Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
hfKx2T5IfT.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\hfKx2T5IfT.exe
|
"C:\Users\user\Desktop\hfKx2T5IfT.exe"
|
|
|
|
C:\Windows\System32\netsh.exe
|
netsh firewall add allowedprogram "C:\Users\user\Desktop\hfKx2T5IfT.exe" "hfKx2T5IfT.exe" ENABLE
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
19.ip.gl.ply.gg
|
147.185.221.19
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
147.185.221.19
|
19.ip.gl.ply.gg
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER
|
di
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3331000
|
trusted library allocation
|
page read and write
|
|
|
|
13B0000
|
trusted library section
|
page read and write
|
|
|
|
1874BD11000
|
heap
|
page read and write
|
||
|
1874BD81000
|
heap
|
page read and write
|
||
|
18749DB8000
|
heap
|
page read and write
|
||
|
BE0000
|
unkown
|
page readonly
|
||
|
18749E0E000
|
heap
|
page read and write
|
||
|
1874BD20000
|
heap
|
page read and write
|
||
|
5ED2EFE000
|
stack
|
page read and write
|
||
|
1874BDCA000
|
heap
|
page read and write
|
||
|
1874BDD3000
|
heap
|
page read and write
|
||
|
18749E09000
|
heap
|
page read and write
|
||
|
1874BDD3000
|
heap
|
page read and write
|
||
|
1874B848000
|
heap
|
page read and write
|
||
|
1874BD10000
|
heap
|
page read and write
|
||
|
18749E20000
|
heap
|
page read and write
|
||
|
18749E29000
|
heap
|
page read and write
|
||
|
18749D98000
|
heap
|
page read and write
|
||
|
C00000
|
unkown
|
page readonly
|
||
|
18749E20000
|
heap
|
page read and write
|
||
|
7FFAAC4AA000
|
trusted library allocation
|
page execute and read and write
|
||
|
1874BDFE000
|
heap
|
page read and write
|
||
|
7FFAAC570000
|
trusted library allocation
|
page execute and read and write
|
||
|
18749DE4000
|
heap
|
page read and write
|
||
|
18749E24000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
1874BD6E000
|
heap
|
page read and write
|
||
|
1BC90000
|
trusted library section
|
page read and write
|
||
|
18749DDE000
|
heap
|
page read and write
|
||
|
18749D83000
|
heap
|
page read and write
|
||
|
1874BDC9000
|
heap
|
page read and write
|
||
|
D44000
|
stack
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
18749D9B000
|
heap
|
page read and write
|
||
|
1874B84F000
|
heap
|
page read and write
|
||
|
1874B84A000
|
heap
|
page read and write
|
||
|
1874BD25000
|
heap
|
page read and write
|
||
|
1874BD22000
|
heap
|
page read and write
|
||
|
1BC0D000
|
stack
|
page read and write
|
||
|
18749E08000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
18749E0F000
|
heap
|
page read and write
|
||
|
1874BDCD000
|
heap
|
page read and write
|
||
|
1874BD42000
|
heap
|
page read and write
|
||
|
18749E09000
|
heap
|
page read and write
|
||
|
1874BDE7000
|
heap
|
page read and write
|
||
|
18749D49000
|
heap
|
page read and write
|
||
|
18749E08000
|
heap
|
page read and write
|
||
|
18749D30000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
1874BDBA000
|
heap
|
page read and write
|
||
|
18749DA1000
|
heap
|
page read and write
|
||
|
18749E15000
|
heap
|
page read and write
|
||
|
18749E25000
|
heap
|
page read and write
|
||
|
1874BD82000
|
heap
|
page read and write
|
||
|
18749E13000
|
heap
|
page read and write
|
||
|
18749E2C000
|
heap
|
page read and write
|
||
|
18749E23000
|
heap
|
page read and write
|
||
|
13E3000
|
heap
|
page read and write
|
||
|
5ED2CFE000
|
stack
|
page read and write
|
