Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
roger.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\Maianthemum
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\autBE4A.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\autBE89.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\inhumation
|
ASCII text, with very long lines (28756), with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\roger.exe
|
"C:\Users\user\Desktop\roger.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\roger.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://mail.myhydropowered.com
|
unknown
|
|
|
|
https://api.ipify.org/
|
172.67.74.152
|
||
|
https://api.ipify.org
|
unknown
|
||
|
http://r10.o.lencr.org0#
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://x1.c.lencr.org/0
|
unknown
|
||
|
http://x1.i.lencr.org/0
|
unknown
|
||
|
http://r10.i.lencr.org/0
|
unknown
|
||
|
http://ip-api.com/line/?fields=hosting
|
208.95.112.1
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
mail.myhydropowered.com
|
131.226.2.60
|
|
|
|
ip-api.com
|
208.95.112.1
|
|
|
|
api.ipify.org
|
172.67.74.152
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.95.112.1
|
ip-api.com
|
United States
|
|
|
|
131.226.2.60
|
mail.myhydropowered.com
|
United States
|
|
|
|
172.67.74.152
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3D30000
|
direct allocation
|
page read and write
|
|
|
|
24EC000
|
trusted library allocation
|
page read and write
|
|
|
|
522000
|
system
|
page execute and read and write
|
|
|
|
7F420000
|
trusted library allocation
|
page execute and read and write
|
||
|
5734000
|
heap
|
page read and write
|
||
|
660A000
|
heap
|
page read and write
|
||
|
4A90000
|
heap
|
page read and write
|
||
|
6D8000
|
heap
|
page read and write
|
||
|
284C000
|
trusted library allocation
|
page read and write
|
||
|
85AF000
|
heap
|
page read and write
|
||
|
ABD000
|
stack
|
page read and write
|
||
|
8577000
|
heap
|
page read and write
|
||
|
1410000
|
heap
|
page read and write
|
||
|
2613000
|
trusted library allocation
|
page read and write
|
||
|
864000
|
trusted library allocation
|
page read and write
|
||
|
3E0000
|
unkown
|
page readonly
|
||
|
64EC000
|
stack
|
page read and write
|
||
|
6610000
|
trusted library allocation
|
page read and write
|
||
|
24D2000
|
trusted library allocation
|
page read and write
|
||
|
863000
|
trusted library allocation
|
page execute and read and write
|
||
|
5ADE000
|
stack
|
page read and write
|
||
|
6D0000
|
heap
|
page read and write
|
||
|
4A70000
|
heap
|
page read and write
|
||
|
520000
|
system
|
page execute and read and write
|
||
|
3491000
|
trusted library allocation
|
page read and write
|
||
|
1328000
|
heap
|
page read and write
|
||
|
85C4000
|
heap
|
page read and write
|
||
|
14C5000
|
heap
|
page read and write
|
||
|
4E0E000
|
stack
|
page read and write
|
||
|
12A0000
|
heap
|
page read and write
|
||
|
85ED000
|
heap
|
page read and write
|
||
|
75D000
|
heap
|
page read and write
|
||
|
5DFC000
|
stack
|
page read and write
|
||
|
45CE000
|
stack
|
page read and write
|
||
|
8510000
|
heap
|
page read and write
|
||
|
3558000
|
trusted library allocation
|
page read and write
|
||
|
29DB000
|
trusted library allocation
|
page read and write
|
||
|
403D000
|
direct allocation
|
page read and write
|
||
|
8B7000
|
heap
|
page read and write
|
||
|
580000
|
heap
|
page read and write
|
||
|
2801000
|
trusted library allocation
|
page read and write
|
||
|
29EA000
|
