Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
DSR -AIROLAM - 2024.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DSR -AIROLAM - 2024.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_amefwfa3.5le.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dlsvvd34.qiu.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mtrrbnqu.rc3.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkabpmng.j2p.ps1
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\DSR -AIROLAM - 2024.exe
|
"C:\Users\user\Desktop\DSR -AIROLAM - 2024.exe"
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR -AIROLAM
- 2024.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://alfainterplast.com.ua
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://mail.alfainterplast.com.ua
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
alfainterplast.com.ua
|
91.239.232.46
|
|
|
|
mail.alfainterplast.com.ua
|
unknown
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
91.239.232.46
|
alfainterplast.com.ua
|
Ukraine
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3366000
|
trusted library allocation
|
page read and write
|
|
|
|
3D2E000
|
trusted library allocation
|
page read and write
|
|
|
|
402000
|
remote allocation
|
page execute and read and write
|
|
|
|
3311000
|
trusted library allocation
|
page read and write
|
|
|
|
335E000
|
trusted library allocation
|
page read and write
|
|
|
|
B6BE000
|
stack
|
page read and write
|
||
|
ED0000
|
trusted library allocation
|
page read and write
|
||
|
8A2E000
|
stack
|
page read and write
|
||
|
1420000
|
heap
|
page read and write
|
||
|
19B8000
|
trusted library allocation
|
page read and write
|
||
|
57A0000
|
heap
|
page execute and read and write
|
||
|
F00000
|
heap
|
page read and write
|
||
|
52B0000
|
heap
|
page execute and read and write
|
||
|
720000
|
unkown
|
page readonly
|
||
|
B8FC000
|
stack
|
page read and write
|
||
|
5C78000
|
trusted library allocation
|
page read and write
|
||
|
1BFD000
|
trusted library allocation
|
page read and write
|
||
|
1BD6000
|
trusted library allocation
|
page read and write
|
||
|
105A000
|
stack
|
page read and write
|
||
|
5260000
|
trusted library section
|
page readonly
|
||
|
3B59000
|
trusted library allocation
|
page read and write
|
||
|
1450000
|
heap
|
page read and write
|
||
|
11EE000
|
trusted library allocation
|
page read and write
|
||
|
6BA0000
|
trusted library allocation
|
page read and write
|
||
|
2ACE000
|
stack
|
page read and write
|
||
|
7372000
|
trusted library allocation
|
page read and write
|
||
|
4376000
|
trusted library allocation
|
page read and write
|
||
|
6D70000
|
heap
|
page read and write
|
||
|
5D30000
|
trusted library allocation
|
page execute and read and write
|
||
|
1210000
|
trusted library allocation
|
page read and write
|
||
|
11FD000
|
trusted library allocation
|
page read and write
|
||
|
3BF5000
|
trusted library allocation
|
page read and write
|
||
|
EAA000
|
trusted library allocation
|
page execute and read and write
|
||
|
2D0C000
|
trusted library allocation
|
page read and write
|
||
|
B67E000
|
stack
|
page read and write
|
||
|
12E0000
|
heap
|
page read and write
|
||
|
C10000
|
heap
|
page read and write
|
||
|
B7FC000
|
stack
|
page read and write
|
||
|
43E000
|
remote allocation
|
page execute and read and write
|
||
|
1160000
|
trusted library allocation
|
page read and write
|
||
|
E9E000
|
stack
|
page read and write
|
||
|
3BA7000
|
trusted library allocation
|
page read and write
|
||
|
1180000
|
heap
|
page execute and read and write
|
||
|
110E000
|
stack
|
page read and write
|
||
|
C4F000
|
heap
|
page read and write
|
||
|
5AEE000
|
stack
|
page read and write
|
||
|
B35F000
|
stack
|
page read and write
|
||
|
5C70000
|
trusted library allocation
|
page read and write
|
||
|
BD0000
|
heap
|
page read and write
|
||
|
154B000
|
heap
|
page read and write
