Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
ungziped_file.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ungziped_file.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\ungziped_file.exe
|
"C:\Users\user\Desktop\ungziped_file.exe"
|
|
|
|
C:\Users\user\Desktop\ungziped_file.exe
|
"C:\Users\user\Desktop\ungziped_file.exe"
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1940000
|
direct allocation
|
page read and write
|
|
|
|
400000
|
remote allocation
|
page execute and read and write
|
|
|
|
1980000
|
trusted library allocation
|
page read and write
|
||
|
7DFE000
|
stack
|
page read and write
|
||
|
38CF000
|
trusted library allocation
|
page read and write
|
||
|
1B17000
|
heap
|
page read and write
|
||
|
39CD000
|
trusted library allocation
|
page read and write
|
||
|
37EB000
|
trusted library allocation
|
page read and write
|
||
|
D9D000
|
stack
|
page read and write
|
||
|
171E000
|
heap
|
page read and write
|
||
|
7045D000
|
unkown
|
page read and write
|
||
|
5E7E000
|
heap
|
page read and write
|
||
|
1290000
|
heap
|
page read and write
|
||
|
394B000
|
trusted library allocation
|
page read and write
|
||
|
184E000
|
stack
|
page read and write
|
||
|
38F8000
|
trusted library allocation
|
page read and write
|
||
|
18B6000
|
direct allocation
|
page execute and read and write
|
||
|
5B90000
|
trusted library section
|
page readonly
|
||
|
7F730000
|
trusted library allocation
|
page execute and read and write
|
||
|
15D0000
|
heap
|
page read and write
|
||
|
1AEC000
|
stack
|
page read and write
|
||
|
19B0000
|
trusted library allocation
|
page read and write
|
||
|
45F2000
|
trusted library allocation
|
page read and write
|
||
|
3814000
|
trusted library allocation
|
page read and write
|
||
|
19FE000
|
stack
|
page read and write
|
||
|
38A5000
|
trusted library allocation
|
page read and write
|
||
|
A8AE000
|
stack
|
page read and write
|
||
|
5C80000
|
heap
|
page read and write
|
||
|
1710000
|
heap
|
page read and write
|
||
|
36CA000
|
trusted library allocation
|
page read and write
|
||
|
7D79000
|
trusted library allocation
|
page read and write
|
||
|
801E000
|
stack
|
page read and write
|
||
|
1960000
|
trusted library allocation
|
page read and write
|
||
|
5890000
|
trusted library allocation
|
page read and write
|
||
|
18BD000
|
direct allocation
|
page execute and read and write
|
||
|
39D4000
|
trusted library allocation
|
page read and write
|
||
|
7C90000
|
trusted library allocation
|
page read and write
|
||
|
7D80000
|
trusted library allocation
|
page read and write
|
||
|
1973000
|
trusted library allocation
|
page read and write
|
||
|
36B2000
|
trusted library allocation
|
page read and write
|
||
|
1992000
|
trusted library allocation
|
page read and write
|
||
|
3867000
|
trusted library allocation
|
page read and write
|
||
|
375A000
|
trusted library allocation
|
page read and write
|
||
|
33FD000
|
trusted library allocation
|
page read and write
|
||
|
1000000
|
heap
|
page read and write
|
||
|
171D000
|
direct allocation
|
page execute and read and write
|
||
|
399E000
|
trusted library allocation
|
page read and write
|
||
|
1997000
|
trusted library allocation
|
page execute and read and write
|
||
|
108E000
|
stack
|
page read and write
|
||
|
39D9000
|
trusted library allocation
|
page read and write
|
||
|
38E3000
|
trusted library allocation
|
page read and write
|
||
|
387C000
|
trusted library allocation
|
page read and write
|
||
|
3800000
|
trusted library allocation
|
page read and write
|
||
|
18A1000
|
direct allocation
|
page execute and read and write
|
||
|
5902000
|
trusted library allocation
|
page read and write
|
||
|
199B000
|
trusted library allocation
|
page execute and read and write
|
||
|
37AD000
|
trusted library allocation
|
page read and write
|
||
