Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
MUM - VESSEL'S PARTICULARS.pdf.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\Dalis
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\MUM - VESSEL'S PARTICULARS.pdf.exe
|
"C:\Users\user\Desktop\MUM - VESSEL'S PARTICULARS.pdf.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\MUM - VESSEL'S PARTICULARS.pdf.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.ipify.org/
|
104.26.13.205
|
||
|
https://api.ipify.org
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
https://api.ipify.org/t
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://beirutrest.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
beirutrest.com
|
50.87.144.157
|
|
|
|
api.ipify.org
|
104.26.13.205
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
50.87.144.157
|
beirutrest.com
|
United States
|
|
|
|
104.26.13.205
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3BE1000
|
trusted library allocation
|
page read and write
|
|
|
|
2C34000
|
trusted library allocation
|
page read and write
|
|
|
|
2C5F000
|
trusted library allocation
|
page read and write
|
|
|
|
5220000
|
trusted library section
|
page read and write
|
|
|
|
5270000
|
trusted library section
|
page read and write
|
|
|
|
293E000
|
heap
|
page read and write
|
|
|
|
521F000
|
stack
|
page read and write
|
||
|
68F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
490000
|
unkown
|
page read and write
|
||
|
285E000
|
stack
|
page read and write
|
||
|
665F000
|
stack
|
page read and write
|
||
|
3E6F000
|
heap
|
page read and write
|
||
|
2B4D000
|
trusted library allocation
|
page read and write
|
||
|
444000
|
system
|
page execute and read and write
|
||
|
2C71000
|
trusted library allocation
|
page read and write
|
||
|
27F0000
|
trusted library allocation
|
page read and write
|
||
|
2728000
|
trusted library allocation
|
page read and write
|
||
|
2BD0000
|
heap
|
page read and write
|
||
|
CF0000
|
heap
|
page read and write
|
||
|
3EF1000
|
heap
|
page read and write
|
||
|
45F3000
|
direct allocation
|
page read and write
|
||
|
2C23000
|
trusted library allocation
|
page read and write
|
||
|
942000
|
heap
|
page read and write
|
||
|
42F1000
|
heap
|
page read and write
|
||
|
52C0000
|
trusted library allocation
|
page read and write
|
||
|
8D0000
|
heap
|
page read and write
|
||
|
3DDB000
|
heap
|
page read and write
|
||
|
50A5000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
541C000
|
stack
|
page read and write
|
||
|
580D000
|
trusted library allocation
|
page read and write
|
||
|
D6B000
|
heap
|
page read and write
|
||
|
480E000
|
direct allocation
|
page read and write
|
||
|
CFA000
|
heap
|
page read and write
|
||
|
3DF2000
|
heap
|
page read and write
|
||
|
3CF0000
|
heap
|
page read and write
|
||
|
1C0000
|
heap
|
page read and write
|
||
|
15E000
|
stack
|
page read and write
|
||
|
C45000
|
heap
|
page read and write
|
||
|
4799000
|
direct allocation
|
page read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
91E000
|
heap
|
page read and write
|
||
|
2813000
|
heap
|
page read and write
|
||
|
426000
|
system
|
page execute and read and write
|
||
|
BE0000
|
trusted library section
|
page read and write
|
||
|
C92000
|
trusted library allocation
|
page read and write
|
||
|
3DC4000
|
heap
|
page read and write
|
||
|
669E000
|
stack
|
page read and write
|
||
|
EBE000
|
stack
|
page read and write
|
||
|
479D000
|
direct allocation
|
page read and write
|
||
|
3E70000
|
heap
|
page read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
5810000
|
heap
|
page read and write
|
||
|
26F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7E0000
|
heap
|
page read and write
|
||
|
941000
|
heap
|
page read and write
|
||
|
45F3000
|
direct allocation
|
page read and write
|
||
|
BD0000
|
trusted library section
|
page read and write
|
||
|
2C65000
|
trusted library allocation
|
page read and write
|
||
|
3675000
|
heap
|
page read and write
|
||
|
3F3E000
|
heap
|
page read and write
|
||
|
CB0000
|
trusted library allocation
|
page read and write
|
||
|
4799000
|
direct allocation
|
page read and write
|
||
|
6920000
|
heap
|
page read and write
|
||
|
3E5F000
|
heap
|
page read and write
|
||
|
6560000
|
trusted library allocation
|
page read and write
|
||
|
AF8000
|
stack
|
page read and write
|
||
|
2E00000
|
direct allocation
|
page read and write
|
||
|
93F000
|
heap
|
page read and write
|
||
|
490000
