Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
arrival notice.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\acrorrheuma
|
ASCII text, with very long lines (28756), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut8EEC.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut8F4B.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\selectee
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\arrival notice.exe
|
"C:\Users\user\Desktop\arrival notice.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\arrival notice.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.ipify.org/
|
172.67.74.152
|
||
|
http://mail.mahesh-ent.com
|
unknown
|
||
|
https://api.ipify.org
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
https://api.ipify.org/t
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
mail.mahesh-ent.com
|
148.66.136.151
|
|
|
|
api.ipify.org
|
172.67.74.152
|
||
|
171.39.242.20.in-addr.arpa
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
148.66.136.151
|
mail.mahesh-ent.com
|
Singapore
|
|
|
|
172.67.74.152
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
B10000
|
direct allocation
|
page read and write
|
|
|
|
2E71000
|
trusted library allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
3E21000
|
trusted library allocation
|
page read and write
|
||
|
7F40000
|
heap
|
page read and write
|
||
|
630C000
|
heap
|
page read and write
|
||
|
2C2D000
|
trusted library allocation
|
page execute and read and write
|
||
|
3174000
|
trusted library allocation
|
page read and write
|
||
|
32A6000
|
trusted library allocation
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
60A0000
|
heap
|
page read and write
|
||
|
54A0000
|
heap
|
page execute and read and write
|
||
|
7D68000
|
heap
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
13B3000
|
heap
|
page read and write
|
||
|
5361000
|
trusted library allocation
|
page read and write
|
||
|
1416000
|
heap
|
page read and write
|
||
|
7F770000
|
trusted library allocation
|
page execute and read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
3EAA000
|
trusted library allocation
|
page read and write
|
||
|
2C30000
|
trusted library allocation
|
page read and write
|
||
|
2EFA000
|
trusted library allocation
|
page read and write
|
||
|
7D65000
|
heap
|
page read and write
|
||
|
3F8A000
|
trusted library allocation
|
page read and write
|
||
|
9D0000
|
unkown
|
page readonly
|
||
|
11BF000
|
stack
|
page read and write
|
||
|
544E000
|
stack
|
page read and write
|
||
|
3038000
|
trusted library allocation
|
page read and write
|
||
|
7020000
|
heap
|
page read and write
|
||
|
A85000
|
unkown
|
page readonly
|
||
|
78E000
|
stack
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
1533000
|
heap
|
page read and write
|
||
|
133B000
|
stack
|
page read and write
|
||
|
1416000
|
heap
|
page read and write
|
||
|
1106000
|
heap
|
page read and write
|
||
|
534E000
|
trusted library allocation
|
page read and write
|
||
|
9D1000
|
unkown
|
page execute read
|
||
|
2DBE000
|
stack
|
page read and write
|
||
|
155F000
|
heap
|
page read and write
|
||
|
3202000
|
trusted library allocation
|
page read and write
|
||
|
10D0000
|
heap
|
page read and write
|
||
|
69D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7CEF000
|
heap
|
page read and write
|
||
|
1552000
|
heap
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
68D6000
|
trusted library allocation
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
E3A000
|
stack
|
page read and write
|
||
|
1416000
|
heap
|
page read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
624D000
|
heap
|
page read and write
|
||
|
149C000
|
heap
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
2C3D000
|
trusted library allocation
|
page execute and read and write
|
||
|
11B0000
|
heap
|
page read and write
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
534B000
|
trusted library allocation
|
page read and write
|
||
|
13EE000
|
heap
|
page read and write
|
||
|
3FAA000
|
trusted library allocation
|
page read and write
|
||
|
68D0000
|
trusted library allocation
|
page read and write
|
||
|
6887000
|
trusted library allocation
|
