Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
N7qmK9sbZa.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
||
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\N7qmK9sbZa.exe.log
|
CSV text
|
modified
|
||
C:\Users\user\AppData\Local\Temp\SystemManager\N7qmK9sbZa.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\SystemManager\N7qmK9sbZa.exe:Zone.Identifier
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\tmpDF0A.tmp
|
ASCII text
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\N7qmK9sbZa.exe
|
"C:\Users\user\Desktop\N7qmK9sbZa.exe"
|
||
C:\Users\user\AppData\Local\Temp\SystemManager\N7qmK9sbZa.exe
|
"C:\Users\user\AppData\Local\Temp\SystemManager\N7qmK9sbZa.exe"
|
||
C:\Windows\SysWOW64\schtasks.exe
|
"schtasks.exe" /Create /TN "SystemUpdateManager" /XML "C:\Users\user\AppData\Local\Temp\tmpDF0A.tmp" /F
|
||
C:\Users\user\AppData\Local\Temp\SystemManager\N7qmK9sbZa.exe
|
C:\Users\user\AppData\Local\Temp\SystemManager\N7qmK9sbZa.exe
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
34.229.235.165
|
|||
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
34.229.235.165
|
unknown
|
United States
|
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
F12000
|
unkown
|
page readonly
|
||
25BF000
|
stack
|
page read and write
|
||
53D0000
|
trusted library allocation
|
page read and write
|
||
3611000
|
trusted library allocation
|
page read and write
|
||
3371000
|
trusted library allocation
|
page read and write
|
||
234E000
|
stack
|
page read and write
|
||
5EE000
|
stack
|
page read and write
|
||
96B000
|
trusted library allocation
|
page execute and read and write
|
||
85C000
|
stack
|
page read and write
|
||
5FFE000
|
stack
|
page read and write
|
||
5D7E000
|
stack
|
page read and write
|
||
488E000
|
stack
|
page read and write
|
||
870000
|
heap
|
page read and write
|
||
32D1000
|
trusted library allocation
|
page read and write
|
||
18D0000
|
trusted library allocation
|
page execute and read and write
|
||
1827000
|
trusted library allocation
|
page execute and read and write
|
||
9F0000
|
heap
|
page read and write
|
||
237E000
|
trusted library allocation
|
page read and write
|
||
C90000
|
heap
|
page read and write
|
||
2440000
|
trusted library allocation
|
page read and write
|
||
956000
|
trusted library allocation
|
page execute and read and write
|
||
661000
|
heap
|
page read and write
|
||
257E000
|
trusted library allocation
|
page read and write
|
||
2385000
|
trusted library allocation
|
page read and write
|
||
490000
|
heap
|
page read and write
|
||
1315000
|
heap
|
page read and write
|
||
1900000
|
heap
|
page read and write
|
||
8D3000
|
heap
|
page read and write
|
||
617E000
|
stack
|
page read and write
|
||
940000
|
trusted library allocation
|
page read and write
|
||
18CE000
|
stack
|
page read and write
|
||
5EFE000
|
stack
|
page read and write
|
||
603B000
|
stack
|
page read and write
|
||
91E000
|
stack
|
page read and write
|
||
760000
|
heap
|
page read and write
|
||
FF080000
|
trusted library allocation
|
page execute and read and write
|
||
4AEE000
|
stack
|
page read and write
|
||
5C3E000
|
stack
|
page read and write
|
||
1840000
|
trusted library allocation
|
page read and write
|
||
25FC000
|
stack
|
page read and write
|
||
C1F000
|
stack
|
page read and write
|
||
510C000
|
stack
|
page read and write
|
||
1505000
|
heap
|
page read and write
|
||
244A000
|
trusted library allocation
|
page read and write
|
||
2240000
|
heap
|
page read and write
|
||
4E1A000
|
stack
|
page read and write
|
||
5770000
|
heap
|
page read and write
|
||
2360000
|
heap
|
page execute and read and write
|
||
654000
|
heap
|
page read and write
|
||
2E5E000
|
stack
|
page read and write
|
||
24BE000
|
stack
|
