Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
mkcert.exe
|
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 69211 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\mkcert.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_epl2j0gi.api.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hxksep0d.1bn.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lkfmsclc.hpv.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m4agtt0c.k02.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\mkcert.exe
|
C:\Users\user\Desktop\mkcert.exe
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://nuget.org/NuGet.exe
|
unknown
|
||
|
http://pesterbdd.com/images/Pester.png
|
unknown
|
||
|
http://schemas.xmlsoap.org/soap/encoding/
|
unknown
|
||
|
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
|
http://schemas.xmlsoap.org/wsdl/
|
unknown
|
||
|
https://contoso.com/
|
unknown
|
||
|
https://nuget.org/nuget.exe
|
unknown
|
||
|
https://contoso.com/License
|
unknown
|
||
|
https://contoso.com/Icon
|
unknown
|
||
|
http://www.quovadis.bm0
|
unknown
|
||
|
https://ocsp.quovadisoffshore.com0
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://github.com/Pester/Pester
|
unknown
|
There are 3 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates\DCFAAC6AAF19C606A0546FBD5AEB657469C82477
|
Blob
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\0EE2B3F9B153D807CCA729F5DB30AC534602C3E5
|
Blob
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\My\Certificates\0EE2B3F9B153D807CCA729F5DB30AC534602C3E5
|
Blob
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\My\Keys\5E06A4893BEF4FCB9B0129B52FE4F0FF16BC8361
|
Blob
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
DFE000
|
stack
|
page read and write
|
||
|
6430000
|
trusted library allocation
|
page read and write
|
||
|
59F6000
|
heap
|
page read and write
|
||
|
14DC000
|
heap
|
page read and write
|
||
|
6950000
|
trusted library allocation
|
page read and write
|
||
|
13ED000
|
trusted library allocation
|
page execute and read and write
|
||
|
9630000
|
trusted library allocation
|
page read and write
|
||
|
5B1D000
|
trusted library allocation
|
page read and write
|
||
|
914F000
|
stack
|
page read and write
|
||
|
9150000
|
heap
|
page read and write
|
||
|
99EE000
|
stack
|
page read and write
|
||
|
37C6000
|
trusted library allocation
|
page read and write
|
||
|
5C00000
|
trusted library allocation
|
page read and write
|
||
|
30F0000
|
heap
|
page execute and read and write
|
||
|
140B000
|
trusted library allocation
|
page execute and read and write
|
||
|
5B16000
|
trusted library allocation
|
page read and write
|
||
|
16AC000
|
stack
|
page read and write
|
||
|
91C0000
|
heap
|
page read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
91B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
9560000
|
trusted library allocation
|
page execute and read and write
|
||
|
59CE000
|
stack
|
page read and write
|
||
|
642E000
|
stack
|
page read and write
|
||
|
64E1000
|
heap
|
page read and write
|
||
|
9249000
|
heap
|
page read and write
|
||
|
1220000
|
heap
|
page read and write
|
||
|
961E000
|
stack
|
page read and write
|
||
|
6970000
|
trusted library allocation
|
page execute and read and write
|
||
|
4119000
|
trusted library allocation
|
page read and write
|
||
|
9659000
|
trusted library allocation
|
page read and write
|
||
|
92D7000
|
heap
|
page read and write
|
||
|
7C50000
|
trusted library allocation
|
page read and write
|
||
|
7DEE000
|
stack
|
page read and write
|
||
|
5B19000
|
trusted library allocation
|
page read and write
|
||
|
5B4D000
|
trusted library allocation
|
page read and write
|
||
|
16F0000
|
heap
|
page read and write
|
||
|
578E000
|
stack
|
page read and write
|
||
|
382E000
|
trusted library allocation
|
page read and write
|
||
|
64D2000
|
heap
|
page read and write
|
||
|
6520000
|
heap
|
page read and write
|
||
|
9281000
|
heap
|
page read and write
|
||
|
97F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
9E5D000