page read and write
|
||
|
621D000
|
stack
|
page read and write
|
||
|
1416000
|
heap
|
page read and write
|
||
|
1552000
|
heap
|
page read and write
|
||
|
2C42000
|
trusted library allocation
|
page read and write
|
||
|
12CC000
|
stack
|
page read and write
|
||
|
5380000
|
trusted library allocation
|
page read and write
|
||
|
303A000
|
trusted library allocation
|
page read and write
|
||
|
1416000
|
heap
|
page read and write
|
||
|
2E5F000
|
trusted library allocation
|
page read and write
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
408A000
|
trusted library allocation
|
page read and write
|
||
|
40CA000
|
trusted library allocation
|
page read and write
|
||
|
6870000
|
trusted library allocation
|
page read and write
|
||
|
2DF0000
|
heap
|
page read and write
|
||
|
11AC000
|
heap
|
page read and write
|
||
|
11C6000
|
heap
|
page read and write
|
||
|
13EF000
|
heap
|
page read and write
|
||
|
2C4A000
|
trusted library allocation
|
page execute and read and write
|
||
|
40AA000
|
trusted library allocation
|
page read and write
|
||
|
10BC000
|
stack
|
page read and write
|
||
|
6BCE000
|
stack
|
page read and write
|
||
|
7D43000
|
heap
|
page read and write
|
||
|
10EE000
|
heap
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
630F000
|
heap
|
page read and write
|
||
|
40EA000
|
trusted library allocation
|
page read and write
|
||
|
3F6A000
|
trusted library allocation
|
page read and write
|
||
|
54B0000
|
heap
|
page read and write
|
||
|
13FE000
|
heap
|
page read and write
|
||
|
2C23000
|
trusted library allocation
|
page execute and read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
5FFB000
|
stack
|
page read and write
|
||
|
6304000
|
heap
|
page read and write
|
||
|
1436000
|
heap
|
page read and write
|
||
|
2C5B000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F20000
|
trusted library allocation
|
page read and write
|
||
|
13BA000
|
heap
|
page read and write
|
||
|
53EC000
|
stack
|
page read and write
|
||
|
687D000
|
trusted library allocation
|
page read and write
|
||
|
2DF4000
|
heap
|
page read and write
|
||
|
7B2C000
|
stack
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
6318000
|
heap
|
page read and write
|
||
|
7B30000
|
heap
|
page read and write
|
||
|
649D000
|
stack
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
2C24000
|
trusted library allocation
|
page read and write
|
||
|
6010000
|
trusted library allocation
|
page read and write
|
||
|
3F2A000
|
trusted library allocation
|
page read and write
|
||
|
61DE000
|
stack
|
page read and write
|
||
|
13FE000
|
heap
|
page read and write
|
||
|
A98000
|
unkown
|
page readonly
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
2DD0000
|
heap
|
page execute and read and write
|
||
|
1416000
|
heap
|
page read and write
|
||
|
6B8C000
|
stack
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
2E10000
|
heap
|
page read and write
|
||
|
A93000
|
unkown
|
page write copy
|
||
|
3012000
|
trusted library allocation
|
page read and write
|
||
|
7C5E000
|
heap
|
page read and write
|
||
|
2C57000
|
trusted library allocation
|
page execute and read and write
|
||
|
12D0000
|
heap
|
page read and write
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
3344000
|
trusted library allocation
|
page read and write
|
||
|
66DE000
|
stack
|
page read and write
|
||
|
13BD000
|
heap
|
page read and write
|
||
|
60DA000
|
heap
|
page read and write
|
||
|
5FA0000
|
trusted library allocation
|
page read and write
|
||
|
6D80000
|
trusted library allocation
|
page execute and read and write
|
||
|
60D0000
|
heap
|
page read and write
|
||
|
605C000
|
stack
|
page read and write
|
||
|
7C3E000
|
heap
|
page read and write
|
||
|
659E000
|
stack
|
page read and write
|
||
|
6700000
|
heap
|
page read and write
|
||
|
1417000
|
heap
|
page read and write
|
||
|
331C000
|
trusted library allocation
|
page read and write
|
||
|
2E56000
|
trusted library allocation
|
page read and write
|
||
|
712F000
|
stack
|
page read and write
|
||
|
13B2000
|
heap
|
page read and write
|
||
|
950000
|
heap
|
page read and write
|
||
|
2C55000
|
trusted library allocation
|
page execute and read and write
