Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
documentos.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\aut4FBD.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut502C.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\outbluffed
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\totten
|
ASCII text, with very long lines (29748), with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\documentos.exe
|
"C:\Users\user\Desktop\documentos.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\documentos.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://account.dyn.com/
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ip-api.com/line/?fields=hosting
|
208.95.112.1
|
||
|
http://ip-api.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
ip-api.com
|
208.95.112.1
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.95.112.1
|
ip-api.com
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
402000
|
system
|
page execute and read and write
|
|
|
|
3BA0000
|
direct allocation
|
page read and write
|
|
|
|
170B000
|
heap
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
11A7000
|
heap
|
page read and write
|
||
|
C33000
|
unkown
|
page write copy
|
||
|
1688000
|
heap
|
page read and write
|
||
|
43ED000
|
direct allocation
|
page read and write
|
||
|
11F5000
|
heap
|
page read and write
|
||
|
43E000
|
system
|
page execute and read and write
|
||
|
16C2000
|
heap
|
page read and write
|
||
|
2F13000
|
trusted library allocation
|
page read and write
|
||
|
173E000
|
heap
|
page read and write
|
||
|
43E9000
|
direct allocation
|
page read and write
|
||
|
440E000
|
direct allocation
|
page read and write
|
||
|
2DB0000
|
trusted library allocation
|
page read and write
|
||
|
170E000
|
heap
|
page read and write
|
||
|
43E9000
|
direct allocation
|
page read and write
|
||
|
66B7000
|
trusted library allocation
|
page read and write
|
||
|
16C3000
|
heap
|
page read and write
|
||
|
4F9D000
|
stack
|
page read and write
|
||
|
119A000
|
heap
|
page read and write
|
||
|
170E000
|
heap
|
page read and write
|
||
|
445E000
|
direct allocation
|
page read and write
|
||
|
16DB000
|
heap
|
page read and write
|
||
|
53C0000
|
trusted library allocation
|
page read and write
|
||
|
10B0000
|
trusted library allocation
|
page read and write
|
||
|
4399000
|
direct allocation
|
page read and write
|
||
|
42C0000
|
direct allocation
|
page read and write
|
||
|
5980000
|
trusted library allocation
|
page execute and read and write
|
||
|
53E0000
|
heap
|
page read and write
|
||
|
1246000
|
heap
|
page read and write
|
||
|
2DCE000
|
trusted library allocation
|
page read and write
|
||
|
15DB000
|
stack
|
page read and write
|
||
|
66D0000
|
trusted library allocation
|
page read and write
|
||
|
42C0000
|
direct allocation
|
page read and write
|
||
|
163D000
|
stack
|
page read and write
|
||
|
3C10000
|
heap
|
page read and write
|
||
|
43ED000
|
direct allocation
|
page read and write
|
||
|
4243000
|
direct allocation
|
page read and write
|
||
|
669E000
|
stack
|
page read and write
|
||
|
4399000
|
direct allocation
|
page read and write
|
||
|
F7A000
|
stack
|
page read and write
|
||
|
10D0000
|
trusted library allocation
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
583E000
|
stack
|
page read and write
|
||
|
440E000
|
direct allocation
|
page read and write
|
||
|
597E000
|
stack
|
page read and write
|
||
|
2DA0000
|
trusted library allocation
|
page read and write
|
||
|
16DB000
|
heap
|
page read and write
|
||
|
11A5000
|
heap
|
page read and write
|
||
|
2550000
|
heap
|
page read and write
|
||
|
2F19000
|
trusted library allocation
|
page read and write
|
||
|
43E9000
|
direct allocation
|
page read and write
|
||
|
4270000
|
direct allocation
|
page read and write
|
||
|
4270000
|
direct allocation
|
page read and write
|
||
|
659E000
|
stack
|
page read and write
|
||
|
2DF0000
|
heap
|
page read and write
|
||
|
1390000
|
heap
|
page read and write
|
||
|
56FE000
|
stack
|
page read and write
|
||
|
6760000
|
heap
|
page read and write
|
||
|
10EA000
|
trusted library allocation
|
page execute and read and write
|
||
|
4120000
|
direct allocation
|
page read and write
|
||
|
3E69000
|