|
||
|
1910000
|
trusted library allocation
|
page read and write
|
||
|
5CAC000
|
trusted library allocation
|
page read and write
|
||
|
2B51000
|
trusted library allocation
|
page read and write
|
||
|
1BC0000
|
trusted library allocation
|
page read and write
|
||
|
11DB000
|
trusted library allocation
|
page read and write
|
||
|
3C43000
|
trusted library allocation
|
page read and write
|
||
|
B57000
|
stack
|
page read and write
|
||
|
1900000
|
trusted library allocation
|
page read and write
|
||
|
5CA0000
|
trusted library allocation
|
page read and write
|
||
|
7020000
|
trusted library allocation
|
page read and write
|
||
|
6410000
|
heap
|
page read and write
|
||
|
4BA0000
|
trusted library allocation
|
page read and write
|
||
|
2CF7000
|
trusted library allocation
|
page read and write
|
||
|
14E2000
|
heap
|
page read and write
|
||
|
1564000
|
heap
|
page read and write
|
||
|
11C0000
|
heap
|
page read and write
|
||
|
1947000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C30000
|
trusted library allocation
|
page read and write
|
||
|
1C23000
|
heap
|
page read and write
|
||
|
1AA0000
|
heap
|
page read and write
|
||
|
3050000
|
trusted library allocation
|
page read and write
|
||
|
1940000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
2AD0000
|
trusted library allocation
|
page read and write
|
||
|
4B8E000
|
stack
|
page read and write
|
||
|
4339000
|
trusted library allocation
|
page read and write
|
||
|
6DE2000
|
heap
|
page read and write
|
||
|
5D50000
|
trusted library allocation
|
page read and write
|
||
|
5650000
|
heap
|
page read and write
|
||
|
D50000
|
trusted library allocation
|
page read and write
|
||
|
1BDE000
|
trusted library allocation
|
page read and write
|
||
|
192D000
|
trusted library allocation
|
page execute and read and write
|
||
|
59AF000
|
stack
|
page read and write
|
||
|
B43E000
|
stack
|
page read and write
|
||
|
3B51000
|
trusted library allocation
|
page read and write
|
||
|
6C30000
|
heap
|
page read and write
|
||
|
CF2000
|
heap
|
page read and write
|
||
|
C30000
|
heap
|
page read and write
|
||
|
679E000
|
stack
|
page read and write
|
||
|
CFE000
|
heap
|
page read and write
|
||
|
6449000
|
heap
|
page read and write
|
||
|
C51000
|
heap
|
page read and write
|
||
|
14A4000
|
heap
|
page read and write
|
||
|
6FA0000
|
trusted library section
|
page read and write
|
||
|
1159000
|
stack
|
page read and write
|
||
|
1BE2000
|
trusted library allocation
|
page read and write
|
||
|
1A8C000
|
stack
|
page read and write
|
||
|
D73000
|
trusted library allocation
|
page read and write
|
||
|
1936000
|
trusted library allocation
|
page execute and read and write
|
||
|
5070000
|
trusted library allocation
|
page execute and read and write
|
||
|
C55000
|
heap
|
page read and write
|
||
|
BC0000
|
heap
|
page read and write
|
||
|
5050000
|
trusted library allocation
|
page read and write
|
||
|
7029000
|
trusted library allocation
|
page read and write
|
||
|
149A000
|
heap
|
page read and write
|
||
|
2AF0000
|
trusted library allocation
|
page read and write
|
||
|
5B2E000
|
stack
|
page read and write
|
||
|
6BB0000
|
trusted library allocation
|
page read and write
|
||
|
1150000
|
trusted library allocation
|
page read and write
|
||
|
1920000
|
trusted library allocation
|
page read and write
|
||
|
193A000
|
trusted library allocation
|
page execute and read and write
|
||
|
B9FE000
|
stack
|
page read and write
|
||
|
1A90000
|
trusted library allocation
|
page execute and read and write
|
||
|
D64000
|
trusted library allocation
|
page read and write
|
||
|
EA6000
|
trusted library allocation
|
page execute and read and write
|
||
|
722000
|
unkown
|
page readonly
|
||
|
12F0000
|
heap
|
page read and write
|
||
|
2BA4000
|
trusted library allocation
|
page read and write
|
||
|
CF5000
|
heap
|
page read and write
|
||
|
5490000
