Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
XCS1lNZ26O.exe
|
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XCS1lNZ26O.exe.log
|
CSV text
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\MyApp.exe
|
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\MyApp.exe:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MyApp.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk
|
MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, ctime=Sun Dec 31 23:06:32 1600,
mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hidenormalshowminimized
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\XCS1lNZ26O.exe
|
"C:\Users\user\Desktop\XCS1lNZ26O.exe"
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\MyApp.exe
|
"C:\Users\user\AppData\Local\Microsoft\MyApp.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
dox2025.serveirc.com
|
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
198.187.3.20.in-addr.arpa
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\AnyDesk
|
AnyDesk
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
402000
|
remote allocation
|
page execute and read and write
|
|
|
|
2A3801BB000
|
trusted library allocation
|
page read and write
|
|
|
|
2A380001000
|
trusted library allocation
|
page read and write
|
|
|
|
7FFD9B890000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B773000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A391033000
|
trusted library allocation
|
page read and write
|
||
|
2A391B75000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B910000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B806000
|
trusted library allocation
|
page read and write
|
||
|
F28B3FF000
|
stack
|
page read and write
|
||
|
28714D4E000
|
heap
|
page read and write
|
||
|
E0045FD000
|
stack
|
page read and write
|
||
|
496E000
|
stack
|
page read and write
|
||
|
28728110000
|
trusted library allocation
|
page read and write
|
||
|
28714B06000
|
unkown
|
page readonly
|
||
|
7FFD9B870000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A39175F000
|
trusted library allocation
|
page read and write
|
||
|
C20000
|
trusted library allocation
|
page read and write
|
||
|
E0065FF000
|
stack
|
page read and write
|
||
|
28716C2B000
|
trusted library allocation
|
page read and write
|
||
|
2A391342000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B79B000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B8F0000
|
trusted library allocation
|
page read and write
|
||
|
28727AE7000
|
trusted library allocation
|
page read and write
|
||
|
E0049FE000
|
stack
|
page read and write
|
||
|
28726DCB000
|
trusted library allocation
|
page read and write
|
||
|
E0061FE000
|
stack
|
page read and write
|
||
|
2A39051E000
|
trusted library allocation
|
page read and write
|
||
|
2872F170000
|
heap
|
page read and write
|
||
|
2A3EB9E0000
|
heap
|
page read and write
|
||
|
10B0000
|
heap
|
page read and write
|
||
|
2A380549000
|
trusted library allocation
|
page read and write
|
||
|
28727EFE000
|
trusted library allocation
|
page read and write
|
||
|
28714C90000
|
heap
|
page read and write
|
||
|
2A391E7F000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B940000
|
trusted library allocation
|
page read and write
|
||
|
2A3EB890000
|
heap
|
page read and write
|
||
|
2872EFF0000
|
heap
|
page execute and read and write
|
||
|
2872EE70000
|
trusted library section
|
page read and write
|
||
|
F28B7FE000
|
stack
|
page read and write
|
||
|
4CEE000
|
stack
|
page read and write
|
||
|
28727DFF000
|
trusted library allocation
|
page read and write
|
||
|
2A391A70000
|
trusted library allocation
|
page read and write
|
||
|
2A390420000
|
trusted library allocation
|
page read and write
|
||
|
F28C3FF000
|
stack
|
page read and write
|
||
|
C40000
|
heap
|
page read and write
|
||
|
2A380567000
|
trusted library allocation
|
page read and write
|
||
|
2A390D27000
|
trusted library allocation
|
page read and write
|
||
|
F28CFFF000
|
stack
|
page read and write
|
||
|
7FFD9B92D000
|
trusted library allocation
|
page read and write
|
||
|
2872E6D0000
|
trusted library allocation
|
page read and write
|
||
|
287271BC000
|
trusted library allocation
|
page read and write
|
||
|
4E2E000
|
stack
|
page read and write
|
||
|
9E0000
|
heap
|
page read and write
|
||
|
28714AFE000
|
unkown