|
stack
|
page read and write
|
||
|
7A90000
|
trusted library allocation
|
page read and write
|
||
|
7CAE000
|
stack
|
page read and write
|
||
|
9070000
|
trusted library allocation
|
page execute and read and write
|
||
|
975C000
|
trusted library allocation
|
page read and write
|
||
|
9030000
|
trusted library allocation
|
page read and write
|
||
|
5B48000
|
trusted library allocation
|
page read and write
|
||
|
1402000
|
trusted library allocation
|
page read and write
|
||
|
984D000
|
stack
|
page read and write
|
||
|
9A10000
|
trusted library allocation
|
page read and write
|
||
|
93C0000
|
trusted library allocation
|
page read and write
|
||
|
922F000
|
heap
|
page read and write
|
||
|
D3C000
|
stack
|
page read and write
|
||
|
5DB0000
|
trusted library allocation
|
page read and write
|
||
|
37F8000
|
trusted library allocation
|
page read and write
|
||
|
9675000
|
trusted library allocation
|
page read and write
|
||
|
7BA0000
|
trusted library allocation
|
page read and write
|
||
|
7AE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
4111000
|
trusted library allocation
|
page read and write
|
||
|
9735000
|
trusted library allocation
|
page read and write
|
||
|
A49F000
|
stack
|
page read and write
|
||
|
964B000
|
trusted library allocation
|
page read and write
|
||
|
8EDE000
|
stack
|
page read and write
|
||
|
13D3000
|
trusted library allocation
|
page execute and read and write
|
||
|
9640000
|
trusted library allocation
|
page read and write
|
||
|
68E8000
|
trusted library allocation
|
page read and write
|
||
|
6542000
|
heap
|
page read and write
|
||
|
9780000
|
trusted library allocation
|
page read and write
|
||
|
16EA000
|
trusted library allocation
|
page read and write
|
||
|
9690000
|
trusted library allocation
|
page read and write
|
||
|
13C0000
|
trusted library allocation
|
page read and write
|
||
|
7A60000
|
trusted library allocation
|
page read and write
|
||
|
7B00000
|
trusted library allocation
|
page read and write
|
||
|
A05E000
|
stack
|
page read and write
|
||
|
649C000
|
heap
|
page read and write
|
||
|
6920000
|
trusted library allocation
|
page read and write
|
||
|
6A10000
|
trusted library allocation
|
page read and write
|
||
|
7A10000
|
trusted library allocation
|
page read and write
|
||
|
9648000
|
trusted library allocation
|
page read and write
|
||
|
9B5E000
|
stack
|
page read and write
|
||
|
8E9C000
|
stack
|
page read and write
|
||
|
68CC000
|
stack
|
page read and write
|
||
|
5C20000
|
trusted library allocation
|
page read and write
|
||
|
5108000
|
trusted library allocation
|
page read and write
|
||
|
16C0000
|
trusted library allocation
|
page read and write
|
||
|
64AC000
|
heap
|
page read and write
|
||
|
4132000
|
trusted library allocation
|
page read and write
|
||
|
FFC60000
|
trusted library allocation
|
page execute and read and write
|
||
|
9A5E000
|
stack
|
page read and write
|
||
|
7B80000
|
trusted library allocation
|
page execute and read and write
|
||
|
9663000
|
trusted library allocation
|
page read and write
|
||
|
A5DE000
|
stack
|
page read and write
|
||
|
13D4000
|
trusted library allocation
|
page read and write
|
||
|
CA2000
|
unkown
|
page readonly
|
||
|
5D05000
|
trusted library allocation
|
page read and write
|
||
|
19C6000
|
heap
|
page read and write
|
||
|
58B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5790000
|
trusted library allocation
|
page read and write
|
||
|
9259000
|
heap
|
page read and write
|
||
|
4101000
|
trusted library allocation
|
page read and write
|
||
|
7A20000
|
trusted library allocation
|
page read and write
|
||
|
141E000
|
heap
|
page read and write
|
||
|
9760000
|
trusted library allocation
|
page read and write
|
||
|
96EF000
|
trusted library allocation
|
page read and write
|
||
|
6490000
|
heap
|
page read and write
|
||
|
16ED000
|
trusted library allocation
|
page read and write
|
||
|
971E000
|
trusted library allocation
|
page read and write
|
||
|
96D6000
|
trusted library allocation
