||
|
C47000
|
heap
|
page read and write
|
||
|
1333000
|
trusted library allocation
|
page execute and read and write
|
||
|
1550000
|
trusted library allocation
|
page read and write
|
||
|
C80000
|
heap
|
page read and write
|
||
|
C1C000
|
heap
|
page read and write
|
||
|
5AB8000
|
heap
|
page read and write
|
||
|
5207000
|
heap
|
page read and write
|
||
|
696E000
|
stack
|
page read and write
|
||
|
706E000
|
stack
|
page read and write
|
||
|
3053000
|
heap
|
page read and write
|
||
|
6E2D000
|
stack
|
page read and write
|
||
|
C21000
|
heap
|
page read and write
|
||
|
C80000
|
heap
|
page read and write
|
||
|
BCE000
|
unkown
|
page read and write
|
||
|
F70000
|
heap
|
page read and write
|
||
|
5AB0000
|
heap
|
page read and write
|
||
|
C4D000
|
heap
|
page read and write
|
||
|
CA3000
|
heap
|
page read and write
|
||
|
CCE000
|
heap
|
page read and write
|
||
|
59F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
C5B000
|
heap
|
page read and write
|
||
|
59B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5AA4000
|
heap
|
page read and write
|
||
|
5670000
|
trusted library allocation
|
page execute and read and write
|
||
|
C26000
|
heap
|
page read and write
|
||
|
14DE000
|
stack
|
page read and write
|
||
|
7FDE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
12EF000
|
stack
|
page read and write
|
||
|
C1B000
|
heap
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
640C000
|
stack
|
page read and write
|
||
|
CCA000
|
heap
|
page read and write
|
||
|
EB0000
|
heap
|
page read and write
|
||
|
59D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5A50000
|
trusted library allocation
|
page execute and read and write
|
||
|
A3B000
|
stack
|
page read and write
|
||
|
1348000
|
heap
|
page read and write
|
||
|
1543000
|
trusted library allocation
|
page read and write
|
||
|
5200000
|
heap
|
page read and write
|
||
|
1556000
|
trusted library allocation
|
page execute and read and write
|
||
|
4A8F000
|
stack
|
page read and write
|
||
|
6150000
|
trusted library allocation
|
page execute and read and write
|
||
|
149E000
|
stack
|
page read and write
|
||
|
3080000
|
trusted library allocation
|
page read and write
|
||
|
5202000
|
heap
|
page read and write
|
||
|
69E9000
|
stack
|
page read and write
|
||
|
B2E000
|
stack
|
page read and write
|
||
|
1382000
|
heap
|
page read and write
|
||
|
692D000
|
stack
|
page read and write
|
||
|
C28000
|
heap
|
page read and write
|
||
|
C57000
|
heap
|
page read and write
|
||
|
58D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5910000
|
trusted library allocation
|
page execute and read and write
|
||
|
348E000
|
trusted library allocation
|
page read and write
|
||
|
3001000
|
trusted library allocation
|
page read and write
|
||
|
C56000
|
heap
|
page read and write
|
||
|
12F0000
|
heap
|
page read and write
|
||
|
6CED000
|
stack
|
page read and write
|
||
|
C54000
|
heap
|
page read and write
|
||
|
5AF8000
|
heap
|
page read and write
|
||
|
2FEB000
|
trusted library allocation
|
page read and write
|
||
|
5900000
|
heap
|
page read and write
|
||
|
51F1000
|
heap
|
page read and write
|
||
|
2FFE000
|
trusted library allocation
|
page read and write
|
||
|
2FD0000
|
heap
|
page execute and read and write
|
||
|
B50000
|
heap
|
page read and write
|
||
|
1334000
|
trusted library allocation
|
page read and write
|
||
|
480000
|
unkown
|
page readonly
|
||
|
C22000
|
heap
|
page read and write
|
||
