Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
952cgs4G29.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\952cgs4G29.exe
|
"C:\Users\user\Desktop\952cgs4G29.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://crl.micro
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
rootsaul.duckdns.org
|
45.128.96.204
|
|
|
|
bg.microsoft.map.fastly.net
|
199.232.214.172
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
45.128.96.204
|
rootsaul.duckdns.org
|
Germany
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
D42000
|
unkown
|
page readonly
|
|
|
|
30F1000
|
trusted library allocation
|
page read and write
|
|
|
|
5D3E000
|
stack
|
page read and write
|
||
|
5AFF000
|
stack
|
page read and write
|
||
|
1240000
|
heap
|
page read and write
|
||
|
5776000
|
heap
|
page read and write
|
||
|
318B000
|
trusted library allocation
|
page read and write
|
||
|
5DB5000
|
trusted library allocation
|
page read and write
|
||
|
5C3D000
|
stack
|
page read and write
|
||
|
668D000
|
stack
|
page read and write
|
||
|
5D49000
|
trusted library allocation
|
page read and write
|
||
|
2E8E000
|
stack
|
page read and write
|
||
|
2FB0000
|
trusted library allocation
|
page read and write
|
||
|
5D4B000
|
trusted library allocation
|
page read and write
|
||
|
5D50000
|
trusted library allocation
|
page read and write
|
||
|
5E60000
|
heap
|
page read and write
|
||
|
59FC000
|
stack
|
page read and write
|
||
|
1697000
|
heap
|
page read and write
|
||
|
D52000
|
unkown
|
page readonly
|
||
|
60EE000
|
stack
|
page read and write
|
||
|
71EE000
|
stack
|
page read and write
|
||
|
2E20000
|
trusted library allocation
|
page read and write
|
||
|
563E000
|
heap
|
page read and write
|
||
|
2E2B000
|
trusted library allocation
|
page execute and read and write
|
||
|
70EC000
|
stack
|
page read and write
|
||
|
5613000
|
heap
|
page read and write
|
||
|
2E40000
|
trusted library allocation
|
page read and write
|
||
|
2DF3000
|
trusted library allocation
|
page execute and read and write
|
||
|
564C000
|
heap
|
page read and write
|
||
|
5636000
|
heap
|
page read and write
|
||
|
5600000
|
heap
|
page read and write
|
||
|
DEC000
|
stack
|
page read and write
|
||
|
40F7000
|
trusted library allocation
|
page read and write
|
||
|
1367000
|
heap
|
page read and write
|
||
|
5D40000
|
trusted library allocation
|
page read and write
|
||
|
2E1A000
|
trusted library allocation
|
page execute and read and write
|
||
|
30EE000
|
stack
|
page read and write
|
||
|
40F9000
|
trusted library allocation
|
page read and write
|
||
|
562E000
|
heap
|
page read and write
|
||
|
2E27000
|
trusted library allocation
|
page execute and read and write
|
||
|
1179000
|
heap
|
page read and write
|
||
|
2DB0000
|
heap
|
page read and write
|
||
|
658C000
|
stack
|
page read and write
|
||
|
1150000
|
heap
|
page read and write
|
||
|
D40000
|
unkown
|
page readonly
|
||
|
2E10000
|
trusted library allocation
|
page read and write
|
||
|
5DA6000
|
trusted library allocation
|
page read and write
|
||
|
1340000
|
heap
|
page read and write
|
||
|
55F0000
|
heap
|
page execute and read and write
|
||
|
2DF4000
|
trusted library allocation
|
page read and write
|
||
|
684D000
|
stack
|
page read and write
|
||
|
5D84000
|
trusted library allocation
|
page read and write
|
||
|
1250000
|
heap
|
page read and write
|
||
|
7F590000
|
trusted library allocation
|
page execute and read and write
|
||
|
2FE0000
|
heap
|
page read and write
|
||
|
57E0000
|
heap
|
page read and write
|
||
|
11CC000
|
heap
|
page read and write
|
||
|
2EF0000
|
heap
|
page execute and read and write
|
||
|
1158000
|
heap
|
page read and write
|
||
|
1260000
|
heap
|
page read and write
|
||
|
2E16000
|
trusted library allocation
|
page execute and read and write
|
||
|
66CE000
|
stack
|
page read and write
|
||
|
1204000
|
heap
|
page read and write
|
||
|
5E80000
|
heap
|
page read and write
|
||
|
5FEE000
|
stack
|
page read and write
|
||
|
2DAD000
|
stack
|
page read and write
|
||
|
2DF0000
|
trusted library allocation
|
page read and write
|
||
|
644E000
|
stack
|
page read and write
|
||
|
2ECC000
|
stack
|
page read and write
|
||
|
6E6E000
|
stack
|
page read and write
|
||
|
6F6E000
|
stack
|
page read and write
|
||
|
63CE000
|
stack
|
page read and write
|
||
|
13AE000
|
stack
|
page read and write
|
||
|
5DFE000
|
stack
|
page read and write
|
||
|
2E12000
|
trusted library allocation
|
page read and write
|
||
|
5E10000
|
trusted library allocation
|
page read and write
|
||
|
5700000
|
heap
|
page read and write
|
||
|
640F000
|
stack
|
page read and write
|
||
|
2E00000
|
trusted library allocation
|
page read and write
|
||
|
10F9000
|
stack
|
page read and write
|
||
|
5D94000
|
trusted library allocation
|
page read and write
|
||
|
2FB7000
|
trusted library allocation
|
page read and write
|
||
|
57E7000
|
heap
|
page read and write
|
||
|
2DFD000
|
trusted library allocation
|
page execute and read and write
|
||
|
670E000
|
stack
|
page read and write
|
||
|
5E90000
|
heap
|
page read and write
|
||
|
2DE0000
|
trusted library allocation
|
page read and write
|
||
|
556E000
|
stack
|
page read and write
|
||
|
5E70000
|
heap
|
page read and write
|
||
|
2EE0000
|
trusted library allocation
|
page read and write
|
||
|
1690000
|
heap
|
page read and write
|
||
|
55EE000
|
stack
|
page read and write
|
||
|
51ED000
|
stack
|
page read and write
|
||
|
5DA9000
|
trusted library allocation
|
page read and write
|
||
|
5E5D000
|
stack
|
page read and write
|
||
|
2ED0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1187000
|
heap
|
page read and write
|
||
|
5629000
|
heap
|
page read and write
|
||
|
57E4000
|
heap
|
page read and write
|
||
|
2F08000
|
trusted library allocation
|
page read and write
|
||
|
654E000
|
stack
|
page read and write
|
||
|
1185000
|
heap
|
page read and write
|
||
|
167C000
|
stack
|
page read and write
|
||
|
55AE000
|
stack
|
page read and write
|
||
|
40F1000
|
trusted library allocation
|
page read and write
|
||
|
1360000
|
heap
|
page read and write
|
||
|
1255000
|
heap
|
page read and write
|
||
|
674C000
|
stack
|
page read and write
|
||
|
2E22000
|
trusted library allocation
|
page read and write
|
||
|
5BFD000
|
stack
|
page read and write
|
||
|
14AE000
|
stack
|
page read and write
|
There are 101 hidden memdumps, click here to show them.