Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
7F7R8soxHM.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\aut5DEB.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut5E3B.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\scroll
|
ASCII text, with very long lines (29748), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\undiscernibly
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\7F7R8soxHM.exe
|
"C:\Users\user\Desktop\7F7R8soxHM.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\7F7R8soxHM.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://account.dyn.com/
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ftp.transotraval.cl
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
ftp.transotraval.cl
|
201.148.105.186
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
201.148.105.186
|
ftp.transotraval.cl
|
Chile
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2911000
|
trusted library allocation
|
page read and write
|
|
|
|
295E000
|
trusted library allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
1720000
|
direct allocation
|
page read and write
|
|
|
|
2703000
|
trusted library allocation
|
page execute and read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
BBA000
|
heap
|
page read and write
|
||
|
5F90000
|
trusted library allocation
|
page read and write
|
||
|
25B0000
|
heap
|
page read and write
|
||
|
1842000
|
heap
|
page read and write
|
||
|
4459000
|
direct allocation
|
page read and write
|
||
|
2700000
|
trusted library allocation
|
page read and write
|
||
|
53AE000
|
stack
|
page read and write
|
||
|
CF0000
|
heap
|
page read and write
|
||
|
42B3000
|
direct allocation
|
page read and write
|
||
|
17F7000
|
heap
|
page read and write
|
||
|
EFF000
|
unkown
|
page readonly
|
||
|
44CE000
|
direct allocation
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
3919000
|
trusted library allocation
|
page read and write
|
||
|
4190000
|
direct allocation
|
page read and write
|
||
|
5FA0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5C0E000
|
stack
|
page read and write
|
||
|
D30000
|
heap
|
page read and write
|
||
|
271D000
|
trusted library allocation
|
page execute and read and write
|
||
|
42B3000
|
direct allocation
|
page read and write
|
||
|
5B0E000
|
stack
|
page read and write
|
||
|
F2F000
|
unkown
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
2726000
|
trusted library allocation
|
page execute and read and write
|
||
|
5088000
|
trusted library allocation
|
page read and write
|
||
|
509C000
|
trusted library allocation
|
page read and write
|
||
|
42B3000
|
direct allocation
|
page read and write
|
||
|
445D000
|
direct allocation
|
page read and write
|
||
|
F25000
|
unkown
|
page readonly
|
||
|
1824000
|
heap
|
page read and write
|
||
|
297C000
|
trusted library allocation
|
page read and write
|
||
|
4F8E000
|
trusted library allocation
|
page read and write
|
||
|
4FA2000
|
trusted library allocation
|
page read and write
|
||
|
24D4000
|
heap
|
page read and write
|
||
|
4459000
|
direct allocation
|
page read and write
|
||
|
5F96000
|
trusted library allocation
|
page read and write
|
||
|
4FB0000
|
trusted library allocation
|
page read and write
|
||
|
17F7000
|
heap
|
page read and write
|
||
|
445D000
|
direct allocation
|
page read and write
|
||
|
44CE000
|
direct allocation
|
page read and write
|
||
|
17B3000
|
heap
|
page read and write
|
||
|
3939000
|
trusted library allocation
|
page read and write
|
||
|
60C0000
|
trusted library allocation
|
page read and write
|
||
|
EFF000
|
unkown
|
page readonly
|
||
|
64E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1792000
|
heap
|
page read and write
|
||
|
FFE000
|
stack
|
page read and write
|
||
|
CA0000
|
heap
|
page read and write
|
||
|
42B3000
|
direct allocation
|
page read and write
|
||
|
E71000
|
unkown
|
page execute read
|
||
|
28CE000
|
stack
|
page read and write
|
||
|
4459000
|
direct allocation
|
page read and write
|
||
|
4190000
|
direct allocation
|
