Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
rPO50018137-14_pdf.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ctsdvwT.exe.log
|
ASCII text, with CRLF line terminators
|
modified
|
||
|
C:\Users\user\AppData\Local\Temp\Hymenophyllaceae
|
ASCII text, with very long lines (28690), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut47B0.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut481E.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\inhumation
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe
|
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\rPO50018137-14_pdf.exe
|
"C:\Users\user\Desktop\rPO50018137-14_pdf.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\rPO50018137-14_pdf.exe"
|
|
|
|
C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe
|
"C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe"
|
|
|
|
C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe
|
"C:\Users\user\AppData\Roaming\ctsdvwT\ctsdvwT.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
mail.musabody.com
|
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
http://mail.musabody.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
mail.musabody.com
|
108.167.140.123
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
108.167.140.123
|
mail.musabody.com
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
ctsdvwT
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1810000
|
direct allocation
|
page read and write
|
|
|
|
400000
|
system
|
page execute and read and write
|
|
|
|
2FFF000
|
heap
|
page read and write
|
|
|
|
5850000
|
trusted library section
|
page read and write
|
|
|
|
4401000
|
trusted library allocation
|
page read and write
|
|
|
|
5910000
|
trusted library section
|
page read and write
|
|
|
|
C66000
|
heap
|
page read and write
|
||
|
58C2000
|
trusted library allocation
|
page read and write
|
||
|
781F000
|
stack
|
page read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
6A5E000
|
trusted library allocation
|
page read and write
|
||
|
3110000
|
heap
|
page read and write
|
||
|
3104000
|
trusted library allocation
|
page read and write
|
||
|
34C2000
|
trusted library allocation
|
page read and write
|
||
|
1F5000
|
heap
|
page read and write
|
||
|
C64000
|
heap
|
page read and write
|
||
|
20B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
354C000
|
trusted library allocation
|
page read and write
|
||
|
471000
|
unkown
|
page execute read
|
||
|
E9D000
|
trusted library allocation
|
page execute and read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
3120000
|
trusted library allocation
|
page read and write
|
||
|
37C9000
|
direct allocation
|
page read and write
|
||
|
30F0000
|
trusted library allocation
|
page read and write
|
||
|
6B7D000
|
stack
|
page read and write
|
||
|
E40000
|
heap
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
AAD000
|
stack
|
page read and write
|
||
|
2AEC000
|
stack
|
page read and write
|
||
|
13CC000
|
heap
|
page read and write
|
||
|
58D6000
|
trusted library allocation
|
page read and write
|
||
|
3132000
|
trusted library allocation
|
page read and write
|
||
|
480000
|
heap
|
page read and write
|
||
|
2B2E000
|
stack
|
page read and write
|
||
|
C56000
|
heap
|
page read and write
|
||
|
E84000
|
trusted library allocation
|
page read and write
|
||
|
2940000
|
trusted library allocation
|
page read and write
|
||
|
D5A000
|
stack
|
page read and write
|
||
|
C44000
|
heap
|
page read and write
|
||
|
532000
|
unkown
|
page readonly
|
||
|
2FD7000
|
heap
|
page read and write
|
||
|
58D1000
|
trusted library allocation
|
page read and write
|
||
|
532000
|
unkown
|
page readonly
|
||
|
5D2C000
|
stack
|
page read and write
|
||
|
2100000
|
heap
|
page read and write
|
||
|
99F000
|
stack
|
page read and write
|
||
|
2F90000
|
heap
|
page read and write
|
||
|
20E0000
|
heap
|
page execute and read and write
|
||
|
5F8F000
|
stack
|
page read and write
|
||
|
488000
|
heap
|
page read and write
|
||
|
