Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
TcQOmn7lnP.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Roaming\FileExplorer.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\FileExplorer.exe.log
|
CSV text
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\TcQOmn7lnP.exe
|
"C:\Users\user\Desktop\TcQOmn7lnP.exe"
|
|
|
|
C:\Users\user\AppData\Roaming\FileExplorer.exe
|
"C:\Users\user\AppData\Roaming\FileExplorer.exe"
|
|
|
|
C:\Users\user\AppData\Roaming\FileExplorer.exe
|
"C:\Users\user\AppData\Roaming\FileExplorer.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
192.168.68.139
|
|
||
|
tell-outcome.gl.at.ply.gg
|
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
tell-outcome.gl.at.ply.gg
|
147.185.221.24
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
192.168.68.139
|
unknown
|
unknown
|
|
|
|
147.185.221.24
|
tell-outcome.gl.at.ply.gg
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
FileExplorer
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
C12000
|
unkown
|
page readonly
|
|
|
|
7FFD34452000
|
trusted library allocation
|
page read and write
|
||
|
1645000
|
heap
|
page read and write
|
||
|
7FFD344AC000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34460000
|
trusted library allocation
|
page read and write
|
||
|
1B35D000
|
stack
|
page read and write
|
||
|
7FFD344D0000
|
trusted library allocation
|
page read and write
|
||
|
1B750000
|
heap
|
page read and write
|
||
|
1C0FC000
|
stack
|
page read and write
|
||
|
1BD10000
|
heap
|
page read and write
|
||
|
1C4FC000
|
stack
|
page read and write
|
||
|
10F1000
|
heap
|
page read and write
|
||
|
7FFD34453000
|
trusted library allocation
|
page execute and read and write
|
||
|
B20000
|
heap
|
page read and write
|
||
|
7FFD3443D000
|
trusted library allocation
|
page execute and read and write
|
||
|
CD5000
|
heap
|
page read and write
|
||
|
7FFD345F0000
|
trusted library allocation
|
page read and write
|
||
|
11A1000
|
heap
|
page read and write
|
||
|
B63000
|
heap
|
page read and write
|
||
|
F80000
|
trusted library allocation
|
page read and write
|
||
|
AC5000
|
heap
|
page read and write
|
||
|
7FFD34460000
|
trusted library allocation
|
page read and write
|
||
|
DD0000
|
heap
|
page read and write
|
||
|
2B81000
|
trusted library allocation
|
page read and write
|
||
|
FB0000
|
heap
|
page execute and read and write
|
||
|
F60000
|
trusted library allocation
|
page read and write
|
||
|
1131000
|
heap
|
page read and write
|
||
|
F40000
|
heap
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
26A0000
|
heap
|
page execute and read and write
|
||
|
1083000
|
trusted library allocation
|
page read and write
|
||
|
D38000
|
heap
|
page read and write
|
||
|
1B0FD000
|
stack
|
page read and write
|
||
|
1ADED000
|
stack
|
page read and write
|
||
|
1B4AE000
|
stack
|
page read and write
|
||
|
11FF000
|
stack
|
page read and write
|
||
|
7FFD345C0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD344E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
10FE000
|
stack
|
page read and write
|
||
|
DC5000
|
heap
|
page read and write
|
||
|
7FFD34536000
|
trusted library allocation
|
page execute and read and write
|
||
|
10F4000
|
heap
|
page read and write
|
||
|
7F4000
|
stack
|
page read and write
|
||
|
7FFD34432000
|
trusted library allocation
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
1BD60000
|
heap
|
page read and write
|
||
|
CD0000
|
heap
|
page read and write
|
||
|
1B72E000
|
stack
|
page read and write
|
||
|
1179000
|
heap
|
page read and write
|
||
|
DC0000
|
heap
|
page read and write
|
||
|
7FFD34470000
|
trusted library allocation
|
page read and write
|
||
|
7FFD3445D000
|
trusted library allocation
|
page execute and read and write
