Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
pagamento.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\aut9FCD.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\autA00D.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\soliloquised
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\unbarricadoed
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\pagamento.exe
|
"C:\Users\user\Desktop\pagamento.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\pagamento.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://reallyfreegeoip.org
|
unknown
|
||
|
http://checkip.dyndns.org
|
unknown
|
||
|
http://checkip.dyndns.org/
|
193.122.6.168
|
||
|
http://checkip.dyndns.com
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/8.46.123.33
|
188.114.97.3
|
||
|
https://reallyfreegeoip.org/xml/8.46.123.33$
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/8.46.123.33(
|
unknown
|
||
|
http://checkip.dyndns.org/q
|
unknown
|
||
|
http://reallyfreegeoip.org
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/
|
unknown
|
There are 1 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
reallyfreegeoip.org
|
188.114.97.3
|
|
|
|
checkip.dyndns.org
|
unknown
|
|
|
|
checkip.dyndns.com
|
193.122.6.168
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
188.114.97.3
|
reallyfreegeoip.org
|
European Union
|
|
|
|
193.122.6.168
|
checkip.dyndns.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2F1C000
|
trusted library allocation
|
page read and write
|
|
|
|
2300000
|
direct allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
2D51000
|
trusted library allocation
|
page read and write
|
|
|
|
2EA6000
|
trusted library allocation
|
page read and write
|
||
|
6950000
|
heap
|
page read and write
|
||
|
EF7000
|
stack
|
page read and write
|
||
|
FE9000
|
heap
|
page read and write
|
||
|
1190000
|
trusted library allocation
|
page read and write
|
||
|
51CE000
|
stack
|
page read and write
|
||
|
68A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
51D0000
|
trusted library allocation
|
page read and write
|
||
|
11BD000
|
trusted library allocation
|
page execute and read and write
|
||
|
BA0000
|
unkown
|
page readonly
|
||
|
2FA4000
|
trusted library allocation
|
page read and write
|
||
|
687E000
|
stack
|
page read and write
|
||
|
5670000
|
trusted library allocation
|
page read and write
|
||
|
4163000
|
direct allocation
|
page read and write
|
||
|
16A4000
|
heap
|
page read and write
|
||
|
3CF0000
|
heap
|
page read and write
|
||
|
C62000
|
unkown
|
page readonly
|
||
|
6400000
|
heap
|
page read and write
|
||
|
18BF000
|
heap
|
page read and write
|
||
|
11B0000
|
trusted library allocation
|
page read and write
|
||
|
41E0000
|
direct allocation
|
page read and write
|
||
|
41E0000
|
direct allocation
|
page read and write
|
||
|
2F9F000
|
trusted library allocation
|
page read and write
|
||
|
BA1000
|
unkown
|
page execute read
|
||
|
1796000
|
heap
|
page read and write
|
||
|
6920000
|
trusted library allocation
|
page read and write
|
||
|
4163000
|
direct allocation
|
page read and write
|
||
|
2F8C000
|
trusted library allocation
|
page read and write
|
||
|
F8A000
|
heap
|
page read and write
|
||
|
2E9E000
|
trusted library allocation
|
page read and write
|
||
|
13A0000
|
heap
|
page read and write
|
||
|
2F00000
|
trusted library allocation
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
41E0000
|
direct allocation
|
page read and write
|
||
|
2EA2000
|
trusted library allocation
|
page read and write
|
||
|
62FE000
|
stack
|
page read and write
|
||
|
4309000
|
direct allocation
|
page read and write
|
||
|
142F000
|
stack
|
page read and write
|
||
|
2DFA000
|
trusted library allocation
|
page read and write
|
||
|
3DB9000
|
trusted library allocation
|
page read and write
|
||
|
BA1000
|
unkown
|
page execute read
|
||
|
4040000
|
direct allocation
|
page read and write
|
||
|
4309000
|
direct allocation
|
page read and write
|
