Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
nQBmwBd90o.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nQBmwBd90o.exe.log
|
CSV text
|
modified
|
|
|
|
C:\Users\user\AppData\Local\Temp\tmp86AB.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\XenoManager\nQBmwBd90o.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\XenoManager\nQBmwBd90o.exe:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\nQBmwBd90o.exe
|
"C:\Users\user\Desktop\nQBmwBd90o.exe"
|
|
|
|
C:\Users\user\AppData\Roaming\XenoManager\nQBmwBd90o.exe
|
"C:\Users\user\AppData\Roaming\XenoManager\nQBmwBd90o.exe"
|
|
|
|
C:\Windows\SysWOW64\schtasks.exe
|
"schtasks.exe" /Create /TN "update_blender" /XML "C:\Users\user\AppData\Local\Temp\tmp86AB.tmp" /F
|
|
|
|
C:\Users\user\AppData\Roaming\XenoManager\nQBmwBd90o.exe
|
C:\Users\user\AppData\Roaming\XenoManager\nQBmwBd90o.exe
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
82.64.210.112
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
82.64.210.112
|
unknown
|
France
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
E12000
|
unkown
|
page readonly
|
|
|
|
13F5000
|
heap
|
page read and write
|
|
|
|
15F4000
|
trusted library allocation
|
page read and write
|
||
|
15E4000
|
trusted library allocation
|
page read and write
|
||
|
9EE000
|
stack
|
page read and write
|
||
|
EBC000
|
stack
|
page read and write
|
||
|
12D0000
|
heap
|
page read and write
|
||
|
13DC000
|
heap
|
page read and write
|
||
|
2CAD000
|
trusted library allocation
|
page execute and read and write
|
||
|
2CE0000
|
trusted library allocation
|
page read and write
|
||
|
566E000
|
stack
|
page read and write
|
||
|
13E4000
|
heap
|
page read and write
|
||
|
582D000
|
stack
|
page read and write
|
||
|
5DDF000
|
stack
|
page read and write
|
||
|
2ECC000
|
trusted library allocation
|
page read and write
|
||
|
7A0000
|
heap
|
page read and write
|
||
|
1031000
|
heap
|
page read and write
|
||
|
15E0000
|
trusted library allocation
|
page read and write
|
||
|
12BE000
|
stack
|
page read and write
|
||
|
45BE000
|
stack
|
page read and write
|
||
|
1086000
|
heap
|
page read and write
|
||
|
11A5000
|
heap
|
page read and write
|
||
|
13F1000
|
heap
|
page read and write
|
||
|
13B8000
|
heap
|
page read and write
|
||
|
7CA000
|
heap
|
page read and write
|
||
|
E1E000
|
unkown
|
page readonly
|
||
|
2FB0000
|
heap
|
page execute and read and write
|
||
|
127E000
|
stack
|
page read and write
|
||
|
7D7000
|
heap
|
page read and write
|
||
|
2ED0000
|
trusted library allocation
|
page read and write
|
||
|
1018000
|
heap
|
page read and write
|
||
|
E10000
|
unkown
|
page readonly
|
||
|
1EE000
|
stack
|
page read and write
|
||
|
687000
|
trusted library allocation
|
page execute and read and write
|
||
|
114E000
|
stack
|
page read and write
|
||
|
55ED000
|
stack
|
page read and write
|
||
|
FFA000
|
heap
|
page read and write
|
||
|
15AE000
|
stack
|
page read and write
|
||
|
2CB7000
|
trusted library allocation
|
page execute and read and write
|
||
|
1A0000
|
heap
|
page read and write
|
||
|
167F000
|
stack
|
page read and write
|
||
|
2CB2000
|
trusted library allocation
|
page read and write
|
||
|
4F9000
|
stack
|
page read and write
|
||
|
2CCB000
|
trusted library allocation
|
page execute and read and write
|
||
|
7A7000
|
heap
|
page read and write
|
||
|
2C4B000
|
heap
|
page read and write
|
||
|
8AA000
|
stack
|
page read and write
|
||
|
1650000
|
trusted library allocation
|
page read and write
|
||
|
5380000
|
trusted library allocation
|
page read and write
