Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
baretail.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
Chrome Cache Entry: 45
|
GIF image data, version 89a, 38 x 41
|
dropped
|
||
Chrome Cache Entry: 46
|
GIF image data, version 89a, 38 x 41
|
downloaded
|
||
Chrome Cache Entry: 47
|
GIF image data, version 89a, 38 x 41
|
dropped
|
||
Chrome Cache Entry: 48
|
HTML document, ASCII text, with CRLF, LF line terminators
|
downloaded
|
||
Chrome Cache Entry: 49
|
MS Windows icon resource - 1 icon, 16x16, 16 colors
|
downloaded
|
||
Chrome Cache Entry: 50
|
MS Windows icon resource - 1 icon, 16x16, 16 colors
|
dropped
|
||
Chrome Cache Entry: 51
|
GIF image data, version 89a, 139 x 33
|
downloaded
|
||
Chrome Cache Entry: 52
|
GIF image data, version 89a, 38 x 41
|
dropped
|
||
Chrome Cache Entry: 53
|
ASCII text, with CRLF line terminators
|
downloaded
|
||
Chrome Cache Entry: 54
|
GIF image data, version 89a, 38 x 41
|
downloaded
|
||
Chrome Cache Entry: 55
|
GIF image data, version 89a, 38 x 41
|
dropped
|
||
Chrome Cache Entry: 56
|
GIF image data, version 89a, 38 x 41
|
downloaded
|
||
Chrome Cache Entry: 57
|
GIF image data, version 89a, 38 x 41
|
downloaded
|
||
Chrome Cache Entry: 58
|
GIF image data, version 89a, 139 x 33
|
dropped
|
||
Chrome Cache Entry: 59
|
GIF image data, version 89a, 150 x 50
|
dropped
|
||
Chrome Cache Entry: 60
|
GIF image data, version 89a, 150 x 50
|
downloaded
|
||
Chrome Cache Entry: 61
|
ASCII text, with no line terminators
|
downloaded
|
There are 8 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\baretail.exe
|
"C:\Users\user\Desktop\baretail.exe"
|
||
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.baremetalsoft.com/register/?app=BareTail&ver=3.50a&build=2006-11-02
|
||
C:\Program Files\Google\Chrome\Application\chrome.exe
|
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US
--service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2116,i,5249147098069161101,3948763448879149394,262144
--disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction
/prefetch:8
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://www.baremetalsoft.com/?app=BareTail&ver=3.50a&build=2006-11-02CE
|
unknown
|
||
https://www.baremetalsoft.com/favicon.ico
|
68.178.230.213
|
||
http://www.baremetalsoft.com/baretail/index.php
|
unknown
|
||
https://www.baremetalsoft.com/baremetalsoftcom.gif
|
68.178.230.213
|
||
https://www.baremetalsoft.com/stats.php?request_uri=%2Fregister%2F%3Fapp%3DBareTail%26ver%3D3.50a%26
|
unknown
|
||
https://www.baremetalsoft.com/style.css
|
68.178.230.213
|
||
http://www.baremetalsoft.com/baregrep/index.php
|
unknown
|
||
http://www.baremetalsoft.com/baretail/faq.php?app=
|
unknown
|
||
https://www.baremetalsoft.com/baregreppro/BareGrepPro2.gif
|
68.178.230.213
|
||
http://www.baremetalsoft.com/index.php
|
unknown
|
||
http://www.baremetalsoft.com/?app=
|
unknown
|
||
http://www.baremetalsoft.com/baregreppro/index.php
|
unknown
|
||
http://www.baremetalsoft.com/baretailpro/index.php
|
unknown
|
||
http://www.worldpay.com
|
unknown
|
||
http://www.baremetalsoft.com/
|
unknown
|
||
http://www.baremetalsoft.com/baretail/licence.php?app=BareTail&ver=3.50a&date=2006-11-02
|
unknown
|
||
https://www.baremetalsoft.com/register/?app=BareTail&ver=3.50a&build=2006-11-02
|
|||
http://www.baremetalsoft.com/U
|
unknown
|
||
https://secure.worldpay.com/global3/payment/default/help_security_en.html
