Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
eiQXaKJ75nCjEWn.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\eiQXaKJ75nCjEWn.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\eiQXaKJ75nCjEWn.exe
|
"C:\Users\user\Desktop\eiQXaKJ75nCjEWn.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://r3.o.lencr.org0
|
unknown
|
||
|
http://mail.pu.edu.af
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
http://x1.c.lencr.org/0
|
unknown
|
||
|
http://x1.i.lencr.org/0
|
unknown
|
||
|
http://r3.i.lencr.org/03
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
mail.pu.edu.af
|
103.132.98.224
|
|
|
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
103.132.98.224
|
mail.pu.edu.af
|
Afghanistan
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2DA1000
|
trusted library allocation
|
page read and write
|
|
|
|
402000
|
remote allocation
|
page execute and read and write
|
|
|
|
2E18000
|
trusted library allocation
|
page read and write
|
|
|
|
5620000
|
trusted library section
|
page read and write
|
|
|
|
2DEE000
|
trusted library allocation
|
page read and write
|
|
|
|
301E000
|
trusted library allocation
|
page read and write
|
|
|
|
4A11000
|
trusted library allocation
|
page read and write
|
|
|
|
2DB1000
|
trusted library allocation
|
page read and write
|
|
|
|
40F1000
|
trusted library allocation
|
page read and write
|
|
|
|
F70000
|
trusted library allocation
|
page read and write
|
||
|
6330000
|
trusted library section
|
page read and write
|
||
|
55D0000
|
trusted library section
|
page read and write
|
||
|
531F000
|
trusted library allocation
|
page read and write
|
||
|
1204000
|
heap
|
page read and write
|
||
|
6A10000
|
heap
|
page read and write
|
||
|
8EEE000
|
stack
|
page read and write
|
||
|
2D2E000
|
trusted library allocation
|
page read and write
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
127B000
|
trusted library allocation
|
page execute and read and write
|
||
|
F20000
|
heap
|
page read and write
|
||
|
606E000
|
stack
|
page read and write
|
||
|
53B2000
|
trusted library allocation
|
page read and write
|
||
|
53D0000
|
heap
|
page execute and read and write
|
||
|
2DEC000
|
trusted library allocation
|
page read and write
|
||
|
62CD000
|
stack
|
page read and write
|
||
|
F60000
|
trusted library allocation
|
page read and write
|
||
|
F90000
|
heap
|
page read and write
|
||
|
55CE000
|
stack
|
page read and write
|
||
|
6A20000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E07000
|
trusted library allocation
|
page read and write
|
||
|
3E09000
|
trusted library allocation
|
page read and write
|
||
|
5323000
|
heap
|
page read and write
|
||
|
902D000
|
stack
|
page read and write
|
||
|
61F0000
|
trusted library allocation
|
page read and write
|
||
|
111A000
|
trusted library allocation
|
page execute and read and write
|
||
|
F86000
|
trusted library allocation
|
page execute and read and write
|
||
|
FCA000
|
heap
|
page read and write
|
||
|
114E000
|
heap
|
page read and write
|
||
|
2D41000
|
trusted library allocation
|
page read and write
|
||
|
88ED000
|
stack
|
page read and write
|
||
|
A82000
|
unkown
|
page readonly
|
||
|
1060000
|
heap
|
page read and write
|
||
|
EF9000
|
stack
|
page read and write
|
||
|
2E14000
|
trusted library allocation
|
page read and write
|
||
|
11EC000
|
heap
|
page read and write
|
||
|
2E21000
|
trusted library allocation
|
page read and write
|
||
|
1330000
|
trusted library allocation
|
page read and write
|
||
|
912E000
|
stack
|
page read and write
|
||
|
10F4000
|
trusted library allocation
|
page read and write
|
||
|
73C1000
|
trusted library allocation
|
page read and write
|
||
|
5310000
|
trusted library allocation
|
page read and write
|
||
|
1032000
|
heap
|
page read and write
|
||
|
FBB000
|
heap
|
page read and write
|
||
|
B49000
|
stack
|
page read and write
|
||
|
5860000
|
trusted library allocation
|
page read and write
|
||
|
2D6E000
|
stack
|
page read and write
|
||
|
5610000
|
trusted library allocation
|
page execute and read and write
|
||
|
1148000
|
heap
|
page read and write
|
||
|
60B0000
|
heap
|
page read and write
|
||
|
53E0000
|
heap
|
page read and write
|
||
|
1184000
|
heap
|
page read and write
|
||
|
BBA000
|
stack
|
page read and write
|
||
|
2BC4000
|
trusted library allocation
|
page read and write
|
||
|
55E0000
|
heap
|
page read and write
|
||
|
F7D000
|
trusted library allocation
|
page execute and read and write
|
||
|
5343000
|
heap
|
page read and write
|
||
|
628F000
|
stack
|
page read and write
|
||
|
1277000
|
trusted library allocation
|
page execute and read and write
|
||
|
10F3000
|
trusted library allocation
|
page execute and read and write
|
||
|
5FE9000