page read and write
|
||
|
2730000
|
trusted library allocation
|
page read and write
|
||
|
A39000
|
stack
|
page read and write
|
||
|
28D0000
|
trusted library allocation
|
page read and write
|
||
|
17A3000
|
heap
|
page read and write
|
||
|
15BF000
|
stack
|
page read and write
|
||
|
C68000
|
heap
|
page read and write
|
||
|
4330000
|
direct allocation
|
page read and write
|
||
|
178B000
|
heap
|
page read and write
|
||
|
53EE000
|
stack
|
page read and write
|
||
|
F25000
|
unkown
|
page readonly
|
||
|
1823000
|
heap
|
page read and write
|
||
|
17F7000
|
heap
|
page read and write
|
||
|
4190000
|
direct allocation
|
page read and write
|
||
|
E50000
|
heap
|
page read and write
|
||
|
2722000
|
trusted library allocation
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
1823000
|
heap
|
page read and write
|
||
|
4F7B000
|
trusted library allocation
|
page read and write
|
||
|
D16000
|
heap
|
page read and write
|
||
|
272A000
|
trusted library allocation
|
page execute and read and write
|
||
|
42B3000
|
direct allocation
|
page read and write
|
||
|
4958000
|
trusted library allocation
|
page read and write
|
||
|
E60000
|
heap
|
page read and write
|
||
|
1793000
|
heap
|
page read and write
|
||
|
1793000
|
heap
|
page read and write
|
||
|
4F82000
|
trusted library allocation
|
page read and write
|
||
|
F38000
|
unkown
|
page readonly
|
||
|
15DB000
|
stack
|
page read and write
|
||
|
1843000
|
heap
|
page read and write
|
||
|
E70000
|
unkown
|
page readonly
|
||
|
D10000
|
heap
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
C4D000
|
heap
|
page read and write
|
||
|
178B000
|
heap
|
page read and write
|
||
|
5FED000
|
stack
|
page read and write
|
||
|
4F8A000
|
trusted library allocation
|
page read and write
|
||
|
17B3000
|
heap
|
page read and write
|
||
|
445D000
|
direct allocation
|
page read and write
|
||
|
F2F000
|
unkown
|
page write copy
|
||
|
17A4000
|
heap
|
page read and write
|
||
|
3911000
|
trusted library allocation
|
page read and write
|
||
|
52AC000
|
stack
|
page read and write
|
||
|
24D0000
|
heap
|
page read and write
|
||
|
FBE000
|
stack
|
page read and write
|
||
|
2900000
|
heap
|
page read and write
|
||
|
16F0000
|
heap
|
page read and write
|
||
|
B98000
|
heap
|
page read and write
|
||
|
27B0000
|
trusted library allocation
|
page read and write
|
||
|
17BE000
|
heap
|
page read and write
|
||
|
64D0000
|
heap
|
page read and write
|
||
|
44CE000
|
direct allocation
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
4B2C000
|
stack
|
page read and write
|
||
|
B39000
|
stack
|
page read and write
|
||
|
27A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
50A0000
|
heap
|
page execute and read and write
|
||
|
4F76000
|
trusted library allocation
|
page read and write
|
||
|
445D000
|
direct allocation
|
page read and write
|
||
|
DEA000
|
stack
|
page read and write
|
||
|
397D000
|
trusted library allocation
|
page read and write
|
||
|
15CE000
|
stack
|
page read and write
|
||
|
42B3000
|
direct allocation
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
5090000
|
trusted library allocation
|
page read and write
|
||
|
17A2000
|
heap
|
page read and write
|
||
|
4F70000
|
trusted library allocation
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
273B000
|
trusted library allocation
|
page execute and read and write
|
||
|
4330000
|
direct allocation
|
page read and write
|
||
|
28F3000
|
heap
|
page read and write
|
||
|
2720000
|
trusted library allocation
|
page read and write
|
||
|
4330000
|
direct allocation
|
page read and write
|
||
|
60B0000
|
trusted library allocation
|
page read and write
|
||
|
506E000
|
stack
|
page read and write
|
||
|
28F0000
|
heap
|
page read and write
|
||
|
64CE000
|
stack
|
page read and write
|
||
|
608E000
|
stack
|
page read and write
|
||
|
16C0000
|
heap
|
page read and write
|
||
|
4F9D000
|
trusted library allocation
|
page read and write
|
||
|
4459000
|
direct allocation
|
page read and write
|
||
|
5E90000
|
heap
|