|
unknown
|
||
https://www.baremetalsoft.com/register/?app=BareTail&ver=3.50a&build=2006-11-02h
|
unknown
|
||
http://purl.oen
|
unknown
|
||
https://www.baremetalsoft.com/baretail/BareTail2.gif
|
68.178.230.213
|
||
http://www.baremetalsoft.com/baretail/licence.php?app=BareTail&ver=3.50a&date=2006-11-02erm
|
unknown
|
||
http://www.baremetalsoft.com/?app=BareTail&ver=3.50a&build=2006-11-02
|
unknown
|
||
https://secure.worldpay.com/global3/payment/default/help_faqs_en.html
|
unknown
|
||
https://www.baremetalsoft.com/baregrep/BareGrep2.gif
|
68.178.230.213
|
||
http://www.baremetalsoft.com/baretail/licence.php
|
unknown
|
||
https://www.worldpay.com/cgenerator/cgenerator.php?instId=101882
|
unknown
|
||
https://www.baremetalsoft.com/register/poweredByWorldPay.gif
|
68.178.230.213
|
||
https://www.baremetalsoft.com/register/?app=
|
unknown
|
||
http://www.baremetalsoft.com/news/index.php
|
unknown
|
||
http://www.baremetalsoft.com/baretail/index.php?app=
|
unknown
|
||
http://www.baremetalsoft.com/contact/index.php
|
unknown
|
||
https://secure.worldpay.com/global3/payment/default/help_en.html
|
unknown
|
||
https://www.baremetalsoft.com/baretailpro/BareTailPro2.gif
|
68.178.230.213
|
||
https://www.baremetalsoft.com/stats.php?request_uri=%2Fregister%2F%3Fapp%3DBareTail%26ver%3D3.50a%26build%3D2006-11-02&http_referer=
|
68.178.230.213
|
||
https://www.baremetalsoft.com/register/?app=BareTail&ver=3.50a&build=2006-11-02I
|
unknown
|
||
http://www.baremetalsoft.com/baretail/usage.php?app=
|
unknown
|
||
https://www.baremetalsoft.com/
|
unknown
|
There are 29 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
baremetalsoft.com
|
68.178.230.213
|
||
www.google.com
|
172.217.23.100
|
||
www.worldpay.com
|
unknown
|
||
www.baremetalsoft.com
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
239.255.255.250
|
unknown
|
Reserved
|
||
172.217.23.100
|
www.google.com
|
United States
|
||
192.168.2.7
|
unknown
|
unknown
|
||
68.178.230.213
|
baremetalsoft.com
|
United States
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
|
MRUListEx
|
||
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2
|
1
|
||
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1
|
NodeSlot
|
||
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1
|
MRUListEx
|
||
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell
|
SniffedFolderType
|
||
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\1e\417C44EB
|
@C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-101
|
||
HKEY_CURRENT_USER_Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe%5Cmicrosoft.system.package.metadata%5CS-1-5-21-2246122658-3693405117-2476756634-1003-MergedResources-0.pri\1d9f5d7d5f3fe76\50e7d6fd
|
@{microsoft.windows.photos_2019.19071.12548.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.windows.photos/files/assets/photoslogoextensions.png}
|
||
HKEY_CURRENT_USER_Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe%5Cmicrosoft.system.package.metadata%5CS-1-5-21-2246122658-3693405117-2476756634-1003-MergedResources-0.pri\1d9f5d7d6155f79\50e7d6fd
|
@{microsoft.zunemusic_10.19071.19011.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/files/assets/fileextension.png}
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
|
{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
|
||
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
|
MRUListEx
|
||
