Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
fqfeeCJXIY.exe
|
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
initial sample
|
||
|
C:\Users\user\AppData\Local\Temp\~DF590B5E50594AA91C.TMP
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\fqfeeCJXIY.exe
|
"C:\Users\user\Desktop\fqfeeCJXIY.exe"
|
 |
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.NewXing.com
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
5A2000
|
unkown
|
page execute and read and write
|
||
|
63B000
|
heap
|
page read and write
|
||
|
24F3000
|
heap
|
page read and write
|
||
|
2333000
|
heap
|
page read and write
|
||
|
22A9000
|
heap
|
page read and write
|
||
|
77E000
|
stack
|
page read and write
|
||
|
23F0000
|
heap
|
page read and write
|
||
|
22AC000
|
heap
|
page read and write
|
||
|
24E9000
|
heap
|
page read and write
|
||
|
22AE000
|
heap
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
5BB000
|
unkown
|
page execute and read and write
|
||
|
63A000
|
heap
|
page read and write
|
||
|
24E0000
|
heap
|
page read and write
|
||
|
2F60000
|
heap
|
page read and write
|
||
|
5A1000
|
unkown
|
page execute and write copy
|
||
|
401000
|
unkown
|
page execute read
|
||
|
59A000
|
unkown
|
page execute read
|
||
|
62B000
|
heap
|
page read and write
|
||
|
243E000
|
stack
|
page read and write
|
||
|
24B0000
|
heap
|
page read and write
|
||
|
63A000
|
heap
|
page read and write
|
||
|
2690000
|
trusted library allocation
|
page read and write
|
||
|
24F8000
|
heap
|
page read and write
|
||
|
22A9000
|
heap
|
page read and write
|
||
|
316F000
|
stack
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
658000
|
heap
|
page read and write
|
||
|
2230000
|
trusted library allocation
|
page execute read
|
||
|
22A0000
|
heap
|
page read and write
|
||
|
2260000
|
heap
|
page read and write
|
||
|
24F0000
|
heap
|
page read and write
|
||
|
222C000
|
heap
|
page read and write
|
||
|
658000
|
heap
|
page read and write
|
||
|
623000
|
heap
|
page read and write
|
||
|
620000
|
heap
|
page read and write
|
||
|
637000
|
heap
|
page read and write
|
||
|
59A000
|
unkown
|
page execute read
|
||
|
46D0000
|
trusted library allocation
|
page read and write
|
||
|
5A1000
|
unkown
|
page execute and write copy
|
||
|
60E000
|
heap
|
page read and write
|
||
|
2210000
|
heap
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
24E5000
|
heap
|
page read and write
|
||
|
22D0000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute and read and write
|
||
|
73E000
|
stack
|
page read and write
|
||
|
22A1000
|
heap
|
page read and write
|
||
|
99000
|
stack
|
page read and write
|
||
|
24B4000
|
heap
|
page read and write
|
||
|
306F000
|
stack
|
page read and write
|
||
|
22A6000
|
heap
|
page read and write
|
||
|
96E000
|
stack
|
page read and write
|
||
|
62E000
|
heap
|
page read and write
|
||
|
247E000
|
stack
|
page read and write
|
||
|
2680000
|
heap
|
page read and write
|
||
|
22C0000
|
heap
|
page read and write
|
||
|
63A000
|
heap
|
page read and write
|
||
|
598000
|
unkown
|
page execute and read and write
|
||
|
A6F000
|
stack
|
page read and write
|
||
|
790000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
623000
|
heap
|
page read and write
|
||
|
2330000
|
heap
|
page read and write
|
||
|
626000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
63A000
|
heap
|
page read and write
|
||
|
60A000
|
heap
|
page read and write
|
||
|
600000
|
heap
|
page read and write
|
||
|
5B3000
|
unkown
|
page execute and write copy
|
||
|
64E000
|
heap
|
page read and write
|
There are 61 hidden memdumps, click here to show them.