Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
whiteee.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\autB66F.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\autB6BE.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\eupolyzoan
|
ASCII text, with very long lines (28680), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\horrify
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\whiteee.exe
|
"C:\Users\user\Desktop\whiteee.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\whiteee.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://reallyfreegeoip.org
|
unknown
|
||
|
http://checkip.dyndns.org
|
unknown
|
||
|
http://checkip.dyndns.org/
|
158.101.44.242
|
||
|
http://checkip.dyndns.com
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/8.46.123.33
|
188.114.96.3
|
||
|
https://reallyfreegeoip.org/xml/8.46.123.33$
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://checkip.dyndns.org/q
|
unknown
|
||
|
http://reallyfreegeoip.org
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
reallyfreegeoip.org
|
188.114.96.3
|
|
|
|
checkip.dyndns.org
|
unknown
|
|
|
|
checkip.dyndns.com
|
158.101.44.242
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
188.114.96.3
|
reallyfreegeoip.org
|
European Union
|
|
|
|
158.101.44.242
|
checkip.dyndns.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2DC1000
|
trusted library allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
14B0000
|
direct allocation
|
page read and write
|
|
|
|
2F8C000
|
trusted library allocation
|
page read and write
|
|
|
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
128B000
|
trusted library allocation
|
page execute and read and write
|
||
|
D0E000
|
stack
|
page read and write
|
||
|
13FE000
|
stack
|
page read and write
|
||
|
3EDE000
|
direct allocation
|
page read and write
|
||
|
6900000
|
heap
|
page read and write
|
||
|
3E6D000
|
direct allocation
|
page read and write
|
||
|
1536000
|
heap
|
page read and write
|
||
|
BFE000
|
stack
|
page read and write
|
||
|
3042000
|
trusted library allocation
|
page read and write
|
||
|
3EDE000
|
direct allocation
|
page read and write
|
||
|
3E69000
|
direct allocation
|
page read and write
|
||
|
3E69000
|
direct allocation
|
page read and write
|
||
|
3DC1000
|
trusted library allocation
|
page read and write
|
||
|
3D40000
|
direct allocation
|
page read and write
|
||
|
623E000
|
stack
|
page read and write
|
||
|
101A000
|
heap
|
page read and write
|
||
|
300C000
|
trusted library allocation
|
page read and write
|
||
|
1541000
|
heap
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
1541000
|
heap
|
page read and write
|
||
|
2E79000
|
trusted library allocation
|
page read and write
|
||
|
1541000
|
heap
|
page read and write
|
||
|
2F6C000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
15D0000
|
heap
|
page read and write
|
||
|
633E000
|
stack
|
page read and write
|
||
|
64BE000
|
stack
|
page read and write
|
||
|
1253000
|
trusted library allocation
|
page execute and read and write
|
||
|
6870000
|
trusted library allocation
|
page read and write
|
||
|
3EDE000
|
direct allocation
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
13FE000
|
stack
|
page read and write
|
||
|
526D000
|
trusted library allocation
|
page read and write
|
||
|
1535000
|
heap
|
page read and write
|
||
|
1272000
|
trusted library allocation
|
page read and write
|
||
|
15B0000
|
heap
|
page read and write
|
||
|
15A0000
|
heap
|
page read and write
|
||
|
5400000
|
trusted library allocation
|
page execute and read and write
|
||
|
5266000
|
trusted library allocation
|
page read and write
|
||
|
3CC3000
|
direct allocation
|
page read and write
|
||
|
15B0000
|
heap
|
page read and write
|
||
|
20EF000
|
stack
|
page read and write
|
||
|
3CC3000
|
direct allocation
|
page read and write
