Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Orden de compra.000854657689654253545676785436.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\autE17D.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\autE1BD.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\cerecloths
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\molecast
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Orden de compra.000854657689654253545676785436.exe
|
"C:\Users\user\Desktop\Orden de compra.000854657689654253545676785436.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\Orden de compra.000854657689654253545676785436.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://account.dyn.com/
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ip-api.com/line/?fields=hosting
|
208.95.112.1
|
||
|
http://ip-api.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
ip-api.com
|
208.95.112.1
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.95.112.1
|
ip-api.com
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
402000
|
system
|
page execute and read and write
|
|
|
|
1310000
|
direct allocation
|
page read and write
|
|
|
|
6547000
|
trusted library allocation
|
page read and write
|
||
|
1400000
|
heap
|
page read and write
|
||
|
52FC000
|
stack
|
page read and write
|
||
|
13EA000
|
heap
|
page read and write
|
||
|
109C000
|
unkown
|
page read and write
|
||
|
6510000
|
heap
|
page read and write
|
||
|
2DA5000
|
trusted library allocation
|
page read and write
|
||
|
3BF0000
|
direct allocation
|
page read and write
|
||
|
2B1C000
|
stack
|
page read and write
|
||
|
140C000
|
heap
|
page read and write
|
||
|
159A000
|
heap
|
page read and write
|
||
|
154F000
|
heap
|
page read and write
|
||
|
6900000
|
heap
|
page read and write
|
||
|
6560000
|
trusted library allocation
|
page read and write
|
||
|
56ED000
|
stack
|
page read and write
|
||
|
2B83000
|
heap
|
page read and write
|
||
|
10E5000
|
heap
|
page read and write
|
||
|
519A000
|
trusted library allocation
|
page read and write
|
||
|
3D90000
|
direct allocation
|
page read and write
|
||
|
6530000
|
trusted library allocation
|
page read and write
|
||
|
DFF000
|
stack
|
page read and write
|
||
|
38A4000
|
heap
|
page read and write
|
||
|
F32000
|
trusted library allocation
|
page read and write
|
||
|
7E9000
|
stack
|
page read and write
|
||
|
1125000
|
heap
|
page read and write
|
||
|
2D16000
|
trusted library allocation
|
page read and write
|
||
|
5EE8000
|
heap
|
page read and write
|
||
|
1400000
|
heap
|
page read and write
|
||
|
2CA1000
|
trusted library allocation
|
page read and write
|
||
|
2DB9000
|
trusted library allocation
|
page read and write
|
||
|
10A4000
|
unkown
|
page readonly
|
||
|
3D90000
|
direct allocation
|
page read and write
|
||
|
3EB9000
|
direct allocation
|
page read and write
|
||
|
3EB9000
|
direct allocation
|
page read and write
|
||
|
10A4000
|
unkown
|
page readonly
|
||
|
DCE000
|
stack
|
page read and write
|
||
|
11A0000
|
heap
|
page read and write
|
||
|
F47000
|
trusted library allocation
|
page execute and read and write
|
||
|
1092000
|
unkown
|
page readonly
|
||
|
1403000
|
heap
|
page read and write
|
||
|
EF0000
|
trusted library allocation
|
page read and write
|
||
|
7EF60000
|
trusted library allocation
|
page execute and read and write
|
||
|
6570000
|
trusted library allocation
|
page execute and read and write
|
||
|
1394000
|
heap
|
page read and write
|
||
|
14A9000
|
heap
|
page read and write
|
||
|
F20000
|
heap
|
page read and write
|
||
|
5192000
|
trusted library allocation
|
page read and write
|
||
|
2B40000
|
heap
|
page execute and read and write
|
||
|
F70000
|
trusted library allocation
|
page execute and read and write
|
||
|
1401000
|
heap
|
page read and write
|
||
|
F70000
|
heap
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
F00000
|
trusted library allocation
|
page read and write
|
||
|
E60000
|
heap
|
page read and write
|
||
|
FD1000
|
unkown
|
page execute read
|
||
|
3D0A000
|
trusted library allocation
|
page read and write
|
||
|
3EB9000
|
direct allocation
|
page read and write
|
||
|
140D000
|
heap
|
page read and write
|
||
|
51AD000
|
trusted library allocation
|
page read and write
|
||
|
3CA9000
|
trusted library allocation
|
page read and write
|
||
|
F26000
|
heap
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
10B3000
|
heap
|
page read and write
|
||
|
106A000
|
heap
|