||
|
18749DDD000
|
heap
|
page read and write
|
||
|
18749DB9000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
1C1E0000
|
heap
|
page read and write
|
||
|
D90000
|
heap
|
page read and write
|
||
|
13D3000
|
heap
|
page read and write
|
||
|
18749D96000
|
heap
|
page read and write
|
||
|
7FFB1E0F6000
|
unkown
|
page readonly
|
||
|
1874BDB6000
|
heap
|
page read and write
|
||
|
1874BD41000
|
heap
|
page read and write
|
||
|
18749DA7000
|
heap
|
page read and write
|
||
|
1874BD6E000
|
heap
|
page read and write
|
||
|
1BCE0000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
1874BD11000
|
heap
|
page read and write
|
||
|
1874BD81000
|
heap
|
page read and write
|
||
|
1874BD73000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
18749D8F000
|
heap
|
page read and write
|
||
|
1874BD1E000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
DE0000
|
heap
|
page read and write
|
||
|
1874BD1D000
|
heap
|
page read and write
|
||
|
18749E08000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
1874BDDF000
|
heap
|
page read and write
|
||
|
11D2000
|
heap
|
page read and write
|
||
|
10E0000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
1874BDA9000
|
heap
|
page read and write
|
||
|
1380000
|
trusted library allocation
|
page read and write
|
||
|
1740000
|
heap
|
page execute and read and write
|
||
|
5ED2DFD000
|
unkown
|
page read and write
|
||
|
7FFAAC522000
|
trusted library allocation
|
page read and write
|
||
|
18749E0E000
|
heap
|
page read and write
|
||
|
18749DB9000
|
heap
|
page read and write
|
||
|
18749DA7000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
18749DE5000
|
heap
|
page read and write
|
||
|
18749E1E000
|
heap
|
page read and write
|
||
|
1874BD1C000
|
heap
|
page read and write
|
||
|
18749E23000
|
heap
|
page read and write
|
||
|
18749D87000
|
heap
|
page read and write
|
||
|
13337000
|
trusted library allocation
|
page read and write
|
||
|
7FFAAC530000
|
trusted library allocation
|
page execute and read and write
|
||
|
1400000
|
heap
|
page read and write
|
||
|
18749E05000
|
heap
|
page read and write
|
||
|
18749E08000
|
heap
|
page read and write
|
||
|
7FFAAC413000
|
trusted library allocation
|
page execute and read and write
|
||
|
11B7000
|
heap
|
page read and write
|
||
|
18749E20000
|
heap
|
page read and write
|
||
|
18749E12000
|
heap
|
page read and write
|
||
|
18749D86000
|
heap
|
page read and write
|
||
|
7FFAAC3E2000
|
trusted library allocation
|
page execute and read and write
|
||
|
18749E15000
|
heap
|
page read and write
|
||
|
1C140000
|
heap
|
page read and write
|
||
|
BE0000
|
unkown
|
page readonly
|
||
|
18749E08000
|
heap
|
page read and write
|
||
|
18749DB8000
|
heap
|
page read and write
|
||
|
1874BD1D000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
1874BDB6000
|
heap
|
page read and write
|
||
|
18749E0A000
|
heap
|
page read and write
|
||
|
7FFAAC40F000
|
trusted library allocation
|
page execute and read and write
|
||
|
1874BDA9000
|
heap
|
page read and write
|
||
|
1B390000
|
trusted library allocation
|
page read and write
|
||
|
1874BD1D000
|
heap
|
page read and write
|
||
|
18749E06000
|
heap
|
page read and write
|
||
|
33E4000
|
trusted library allocation
|
page read and write
|
||
|
18749E0D000
|
heap
|
page read and write
|
||
|
18749DDD000
|
heap
|
page read and write
|
||
|
18749E21000
|
heap
|
page read and write
|
||
|
1725000
|
stack
|
page read and write
|
||
