Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
antispam.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\qwertyuio.txt
|
data
|
modified
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
|
|
C:\Windows\System32\cmd.exe
|
cmd.exe /c systeminfo
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
|
|
C:\Windows\System32\systeminfo.exe
|
systeminfo
|
|
|
|
C:\Windows\System32\cmd.exe
|
cmd.exe /c route print
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
|
|
C:\Windows\System32\cmd.exe
|
cmd.exe /c ipconfig /all
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
|
|
|
C:\Windows\System32\ipconfig.exe
|
ipconfig /all
|
|
|
|
C:\Users\user\Desktop\antispam.exe
|
"C:\Users\user\Desktop\antispam.exe"
|
||
|
C:\Windows\System32\wbem\WmiPrvSE.exe
|
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
|
||
|
C:\Windows\System32\ROUTE.EXE
|
route print
|
There are 2 hidden processes, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\24\417C44EB
|
@%SystemRoot%\system32\mlang.dll,-4387
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\24\417C44EB
|
@%SystemRoot%\system32\mlang.dll,-4407
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
202CB9C0000
|
heap
|
page read and write
|
||
|
1F553A58000
|
heap
|
page read and write
|
||
|
202CB83B000
|
heap
|
page read and write
|
||
|
3DD3FAD000
|
stack
|
page read and write
|
||
|
202CB810000
|
heap
|
page read and write
|
||
|
7FF6A1F71000
|
unkown
|
page execute read
|
||
|
9E196FE000
|
stack
|
page read and write
|
||
|
202CB86D000
|
heap
|
page read and write
|
||
|
202CB85E000
|
heap
|
page read and write
|
||
|
202CB85C000
|
heap
|
page read and write
|
||
|
22AFC160000
|
heap
|
page read and write
|
||
|
1F553A6A000
|
heap
|
page read and write
|
||
|
202CB859000
|
heap
|
page read and write
|
||
|
7FF6A1F78000
|
unkown
|
page write copy
|
||
|
202CB859000
|
heap
|
page read and write
|
||
|
1F553A5E000
|
heap
|
page read and write
|
||
|
202CB836000
|
heap
|
page read and write
|
||
|
1F5558D0000
|
heap
|
page read and write
|
||
|
22AFC060000
|
heap
|
page read and write
|
||
|
1F5553A5000
|
heap
|
page read and write
|
||
|
202CB859000
|
heap
|
page read and write
|
||
|
7FF6A1F75000
|
unkown
|
page readonly
|
||
|
3DD427F000
|
stack
|
page read and write
|
||
|
1F5539C0000
|
heap
|
page read and write
|
||
|
202CB863000
|
heap
|
page read and write
|
||
|
7FF6A1F79000
|
unkown
|
page readonly
|
||
|
202CB835000
|
heap
|
page read and write
|
||
|
202CB859000
|
heap
|
page read and write
|
||
|
7FF6A1F75000
|
unkown
|
page readonly
|
||
|
202CB845000
|
heap
|
page read and write
|
||
|
22AFC069000
|
heap
|
page read and write
|
||
|
202CB835000
|
heap
|
page read and write
|
||
|
22AFC180000
|
heap
|
page read and write
|
||
|
202CB843000
|
heap
|
page read and write
|
||
|
1F553950000
|
heap
|
page read and write
|
||
|
682807E000
|
stack
|
page read and write
|
||
|
22AFC2F5000
|
heap
|
page read and write
|
||
|
22AFC07C000
|
heap
|
page read and write
|
||
|
202CB867000
|
heap
|
page read and write
|
||
|
1F5553AA000
|
heap
|
page read and write
|
||
|
6827D1E000
|
stack
|
page read and write
|
||
|
202CB845000
|
heap
|
page read and write
|
||
|
22AFBF70000
|
heap
|
page read and write
|
||
|
6827D9E000
|
stack
|
page read and write
|
||
|
202CB859000
|
heap
|
page read and write
|
||
|
1F5553A0000
|
heap
|
page read and write
|
||
|
7FF6A1F70000
|
unkown
|
page readonly
|
||
|
1F553A39000
|
heap
|
page read and write
|
||
|
9E195FE000
|
stack
|
page read and write
|
||
|
7FF6A1F79000
|
unkown
|
page readonly
|
||
|
9E192F8000
|
stack
|
page read and write
|
||
|
1F557030000
|
trusted library allocation
|
page read and write
|
||
|
1F553A1B000
|
heap
|
page read and write
|
||
|
1F5539F3000
|
heap
|
page read and write
|
||
|
3DD42FF000
|
stack
|
page read and write
|
||
|
202CB9C5000
|
heap
|
page read and write
|
||
|
1F553A10000
|
heap
|
page read and write
|
||
|
6827C9B000
|
stack
|
page read and write
|
||
|
7FF6A1F71000
|
unkown
|
page execute read
|
||
|
202CB83B000
|
heap
|
page read and write
|
||
|
7FF6A1F70000
|
unkown
|
page readonly
|
||
|
202CB817000
|
heap
|
page read and write
|
||
|
1F553A5B000
|
heap
|
page read and write
|
||
|
202CB6F0000
|
heap
|
page read and write
|
||
|
1F555580000
|
heap
|
page read and write
|
||
|
202CB859000
|
heap
|
page read and write
|
||
|
1F5539F0000
|
heap
|
page read and write
|
||
|
202CB7F0000
|
heap
|
page read and write
|
||
|
22AFC2F0000
|
heap
|
page read and write
|
||
|
1F553870000
|
heap
|
page read and write
|
||
|
7FF6A1F78000
|
unkown
|
page read and write
|
||
|
68280FF000
|
stack
|
page read and write
|
||
|
202CB7D0000
|
heap
|
page read and write
|
||
|
1F553980000
|
heap
|
page read and write
|
||
|
682817E000
|
stack
|
page read and write
|
There are 65 hidden memdumps, click here to show them.