|
page readonly
|
||
|
287166A1000
|
trusted library allocation
|
page read and write
|
||
|
2A390464000
|
trusted library allocation
|
page read and write
|
||
|
F28BBFD000
|
stack
|
page read and write
|
||
|
28714CBD000
|
heap
|
page read and write
|
||
|
BF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B810000
|
trusted library allocation
|
page execute and read and write
|
||
|
28714E55000
|
heap
|
page read and write
|
||
|
2A3EDDC0000
|
heap
|
page read and write
|
||
|
BC0000
|
heap
|
page read and write
|
||
|
2A390001000
|
trusted library allocation
|
page read and write
|
||
|
B0E000
|
stack
|
page read and write
|
||
|
28726DC9000
|
trusted library allocation
|
page read and write
|
||
|
AC5000
|
heap
|
page read and write
|
||
|
28728210000
|
trusted library allocation
|
page read and write
|
||
|
C10000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B910000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B750000
|
trusted library allocation
|
page read and write
|
||
|
2A3EBA95000
|
heap
|
page read and write
|
||
|
C19000
|
trusted library allocation
|
page read and write
|
||
|
B90000
|
trusted library allocation
|
page read and write
|
||
|
28726FAA000
|
trusted library allocation
|
page read and write
|
||
|
2A3923A2000
|
trusted library allocation
|
page read and write
|
||
|
2A391D81000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B780000
|
trusted library allocation
|
page read and write
|
||
|
27D1000
|
trusted library allocation
|
page read and write
|
||
|
28716BF4000
|
trusted library allocation
|
page read and write
|
||
|
D7E000
|
stack
|
page read and write
|
||
|
2A391031000
|
trusted library allocation
|
page read and write
|
||
|
C20000
|
trusted library allocation
|
page read and write
|
||
|
2A3924A1000
|
trusted library allocation
|
page read and write
|
||
|
28726AA3000
|
trusted library allocation
|
page read and write
|
||
|
DBD000
|
stack
|
page read and write
|
||
|
7FFD9B790000
|
trusted library allocation
|
page read and write
|
||
|
28728256000
|
trusted library allocation
|
page read and write
|
||
|
28714CD0000
|
heap
|
page read and write
|
||
|
2A3801CF000
|
trusted library allocation
|
page read and write
|
||
|
2A390520000
|
trusted library allocation
|
page read and write
|
||
|
B84000
|
trusted library allocation
|
page read and write
|
||
|
2872EA24000
|
heap
|
page read and write
|
||
|
7FFD9B77D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2871483A000
|
unkown
|
page readonly
|
||
|
2A3EB7B0000
|
heap
|
page read and write
|
||
|
2A3EBA20000
|
trusted library allocation
|
page read and write
|
||
|
2A390B1C000
|
trusted library allocation
|
page read and write
|
||
|
F28C7FF000
|
stack
|
page read and write
|
||
|
28714DD0000
|
heap
|
page read and write
|
||
|
7FFD9B943000
|
trusted library allocation
|
page read and write
|
||
|
28716BE4000
|
trusted library allocation
|
page read and write
|
||
|
28714DB0000
|
heap
|
page read and write
|
||
|
7FFD9B836000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A3EB909000
|
heap
|
page read and write
|
||
|
28714702000
|
unkown
|
page readonly
|
||
|
2A3EB8B0000
|
heap
|
page read and write
|
||
|
2A392192000
|
trusted library allocation
|
page read and write
|
||
|
C91000
|
heap
|
page read and write
|
||
|
2A38050B000
|
trusted library allocation
|
page read and write
|
||
|
2A392190000
|
trusted library allocation
|
page read and write
|
||
|
28714CBB000
|
heap
|
page read and write
|
||
|
2A3EB922000
|
heap
|
page read and write
|
||
|
2A380509000
|
trusted library allocation
|
page read and write
|
||
|
2A3EB94F000
|
heap
|
page read and write
|
||
|
28727BEF000
|
trusted library allocation
|
page read and write
|
||
|
2A3EBB70000
|
heap
|
page execute and read and write
|
||
|
28716C1D000
|
trusted library allocation
|
page read and write
|
||
|
28714EF0000
|
heap
|
page read and write
|
||
|
2872EEEF000
|
heap
|
page read and write
|
||
|
7FFD9B856000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A390423000
|
trusted library allocation
|
page read and write
|
||
|
2A3ED360000
|
trusted library allocation
|
page read and write
|
||
|
28714EE0000
|
heap
|
page read and write
|
||
|
28726AAB000
|
trusted library allocation
|
page read and write
|
||
|
2A390F32000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B820000
