Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
62.60.153.28
|
unknown
|
Iran (ISLAMIC Republic Of)
|
|
|
|
8.8.8.8
|
unknown
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit
|
Version
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3201000
|
trusted library allocation
|
page read and write
|
|
|
|
3180000
|
heap
|
page execute and read and write
|
||
|
E76000
|
unkown
|
page execute and read and write
|
||
|
1403000
|
trusted library allocation
|
page read and write
|
||
|
3379000
|
trusted library allocation
|
page read and write
|
||
|
32F5000
|
trusted library allocation
|
page read and write
|
||
|
337B000
|
trusted library allocation
|
page read and write
|
||
|
3329000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B260000
|
trusted library allocation
|
page read and write
|
||
|
12F4000
|
stack
|
page read and write
|
||
|
3327000
|
trusted library allocation
|
page read and write
|
||
|
1C02E000
|
heap
|
page read and write
|
||
|
13209000
|
trusted library allocation
|
page read and write
|
||
|
14CC000
|
heap
|
page read and write
|
||
|
32BF000
|
trusted library allocation
|
page read and write
|
||
|
1BBF0000
|
heap
|
page execute and read and write
|
||
|
7FFB4B014000
|
trusted library allocation
|
page read and write
|
||
|
1D13C000
|
stack
|
page read and write
|
||
|
3273000
|
trusted library allocation
|
page read and write
|
||
|
1C7AE000
|
stack
|
page read and write
|
||
|
32B5000
|
trusted library allocation
|
page read and write
|
||
|
32C1000
|
trusted library allocation
|
page read and write
|
||
|
3338000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B023000
|
trusted library allocation
|
page read and write
|
||
|
EC1000
|
unkown
|
page execute and read and write
|
||
|
7FFB4B02D000
|
trusted library allocation
|
page execute and read and write
|
||
|
32D9000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B03D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C0CB000
|
heap
|
page read and write
|
||
|
3268000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B0CC000
|
trusted library allocation
|
page execute and read and write
|
||
|
3350000
|
trusted library allocation
|
page read and write
|
||
|
1539000
|
heap
|
page read and write
|
||
|
15B6000
|
heap
|
page read and write
|
||
|
7FFB4B0D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
F80000
|
heap
|
page read and write
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
7FFB4B034000
|
trusted library allocation
|
page read and write
|
||
|
1C089000
|
heap
|
page read and write
|
||
|
1C5FE000
|
stack
|
page read and write
|
||
|
328D000
|
trusted library allocation
|
page read and write
|
||
|
14C6000
|
heap
|
page read and write
|
||
|
333C000
|
trusted library allocation
|
page read and write
|
||
|
1BDFE000
|
stack
|
page read and write
|
||
|
1400000
|
trusted library allocation
|
page read and write
|
||
|
32E9000
|
trusted library allocation
|
page read and write
|
||
|
32F3000
|
trusted library allocation
|
page read and write
|
||
|
327F000
|
trusted library allocation
|
page read and write
|
||
|
1B200000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B25A000
|
trusted library allocation
|
page read and write
|
||
|
152D000
|
heap
|
page read and write
|
||
|
1B78D000
|
stack
|
page read and write
|
||
|
1C032000
|
heap
|
page read and write
|
||
|
3364000
|
trusted library allocation
|
page read and write
|
||
|
1C495000
|
heap
|
page read and write
|
||
|
7FFB4B03B000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFB4B010000
|
trusted library allocation
|
page read and write
|
||
|
3354000
|
trusted library allocation
|
page read and write
|
||
|
3341000
|
trusted library allocation
|
page read and write
|
||
|
1C09F000
|
heap
|
page read and write
|
||
|
7FFB4B1D0000
|
trusted library allocation
|
page read and write
|
||
|
1BFFB000
|
stack
|
page read and write
|
||
|
1C6FF000
|
stack
|
page read and write
|
||
|
7FFB4B012000
|
trusted library allocation
|
page read and write
|
||
|
3262000
|
trusted library allocation
|
page read and write
|
||
|
1C000000
|
heap
|
page read and write
|
||
|
3333000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B0C6000
|
trusted library allocation
|
page read and write
|
||
|
FC5000
|
heap
|
page read and write
|
||
|
32CB000
|
trusted library allocation
|
page read and write
|
||
|
1C3DE000
|
heap
|
page read and write
|
||
|
7FFB4B030000
|
trusted library allocation
|
page read and write
|
||
|
14C0000
|
heap
|
page read and write
|
||
|
7FFB4B200000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFB4B1DA000
|
trusted library allocation
|
page read and write
|
||
|
1C900000
|
heap
|
page read and write
|
||
|
334D000
|
trusted library allocation
|
page read and write
|
||
|
1C03D000
|
heap
|