|
unkown
|
page write copy
|
||
|
480E000
|
direct allocation
|
page read and write
|
||
|
C8E000
|
stack
|
page read and write
|
||
|
52E0000
|
heap
|
page read and write
|
||
|
C14000
|
trusted library allocation
|
page read and write
|
||
|
480E000
|
direct allocation
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
5083000
|
heap
|
page read and write
|
||
|
4670000
|
direct allocation
|
page read and write
|
||
|
26DC000
|
stack
|
page read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
2B20000
|
trusted library allocation
|
page read and write
|
||
|
2C30000
|
trusted library allocation
|
page read and write
|
||
|
44D0000
|
direct allocation
|
page read and write
|
||
|
C20000
|
trusted library allocation
|
page read and write
|
||
|
2B32000
|
trusted library allocation
|
page read and write
|
||
|
91A000
|
heap
|
page read and write
|
||
|
3CA2000
|
trusted library allocation
|
page read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
6150000
|
trusted library allocation
|
page execute and read and write
|
||
|
1A0000
|
heap
|
page read and write
|
||
|
4670000
|
direct allocation
|
page read and write
|
||
|
2B41000
|
trusted library allocation
|
page read and write
|
||
|
1A5000
|
heap
|
page read and write
|
||
|
4CDE000
|
stack
|
page read and write
|
||
|
2B52000
|
trusted library allocation
|
page read and write
|
||
|
5020000
|
heap
|
page read and write
|
||
|
563E000
|
stack
|
page read and write
|
||
|
C07000
|
heap
|
page read and write
|
||
|
479D000
|
direct allocation
|
page read and write
|
||
|
480E000
|
direct allocation
|
page read and write
|
||
|
11DF000
|
stack
|
page read and write
|
||
|
2B46000
|
trusted library allocation
|
page read and write
|
||
|
3E65000
|
heap
|
page read and write
|
||
|
2DC7000
|
heap
|
page read and write
|
||
|
2800000
|
heap
|
page execute and read and write
|
||
|
6568000
|
trusted library allocation
|
page read and write
|
||
|
6B4E000
|
stack
|
page read and write
|
||
|
3E6E000
|
heap
|
page read and write
|
||
|
66B0000
|
trusted library allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
62DD000
|
stack
|
page read and write
|
||
|
CFD000
|
heap
|
page read and write
|
||
|
366E000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
65CD000
|
stack
|
page read and write
|
||
|
C97000
|
trusted library allocation
|
page execute and read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
4799000
|
direct allocation
|
page read and write
|
||
|
651E000
|
stack
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
6570000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F25000
|
heap
|
page read and write
|
||
|
3E60000
|
heap
|
page execute and read and write
|
||
|
4799000
|
direct allocation
|
page read and write
|
||
|
44D0000
|
direct allocation
|
page read and write
|
||
|
6554000
|
trusted library allocation
|
page read and write
|
||
|
CC8000
|
heap
|
page read and write
|
||
|
2B2B000
|
trusted library allocation
|
page read and write
|
||
|
551C000
|
stack
|
page read and write
|
||
|
479D000
|
direct allocation
|
page read and write
|
||
|
44D0000
|
direct allocation
|
page read and write
|
||
|
C3A000
|
trusted library allocation
|
page execute and read and write
|
||
|
3E5E000
|
heap
|
page read and write
|
||
|
68E0000
|
trusted library allocation
|
page read and write
|
||
|
2C1A000
|
trusted library allocation
|
page read and write
|
||
|
502E000
|
heap
|
page read and write
|
||
|
94D000
|
heap
|
page read and write
|
||
|
4799000
|
direct allocation
|
page read and write
|
||
|
66A0000
|
trusted library allocation
|
page read and write
|
||
|
6BC0000
|
heap
|
page read and write
|
||
|
C10000
|
trusted library allocation
|
page read and write
|
||
|
70A000
|
stack
|
page read and write
|
||
|
3BEF000
|
stack
|
page read and write
|
||
|
44D0000
|
direct allocation
|
page read and write
|
||
|
D33000
|
heap
|
page read and write
|
||
|
3EF1000
|
heap
|
page read and write
|
||
|
4799000
|
direct allocation
|
page read and write
|
||
|
7EF00000
|
trusted library allocation
|
page execute and read and write
|
||
|
7BE000
|
stack
|
page read and write
|
||
|
63DF000
|
stack
|
page read and write
|
||
|
2810000
|
heap
|
page read and write
|
||
|
3F3E000
|
heap
|
page read and write
|
||
|
27C0000
|
heap
|
page execute and read and write
|
||
|
2B2E000
|
trusted library allocation
|
page read and write
|
||
|
2700000
|
trusted library allocation
|
page read and write