page read and write
|
||
FBC000
|
stack
|
page read and write
|
||
1440000
|
heap
|
page read and write
|
||
3170000
|
heap
|
page execute and read and write
|
||
8B5000
|
heap
|
page read and write
|
||
16CE000
|
stack
|
page read and write
|
||
5B3E000
|
stack
|
page read and write
|
||
17E0000
|
trusted library allocation
|
page read and write
|
||
5AFE000
|
stack
|
page read and write
|
||
542C000
|
stack
|
page read and write
|
||
2DD0000
|
heap
|
page read and write
|
||
6A2000
|
heap
|
page read and write
|
||
962000
|
trusted library allocation
|
page read and write
|
||
6EB000
|
heap
|
page read and write
|
||
F1E000
|
unkown
|
page readonly
|
||
8A6000
|
heap
|
page read and write
|
||
14DE000
|
heap
|
page read and write
|
||
59FE000
|
stack
|
page read and write
|
||
3399000
|
trusted library allocation
|
page read and write
|
||
2611000
|
trusted library allocation
|
page read and write
|
||
4CDF000
|
stack
|
page read and write
|
||
49AE000
|
stack
|
page read and write
|
||
C34000
|
trusted library allocation
|
page read and write
|
||
5DBE000
|
stack
|
page read and write
|
||
470000
|
heap
|
page read and write
|
||
980000
|
trusted library allocation
|
page read and write
|
||
14D0000
|
heap
|
page read and write
|
||
24A8000
|
trusted library allocation
|
page read and write
|
||
460000
|
heap
|
page read and write
|
||
29FD000
|
stack
|
page read and write
|
||
17F0000
|
trusted library allocation
|
page read and write
|
||
2E1F000
|
unkown
|
page read and write
|
||
4D1C000
|
stack
|
page read and write
|
||
188E000
|
stack
|
page read and write
|
||
1804000
|
trusted library allocation
|
page read and write
|
||
14FD000
|
heap
|
page read and write
|
||
FC000
|
stack
|
page read and write
|
||
5850000
|
heap
|
page read and write
|
||
2F00000
|
heap
|
page read and write
|
||
967000
|
trusted library allocation
|
page execute and read and write
|
||
3EC000
|
stack
|
page read and write
|
||
182B000
|
trusted library allocation
|
page execute and read and write
|
||
62E000
|
heap
|
page read and write
|
||
31C0000
|
heap
|
page read and write
|
||
1571000
|
heap
|
page read and write
|
||
9E0000
|
trusted library allocation
|
page read and write
|
||
620000
|
heap
|
page read and write
|
||
C23000
|
trusted library allocation
|
page execute and read and write
|
||
6EF000
|
heap
|
page read and write
|
||
2470000
|
heap
|
page execute and read and write
|
||
4FF9000
|
stack
|
page read and write
|
||
3160000
|
trusted library allocation
|
page read and write
|
||
62A000
|
heap
|
page read and write
|
||
4BEF000
|
stack
|
page read and write
|
||
17F3000
|
trusted library allocation
|
page execute and read and write
|
||
9AE000
|
stack
|
page read and write
|
||
C57000
|
trusted library allocation
|
page execute and read and write
|
||
44AD000
|
stack
|
page read and write
|
||
2DC0000
|
heap
|
page read and write
|
||
495000
|
heap
|
page read and write
|
||
546C000
|
stack
|
page read and write
|
||
1800000
|
trusted library allocation
|
page read and write
|
||
2CA0000
|
heap
|
page read and write
|
||
14DA000
|
heap
|
page read and write
|
||
2F0B000
|
heap
|
page read and write
|
||
878000
|
heap
|
page read and write
|
||
48A0000
|
heap
|
page execute and read and write
|
||
B00000
|
trusted library allocation
|
page read and write
|
||
F10000
|
unkown
|
page readonly
|
||
2350000
|
trusted library allocation
|
page read and write
|
||
75E000
|
stack
|
page read and write
|
||
2450000
|
trusted library allocation
|
page read and write
|
||
2DBE000
|
unkown
|
page read and write
|
||
8DE000
|
stack
|
page read and write
|
||
95A000
|
trusted library allocation
|
page execute and read and write
|
||
3150000
|
heap
|
page read and write
|
||
1330000
|
heap