||
|
51FD000
|
trusted library allocation
|
page read and write
|
||
|
11D2000
|
trusted library allocation
|
page read and write
|
||
|
11D7000
|
trusted library allocation
|
page execute and read and write
|
||
|
13FF000
|
stack
|
page read and write
|
||
|
2E46000
|
trusted library allocation
|
page read and write
|
||
|
5210000
|
heap
|
page read and write
|
||
|
2E17000
|
trusted library allocation
|
page read and write
|
||
|
63FE000
|
stack
|
page read and write
|
||
|
2E08000
|
trusted library allocation
|
page read and write
|
||
|
4163000
|
direct allocation
|
page read and write
|
||
|
2ED3000
|
trusted library allocation
|
page read and write
|
||
|
11A4000
|
trusted library allocation
|
page read and write
|
||
|
2E14000
|
trusted library allocation
|
page read and write
|
||
|
41E0000
|
direct allocation
|
page read and write
|
||
|
F96000
|
heap
|
page read and write
|
||
|
187F000
|
heap
|
page read and write
|
||
|
11D0000
|
trusted library allocation
|
page read and write
|
||
|
2E9A000
|
trusted library allocation
|
page read and write
|
||
|
2E56000
|
trusted library allocation
|
page read and write
|
||
|
2DF7000
|
trusted library allocation
|
page read and write
|
||
|
4040000
|
direct allocation
|
page read and write
|
||
|
653D000
|
stack
|
page read and write
|
||
|
16E6000
|
heap
|
page read and write
|
||
|
1696000
|
heap
|
page read and write
|
||
|
15E0000
|
heap
|
page read and write
|
||
|
1550000
|
heap
|
page read and write
|
||
|
2E2F000
|
trusted library allocation
|
page read and write
|
||
|
11CA000
|
trusted library allocation
|
page execute and read and write
|
||
|
11AD000
|
trusted library allocation
|
page execute and read and write
|
||
|
17DB000
|
heap
|
page read and write
|
||
|
16A4000
|
heap
|
page read and write
|
||
|
3DDD000
|
trusted library allocation
|
page read and write
|
||
|
430D000
|
direct allocation
|
page read and write
|
||
|
4309000
|
direct allocation
|
page read and write
|
||
|
1787000
|
heap
|
page read and write
|
||
|
437E000
|
direct allocation
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
2EE0000
|
trusted library allocation
|
page read and write
|
||
|
188E000
|
heap
|
page read and write
|
||
|
159E000
|
stack
|
page read and write
|
||
|
C3C000
|
unkown
|
page readonly
|
||
|
2FD2000
|
trusted library allocation
|
page read and write
|
||
|
2F86000
|
trusted library allocation
|
page read and write
|
||
|
430D000
|
direct allocation
|
page read and write
|
||
|
5202000
|
trusted library allocation
|
page read and write
|
||
|
51F6000
|
trusted library allocation
|
page read and write
|
||
|
4040000
|
direct allocation
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
51EE000
|
trusted library allocation
|
page read and write
|
||
|
F60000
|
heap
|
page read and write
|
||
|
53AD000
|
stack
|
page read and write
|
||
|
66BF000
|
stack
|
page read and write
|
||
|
16D5000
|
heap
|
page read and write
|
||
|
18C0000
|
heap
|
page read and write
|
||
|
430D000
|
direct allocation
|
page read and write
|
||
|
4309000
|
direct allocation
|
page read and write
|
||
|
6880000
|
trusted library allocation
|
page read and write
|
||
|
F68000
|
heap
|
page read and write
|
||
|
2380000
|
heap
|
page read and write
|
||
|
437E000
|
direct allocation
|
page read and write
|
||
|
11F0000
|
trusted library allocation
|
page read and write
|
||
|
13D0000
|
heap
|
page execute and read and write
|
||
|
1650000
|
heap
|
page read and write
|
||
|
688A000
|
trusted library allocation
|
page read and write
|
||
|
68B0000
|
trusted library allocation
|
page read and write
|
||
|
1779000
|
heap
|
page read and write
|
||
|
68C0000
|
trusted library allocation
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
F30000
|
heap
|
page read and write
|
||
|
3D51000
|
trusted library allocation
|
page read and write
|
||
|
2F96000
|
trusted library allocation
|
page read and write
|
||
|
139D000
|
stack
|
page read and write
|