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2
|
MRUListEx
|
||
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
|
NodeSlots
|
There are 2 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
6C64000
|
heap
|
page read and write
|
||
6C00000
|
heap
|
page read and write
|
||
8E0E000
|
stack
|
page read and write
|
||
55C0000
|
heap
|
page read and write
|
||
55CF000
|
heap
|
page read and write
|
||
6BD9000
|
heap
|
page read and write
|
||
3ADE000
|
stack
|
page read and write
|
||
6C0B000
|
heap
|
page read and write
|
||
6BD8000
|
heap
|
page read and write
|
||
2CFF000
|
stack
|
page read and write
|
||
6BD9000
|
heap
|
page read and write
|
||
5624000
|
heap
|
page read and write
|
||
55CB000
|
heap
|
page read and write
|
||
6D1D000
|
heap
|
page read and write
|
||
6BDD000
|
heap
|
page read and write
|
||
6CCE000
|
heap
|
page read and write
|
||
6C06000
|
heap
|
page read and write
|
||
2BFE000
|
stack
|
page read and write
|
||
6D16000
|
heap
|
page read and write
|
||
64E000
|
heap
|
page read and write
|
||
6C30000
|
heap
|
page read and write
|
||
6BE3000
|
heap
|
page read and write
|
||
22F0000
|
heap
|
page read and write
|
||
2500000
|
heap
|
page read and write
|
||
6C0D000
|
heap
|
page read and write
|
||
6CA5000
|
heap
|
page read and write
|
||
69AD000
|
heap
|
page read and write
|
||
6BE9000
|
heap
|
page read and write
|
||
2329000
|
heap
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
6BE9000
|
heap
|
page read and write
|
||
561B000
|
heap
|
page read and write
|
||
6BF2000
|
heap
|
page read and write
|
||
6C0D000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
24B0000
|
heap
|
page read and write
|
||
6D86000
|
heap
|
page read and write
|
||
6A5000
|
heap
|
page read and write
|
||
891E000
|
stack
|
page read and write
|
||
560B000
|
heap
|
page read and write
|
||
561B000
|
heap
|
page read and write
|
||
69CD000
|
heap
|
page read and write
|
||
6B30000
|
heap
|
page read and write
|
||
6BE9000
|
heap
|
page read and write
|
||
71C000
|
heap
|
page read and write
|
||
8B1E000
|
stack
|
page read and write
|
||
6C06000
|
heap
|
page read and write
|
||
3E5F000
|
stack
|
page read and write
|
||
6FEC000
|
stack
|
page read and write
|
||
2320000
|
heap
|
page read and write
|
||
6CA9000
|
heap
|
page read and write
|
||
6C09000
|
heap
|
page read and write
|
||
196000
|
stack
|
page read and write
|
||
6C08000
|
heap
|
page read and write
|
||
86A0000
|
heap
|
page read and write
|
||
6995000
|
heap
|
page read and write
|
||
5624000
|
heap
|
page read and write
|
||
6BF3000
|
heap
|
page read and write
|
||
6BE4000
|
heap
|
page read and write
|
||
6BE3000
|
heap
|
page read and write
|
||
8580000
|
heap
|
page read and write
|
||
6BFB000
|
heap
|
page read and write
|
||
24B4000
|
heap
|
page read and write
|
||
6C03000
|
heap
|
page read and write
|
||
6BFB000
|
heap
|
page read and write
|
||
3060000
|
trusted library allocation
|
page read and write
|
||
5624000
|
heap
|
page read and write
|
||
25CC000
|
stack
|
page read and write
|
||
6BF2000
|
heap
|
page read and write
|
||
6BF7000
|
heap
|
page read and write
|
||
69B9000
|
heap
|
page read and write
|
||
696C000
|
stack
|
page read and write
|
||
3BDF000
|
stack
|
page read and write
|
||
6BD9000
|
heap
|
page read and write
|
||
6BEE000
|
heap
|
page read and write
|
||
2BBF000
|
stack
|
page read and write
|
||
7828000
|