|
trusted library allocation
|
page read and write
|
||
|
58E7000
|
trusted library allocation
|
page read and write
|
||
|
2D90000
|
trusted library allocation
|
page read and write
|
||
|
FD6000
|
heap
|
page read and write
|
||
|
1137000
|
trusted library allocation
|
page execute and read and write
|
||
|
58C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
10FD000
|
trusted library allocation
|
page execute and read and write
|
||
|
5FAF000
|
stack
|
page read and write
|
||
|
11E1000
|
heap
|
page read and write
|
||
|
113B000
|
trusted library allocation
|
page execute and read and write
|
||
|
10F0000
|
trusted library allocation
|
page read and write
|
||
|
110D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1112000
|
trusted library allocation
|
page read and write
|
||
|
F7D000
|
stack
|
page read and write
|
||
|
F63000
|
trusted library allocation
|
page execute and read and write
|
||
|
FE5000
|
heap
|
page read and write
|
||
|
538E000
|
stack
|
page read and write
|
||
|
5630000
|
trusted library allocation
|
page read and write
|
||
|
3DB9000
|
trusted library allocation
|
page read and write
|
||
|
4E40000
|
trusted library allocation
|
page read and write
|
||
|
103A000
|
heap
|
page read and write
|
||
|
3E07000
|
trusted library allocation
|
page read and write
|
||
|
3DB1000
|
trusted library allocation
|
page read and write
|
||
|
2C20000
|
heap
|
page execute and read and write
|
||
|
2D32000
|
trusted library allocation
|
page read and write
|
||
|
5335000
|
trusted library allocation
|
page read and write
|
||
|
5868000
|
trusted library allocation
|
page read and write
|
||
|
2D80000
|
trusted library allocation
|
page read and write
|
||
|
F64000
|
trusted library allocation
|
page read and write
|
||
|
2D70000
|
trusted library allocation
|
page execute and read and write
|
||
|
58D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
F30000
|
heap
|
page read and write
|
||
|
2E48000
|
trusted library allocation
|
page read and write
|
||
|
F82000
|
trusted library allocation
|
page read and write
|
||
|
58A0000
|
trusted library allocation
|
page read and write
|
||
|
6125000
|
heap
|
page read and write
|
||
|
1140000
|
heap
|
page read and write
|
||
|
4E8B000
|
stack
|
page read and write
|
||
|
2D90000
|
heap
|
page execute and read and write
|
||
|
3F8E000
|
trusted library allocation
|
page read and write
|
||
|
131C000
|
stack
|
page read and write
|
||
|
2B08000
|
trusted library allocation
|
page read and write
|
||
|
2D4D000
|
trusted library allocation
|
page read and write
|
||
|
52DB000
|
trusted library allocation
|
page read and write
|
||
|
FA8000
|
heap
|
page read and write
|
||
|
FD4000
|
heap
|
page read and write
|
||
|
57CF000
|
stack
|
page read and write
|
||
|
2D3A000
|
trusted library allocation
|
page read and write
|
||
|
648D000
|
stack
|
page read and write
|
||
|
F95000
|
heap
|
page read and write
|
||
|
133E000
|
stack
|
page read and write
|
||
|
1350000
|
heap
|
page read and write
|
||
|
1130000
|
trusted library allocation
|
page read and write
|
||
|
1181000
|
heap
|
page read and write
|
||
|
5340000
|
heap
|
page read and write
|
||
|
58D0000
|
trusted library allocation
|
page read and write
|
||
|
3DA1000
|
trusted library allocation
|
page read and write
|
||
|
1270000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
2C00000
|
heap
|
page read and write
|
||
|
2C6E000
|
stack
|
page read and write
|
||
|
1098000
|
heap
|
page read and write
|
||
|
6A0E000
|
stack
|
page read and write
|
||
|
52F6000
|
trusted library allocation
|
page read and write
|
||
|
2BD0000
|
heap
|
page read and write
|
||
|
2D46000
|
trusted library allocation
|
page read and write
|
||
|
1168000
|
heap
|
page read and write
|
||
|
75EE000
|
stack
|
page read and write
|
||
|
5FE0000
|
trusted library allocation
|
page read and write
|
||
|
F50000
|
trusted library allocation
|
page read and write
|
||
|
589C000
|
trusted library allocation
|
page read and write
|
||
|
5FF0000
|
heap
|
page read and write
|
||
|
1290000
|
trusted library allocation
|
page read and write
|
||
|
8DB0000
|
heap
|
page read and write
|
||
|
EF7000
|
stack
|
page read and write
|
||
|
2D60000
|
trusted library allocation
|
page read and write
|
||
|
52FD000
|
trusted library allocation
|
page read and write
|
||
|
1272000
|
trusted library allocation
|
page read and write
|
||
|
61ED000
|
stack
|
page read and write
|
||
|
1175000
|
heap
|
page read and write
|
||
|
F00000
|
heap
|
page read and write
|
||
|
5320000
|
heap
|
page read and write
|
||
|
1120000
|
heap
|
page read and write
|
||
|
5FCE000
|
stack
|
page read and write
|
||
|
2CDE000
|
stack
|
page read and write
|
||
|
FFD10000