|
||
|
AAF000
|
heap
|
page read and write
|
||
|
139E000
|
stack
|
page read and write
|
||
|
DF8000
|
heap
|
page read and write
|
||
|
C10000
|
unkown
|
page readonly
|
||
|
1B22E000
|
stack
|
page read and write
|
||
|
7FFD34440000
|
trusted library allocation
|
page read and write
|
||
|
A40000
|
heap
|
page read and write
|
||
|
1000000
|
heap
|
page read and write
|
||
|
ACE000
|
heap
|
page read and write
|
||
|
7FFD3449C000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD3447C000
|
trusted library allocation
|
page execute and read and write
|
||
|
AD5000
|
heap
|
page read and write
|
||
|
EF0000
|
heap
|
page read and write
|
||
|
1B620000
|
heap
|
page read and write
|
||
|
2851000
|
trusted library allocation
|
page read and write
|
||
|
F20000
|
heap
|
page read and write
|
||
|
2D90000
|
heap
|
page read and write
|
||
|
7FFD34462000
|
trusted library allocation
|
page read and write
|
||
|
7FFD3445D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34443000
|
trusted library allocation
|
page execute and read and write
|
||
|
285C000
|
trusted library allocation
|
page read and write
|
||
|
1105000
|
heap
|
page read and write
|
||
|
7FFD34500000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FF4D62E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34570000
|
trusted library allocation
|
page execute and read and write
|
||
|
CF4000
|
stack
|
page read and write
|
||
|
7FFD34500000
|
trusted library allocation
|
page read and write
|
||
|
6B0000
|
unkown
|
page readonly
|
||
|
B54000
|
heap
|
page read and write
|
||
|
9E0000
|
heap
|
page read and write
|
||
|
12B78000
|
trusted library allocation
|
page read and write
|
||
|
12B71000
|
trusted library allocation
|
page read and write
|
||
|
7FFD345E0000
|
trusted library allocation
|
page read and write
|
||
|
12DD8000
|
trusted library allocation
|
page read and write
|
||
|
1B3AE000
|
stack
|
page read and write
|
||
|
7FFD34526000
|
trusted library allocation
|
page execute and read and write
|
||
|
A96000
|
heap
|
page read and write
|
||
|
7FFD3442D000
|
trusted library allocation
|
page execute and read and write
|
||
|
A90000
|
heap
|
page read and write
|
||
|
1B85A000
|
stack
|
page read and write
|
||
|
1050000
|
trusted library allocation
|
page read and write
|
||
|
1B73E000
|
stack
|
page read and write
|
||
|
7FFD344F6000
|
trusted library allocation
|
page read and write
|
||
|
7FFD3444D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34450000
|
trusted library allocation
|
page read and write
|
||
|
1B156000
|
heap
|
page read and write
|
||
|
B01000
|
heap
|
page read and write
|
||
|
DA0000
|
heap
|
page read and write
|
||
|
1135000
|
heap
|
page read and write
|
||
|
7FFD34464000
|
trusted library allocation
|
page read and write
|
||
|
D6C000
|
heap
|
page read and write
|
||
|
FF5000
|
heap
|
page read and write
|
||
|
7FFD344FC000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34424000
|
trusted library allocation
|
page read and write
|
||
|
2840000
|
heap
|
page read and write
|
||
|
7FFD34506000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B92E000
|
stack
|
page read and write
|
||
|
7FFD34454000
|
trusted library allocation
|
page read and write
|
||
|
2D5E000
|
stack
|
page read and write
|
||
|
7FFD34423000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B753000
|
heap
|
page read and write
|
||
|
11A4000
|
heap
|
page read and write
|
||
|
2B60000
|
heap
|
page execute and read and write
|
||
|
F15000
|
heap
|
page read and write
|
||
|
7FFD344F0000
|
trusted library allocation
|
page read and write
|
||
|
EE0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34444000
|
trusted library allocation
|
page read and write
|
||
|
D5A000