heap
|
page read and write
|
||
7860000
|
heap
|
page read and write
|
||
6BFB000
|
heap
|
page read and write
|
||
3860000
|
heap
|
page read and write
|
||
6C09000
|
heap
|
page read and write
|
||
6BF7000
|
heap
|
page read and write
|
||
2325000
|
heap
|
page read and write
|
||
6985000
|
heap
|
page read and write
|
||
440000
|
heap
|
page read and write
|
||
6BD4000
|
heap
|
page read and write
|
||
6CF7000
|
heap
|
page read and write
|
||
6C0D000
|
heap
|
page read and write
|
||
6C64000
|
heap
|
page read and write
|
||
6D1B000
|
heap
|
page read and write
|
||
6BEE000
|
heap
|
page read and write
|
||
6BFB000
|
heap
|
page read and write
|
||
411C000
|
stack
|
page read and write
|
||
6BEE000
|
heap
|
page read and write
|
||
6A5000
|
heap
|
page read and write
|
||
6A4000
|
heap
|
page read and write
|
||
6A0000
|
heap
|
page read and write
|
||
6BE9000
|
heap
|
page read and write
|
||
5624000
|
heap
|
page read and write
|
||
770C000
|
stack
|
page read and write
|
||
648000
|
heap
|
page read and write
|
||
450000
|
heap
|
page read and write
|
||
6B6D000
|
heap
|
page read and write
|
||
6BE0000
|
heap
|
page read and write
|
||
718000
|
heap
|
page read and write
|
||
640000
|
heap
|
page read and write
|
||
6BEE000
|
heap
|
page read and write
|
||
435B000
|
stack
|
page read and write
|
||
69A7000
|
heap
|
page read and write
|
||
6AC000
|
heap
|
page read and write
|
||
6C06000
|
heap
|
page read and write
|
||
6AC000
|
heap
|
page read and write
|
||
6C03000
|
heap
|
page read and write
|
||
6BEE000
|
heap
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
6BFA000
|
heap
|
page read and write
|
||
6CA1000
|
heap
|
page read and write
|
||
6BE7000
|
heap
|
page read and write
|
||
6BD8000
|
heap
|
page read and write
|
||
6BE1000
|
heap
|
page read and write
|
||
6BFB000
|
heap
|
page read and write
|
||
3D5E000
|
stack
|
page read and write
|
||
69AC000
|
heap
|
page read and write
|
||
6984000
|
heap
|
page read and write
|
||
69E000
|
heap
|
page read and write
|
||
8E000
|
stack
|
page read and write
|
||
70EA000
|
stack
|
page read and write
|
||
561C000
|
heap
|
page read and write
|
||
69E000
|
heap
|
page read and write
|
||
4D5000
|
heap
|
page read and write
|
||
6BE9000
|
heap
|
page read and write
|
||
6CA1000
|
heap
|
page read and write
|
||
6BE3000
|
heap
|
page read and write
|
||
2300000
|
heap
|
page read and write
|
||
6975000
|
heap
|
page read and write
|
||
560B000
|
heap
|
page read and write
|
||
6AB000
|
heap
|
page read and write
|
||
6974000
|
heap
|
page read and write
|
||
21E0000
|
direct allocation
|
page read and write
|
||
6C64000
|
heap
|
page read and write
|
||
434000
|
unkown
|
page readonly
|
||
55CB000
|
heap
|
page read and write
|
||
699D000
|
heap
|
page read and write
|
||
69A8000
|
heap
|
page read and write
|
||
7919000
|
stack
|
page read and write
|
||
6C0C000
|
heap
|
page read and write
|
||
6994000
|
heap
|
page read and write
|
||
6CA1000
|
heap
|
page read and write
|
||
76CC000
|
stack
|
page read and write
|
||
6BDE000
|
heap
|
page read and write
|
||
6BDD000
|
heap
|
page read and write
|
||
6BE9000
|
heap
|
page read and write
|
||
6C00000
|
heap
|
page read and write
|
||
570E000
|
stack
|
page read and write
|
||
6A8000
|
heap
|
page read and write
|
||
6BD8000
|
heap
|
page read and write
|
||
2ABE000
|
stack
|
page read and write
|
||
6BDE000
|
heap
|
