Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Quote.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quote.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
modified
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Quote.exe
|
"C:\Users\user\Desktop\Quote.exe"
|
|
|
|
C:\Users\user\Desktop\Quote.exe
|
"C:\Users\user\Desktop\Quote.exe"
|
|
|
|
C:\Users\user\Desktop\Quote.exe
|
"C:\Users\user\Desktop\Quote.exe"
|
|
|
|
C:\Program Files\Windows Defender\MpCmdRun.exe
|
"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://account.dyn.com/
|
unknown
|
||
|
http://tempuri.org/DataSet1.xsd)Microsoft
|
unknown
|
||
|
http://us2.smtp.mailhostbox.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
us2.smtp.mailhostbox.com
|
208.91.198.143
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.91.198.143
|
us2.smtp.mailhostbox.com
|
United States
|
||
|
208.91.199.225
|
unknown
|
United States
|
||
|
208.91.199.223
|
unknown
|
United States
|
||
|
208.91.199.224
|
unknown
|
United States
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2EA1000
|
trusted library allocation
|
page read and write
|
|
|
|
402000
|
remote allocation
|
page execute and read and write
|
|
|
|
3B99000
|
trusted library allocation
|
page read and write
|
|
|
|
2EEE000
|
trusted library allocation
|
page read and write
|
|
|
|
45F5000
|
trusted library allocation
|
page read and write
|
|
|
|
576E000
|
stack
|
page read and write
|
||
|
1300000
|
heap
|
page read and write
|
||
|
2CE0000
|
trusted library allocation
|
page read and write
|
||
|
11F0000
|
heap
|
page read and write
|
||
|
1180000
|
trusted library allocation
|
page read and write
|
||
|
FC8000
|
heap
|
page read and write
|
||
|
E03000
|
trusted library allocation
|
page execute and read and write
|
||
|
5EFE000
|
stack
|
page read and write
|
||
|
1110000
|
heap
|
page read and write
|
||
|
85B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2BC6000
|
trusted library allocation
|
page read and write
|
||
|
F1F000
|
stack
|
page read and write
|
||
|
1280000
|
trusted library allocation
|
page read and write
|
||
|
1270000
|
trusted library allocation
|
page read and write
|
||
|
68A0000
|
heap
|
page read and write
|
||
|
1240000
|
trusted library allocation
|
page read and write
|
||
|
11BF000
|
stack
|
page read and write
|
||
|
3EA9000
|
trusted library allocation
|
page read and write
|
||
|
105A000
|
heap
|
page read and write
|
||
|
12B6000
|
trusted library allocation
|
page read and write
|
||
|
2B91000
|
trusted library allocation
|
page read and write
|
||
|
DF0000
|
trusted library allocation
|
page read and write
|
||
|
5AEC000
|
trusted library allocation
|
page read and write
|
||
|
E00000
|
trusted library allocation
|
page read and write
|
||
|
850000
|
unkown
|
page readonly
|
||
|
126F000
|
trusted library allocation
|
page read and write
|
||
|
4BA0000
|
trusted library allocation
|
page read and write
|
||
|
1133000
|
trusted library allocation
|
page execute and read and write
|
||
|
1083000
|
heap
|
page read and write
|
||
|
861B000
|
stack
|
page read and write
|
||
|
1160000
|
trusted library allocation
|
page read and write
|
||
|
3EA1000
|
trusted library allocation
|
page read and write
|
||
|
1167000
|
trusted library allocation
|
page execute and read and write
|
||
|
E0D000
|
trusted library allocation
|
page execute and read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
60EE000
|
stack
|
page read and write
|
||
|
55A0000
|
heap
|
page read and write
|
||
|
651E000
|
stack
|
page read and write
|
||
|
525E000
|
stack
|
page read and write
|
||
|
750000
|
unkown
|
page readonly
|
||
|
4B90000
|
trusted library allocation
|
page execute and read and write
|
||
|
547E000
|
stack
|
page read and write
|
||
|
138B000
|
heap
|
page read and write
|
||
|
F47000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E2D000
|
trusted library allocation
|
page read and write
|
||
|
52A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7F260000
|
trusted library allocation
|
page execute and read and write
|
||
|
C50000
|
heap
|
page read and write
|
||
|
FF5000
|
heap
|
page read and write
|
||
|
61EF000
|
stack
|
page read and write
|
||
|
50E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5F00000
|
heap
|
page read and write
|
||
|
FCE000
|
heap
|
page read and write
|
||
|
8353000
|
trusted library allocation
|
page read and write
|
||
|
51D3000
|
heap
|
page read and write
|
||
|
113D000
|
trusted library allocation
|
page execute and read and write
|
||
|
877D000
|
stack
|
page read and write
|
||
|
67DE000
|
unkown