|
||
|
68F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
12F6000
|
heap
|
page read and write
|
||
|
2C20000
|
trusted library allocation
|
page read and write
|
||
|
1F7E000
|
stack
|
page read and write
|
||
|
A98000
|
unkown
|
page readonly
|
||
|
62D5000
|
heap
|
page read and write
|
||
|
7C42000
|
heap
|
page read and write
|
||
|
13B2000
|
heap
|
page read and write
|
||
|
1416000
|
heap
|
page read and write
|
||
|
2DE0000
|
trusted library allocation
|
page read and write
|
||
|
1491000
|
heap
|
page read and write
|
||
|
2F1E000
|
trusted library allocation
|
page read and write
|
||
|
7D4D000
|
heap
|
page read and write
|
||
|
6710000
|
trusted library allocation
|
page read and write
|
||
|
675E000
|
stack
|
page read and write
|
||
|
6249000
|
heap
|
page read and write
|
||
|
10D8000
|
heap
|
page read and write
|
||
|
1388000
|
heap
|
page read and write
|
||
|
338D000
|
trusted library allocation
|
page read and write
|
||
|
5366000
|
trusted library allocation
|
page read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
1473000
|
heap
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
2C70000
|
trusted library allocation
|
page read and write
|
||
|
3F0A000
|
trusted library allocation
|
page read and write
|
||
|
9D1000
|
unkown
|
page execute read
|
||
|
6D4E000
|
stack
|
page read and write
|
||
|
6C0E000
|
stack
|
page read and write
|
||
|
57AE000
|
stack
|
page read and write
|
||
|
400A000
|
trusted library allocation
|
page read and write
|
||
|
FA5000
|
heap
|
page read and write
|
||
|
A5F000
|
unkown
|
page readonly
|
||
|
1380000
|
heap
|
page read and write
|
||
|
5390000
|
trusted library allocation
|
page read and write
|
||
|
1347000
|
heap
|
page read and write
|
||
|
56AC000
|
stack
|
page read and write
|
||
|
3E89000
|
trusted library allocation
|
page read and write
|
||
|
7CB9000
|
heap
|
page read and write
|
||
|
6880000
|
trusted library allocation
|
page read and write
|
||
|
1562000
|
heap
|
page read and write
|
||
|
1533000
|
heap
|
page read and write
|
||
|
1416000
|
heap
|
page read and write
|
||
|
406A000
|
trusted library allocation
|
page read and write
|
||
|
3149000
|
trusted library allocation
|
page read and write
|
||
|
536D000
|
trusted library allocation
|
page read and write
|
||
|
2FE8000
|
trusted library allocation
|
page read and write
|
||
|
13E5000
|
heap
|
page read and write
|
||
|
5F9C000
|
stack
|
page read and write
|
||
|
548E000
|
stack
|
page read and write
|
||
|
A5F000
|
unkown
|
page readonly
|
||
|
12F0000
|
heap
|
page read and write
|
||
|
2C40000
|
trusted library allocation
|
page read and write
|
||
|
3F4A000
|
trusted library allocation
|
page read and write
|
||
|
3ECA000
|
trusted library allocation
|
page read and write
|
||
|
535E000
|
trusted library allocation
|
page read and write
|
||
|
1340000
|
heap
|
page read and write
|
||
|
BC4000
|
heap
|
page read and write
|
||
|
F39000
|
stack
|
page read and write
|
||
|
150A000
|
heap
|
page read and write
|
||
|
2C46000
|
trusted library allocation
|
page execute and read and write
|
||
|
5352000
|
trusted library allocation
|
page read and write
|
||
|
11CF000
|
stack
|
page read and write
|
||
|
43E000
|
system
|
page execute and read and write
|
||
|
3340000
|
trusted library allocation
|
page read and write
|
||
|
414A000
|
trusted library allocation
|
page read and write
|
||
|
7CE1000
|
heap
|
page read and write
|
||
|
A85000
|
unkown
|
page readonly
|
||
|
69E0000
|
trusted library allocation
|
page read and write
|
||
|
1400000
|
heap
|
page read and write
|
||
|
74E000
|
stack
|
page read and write
|
||
|
7CDD000
|
heap
|
page read and write
|
||
|
3FEA000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
144D000
|
stack
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
1416000
|
heap
|
page read and write
|
||
|
6D0D000
|
stack
|
page read and write
|
||
|
3EEA000
|
trusted library allocation
|
page read and write
|
||
|
412A000
|
trusted library allocation
|
page read and write
|
||
|
F90000
|
heap
|
page read and write
|
||
|
698E000
|
stack
|
page read and write
|
||
|
62F4000
|
heap
|
page read and write
|
||
|
2E21000
|