trusted library allocation
|
page read and write
|
||
|
40D0000
|
direct allocation
|
page read and write
|
||
|
16A3000
|
heap
|
page read and write
|
||
|
16B3000
|
heap
|
page read and write
|
||
|
B89000
|
stack
|
page read and write
|
||
|
6231000
|
heap
|
page read and write
|
||
|
171D000
|
heap
|
page read and write
|
||
|
16C2000
|
heap
|
page read and write
|
||
|
16C2000
|
heap
|
page read and write
|
||
|
1160000
|
trusted library allocation
|
page execute and read and write
|
||
|
440E000
|
direct allocation
|
page read and write
|
||
|
573E000
|
stack
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
2E01000
|
trusted library allocation
|
page read and write
|
||
|
66C0000
|
trusted library allocation
|
page read and write
|
||
|
1755000
|
heap
|
page read and write
|
||
|
16DB000
|
heap
|
page read and write
|
||
|
170E000
|
heap
|
page read and write
|
||
|
2DDD000
|
trusted library allocation
|
page read and write
|
||
|
439D000
|
direct allocation
|
page read and write
|
||
|
10A5000
|
heap
|
page read and write
|
||
|
43ED000
|
direct allocation
|
page read and write
|
||
|
2DC2000
|
trusted library allocation
|
page read and write
|
||
|
172A000
|
heap
|
page read and write
|
||
|
2DBE000
|
trusted library allocation
|
page read and write
|
||
|
16C5000
|
heap
|
page read and write
|
||
|
10E0000
|
trusted library allocation
|
page read and write
|
||
|
174E000
|
heap
|
page read and write
|
||
|
1370000
|
heap
|
page read and write
|
||
|
2E35000
|
trusted library allocation
|
page read and write
|
||
|
1650000
|
heap
|
page read and write
|
||
|
4399000
|
direct allocation
|
page read and write
|
||
|
1F8E000
|
stack
|
page read and write
|
||
|
2DD1000
|
trusted library allocation
|
page read and write
|
||
|
10E6000
|
trusted library allocation
|
page execute and read and write
|
||
|
16A8000
|
heap
|
page read and write
|
||
|
4243000
|
direct allocation
|
page read and write
|
||
|
7FDF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1170000
|
heap
|
page read and write
|
||
|
170A000
|
heap
|
page read and write
|
||
|
66A0000
|
trusted library allocation
|
page read and write
|
||
|
2DCA000
|
trusted library allocation
|
page read and write
|
||
|
C2F000
|
unkown
|
page read and write
|
||
|
54E0000
|
heap
|
page read and write
|
||
|
587E000
|
stack
|
page read and write
|
||
|
115E000
|
stack
|
page read and write
|
||
|
2DBB000
|
trusted library allocation
|
page read and write
|
||
|
61F2000
|
heap
|
page read and write
|
||
|
2580000
|
heap
|
page read and write
|
||
|
10FB000
|
trusted library allocation
|
page execute and read and write
|
||
|
16DB000
|
heap
|
page read and write
|
||
|
53D0000
|
heap
|
page read and write
|
||
|
54F0000
|
heap
|
page execute and read and write
|
||
|
52E0000
|
trusted library allocation
|
page read and write
|
||
|
16DC000
|
heap
|
page read and write
|
||
|
3E29000
|
trusted library allocation
|
page read and write
|
||
|
52F0000
|
trusted library allocation
|
page read and write
|
||
|
170A000
|
heap
|
page read and write
|
||
|
238E000
|
stack
|
page read and write
|
||
|
16B2000
|
heap
|
page read and write
|
||
|
10A0000
|
heap
|
page read and write
|
||
|
2DD6000
|
trusted library allocation
|
page read and write
|
||
|
1110000
|
trusted library allocation
|
page read and write
|
||
|
66A7000
|
trusted library allocation
|
page read and write
|
||
|
10C4000
|
trusted library allocation
|
page read and write
|
||
|
41F3000
|
direct allocation
|
page read and write
|
||
|
171F000
|
heap
|
page read and write
|
||
|
10C3000
|
trusted library allocation
|
page execute and read and write
|
||
|
645D000
|
stack
|
page read and write
|
||
|
10F7000
|
trusted library allocation
|
page execute and read and write
|
||
|
2EEC000
|
trusted library allocation
|
page read and write
|
||
|
16C4000
|
heap
|
page read and write
|
||
|
118E000
|
heap
|
page read and write
|
||
|
3C14000
|
heap
|
page read and write
|
||
|
BFF000
|
unkown
|
page readonly
|
||
|
10CD000
|
trusted library allocation
|
page execute and read and write
|
||
|
16B3000
|
heap
|
page read and write
|
||
|
2EDC000
|
trusted library allocation
|
page read and write
|
||
|
EF9000
|
stack
|
page read and write
|
||
|
2EF0000