|
18749E05000
|
heap
|
page read and write
|
||
|
18749DA1000
|
heap
|
page read and write
|
||
|
28000
|
trusted library allocation
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
115A000
|
heap
|
page read and write
|
||
|
DA0000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
18749DDE000
|
heap
|
page read and write
|
||
|
1874BD19000
|
heap
|
page read and write
|
||
|
18749E0E000
|
heap
|
page read and write
|
||
|
18749E08000
|
heap
|
page read and write
|
||
|
7FFAAC4B0000
|
trusted library allocation
|
page read and write
|
||
|
1874BDCA000
|
heap
|
page read and write
|
||
|
7FFAAC580000
|
trusted library allocation
|
page execute and read and write
|
||
|
1874BD11000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
1555000
|
heap
|
page read and write
|
||
|
13335000
|
trusted library allocation
|
page read and write
|
||
|
1874B85D000
|
heap
|
page read and write
|
||
|
18749D84000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
18749D99000
|
heap
|
page read and write
|
||
|
18749DDD000
|
heap
|
page read and write
|
||
|
18749E08000
|
heap
|
page read and write
|
||
|
18749DB8000
|
heap
|
page read and write
|
||
|
7FFB1E0E1000
|
unkown
|
page execute read
|
||
|
18749E23000
|
heap
|
page read and write
|
||
|
18749DE3000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
33AD000
|
trusted library allocation
|
page read and write
|
||
|
1874BDC9000
|
heap
|
page read and write
|
||
|
1874BD1D000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
18749D92000
|
heap
|
page read and write
|
||
|
18749E10000
|
heap
|
page read and write
|
||
|
18749DF0000
|
heap
|
page read and write
|
||
|
1874BDD5000
|
heap
|
page read and write
|
||
|
18749DA2000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
18749E20000
|
heap
|
page read and write
|
||
|
18749E12000
|
heap
|
page read and write
|
||
|
1874B970000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
1874B840000
|
heap
|
page read and write
|
||
|
7FFB1E100000
|
unkown
|
page read and write
|
||
|
1874B854000
|
heap
|
page read and write
|
||
|
18749DF0000
|
heap
|
page read and write
|
||
|
18749D9B000
|
heap
|
page read and write
|
||
|
7FFAAC4BD000
|
trusted library allocation
|
page execute and read and write
|
||
|
18749D8E000
|
heap
|
page read and write
|
||
|
1874BD1C000
|
heap
|
page read and write
|
||
|
11D6000
|
heap
|
page read and write
|
||
|
18749DA7000
|
heap
|
page read and write
|
||
|
18749E09000
|
heap
|
page read and write
|
||
|
18749DF0000
|
heap
|
page read and write
|
||
|
13331000
|
trusted library allocation
|
page read and write
|
||
|
18749D7C000
|
heap
|
page read and write
|
||
|
7FFB1E105000
|
unkown
|
page readonly
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
1874BD41000
|
heap
|
page read and write
|
||
|
1BA04000
|
heap
|
page read and write
|
||
|
DC0000
|
heap
|
page read and write
|
||
|
20000
|
trusted library allocation
|
page read and write
|
||
|
5ED2CEE000
|
stack
|
page read and write
|
||
|
1874BD1C000
|
heap
|
page read and write
|
||
|
18749CB0000
|
heap
|
page read and write
|
||
|
18749E1B000
|
heap
|
page read and write
|
||
|
1874BD19000
|
heap
|
page read and write
|
||
|
18749D96000
|
heap
|
page read and write
|
||
|
1BEDE000
|
stack
|
page read and write
|
||
|
18749D99000
|
heap
|
page read and write
|
||
|
18749E28000
|
heap
|
page read and write
|
||
|
1874B85D000
|
heap
|
page read and write
|
||
|
1874BDD0000
|
heap
|
page read and write