page read and write
|
||
|
4459000
|
direct allocation
|
page read and write
|
||
|
4190000
|
direct allocation
|
page read and write
|
||
|
1783000
|
heap
|
page read and write
|
||
|
BC7000
|
heap
|
page read and write
|
||
|
1842000
|
heap
|
page read and write
|
||
|
1710000
|
direct allocation
|
page execute and read and write
|
||
|
4C2D000
|
stack
|
page read and write
|
||
|
279E000
|
stack
|
page read and write
|
||
|
2710000
|
trusted library allocation
|
page read and write
|
||
|
C80000
|
heap
|
page read and write
|
||
|
4190000
|
direct allocation
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
7F2F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
4330000
|
direct allocation
|
page read and write
|
||
|
242E000
|
stack
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
1768000
|
heap
|
page read and write
|
||
|
17A3000
|
heap
|
page read and write
|
||
|
E70000
|
unkown
|
page readonly
|
||
|
BC5000
|
heap
|
page read and write
|
||
|
44CE000
|
direct allocation
|
page read and write
|
||
|
27C0000
|
heap
|
page execute and read and write
|
||
|
445D000
|
direct allocation
|
page read and write
|
||
|
50B0000
|
heap
|
page read and write
|
||
|
D45000
|
heap
|
page read and write
|
||
|
296C000
|
trusted library allocation
|
page read and write
|
||
|
6090000
|
trusted library allocation
|
page execute and read and write
|
||
|
C13000
|
heap
|
page read and write
|
||
|
2735000
|
trusted library allocation
|
page execute and read and write
|
||
|
43E000
|
system
|
page execute and read and write
|
||
|
1793000
|
heap
|
page read and write
|
||
|
63CE000
|
stack
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
270D000
|
trusted library allocation
|
page execute and read and write
|
||
|
4330000
|
direct allocation
|
page read and write
|
||
|
500C000
|
stack
|
page read and write
|
||
|
4190000
|
direct allocation
|
page read and write
|
||
|
1760000
|
heap
|
page read and write
|
||
|
44CE000
|
direct allocation
|
page read and write
|
||
|
2737000
|
trusted library allocation
|
page execute and read and write
|
||
|
60A7000
|
trusted library allocation
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
1813000
|
heap
|
page read and write
|
||
|
17BD000
|
heap
|
page read and write
|
||
|
F38000
|
unkown
|
page readonly
|
||
|
2732000
|
trusted library allocation
|
page read and write
|
||
|
26C0000
|
heap
|
page read and write
|
||
|
C52000
|
heap
|
page read and write
|
||
|
295C000
|
trusted library allocation
|
page read and write
|
||
|
B90000
|
heap
|
page read and write
|
||
|
26F0000
|
trusted library allocation
|
page read and write
|
||
|
D40000
|
heap
|
page read and write
|
||
|
17A3000
|
heap
|
page read and write
|
||
|
2704000
|
trusted library allocation
|
page read and write
|
||
|
202E000
|
stack
|
page read and write
|
||
|
44CE000
|
direct allocation
|
page read and write
|
||
|
17A4000
|
heap
|
page read and write
|
||
|
5510000
|
heap
|
page read and write
|
||
|
4F7E000
|
trusted library allocation
|
page read and write
|
||
|
4F96000
|
trusted library allocation
|
page read and write
|
||
|
15FC000
|
stack
|
page read and write
|
||
|
C6C000
|
heap
|
page read and write
|
||
|
5080000
|
trusted library allocation
|
page read and write
|
||
|
E71000
|
unkown
|
page execute read
|
||
|
4F91000
|
trusted library allocation
|
page read and write
|
||
|
28E0000
|
trusted library allocation
|
page read and write
|
||
|
54EE000
|
stack
|
page read and write
|
||
|
4459000
|
direct allocation
|
page read and write
|
||
|
4330000
|
direct allocation
|
page read and write
|
||
|
F33000
|
unkown
|
page write copy
|
||
|
2750000
|
trusted library allocation
|
page read and write
|
||
|
6780000
|
heap
|
page read and write
|
||
|
445D000
|
direct allocation
|
page read and write
|
||
|
5FF0000
|
trusted library allocation
|
page read and write
|
||
|
1806000
|
heap
|
page read and write
|
||
|
60A0000
|
trusted library allocation
|
page read and write
|
There are 206 hidden memdumps, click here to show them.