page read and write
|
||
|
109C000
|
unkown
|
page write copy
|
||
|
1554000
|
heap
|
page read and write
|
||
|
1092000
|
unkown
|
page readonly
|
||
|
3D13000
|
direct allocation
|
page read and write
|
||
|
3D19000
|
direct allocation
|
page read and write
|
||
|
3EBD000
|
direct allocation
|
page read and write
|
||
|
51A1000
|
trusted library allocation
|
page read and write
|
||
|
1593000
|
heap
|
page read and write
|
||
|
F60000
|
trusted library allocation
|
page read and write
|
||
|
1563000
|
heap
|
page read and write
|
||
|
3823000
|
direct allocation
|
page read and write
|
||
|
DDB000
|
stack
|
page read and write
|
||
|
FD1000
|
unkown
|
page execute read
|
||
|
1030000
|
trusted library allocation
|
page read and write
|
||
|
2D8C000
|
trusted library allocation
|
page read and write
|
||
|
F4B000
|
trusted library allocation
|
page execute and read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
EB0000
|
heap
|
page read and write
|
||
|
F10000
|
trusted library allocation
|
page read and write
|
||
|
1394000
|
heap
|
page read and write
|
||
|
518B000
|
trusted library allocation
|
page read and write
|
||
|
1040000
|
heap
|
page read and write
|
||
|
63FE000
|
stack
|
page read and write
|
||
|
3BF0000
|
direct allocation
|
page read and write
|
||
|
3D1D000
|
direct allocation
|
page read and write
|
||
|
105E000
|
heap
|
page read and write
|
||
|
3D13000
|
direct allocation
|
page read and write
|
||
|
13EC000
|
heap
|
page read and write
|
||
|
F03000
|
trusted library allocation
|
page execute and read and write
|
||
|
1368000
|
heap
|
page read and write
|
||
|
139E000
|
heap
|
page read and write
|
||
|
13DB000
|
heap
|
page read and write
|
||
|
3F2E000
|
direct allocation
|
page read and write
|
||
|
139E000
|
heap
|
page read and write
|
||
|
2D7C000
|
trusted library allocation
|
page read and write
|
||
|
2B50000
|
trusted library allocation
|
page read and write
|
||
|
14E9000
|
heap
|
page read and write
|
||
|
6540000
|
trusted library allocation
|
page read and write
|
||
|
F80000
|
heap
|
page read and write
|
||
|
5EE0000
|
heap
|
page read and write
|
||
|
51C0000
|
heap
|
page read and write
|
||
|
140C000
|
heap
|
page read and write
|
||
|
1300000
|
direct allocation
|
page execute and read and write
|
||
|
556E000
|
stack
|
page read and write
|
||
|
1384000
|
heap
|
page read and write
|
||
|
FCE000
|
stack
|
page read and write
|
||
|
1403000
|
heap
|
page read and write
|
||
|
2B20000
|
trusted library allocation
|
page read and write
|
||
|
FBE000
|
stack
|
page read and write
|
||
|
3D8E000
|
direct allocation
|
page read and write
|
||
|
2D83000
|
trusted library allocation
|
page read and write
|
||
|
E50000
|
heap
|
page read and write
|
||
|
1048000
|
heap
|
page read and write
|
||
|
D38000
|
stack
|
page read and write
|
||
|
139B000
|
heap
|
page read and write
|
||
|
10A0000
|
unkown
|
page write copy
|
||
|
6600000
|
trusted library allocation
|
page read and write
|
||
|
13EA000
|
heap
|
page read and write
|
||
|
DBE000
|
stack
|
page read and write
|
||
|
F36000
|
trusted library allocation
|
page execute and read and write
|
||
|
F04000
|
trusted library allocation
|
page read and write
|
||
|
2D68000
|
trusted library allocation
|
page read and write
|
||
|
F0D000
|
trusted library allocation
|
page execute and read and write
|
||
|
F30000
|
trusted library allocation
|
page read and write
|
||
|
1394000
|
heap
|
page read and write
|
||
|
3D1D000
|
direct allocation
|
page read and write
|
||
|
C39000
|
stack
|
page read and write
|
||
|
FD0000
|
unkown
|
page readonly
|
||
|
1563000
|
heap
|
page read and write
|
||
|
3CA1000
|
trusted library allocation
|
page read and write
|
||
|
13AD000
|
heap
|
page read and write
|
||
|
3BF0000
|
direct allocation
|
page read and write
|
||
|
1074000
|
heap
|
page read and write
|
||
|
3700000
|
direct allocation
|
page read and write
|
||
|
12D0000
|
heap
|
page read and write
|
||
|
546E000
|
stack
|
page read and write
|
||
|
5DDE000
|
stack
|
page read and write
|
||
|
2D62000
|
trusted library allocation
|
page read and write
|
||
|
3D8E000
|
direct allocation
|
page read and write
|
||
|
5320000
|
heap
|
page execute and read and write
|
||
|
140C000
|
heap
|
page read and write
|
||
|
3823000
|
direct allocation
|
page read and write
|
||
|
38A0000
|
heap
|
page read and write
|
||
|
1010000
|
heap
|
page read and write
|
||
|
2CD5000
|
trusted library allocation