trusted library allocation
|
page read and write
|
||
|
495000
|
unkown
|
page readonly
|
||
|
880000
|
trusted library allocation
|
page read and write
|
||
|
8B0000
|
heap
|
page read and write
|
||
|
3E93000
|
direct allocation
|
page read and write
|
||
|
1467000
|
heap
|
page read and write
|
||
|
5FA7000
|
trusted library allocation
|
page read and write
|
||
|
34B9000
|
trusted library allocation
|
page read and write
|
||
|
3F10000
|
direct allocation
|
page read and write
|
||
|
B10000
|
heap
|
page execute and read and write
|
||
|
57D2000
|
heap
|
page read and write
|
||
|
3EE3000
|
direct allocation
|
page read and write
|
||
|
78F000
|
heap
|
page read and write
|
||
|
14C6000
|
heap
|
page read and write
|
||
|
7A8000
|
heap
|
page read and write
|
||
|
1353000
|
heap
|
page read and write
|
||
|
748000
|
heap
|
page read and write
|
||
|
4089000
|
direct allocation
|
page read and write
|
||
|
2491000
|
trusted library allocation
|
page read and write
|
||
|
A70C000
|
stack
|
page read and write
|
||
|
24DA000
|
trusted library allocation
|
page read and write
|
||
|
3E1000
|
unkown
|
page execute read
|
||
|
86D000
|
trusted library allocation
|
page execute and read and write
|
||
|
14A7000
|
heap
|
page read and write
|
||
|
34F8000
|
trusted library allocation
|
page read and write
|
||
|
2120000
|
direct allocation
|
page execute and read and write
|
||
|
24D6000
|
trusted library allocation
|
page read and write
|
||
|
5A9E000
|
stack
|
page read and write
|
||
|
4F8000
|
stack
|
page read and write
|
||
|
22E8000
|
trusted library allocation
|
page read and write
|
||
|
3E93000
|
direct allocation
|
page read and write
|
||
|
5FE0000
|
trusted library allocation
|
page read and write
|
||
|
2595000
|
trusted library allocation
|
page read and write
|
||
|
5FC0000
|
trusted library allocation
|
page read and write
|
||
|
24CE000
|
trusted library allocation
|
page read and write
|
||
|
1290000
|
heap
|
page read and write
|
||
|
3F10000
|
direct allocation
|
page read and write
|
||
|
1488000
|
heap
|
page read and write
|
||
|
5813000
|
heap
|
page read and write
|
||
|
8550000
|
heap
|
page read and write
|
||
|
13A8000
|
heap
|
page read and write
|
||
|
500C000
|
stack
|
page read and write
|
||
|
5740000
|
heap
|
page read and write
|
||
|
57E0000
|
heap
|
page read and write
|
||
|
135A000
|
heap
|
page read and write
|
||
|
8519000
|
heap
|
page read and write
|
||
|
8581000
|
heap
|
page read and write
|
||
|
6FB000
|
heap
|
page read and write
|
||
|
3D70000
|
direct allocation
|
page read and write
|
||
|
248F000
|
stack
|
page read and write
|
||
|
4DCE000
|
stack
|
page read and write
|
||
|
E3A000
|
stack
|
page read and write
|
||
|
3EE3000
|
direct allocation
|
page read and write
|
||
|
2849000
|
trusted library allocation
|
page read and write
|
||
|
496A000
|
trusted library allocation
|
page read and write
|
||
|
6600000
|
heap
|
page read and write
|
||
|
1BEE000
|
stack
|
page read and write
|
||
|
27AD000
|
trusted library allocation
|
page read and write
|
||
|
5F3E000
|
stack
|
page read and write
|
||
|
2825000
|
trusted library allocation
|
page read and write
|
||
|
5738000
|
heap
|
page read and write
|
||
|
886000
|
trusted library allocation
|
page execute and read and write
|
||
|
895000
|
trusted library allocation
|
page execute and read and write
|
||
|
40FE000
|
direct allocation
|
page read and write
|
||
|
89B000
|
trusted library allocation
|
page execute and read and write
|