|
page read and write
|
||
|
1100000
|
heap
|
page read and write
|
||
|
F20000
|
trusted library allocation
|
page read and write
|
||
|
3EC9000
|
trusted library allocation
|
page read and write
|
||
|
3B91000
|
trusted library allocation
|
page read and write
|
||
|
50D2000
|
trusted library allocation
|
page read and write
|
||
|
2CF0000
|
trusted library allocation
|
page read and write
|
||
|
1156000
|
trusted library allocation
|
page execute and read and write
|
||
|
529E000
|
stack
|
page read and write
|
||
|
D30000
|
heap
|
page read and write
|
||
|
2E0B000
|
trusted library allocation
|
page read and write
|
||
|
566F000
|
stack
|
page read and write
|
||
|
1270000
|
trusted library allocation
|
page read and write
|
||
|
12BD000
|
trusted library allocation
|
page read and write
|
||
|
1115000
|
heap
|
page read and write
|
||
|
6090000
|
trusted library section
|
page read and write
|
||
|
12C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
58DC000
|
stack
|
page read and write
|
||
|
12D0000
|
trusted library allocation
|
page read and write
|
||
|
1250000
|
heap
|
page execute and read and write
|
||
|
5493000
|
heap
|
page read and write
|
||
|
2EEC000
|
trusted library allocation
|
page read and write
|
||
|
5590000
|
heap
|
page execute and read and write
|
||
|
1200000
|
heap
|
page read and write
|
||
|
64DF000
|
stack
|
page read and write
|
||
|
2E32000
|
trusted library allocation
|
page read and write
|
||
|
137B000
|
heap
|
page read and write
|
||
|
85C0000
|
trusted library allocation
|
page read and write
|
||
|
12E0000
|
heap
|
page read and write
|
||
|
1280000
|
heap
|
page read and write
|
||
|
1373000
|
heap
|
page read and write
|
||
|
752000
|
unkown
|
page readonly
|
||
|
1140000
|
trusted library allocation
|
page read and write
|
||
|
2E26000
|
trusted library allocation
|
page read and write
|
||
|
5B10000
|
trusted library allocation
|
page execute and read and write
|
||
|
54DE000
|
stack
|
page read and write
|
||
|
12B1000
|
trusted library allocation
|
page read and write
|
||
|
2D28000
|
trusted library allocation
|
page read and write
|
||
|
521E000
|
stack
|
page read and write
|
||
|
2BD2000
|
trusted library allocation
|
page read and write
|
||
|
8AD0000
|
trusted library section
|
page read and write
|
||
|
2D00000
|
trusted library allocation
|
page read and write
|
||
|
50C0000
|
heap
|
page read and write
|
||
|
132A000
|
heap
|
page read and write
|
||
|
4BF0000
|
trusted library allocation
|
page read and write
|
||
|
11D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
10A0000
|
heap
|
page read and write
|
||
|
E15000
|
heap
|
page read and write
|
||
|
109E000
|
stack
|
page read and write
|
||
|
1134000
|
trusted library allocation
|
page read and write
|
||
|
1230000
|
trusted library allocation
|
page read and write
|
||
|
2D10000
|
heap
|
page read and write
|
||
|
8780000
|
heap
|
page read and write
|
||
|
4D2C000
|
stack
|
page read and write
|
||
|
2CDC000
|
stack
|
page read and write
|
||
|
556F000
|
stack
|
page read and write
|
||
|
1308000
|
heap
|
page read and write
|
||
|
4BA8000
|
trusted library allocation
|
page read and write
|
||
|
1385000
|
heap
|
page read and write
|
||
|
450A000
|
trusted library allocation
|
page read and write
|
||
|
8EA000
|
stack
|
page read and write
|
||
|
1165000
|
trusted library allocation
|
page execute and read and write
|
||
|
FFF000
|
heap
|
page read and write
|
||
|
2E06000
|
trusted library allocation
|
page read and write
|
||
|
129B000
|
trusted library allocation
|
page read and write
|
||
|
F30000
|
trusted library allocation
|
page read and write
|
||
|
2CF4000
|
trusted library allocation
|
page read and write
|
||
|
12C2000
|
trusted library allocation
|
page read and write
|
||
|
1162000
|
trusted library allocation
|
page read and write
|
||
|
5770000
|
trusted library section
|
page read and write
|
||
|
2E12000
|
trusted library allocation
|
page read and write
|
||
|
52C0000
|
heap
|
page read and write
|
||
|
51C0000
|
trusted library allocation
|
page read and write
|
||
|
7EF20000
|
trusted library allocation
|
page execute and read and write
|
||
|
1120000
|
trusted library allocation
|
page read and write
|
||
|
5080000
|
trusted library allocation
|
page read and write
|
||
|
FBE000
|
stack
|
page read and write
|
||
|
5ADE000
|
stack
|
page read and write
|
||
|
F42000
|
trusted library allocation
|
page read and write
|
||
|
2E90000
|
heap
|
page execute and read and write
|
||
|
5490000
|
heap
|
page read and write
|
||
|
543E000
|
stack
|
page read and write
|
||