|
page read and write
|
||
|
325B000
|
trusted library allocation
|
page read and write
|
||
|
7AA0000
|
trusted library allocation
|
page read and write
|
||
|
7AF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
9278000
|
heap
|
page read and write
|
||
|
1400000
|
trusted library allocation
|
page read and write
|
||
|
7AC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
91A0000
|
trusted library allocation
|
page read and write
|
||
|
13DD000
|
trusted library allocation
|
page execute and read and write
|
||
|
17FE000
|
stack
|
page read and write
|
||
|
9750000
|
trusted library allocation
|
page read and write
|
||
|
5BB0000
|
trusted library allocation
|
page read and write
|
||
|
68DF000
|
trusted library allocation
|
page read and write
|
||
|
1225000
|
heap
|
page read and write
|
||
|
58C0000
|
heap
|
page execute and read and write
|
||
|
7A30000
|
trusted library allocation
|
page read and write
|
||
|
8D9E000
|
stack
|
page read and write
|
||
|
9706000
|
trusted library allocation
|
page read and write
|
||
|
1405000
|
trusted library allocation
|
page execute and read and write
|
||
|
6980000
|
trusted library allocation
|
page read and write
|
||
|
950F000
|
stack
|
page read and write
|
||
|
1444000
|
heap
|
page read and write
|
||
|
13E0000
|
trusted library allocation
|
page read and write
|
||
|
A600000
|
trusted library allocation
|
page execute and read and write
|
||
|
9510000
|
heap
|
page read and write
|
||
|
9643000
|
trusted library allocation
|
page read and write
|
||
|
67CE000
|
stack
|
page read and write
|
||
|
150A000
|
heap
|
page read and write
|
||
|
7C20000
|
trusted library allocation
|
page execute and read and write
|
||
|
A5E0000
|
trusted library allocation
|
page read and write
|
||
|
30DE000
|
stack
|
page read and write
|
||
|
9D40000
|
trusted library allocation
|
page read and write
|
||
|
6494000
|
heap
|
page read and write
|
||
|
9000000
|
trusted library allocation
|
page read and write
|
||
|
7BF0000
|
trusted library allocation
|
page read and write
|
||
|
899F000
|
stack
|
page read and write
|
||
|
7EC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
9860000
|
trusted library allocation
|
page read and write
|
||
|
6910000
|
trusted library allocation
|
page read and write
|
||
|
910D000
|
stack
|
page read and write
|
||
|
922D000
|
heap
|
page read and write
|
||
|
6A30000
|
trusted library allocation
|
page read and write
|
||
|
9668000
|
trusted library allocation
|
page read and write
|
||
|
58AE000
|
stack
|
page read and write
|
||
|
8BDE000
|
stack
|
page read and write
|
||
|
3493000
|
trusted library allocation
|
page read and write
|
||
|
6990000
|
trusted library allocation
|
page read and write
|
||
|
9050000
|
trusted library allocation
|
page read and write
|
||
|
529D000
|
stack
|
page read and write
|
||
|
64EF000
|
heap
|
page read and write
|
||
|
5BA0000
|
trusted library allocation
|
page read and write
|
||
|
59E7000
|
heap
|
page read and write
|
||
|
6590000
|
heap
|
page read and write
|
||
|
59FB000
|
heap
|
page read and write
|
||
|
96ED000
|
trusted library allocation
|
page read and write
|
||
|
6930000
|
trusted library allocation
|
page execute and read and write
|
||
|
A4DE000
|
stack
|
page read and write
|
||
|
13F0000
|
trusted library allocation
|
page read and write
|
||
|
6509000
|
heap
|
page read and write
|
||
|
1990000
|
trusted library allocation
|
page read and write
|
||
|
9740000
|
trusted library allocation
|
page read and write
|
||
|
9020000
|
trusted library allocation
|
page execute and read and write
|
||
|
5AE0000
|
trusted library allocation
|
page read and write
|
||
|
16D0000
|
heap
|
page read and write
|
||
|
5BB9000
|
trusted library allocation
|
page read and write
|
||
|
16E0000
|
trusted library allocation
|
page read and write
|
||
|
120E000
|
stack
|
page read and write
|
||
|
CD0000
|
heap
|
page read and write
|
||
|
14E1000
|
heap
|
page read and write
|
||
|
5BBB000
|
trusted library allocation
|
page read and write