|
||
|
5390000
|
trusted library allocation
|
page read and write
|
||
|
7C4000
|
heap
|
page read and write
|
||
|
1230000
|
heap
|
page read and write
|
||
|
770000
|
heap
|
page read and write
|
||
|
5B9E000
|
stack
|
page read and write
|
||
|
4BAE000
|
stack
|
page read and write
|
||
|
664000
|
trusted library allocation
|
page read and write
|
||
|
30EF000
|
stack
|
page read and write
|
||
|
2E40000
|
heap
|
page execute and read and write
|
||
|
1660000
|
heap
|
page read and write
|
||
|
528D000
|
stack
|
page read and write
|
||
|
2BB0000
|
heap
|
page read and write
|
||
|
40F1000
|
trusted library allocation
|
page read and write
|
||
|
12BF000
|
stack
|
page read and write
|
||
|
605C000
|
stack
|
page read and write
|
||
|
2CA0000
|
trusted library allocation
|
page read and write
|
||
|
2ECE000
|
trusted library allocation
|
page read and write
|
||
|
F89000
|
stack
|
page read and write
|
||
|
4F3D000
|
stack
|
page read and write
|
||
|
2C60000
|
heap
|
page read and write
|
||
|
660000
|
trusted library allocation
|
page read and write
|
||
|
760000
|
trusted library allocation
|
page read and write
|
||
|
5A1E000
|
stack
|
page read and write
|
||
|
13C000
|
stack
|
page read and write
|
||
|
2F5E000
|
stack
|
page read and write
|
||
|
12D5000
|
heap
|
page read and write
|
||
|
2C90000
|
trusted library allocation
|
page read and write
|
||
|
1640000
|
trusted library allocation
|
page execute and read and write
|
||
|
2D2E000
|
stack
|
page read and write
|
||
|
BFE000
|
stack
|
page read and write
|
||
|
58ED000
|
stack
|
page read and write
|
||
|
137E000
|
stack
|
page read and write
|
||
|
161B000
|
trusted library allocation
|
page execute and read and write
|
||
|
5630000
|
heap
|
page execute and read and write
|
||
|
5F1E000
|
stack
|
page read and write
|
||
|
596F000
|
stack
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
1100000
|
heap
|
page read and write
|
||
|
2E30000
|
trusted library allocation
|
page execute and read and write
|
||
|
176E000
|
stack
|
page read and write
|
||
|
5C9E000
|
stack
|
page read and write
|
||
|
68B000
|
trusted library allocation
|
page execute and read and write
|
||
|
13BE000
|
heap
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
11A0000
|
heap
|
page read and write
|
||
|
30F1000
|
trusted library allocation
|
page read and write
|
||
|
24BE000
|
stack
|
page read and write
|
||
|
1617000
|
trusted library allocation
|
page execute and read and write
|
||
|
6FE000
|
stack
|
page read and write
|
||
|
2CC0000
|
trusted library allocation
|
page read and write
|
||
|
2F9D000
|
stack
|
page read and write
|
||
|
2AEE000
|
stack
|
page read and write
|
||
|
5F5C000
|
stack
|
page read and write
|
||
|
145B000
|
heap
|
page read and write
|
||
|
5910000
|
heap
|
page read and write
|
||
|
2C9D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2CC2000
|
trusted library allocation
|
page read and write
|
||
|
6A5000
|
heap
|
page read and write
|
||
|
2B00000
|
heap
|
page read and write
|
||
|
1160000
|
heap
|
page read and write
|
||
|
2E6E000
|
trusted library allocation
|
page read and write
|
||
|
2C94000
|
trusted library allocation
|
page read and write
|
||
|
16BE000
|
stack
|
page read and write
|
||
|
2C93000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E2F000
|
stack
|
page read and write
|
||
|
2C80000
|
trusted library allocation
|
page read and write
|
||
|
133D000
|
stack
|
page read and write
|
||
|
3E61000
|
trusted library allocation
|
page read and write
|
||
|
13B0000
|
heap
|
page read and write
