Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
En3e396wX1.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Roaming\app
|
Unicode text, UTF-8 (with BOM) text, with no line terminators
|
dropped
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\En3e396wX1.exe
|
"C:\Users\user\Desktop\En3e396wX1.exe"
|
|
|
|
C:\Windows\SysWOW64\netsh.exe
|
netsh firewall add allowedprogram "C:\Users\user\Desktop\En3e396wX1.exe" "En3e396wX1.exe" ENABLE
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
2.tcp.eu.ngrok.io
|
18.197.239.5
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
3.127.138.57
|
unknown
|
United States
|
|
|
|
18.156.13.209
|
unknown
|
United States
|
|
|
|
18.197.239.5
|
2.tcp.eu.ngrok.io
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Environment
|
SEE_MASK_NOZONECHECKS
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
8F2000
|
unkown
|
page readonly
|
|
|
|
2EC1000
|
trusted library allocation
|
page read and write
|
|
|
|
2F61000
|
trusted library allocation
|
page read and write
|
||
|
C3D000
|
heap
|
page read and write
|
||
|
2F02000
|
trusted library allocation
|
page read and write
|
||
|
51EE000
|
stack
|
page read and write
|
||
|
B99000
|
heap
|
page read and write
|
||
|
4EAF000
|
heap
|
page read and write
|
||
|
4EB5000
|
heap
|
page read and write
|
||
|
BC9000
|
heap
|
page read and write
|
||
|
B97000
|
heap
|
page read and write
|
||
|
999000
|
stack
|
page read and write
|
||
|
BC5000
|
heap
|
page read and write
|
||
|
4EB1000
|
heap
|
page read and write
|
||
|
1012000
|
trusted library allocation
|
page execute and read and write
|
||
|
BC8000
|
heap
|
page read and write
|
||
|
8F0000
|
heap
|
page read and write
|
||
|
8F0000
|
unkown
|
page readonly
|
||
|
C2D000
|
heap
|
page read and write
|
||
|
4F9C000
|
stack
|
page read and write
|
||
|
BC9000
|
heap
|
page read and write
|
||
|
5900000
|
heap
|
page read and write
|
||
|
B97000
|
heap
|
page read and write
|
||
|
BED000
|
heap
|
page read and write
|
||
|
BC4000
|
heap
|
page read and write
|
||
|
B8C000
|
heap
|
page read and write
|
||
|
BC2000
|
heap
|
page read and write
|
||
|
4EA1000
|
heap
|
page read and write
|
||
|
BBC000
|
heap
|
page read and write
|
||
|
58D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
8DE000
|
unkown
|
page read and write
|
||
|
BC9000
|
heap
|
page read and write
|
||
|
1080000
|
heap
|
page read and write
|
||
|
4EAF000
|
heap
|
page read and write
|
||
|
4EAF000
|
heap
|
page read and write
|
||
|
BB2000
|
heap
|
page read and write
|
||
|
FF0000
|
trusted library allocation
|
page read and write
|
||
|
985000
|
heap
|
page read and write
|
||
|
CF6000
|
stack
|
page read and write
|
||
|
BC5000
|
heap
|
page read and write
|
||
|
C10000
|
heap
|
page read and write
|
||
|
C2D000
|
heap
|
page read and write
|
||
|
102A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1020000
|
heap
|
page read and write
|
||
|
C3E000
|
heap
|
page read and write
|
||
|
BC0000
|
heap
|
page read and write
|
||
|
4EC0000
|
trusted library allocation
|
page read and write
|
||
|
C3A000
|
heap
|
page read and write
|
||
|
4EAF000
|
heap
|
page read and write
|
||
|
1126000
|
heap
|
page read and write
|
||
|
BB6000
|
heap
|
page read and write
|
||
|
B98000
|
heap
|
page read and write
|
||
|
B98000
|
heap
|
page read and write
|
||
|
2EF6000
|
trusted library allocation
|
page read and write
|
||
|
B89000
|
heap
|
page read and write
|
||
|
584C000
|
stack
|
page read and write
|
||
|
BAE000
|
heap
|
page read and write
|
||
|
509E000
|
stack
|
page read and write
|
||
|
BAE000
|
heap
|
page read and write
|
||
|
BC5000
|
heap
|
page read and write
|
||
|
BEE000
|
heap
|
page read and write
|
||
|
10BE000
|
heap
|
page read and write
|
||
|
74E000
|
stack
|
page read and write
|
||
|
BAE000
|
heap
|
page read and write
|
||
|
C10000
|
heap
|
page read and write
|
||
|
58A0000
|
unclassified section
|
page read and write
|
||
|
BEE000
|
heap
|
page read and write
|
||
|
B99000
|
heap
|
page read and write
|
||
|
C37000
|
heap
|
page read and write
|
||
|
3242000
|
trusted library allocation
|
page read and write
|
||
|
B61000
|
heap
|
