Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Xwl3DsNmN2.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
modified
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Xwl3DsNmN2.exe
|
"C:\Users\user\Desktop\Xwl3DsNmN2.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://89.197.154.115:7700/6CqFEOIEZ-_A_cH8pgiUAgokwto4FovQaLCp7IwjfjFOHLmm4PXOb0KwnKkTc0c4DgsIXI1BeciyULKIi1BQYK5r_ag_pWihXw1viMYb3a4ebq8yKbFx_6C
|
|
||
|
89.197.154.115
|
|
||
|
https://89.197.154.115/
|
unknown
|
||
|
https://89.197.154.115:7700/ptjW
|
unknown
|
||
|
http://www.apache.org/licenses/LICENSE-2.0
|
unknown
|
||
|
https://89.197.154.115:7700/ptjnnlsres.dll.muil
|
unknown
|
||
|
https://89.197.154.115:7700/ptjh
|
unknown
|
||
|
https://89.197.154.115:7700/hy
|
unknown
|
||
|
https://89.197.154.115:7700/ptj-
|
unknown
|
||
|
https://89.197.154.115:7700/ptj0
|
unknown
|
||
|
https://89.197.154.115:7700/
|
unknown
|
||
|
https://89.197.154.115:7700/ptjq
|
unknown
|
||
|
https://89.197.154.115:7700/ptjs
|
unknown
|
||
|
http://www.apache.org/
|
unknown
|
||
|
https://89.197.154.115:7700/oft
|
unknown
|
||
|
https://89.197.154.115:7700/ptj7
|
unknown
|
||
|
https://89.197.154.115:7700/ptjft
|
unknown
|
||
|
https://89.197.154.115:7700/ptj9
|
unknown
|
||
|
https://89.197.154.115:7700/ptj
|
unknown
|
||
|
https://89.197.154.115:7700/ptjm32
|
unknown
|
||
|
https://89.197.154.115:7700/My
|
unknown
|
||
|
https://89.197.154.115:7700/tjc
|
unknown
|
||
|
http://www.zeustech.net/
|
unknown
|
||
|
https://89.197.154.115:7700/ptjJ
|
unknown
|
||
|
https://89.197.154.115:7700/6CqFEOIEZ-_A_cH8pgiUAgokwto4FovQaLCp7IwjfjFOHLmm4PXOb0KwnKkTc0c4DgsIXI1B
|
unknown
|
||
|
https://89.197.154.115:7700/ptjP
|
unknown
|
||
|
http://127.0.0.1:%u/
|
unknown
|
||
|
https://89.197.154.115:7700/ptj476756634-1003
|
unknown
|
There are 18 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
89.197.154.115
|
unknown
|
United Kingdom
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
32D0000
|
direct allocation
|
page execute and read and write
|
|
|
|
401000
|
unkown
|
page execute read
|
|
|
|
401000
|
unkown
|
page execute read
|
|
|
|
2F70000
|
direct allocation
|
page execute and read and write
|
|
|
|
5B0000
|
direct allocation
|
page execute and read and write
|
|
|
|
5AA000
|
heap
|
page read and write
|
||
|
526000
|
heap
|
page read and write
|
||
|
4E4000
|
heap
|
page read and write
|
||
|
40D000
|
unkown
|
page write copy
|
||
|
2D20000
|
remote allocation
|
page read and write
|
||
|
2EB6000
|
heap
|
page read and write
|
||
|
2EA8000
|
heap
|
page read and write
|
||
|
2EAC000
|
heap
|
page read and write
|
||
|
505000
|
heap
|
page read and write
|
||
|
2EB6000
|
heap
|
page read and write
|
||
|
2EA9000
|
heap
|
page read and write
|
||
|
2ED3000
|
heap
|
page read and write
|
||
|
2E81000
|
heap
|
page read and write
|
||
|
4F9000
|
heap
|
page read and write
|
||
|
2CED000
|
stack
|
page read and write
|
||
|
280E000
|
stack
|
page read and write
|
||
|
5C6000
|
heap
|
page read and write
|
||
|
2F5B000
|
heap
|
page read and write
|
||
|
615000
|
heap
|
page read and write
|
||
|
51C000
|
heap
|
page read and write
|
||
|
40D000
|
unkown
|
page write copy
|
||
|
2EA8000
|
heap
|
page read and write
|
||
|
2F2E000
|
heap
|
page read and write
|
||
|
37E0000
|
heap
|
page read and write
|
||
|
5AA000
|
heap
|
page read and write
|
||
|
2EB6000
|
heap
|
page read and write
|
||
|
420000
|
heap
|
page read and write