|
||
|
1CEE000
|
stack
|
page read and write
|
||
|
1593000
|
heap
|
page read and write
|
||
|
3E6D000
|
direct allocation
|
page read and write
|
||
|
2F13000
|
trusted library allocation
|
page read and write
|
||
|
1593000
|
heap
|
page read and write
|
||
|
3E69000
|
direct allocation
|
page read and write
|
||
|
2E6D000
|
trusted library allocation
|
page read and write
|
||
|
15F0000
|
heap
|
page read and write
|
||
|
3CC3000
|
direct allocation
|
page read and write
|
||
|
1593000
|
heap
|
page read and write
|
||
|
6800000
|
trusted library allocation
|
page read and write
|
||
|
2E70000
|
trusted library allocation
|
page read and write
|
||
|
15E0000
|
heap
|
page read and write
|
||
|
663E000
|
stack
|
page read and write
|
||
|
FF4000
|
unkown
|
page readonly
|
||
|
3CC3000
|
direct allocation
|
page read and write
|
||
|
67BF000
|
stack
|
page read and write
|
||
|
3E44000
|
trusted library allocation
|
page read and write
|
||
|
FBC000
|
unkown
|
page readonly
|
||
|
2EC7000
|
trusted library allocation
|
page read and write
|
||
|
2EA0000
|
trusted library allocation
|
page read and write
|
||
|
10AB000
|
heap
|
page read and write
|
||
|
6340000
|
heap
|
page read and write
|
||
|
1541000
|
heap
|
page read and write
|
||
|
1200000
|
heap
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
5636000
|
trusted library allocation
|
page read and write
|
||
|
14A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
5240000
|
trusted library allocation
|
page read and write
|
||
|
F21000
|
unkown
|
page execute read
|
||
|
151B000
|
heap
|
page read and write
|
||
|
66BE000
|
stack
|
page read and write
|
||
|
B70000
|
heap
|
page read and write
|
||
|
3E69000
|
direct allocation
|
page read and write
|
||
|
1276000
|
trusted library allocation
|
page execute and read and write
|
||
|
FE2000
|
unkown
|
page readonly
|
||
|
3D40000
|
direct allocation
|
page read and write
|
||
|
15BC000
|
heap
|
page read and write
|
||
|
FE2000
|
unkown
|
page readonly
|
||
|
1526000
|
heap
|
page read and write
|
||
|
15D0000
|
heap
|
page read and write
|
||
|
52ED000
|
stack
|
page read and write
|
||
|
B0A000
|
stack
|
page read and write
|
||
|
EF7000
|
stack
|
page read and write
|
||
|
3D40000
|
direct allocation
|
page read and write
|
||
|
127A000
|
trusted library allocation
|
page execute and read and write
|
||
|
5410000
|
heap
|
page read and write
|
||
|
524E000
|
trusted library allocation
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
1514000
|
heap
|
page read and write
|
||
|
BBE000
|
stack
|
page read and write
|
||
|
2EBF000
|
trusted library allocation
|
page read and write
|
||
|
588F000
|
stack
|
page read and write
|
||
|
5413000
|
heap
|
page read and write
|
||
|
1541000
|
heap
|
page read and write
|
||
|
3CC3000
|
direct allocation
|
page read and write
|
||
|
15E0000
|
heap
|
page read and write
|
||
|
5261000
|
trusted library allocation
|
page read and write
|
||
|
14B0000
|
heap
|
page execute and read and write
|
||
|
304A000
|
trusted library allocation
|
page read and write
|
||
|
3048000
|
trusted library allocation
|
page read and write
|
||
|
53FE000
|
stack
|
page read and write
|
||
|
2E88000
|
trusted library allocation
|
page read and write
|
||
|
3055000
|
trusted library allocation
|
page read and write
|
||
|
1537000
|
heap
|
page read and write
|
||
|
1537000
|
heap
|
page read and write
|
||
|
1027000
|
heap
|
page read and write
|
||
|
D50000
|
heap
|
page read and write
|
||
|
2E7C000
|
trusted library allocation
|
page read and write
|
||
|
3DE9000
|
trusted library allocation
|
page read and write
|
||
|
3EDE000
|
direct allocation
|
page read and write
|
||
|
F20000
|
unkown
|
page readonly
|
||
|
1526000
|
heap
|
page read and write
|
||
|
15B1000
|
heap
|
page read and write
|
||
|
2FFC000