7F0000
|
heap
|
page read and write
|
||
|
C56000
|
heap
|
page read and write
|
||
|
20D0000
|
trusted library allocation
|
page read and write
|
||
|
E94000
|
trusted library allocation
|
page read and write
|
||
|
2F4C000
|
unkown
|
page read and write
|
||
|
47E000
|
stack
|
page read and write
|
||
|
430000
|
heap
|
page read and write
|
||
|
59CE000
|
stack
|
page read and write
|
||
|
3B51000
|
trusted library allocation
|
page read and write
|
||
|
50C000
|
unkown
|
page readonly
|
||
|
3190000
|
heap
|
page read and write
|
||
|
37C9000
|
direct allocation
|
page read and write
|
||
|
6D70000
|
heap
|
page read and write
|
||
|
48D0000
|
heap
|
page execute and read and write
|
||
|
355F000
|
trusted library allocation
|
page read and write
|
||
|
CE3000
|
heap
|
page read and write
|
||
|
5C2C000
|
stack
|
page read and write
|
||
|
B50000
|
direct allocation
|
page execute and read and write
|
||
|
C3E000
|
heap
|
page read and write
|
||
|
58A0000
|
trusted library allocation
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
338E000
|
stack
|
page read and write
|
||
|
34A1000
|
trusted library allocation
|
page read and write
|
||
|
1920000
|
heap
|
page read and write
|
||
|
3136000
|
trusted library allocation
|
page execute and read and write
|
||
|
160E000
|
stack
|
page read and write
|
||
|
604C000
|
stack
|
page read and write
|
||
|
4A1E000
|
stack
|
page read and write
|
||
|
34D3000
|
trusted library allocation
|
page read and write
|
||
|
2B30000
|
trusted library allocation
|
page read and write
|
||
|
420000
|
heap
|
page read and write
|
||
|
54CE000
|
stack
|
page read and write
|
||
|
1FAB000
|
trusted library allocation
|
page execute and read and write
|
||
|
58BB000
|
trusted library allocation
|
page read and write
|
||
|
3160000
|
trusted library allocation
|
page read and write
|
||
|
6A40000
|
trusted library allocation
|
page read and write
|
||
|
36A0000
|
direct allocation
|
page read and write
|
||
|
180E000
|
stack
|
page read and write
|
||
|
3485000
|
trusted library allocation
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
4CEE000
|
stack
|
page read and write
|
||
|
313A000
|
trusted library allocation
|
page execute and read and write
|
||
|
36A0000
|
direct allocation
|
page read and write
|
||
|
5AF0000
|
heap
|
page read and write
|
||
|
140E000
|
stack
|
page read and write
|
||
|
13BF000
|
heap
|
page read and write
|
||
|
3500000
|
direct allocation
|
page read and write
|
||
|
3123000
|
trusted library allocation
|
page read and write
|
||
|
544000
|
unkown
|
page readonly
|
||
|
36A0000
|
direct allocation
|
page read and write
|
||
|
1490000
|
heap
|
page read and write
|
||
|
3140000
|
trusted library allocation
|
page read and write
|
||
|
540000
|
unkown
|
page write copy
|
||
|
3142000
|
trusted library allocation
|
page read and write
|
||
|
E90000
|
trusted library allocation
|
page read and write
|
||
|
C45000
|
heap
|
page read and write
|
||
|
DB0000
|
heap
|
page read and write
|
||
|
7F120000
|
trusted library allocation
|
page execute and read and write
|
||
|
6AE0000
|
heap
|
page read and write
|
||
|
72DC000
|
stack
|
page read and write
|
||
|
95E000
|
stack
|
page read and write
|
||
|
58B0000
|
trusted library allocation
|
page read and write
|
||
|
B30000
|
heap
|
page read and write
|
||
|
EFB000
|
heap
|
page read and write
|
||
|
13C9000
|
heap
|
page read and write
|
||
|
3147000
|
trusted library allocation
|
page execute and read and write
|
||
|
3280000
|
heap
|
page read and write
|
||
|
6D8A000
|
trusted library allocation
|
page read and write
|
||
|
3401000
|
trusted library allocation
|
page read and write
|
||
|
6AB0000
|
trusted library allocation
|
page read and write
|
||
|
3180000
|
trusted library allocation
|
page read and write
|
||
|
6A60000
|
trusted library allocation
|
page execute and read and write
|
||
|
71DE000
|
stack
|
page read and write
|
||
|
200E000
|
stack
|
page read and write
|
||
|
37CD000
|