|
heap
|
page read and write
|
||
|
2DD1000
|
trusted library allocation
|
page read and write
|
||
|
7FFD3446D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B740000
|
heap
|
page read and write
|
||
|
10EB000
|
heap
|
page read and write
|
||
|
1C2FA000
|
stack
|
page read and write
|
||
|
7FFD345F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
EDF000
|
stack
|
page read and write
|
||
|
7FFD34434000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34440000
|
trusted library allocation
|
page read and write
|
||
|
12DD1000
|
trusted library allocation
|
page read and write
|
||
|
2B3E000
|
stack
|
page read and write
|
||
|
AD0000
|
heap
|
page read and write
|
||
|
7FFD34560000
|
trusted library allocation
|
page execute and read and write
|
||
|
AD2000
|
heap
|
page read and write
|
||
|
7FFD34464000
|
trusted library allocation
|
page read and write
|
||
|
DF6000
|
heap
|
page read and write
|
||
|
1102000
|
heap
|
page read and write
|
||
|
12858000
|
trusted library allocation
|
page read and write
|
||
|
12B73000
|
trusted library allocation
|
page read and write
|
||
|
1080000
|
trusted library allocation
|
page read and write
|
||
|
DDF000
|
stack
|
page read and write
|
||
|
D00000
|
heap
|
page read and write
|
||
|
1BD0E000
|
stack
|
page read and write
|
||
|
1B270000
|
heap
|
page execute and read and write
|
||
|
10CC000
|
heap
|
page read and write
|
||
|
1B5AF000
|
stack
|
page read and write
|
||
|
A50000
|
heap
|
page read and write
|
||
|
1B2A0000
|
heap
|
page read and write
|
||
|
2B71000
|
trusted library allocation
|
page read and write
|
||
|
CB0000
|
trusted library allocation
|
page read and write
|
||
|
EF5000
|
heap
|
page read and write
|
||
|
12851000
|
trusted library allocation
|
page read and write
|
||
|
2DC0000
|
heap
|
page read and write
|
||
|
2B7F000
|
trusted library allocation
|
page read and write
|
||
|
F10000
|
heap
|
page read and write
|
||
|
12853000
|
trusted library allocation
|
page read and write
|
||
|
1AE00000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34540000
|
trusted library allocation
|
page execute and read and write
|
||
|
1BD7E000
|
heap
|
page read and write
|
||
|
1C3FC000
|
stack
|
page read and write
|
||
|
1C1FF000
|
stack
|
page read and write
|
||
|
2A30000
|
heap
|
page read and write
|
||
|
1181000
|
heap
|
page read and write
|
||
|
D30000
|
heap
|
page read and write
|
||
|
A9C000
|
heap
|
page read and write
|
||
|
7FFD3446D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B53E000
|
stack
|
page read and write
|
||
|
10C0000
|
heap
|
page read and write
|
||
|
1640000
|
heap
|
page read and write
|
||
|
C60000
|
heap
|
page read and write
|
||
|
AFB000
|
heap
|
page read and write
|
||
|
D4C000
|
heap
|
page read and write
|
||
|
27AE000
|
stack
|
page read and write
|
||
|
2D80000
|
heap
|
page execute and read and write
|
||
|
D54000
|
stack
|
page read and write
|
||
|
1BB0E000
|
stack
|
page read and write
|
||
|
D62000
|
heap
|
page read and write
|
||
|
1BC0E000
|
stack
|
page read and write
|
||
|
1BA04000
|
stack
|
page read and write
|
||
|
1070000
|
trusted library allocation
|
page read and write
|
||
|
D6E000
|
heap
|
page read and write
|
||
|
1020000
|
heap
|
page read and write
|
||
|
D99000
|
heap
|
page read and write
|
||
|
1B900000
|
heap
|
page execute and read and write
|
||
|
7FFD34510000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B6FE000
|
stack
|
page read and write
|
||
|
ABB000
|
heap
|
page read and write
|
||
|
2B7C000
|
trusted library allocation
|
page read and write
|
||
|
1B82F000
|
stack
|
page read and write
|
||
|
7FFD34430000
|
trusted library allocation
|
page read and write
|
There are 180 hidden memdumps, click here to show them.