|
trusted library allocation
|
page read and write
|
||
|
126D000
|
trusted library allocation
|
page execute and read and write
|
||
|
15E0000
|
heap
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
1280000
|
trusted library allocation
|
page read and write
|
||
|
1541000
|
heap
|
page read and write
|
||
|
3E6D000
|
direct allocation
|
page read and write
|
||
|
2F1B000
|
trusted library allocation
|
page read and write
|
||
|
64FE000
|
stack
|
page read and write
|
||
|
3CC3000
|
direct allocation
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
15B1000
|
heap
|
page read and write
|
||
|
3D40000
|
direct allocation
|
page read and write
|
||
|
14D0000
|
trusted library allocation
|
page read and write
|
||
|
5246000
|
trusted library allocation
|
page read and write
|
||
|
F21000
|
unkown
|
page execute read
|
||
|
563B000
|
trusted library allocation
|
page read and write
|
||
|
561F000
|
stack
|
page read and write
|
||
|
FE5000
|
heap
|
page read and write
|
||
|
2F50000
|
trusted library allocation
|
page read and write
|
||
|
67DA000
|
trusted library allocation
|
page read and write
|
||
|
3BA0000
|
direct allocation
|
page read and write
|
||
|
67F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1254000
|
trusted library allocation
|
page read and write
|
||
|
141F000
|
stack
|
page read and write
|
||
|
68C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1535000
|
heap
|
page read and write
|
||
|
15A0000
|
heap
|
page read and write
|
||
|
562E000
|
trusted library allocation
|
page read and write
|
||
|
2F0F000
|
trusted library allocation
|
page read and write
|
||
|
667E000
|
stack
|
page read and write
|
||
|
14F0000
|
heap
|
page read and write
|
||
|
5640000
|
heap
|
page execute and read and write
|
||
|
14C0000
|
trusted library allocation
|
page read and write
|
||
|
5620000
|
trusted library allocation
|
page read and write
|
||
|
304F000
|
trusted library allocation
|
page read and write
|
||
|
909000
|
stack
|
page read and write
|
||
|
2F17000
|
trusted library allocation
|
page read and write
|
||
|
11EE000
|
stack
|
page read and write
|
||
|
525A000
|
trusted library allocation
|
page read and write
|
||
|
2F03000
|
trusted library allocation
|
page read and write
|
||
|
3E5A000
|
trusted library allocation
|
page read and write
|
||
|
67D3000
|
trusted library allocation
|
page read and write
|
||
|
1270000
|
trusted library allocation
|
page read and write
|
||
|
FF8000
|
heap
|
page read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
2F0B000
|
trusted library allocation
|
page read and write
|
||
|
67DF000
|
trusted library allocation
|
page read and write
|
||
|
14F0000
|
heap
|
page read and write
|
||
|
5280000
|
trusted library allocation
|
page read and write
|
||
|
980000
|
heap
|
page read and write
|
||
|
2F07000
|
trusted library allocation
|
page read and write
|
||
|
FE0000
|
heap
|
page read and write
|
||
|
FEC000
|
unkown
|
page read and write
|
||
|
15E0000
|
heap
|
page read and write
|
||
|
5630000
|
trusted library allocation
|
page read and write
|
||
|
67D0000
|
trusted library allocation
|
page read and write
|
||
|
2EFF000
|
trusted library allocation
|
page read and write
|
||
|
1541000
|
heap
|
page read and write
|
||
|
647D000
|
stack
|
page read and write
|
||
|
12B0000
|
heap
|
page read and write
|
||
|
2F70000
|
trusted library allocation
|
page read and write
|
||
|
3E6D000
|
direct allocation
|
page read and write
|
||
|
2F43000
|
trusted library allocation
|
page read and write
|
||
|
2EC3000
|
trusted library allocation
|
page read and write
|
||
|
FD0000
|
heap
|
page read and write
|
||
|
9FD000
|
stack
|
page read and write
|
||
|
1285000
|
trusted library allocation
|
page execute and read and write
|
||
|
3EDE000
|
direct allocation
|
page read and write
|
||
|
