Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
2aFb7hE00o.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\aut4A8E.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut4ADE.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\beeish
|
ASCII text, with very long lines (29708), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\unnervousness
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\2aFb7hE00o.exe
|
"C:\Users\user\Desktop\2aFb7hE00o.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\2aFb7hE00o.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://account.dyn.com/
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ip-api.com/line/?fields=hosting
|
208.95.112.1
|
||
|
http://ip-api.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
ip-api.com
|
208.95.112.1
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.95.112.1
|
ip-api.com
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
18B0000
|
direct allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
D00000
|
heap
|
page read and write
|
||
|
D4C000
|
heap
|
page read and write
|
||
|
38C9000
|
direct allocation
|
page read and write
|
||
|
58DE000
|
stack
|
page read and write
|
||
|
3723000
|
direct allocation
|
page read and write
|
||
|
C81000
|
heap
|
page read and write
|
||
|
D2D000
|
heap
|
page read and write
|
||
|
3723000
|
direct allocation
|
page read and write
|
||
|
1549000
|
heap
|
page read and write
|
||
|
325D000
|
trusted library allocation
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
142E000
|
stack
|
page read and write
|
||
|
B9F000
|
unkown
|
page write copy
|
||
|
65C0000
|
heap
|
page read and write
|
||
|
14B0000
|
heap
|
page read and write
|
||
|
3501000
|
trusted library allocation
|
page read and write
|
||
|
CA0000
|
heap
|
page read and write
|
||
|
1580000
|
heap
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
5940000
|
heap
|
page execute and read and write
|
||
|
182E000
|
stack
|
page read and write
|
||
|
3723000
|
direct allocation
|
page read and write
|
||
|
C80000
|
heap
|
page read and write
|
||
|
5B4C000
|
stack
|
page read and write
|
||
|
A7E000
|
stack
|
page read and write
|
||
|
AE1000
|
unkown
|
page execute read
|
||
|
38CD000
|
direct allocation
|
page read and write
|
||
|
310000
|
heap
|
page read and write
|
||
|
6A17000
|
trusted library allocation
|
page read and write
|
||
|
C9F000
|
heap
|
page read and write
|
||
|
6A40000
|
trusted library allocation
|
page read and write
|
||
|
D03000
|
heap
|
page read and write
|
||
|
393E000
|
direct allocation
|
page read and write
|
||
|
323B000
|
trusted library allocation
|
page read and write
|
||
|
177C000
|
stack
|
page read and write
|
||
|
B9F000
|
unkown
|
page read and write
|
||
|
393E000
|
direct allocation
|
page read and write
|
||
|
7F340000
|
trusted library allocation
|
page execute and read and write
|
||
|
D03000
|
heap
|
page read and write
|
||
|
6A50000
|
trusted library allocation
|
page execute and read and write
|
||
|
B6F000
|
unkown
|
page readonly
|
||
|
1490000
|
trusted library allocation
|
page read and write
|
||
|
38CD000
|
direct allocation
|
page read and write
|
||
|
BA8000
|
unkown
|
page readonly
|
||
|
1305000
|
heap
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
6608000
|
heap
|
page read and write
|
||
|
C80000
|
heap
|
page read and write
|
||
|
3242000
|
trusted library allocation
|
page read and write
|
||
|
B6F000
|
unkown
|
page readonly
|
||
|
3494000
|
trusted library allocation
|
page read and write
|
||
|
14CE000
|
heap
|
page read and write
|
||
|
3256000
|
trusted library allocation
|
page read and write
|
||
|
C9F000
|
heap
|
page read and write
|
||
|
3251000
|
trusted library allocation
|
page read and write
|
||
|
FF8000
|
stack
|
page read and write
|
||
|
3531000
|
trusted library allocation
|
page read and write
|
||
|
1960000
|
trusted library allocation
|
page read and write
|
||
|
5D4E000
|
stack
|
page read and write
|
||
|
6A20000
|
trusted library allocation
|
page read and write
|
||
|
3230000
|