page read and write
|
||
4D0000
|
heap
|
page read and write
|
||
42E000
|
unkown
|
page read and write
|
||
6E70000
|
heap
|
page read and write
|
||
3F9D000
|
stack
|
page read and write
|
||
6AB000
|
heap
|
page read and write
|
||
3E9E000
|
stack
|
page read and write
|
||
6BD8000
|
heap
|
page read and write
|
||
6BE9000
|
heap
|
page read and write
|
||
5624000
|
heap
|
page read and write
|
||
580F000
|
stack
|
page read and write
|
||
561C000
|
heap
|
page read and write
|
||
560B000
|
heap
|
page read and write
|
||
425C000
|
stack
|
page read and write
|
||
561C000
|
heap
|
page read and write
|
||
6BD8000
|
heap
|
page read and write
|
||
6C01000
|
heap
|
page read and write
|
||
6CE6000
|
heap
|
page read and write
|
||
6C17000
|
heap
|
page read and write
|
||
7B5D000
|
stack
|
page read and write
|
||
874D000
|
stack
|
page read and write
|
||
561C000
|
heap
|
page read and write
|
||
3C1E000
|
stack
|
page read and write
|
||
6BE0000
|
heap
|
page read and write
|
||
55CD000
|
heap
|
page read and write
|
||
6AF000
|
heap
|
page read and write
|
||
6C08000
|
heap
|
page read and write
|
||
6BDD000
|
heap
|
page read and write
|
||
6BE9000
|
heap
|
page read and write
|
||
6BE9000
|
heap
|
page read and write
|
||
7A19000
|
stack
|
page read and write
|
||
6BB2000
|
heap
|
page read and write
|
||
6F6000
|
heap
|
page read and write
|
||
7848000
|
heap
|
page read and write
|
||
681000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
3D1F000
|
stack
|
page read and write
|
||
6C09000
|
heap
|
page read and write
|
||
21FC000
|
direct allocation
|
page read and write
|
||
6B3000
|
heap
|
page read and write
|
||
8F0E000
|
stack
|
page read and write
|
||
6F6000
|
heap
|
page read and write
|
||
7CFC000
|
stack
|
page read and write
|
||
21FB000
|
direct allocation
|
page read and write
|
||
6BD9000
|
heap
|
page read and write
|
||
399E000
|
stack
|
page read and write
|
||
6C09000
|
heap
|
page read and write
|
||
3A9F000
|
stack
|
page read and write
|
||
6BD9000
|
heap
|
page read and write
|
||
26CF000
|
stack
|
page read and write
|
||
88D0000
|
heap
|
page read and write
|
||
6C0D000
|
heap
|
page read and write
|
||
6BF2000
|
heap
|
page read and write
|
||
6CA5000
|
heap
|
page read and write
|
||
6C67000
|
heap
|
page read and write
|
||
6E60000
|
heap
|
page read and write
|
||
6C14000
|
heap
|
page read and write
|
||
6C06000
|
heap
|
page read and write
|
||
4219000
|
stack
|
page read and write
|
||
6CA5000
|
heap
|
page read and write
|
||
6BD8000
|
heap
|
page read and write
|
||
6BE9000
|
heap
|
page read and write
|
||
6C64000
|
heap
|
page read and write
|
||
5624000
|
heap
|
page read and write
|
||
560C000
|
heap
|
page read and write
|
||
6BEF000
|
heap
|
page read and write
|
||
430000
|
unkown
|
page write copy
|
||
7A5C000
|
stack
|
page read and write
|
||
888E000
|
stack
|
page read and write
|
||
561C000
|
heap
|
page read and write
|
||
8A1D000
|
stack
|
page read and write
|
||
7E19000
|
stack
|
page read and write
|
||
7838000
|
heap
|
page read and write
|
||
42E000
|
unkown
|
page write copy
|
||
6C67000
|
heap
|
page read and write
|
||
69A0000
|
heap
|
page read and write
|
||
6D76000
|
heap
|
page read and write
|
There are 224 hidden memdumps, click here to show them.
DOM / HTML
URL
|
Malicious
|
|
---|---|---|
https://www.baremetalsoft.com/register/?app=BareTail&ver=3.50a&build=2006-11-02
|