|
page read and write
|
||
|
5EEC000
|
heap
|
page read and write
|
||
|
F3A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
159A000
|
heap
|
page read and write
|
||
|
111F000
|
heap
|
page read and write
|
||
|
4CA8000
|
trusted library allocation
|
page read and write
|
||
|
2B80000
|
heap
|
page read and write
|
||
|
3D13000
|
direct allocation
|
page read and write
|
||
|
63BF000
|
stack
|
page read and write
|
||
|
3CC9000
|
trusted library allocation
|
page read and write
|
||
|
56AE000
|
stack
|
page read and write
|
||
|
140C000
|
heap
|
page read and write
|
||
|
DEF000
|
stack
|
page read and write
|
||
|
F6E000
|
stack
|
page read and write
|
||
|
2ADE000
|
stack
|
page read and write
|
||
|
2D90000
|
trusted library allocation
|
page read and write
|
||
|
140C000
|
heap
|
page read and write
|
||
|
6537000
|
trusted library allocation
|
page read and write
|
||
|
64FE000
|
stack
|
page read and write
|
||
|
3D8E000
|
direct allocation
|
page read and write
|
||
|
62BD000
|
stack
|
page read and write
|
||
|
5186000
|
trusted library allocation
|
page read and write
|
||
|
5F18000
|
heap
|
page read and write
|
||
|
106C000
|
unkown
|
page readonly
|
||
|
6520000
|
trusted library allocation
|
page execute and read and write
|
||
|
13EB000
|
heap
|
page read and write
|
||
|
1B5E000
|
stack
|
page read and write
|
||
|
1F5E000
|
stack
|
page read and write
|
||
|
139E000
|
heap
|
page read and write
|
||
|
51A6000
|
trusted library allocation
|
page read and write
|
||
|
E65000
|
heap
|
page read and write
|
||
|
542C000
|
stack
|
page read and write
|
||
|
3BF0000
|
direct allocation
|
page read and write
|
||
|
519E000
|
trusted library allocation
|
page read and write
|
||
|
10C5000
|
heap
|
page read and write
|
||
|
2D92000
|
trusted library allocation
|
page read and write
|
||
|
1360000
|
heap
|
page read and write
|
||
|
3700000
|
direct allocation
|
page read and write
|
||
|
2DB3000
|
trusted library allocation
|
page read and write
|
||
|
FD0000
|
unkown
|
page readonly
|
||
|
55AE000
|
stack
|
page read and write
|
||
|
F42000
|
trusted library allocation
|
page read and write
|
||
|
106C000
|
unkown
|
page readonly
|
||
|
1554000
|
heap
|
page read and write
|
||
|
5F00000
|
heap
|
page read and write
|
||
|
3D90000
|
direct allocation
|
page read and write
|
||
|
13ED000
|
heap
|
page read and write
|
||
|
13EA000
|
heap
|
page read and write
|
||
|
5180000
|
trusted library allocation
|
page read and write
|
||
|
4E3D000
|
stack
|
page read and write
|
||
|
13EC000
|
heap
|
page read and write
|
||
|
65F0000
|
heap
|
page read and write
|
||
|
2B90000
|
heap
|
page read and write
|
||
|
1545000
|
heap
|
page read and write
|
||
|
3F2E000
|
direct allocation
|
page read and write
|
||
|
3EBD000
|
direct allocation
|
page read and write
|
||
|
3BF0000
|
direct allocation
|
page read and write
|
||
|
140C000
|
heap
|
page read and write
|
||
|
1554000
|
heap
|
page read and write
|
||
|
13EA000
|
heap
|
page read and write
|
||
|
3EBD000
|
direct allocation
|
page read and write
|
||
|
146A000
|
heap
|
page read and write
|
||
|
6550000
|
trusted library allocation
|
page read and write
|
||
|
1569000
|
heap
|
page read and write
|
||
|
1077000
|
heap
|
page read and write
|
||
|
2DA0000
|
trusted library allocation
|
page read and write
|
||
|
3D1D000
|
direct allocation
|
page read and write
|
||
|
140C000
|
heap
|
page read and write
|
||
|
1485000
|
heap
|
page read and write
|
||
|
43E000
|
system
|
page execute and read and write
|
||
|
3D19000
|
direct allocation
|
page read and write
|
||
|
6500000
|
trusted library allocation
|
page read and write
|
||
|
3823000
|
direct allocation
|
page read and write
|
||
|
3700000
|
direct allocation
|
page read and write
|
||
|
140C000
|
heap
|
page read and write
|
||
|
51B2000
|
trusted library allocation
|
page read and write
|
||
|
1563000
|
heap
|
page read and write
|
||
|
142C000
|
heap
|
page read and write
|
||
|
3D19000
|
direct allocation
|
page read and write
|
||
|
12E0000
|
heap
|
page read and write
|
||
|
3F2E000
|
direct allocation
|
page read and write
|
||
|
F1D000
|
trusted library allocation
|
page execute and read and write
|
||
|
3BF0000
|
direct allocation
|
page read and write
|
||
|
2B30000
|
trusted library allocation
|
page read and write
|
||
|
518E000
|
trusted library allocation
|
page read and write
|
There are 226 hidden memdumps, click here to show them.