|
||
|
678F000
|
stack
|
page read and write
|
||
|
8A9E000
|
stack
|
page read and write
|
||
|
9680000
|
trusted library allocation
|
page read and write
|
||
|
132E000
|
stack
|
page read and write
|
||
|
99F0000
|
trusted library allocation
|
page read and write
|
||
|
90A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7A80000
|
trusted library allocation
|
page read and write
|
||
|
57E0000
|
trusted library allocation
|
page read and write
|
||
|
9267000
|
heap
|
page read and write
|
||
|
7DAE000
|
stack
|
page read and write
|
||
|
96A0000
|
trusted library allocation
|
page read and write
|
||
|
19B6000
|
trusted library allocation
|
page read and write
|
||
|
CA0000
|
unkown
|
page readonly
|
||
|
7EE0000
|
trusted library allocation
|
page read and write
|
||
|
16F7000
|
heap
|
page read and write
|
||
|
13E3000
|
trusted library allocation
|
page read and write
|
||
|
410B000
|
trusted library allocation
|
page read and write
|
||
|
9190000
|
trusted library allocation
|
page read and write
|
||
|
928F000
|
heap
|
page read and write
|
||
|
9245000
|
heap
|
page read and write
|
||
|
9010000
|
trusted library allocation
|
page read and write
|
||
|
8B9E000
|
stack
|
page read and write
|
||
|
963C000
|
trusted library allocation
|
page execute and read and write
|
||
|
5AD0000
|
trusted library allocation
|
page read and write
|
||
|
95BE000
|
stack
|
page read and write
|
||
|
6523000
|
heap
|
page read and write
|
||
|
6A20000
|
trusted library allocation
|
page read and write
|
||
|
9620000
|
trusted library allocation
|
page read and write
|
||
|
96FF000
|
trusted library allocation
|
page read and write
|
||
|
9CF0000
|
trusted library allocation
|
page read and write
|
||
|
7E2E000
|
stack
|
page read and write
|
||
|
5B25000
|
trusted library allocation
|
page read and write
|
||
|
68D1000
|
trusted library allocation
|
page read and write
|
||
|
FFC78000
|
trusted library allocation
|
page execute and read and write
|
||
|
59E1000
|
heap
|
page read and write
|
||
|
95D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
37C4000
|
trusted library allocation
|
page read and write
|
||
|
6515000
|
heap
|
page read and write
|
||
|
96F4000
|
trusted library allocation
|
page read and write
|
||
|
95C3000
|
trusted library allocation
|
page read and write
|
||
|
1620000
|
trusted library allocation
|
page read and write
|
||
|
19C0000
|
heap
|
page read and write
|
||
|
9738000
|
trusted library allocation
|
page read and write
|
||
|
92AE000
|
heap
|
page read and write
|
||
|
37C8000
|
trusted library allocation
|
page read and write
|
||
|
8D5E000
|
stack
|
page read and write
|
||
|
9636000
|
trusted library allocation
|
page execute and read and write
|
||
|
4115000
|
trusted library allocation
|
page read and write
|
||
|
1407000
|
trusted library allocation
|
page execute and read and write
|
||
|
19A0000
|
trusted library allocation
|
page read and write
|
||
|
6960000
|
trusted library allocation
|
page read and write
|
||
|
9550000
|
trusted library allocation
|
page read and write
|
||
|
5BC0000
|
trusted library allocation
|
page read and write
|
||
|
95C0000
|
trusted library allocation
|
page read and write
|
||
|
9683000
|
trusted library allocation
|
page read and write
|
||
|
99AE000
|
stack
|
page read and write
|
||
|
19CE000
|
heap
|
page read and write
|
||
|
8FE0000
|
trusted library allocation
|
page read and write
|
||
|
7C10000
|
trusted library allocation
|
page read and write
|
||
|
7F00000
|
trusted library allocation
|
page read and write
|
||
|
13D0000
|
trusted library allocation
|
page read and write
|
||
|
6940000
|
trusted library allocation
|
page execute and read and write
|
||
|
967E000
|
trusted library allocation
|
page read and write
|
||
|
9295000
|
heap
|
page read and write
|
||
|
90C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
9657000
|
trusted library allocation
|
page read and write
|
||
|
568E000
|
stack
|
page read and write
|
||
|
9060000
|
trusted library allocation