|
||
|
2B4F000
|
stack
|
page read and write
|
||
|
5A5E000
|
stack
|
page read and write
|
||
|
FFE000
|
heap
|
page read and write
|
||
|
53A0000
|
heap
|
page execute and read and write
|
||
|
2E75000
|
trusted library allocation
|
page read and write
|
||
|
586E000
|
stack
|
page read and write
|
||
|
86D000
|
stack
|
page read and write
|
||
|
1630000
|
trusted library allocation
|
page read and write
|
||
|
54AF000
|
stack
|
page read and write
|
||
|
4AA0000
|
heap
|
page execute and read and write
|
||
|
1428000
|
heap
|
page read and write
|
||
|
609E000
|
stack
|
page read and write
|
||
|
B1F000
|
stack
|
page read and write
|
||
|
5E1E000
|
stack
|
page read and write
|
||
|
2CB0000
|
trusted library allocation
|
page read and write
|
||
|
2E61000
|
trusted library allocation
|
page read and write
|
||
|
654000
|
trusted library allocation
|
page read and write
|
||
|
5B5F000
|
stack
|
page read and write
|
||
|
700000
|
heap
|
page execute and read and write
|
||
|
34C1000
|
trusted library allocation
|
page read and write
|
||
|
2AAE000
|
unkown
|
page read and write
|
||
|
E8C000
|
stack
|
page read and write
|
||
|
619F000
|
stack
|
page read and write
|
||
|
74C000
|
stack
|
page read and write
|
||
|
12FE000
|
stack
|
page read and write
|
||
|
1220000
|
heap
|
page read and write
|
||
|
15E3000
|
trusted library allocation
|
page execute and read and write
|
||
|
15F0000
|
trusted library allocation
|
page read and write
|
||
|
6A0000
|
heap
|
page read and write
|
||
|
1900000
|
heap
|
page read and write
|
||
|
2C40000
|
heap
|
page read and write
|
||
|
653000
|
trusted library allocation
|
page execute and read and write
|
||
|
2FC0000
|
heap
|
page read and write
|
||
|
24C1000
|
trusted library allocation
|
page read and write
|
||
|
1180000
|
heap
|
page read and write
|
||
|
5CDE000
|
stack
|
page read and write
|
||
|
C10000
|
heap
|
page read and write
|
||
|
2E50000
|
heap
|
page read and write
|
||
|
99F000
|
stack
|
page read and write
|
||
|
910000
|
heap
|
page read and write
|
||
|
A10000
|
heap
|
page read and write
|
||
|
10F0000
|
heap
|
page read and write
|
||
|
1064000
|
heap
|
page read and write
|
||
|
2CC7000
|
trusted library allocation
|
page execute and read and write
|
||
|
65D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2AF0000
|
heap
|
page read and write
|
||
|
2CBA000
|
trusted library allocation
|
page execute and read and write
|
||
|
790000
|
heap
|
page read and write
|
||
|
95E000
|
unkown
|
page read and write
|
||
|
576F000
|
stack
|
page read and write
|
||
|
750000
|
trusted library allocation
|
page execute and read and write
|
||
|
2FA0000
|
trusted library allocation
|
page read and write
|
||
|
2ECA000
|
trusted library allocation
|
page read and write
|
||
|
15D0000
|
trusted library allocation
|
page read and write
|
||
|
61E000
|
stack
|
page read and write
|
||
|
49FE000
|
stack
|
page read and write
|
||
|
2ED2000
|
trusted library allocation
|
page read and write
|
||
|
503E000
|
stack
|
page read and write
|
||
|
1610000
|
trusted library allocation
|
page read and write
|
||
|
2EC4000
|
trusted library allocation
|
page read and write
|
||
|
9A0000
|
trusted library allocation
|
page read and write
|
||
|
FB9000
|
stack
|
page read and write
|
||
|
2FE0000
|
heap
|
page read and write
|
||
|
640000
|
trusted library allocation
|
page read and write
|
||
|
7BE000
|
heap
|
page read and write
|
||
|
5780000
|
trusted library allocation
|
page read and write
|
There are 174 hidden memdumps, click here to show them.