||
|
6457000
|
heap
|
page read and write
|
||
|
169E000
|
heap
|
page read and write
|
||
|
2EC5000
|
trusted library allocation
|
page read and write
|
||
|
1075000
|
heap
|
page read and write
|
||
|
2E0B000
|
trusted library allocation
|
page read and write
|
||
|
56A0000
|
heap
|
page execute and read and write
|
||
|
1890000
|
heap
|
page read and write
|
||
|
2DFF000
|
trusted library allocation
|
page read and write
|
||
|
16B3000
|
heap
|
page read and write
|
||
|
2E52000
|
trusted library allocation
|
page read and write
|
||
|
437E000
|
direct allocation
|
page read and write
|
||
|
4040000
|
direct allocation
|
page read and write
|
||
|
51F1000
|
trusted library allocation
|
page read and write
|
||
|
140E000
|
stack
|
page read and write
|
||
|
2F81000
|
trusted library allocation
|
page read and write
|
||
|
2FCC000
|
trusted library allocation
|
page read and write
|
||
|
118E000
|
stack
|
page read and write
|
||
|
430D000
|
direct allocation
|
page read and write
|
||
|
58B0000
|
trusted library allocation
|
page read and write
|
||
|
16E5000
|
heap
|
page read and write
|
||
|
677E000
|
stack
|
page read and write
|
||
|
17D0000
|
heap
|
page read and write
|
||
|
6890000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E44000
|
trusted library allocation
|
page read and write
|
||
|
103A000
|
stack
|
page read and write
|
||
|
C70000
|
unkown
|
page write copy
|
||
|
2EB7000
|
trusted library allocation
|
page read and write
|
||
|
657E000
|
stack
|
page read and write
|
||
|
1817000
|
heap
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
41E0000
|
direct allocation
|
page read and write
|
||
|
2E5A000
|
trusted library allocation
|
page read and write
|
||
|
2D30000
|
trusted library allocation
|
page read and write
|
||
|
1668000
|
heap
|
page read and write
|
||
|
5340000
|
trusted library allocation
|
page read and write
|
||
|
3CF4000
|
heap
|
page read and write
|
||
|
17AB000
|
heap
|
page read and write
|
||
|
11DB000
|
trusted library allocation
|
page execute and read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
66FE000
|
stack
|
page read and write
|
||
|
2FD4000
|
trusted library allocation
|
page read and write
|
||
|
2FDE000
|
trusted library allocation
|
page read and write
|
||
|
430D000
|
direct allocation
|
page read and write
|
||
|
2E4E000
|
trusted library allocation
|
page read and write
|
||
|
1660000
|
heap
|
page read and write
|
||
|
5213000
|
heap
|
page read and write
|
||
|
51DE000
|
trusted library allocation
|
page read and write
|
||
|
C3C000
|
unkown
|
page readonly
|
||
|
69A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
51DB000
|
trusted library allocation
|
page read and write
|
||
|
C74000
|
unkown
|
page readonly
|
||
|
1687000
|
heap
|
page read and write
|
||
|
58B8000
|
trusted library allocation
|
page read and write
|
||
|
2FD8000
|
trusted library allocation
|
page read and write
|
||
|
C6C000
|
unkown
|
page write copy
|
||
|
531E000
|
stack
|
page read and write
|
||
|
104D000
|
heap
|
page read and write
|
||
|
2C8E000
|
stack
|
page read and write
|
||
|
180B000
|
heap
|
page read and write
|
||
|
4040000
|
direct allocation
|
page read and write
|
||
|
58B6000
|
trusted library allocation
|
page read and write
|
||
|
16A4000
|
heap
|
page read and write
|
||
|
4E4E000
|
stack
|
page read and write
|
||
|
3017000
|
trusted library allocation
|
page read and write
|
||
|
11D5000
|
trusted library allocation
|
page execute and read and write
|
||
|
51D6000
|
trusted library allocation
|
page read and write
|
||
|
15DE000
|
stack
|
page read and write
|
||
|
3DD4000
|
trusted library allocation
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
135E000
|
stack
|
page read and write
|
||
|
41E0000
|
direct allocation
|
page read and write
|
||
|
4163000
|
direct allocation
|
page read and write
|
||
|
17EF000
|
heap
|
page read and write
|
||
|
2E8E000
|
trusted library allocation
|
page read and write