|
||
|
2B3E000
|
trusted library allocation
|
page read and write
|
||
|
26E0000
|
heap
|
page read and write
|
||
|
3DC2000
|
heap
|
page read and write
|
||
|
44D0000
|
direct allocation
|
page read and write
|
||
|
685E000
|
stack
|
page read and write
|
||
|
2E9E000
|
stack
|
page read and write
|
||
|
6CCE000
|
stack
|
page read and write
|
||
|
D2D000
|
heap
|
page read and write
|
||
|
27E0000
|
trusted library allocation
|
page read and write
|
||
|
1F4000
|
heap
|
page read and write
|
||
|
45F3000
|
direct allocation
|
page read and write
|
||
|
C2D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2710000
|
heap
|
page read and write
|
||
|
8B4000
|
stack
|
page read and write
|
||
|
2B26000
|
trusted library allocation
|
page read and write
|
||
|
C95000
|
trusted library allocation
|
page execute and read and write
|
||
|
15DE000
|
stack
|
page read and write
|
||
|
C23000
|
trusted library allocation
|
page read and write
|
||
|
4670000
|
direct allocation
|
page read and write
|
||
|
45F3000
|
direct allocation
|
page read and write
|
||
|
5101000
|
heap
|
page read and write
|
||
|
4A7000
|
unkown
|
page read and write
|
||
|
910000
|
heap
|
page read and write
|
||
|
8AF000
|
stack
|
page read and write
|
||
|
641E000
|
stack
|
page read and write
|
||
|
2C5D000
|
trusted library allocation
|
page read and write
|
||
|
5800000
|
trusted library allocation
|
page read and write
|
||
|
45F3000
|
direct allocation
|
page read and write
|
||
|
2B1E000
|
stack
|
page read and write
|
||
|
19E000
|
stack
|
page read and write
|
||
|
4670000
|
direct allocation
|
page read and write
|
||
|
480E000
|
direct allocation
|
page read and write
|
||
|
C9B000
|
trusted library allocation
|
page execute and read and write
|
||
|
3CDD000
|
trusted library allocation
|
page read and write
|
||
|
6550000
|
trusted library allocation
|
page read and write
|
||
|
94D000
|
heap
|
page read and write
|
||
|
3E61000
|
heap
|
page read and write
|
||
|
479D000
|
direct allocation
|
page read and write
|
||
|
2C5B000
|
trusted library allocation
|
page read and write
|
||
|
2DBE000
|
stack
|
page read and write
|
||
|
3D9B000
|
heap
|
page read and write
|
||
|
7C0000
|
heap
|
page read and write
|
||
|
2BA0000
|
trusted library allocation
|
page read and write
|
||
|
480E000
|
direct allocation
|
page read and write
|
||
|
C00000
|
heap
|
page read and write
|
||
|
C1D000
|
trusted library allocation
|
page execute and read and write
|
||
|
3E46000
|
heap
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
C32000
|
trusted library allocation
|
page read and write
|
||
|
89F000
|
stack
|
page read and write
|
||
|
C36000
|
trusted library allocation
|
page execute and read and write
|
||
|
479D000
|
direct allocation
|
page read and write
|
||
|
1E0000
|
heap
|
page read and write
|
||
|
3BF0000
|
heap
|
page read and write
|
||
|
BF0000
|
trusted library allocation
|
page read and write
|
||
|
44D0000
|
direct allocation
|
page read and write
|
||
|
45F3000
|
direct allocation
|
page read and write
|
||
|
2DF0000
|
heap
|
page read and write
|
||
|
770000
|
heap
|
page read and write
|
||
|
110000
|
heap
|
page read and write
|
||
|
5028000
|
heap
|
page read and write
|
||
|
5022000
|
heap
|
page read and write
|
||
|
2F20000
|
heap
|
page read and write
|
||
|
2BE1000
|
trusted library allocation
|
page read and write
|
||
|
3EF0000
|
heap
|
page read and write
|
||
|
43B8000
|
heap
|
page read and write
|
||
|
479D000
|
direct allocation
|
page read and write
|
||
|
2B9E000
|
stack
|
page read and write
|
||
|
C40000
|
heap
|
page read and write
|
||
|
289E000
|
stack
|
page read and write
|
||
|
5030000
|
heap
|
page read and write
|
||
|
4670000
|
direct allocation
|
page read and write
|
||
|
2B3A000
|
trusted library allocation
|
page read and write
|
||
|
4670000
|
direct allocation
|
page read and write
|
||
|
269E000
|
stack
|
page read and write
|
||
|
100000
|
heap
|
page read and write
|
||
|
6580000
|
trusted library allocation
|
page read and write
|
||
|
D1C000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
505E000
|
heap
|
page read and write
|
||
|
66A7000
|
trusted library allocation
|
page read and write
|
||
|
C30000
|
trusted library allocation
|
page read and write
|
||
|
5040000
|
heap
|
page read and write
|
||
|
C13000
|
trusted library allocation
|
page execute and read and write
|
There are 229 hidden memdumps, click here to show them.