trusted library allocation
|
page read and write
|
||
|
14D4000
|
heap
|
page read and write
|
||
|
BC0000
|
heap
|
page read and write
|
||
|
13A3000
|
heap
|
page read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
62E7000
|
heap
|
page read and write
|
||
|
2CBE000
|
stack
|
page read and write
|
||
|
A8F000
|
unkown
|
page write copy
|
||
|
6719000
|
trusted library allocation
|
page read and write
|
||
|
7D59000
|
heap
|
page read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
990000
|
direct allocation
|
page execute and read and write
|
||
|
790000
|
heap
|
page read and write
|
||
|
6309000
|
heap
|
page read and write
|
||
|
69CC000
|
stack
|
page read and write
|
||
|
7D25000
|
heap
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
307F000
|
trusted library allocation
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
1552000
|
heap
|
page read and write
|
||
|
A8F000
|
unkown
|
page read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
402A000
|
trusted library allocation
|
page read and write
|
||
|
1B7D000
|
stack
|
page read and write
|
||
|
65DE000
|
stack
|
page read and write
|
||
|
2C50000
|
trusted library allocation
|
page read and write
|
||
|
9D0000
|
unkown
|
page readonly
|
||
|
685F000
|
stack
|
page read and write
|
||
|
68CD000
|
stack
|
page read and write
|
||
|
6000000
|
trusted library allocation
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
970000
|
heap
|
page read and write
|
||
|
2F22000
|
trusted library allocation
|
page read and write
|
||
|
319A000
|
trusted library allocation
|
page read and write
|
||
|
404A000
|
trusted library allocation
|
page read and write
|
||
|
6D90000
|
heap
|
page read and write
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
3198000
|
trusted library allocation
|
page read and write
|
||
|
32F0000
|
trusted library allocation
|
page read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
4E28000
|
trusted library allocation
|
page read and write
|
||
|
3342000
|
trusted library allocation
|
page read and write
|
||
|
11FC000
|
stack
|
page read and write
|
||
|
62DD000
|
heap
|
page read and write
|
||
|
6D70000
|
trusted library allocation
|
page read and write
|
||
|
68E0000
|
trusted library allocation
|
page read and write
|
||
|
13BD000
|
heap
|
page read and write
|
||
|
331A000
|
trusted library allocation
|
page read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
2DC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
13BD000
|
heap
|
page read and write
|
||
|
3346000
|
trusted library allocation
|
page read and write
|
||
|
2E6D000
|
trusted library allocation
|
page read and write
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
7C30000
|
heap
|
page read and write
|
||
|
2C10000
|
trusted library allocation
|
page read and write
|
||
|
700000
|
heap
|
page read and write
|
||
|
1400000
|
heap
|
page read and write
|
||
|
870000
|
heap
|
page read and write
|
||
|
1416000
|
heap
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
69A000
|
stack
|
page read and write
|
||
|
F80000
|
heap
|
page read and write
|
||
|
1542000
|
heap
|
page read and write
|
||
|
4EFC000
|
stack
|
page read and write
|
||
|
4FFD000
|
stack
|
page read and write
|
||
|
5340000
|
trusted library allocation
|
page read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
58EC000
|
stack
|
page read and write
|
||
|
11DB000
|
stack
|
page read and write
|
||
|
119B000
|
heap
|
page read and write
|
||
|
2E00000
|
trusted library allocation
|
page read and write
|
||
|
3E49000
|
trusted library allocation
|
page read and write
|
||
|
2C52000
|
trusted library allocation
|
page read and write
|
||
|
1108000
|
heap
|
page read and write
|
||
|
1165000
|
heap
|
page read and write
|
||
|
3FCA000
|
trusted library allocation
|
page read and write
|
||
|
410A000
|
trusted library allocation
|
page read and write
|
||
|
6220000
|
heap
|
page read and write
|
||
|
2F2F000
|
trusted library allocation
|
page read and write
|
||
|
7F30000
|
heap
|
page read and write
|
||
|
58AE000
|
stack
|
page read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
There are 303 hidden memdumps, click here to show them.