Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SecuriteInfo.com.FileRepMalware.14270.3068.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\1img.png
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\2img.png
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\3img.png
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\AnyDesk.exe
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.14270.3068.exe
|
"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.14270.3068.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://cdn.discordapp.com/attachments/946434985617944649/1187447469492150292/3img.png?ex=6596eba2&i
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
https://cdn.discordapp.com/attachments/946434985617944649/1187447469743804447/1img.png?ex=6596eba2&i
|
unknown
|
||
|
https://cdn.discordapp.com/
|
unknown
|
||
|
https://cdn.discordapp.com/attachments/946434985617944649/1187447469185974412/2img.png?ex=6596eba2&i
|
unknown
|
||
|
https://autohotkey.com
|
unknown
|
||
|
https://cdn.discordapp.com/attachments/946434985617944649/1187449788539613234/AnyDesk.exe?ex=6596edcb&is=658478cb&hm=1ccb90ac0e74e5fc5ff101f4716703308a02fb42540256a74e81a4d808fbe4ef&
|
162.159.133.233
|
||
|
https://cdn.discordapp.com/attachments/946434985617944649/1187447469185974412/2img.png?ex=6596eba2&is=658476a2&hm=ceac553c8fa20a5a29d3a30fafcd5022ef44d33396c849d1a84b29a8507c87e5&
|
162.159.133.233
|
||
|
https://cdn.discordapp.com/attachments/946434985617944649/1187449788539613234/AnyDesk.exe?ex=6596edc
|
unknown
|
||
|
https://cdn.discordapp.com/attachments/946434985617944649/1187447469743804447/1img.png?ex=6596eba2&is=658476a2&hm=0a3291a0428a9a3a412cccb212e697c45efde312d3ae0a17818b7bba37eb978d&
|
162.159.133.233
|
||
|
https://autohotkey.comCould
|
unknown
|
||
|
https://cdn.discordapp.com/attachments/946434985617944649/1187447469492150292/3img.png?ex=6596eba2&is=658476a2&hm=e54785c353dcbe635c35016ed6a0babbb34588ac67d1176df058c308ee2bef44&
|
162.159.133.233
|
There are 2 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
cdn.discordapp.com
|
162.159.133.233
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
162.159.133.233
|
cdn.discordapp.com
|
United States
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1400E0000
|
unkown
|
page readonly
|
||
|
2BD3000
|
heap
|
page read and write
|
||
|
53BF000
|
stack
|
page read and write
|
||
|
9BC000
|
heap
|
page read and write
|
||
|
14011B000
|
unkown
|
page read and write
|
||
|
2B90000
|
remote allocation
|
page read and write
|
||
|
918000
|
heap
|
page read and write
|
||
|
170000
|
heap
|
page read and write
|
||
|
7F9000
|
stack
|
page read and write
|
||
|
2B90000
|
remote allocation
|
page read and write
|
||
|
7DF000
|
stack
|
page read and write
|
||
|
9BE000
|
heap
|
page read and write
|
||
|
12EE000
|
heap
|
page read and write
|
||
|
7D2000
|
stack
|
page read and write
|
||
|
990000
|
heap
|
page read and write
|
||
|
2C10000
|
heap
|
page read and write
|
||
|
190000
|
heap
|
page read and write
|
||
|
305C000
|
heap
|
page read and write
|
||
|
915000
|
heap
|
page read and write
|
||
|
935000
|
heap
|
page read and write
|
||
|
5BBF000
|
stack
|
page read and write
|
||
|
140127000
|
unkown
|
page execute
|
||
|
996000
|
heap
|
page read and write
|
||
|
4FBE000
|
stack
|
page read and write
|
||
|
304C000
|
heap
|
page read and write
|
||
|
140000000
|
unkown
|
page readonly
|
||
|
91C000
|
heap
|
page read and write
|
||
|
9BE000
|
heap
|
page read and write
|
||
|
14011F000
|
unkown
|
page readonly
|
||
|
911000
|
heap
|
page read and write
|
||
|
9BE000
|
heap
|
page read and write
|
||
|
996000
|
heap
|
page read and write
|
||
|
996000
|
heap
|
page read and write
|
||
|
91D000
|
heap
|
page read and write
|
||
|
3051000
|
heap
|
page read and write
|
||
|
9BE000
|
heap
|
page read and write
|
||
|
57BE000
|
stack
|
page read and write
|
||
|
140000000
|
unkown
|
page readonly
|
||
|
11E0000
|
heap
|
page read and write
|
||
|
11F1000
|
heap
|
page read and write
|
||
|
9BC000
|
heap
|
page read and write
|
||
|
12E0000
|
heap
|
page read and write
|
||
|
8E8000
|
heap
|
page read and write
|
||
|
3067000
|
heap
|
page read and write
|
||
|
3026000
|
heap
|
page read and write
|
||
|
301F000
|
stack
|
page read and write
|
||
|
140112000
|
unkown
|
page read and write
|
||
|
7BE000
|
stack
|
page read and write
|
||
|
3026000
|
heap
|
page read and write
|
||
|
14012A000
|
unkown
|
page readonly
|
||
|
1400E0000
|
unkown
|
page readonly
|
||
|
800000
|
heap
|
page read and write
|
||
|
5C40000
|
heap
|
page read and write
|
||
|
90000
|
heap
|
page read and write
|
||
|
140001000
|
unkown
|
page execute read
|
||
|
990000
|
heap
|
page read and write
|
||
|
9BC000
|
heap
|
page read and write
|
||
|
93F000
|
heap
|
page read and write
|
||
|
3060000
|
heap
|
page read and write
|
||
|
140001000
|
unkown
|
page execute read
|
||
|
3027000
|
heap
|
page read and write
|
||
|
140127000
|
unkown
|
page execute
|
||
|
7FC000
|
stack
|
page read and write
|
||
|
7EF000
|
stack
|
page read and write
|
||
|
1400F2000
|
unkown
|
page readonly
|
||
|
918000
|
heap
|
page read and write
|
||
|
9BC000
|
heap
|
page read and write
|
||
|
9BC000
|
heap
|
page read and write
|
||
|
2B90000
|
remote allocation
|
page read and write
|
||
|
995000
|
heap
|
page read and write
|
||
|
98A000
|
heap
|
page read and write
|
||
|
12E5000
|
heap
|
page read and write
|
||
|
140112000
|
unkown
|
page write copy
|
||
|
4BBB000
|
stack
|
page read and write
|
||
|
919000
|
heap
|
page read and write
|
||
|
14011F000
|
unkown
|
page readonly
|
||
|
6610000
|
trusted library allocation
|
page read and write
|
||
|
1400F2000
|
unkown
|
page readonly
|
||
|
7CF000
|
stack
|
page read and write
|
||
|
3020000
|
heap
|
page read and write
|
||
|
8E0000
|
heap
|
page read and write
|
||
|
9BE000
|
heap
|
page read and write
|
||
|
978000
|
heap
|
page read and write
|
||
|
2BD0000
|
heap
|
page read and write
|
||
|
14012A000
|
unkown
|
page readonly
|
||
|
951000
|
heap
|
page read and write
|
||
|
7E3000
|
stack
|
page read and write
|
There are 77 hidden memdumps, click here to show them.