page read and write
|
||
|
7FFB4B220000
|
trusted library allocation
|
page read and write
|
||
|
1C0B7000
|
heap
|
page read and write
|
||
|
338F000
|
trusted library allocation
|
page read and write
|
||
|
13201000
|
trusted library allocation
|
page read and write
|
||
|
32FF000
|
trusted library allocation
|
page read and write
|
||
|
32CD000
|
trusted library allocation
|
page read and write
|
||
|
1C085000
|
heap
|
page read and write
|
||
|
1C7EE000
|
stack
|
page read and write
|
||
|
E62000
|
unkown
|
page readonly
|
||
|
7FF428190000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFB4B0C0000
|
trusted library allocation
|
page read and write
|
||
|
E60000
|
unkown
|
page readonly
|
||
|
7FFB4B1C0000
|
trusted library allocation
|
page read and write
|
||
|
F50000
|
heap
|
page read and write
|
||
|
1C05B000
|
heap
|
page read and write
|
||
|
1505000
|
heap
|
page read and write
|
||
|
7FFB4B1BF000
|
trusted library allocation
|
page read and write
|
||
|
1C01D000
|
heap
|
page read and write
|
||
|
1D03A000
|
stack
|
page read and write
|
||
|
32DB000
|
trusted library allocation
|
page read and write
|
||
|
1B580000
|
heap
|
page read and write
|
||
|
F60000
|
heap
|
page read and write
|
||
|
13F0000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B130000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B230000
|
trusted library allocation
|
page read and write
|
||
|
329B000
|
trusted library allocation
|
page read and write
|
||
|
331B000
|
trusted library allocation
|
page read and write
|
||
|
3319000
|
trusted library allocation
|
page read and write
|
||
|
330D000
|
trusted library allocation
|
page read and write
|
||
|
E62000
|
unkown
|
page execute and read and write
|
||
|
14B0000
|
heap
|
page read and write
|
||
|
336F000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B06C000
|
trusted library allocation
|
page execute and read and write
|
||
|
1420000
|
trusted library section
|
page read and write
|
||
|
1C0BF000
|
heap
|
page read and write
|
||
|
1C0D2000
|
heap
|
page read and write
|
||
|
152F000
|
heap
|
page read and write
|
||
|
32E7000
|
trusted library allocation
|
page read and write
|
||
|
330F000
|
trusted library allocation
|
page read and write
|
||
|
32A7000
|
trusted library allocation
|
page read and write
|
||
|
1D339000
|
stack
|
page read and write
|
||
|
335F000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B210000
|
trusted library allocation
|
page read and write
|
||
|
31F0000
|
heap
|
page read and write
|
||
|
1BBCA000
|
stack
|
page read and write
|
||
|
E60000
|
unkown
|
page execute and read and write
|
||
|
7FFB4B1F0000
|
trusted library allocation
|
page read and write
|
||
|
336C000
|
trusted library allocation
|
page read and write
|
||
|
17BC000
|
stack
|
page read and write
|
||
|
3264000
|
trusted library allocation
|
page read and write
|
||
|
FC0000
|
heap
|
page read and write
|
||
|
1C300000
|
heap
|
page read and write
|
||
|
7FFB4B240000
|
trusted library allocation
|
page read and write
|
||
|
16BE000
|
stack
|
page read and write
|
||
|
3335000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B230000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B013000
|
trusted library allocation
|
page execute and read and write
|
||
|
3367000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B0F6000
|
trusted library allocation
|
page execute and read and write
|
||
|
315E000
|
stack
|
page read and write
|
||
|
3301000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B1D7000
|
trusted library allocation
|
page read and write
|
||
|
13A0F000
|
trusted library allocation
|
page read and write
|
||
|
1502000
|
heap
|
page read and write
|
||
|
338A000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B1E0000
|
trusted library allocation
|
page read and write
|
||
|
3385000
|
trusted library allocation
|
page read and write
|
||
|
1562000
|
heap
|
page read and write
|
||
|
1C3A3000
|
heap
|
page read and write
|
||
|
1CF3A000
|
stack
|
page read and write
|
||
|
3387000
|
trusted library allocation
|
page read and write
|
||
|
13D0000
|
trusted library allocation
|
page read and write
|
||
|
3170000
|
trusted library allocation
|
page read and write
|
||
|
1C071000
|
heap
|
page read and write
|
||
|
1C0D7000
|
heap
|
page read and write
|
||
|
7FFB4B01D000
|
trusted library allocation
|
page execute and read and write
|
||
|
14B5000
|
heap
|
page read and write
|
||
|
1BCFA000
|
stack
|
page read and write
|
||
|
3266000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B1B0000
|
trusted library allocation
|
page read and write
|
||
|
1C0CE000
|
heap
|
page read and write
|
||
|
335D000
|
trusted library allocation
|
page read and write
|
There are 150 hidden memdumps, click here to show them.