page read and write
|
||
|
B8A000
|
heap
|
page read and write
|
||
|
4EA1000
|
heap
|
page read and write
|
||
|
B95000
|
heap
|
page read and write
|
||
|
B8F000
|
heap
|
page read and write
|
||
|
BC2000
|
heap
|
page read and write
|
||
|
C37000
|
heap
|
page read and write
|
||
|
BED000
|
heap
|
page read and write
|
||
|
B8B000
|
heap
|
page read and write
|
||
|
BBC000
|
heap
|
page read and write
|
||
|
980000
|
heap
|
page read and write
|
||
|
BAE000
|
heap
|
page read and write
|
||
|
5230000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F4B000
|
trusted library allocation
|
page read and write
|
||
|
C3D000
|
heap
|
page read and write
|
||
|
B99000
|
heap
|
page read and write
|
||
|
7C0000
|
heap
|
page read and write
|
||
|
4EAF000
|
heap
|
page read and write
|
||
|
E1E000
|
stack
|
page read and write
|
||
|
C3E000
|
heap
|
page read and write
|
||
|
1070000
|
heap
|
page read and write
|
||
|
2F51000
|
trusted library allocation
|
page read and write
|
||
|
8E6000
|
heap
|
page read and write
|
||
|
C2D000
|
heap
|
page read and write
|
||
|
BCB000
|
heap
|
page read and write
|
||
|
B40000
|
heap
|
page read and write
|
||
|
ED5000
|
heap
|
page read and write
|
||
|
2F0C000
|
trusted library allocation
|
page read and write
|
||
|
50B0000
|
trusted library allocation
|
page read and write
|
||
|
554F000
|
stack
|
page read and write
|
||
|
B8A000
|
heap
|
page read and write
|
||
|
108A000
|
heap
|
page read and write
|
||
|
BC9000
|
heap
|
page read and write
|
||
|
C33000
|
heap
|
page read and write
|
||
|
65B000
|
stack
|
page read and write
|
||
|
51AC000
|
stack
|
page read and write
|
||
|
B98000
|
heap
|
page read and write
|
||
|
9F0000
|
heap
|
page read and write
|
||
|
E80000
|
heap
|
page read and write
|
||
|
BC8000
|
heap
|
page read and write
|
||
|
2F79000
|
trusted library allocation
|
page read and write
|
||
|
101A000
|
trusted library allocation
|
page execute and read and write
|
||
|
BAA000
|
heap
|
page read and write
|
||
|
A8F000
|
unkown
|
page read and write
|
||
|
33D4000
|
trusted library allocation
|
page read and write
|
||
|
753000
|
stack
|
page read and write
|
||
|
4830000
|
heap
|
page read and write
|
||
|
B84000
|
heap
|
page read and write
|
||
|
3EC1000
|
trusted library allocation
|
page read and write
|
||
|
BAD000
|
heap
|
page read and write
|
||
|
B76000
|
heap
|
page read and write
|
||
|
4E7F000
|
stack
|
page read and write
|
||
|
516C000
|
stack
|
page read and write
|
||
|
5240000
|
heap
|
page read and write
|
||
|
EB0000
|
heap
|
page execute and read and write
|
||
|
B91000
|
heap
|
page read and write
|
||
|
BC9000
|
heap
|
page read and write
|
||
|
4EB1000
|
heap
|
page read and write
|
||
|
4EBA000
|
heap
|
page read and write
|
||
|
BBC000
|
heap
|
page read and write
|
||
|
477E000
|
stack
|
page read and write
|
||
|
4EB8000
|
heap
|
page read and write
|
||
|
2F46000
|
trusted library allocation
|
page read and write
|
||
|
8E0000
|
heap
|
page read and write
|
||
|
C30000
|
heap
|
page read and write
|
||
|
2F4F000
|
trusted library allocation
|
page read and write
|
||
|
4EB9000
|
heap
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
96E000
|
stack
|
page read and write
|
||
|
4EA2000
|
heap
|
page read and write
|
||
|
C2D000
|
heap
|
page read and write
|
||
|
31F3000
|
trusted library allocation
|
page read and write
|
||
|
2F35000
|
trusted library allocation
|
page read and write
|
||
|
BC4000
|
heap
|
page read and write
|
||
|
3EDB000
|
trusted library allocation
|
page read and write
|
||
|
B91000
|
heap
|
page read and write
|
||
|
588B000
|
stack
|
page read and write
|
||
|
75B000
|
stack
|
page read and write
|
||
|
BC8000
|
heap
|
page read and write
|
||
|
BCC000
|
heap
|
page read and write
|
||
|
108E000
|
heap
|
page read and write
|
||
|
C0F000
|
heap
|
page read and write
|
||
|
B84000
|
heap
|
page read and write
|
||
|
1002000
|
trusted library allocation
|
page execute and read and write
|
||
|
C10000
|
heap
|
page read and write
|
||
|
B8D000
|
heap
|
page read and write
|
||
|
C2D000
|
heap
|
page read and write
|
||
|
2F55000
|
trusted library allocation
|