|
heap
|
page read and write
|
||
|
7F780000
|
trusted library allocation
|
page execute and read and write
|
||
|
578E000
|
stack
|
page read and write
|
||
|
EE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1914000
|
trusted library allocation
|
page read and write
|
||
|
5D40000
|
trusted library allocation
|
page execute and read and write
|
||
|
EA2000
|
trusted library allocation
|
page read and write
|
||
|
1BDB000
|
trusted library allocation
|
page read and write
|
||
|
3373000
|
trusted library allocation
|
page read and write
|
||
|
9B2E000
|
stack
|
page read and write
|
||
|
1960000
|
trusted library allocation
|
page read and write
|
||
|
65F7000
|
trusted library allocation
|
page read and write
|
||
|
EBB000
|
trusted library allocation
|
page execute and read and write
|
||
|
5049000
|
trusted library allocation
|
page read and write
|
||
|
1945000
|
trusted library allocation
|
page execute and read and write
|
||
|
65E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
D6D000
|
trusted library allocation
|
page execute and read and write
|
||
|
D4E000
|
stack
|
page read and write
|
||
|
1478000
|
heap
|
page read and write
|
||
|
2B40000
|
heap
|
page read and write
|
||
|
114E000
|
stack
|
page read and write
|
||
|
CBD000
|
heap
|
page read and write
|
||
|
1BB0000
|
trusted library allocation
|
page read and write
|
||
|
C1E000
|
heap
|
page read and write
|
||
|
5D1D000
|
stack
|
page read and write
|
||
|
C37000
|
heap
|
page read and write
|
||
|
1BF1000
|
trusted library allocation
|
page read and write
|
||
|
D63000
|
trusted library allocation
|
page execute and read and write
|
||
|
6BF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2B30000
|
heap
|
page read and write
|
||
|
55BE000
|
stack
|
page read and write
|
||
|
5290000
|
trusted library allocation
|
page read and write
|
||
|
659E000
|
stack
|
page read and write
|
||
|
1932000
|
trusted library allocation
|
page read and write
|
||
|
4319000
|
trusted library allocation
|
page read and write
|
||
|
1505000
|
heap
|
page read and write
|
||
|
52A0000
|
trusted library allocation
|
page read and write
|
||
|
11CC000
|
stack
|
page read and write
|
||
|
5040000
|
trusted library allocation
|
page read and write
|
||
|
B09E000
|
stack
|
page read and write
|
||
|
148E000
|
heap
|
page read and write
|
||
|
1220000
|
heap
|
page read and write
|
||
|
1173000
|
heap
|
page read and write
|
||
|
89EE000
|
stack
|
page read and write
|
||
|
11F6000
|
trusted library allocation
|
page read and write
|
||
|
5D65000
|
heap
|
page read and write
|
||
|
1470000
|
heap
|
page read and write
|
||
|
2CC7000
|
trusted library allocation
|
page read and write
|
||
|
EB2000
|
trusted library allocation
|
page read and write
|
||
|
B25E000
|
stack
|
page read and write
|
||
|
54B0000
|
heap
|
page read and write
|
||
|
19AE000
|
stack
|
page read and write
|
||
|
65F0000
|
trusted library allocation
|
page read and write
|
||
|
1C14000
|
trusted library allocation
|
page read and write
|
||
|
D60000
|
trusted library allocation
|
page read and write
|
||
|
6DF4000
|
heap
|
page read and write
|
||
|
4B90000
|
trusted library allocation
|
page read and write
|
||
|
1C20000
|
heap
|
page read and write
|
||
|
D7D000
|
trusted library allocation
|
page execute and read and write
|
||
|
335C000
|
trusted library allocation
|
page read and write
|
||
|
12F5000
|
heap
|
page read and write
|
||
|
5D10000
|
trusted library section
|
page read and write
|
||
|
4BD0000
|
trusted library allocation
|
page execute and read and write
|
||
|
4CEC000
|
stack
|
page read and write
|
||
|
58AC000
|
stack
|
page read and write
|
||
|
5047000
|
trusted library allocation
|
page read and write
|
||
|
1545000
|
heap
|
page read and write
|
||
|
2BA9000
|
trusted library allocation
|
page read and write
|
||
|
53BE000
|
stack
|
page read and write
|
||
|