||
|
255B000
|
trusted library allocation
|
page read and write
|
||
|
4089000
|
direct allocation
|
page read and write
|
||
|
135D000
|
heap
|
page read and write
|
||
|
46F000
|
unkown
|
page readonly
|
||
|
B20000
|
trusted library allocation
|
page execute and read and write
|
||
|
60C0000
|
trusted library allocation
|
page read and write
|
||
|
85E9000
|
heap
|
page read and write
|
||
|
202E000
|
stack
|
page read and write
|
||
|
138C000
|
heap
|
page read and write
|
||
|
81B000
|
stack
|
page read and write
|
||
|
1352000
|
heap
|
page read and write
|
||
|
1320000
|
heap
|
page read and write
|
||
|
3F10000
|
direct allocation
|
page read and write
|
||
|
13A8000
|
heap
|
page read and write
|
||
|
289A000
|
trusted library allocation
|
page read and write
|
||
|
408D000
|
direct allocation
|
page read and write
|
||
|
4F8C000
|
stack
|
page read and write
|
||
|
3E93000
|
direct allocation
|
page read and write
|
||
|
6080000
|
heap
|
page read and write
|
||
|
13A8000
|
heap
|
page read and write
|
||
|
A60C000
|
stack
|
page read and write
|
||
|
139C000
|
heap
|
page read and write
|
||
|
5F90000
|
trusted library allocation
|
page read and write
|
||
|
283D000
|
trusted library allocation
|
page read and write
|
||
|
137C000
|
heap
|
page read and write
|
||
|
55E000
|
system
|
page execute and read and write
|
||
|
57EC000
|
heap
|
page read and write
|
||
|
A80C000
|
stack
|
page read and write
|
||
|
5F80000
|
trusted library allocation
|
page read and write
|
||
|
403D000
|
direct allocation
|
page read and write
|
||
|
3DC0000
|
direct allocation
|
page read and write
|
||
|
57FE000
|
heap
|
page read and write
|
||
|
4A73000
|
heap
|
page read and write
|
||
|
3DC0000
|
direct allocation
|
page read and write
|
||
|
6360000
|
heap
|
page read and write
|
||
|
120F000
|
stack
|
page read and write
|
||
|
854A000
|
heap
|
page read and write
|
||
|
2150000
|
heap
|
page read and write
|
||
|
706000
|
heap
|
page read and write
|
||
|
6CC000
|
stack
|
page read and write
|
||
|
9BB000
|
stack
|
page read and write
|
||
|
131D000
|
stack
|
page read and write
|
||
|
4971000
|
trusted library allocation
|
page read and write
|
||
|
4A80000
|
heap
|
page read and write
|
||
|
13A9000
|
heap
|
page read and write
|
||
|
B0E000
|
stack
|
page read and write
|
||
|
40AE000
|
direct allocation
|
page read and write
|
||
|
5FF0000
|
trusted library allocation
|
page read and write
|
||
|
3518000
|
trusted library allocation
|
page read and write
|
||
|
4A8000
|
unkown
|
page readonly
|
||
|
139B000
|
heap
|
page read and write
|
||
|
2755000
|
trusted library allocation
|
page read and write
|
||
|
2557000
|
trusted library allocation
|
page read and write
|
||
|
4FCC000
|
stack
|
page read and write
|
||
|
4039000
|
direct allocation
|
page read and write
|
||
|
6090000
|
trusted library allocation
|
page read and write
|
||
|
408D000
|
direct allocation
|
page read and write
|
||
|
850000
|
trusted library allocation
|
page read and write
|
||
|
1C2E000
|
stack
|
page read and write
|
||
|
5FD0000
|
trusted library allocation
|
page read and write
|
||
|
2380000
|
heap
|
page read and write
|
||
|
13A8000
|
heap
|
page read and write
|
||
|
4B90000
|
heap
|
page read and write
|
||
|
137C000
|
heap
|
page read and write
|
||
|
135A000
|
heap
|
page read and write
|
||
|
14A6000
|
heap
|
page read and write
|
||
|
5BE0000
|
heap
|
page read and write
|
||
|
5D2F000
|
stack
|
page read and write
|
||
|
585000
|
heap
|