|
||
|
18749DB8000
|
heap
|
page read and write
|
||
|
18749DB8000
|
heap
|
page read and write
|
||
|
18749DB9000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
18749E05000
|
heap
|
page read and write
|
||
|
7FF430080000
|
trusted library allocation
|
page execute and read and write
|
||
|
18749DF0000
|
heap
|
page read and write
|
||
|
1874BDDF000
|
heap
|
page read and write
|
||
|
18749C90000
|
heap
|
page read and write
|
||
|
1874BDA9000
|
heap
|
page read and write
|
||
|
114A000
|
heap
|
page read and write
|
||
|
7FFAAC3F2000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FF430070000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFAAC3EA000
|
trusted library allocation
|
page execute and read and write
|
||
|
18749E0E000
|
heap
|
page read and write
|
||
|
18749E20000
|
heap
|
page read and write
|
||
|
18749DB8000
|
heap
|
page read and write
|
||
|
7FFAAC4B5000
|
trusted library allocation
|
page read and write
|
||
|
1874BD25000
|
heap
|
page read and write
|
||
|
7FFB1E0E0000
|
unkown
|
page readonly
|
||
|
18749DF0000
|
heap
|
page read and write
|
||
|
1874B843000
|
heap
|
page read and write
|
||
|
120C000
|
heap
|
page read and write
|
||
|
1874BD81000
|
heap
|
page read and write
|
||
|
5ED32FF000
|
stack
|
page read and write
|
||
|
18749DA7000
|
heap
|
page read and write
|
||
|
7FFAAC444000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFB1E102000
|
unkown
|
page readonly
|
||
|
1874BD1E000
|
heap
|
page read and write
|
||
|
1550000
|
heap
|
page read and write
|
||
|
18749DA7000
|
heap
|
page read and write
|
||
|
1874BDCE000
|
heap
|
page read and write
|
||
|
18749C80000
|
heap
|
page read and write
|
||
|
7FFAAC4A2000
|
trusted library allocation
|
page execute and read and write
|
||
|
1874BD81000
|
heap
|
page read and write
|
||
|
1874BD6E000
|
heap
|
page read and write
|
||
|
1405000
|
heap
|
page read and write
|
||
|
18749DA7000
|
heap
|
page read and write
|
||
|
18749E16000
|
heap
|
page read and write
|
||
|
18749DA4000
|
heap
|
page read and write
|
||
|
1874BD73000
|
heap
|
page read and write
|
||
|
7FFAAC590000
|
trusted library allocation
|
page execute and read and write
|
||
|
18749D25000
|
heap
|
page read and write
|
||
|
BE2000
|
unkown
|
page readonly
|
||
|
1874BD41000
|
heap
|
page read and write
|
||
|
18749D8E000
|
heap
|
page read and write
|
||
|
18749D20000
|
heap
|
page read and write
|
||
|
7FFAAC400000
|
trusted library allocation
|
page read and write
|
||
|
18749E1B000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
1874BD1E000
|
heap
|
page read and write
|
||
|
18749E0E000
|
heap
|
page read and write
|
||
|
33FE000
|
trusted library allocation
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
1874BDCC000
|
heap
|
page read and write
|
||
|
18749E15000
|
heap
|
page read and write
|
||
|
1874BDDE000
|
heap
|
page read and write
|
||
|
1874BD16000
|
heap
|
page read and write
|
||
|
1120000
|
heap
|
page read and write
|
||
|
18749DA7000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
2FEE000
|
stack
|
page read and write
|
||
|
18749D86000
|
heap
|
page read and write
|
||
|
1874BD20000
|
heap
|
page read and write
|
||
|
18749E0C000
|
heap
|
page read and write
|
||
|
18749E0F000
|
heap
|
page read and write
|
||
|
18749E26000
|
heap
|
page read and write
|
||
|
1874BDCB000
|
heap
|
page read and write
|
||
|
18749E0C000
|
heap
|
page read and write
|
||
|
1874BD1E000
|
heap
|