|
5880000
|
trusted library allocation
|
page read and write
|
||
|
5870000
|
trusted library allocation
|
page read and write
|
||
|
3891000
|
trusted library allocation
|
page read and write
|
||
|
17D2000
|
heap
|
page read and write
|
||
|
70456000
|
unkown
|
page readonly
|
||
|
33BE000
|
stack
|
page read and write
|
||
|
5E60000
|
heap
|
page read and write
|
||
|
178E000
|
direct allocation
|
page execute and read and write
|
||
|
1A00000
|
heap
|
page read and write
|
||
|
39B8000
|
trusted library allocation
|
page read and write
|
||
|
1751000
|
heap
|
page read and write
|
||
|
7B8E000
|
stack
|
page read and write
|
||
|
36DF000
|
trusted library allocation
|
page read and write
|
||
|
3708000
|
trusted library allocation
|
page read and write
|
||
|
33C0000
|
trusted library allocation
|
page read and write
|
||
|
4429000
|
trusted library allocation
|
page read and write
|
||
|
7EFE000
|
stack
|
page read and write
|
||
|
178D000
|
heap
|
page read and write
|
||
|
5BA0000
|
heap
|
page execute and read and write
|
||
|
16F0000
|
heap
|
page read and write
|
||
|
10C0000
|
heap
|
page read and write
|
||
|
5FBE000
|
stack
|
page read and write
|
||
|
15F0000
|
direct allocation
|
page execute and read and write
|
||
|
198A000
|
trusted library allocation
|
page execute and read and write
|
||
|
33D0000
|
trusted library allocation
|
page read and write
|
||
|
7B90000
|
heap
|
page read and write
|
||
|
1B00000
|
trusted library allocation
|
page execute and read and write
|
||
|
7F10000
|
trusted library allocation
|
page read and write
|
||
|
5D30000
|
trusted library allocation
|
page read and write
|
||
|
3784000
|
trusted library allocation
|
page read and write
|
||
|
5D40000
|
heap
|
page read and write
|
||
|
194E000
|
stack
|
page read and write
|
||
|
15E5000
|
heap
|
page read and write
|
||
|
37C2000
|
trusted library allocation
|
page read and write
|
||
|
70440000
|
unkown
|
page readonly
|
||
|
7D70000
|
trusted library allocation
|
page read and write
|
||
|
5E4D000
|
stack
|
page read and write
|
||
|
1090000
|
heap
|
page read and write
|
||
|
7F5E000
|
stack
|
page read and write
|
||
|
1719000
|
direct allocation
|
page execute and read and write
|
||
|
148F000
|
stack
|
page read and write
|
||
|
3731000
|
trusted library allocation
|
page read and write
|
||
|
158F000
|
stack
|
page read and write
|
||
|
3852000
|
trusted library allocation
|
page read and write
|
||
|
5A20000
|
heap
|
page read and write
|
||
|
70441000
|
unkown
|
page execute read
|
||
|
1190000
|
heap
|
page read and write
|
||
|
376F000
|
trusted library allocation
|
page read and write
|
||
|
7F9E000
|
stack
|
page read and write
|
||
|
551C000
|
stack
|
page read and write
|
||
|
3410000
|
heap
|
page read and write
|
||
|
196D000
|
trusted library allocation
|
page execute and read and write
|
||
|
10C8000
|
heap
|
page read and write
|
||
|
1990000
|
trusted library allocation
|
page read and write
|
||
|
11DE000
|
stack
|
page read and write
|
||
|
172F000
|
heap
|
page read and write
|
||
|
371D000
|
trusted library allocation
|
page read and write
|
||
|
5860000
|
trusted library allocation
|
page read and write
|
||
|
1964000
|
trusted library allocation
|
page read and write
|
||
|
7CE0000
|
trusted library section
|
page read and write
|
||
|
5C70000
|
heap
|
page read and write
|
||
|
7F12000
|
trusted library allocation
|
page read and write
|
||
|
A9AF000
|
stack
|
page read and write
|
||
|
7BA4000
|
heap
|
page read and write
|
||
|
1982000
|
trusted library allocation
|
page read and write
|
||
|
5900000
|
trusted library allocation
|
page read and write
|
||
|
A7AE000
|
stack
|
page read and write
|
||
|
10A0000
|
heap
|
page read and write
|
||
|
5885000
|
trusted library allocation
|
page read and write
|
||
|
7CA0000
|