page read and write
|
||
|
5F9D000
|
trusted library allocation
|
page read and write
|
||
|
49A0000
|
trusted library allocation
|
page read and write
|
||
|
13A8000
|
heap
|
page read and write
|
||
|
14C5000
|
heap
|
page read and write
|
||
|
870000
|
trusted library allocation
|
page read and write
|
||
|
258F000
|
trusted library allocation
|
page read and write
|
||
|
46F000
|
unkown
|
page readonly
|
||
|
4940000
|
trusted library allocation
|
page read and write
|
||
|
8541000
|
heap
|
page read and write
|
||
|
3D70000
|
direct allocation
|
page read and write
|
||
|
24C1000
|
trusted library allocation
|
page read and write
|
||
|
5F7E000
|
stack
|
page read and write
|
||
|
2874000
|
trusted library allocation
|
page read and write
|
||
|
3DC0000
|
direct allocation
|
page read and write
|
||
|
B36000
|
heap
|
page read and write
|
||
|
49FC000
|
stack
|
page read and write
|
||
|
49F000
|
unkown
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
1487000
|
heap
|
page read and write
|
||
|
4039000
|
direct allocation
|
page read and write
|
||
|
5D7E000
|
stack
|
page read and write
|
||
|
87D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2841000
|
trusted library allocation
|
page read and write
|
||
|
8553000
|
heap
|
page read and write
|
||
|
5FA0000
|
trusted library allocation
|
page read and write
|
||
|
6010000
|
trusted library allocation
|
page execute and read and write
|
||
|
28E0000
|
trusted library allocation
|
page read and write
|
||
|
57E9000
|
heap
|
page read and write
|
||
|
3EE3000
|
direct allocation
|
page read and write
|
||
|
495E000
|
trusted library allocation
|
page read and write
|
||
|
5FB0000
|
trusted library allocation
|
page execute and read and write
|
||
|
3F60000
|
direct allocation
|
page read and write
|
||
|
7D0000
|
heap
|
page read and write
|
||
|
65ED000
|
stack
|
page read and write
|
||
|
4039000
|
direct allocation
|
page read and write
|
||
|
121B000
|
stack
|
page read and write
|
||
|
8524000
|
heap
|
page read and write
|
||
|
2100000
|
heap
|
page read and write
|
||
|
4CCC000
|
stack
|
page read and write
|
||
|
3E93000
|
direct allocation
|
page read and write
|
||
|
40FE000
|
direct allocation
|
page read and write
|
||
|
408D000
|
direct allocation
|
page read and write
|
||
|
4A5E000
|
stack
|
page read and write
|
||
|
251A000
|
trusted library allocation
|
page read and write
|
||
|
858D000
|
heap
|
page read and write
|
||
|
12D0000
|
heap
|
page read and write
|
||
|
599D000
|
stack
|
page read and write
|
||
|
4956000
|
trusted library allocation
|
page read and write
|
||
|
3D70000
|
direct allocation
|
page read and write
|
||
|
11FF000
|
stack
|
page read and write
|
||
|
7C5000
|
heap
|
page read and write
|
||
|
8547000
|
heap
|
page read and write
|
||
|
3F60000
|
direct allocation
|
page read and write
|
||
|
5C2E000
|
stack
|
page read and write
|
||
|
861D000
|
heap
|
page read and write
|
||
|
4089000
|
direct allocation
|
page read and write
|
||
|
24CA000
|
trusted library allocation
|
page read and write
|
||
|
40AE000
|
direct allocation
|
page read and write
|
||
|
3E0000
|
unkown
|
page readonly
|
||
|
40AE000
|
direct allocation
|
page read and write
|
||
|
852B000
|
heap
|
page read and write
|
||
|
20E4000
|
heap
|
page read and write
|
||
|
708000
|
heap
|
page read and write
|
||
|
3F10000
|
direct allocation
|
page read and write
|
||
|
4A8000
|
unkown
|
page readonly
|
||
|
855E000
|
heap
|
page read and write
|
||
|
1497000
|
heap
|