|
trusted library allocation
|
page read and write
|
||
|
1056000
|
heap
|
page read and write
|
||
|
15BE000
|
stack
|
page read and write
|
||
|
534C000
|
stack
|
page read and write
|
||
|
55FC000
|
stack
|
page read and write
|
||
|
4E08000
|
trusted library allocation
|
page read and write
|
||
|
BFF000
|
unkown
|
page readonly
|
||
|
170B000
|
heap
|
page read and write
|
||
|
10F2000
|
trusted library allocation
|
page read and write
|
||
|
3E01000
|
trusted library allocation
|
page read and write
|
||
|
2EF2000
|
trusted library allocation
|
page read and write
|
||
|
170A000
|
heap
|
page read and write
|
||
|
16DB000
|
heap
|
page read and write
|
||
|
C25000
|
unkown
|
page readonly
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
4120000
|
direct allocation
|
page read and write
|
||
|
53AE000
|
stack
|
page read and write
|
||
|
2EE3000
|
trusted library allocation
|
page read and write
|
||
|
6770000
|
trusted library allocation
|
page read and write
|
||
|
66E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E76000
|
trusted library allocation
|
page read and write
|
||
|
10F0000
|
trusted library allocation
|
page read and write
|
||
|
122F000
|
heap
|
page read and write
|
||
|
41F3000
|
direct allocation
|
page read and write
|
||
|
2D80000
|
heap
|
page execute and read and write
|
||
|
2F00000
|
trusted library allocation
|
page read and write
|
||
|
4243000
|
direct allocation
|
page read and write
|
||
|
15CE000
|
stack
|
page read and write
|
||
|
40D0000
|
direct allocation
|
page read and write
|
||
|
1755000
|
heap
|
page read and write
|
||
|
C2F000
|
unkown
|
page write copy
|
||
|
66B0000
|
trusted library allocation
|
page read and write
|
||
|
445E000
|
direct allocation
|
page read and write
|
||
|
B70000
|
unkown
|
page readonly
|
||
|
40D0000
|
direct allocation
|
page read and write
|
||
|
1178000
|
heap
|
page read and write
|
||
|
2D7C000
|
stack
|
page read and write
|
||
|
445E000
|
direct allocation
|
page read and write
|
||
|
439D000
|
direct allocation
|
page read and write
|
||
|
FE0000
|
heap
|
page read and write
|
||
|
6A80000
|
heap
|
page read and write
|
||
|
2E74000
|
trusted library allocation
|
page read and write
|
||
|
2EC2000
|
trusted library allocation
|
page read and write
|
||
|
B71000
|
unkown
|
page execute read
|
||
|
B70000
|
unkown
|
page readonly
|
||
|
C38000
|
unkown
|
page readonly
|
||
|
42C0000
|
direct allocation
|
page read and write
|
||
|
4120000
|
direct allocation
|
page read and write
|
||
|
1736000
|
heap
|
page read and write
|
||
|
2D3E000
|
stack
|
page read and write
|
||
|
1680000
|
heap
|
page read and write
|
||
|
1F4E000
|
stack
|
page read and write
|
||
|
439D000
|
direct allocation
|
page read and write
|
||
|
15FC000
|
stack
|
page read and write
|
||
|
B71000
|
unkown
|
page execute read
|
||
|
C25000
|
unkown
|
page readonly
|
||
|
1010000
|
heap
|
page read and write
|
||
|
16B3000
|
heap
|
page read and write
|
||
|
170A000
|
heap
|
page read and write
|
||
|
2EC8000
|
trusted library allocation
|
page read and write
|
||
|
4270000
|
direct allocation
|
page read and write
|
||
|
16DB000
|
heap
|
page read and write
|
||
|
10DD000
|
trusted library allocation
|
page execute and read and write
|
||
|
61E0000
|
heap
|
page read and write
|
||
|
53D3000
|
heap
|
page read and write
|
||
|
2570000
|
direct allocation
|
page execute and read and write
|
||
|
3E09000
|
trusted library allocation
|
page read and write
|
||
|
10E2000
|
trusted library allocation
|
page read and write
|
||
|
2F05000
|
trusted library allocation
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
10C0000
|
trusted library allocation
|
page read and write
|
||
|
16C3000
|
heap
|
page read and write
|
||
|
16DB000
|
heap
|
page read and write
|
||
|
655E000
|
stack
|
page read and write
|
||
|
C38000
|
unkown
|
page readonly
|
||
|
16DB000
|
heap
|
page read and write
|
||
|
2D90000
|
trusted library allocation
|
page read and write
|
||
|
1050000
|
heap
|
page read and write
|
||
|
16A8000
|
heap
|
page read and write
|
||
|
170A000
|
heap
|
page read and write
|
||
|
41F3000
|
direct allocation
|
page read and write
|
There are 213 hidden memdumps, click here to show them.