Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
bUAB.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\bUAB.exe
|
"C:\Users\user\Desktop\bUAB.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
window10.duckdns.org
|
172.94.39.213
|
|
|
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
||
|
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
|
217.20.63.34
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
172.94.39.213
|
window10.duckdns.org
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit
|
Version
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
26C1000
|
trusted library allocation
|
page read and write
|
|
|
|
3B2000
|
unkown
|
page readonly
|
|
|
|
29C3000
|
trusted library allocation
|
page read and write
|
|
|
|
2743000
|
trusted library allocation
|
page read and write
|
|
|
|
1B3DF000
|
stack
|
page read and write
|
||
|
1B072000
|
heap
|
page read and write
|
||
|
7FE000
|
heap
|
page read and write
|
||
|
272D000
|
trusted library allocation
|
page read and write
|
||
|
AF0000
|
heap
|
page read and write
|
||
|
B5F000
|
stack
|
page read and write
|
||
|
7FFD9B920000
|
trusted library allocation
|
page read and write
|
||
|
A50000
|
heap
|
page read and write
|
||
|
7FFD9B7A4000
|
trusted library allocation
|
page read and write
|
||
|
1AFA0000
|
heap
|
page read and write
|
||
|
7FF496680000
|
trusted library allocation
|
page execute and read and write
|
||
|
1AFF3000
|
heap
|
page read and write
|
||
|
1AFA2000
|
heap
|
page read and write
|
||
|
3B0000
|
unkown
|
page readonly
|
||
|
1B18A000
|
heap
|
page read and write
|
||
|
760000
|
heap
|
page read and write
|
||
|
29FB000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B8A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A00000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B866000
|
trusted library allocation
|
page execute and read and write
|
||
|
807000
|
heap
|
page read and write
|
||
|
2735000
|
trusted library allocation
|
page read and write
|
||
|
3BE000
|
unkown
|
page readonly
|
||
|
126C1000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B780000
|
trusted library allocation
|
page read and write
|
||
|
1B4DF000
|
stack
|
page read and write
|
||
|
7C1000
|
heap
|
page read and write
|
||
|
7FFD9B7AD000
|
trusted library allocation
|
page execute and read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
1C11C000
|
stack
|
page read and write
|
||
|
2712000
|
trusted library allocation
|
page read and write
|
||
|
2716000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B7A0000
|
trusted library allocation
|
page read and write
|
||
|
1B079000
|
heap
|
page read and write
|
||
|
B10000
|
heap
|
page read and write
|
||
|
C5E000
|
stack
|
page read and write
|
||
|
2733000
|
trusted library allocation
|
page read and write
|
||
|
1B019000
|
heap
|
page read and write
|
||
|
2722000
|
trusted library allocation
|
page read and write
|
||
|
2A04000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B79D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B941000
|
trusted library allocation
|
page read and write
|
||
|
AF5000
|
heap
|
page read and write
|
||
|
2718000
|
trusted library allocation
|
page read and write
|
||
|
750000
|
heap
|
page read and write
|
||
|
1AA4F000
|
heap
|
page read and write
|
||
|
1B85F000
|
stack
|
page read and write
|
||
|
2727000
|
trusted library allocation
|
page read and write
|
||
|
29D5000
|
trusted library allocation
|
page read and write
|
||
|
1B022000
|
heap
|
page read and write
|
||
|
7FFD9B784000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B836000
|
trusted library allocation
|
page read and write
|
||
|
1B026000
|
heap
|
page read and write
|
||
|
1A6F0000
|
trusted library allocation
|
page read and write
|
||
|
25F0000
|
heap
|
page execute and read and write
|
||
|
1BB1C000
|
stack
|
page read and write
|
||
|
7FB000
|
heap
|
page read and write
|
||
|
AE0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B793000
|
trusted library allocation
|
page read and write
|
||
|
1BC1D000
|
stack
|
page read and write
|
||
|
1BE1A000
|
stack
|
page read and write
|
||
|
273E000
|
trusted library allocation
|
page read and write
|
||
|
B03000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B790000
|
trusted library allocation
|
page read and write
|
||
|
1BA1C000
|
stack
|
page read and write
|
||
|
29B5000
|
trusted library allocation
|
page read and write
|
||
|
29E9000
|
trusted library allocation
|
page read and write
|
||
|
29B2000
|
trusted library allocation
|
page read and write
|
||
|
1AC5C000
|
stack
|
page read and write
|
||
|
2739000
|
trusted library allocation
|
page read and write
|
||
|
714000
|
stack
|
page read and write
|
||
|
1B01C000
|
heap
|
page read and write
|
||
|
29F7000
|
trusted library allocation
|
page read and write
|
||
|
1B81E000
|
stack
|
page read and write
|
||
|
7FFD9B783000
|
trusted library allocation
|
page execute and read and write
|
||
|
1BF1D000
|
stack
|
page read and write
|
||
|
1B024000
|
heap
|
page read and write
|
||
|
7FFD9B830000
|
trusted library allocation
|
page read and write
|
||
|
2724000
|
trusted library allocation
|
page read and write
|
||
|
78C000
|
heap
|
page read and write
|
||
|
1B245000
|
heap
|
page read and write
|
||
|
272B000
|
trusted library allocation
|
page read and write
|
||
|
1B013000
|
heap
|
page read and write
|
||
|
1B5DE000
|
stack
|
page read and write
|
||
|
780000
|
heap
|
page read and write
|
||
|
B15000
|
heap
|
page read and write
|
||
|
1B0E0000
|
heap
|
page read and write
|
||
|
786000
|
heap
|
page read and write
|
||
|
1BD1A000
|
stack
|
page read and write
|
||
|
7FFD9B78D000
|
trusted library allocation
|
page execute and read and write
|
||
|
273B000
|
trusted library allocation
|
page read and write
|
||
|
7C4000
|
heap
|
page read and write
|
||
|
7FFD9B930000
|
trusted library allocation
|
page execute and read and write
|
||
|
29BB000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B840000
|
trusted library allocation
|
page execute and read and write
|
||
|
1AFA6000
|
heap
|
page read and write
|
||
|
B00000
|
trusted library allocation
|
page read and write
|
||
|
1AFEA000
|
heap
|
page read and write
|
||
|
7AC000
|
heap
|
page read and write
|
||
|
7ED000
|
heap
|
page read and write
|
||
|
1B0D0000
|
heap
|
page execute and read and write
|
||
|
271A000
|
trusted library allocation
|
page read and write
|
||
|
1B19F000
|
heap
|
page read and write
|
||
|
29B8000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B83C000
|
trusted library allocation
|
page execute and read and write
|
||
|
7F7000
|
heap
|
page read and write
|
||
|
A4D000
|
stack
|
page read and write
|
||
|
25BE000
|
stack
|
page read and write
|
||
|
7FFD9B7DC000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B06F000
|
heap
|
page read and write
|
||
|
1B183000
|
heap
|
page read and write
|
||
|
26B0000
|
heap
|
page read and write
|
||
|
3B0000
|
unkown
|
page readonly
|
||
|
AC0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B7AB000
|
trusted library allocation
|
page execute and read and write
|
||
|
7B5000
|
heap
|
page read and write
|
||
|
29E2000
|
trusted library allocation
|
page read and write
|
||
|
1B094000
|
heap
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
126CF000
|
trusted library allocation
|
page read and write
|
There are 114 hidden memdumps, click here to show them.