direct allocation
|
page read and write
|
||
|
58DD000
|
trusted library allocation
|
page read and write
|
||
|
59D0000
|
heap
|
page execute and read and write
|
||
|
97B000
|
stack
|
page read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
3465000
|
trusted library allocation
|
page read and write
|
||
|
761C000
|
stack
|
page read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
6AA0000
|
trusted library allocation
|
page read and write
|
||
|
550E000
|
stack
|
page read and write
|
||
|
1FC0000
|
trusted library allocation
|
page read and write
|
||
|
D3B000
|
heap
|
page read and write
|
||
|
C3E000
|
heap
|
page read and write
|
||
|
98F000
|
stack
|
page read and write
|
||
|
5ADE000
|
stack
|
page read and write
|
||
|
15CE000
|
stack
|
page read and write
|
||
|
143A000
|
heap
|
page read and write
|
||
|
18C4000
|
heap
|
page read and write
|
||
|
36A0000
|
direct allocation
|
page read and write
|
||
|
37CD000
|
direct allocation
|
page read and write
|
||
|
164E000
|
stack
|
page read and write
|
||
|
434E000
|
stack
|
page read and write
|
||
|
DFE000
|
stack
|
page read and write
|
||
|
1FA0000
|
trusted library allocation
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
C66000
|
heap
|
page read and write
|
||
|
7B0000
|
trusted library allocation
|
page read and write
|
||
|
4B5E000
|
stack
|
page read and write
|
||
|
C47000
|
heap
|
page read and write
|
||
|
2FD0000
|
heap
|
page read and write
|
||
|
33CC000
|
stack
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
D2B000
|
heap
|
page read and write
|
||
|
312D000
|
trusted library allocation
|
page execute and read and write
|
||
|
ED8000
|
heap
|
page read and write
|
||
|
E45000
|
heap
|
page read and write
|
||
|
ED0000
|
heap
|
page read and write
|
||
|
2990000
|
trusted library allocation
|
page execute and read and write
|
||
|
58E2000
|
trusted library allocation
|
page read and write
|
||
|
440000
|
heap
|
page read and write
|
||
|
5D50000
|
heap
|
page read and write
|
||
|
73DC000
|
stack
|
page read and write
|
||
|
18C0000
|
heap
|
page read and write
|
||
|
47CF000
|
stack
|
page read and write
|
||
|
3623000
|
direct allocation
|
page read and write
|
||
|
2F8C000
|
unkown
|
page read and write
|
||
|
7C3000
|
trusted library allocation
|
page execute and read and write
|
||
|
471000
|
unkown
|
page execute read
|
||
|
3532000
|
trusted library allocation
|
page read and write
|
||
|
37C9000
|
direct allocation
|
page read and write
|
||
|
E60000
|
trusted library allocation
|
page read and write
|
||
|
5130000
|
heap
|
page read and write
|
||
|
5980000
|
trusted library allocation
|
page read and write
|
||
|
5900000
|
trusted library allocation
|
page read and write
|
||
|
D2B000
|
heap
|
page read and write
|
||
|
6A90000
|
trusted library allocation
|
page execute and read and write
|
||
|
430000
|
heap
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
383E000
|
direct allocation
|
page read and write
|
||
|
9BA000
|
unkown
|
page readonly
|
||
|
1380000
|
heap
|
page read and write
|
||
|
58CE000
|
trusted library allocation
|
page read and write
|
||
|
4B6000
|
heap
|
page read and write
|
||
|
3500000
|
direct allocation
|
page read and write
|
||
|
3495000
|
trusted library allocation
|
page read and write
|
||
|
2B51000
|
trusted library allocation
|
page read and write
|
||
|
3538000
|
trusted library allocation
|
page read and write
|
||
|
44C3000
|
trusted library allocation
|
page read and write
|
||
|
E10000
|
heap
|
page read and write
|
||
|
426000
|
system
|
page execute and read and write
|
||
|
3170000
|
trusted library allocation
|
page execute and read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
1CA000
|
stack
|
page read and write
|
||
|
347D000
|
trusted library allocation
|
page read and write
|
||
|
36A0000
|
direct allocation
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
37C9000
|
direct allocation
|
page read and write
|
||
|
3623000
|
direct allocation
|
page read and write