|
trusted library allocation
|
page read and write
|
||
|
28726EA9000
|
trusted library allocation
|
page read and write
|
||
|
4F4E000
|
stack
|
page read and write
|
||
|
7FFD9B7AC000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A3EDE01000
|
heap
|
page read and write
|
||
|
F0F000
|
stack
|
page read and write
|
||
|
28714CC1000
|
heap
|
page read and write
|
||
|
B30000
|
heap
|
page read and write
|
||
|
B83000
|
trusted library allocation
|
page execute and read and write
|
||
|
28714700000
|
unkown
|
page readonly
|
||
|
C77000
|
heap
|
page read and write
|
||
|
2A3805A6000
|
trusted library allocation
|
page read and write
|
||
|
28714CFC000
|
heap
|
page read and write
|
||
|
7FFD9B800000
|
trusted library allocation
|
page read and write
|
||
|
28714BB0000
|
heap
|
page read and write
|
||
|
4E40000
|
heap
|
page execute and read and write
|
||
|
2A3EB8E0000
|
heap
|
page read and write
|
||
|
2A390008000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B830000
|
trusted library allocation
|
page execute and read and write
|
||
|
28726CCB000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B754000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B762000
|
trusted library allocation
|
page read and write
|
||
|
2A39080B000
|
trusted library allocation
|
page read and write
|
||
|
287279E9000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B76D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A380513000
|
trusted library allocation
|
page read and write
|
||
|
F28BFF7000
|
stack
|
page read and write
|
||
|
37D1000
|
trusted library allocation
|
page read and write
|
||
|
7FF444D00000
|
trusted library allocation
|
page execute and read and write
|
||
|
C20000
|
trusted library allocation
|
page read and write
|
||
|
E0039F2000
|
stack
|
page read and write
|
||
|
E0059FF000
|
stack
|
page read and write
|
||
|
2A3EBA90000
|
heap
|
page read and write
|
||
|
2A3EDCD0000
|
heap
|
page execute and read and write
|
||
|
287267DF000
|
trusted library allocation
|
page read and write
|
||
|
2A3EB91F000
|
heap
|
page read and write
|
||
|
28727AE9000
|
trusted library allocation
|
page read and write
|
||
|
2872820E000
|
trusted library allocation
|
page read and write
|
||
|
2A380530000
|
trusted library allocation
|
page read and write
|
||
|
28714CD3000
|
heap
|
page read and write
|
||
|
B94000
|
trusted library allocation
|
page read and write
|
||
|
2A3EDDFF000
|
heap
|
page read and write
|
||
|
28714B1C000
|
unkown
|
page readonly
|
||
|
2A3EB949000
|
heap
|
page read and write
|
||
|
7FFD9B82C000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B770000
|
trusted library allocation
|
page read and write
|
||
|
2A380520000
|
trusted library allocation
|
page read and write
|
||
|
2A380507000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B77B000
|
trusted library allocation
|
page execute and read and write
|
||
|
F28D3FD000
|
stack
|
page read and write
|
||
|
C5E000
|
heap
|
page read and write
|
||
|
287266A8000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B78D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B753000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A380511000
|
trusted library allocation
|
page read and write
|
||
|
28714E20000
|
trusted library allocation
|
page read and write
|
||
|
28714E50000
|
heap
|
page read and write
|
||
|
28726E26000
|
trusted library allocation
|
page read and write
|
||
|
87C000
|
stack
|
page read and write
|
||
|
F28AFFD000
|
stack
|
page read and write
|
||
|
2A390C22000
|
trusted library allocation
|
page read and write
|
||
|
2A391E81000
|
trusted library allocation
|
page read and write
|
||
|
E005DFE000
|
stack
|
page read and write
|
||
|
7FFD9B900000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B7CC000
|
trusted library allocation
|
page execute and read and write
|
||
|
28714D90000
|
heap
|
page read and write
|
||
|
27CE000
|
stack
|
page read and write
|
||
|
28726FAC000
|
trusted library allocation
|
page read and write
|
||
|
2A391243000
|
trusted library allocation
|
page read and write
|
||
|
2A3EB94B000
|
heap
|
page read and write
|
||
|
DD0000
|
heap
|
page read and write
|
||
|
2A3EB8E6000
|
heap
|
page read and write
|
||
|
28726AC8000
|
trusted library allocation
|