page read and write
|
||
|
49F000
|
unkown
|
page write copy
|
||
|
882000
|
trusted library allocation
|
page read and write
|
||
|
860000
|
trusted library allocation
|
page read and write
|
||
|
135D000
|
heap
|
page read and write
|
||
|
123C000
|
stack
|
page read and write
|
||
|
44CC000
|
stack
|
page read and write
|
||
|
3D70000
|
direct allocation
|
page read and write
|
||
|
13A8000
|
heap
|
page read and write
|
||
|
13A8000
|
heap
|
page read and write
|
||
|
4950000
|
trusted library allocation
|
page read and write
|
||
|
3F60000
|
direct allocation
|
page read and write
|
||
|
2686000
|
trusted library allocation
|
page read and write
|
||
|
B30000
|
heap
|
page read and write
|
||
|
135D000
|
heap
|
page read and write
|
||
|
4920000
|
heap
|
page read and write
|
||
|
7510000
|
heap
|
page read and write
|
||
|
495000
|
unkown
|
page readonly
|
||
|
5EFC000
|
stack
|
page read and write
|
||
|
6EE000
|
heap
|
page read and write
|
||
|
5B0000
|
heap
|
page read and write
|
||
|
27FF000
|
trusted library allocation
|
page read and write
|
||
|
4A3000
|
unkown
|
page write copy
|
||
|
4990000
|
trusted library allocation
|
page read and write
|
||
|
138C000
|
heap
|
page read and write
|
||
|
57F7000
|
heap
|
page read and write
|
||
|
3538000
|
trusted library allocation
|
page read and write
|
||
|
496E000
|
trusted library allocation
|
page read and write
|
||
|
20E0000
|
heap
|
page read and write
|
||
|
1499000
|
heap
|
page read and write
|
||
|
897000
|
trusted library allocation
|
page execute and read and write
|
||
|
40FE000
|
direct allocation
|
page read and write
|
||
|
13C8000
|
heap
|
page read and write
|
||
|
1E9000
|
stack
|
page read and write
|
||
|
5DBE000
|
stack
|
page read and write
|
||
|
88A000
|
trusted library allocation
|
page execute and read and write
|
||
|
14C6000
|
heap
|
page read and write
|
||
|
403D000
|
direct allocation
|
page read and write
|
||
|
495B000
|
trusted library allocation
|
page read and write
|
||
|
60D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
13A8000
|
heap
|
page read and write
|
||
|
1382000
|
heap
|
page read and write
|
||
|
7520000
|
heap
|
page read and write
|
||
|
AC0000
|
trusted library allocation
|
page read and write
|
||
|
5720000
|
heap
|
page read and write
|
||
|
4910000
|
trusted library allocation
|
page read and write
|
||
|
40AE000
|
direct allocation
|
page read and write
|
||
|
5FD6000
|
trusted library allocation
|
page read and write
|
||
|
13A8000
|
heap
|
page read and write
|
||
|
57C1000
|
heap
|
page read and write
|
||
|
5BDE000
|
stack
|
page read and write
|
||
|
4962000
|
trusted library allocation
|
page read and write
|
||
|
14B5000
|
heap
|
page read and write
|
||
|
3E1000
|
unkown
|
page execute read
|
||
|
1352000
|
heap
|
page read and write
|
||
|
4F0E000
|
stack
|
page read and write
|
||
|
4039000
|
direct allocation
|
page read and write
|
||
|
1498000
|
heap
|
page read and write
|
||
|
1343000
|
heap
|
page read and write
|
||
|
4976000
|
trusted library allocation
|
page read and write
|
||
|
892000
|
trusted library allocation
|
page read and write
|
||
|
5F88000
|
trusted library allocation
|
page read and write
|
||
|
4BC0000
|
heap
|
page execute and read and write
|
||
|
4982000
|
trusted library allocation
|
page read and write
|
||
|
403D000
|
direct allocation
|
page read and write
|
||
|
497D000
|
trusted library allocation
|
page read and write
|
There are 297 hidden memdumps, click here to show them.