|
||
|
C18000
|
heap
|
page read and write
|
||
|
C57000
|
heap
|
page read and write
|
||
|
6BC0000
|
trusted library allocation
|
page read and write
|
||
|
7C4000
|
trusted library allocation
|
page read and write
|
||
|
C47000
|
heap
|
page read and write
|
||
|
E00000
|
heap
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
9B0000
|
unkown
|
page readonly
|
||
|
C44000
|
heap
|
page read and write
|
||
|
424C000
|
stack
|
page read and write
|
||
|
2AAF000
|
stack
|
page read and write
|
||
|
50C000
|
unkown
|
page readonly
|
||
|
123A000
|
stack
|
page read and write
|
||
|
7D0000
|
trusted library allocation
|
page read and write
|
||
|
6D80000
|
trusted library allocation
|
page read and write
|
||
|
3623000
|
direct allocation
|
page read and write
|
||
|
4E1000
|
heap
|
page read and write
|
||
|
58BE000
|
trusted library allocation
|
page read and write
|
||
|
36A0000
|
direct allocation
|
page read and write
|
||
|
5D6C000
|
heap
|
page read and write
|
||
|
53C0000
|
heap
|
page execute and read and write
|
||
|
D3B000
|
heap
|
page read and write
|
||
|
6F5E000
|
stack
|
page read and write
|
||
|
C6C000
|
heap
|
page read and write
|
||
|
CE3000
|
heap
|
page read and write
|
||
|
5DC6000
|
heap
|
page read and write
|
||
|
770000
|
heap
|
page read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
560F000
|
stack
|
page read and write
|
||
|
298E000
|
stack
|
page read and write
|
||
|
96E000
|
stack
|
page read and write
|
||
|
74F000
|
stack
|
page read and write
|
||
|
EF4000
|
heap
|
page read and write
|
||
|
2B40000
|
heap
|
page execute and read and write
|
||
|
C76000
|
heap
|
page read and write
|
||
|
14B5000
|
heap
|
page read and write
|
||
|
20C0000
|
trusted library allocation
|
page read and write
|
||
|
E8D000
|
trusted library allocation
|
page execute and read and write
|
||
|
383E000
|
direct allocation
|
page read and write
|
||
|
4504000
|
trusted library allocation
|
page read and write
|
||
|
470000
|
unkown
|
page readonly
|
||
|
20F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
16CE000
|
stack
|
page read and write
|
||
|
37C9000
|
direct allocation
|
page read and write
|
||
|
31E8000
|
trusted library allocation
|
page read and write
|
||
|
37CD000
|
direct allocation
|
page read and write
|
||
|
3116000
|
heap
|
page read and write
|
||
|
2211000
|
trusted library allocation
|
page read and write
|
||
|
3550000
|
trusted library allocation
|
page read and write
|
||
|
4C5E000
|
stack
|
page read and write
|
||
|
4A4000
|
heap
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
3194000
|
heap
|
page read and write
|
||
|
E70000
|
heap
|
page read and write
|
||
|
544000
|
unkown
|
page readonly
|
||
|
3623000
|
direct allocation
|
page read and write
|
||
|
58F0000
|
trusted library allocation
|
page read and write
|
||
|
470000
|
unkown
|
page readonly
|
||
|
46CE000
|
stack
|
page read and write
|
||
|
383E000
|
direct allocation
|
page read and write
|
||
|
2FB0000
|
heap
|
page read and write
|
||
|
512F000
|
stack
|
page read and write
|
||
|
37CD000
|
direct allocation
|
page read and write
|
||
|
7CD000
|
trusted library allocation
|
page execute and read and write
|
||
|
30E0000
|
trusted library section
|
page read and write
|
||
|
EBB000
|
trusted library allocation
|
page execute and read and write
|
||
|
C44000
|
heap
|
page read and write
|
||
|
3100000
|
trusted library allocation
|
page read and write
|
||
|
54FD000
|
stack
|
page read and write
|
||
|
33F0000
|
heap
|
page execute and read and write
|
||
|
445000
|
system
|
page execute and read and write
|
||
|
7D4000
|
trusted library allocation
|
page read and write
|
||
|
48CE000
|
stack
|
page read and write
|
||
|
3623000
|
direct allocation
|
page read and write
|
||
|
5D92000
|
heap
|
page read and write
|
||
|
C45000
|
heap
|
page read and write
|
||
|
49DE000
|
stack
|
page read and write
|
||
|
D3B000
|
heap
|
page read and write
|
||
|
E83000
|
trusted library allocation
|