page read and write
|
||
|
2A380515000
|
trusted library allocation
|
page read and write
|
||
|
287272BC000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B950000
|
trusted library allocation
|
page read and write
|
||
|
2A3EB902000
|
heap
|
page read and write
|
||
|
E003DFE000
|
stack
|
page read and write
|
||
|
7FFD9B752000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B920000
|
trusted library allocation
|
page read and write
|
||
|
C6A000
|
heap
|
page read and write
|
||
|
7FFD9B75D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A3924A3000
|
trusted library allocation
|
page read and write
|
||
|
F28D7FE000
|
stack
|
page read and write
|
||
|
7FFD9B774000
|
trusted library allocation
|
page read and write
|
||
|
E004DFD000
|
stack
|
page read and write
|
||
|
28714C9C000
|
heap
|
page read and write
|
||
|
7FFD9B782000
|
trusted library allocation
|
page read and write
|
||
|
BBB000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A380559000
|
trusted library allocation
|
page read and write
|
||
|
C63000
|
heap
|
page read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
28727BED000
|
trusted library allocation
|
page read and write
|
||
|
287272BA000
|
trusted library allocation
|
page read and write
|
||
|
97C000
|
stack
|
page read and write
|
||
|
28714CFA000
|
heap
|
page read and write
|
||
|
7FFD9B774000
|
trusted library allocation
|
page read and write
|
||
|
2A38050D000
|
trusted library allocation
|
page read and write
|
||
|
2872EF04000
|
heap
|
page read and write
|
||
|
2872EEC9000
|
heap
|
page read and write
|
||
|
2A3EBB80000
|
heap
|
page read and write
|
||
|
2A391344000
|
trusted library allocation
|
page read and write
|
||
|
F28ABF3000
|
stack
|
page read and write
|
||
|
28714CC3000
|
heap
|
page read and write
|
||
|
28714EA0000
|
heap
|
page execute and read and write
|
||
|
2A38050F000
|
trusted library allocation
|
page read and write
|
||
|
AC0000
|
heap
|
page read and write
|
||
|
2A3EDDB0000
|
heap
|
page read and write
|
||
|
2A3EBA80000
|
heap
|
page read and write
|
||
|
28727F00000
|
trusted library allocation
|
page read and write
|
||
|
2A3ED6B8000
|
heap
|
page read and write
|
||
|
B70000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B80C000
|
trusted library allocation
|
page execute and read and write
|
||
|
28714D06000
|
heap
|
page read and write
|
||
|
2A392092000
|
trusted library allocation
|
page read and write
|
||
|
2A3801B2000
|
trusted library allocation
|
page read and write
|
||
|
2A390788000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B79D000
|
trusted library allocation
|
page execute and read and write
|
||
|
287273C0000
|
trusted library allocation
|
page read and write
|
||
|
E0055FE000
|
stack
|
page read and write
|
||
|
2872EF12000
|
heap
|
page read and write
|
||
|
E0069FB000
|
stack
|
page read and write
|
||
|
7FFD9B930000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B949000
|
trusted library allocation
|
page read and write
|
||
|
B10000
|
heap
|
page read and write
|
||
|
2872EEB0000
|
trusted library section
|
page read and write
|
||
|
4DEF000
|
stack
|
page read and write
|
||
|
28714E40000
|
trusted library allocation
|
page read and write
|
||
|
28714CC5000
|
heap
|
page read and write
|
||
|
C00000
|
heap
|
page execute and read and write
|
||
|
2A390428000
|
trusted library allocation
|
page read and write
|
||
|
2872EEC5000
|
heap
|
page read and write
|
||
|
7FFD9B76A000
|
trusted library allocation
|
page read and write
|
||
|
287266A1000
|
trusted library allocation
|
page read and write
|
||
|
F28CBFE000
|
stack
|
page read and write
|
||
|
2A3EBA40000
|
trusted library allocation
|
page read and write
|
||
|
2A3EBB85000
|
heap
|
page read and write
|
||
|
28714EF5000
|
heap
|
page read and write
|
||
|
28714C96000
|
heap
|
page read and write
|
||
|
7FFD9B960000
|
trusted library allocation
|
page execute and read and write
|
||
|
E0051FD000
|
stack
|
page read and write
|
||
|
287273C2000
|
trusted library allocation
|
page read and write
|
||
|
C48000
|
heap
|
page read and write
|
||
|
2872EEC0000
|
heap
|
page read and write
|
||
|
7FFD9B77D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B760000
|
trusted library allocation
|
page read and write
|
There are 263 hidden memdumps, click here to show them.