|
trusted library allocation
|
page execute and read and write
|
||
|
F8A000
|
trusted library allocation
|
page execute and read and write
|
||
|
4DEE000
|
stack
|
page read and write
|
||
|
5600000
|
trusted library allocation
|
page read and write
|
||
|
6C70000
|
heap
|
page read and write
|
||
|
3DC9000
|
trusted library allocation
|
page read and write
|
||
|
5300000
|
trusted library allocation
|
page read and write
|
||
|
FE0000
|
heap
|
page read and write
|
||
|
56DE000
|
stack
|
page read and write
|
||
|
F10000
|
heap
|
page read and write
|
||
|
40B1000
|
trusted library allocation
|
page read and write
|
||
|
4E3E000
|
stack
|
page read and write
|
||
|
A80000
|
unkown
|
page readonly
|
||
|
5302000
|
trusted library allocation
|
page read and write
|
||
|
F80000
|
trusted library allocation
|
page read and write
|
||
|
52EE000
|
trusted library allocation
|
page read and write
|
||
|
5340000
|
trusted library allocation
|
page read and write
|
||
|
52D0000
|
trusted library allocation
|
page read and write
|
||
|
8DAD000
|
stack
|
page read and write
|
||
|
5650000
|
heap
|
page execute and read and write
|
||
|
8AAF000
|
stack
|
page read and write
|
||
|
2D2B000
|
trusted library allocation
|
page read and write
|
||
|
58B0000
|
trusted library allocation
|
page read and write
|
||
|
2BC0000
|
trusted library allocation
|
page read and write
|
||
|
2D20000
|
trusted library allocation
|
page read and write
|
||
|
1320000
|
trusted library allocation
|
page execute and read and write
|
||
|
3EA3000
|
trusted library allocation
|
page read and write
|
||
|
60CE000
|
heap
|
page read and write
|
||
|
58B6000
|
trusted library allocation
|
page read and write
|
||
|
2EEB000
|
trusted library allocation
|
page read and write
|
||
|
4E9D000
|
stack
|
page read and write
|
||
|
581E000
|
stack
|
page read and write
|
||
|
5FD0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1116000
|
trusted library allocation
|
page execute and read and write
|
||
|
5890000
|
trusted library allocation
|
page read and write
|
||
|
55F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1275000
|
trusted library allocation
|
page execute and read and write
|
||
|
690E000
|
stack
|
page read and write
|
||
|
143E000
|
stack
|
page read and write
|
||
|
10E0000
|
trusted library allocation
|
page read and write
|
||
|
BB0000
|
heap
|
page read and write
|
||
|
52D4000
|
trusted library allocation
|
page read and write
|
||
|
5560000
|
trusted library allocation
|
page read and write
|
||
|
4DF0000
|
trusted library allocation
|
page read and write
|
||
|
1110000
|
trusted library allocation
|
page read and write
|
||
|
8CAE000
|
stack
|
page read and write
|
||
|
3E55000
|
trusted library allocation
|
page read and write
|
||
|
102A000
|
heap
|
page read and write
|
||
|
53B0000
|
trusted library allocation
|
page read and write
|
||
|
57DE000
|
stack
|
page read and write
|
||
|
1340000
|
trusted library allocation
|
page read and write
|
||
|
F6D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2D3E000
|
trusted library allocation
|
page read and write
|
||
|
1132000
|
trusted library allocation
|
page read and write
|
||
|
57D0000
|
heap
|
page read and write
|
||
|
55DC000
|
stack
|
page read and write
|
||
|
4E42000
|
trusted library allocation
|
page read and write
|
||
|
F90000
|
heap
|
page read and write
|
||
|
8FEE000
|
stack
|
page read and write
|
||
|
5360000
|
trusted library allocation
|
page read and write
|
||
|
5330000
|
trusted library allocation
|
page read and write
|
||
|
1082000
|
heap
|
page read and write
|
||
|
1103000
|
trusted library allocation
|
page read and write
|
||
|
1100000
|
trusted library allocation
|
page read and write
|
||
|
88AE000
|
stack
|
page read and write
|
||
|
58E0000
|
trusted library allocation
|
page read and write
|
||
|
8BAE000
|
stack
|
page read and write
|
||
|
12DE000
|
stack
|
page read and write
|
||
|
531C000
|
stack
|
page read and write
|
||
|
53A0000
|
heap
|
page read and write
|
||
|
2BF0000
|
trusted library allocation
|
page read and write
|
||
|
5ECC000
|
stack
|
page read and write
|
||
|
58F0000
|
trusted library allocation
|
page read and write
|
||
|
B2A000
|
unkown
|
page readonly
|
||
|
2D52000
|
trusted library allocation
|
page read and write
|
||
|
4F8C000
|
stack
|
page read and write
|
||
|
53CE000
|
stack
|
page read and write
|
||
|
2DA0000
|
heap
|
page read and write
|
||
|
2BA0000
|
heap
|
page read and write
|
||
|
FDE000
|
stack
|
page read and write
|
||
|
52F1000
|
trusted library allocation
|
page read and write
|
||
|
53C0000
|
trusted library allocation
|
page execute and read and write
|
There are 226 hidden memdumps, click here to show them.