trusted library allocation
|
page read and write
|
||
|
3421000
|
trusted library allocation
|
page read and write
|
||
|
1963000
|
trusted library allocation
|
page execute and read and write
|
||
|
4421000
|
trusted library allocation
|
page read and write
|
||
|
33DB000
|
trusted library allocation
|
page read and write
|
||
|
3922000
|
trusted library allocation
|
page read and write
|
||
|
1950000
|
trusted library allocation
|
page read and write
|
||
|
1938000
|
direct allocation
|
page execute and read and write
|
||
|
3960000
|
trusted library allocation
|
page read and write
|
||
|
104E000
|
stack
|
page read and write
|
||
|
1748000
|
heap
|
page read and write
|
||
|
3975000
|
trusted library allocation
|
page read and write
|
||
|
39D7000
|
trusted library allocation
|
page read and write
|
||
|
180B000
|
heap
|
page read and write
|
||
|
3798000
|
trusted library allocation
|
page read and write
|
||
|
FE2000
|
unkown
|
page readonly
|
||
|
1986000
|
trusted library allocation
|
page execute and read and write
|
||
|
7590000
|
heap
|
page read and write
|
||
|
1B10000
|
heap
|
page read and write
|
||
|
38BA000
|
trusted library allocation
|
page read and write
|
||
|
C9D000
|
stack
|
page read and write
|
||
|
58F0000
|
heap
|
page read and write
|
||
|
1AF0000
|
heap
|
page execute and read and write
|
||
|
1970000
|
trusted library allocation
|
page read and write
|
||
|
FE0000
|
unkown
|
page readonly
|
||
|
1744000
|
heap
|
page read and write
|
||
|
37D6000
|
trusted library allocation
|
page read and write
|
||
|
39D1000
|
trusted library allocation
|
page read and write
|
||
|
5FC0000
|
trusted library section
|
page read and write
|
||
|
15E0000
|
heap
|
page read and write
|
||
|
33F1000
|
trusted library allocation
|
page read and write
|
||
|
16EF000
|
stack
|
page read and write
|
||
|
36B7000
|
trusted library allocation
|
page read and write
|
||
|
390D000
|
trusted library allocation
|
page read and write
|
||
|
383E000
|
trusted library allocation
|
page read and write
|
||
|
5BEB000
|
stack
|
page read and write
|
||
|
59C0000
|
trusted library allocation
|
page read and write
|
||
|
7FDE000
|
stack
|
page read and write
|
||
|
76B2000
|
trusted library allocation
|
page read and write
|
||
|
1180000
|
heap
|
page read and write
|
||
|
14F7000
|
stack
|
page read and write
|
||
|
39A4000
|
trusted library allocation
|
page read and write
|
||
|
36F3000
|
trusted library allocation
|
page read and write
|
||
|
1753000
|
heap
|
page read and write
|
||
|
5910000
|
trusted library allocation
|
page execute and read and write
|
||
|
33F6000
|
trusted library allocation
|
page read and write
|
||
|
5CB5000
|
heap
|
page read and write
|
||
|
3746000
|
trusted library allocation
|
page read and write
|
||
|
5CB0000
|
heap
|
page read and write
|
||
|
464D000
|
trusted library allocation
|
page read and write
|
||
|
1119000
|
stack
|
page read and write
|
||
|
1A18000
|
trusted library allocation
|
page read and write
|
||
|
197D000
|
trusted library allocation
|
page execute and read and write
|
||
|
5E50000
|
heap
|
page read and write
|
||
|
3829000
|
trusted library allocation
|
page read and write
|
||
|
7DB0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5A23000
|
heap
|
page read and write
|
||
|
A6AE000
|
stack
|
page read and write
|
||
|
33D4000
|
trusted library allocation
|
page read and write
|
||
|
33EE000
|
trusted library allocation
|
page read and write
|
||
|
7045F000
|
unkown
|
page readonly
|
||
|
3989000
|
trusted library allocation
|
page read and write
|
||
|
58B0000
|
trusted library allocation
|
page read and write
|
||
|
3936000
|
trusted library allocation
|
page read and write
|
||
|
5A00000
|
trusted library allocation
|
page execute and read and write
|
There are 181 hidden memdumps, click here to show them.