|
page read and write
|
||
|
68F0000
|
trusted library allocation
|
page read and write
|
||
|
A39E000
|
stack
|
page read and write
|
||
|
7B60000
|
trusted library allocation
|
page read and write
|
||
|
9CC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7A00000
|
trusted library allocation
|
page read and write
|
||
|
1437000
|
heap
|
page read and write
|
||
|
9639000
|
trusted library allocation
|
page execute and read and write
|
||
|
95CD000
|
trusted library allocation
|
page execute and read and write
|
||
|
68F6000
|
trusted library allocation
|
page read and write
|
||
|
10F8000
|
stack
|
page read and write
|
||
|
7C00000
|
trusted library allocation
|
page execute and read and write
|
||
|
7AB0000
|
trusted library allocation
|
page read and write
|
||
|
1418000
|
heap
|
page read and write
|
||
|
9040000
|
trusted library allocation
|
page execute and read and write
|
||
|
9686000
|
trusted library allocation
|
page read and write
|
||
|
4177000
|
trusted library allocation
|
page read and write
|
||
|
5B30000
|
trusted library allocation
|
page read and write
|
||
|
136D000
|
stack
|
page read and write
|
||
|
9651000
|
trusted library allocation
|
page read and write
|
||
|
7A40000
|
trusted library allocation
|
page read and write
|
||
|
7EF0000
|
trusted library allocation
|
page read and write
|
||
|
7B90000
|
trusted library allocation
|
page execute and read and write
|
||
|
96F1000
|
trusted library allocation
|
page read and write
|
||
|
68F8000
|
trusted library allocation
|
page read and write
|
||
|
348D000
|
trusted library allocation
|
page read and write
|
||
|
8FF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7A50000
|
trusted library allocation
|
page read and write
|
||
|
9F5D000
|
stack
|
page read and write
|
||
|
8C5E000
|
stack
|
page read and write
|
||
|
7B70000
|
trusted library allocation
|
page read and write
|
||
|
3101000
|
trusted library allocation
|
page read and write
|
||
|
8C1F000
|
stack
|
page read and write
|
||
|
7A70000
|
trusted library allocation
|
page read and write
|
||
|
68D4000
|
trusted library allocation
|
page read and write
|
||
|
35F4000
|
trusted library allocation
|
page read and write
|
||
|
160E000
|
stack
|
page read and write
|
||
|
13F6000
|
trusted library allocation
|
page execute and read and write
|
||
|
16B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
19B0000
|
trusted library allocation
|
page read and write
|
||
|
9B60000
|
trusted library allocation
|
page read and write
|
||
|
5B10000
|
trusted library allocation
|
page read and write
|
||
|
940E000
|
stack
|
page read and write
|
||
|
96C2000
|
trusted library allocation
|
page read and write
|
||
|
5B40000
|
trusted library allocation
|
page read and write
|
||
|
9570000
|
trusted library allocation
|
page read and write
|
||
|
64FF000
|
heap
|
page read and write
|
||
|
96E0000
|
trusted library allocation
|
page read and write
|
||
|
8FDE000
|
stack
|
page read and write
|
||
|
166E000
|
stack
|
page read and write
|
||
|
5B20000
|
trusted library allocation
|
page read and write
|
||
|
9232000
|
heap
|
page read and write
|
||
|
55E0000
|
heap
|
page read and write
|
||
|
971C000
|
trusted library allocation
|
page read and write
|
||
|
1410000
|
heap
|
page read and write
|
||
|
68EC000
|
trusted library allocation
|
page read and write
|
||
|
9665000
|
trusted library allocation
|
page read and write
|
||
|
5BA3000
|
trusted library allocation
|
page read and write
|
||
|
3154000
|
trusted library allocation
|
page read and write
|
||
|
59F2000
|
heap
|
page read and write
|
||
|
1451000
|
heap
|
page read and write
|
||
|
5B90000
|
trusted library allocation
|
page read and write
|
||
|
7AD0000
|
trusted library allocation
|
page read and write
|
||
|
7EBE000
|
stack
|
page read and write
|
||
|
5D30000
|
trusted library allocation
|
page execute and read and write
|
||
|
7BE0000
|
trusted library allocation
|
page read and write
|
There are 302 hidden memdumps, click here to show them.