Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
File-11F_385347.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
|
C:\Users\user\AppData\Local\MPC-HC\MPC-HC.1.9.13.x86.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
Chrome Cache Entry: 39
|
ASCII text, with very long lines (745)
|
downloaded
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\File-11F_385347.exe
|
"C:\Users\user\Desktop\File-11F_385347.exe"
|
 |
|
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
|
||
|
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US
--service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1724,i,16714932929559567655,4968093527130383925,262144
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
/prefetch:8
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGNHIr7EGIjBbcI5gdfmKwCdV__yDFi29L_2EfWEBQ0qVQQiZdNjzBeDdBnmbFvPJWbk3gUOEyDUyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
|
142.250.217.164
|
||
|
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
|
unknown
|
||
|
https://curl.se/docs/hsts.html
|
unknown
|
||
|
https://www.google.com/async/ddljson?async=ntp:2
|
142.250.217.164
|
||
|
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
|
unknown
|
||
|
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGNLIr7EGIjCTne0bwf48RoRhZuPH4pFklPwwJFOSRYaI2xBpyQCasbMRMkTzYh04Cbc12bYZbG0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
|
142.250.217.164
|
||
|
https://sectigo.com/CPS0
|
unknown
|
||
|
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
|
142.250.217.164
|
||
|
http://ocsp.sectigo.com0M
|
unknown
|
||
|
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
|
unknown
|
||
|
http://ocsp.sectigo.com0
|
unknown
|
||
|
https://curl.se/docs/http-cookies.html
|
unknown
|
||
|
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
|
unknown
|
||
|
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
|
unknown
|
||
|
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
|
unknown
|
||
|
https://www.google.com/async/newtab_promos
|
142.250.217.164
|
||
|
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
|
142.250.217.164
|
||
|
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
|
unknown
|
||
|
https://curl.se/docs/alt-svc.html
|
unknown
|
||
|
https://contentworldinc.com/9BEC55CF2367EE37/28571844681/59AFA49E14E6A1FD/71415242461?E560AB4B6913F3
|
unknown
|
||
|
https://contentworldinc.com/9BEC55CF2367EE37/28571844681/59AFA49E14E6A1FD/71415242461?E560AB4B6913F3951714152424
|
104.26.5.9
|
There are 11 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
contentworldinc.com
|
104.26.5.9
|
||
|
www.google.com
|
142.250.217.164
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
142.250.217.164
|
www.google.com
|
United States
|
||
|
239.255.255.250
|
unknown
|
Reserved
|
||
|
192.168.2.4
|
unknown
|
unknown
|
||
|
127.0.0.1
|
unknown
|
unknown
|
||
|
104.26.5.9
|
contentworldinc.com
|
United States
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
14D8000
|
heap
|
page read and write
|
||
|
5BF8000
|
heap
|
page read and write
|
||
|
1161000
|
unkown
|
page readonly
|
||
|
151E000
|
heap
|
page read and write
|
||
|
152C000
|
heap
|
page read and write
|
||
|
55B1000
|
heap
|
page read and write
|
||
|
1507000
|
heap
|
page read and write
|
||
|
1543000
|
heap
|
page read and write
|
||
|
5AF0000
|
heap
|
page read and write
|
||
|
57B0000
|
direct allocation
|
page read and write
|
||
|
3610000
|
trusted library allocation
|
page read and write
|
||
|
16CF000
|
stack
|
page read and write
|
||
|
3000000
|
remote allocation
|
page read and write
|
||
|
418E000
|
stack
|
page read and write
|
||
|
3000000
|
remote allocation
|
page read and write
|
||
|
A6E000
|
stack
|
page read and write
|
||
|
13A4000
|
heap
|
page read and write
|
||
|
11A7000
|
unkown
|
page read and write
|
||
|
1526000
|
heap
|
page read and write
|
||
|
AB0000
|
unkown
|
page readonly
|
||
|
4290000
|
direct allocation
|
page read and write
|
||
|
11A8000
|
unkown
|
page write copy
|
||
|
3FD0000
|
heap
|
page read and write
|
||
|
55B0000
|
heap
|
page read and write
|
||
|
11AA000
|
unkown
|
page read and write
|
||
|
4050000
|
heap
|
page read and write
|
||
|
11B2000
|
unkown
|
page readonly
|
||
|
5BF9000
|
heap
|
page read and write
|
||
|
11B2000
|
unkown
|
page readonly
|
||
|
11A7000
|
unkown
|
page write copy
|
||
|
56B0000
|
heap
|
page read and write
|
||
|
1530000
|
heap
|
page read and write
|
||
|
AB1000
|
unkown
|
page execute read
|
||
|
5BB0000
|
heap
|
page read and write
|
||
|
5AF0000
|
heap
|
page read and write
|
||
|
3F51000
|
heap
|
page read and write
|
||
|
1530000
|
heap
|
page read and write
|
||
|
1542000
|
heap
|
page read and write
|
||
|
152D000
|
heap
|
page read and write
|
||
|
5AF0000
|
heap
|
page read and write
|
||
|
5BF8000
|
heap
|
page read and write
|
||
|
1161000
|
unkown
|
page readonly
|
||
|
1553000
|
heap
|
page read and write
