Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
ROADToken.exe
|
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ROADToken.exe.log
|
CSV text
|
modified
|
|
|
|
\Device\ConDrv
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\ROADToken.exe
|
"C:\Users\user\Desktop\ROADToken.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe
|
"C:\Program Files\Windows Security\BrowserCore\browsercore.exe"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://login.microsoftonline.com/common/oauth2/authorize?sso_nonce=_
|
unknown
|
||
|
https://login.microsoftonline.com
|
unknown
|
||
|
https://login.microsoftonline.com/common/oauth2/authorize?sso_nonce=
|
unknown
|
||
|
https://login.microsoftonline.com/common/oauth2/authorize
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
A3E000
|
stack
|
page read and write
|
||
|
1A0D1C20000
|
heap
|
page read and write
|
||
|
1A0D1A8A000
|
heap
|
page read and write
|
||
|
9DB000
|
trusted library allocation
|
page execute and read and write
|
||
|
2450000
|
heap
|
page execute and read and write
|
||
|
1A0D1A20000
|
heap
|
page read and write
|
||
|
860000
|
heap
|
page read and write
|
||
|
2470000
|
heap
|
page read and write
|
||
|
1E4000
|
unkown
|
page readonly
|
||
|
1A0D1A00000
|
heap
|
page read and write
|
||
|
9A3000
|
trusted library allocation
|
page execute and read and write
|
||
|
1A0D1A95000
|
heap
|
page read and write
|
||
|
A7E000
|
stack
|
page read and write
|
||
|
99E000
|
stack
|
page read and write
|
||
|
390E53B000
|
stack
|
page read and write
|
||
|
1E0000
|
unkown
|
page readonly
|
||
|
6C0000
|
heap
|
page read and write
|
||
|
9B4000
|
trusted library allocation
|
page read and write
|
||
|
850000
|
trusted library allocation
|
page read and write
|
||
|
1E2000
|
unkown
|
page readonly
|
||
|
2588000
|
trusted library allocation
|
page read and write
|
||
|
AA0000
|
heap
|
page read and write
|
||
|
390E5BF000
|
stack
|
page read and write
|
||
|
3581000
|
trusted library allocation
|
page read and write
|
||
|
74E000
|
stack
|
page read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
47C000
|
stack
|
page read and write
|
||
|
84F000
|
stack
|
page read and write
|
||
|
9B0000
|
trusted library allocation
|
page read and write
|
||
|
8A5000
|
heap
|
page read and write
|
||
|
700000
|
heap
|
page read and write
|
||
|
705000
|
heap
|
page read and write
|
||
|
BDF000
|
stack
|
page read and write
|
||
|
1A0D1CB0000
|
heap
|
page read and write
|
||
|
1A0D1920000
|
heap
|
page read and write
|
||
|
A90000
|
heap
|
page read and write
|
||
|
AD0000
|
heap
|
page read and write
|
||
|
8A1000
|
heap
|
page read and write
|
||
|
868000
|
heap
|
page read and write
|
||
|
88C000
|
heap
|
page read and write
|
||
|
258C000
|
trusted library allocation
|
page read and write
|
||
|
2581000
|
trusted library allocation
|
page read and write
|
||
|
1A0D1A80000
|
heap
|
page read and write
|
||
|
579000
|
stack
|
page read and write
|
||
|
9A4000
|
trusted library allocation
|
page read and write
|
||
|
390E87F000
|
stack
|
page read and write
|
||
|
9D7000
|
trusted library allocation
|
page execute and read and write
|
||
|
86E000
|
heap
|
page read and write
|
||
|
467E000
|
stack
|
page read and write
|
||
|
257F000
|
stack
|
page read and write
|
||
|
AC0000
|
trusted library allocation
|
page read and write
|
||
|
A80000
|
trusted library allocation
|
page execute and read and write
|
There are 42 hidden memdumps, click here to show them.