|
page read and write
|
||
4EFC000
|
stack
|
page read and write
|
||
26C8000
|
trusted library allocation
|
page read and write
|
||
5670000
|
heap
|
page read and write
|
||
14CE000
|
stack
|
page read and write
|
||
25F8000
|
trusted library allocation
|
page read and write
|
||
47F0000
|
heap
|
page read and write
|
||
43AD000
|
stack
|
page read and write
|
||
9D0000
|
trusted library allocation
|
page execute and read and write
|
||
12F9000
|
stack
|
page read and write
|
||
2600000
|
heap
|
page read and write
|
||
556C000
|
stack
|
page read and write
|
||
17CF000
|
stack
|
page read and write
|
||
B10000
|
heap
|
page read and write
|
||
AAF000
|
stack
|
page read and write
|
||
6F9000
|
stack
|
page read and write
|
||
484E000
|
stack
|
page read and write
|
||
930000
|
trusted library allocation
|
page read and write
|
||
4B80000
|
heap
|
page execute and read and write
|
||
C24000
|
trusted library allocation
|
page read and write
|
||
1513000
|
heap
|
page read and write
|
||
534C000
|
stack
|
page read and write
|
||
89D000
|
stack
|
page read and write
|
||
899000
|
heap
|
page read and write
|
||
4AAE000
|
stack
|
page read and write
|
||
952000
|
trusted library allocation
|
page read and write
|
||
94D000
|
trusted library allocation
|
page execute and read and write
|
||
93D000
|
trusted library allocation
|
page execute and read and write
|
||
C30000
|
trusted library allocation
|
page read and write
|
||
5EBE000
|
stack
|
page read and write
|
||
520F000
|
stack
|
page read and write
|
||
5AE000
|
stack
|
page read and write
|
||
26D6000
|
trusted library allocation
|
page read and write
|
||
1410000
|
heap
|
page read and write
|
||
3150000
|
trusted library allocation
|
page read and write
|
||
934000
|
trusted library allocation
|
page read and write
|
||
613C000
|
stack
|
page read and write
|
||
C80000
|
trusted library allocation
|
page execute and read and write
|
||
750000
|
heap
|
page read and write
|
||
2E9F000
|
stack
|
page read and write
|
||
627F000
|
stack
|
page read and write
|
||
4B2E000
|
stack
|
page read and write
|
||
148D000
|
stack
|
page read and write
|
||
566C000
|
stack
|
page read and write
|
||
1820000
|
trusted library allocation
|
page read and write
|
||
6DB000
|
heap
|
page read and write
|
||
4C9D000
|
stack
|
page read and write
|
||
4D8E000
|
stack
|
page read and write
|
||
17F4000
|
trusted library allocation
|
page read and write
|
||
610000
|
heap
|
page read and write
|
||
4BF0000
|
trusted library allocation
|
page read and write
|
||
AEE000
|
stack
|
page read and write
|
||
53CE000
|
stack
|
page read and write
|
||
1310000
|
heap
|
page read and write
|
||
18E0000
|
heap
|
page read and write
|
||
9CE000
|
stack
|
page read and write
|
||
933000
|
trusted library allocation
|
page execute and read and write
|
||
2C3A000
|
stack
|
page read and write
|
||
1F9000
|
stack
|
page read and write
|
||
2371000
|
trusted library allocation
|
page read and write
|
||
32CE000
|
stack
|
page read and write
|
||
894000
|
heap
|
page read and write
|
||
4B6E000
|
stack
|
page read and write
|
||
58F0000
|
heap
|
page execute and read and write
|
||
920000
|
trusted library allocation
|
page read and write
|
||
770000
|
heap
|
page read and write
|
||
C5B000
|
trusted library allocation
|
page execute and read and write
|
||
5C7E000
|
stack
|
page read and write
|
||
4C8E000
|
stack
|
page read and write
|
||
1542000
|
heap
|
page read and write
|
||
47AE000
|
stack
|
page read and write
|
||
C2D000
|
trusted library allocation
|
page execute and read and write
|
||
6FC000
|
heap
|
page read and write
|
||
42D1000
|
trusted library allocation
|
page read and write
|
There are 190 hidden memdumps, click here to show them.