page read and write
|
||
|
1874BD25000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
1BCF2000
|
heap
|
page read and write
|
||
|
7FFAAC3F0000
|
trusted library allocation
|
page read and write
|
||
|
5ED31FE000
|
stack
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
1874BDD7000
|
heap
|
page read and write
|
||
|
18749D8E000
|
heap
|
page read and write
|
||
|
13E6000
|
heap
|
page read and write
|
||
|
18749DB8000
|
heap
|
page read and write
|
||
|
1874BD1E000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
7FFAAC526000
|
trusted library allocation
|
page read and write
|
||
|
1BCB0000
|
heap
|
page execute and read and write
|
||
|
18749DB8000
|
heap
|
page read and write
|
||
|
16EA000
|
stack
|
page read and write
|
||
|
1874BD73000
|
heap
|
page read and write
|
||
|
18749D81000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
1874B856000
|
heap
|
page read and write
|
||
|
18749E08000
|
heap
|
page read and write
|
||
|
1874BD41000
|
heap
|
page read and write
|
||
|
18749E28000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
1874BDBA000
|
heap
|
page read and write
|
||
|
13D0000
|
heap
|
page read and write
|
||
|
18749D45000
|
heap
|
page read and write
|
||
|
1874BDD0000
|
heap
|
page read and write
|
||
|
18749E10000
|
heap
|
page read and write
|
||
|
18749D8E000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
18749E21000
|
heap
|
page read and write
|
||
|
7FFAAC4BA000
|
trusted library allocation
|
page execute and read and write
|
||
|
18749E1B000
|
heap
|
page read and write
|
||
|
18749E1B000
|
heap
|
page read and write
|
||
|
112C000
|
heap
|
page read and write
|
||
|
1874BDCE000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
1874BD1E000
|
heap
|
page read and write
|
||
|
18749DA7000
|
heap
|
page read and write
|
||
|
18749DF0000
|
heap
|
page read and write
|
||
|
18749E2A000
|
heap
|
page read and write
|
||
|
18749E18000
|
heap
|
page read and write
|
||
|
18749E0F000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
1874BDFE000
|
heap
|
page read and write
|
||
|
1874B850000
|
heap
|
page read and write
|
||
|
1874B830000
|
heap
|
page read and write
|
||
|
18749E23000
|
heap
|
page read and write
|
||
|
18749E04000
|
heap
|
page read and write
|
||
|
13E0000
|
heap
|
page read and write
|
||
|
1874BD25000
|
heap
|
page read and write
|
||
|
131E000
|
stack
|
page read and write
|
||
|
1874BD8B000
|
heap
|
page read and write
|
||
|
18749E23000
|
heap
|
page read and write
|
||
|
33D6000
|
trusted library allocation
|
page read and write
|
||
|
11D4000
|
heap
|
page read and write
|
||
|
1874BDDE000
|
heap
|
page read and write
|
||
|
18749DB9000
|
heap
|
page read and write
|
||
|
18749DDC000
|
heap
|
page read and write
|
||
|
1874BD11000
|
heap
|
page read and write
|
||
|
1874BD17000
|
heap
|
page read and write
|
||
|
5ED2CF1000
|
stack
|
page read and write
|
||
|
18749DB8000
|
heap
|
page read and write
|
||
|
18749E2C000
|
heap
|
page read and write
|
||
|
18749DF0000
|
heap
|
page read and write
|
||
|
18749DBB000
|
heap
|
page read and write
|
||
|
7FFAAC4E2000
|
trusted library allocation
|
page execute and read and write
|
||
|
1743000
|
heap
|
page execute and read and write
|
||
|
11ED000
|
heap
|
page read and write
|
||
|
1874BDA1000
|
heap
|
page read and write
|
||
|
1874BD62000
|
heap
|
page read and write
|
||
|
18749E05000
|
heap
|
page read and write
|
There are 342 hidden memdumps, click here to show them.