|
||
|
11C6000
|
trusted library allocation
|
page execute and read and write
|
||
|
5680000
|
trusted library allocation
|
page execute and read and write
|
||
|
131E000
|
stack
|
page read and write
|
||
|
11A3000
|
trusted library allocation
|
page execute and read and write
|
||
|
58C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
225E000
|
stack
|
page read and write
|
||
|
C6C000
|
unkown
|
page read and write
|
||
|
1200000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E92000
|
trusted library allocation
|
page read and write
|
||
|
437E000
|
direct allocation
|
page read and write
|
||
|
C74000
|
unkown
|
page readonly
|
||
|
11C2000
|
trusted library allocation
|
page read and write
|
||
|
688F000
|
trusted library allocation
|
page read and write
|
||
|
5470000
|
heap
|
page read and write
|
||
|
1070000
|
heap
|
page read and write
|
||
|
BBA000
|
stack
|
page read and write
|
||
|
170C000
|
heap
|
page read and write
|
||
|
566F000
|
stack
|
page read and write
|
||
|
5690000
|
trusted library allocation
|
page read and write
|
||
|
13E0000
|
heap
|
page read and write
|
||
|
169E000
|
heap
|
page read and write
|
||
|
5320000
|
trusted library allocation
|
page read and write
|
||
|
2EFC000
|
trusted library allocation
|
page read and write
|
||
|
3D79000
|
trusted library allocation
|
page read and write
|
||
|
18CF000
|
heap
|
page read and write
|
||
|
65BE000
|
stack
|
page read and write
|
||
|
13C0000
|
trusted library allocation
|
page read and write
|
||
|
1831000
|
heap
|
page read and write
|
||
|
673E000
|
stack
|
page read and write
|
||
|
1697000
|
heap
|
page read and write
|
||
|
6883000
|
trusted library allocation
|
page read and write
|
||
|
58BB000
|
trusted library allocation
|
page read and write
|
||
|
1210000
|
heap
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
F20000
|
heap
|
page read and write
|
||
|
11A0000
|
trusted library allocation
|
page read and write
|
||
|
2E02000
|
trusted library allocation
|
page read and write
|
||
|
11C0000
|
trusted library allocation
|
page read and write
|
||
|
16F4000
|
heap
|
page read and write
|
||
|
51EA000
|
trusted library allocation
|
page read and write
|
||
|
22F0000
|
direct allocation
|
page execute and read and write
|
||
|
1895000
|
heap
|
page read and write
|
||
|
187F000
|
heap
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
4309000
|
direct allocation
|
page read and write
|
||
|
170B000
|
heap
|
page read and write
|
||
|
2EAA000
|
trusted library allocation
|
page read and write
|
||
|
BA0000
|
unkown
|
page readonly
|
||
|
188E000
|
heap
|
page read and write
|
||
|
430D000
|
direct allocation
|
page read and write
|
||
|
437E000
|
direct allocation
|
page read and write
|
||
|
6DA0000
|
heap
|
page read and write
|
||
|
4163000
|
direct allocation
|
page read and write
|
||
|
3DE9000
|
trusted library allocation
|
page read and write
|
||
|
1470000
|
heap
|
page read and write
|
||
|
143F000
|
stack
|
page read and write
|
||
|
4163000
|
direct allocation
|
page read and write
|
||
|
18C2000
|
heap
|
page read and write
|
||
|
6464000
|
heap
|
page read and write
|
||
|
4309000
|
direct allocation
|
page read and write
|
||
|
18CF000
|
heap
|
page read and write
|
||
|
16B9000
|
heap
|
page read and write
|
||
|
1E5D000
|
stack
|
page read and write
|
||
|
16F4000
|
heap
|
page read and write
|
||
|
141B000
|
stack
|
page read and write
|
||
|
C62000
|
unkown
|
page readonly
|
||
|
569E000
|
trusted library allocation
|
page read and write
|
||
|
18C2000
|
heap
|
page read and write
|
||
|
437E000
|
direct allocation
|
page read and write
|
||
|
2FA9000
|
trusted library allocation
|
page read and write
|
||
|
1696000
|
heap
|
page read and write
|
||
|
4040000
|
direct allocation
|
page read and write
|
||
|
2D40000
|
heap
|
page read and write
|
||
|
2E96000
|
trusted library allocation
|
page read and write
|
There are 260 hidden memdumps, click here to show them.