1C02000
|
trusted library allocation
|
page read and write
|
||
|
1202000
|
trusted library allocation
|
page read and write
|
||
|
55D0000
|
trusted library allocation
|
page read and write
|
||
|
59EE000
|
stack
|
page read and write
|
||
|
1BEA000
|
trusted library allocation
|
page read and write
|
||
|
B7BE000
|
stack
|
page read and write
|
||
|
194B000
|
trusted library allocation
|
page execute and read and write
|
||
|
EF0000
|
trusted library allocation
|
page read and write
|
||
|
1227000
|
heap
|
page read and write
|
||
|
1BEE000
|
trusted library allocation
|
page read and write
|
||
|
5D60000
|
heap
|
page read and write
|
||
|
1913000
|
trusted library allocation
|
page execute and read and write
|
||
|
6439000
|
heap
|
page read and write
|
||
|
1BAE000
|
stack
|
page read and write
|
||
|
5460000
|
trusted library section
|
page read and write
|
||
|
5280000
|
heap
|
page read and write
|
||
|
1C50000
|
heap
|
page execute and read and write
|
||
|
B57E000
|
stack
|
page read and write
|
||
|
50CC000
|
stack
|
page read and write
|
||
|
6F6E000
|
stack
|
page read and write
|
||
|
EA0000
|
trusted library allocation
|
page read and write
|
||
|
648F000
|
heap
|
page read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
C18000
|
heap
|
page read and write
|
||
|
5CB0000
|
trusted library allocation
|
page read and write
|
||
|
5B90000
|
heap
|
page read and write
|
||
|
1BF6000
|
trusted library allocation
|
page read and write
|
||
|
1942000
|
trusted library allocation
|
page read and write
|
||
|
7EE30000
|
trusted library allocation
|
page execute and read and write
|
||
|
14A6000
|
heap
|
page read and write
|
||
|
1930000
|
trusted library allocation
|
page read and write
|
||
|
5270000
|
heap
|
page read and write
|
||
|
1170000
|
heap
|
page read and write
|
||
|
5CC0000
|
trusted library allocation
|
page read and write
|
||
|
2CD8000
|
trusted library allocation
|
page read and write
|
||
|
11F1000
|
trusted library allocation
|
page read and write
|
||
|
55C4000
|
trusted library allocation
|
page read and write
|
||
|
1D5D000
|
stack
|
page read and write
|
||
|
11D0000
|
trusted library allocation
|
page read and write
|
||
|
5CD0000
|
trusted library allocation
|
page execute and read and write
|
||
|
100F000
|
stack
|
page read and write
|
||
|
5D5E000
|
stack
|
page read and write
|
||
|
55C0000
|
trusted library allocation
|
page read and write
|
||
|
D70000
|
trusted library allocation
|
page read and write
|
||
|
C44000
|
heap
|
page read and write
|
||
|
704B000
|
trusted library allocation
|
page read and write
|
||
|
4311000
|
trusted library allocation
|
page read and write
|
||
|
5480000
|
heap
|
page read and write
|
||
|
EB7000
|
trusted library allocation
|
page execute and read and write
|
||
|
5D20000
|
trusted library section
|
page read and write
|
||
|
1C10000
|
trusted library allocation
|
page read and write
|
||
|
1215000
|
trusted library allocation
|
page read and write
|
||
|
1537000
|
heap
|
page read and write
|
||
|
C84000
|
heap
|
page read and write
|
||
|
5CC6000
|
trusted library allocation
|
page read and write
|
||
|
5C2E000
|
stack
|
page read and write
|
||
|
5030000
|
trusted library allocation
|
page execute and read and write
|
||
|
191D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1D9C000
|
stack
|
page read and write
|
||
|
11D4000
|
trusted library allocation
|
page read and write
|
||
|
5450000
|
trusted library allocation
|
page execute and read and write
|
||
|
6BE0000
|
heap
|
page read and write
|
||
|
A5A000
|
stack
|
page read and write
|
||
|
D09000
|
heap
|
page read and write
|
||
|
1BD0000
|
trusted library allocation
|
page read and write
|
||
|
1410000
|
heap
|
page read and write
|
||
|
B53F000
|
stack
|
page read and write
|
||
|
5470000
|
heap
|
page read and write
|
There are 246 hidden memdumps, click here to show them.