trusted library allocation
|
page read and write
|
||
|
16F0000
|
heap
|
page execute and read and write
|
||
|
3600000
|
direct allocation
|
page read and write
|
||
|
32F3000
|
heap
|
page read and write
|
||
|
B95000
|
unkown
|
page readonly
|
||
|
14AA000
|
trusted library allocation
|
page execute and read and write
|
||
|
D03000
|
heap
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
16B2000
|
trusted library allocation
|
page read and write
|
||
|
3723000
|
direct allocation
|
page read and write
|
||
|
3236000
|
trusted library allocation
|
page read and write
|
||
|
C67000
|
heap
|
page read and write
|
||
|
C38000
|
heap
|
page read and write
|
||
|
4488000
|
trusted library allocation
|
page read and write
|
||
|
1300000
|
heap
|
page read and write
|
||
|
5E0E000
|
stack
|
page read and write
|
||
|
158F000
|
heap
|
page read and write
|
||
|
3522000
|
trusted library allocation
|
page read and write
|
||
|
1980000
|
heap
|
page read and write
|
||
|
6A10000
|
trusted library allocation
|
page read and write
|
||
|
1940000
|
trusted library allocation
|
page read and write
|
||
|
34FA000
|
trusted library allocation
|
page read and write
|
||
|
393E000
|
direct allocation
|
page read and write
|
||
|
38CD000
|
direct allocation
|
page read and write
|
||
|
C9F000
|
heap
|
page read and write
|
||
|
AE0000
|
unkown
|
page readonly
|
||
|
3510000
|
trusted library allocation
|
page read and write
|
||
|
9DB000
|
stack
|
page read and write
|
||
|
C82000
|
heap
|
page read and write
|
||
|
4421000
|
trusted library allocation
|
page read and write
|
||
|
1930000
|
heap
|
page read and write
|
||
|
38CD000
|
direct allocation
|
page read and write
|
||
|
16E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1591000
|
heap
|
page read and write
|
||
|
14DA000
|
heap
|
page read and write
|
||
|
C30000
|
heap
|
page read and write
|
||
|
38C9000
|
direct allocation
|
page read and write
|
||
|
68FE000
|
stack
|
page read and write
|
||
|
1525000
|
heap
|
page read and write
|
||
|
32B0000
|
heap
|
page read and write
|
||
|
C80000
|
heap
|
page read and write
|
||
|
300000
|
heap
|
page read and write
|
||
|
3F0000
|
heap
|
page read and write
|
||
|
14E5000
|
heap
|
page read and write
|
||
|
393E000
|
direct allocation
|
page read and write
|
||
|
589E000
|
stack
|
page read and write
|
||
|
148D000
|
trusted library allocation
|
page execute and read and write
|
||
|
3600000
|
direct allocation
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
3723000
|
direct allocation
|
page read and write
|
||
|
C10000
|
direct allocation
|
page execute and read and write
|
||
|
38C9000
|
direct allocation
|
page read and write
|
||
|
BA8000
|
unkown
|
page readonly
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
6AF0000
|
trusted library allocation
|
page read and write
|
||
|
9CE000
|
stack
|
page read and write
|
||
|
38CD000
|
direct allocation
|
page read and write
|
||
|
38C9000
|
direct allocation
|
page read and write
|
||
|
1430000
|
heap
|
page read and write
|
||
|
393E000
|
direct allocation
|
page read and write
|
||
|
323E000
|
trusted library allocation
|
page read and write
|
||
|
350A000
|
trusted library allocation
|
page read and write
|
||
|
1260000
|
heap
|
page read and write
|
||
|
16B0000
|
trusted library allocation
|
page read and write
|
||
|
C71000
|
heap
|
page read and write
|
||
|
34E0000
|
trusted library allocation
|
page read and write
|
||
|
9FC000
|
stack
|
page read and write
|
||
|
1986000
|
heap
|
page read and write
|
||
|
14E8000
|
heap
|
page read and write
|
||
|
3600000
|
direct allocation
|
page read and write
|
||
|
3723000
|
direct allocation
|
page read and write
|
||
|
6A00000
|
trusted library allocation
|
page execute and read and write
|
||
|
AE0000
|
unkown
|
page readonly
|
||
|
16BB000
|
trusted library allocation
|
page execute and read and write
|
||
|
B95000
|
unkown
|
page readonly
|
||
|
173E000
|
stack
|
page read and write
|
||
|
9BE000
|
stack
|
page read and write
|
||
|
4449000
|
trusted library allocation
|