page read and write
|
||
|
1101000
|
heap
|
page read and write
|
||
|
BB8000
|
heap
|
page read and write
|
||
|
BCB000
|
heap
|
page read and write
|
||
|
5890000
|
trusted library allocation
|
page read and write
|
||
|
BB1000
|
heap
|
page read and write
|
||
|
320D000
|
trusted library allocation
|
page read and write
|
||
|
BC6000
|
heap
|
page read and write
|
||
|
1042000
|
trusted library allocation
|
page read and write
|
||
|
BB9000
|
heap
|
page read and write
|
||
|
BAA000
|
heap
|
page read and write
|
||
|
BBC000
|
heap
|
page read and write
|
||
|
C10000
|
heap
|
page read and write
|
||
|
BB7000
|
heap
|
page read and write
|
||
|
13D0000
|
heap
|
page read and write
|
||
|
50C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
32D8000
|
trusted library allocation
|
page read and write
|
||
|
B97000
|
heap
|
page read and write
|
||
|
BC8000
|
heap
|
page read and write
|
||
|
2F0E000
|
trusted library allocation
|
page read and write
|
||
|
FDE000
|
stack
|
page read and write
|
||
|
75E000
|
stack
|
page read and write
|
||
|
B95000
|
heap
|
page read and write
|
||
|
1010000
|
trusted library allocation
|
page read and write
|
||
|
BC0000
|
heap
|
page read and write
|
||
|
B93000
|
heap
|
page read and write
|
||
|
DD0000
|
heap
|
page read and write
|
||
|
C2D000
|
heap
|
page read and write
|
||
|
B30000
|
heap
|
page read and write
|
||
|
C3E000
|
heap
|
page read and write
|
||
|
C10000
|
heap
|
page read and write
|
||
|
BAA000
|
heap
|
page read and write
|
||
|
C3D000
|
heap
|
page read and write
|
||
|
7FDE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
C2D000
|
heap
|
page read and write
|
||
|
4EC8000
|
trusted library allocation
|
page read and write
|
||
|
2F5F000
|
trusted library allocation
|
page read and write
|
||
|
ED0000
|
heap
|
page read and write
|
||
|
534B000
|
stack
|
page read and write
|
||
|
2FDC000
|
trusted library allocation
|
page read and write
|
||
|
F3F000
|
stack
|
page read and write
|
||
|
13D6000
|
heap
|
page read and write
|
||
|
325E000
|
trusted library allocation
|
page read and write
|
||
|
2F28000
|
trusted library allocation
|
page read and write
|
||
|
1027000
|
trusted library allocation
|
page execute and read and write
|
||
|
B84000
|
heap
|
page read and write
|
||
|
1040000
|
trusted library allocation
|
page read and write
|
||
|
C10000
|
heap
|
page read and write
|
||
|
B93000
|
heap
|
page read and write
|
||
|
4E80000
|
heap
|
page read and write
|
||
|
3409000
|
trusted library allocation
|
page read and write
|
||
|
544C000
|
stack
|
page read and write
|
||
|
4940000
|
heap
|
page read and write
|
||
|
BED000
|
heap
|
page read and write
|
||
|
C2E000
|
heap
|
page read and write
|
||
|
13C0000
|
trusted library allocation
|
page read and write
|
||
|
C32000
|
heap
|
page read and write
|
||
|
E90000
|
heap
|
page read and write
|
||
|
103A000
|
trusted library allocation
|
page execute and read and write
|
||
|
BB8000
|
heap
|
page read and write
|
||
|
BB2000
|
heap
|
page read and write
|
||
|
BAA000
|
heap
|
page read and write
|
||
|
BC5000
|
heap
|
page read and write
|
||
|
1032000
|
trusted library allocation
|
page execute and read and write
|
||
|
C10000
|
heap
|
page read and write
|
||
|
BBC000
|
heap
|
page read and write
|
||
|
B95000
|
heap
|
page read and write
|
||
|
C3C000
|
heap
|
page read and write
|
||
|
100A000
|
trusted library allocation
|
page execute and read and write
|
||
|
12BE000
|
stack
|
page read and write
|
||
|
31FF000
|
trusted library allocation
|
page read and write
|
||
|
B4A000
|
heap
|
page read and write
|
||
|
BB6000
|
heap
|
page read and write
|
||
|
1047000
|
trusted library allocation
|
page execute and read and write
|
||
|
13BE000
|
stack
|
page read and write
|
||
|
4EAB000
|
heap
|
page read and write
|
||
|
BB6000
|
heap
|
page read and write
|
||
|
B79000
|
heap
|
page read and write
|
||
|
BBE000
|
heap
|
page read and write
|
||
|
104B000
|
trusted library allocation
|
page execute and read and write
|
||
|
BB9000
|
heap
|
page read and write
|
||
|
B94000
|
heap
|
page read and write
|
There are 230 hidden memdumps, click here to show them.