|
5890000
|
trusted library allocation
|
page read and write
|
||
|
C45000
|
heap
|
page read and write
|
||
|
E9F000
|
unkown
|
page read and write
|
||
|
CA3000
|
heap
|
page read and write
|
||
|
DEA000
|
stack
|
page read and write
|
||
|
C80000
|
heap
|
page read and write
|
||
|
1330000
|
heap
|
page read and write
|
||
|
3050000
|
heap
|
page read and write
|
||
|
42EC000
|
trusted library allocation
|
page read and write
|
||
|
31AF000
|
stack
|
page read and write
|
||
|
1440000
|
heap
|
page read and write
|
||
|
6F6D000
|
stack
|
page read and write
|
||
|
1540000
|
trusted library allocation
|
page read and write
|
||
|
3090000
|
trusted library allocation
|
page read and write
|
||
|
C2A000
|
heap
|
page read and write
|
||
|
C24000
|
heap
|
page read and write
|
||
|
CCA000
|
heap
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
3006000
|
trusted library allocation
|
page read and write
|
||
|
C4F000
|
heap
|
page read and write
|
||
|
C15000
|
heap
|
page read and write
|
||
|
1380000
|
heap
|
page read and write
|
||
|
2FF2000
|
trusted library allocation
|
page read and write
|
||
|
D54000
|
unkown
|
page readonly
|
||
|
F76000
|
heap
|
page read and write
|
||
|
C18000
|
heap
|
page read and write
|
||
|
1567000
|
trusted library allocation
|
page execute and read and write
|
||
|
14FE000
|
stack
|
page read and write
|
||
|
63CE000
|
stack
|
page read and write
|
||
|
18D0000
|
trusted library allocation
|
page read and write
|
||
|
BD7000
|
heap
|
page read and write
|
||
|
1610000
|
heap
|
page read and write
|
||
|
52AE000
|
stack
|
page read and write
|
||
|
C41000
|
heap
|
page read and write
|
||
|
134E000
|
heap
|
page read and write
|
||
|
CC9000
|
heap
|
page read and write
|
||
|
2FE4000
|
trusted library allocation
|
page read and write
|
||
|
66EB000
|
stack
|
page read and write
|
||
|
5680000
|
trusted library allocation
|
page read and write
|
||
|
1560000
|
trusted library allocation
|
page read and write
|
||
|
3070000
|
trusted library allocation
|
page read and write
|
||
|
C53000
|
heap
|
page read and write
|
||
|
C4F000
|
heap
|
page read and write
|
||
|
BD0000
|
heap
|
page read and write
|
||
|
348C000
|
trusted library allocation
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
C59000
|
heap
|
page read and write
|
||
|
1330000
|
trusted library allocation
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
67EC000
|
stack
|
page read and write
|
||
|
CCB000
|
heap
|
page read and write
|
||
|
58A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
C21000
|
heap
|
page read and write
|
||
|
300D000
|
trusted library allocation
|
page read and write
|
||
|
B33000
|
stack
|
page read and write
|
||
|
1320000
|
trusted library allocation
|
page read and write
|
||
|
154D000
|
trusted library allocation
|
page execute and read and write
|
||
|
C20000
|
heap
|
page read and write
|
||
|
C07000
|
heap
|
page read and write
|
||
|
CA3000
|
heap
|
page read and write
|
||
|
171E000
|
stack
|
page read and write
|
||
|
2FC0000
|
trusted library allocation
|
page read and write
|
||
|
3040000
|
trusted library allocation
|
page read and write
|
||
|
C50000
|
heap
|
page read and write
|
||
|
C5C000
|
heap
|
page read and write
|
||
|
1150000
|
heap
|
page read and write
|
||
|
C3D000
|
heap
|
page read and write
|
||
|
1160000
|
heap
|
page read and write
|
||
|
C5E000
|
heap
|
page read and write
|
There are 289 hidden memdumps, click here to show them.