page execute and read and write
|
||
|
6BD0000
|
trusted library allocation
|
page execute and read and write
|
||
|
C57000
|
heap
|
page read and write
|
||
|
3103000
|
trusted library allocation
|
page execute and read and write
|
||
|
673F000
|
stack
|
page read and write
|
||
|
C73000
|
heap
|
page read and write
|
||
|
C92000
|
heap
|
page read and write
|
||
|
383E000
|
direct allocation
|
page read and write
|
||
|
33D0000
|
heap
|
page read and write
|
||
|
9B2000
|
unkown
|
page readonly
|
||
|
3500000
|
direct allocation
|
page read and write
|
||
|
1338000
|
stack
|
page read and write
|
||
|
C61000
|
heap
|
page read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
53C000
|
unkown
|
page read and write
|
||
|
119F000
|
stack
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
C76000
|
heap
|
page read and write
|
||
|
F07000
|
heap
|
page read and write
|
||
|
310D000
|
trusted library allocation
|
page execute and read and write
|
||
|
37C9000
|
direct allocation
|
page read and write
|
||
|
37CD000
|
direct allocation
|
page read and write
|
||
|
750000
|
heap
|
page read and write
|
||
|
1390000
|
heap
|
page read and write
|
||
|
29A0000
|
heap
|
page read and write
|
||
|
EB7000
|
trusted library allocation
|
page execute and read and write
|
||
|
37CD000
|
direct allocation
|
page read and write
|
||
|
C10000
|
heap
|
page read and write
|
||
|
C56000
|
heap
|
page read and write
|
||
|
C37000
|
heap
|
page read and write
|
||
|
1398000
|
heap
|
page read and write
|
||
|
34D0000
|
trusted library allocation
|
page read and write
|
||
|
C5C000
|
stack
|
page read and write
|
||
|
C47000
|
heap
|
page read and write
|
||
|
C76000
|
heap
|
page read and write
|
||
|
C73000
|
heap
|
page read and write
|
||
|
34CA000
|
trusted library allocation
|
page read and write
|
||
|
3211000
|
trusted library allocation
|
page read and write
|
||
|
31DE000
|
stack
|
page read and write
|
||
|
314B000
|
trusted library allocation
|
page execute and read and write
|
||
|
220F000
|
stack
|
page read and write
|
||
|
6D82000
|
trusted library allocation
|
page read and write
|
||
|
AC000
|
stack
|
page read and write
|
||
|
14B0000
|
heap
|
page read and write
|
||
|
6BBE000
|
stack
|
page read and write
|
||
|
53C000
|
unkown
|
page write copy
|
||
|
6A53000
|
trusted library allocation
|
page read and write
|
||
|
51F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2FC0000
|
trusted library section
|
page read and write
|
||
|
3623000
|
direct allocation
|
page read and write
|
||
|
C57000
|
heap
|
page read and write
|
||
|
3471000
|
trusted library allocation
|
page read and write
|
||
|
1AA000
|
stack
|
page read and write
|
||
|
5E8E000
|
stack
|
page read and write
|
||
|
5150000
|
trusted library allocation
|
page read and write
|
||
|
B70000
|
heap
|
page read and write
|
||
|
7DD000
|
trusted library allocation
|
page execute and read and write
|
||
|
4B1F000
|
stack
|
page read and write
|
||
|
539E000
|
stack
|
page read and write
|
||
|
349B000
|
trusted library allocation
|
page read and write
|
||
|
AEE000
|
stack
|
page read and write
|
||
|
535E000
|
stack
|
page read and write
|
||
|
383E000
|
direct allocation
|
page read and write
|
||
|
525E000
|
stack
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
3500000
|
direct allocation
|
page read and write
|
||
|
3500000
|
direct allocation
|
page read and write
|
||
|
4F5000
|
heap
|
page read and write
|
||
|
34C5000
|
trusted library allocation
|
page read and write
|
||
|
C56000
|
heap
|
page read and write
|
||
|
3130000
|
trusted library allocation
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
3500000
|
direct allocation
|
page read and write
|
||
|
383E000
|
direct allocation
|
page read and write
|
||
|
1FA7000
|
trusted library allocation
|
page execute and read and write
|
||
|
3565000
|
trusted library allocation
|
page read and write
|
||
|
6DD0000
|
heap
|
page read and write
|
There are 347 hidden memdumps, click here to show them.