|
4BED000
|
stack
|
page read and write
|
||
|
4F9D000
|
stack
|
page read and write
|
||
|
43E000
|
remote allocation
|
page execute and read and write
|
||
|
1333000
|
heap
|
page read and write
|
||
|
E04000
|
trusted library allocation
|
page read and write
|
||
|
5568000
|
trusted library allocation
|
page read and write
|
||
|
2C9E000
|
stack
|
page read and write
|
||
|
2E21000
|
trusted library allocation
|
page read and write
|
||
|
1336000
|
heap
|
page read and write
|
||
|
2E00000
|
trusted library allocation
|
page read and write
|
||
|
F3A000
|
trusted library allocation
|
page execute and read and write
|
||
|
2DE8000
|
trusted library allocation
|
page read and write
|
||
|
5560000
|
trusted library allocation
|
page read and write
|
||
|
5DFE000
|
stack
|
page read and write
|
||
|
6340000
|
heap
|
page read and write
|
||
|
2E1E000
|
trusted library allocation
|
page read and write
|
||
|
D7E000
|
stack
|
page read and write
|
||
|
F4B000
|
trusted library allocation
|
page execute and read and write
|
||
|
643D000
|
stack
|
page read and write
|
||
|
F60000
|
trusted library allocation
|
page read and write
|
||
|
59DF000
|
stack
|
page read and write
|
||
|
2E1A000
|
trusted library allocation
|
page read and write
|
||
|
50D0000
|
trusted library allocation
|
page read and write
|
||
|
1290000
|
trusted library allocation
|
page read and write
|
||
|
116B000
|
trusted library allocation
|
page execute and read and write
|
||
|
1275000
|
trusted library allocation
|
page read and write
|
||
|
DBE000
|
stack
|
page read and write
|
||
|
115A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1150000
|
trusted library allocation
|
page read and write
|
||
|
F2D000
|
trusted library allocation
|
page execute and read and write
|
||
|
F80000
|
heap
|
page read and write
|
||
|
114D000
|
trusted library allocation
|
page execute and read and write
|
||
|
12B0000
|
heap
|
page read and write
|
||
|
1260000
|
trusted library allocation
|
page read and write
|
||
|
1152000
|
trusted library allocation
|
page read and write
|
||
|
FC0000
|
heap
|
page read and write
|
||
|
8670000
|
heap
|
page read and write
|
||
|
2B8E000
|
stack
|
page read and write
|
||
|
11E0000
|
trusted library allocation
|
page read and write
|
||
|
E3A000
|
stack
|
page read and write
|
||
|
5B00000
|
trusted library allocation
|
page read and write
|
||
|
12AE000
|
trusted library allocation
|
page read and write
|
||
|
1220000
|
trusted library allocation
|
page execute and read and write
|
||
|
F70000
|
heap
|
page read and write
|
||
|
897E000
|
stack
|
page read and write
|
||
|
F23000
|
trusted library allocation
|
page read and write
|
||
|
50DB000
|
trusted library allocation
|
page read and write
|
||
|
1240000
|
trusted library allocation
|
page read and write
|
||
|
1250000
|
trusted library allocation
|
page execute and read and write
|
||
|
61FF000
|
stack
|
page read and write
|
||
|
1002000
|
heap
|
page read and write
|
||
|
53C0000
|
heap
|
page execute and read and write
|
||
|
60A1000
|
trusted library allocation
|
page read and write
|
||
|
6080000
|
trusted library section
|
page read and write
|
||
|
1294000
|
trusted library allocation
|
page read and write
|
||
|
11FC000
|
stack
|
page read and write
|
||
|
F38000
|
stack
|
page read and write
|
||
|
F36000
|
trusted library allocation
|
page execute and read and write
|
||
|
11CE000
|
stack
|
page read and write
|
||
|
68E2000
|
heap
|
page read and write
|
||
|
1260000
|
trusted library allocation
|
page read and write
|
||
|
51D0000
|
heap
|
page read and write
|
||
|
5AE0000
|
trusted library allocation
|
page read and write
|
||
|
9E7000
|
stack
|
page read and write
|
||
|
2EF6000
|
trusted library allocation
|
page read and write
|
||
|
50F0000
|
trusted library allocation
|
page read and write
|
||
|
10C0000
|
heap
|
page read and write
|
||
|
1267000
|
trusted library allocation
|
page read and write
|
||
|
68BC000
|
heap
|
page read and write
|
||
|
66DE000
|
stack
|
page read and write
|
||
|
1130000
|
trusted library allocation
|
page read and write
|
||
|
E10000
|
heap
|
page read and write
|
||
|
2E8C000
|
stack
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
3F08000
|
trusted library allocation
|
page read and write
|
||
|
2BD0000
|
trusted library allocation
|
page read and write
|
||
|
2E0E000
|
trusted library allocation
|
page read and write
|
||
|
5B06000
|
trusted library allocation
|
page read and write
|
||
|
51B0000
|
trusted library allocation
|
page read and write
|
There are 213 hidden memdumps, click here to show them.