|
||
|
5E9000
|
stack
|
page read and write
|
||
|
12CF000
|
stack
|
page read and write
|
||
|
1530000
|
heap
|
page read and write
|
||
|
3E51000
|
heap
|
page read and write
|
||
|
3F50000
|
heap
|
page read and write
|
||
|
3020000
|
heap
|
page read and write
|
||
|
3000000
|
remote allocation
|
page read and write
|
||
|
305E000
|
heap
|
page read and write
|
||
|
5A30000
|
heap
|
page read and write
|
||
|
5BF0000
|
heap
|
page read and write
|
||
|
2FF0000
|
heap
|
page read and write
|
||
|
3F51000
|
heap
|
page read and write
|
||
|
152C000
|
heap
|
page read and write
|
||
|
59B0000
|
heap
|
page read and write
|
||
|
40D0000
|
heap
|
page read and write
|
||
|
153E000
|
heap
|
page read and write
|
||
|
152C000
|
heap
|
page read and write
|
||
|
55B1000
|
heap
|
page read and write
|
||
|
1515000
|
heap
|
page read and write
|
||
|
151B000
|
heap
|
page read and write
|
||
|
3010000
|
heap
|
page read and write
|
||
|
152C000
|
heap
|
page read and write
|
||
|
4150000
|
direct allocation
|
page read and write
|
||
|
59F0000
|
heap
|
page read and write
|
||
|
55B1000
|
heap
|
page read and write
|
||
|
3ED0000
|
heap
|
page read and write
|
||
|
152C000
|
heap
|
page read and write
|
||
|
1530000
|
heap
|
page read and write
|
||
|
14FC000
|
heap
|
page read and write
|
||
|
3055000
|
heap
|
page read and write
|
||
|
1526000
|
heap
|
page read and write
|
||
|
3E50000
|
heap
|
page read and write
|
||
|
AB1000
|
unkown
|
page execute read
|
||
|
3F65000
|
heap
|
page read and write
|
||
|
4011000
|
heap
|
page read and write
|
||
|
14FC000
|
heap
|
page read and write
|
||
|
3014000
|
heap
|
page read and write
|
||
|
950000
|
heap
|
page read and write
|
||
|
3E90000
|
heap
|
page read and write
|
||
|
13A0000
|
heap
|
page read and write
|
||
|
4090000
|
heap
|
page read and write
|
||
|
3FD0000
|
heap
|
page read and write
|
||
|
59B1000
|
heap
|
page read and write
|
||
|
AB0000
|
unkown
|
page readonly
|
||
|
55B1000
|
heap
|
page read and write
|
||
|
3F90000
|
heap
|
page read and write
|
||
|
130E000
|
stack
|
page read and write
|
||
|
3059000
|
heap
|
page read and write
|
||
|
1521000
|
heap
|
page read and write
|
||
|
13A4000
|
heap
|
page read and write
|
||
|
5BF8000
|
heap
|
page read and write
|
||
|
3F90000
|
heap
|
page read and write
|
||
|
5A70000
|
heap
|
page read and write
|
||
|
1542000
|
heap
|
page read and write
|
||
|
2F6F000
|
stack
|
page read and write
|
||
|
153F000
|
heap
|
page read and write
|
||
|
14D0000
|
heap
|
page read and write
|
||
|
5AF0000
|
heap
|
page read and write
|
||
|
14F8000
|
heap
|
page read and write
|
||
|
1557000
|
heap
|
page read and write
|
||
|
55B1000
|
heap
|
page read and write
|
||
|
5BF8000
|
heap
|
page read and write
|
||
|
5AB0000
|
heap
|
page read and write
|
||
|
AAE000
|
stack
|
page read and write
|
||
|
5B30000
|
heap
|
page read and write
|
||
|
4010000
|
heap
|
page read and write
|
||
|
5DB0000
|
direct allocation
|
page read and write
|
||
|
1581000
|
heap
|
page read and write
|
||
|
1507000
|
heap
|
page read and write
|
||
|
14AE000
|
stack
|
page read and write
|
||
|
5BF8000
|
heap
|
page read and write
|
||
|
153D000
|
heap
|
page read and write
|
||
|
152C000
|
heap
|
page read and write
|
||
|
5AF0000
|
heap
|
page read and write
|
||
|
8FB000
|
stack
|
page read and write
|
||
|
1526000
|
heap
|
page read and write
|
||
|
1518000
|
heap
|
page read and write
|
||
|
153D000
|
heap
|
page read and write
|
||
|
11B0000
|
unkown
|
page readonly
|
||
|
3F90000
|
heap
|
page read and write
|
||
|
2FE0000
|
heap
|
page read and write
|
||
|
5FF0000
|
direct allocation
|
page read and write
|
||
|
1557000
|
heap
|
page read and write
|
||
|
1310000
|
heap
|
page read and write
|
||
|
1526000
|
heap
|
page read and write
|
||
|
55C0000
|
heap
|
page read and write
|
||
|
3050000
|
heap
|
page read and write
|
||
|
4091000
|
heap
|
page read and write
|
||
|
3F51000
|
heap
|
page read and write
|
||
|
56B0000
|
trusted library allocation
|
page read and write
|
||
|
5BF8000
|
heap
|
page read and write
|
||
|
5BF8000
|
heap
|
page read and write
|
||
|
11B0000
|
unkown
|
page readonly
|
||
|
428F000
|
stack
|
page read and write
|
||
|
152C000
|
heap
|
page read and write
|
||
|
3F90000
|
heap
|
page read and write
|
||
|
152D000
|
heap
|
page read and write
|
||
|
5BF8000
|
heap
|
page read and write
|
||
|
3ED1000
|
heap
|
page read and write
|
||
|
5A31000
|
heap
|
page read and write
|
||
|
5BB1000
|
heap
|
page read and write
|
||
|
5AB1000
|
heap
|
page read and write
|
||
|
3F90000
|
heap
|
page read and write
|
||
|
5BF8000
|
heap
|
page read and write
|
||
|
5AF0000
|
heap
|
page read and write
|
||
|
1553000
|
heap
|
page read and write
|
||
|
3F91000
|
heap
|
page read and write
|
||
|
139E000
|
stack
|
page read and write
|
There are 141 hidden memdumps, click here to show them.