page read and write
|
||
|
3455000
|
trusted library allocation
|
page read and write
|
||
|
14B8000
|
heap
|
page read and write
|
||
|
14A0000
|
trusted library allocation
|
page read and write
|
||
|
1470000
|
trusted library allocation
|
page read and write
|
||
|
C64000
|
heap
|
page read and write
|
||
|
1484000
|
trusted library allocation
|
page read and write
|
||
|
5C4E000
|
stack
|
page read and write
|
||
|
C8F000
|
heap
|
page read and write
|
||
|
3600000
|
direct allocation
|
page read and write
|
||
|
6A27000
|
trusted library allocation
|
page read and write
|
||
|
69FE000
|
stack
|
page read and write
|
||
|
C82000
|
heap
|
page read and write
|
||
|
3300000
|
heap
|
page read and write
|
||
|
43E000
|
system
|
page execute and read and write
|
||
|
5DCD000
|
stack
|
page read and write
|
||
|
1483000
|
trusted library allocation
|
page execute and read and write
|
||
|
3600000
|
direct allocation
|
page read and write
|
||
|
3421000
|
trusted library allocation
|
page read and write
|
||
|
AE1000
|
unkown
|
page execute read
|
||
|
551D000
|
stack
|
page read and write
|
||
|
32B4000
|
heap
|
page read and write
|
||
|
350E000
|
trusted library allocation
|
page read and write
|
||
|
12B0000
|
heap
|
page read and write
|
||
|
34E6000
|
trusted library allocation
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
64BE000
|
stack
|
page read and write
|
||
|
32E0000
|
trusted library allocation
|
page read and write
|
||
|
32AC000
|
stack
|
page read and write
|
||
|
1780000
|
trusted library allocation
|
page read and write
|
||
|
1583000
|
heap
|
page read and write
|
||
|
A3D000
|
stack
|
page read and write
|
||
|
5950000
|
heap
|
page read and write
|
||
|
C91000
|
heap
|
page read and write
|
||
|
1950000
|
trusted library allocation
|
page read and write
|
||
|
29A000
|
stack
|
page read and write
|
||
|
6AE0000
|
heap
|
page read and write
|
||
|
D4C000
|
heap
|
page read and write
|
||
|
C9F000
|
heap
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
1480000
|
trusted library allocation
|
page read and write
|
||
|
4429000
|
trusted library allocation
|
page read and write
|
||
|
149D000
|
trusted library allocation
|
page execute and read and write
|
||
|
38CD000
|
direct allocation
|
page read and write
|
||
|
65EA000
|
heap
|
page read and write
|
||
|
393E000
|
direct allocation
|
page read and write
|
||
|
38C9000
|
direct allocation
|
page read and write
|
||
|
15AB000
|
heap
|
page read and write
|
||
|
16D0000
|
trusted library allocation
|
page read and write
|
||
|
591E000
|
stack
|
page read and write
|
||
|
C71000
|
heap
|
page read and write
|
||
|
18A8000
|
trusted library allocation
|
page read and write
|
||
|
BA3000
|
unkown
|
page write copy
|
||
|
14A6000
|
trusted library allocation
|
page execute and read and write
|
||
|
3537000
|
trusted library allocation
|
page read and write
|
||
|
32F0000
|
heap
|
page read and write
|
||
|
C9F000
|
heap
|
page read and write
|
||
|
D2D000
|
heap
|
page read and write
|
||
|
324E000
|
trusted library allocation
|
page read and write
|
||
|
1790000
|
heap
|
page read and write
|
||
|
C62000
|
heap
|
page read and write
|
||
|
3310000
|
heap
|
page read and write
|
||
|
6A30000
|
trusted library allocation
|
page read and write
|
||
|
14A2000
|
trusted library allocation
|
page read and write
|
||
|
C9F000
|
heap
|
page read and write
|
||
|
6A60000
|
heap
|
page read and write
|
||
|
D4C000
|
heap
|
page read and write
|
||
|
324A000
|
trusted library allocation
|
page read and write
|
||
|
3496000
|
trusted library allocation
|
page read and write
|
||
|
341F000
|
stack
|
page read and write
|
||
|
3600000
|
direct allocation
|
page read and write
|
||
|
157B000
|
heap
|
page read and write
|
||
|
16B7000
|
trusted library allocation
|
page execute and read and write
|
||
|
EF9000
|
stack
|
page read and write
|
||
|
351E000
|
trusted library allocation
|
page read and write
|
||
|
38C9000
|
direct allocation
|
page read and write
|
There are 205 hidden memdumps, click here to show them.