1525000
|
heap
|
page read and write
|
||
|
1541000
|
heap
|
page read and write
|
||
|
2ECB000
|
trusted library allocation
|
page read and write
|
||
|
3850000
|
heap
|
page read and write
|
||
|
3E69000
|
direct allocation
|
page read and write
|
||
|
3EDE000
|
direct allocation
|
page read and write
|
||
|
142F000
|
stack
|
page read and write
|
||
|
301F000
|
trusted library allocation
|
page read and write
|
||
|
301A000
|
trusted library allocation
|
page read and write
|
||
|
3E69000
|
direct allocation
|
page read and write
|
||
|
65FE000
|
stack
|
page read and write
|
||
|
5420000
|
heap
|
page read and write
|
||
|
FEC000
|
unkown
|
page write copy
|
||
|
1593000
|
heap
|
page read and write
|
||
|
5310000
|
trusted library allocation
|
page read and write
|
||
|
3E4E000
|
trusted library allocation
|
page read and write
|
||
|
1260000
|
trusted library allocation
|
page read and write
|
||
|
4DFD000
|
stack
|
page read and write
|
||
|
1287000
|
trusted library allocation
|
page execute and read and write
|
||
|
6810000
|
trusted library allocation
|
page read and write
|
||
|
125D000
|
trusted library allocation
|
page execute and read and write
|
||
|
13BF000
|
stack
|
page read and write
|
||
|
FF0000
|
unkown
|
page write copy
|
||
|
12A0000
|
trusted library allocation
|
page read and write
|
||
|
1510000
|
heap
|
page read and write
|
||
|
2DBF000
|
stack
|
page read and write
|
||
|
2EB5000
|
trusted library allocation
|
page read and write
|
||
|
525E000
|
trusted library allocation
|
page read and write
|
||
|
4EFE000
|
stack
|
page read and write
|
||
|
3D40000
|
direct allocation
|
page read and write
|
||
|
3E6D000
|
direct allocation
|
page read and write
|
||
|
1523000
|
heap
|
page read and write
|
||
|
3E6D000
|
direct allocation
|
page read and write
|
||
|
FF4000
|
unkown
|
page readonly
|
||
|
13EE000
|
stack
|
page read and write
|
||
|
14F8000
|
heap
|
page read and write
|
||
|
1240000
|
trusted library allocation
|
page read and write
|
||
|
1535000
|
heap
|
page read and write
|
||
|
151B000
|
heap
|
page read and write
|
||
|
3D40000
|
direct allocation
|
page read and write
|
||
|
67E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F28000
|
trusted library allocation
|
page read and write
|
||
|
14E0000
|
trusted library allocation
|
page read and write
|
||
|
1593000
|
heap
|
page read and write
|
||
|
1545000
|
heap
|
page read and write
|
||
|
1282000
|
trusted library allocation
|
page read and write
|
||
|
2F7F000
|
trusted library allocation
|
page read and write
|
||
|
524B000
|
trusted library allocation
|
page read and write
|
||
|
2E68000
|
trusted library allocation
|
page read and write
|
||
|
2FF7000
|
trusted library allocation
|
page read and write
|
||
|
68A0000
|
heap
|
page read and write
|
||
|
1541000
|
heap
|
page read and write
|
||
|
3E29000
|
trusted library allocation
|
page read and write
|
||
|
1593000
|
heap
|
page read and write
|
||
|
F20000
|
unkown
|
page readonly
|
||
|
2E86000
|
trusted library allocation
|
page read and write
|
||
|
3016000
|
trusted library allocation
|
page read and write
|
||
|
D70000
|
direct allocation
|
page execute and read and write
|
||
|
2E75000
|
trusted library allocation
|
page read and write
|
||
|
970000
|
heap
|
page read and write
|
||
|
5638000
|
trusted library allocation
|
page read and write
|
||
|
FBC000
|
unkown
|
page readonly
|
||
|
3854000
|
heap
|
page read and write
|
||
|
15D0000
|
heap
|
page read and write
|
||
|
1250000
|
trusted library allocation
|
page read and write
|
||
|
10DC000
|
heap
|
page read and write
|
||
|
67C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
140B000
|
stack
|
page read and write
|
||
|
5272000
|
trusted library allocation
|
page read and write
|
There are 250 hidden memdumps, click here to show them.