|
||
|
2A9E000
|
stack
|
page read and write
|
||
|
523000
|
heap
|
page read and write
|
||
|
30E3000
|
heap
|
page read and write
|
||
|
2FB3000
|
direct allocation
|
page execute and read and write
|
||
|
523000
|
heap
|
page read and write
|
||
|
52A000
|
heap
|
page read and write
|
||
|
2EB8000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
40C000
|
unkown
|
page readonly
|
||
|
5AA000
|
heap
|
page read and write
|
||
|
555000
|
heap
|
page read and write
|
||
|
2E71000
|
heap
|
page read and write
|
||
|
55A000
|
heap
|
page read and write
|
||
|
26AE000
|
stack
|
page read and write
|
||
|
2D20000
|
remote allocation
|
page read and write
|
||
|
23D0000
|
heap
|
page read and write
|
||
|
598000
|
heap
|
page read and write
|
||
|
2EA8000
|
heap
|
page read and write
|
||
|
415000
|
unkown
|
page readonly
|
||
|
310E000
|
heap
|
page read and write
|
||
|
59C000
|
heap
|
page read and write
|
||
|
2EB6000
|
heap
|
page read and write
|
||
|
40C000
|
unkown
|
page readonly
|
||
|
415000
|
unkown
|
page readonly
|
||
|
30D1000
|
heap
|
page read and write
|
||
|
610000
|
heap
|
page read and write
|
||
|
2A5D000
|
stack
|
page read and write
|
||
|
2EB1000
|
heap
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
590000
|
heap
|
page read and write
|
||
|
290F000
|
stack
|
page read and write
|
||
|
37E2000
|
heap
|
page read and write
|
||
|
2EB1000
|
heap
|
page read and write
|
||
|
2FA8000
|
direct allocation
|
page execute and read and write
|
||
|
4BE000
|
heap
|
page read and write
|
||
|
4BA000
|
heap
|
page read and write
|
||
|
30D1000
|
heap
|
page read and write
|
||
|
2FC0000
|
heap
|
page read and write
|
||
|
589000
|
heap
|
page read and write
|
||
|
2E5F000
|
stack
|
page read and write
|
||
|
310E000
|
heap
|
page read and write
|
||
|
2F01000
|
heap
|
page read and write
|
||
|
2EB6000
|
heap
|
page read and write
|
||
|
2D20000
|
remote allocation
|
page read and write
|
||
|
52A000
|
heap
|
page read and write
|
||
|
27AF000
|
stack
|
page read and write
|
||
|
30E3000
|
heap
|
page read and write
|
||
|
2ED3000
|
heap
|
page read and write
|
||
|
582000
|
heap
|
page read and write
|
||
|
37E4000
|
heap
|
page read and write
|
||
|
590000
|
heap
|
page read and write
|
||
|
2FE0000
|
heap
|
page read and write
|
||
|
2B9E000
|
stack
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
2EB1000
|
heap
|
page read and write
|
||
|
3070000
|
heap
|
page read and write
|
||
|
2D5E000
|
stack
|
page read and write
|
||
|
2BEE000
|
stack
|
page read and write
|
||
|
2EB1000
|
heap
|
page read and write
|
||
|
2EB1000
|
heap
|
page read and write
|
||
|
19D000
|
stack
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
2FB5000
|
direct allocation
|
page execute and read and write
|
||
|
30D0000
|
heap
|
page read and write
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
295D000
|
stack
|
page read and write
|
||
|
2E70000
|
heap
|
page read and write
|
||
|
2EEF000
|
heap
|
page read and write
|
||
|
503000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
3077000
|
heap
|
page read and write
|
||
|
46E000
|
stack
|
page read and write
|
||
|
5AA000
|
heap
|
page read and write
|
||
|
2EC2000
|
heap
|
page read and write
|
||
|
2F2D000
|
heap
|
page read and write
|
||
|
7EF000
|
stack
|
page read and write
|
||
|
59F000
|
heap
|
page read and write
|
||
|
4B0000
|
heap
|
page read and write
|
There are 100 hidden memdumps, click here to show them.