Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Copy60330548196.exe
|
"C:\Users\user\Desktop\Copy60330548196.exe"
|
 |
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://98.142.254.109/ii/Meqvrjzz.wavt
|
unknown
|
||
|
http://98.142.254.109
|
unknown
|
||
|
http://98.142.254.109/ii/Meqvrjzz.wav
|
98.142.254.109
|
||
|
http://crl.thawte.com/ThawteTimestampingCA.crl0
|
unknown
|
||
|
http://schemas.xmlsoap.org/soap/encoding/
|
unknown
|
||
|
http://98.142.254.109D
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ocsp.thawte.com0
|
unknown
|
||
|
http://98.142.254.109/ii/Meqvrjzz.wavP
|
unknown
|
||
|
http://schemas.xmlsoap.org/soap/envelope/
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
98.142.254.109
|
unknown
|
Canada
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Copy60330548196_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2B7E000
|
trusted library allocation
|
page read and write
|
||
|
58ED000
|
stack
|
page read and write
|
||
|
5E0D000
|
stack
|
page read and write
|
||
|
6D2000
|
unkown
|
page readonly
|
||
|
2AA0000
|
heap
|
page execute and read and write
|
||
|
548E000
|
stack
|
page read and write
|
||
|
E6E000
|
stack
|
page read and write
|
||
|
EED000
|
stack
|
page read and write
|
||
|
B7E000
|
heap
|
page read and write
|
||
|
2BD4000
|
trusted library allocation
|
page read and write
|
||
|
5AAD000
|
stack
|
page read and write
|
||
|
BA5000
|
heap
|
page read and write
|
||
|
2B8C000
|
trusted library allocation
|
page read and write
|
||
|
DBD000
|
stack
|
page read and write
|
||
|
E00000
|
heap
|
page read and write
|
||
|
DFA000
|
trusted library allocation
|
page execute and read and write
|
||
|
2B72000
|
trusted library allocation
|
page read and write
|
||
|
DE0000
|
trusted library allocation
|
page read and write
|
||
|
C2D000
|
heap
|
page read and write
|
||
|
5E60000
|
heap
|
page read and write
|
||
|
7F0000
|
heap
|
page read and write
|
||
|
5F6D000
|
stack
|
page read and write
|
||
|
6D0000
|
unkown
|
page readonly
|
||
|
B30000
|
heap
|
page read and write
|
||
|
2BDC000
|
trusted library allocation
|
page read and write
|
||
|
2B7C000
|
trusted library allocation
|
page read and write
|
||
|
2B80000
|
trusted library allocation
|
page read and write
|
||
|
B20000
|
heap
|
page read and write
|
||
|
E1B000
|
trusted library allocation
|
page execute and read and write
|
||
|
7AC000
|
stack
|
page read and write
|
||
|
510C000
|
stack
|
page read and write
|
||
|
568E000
|
stack
|
page read and write
|
||
|
2AD1000
|
trusted library allocation
|
page read and write
|
||
|
538D000
|
stack
|
page read and write
|
||
|
2B8E000
|
trusted library allocation
|
page read and write
|
||
|
C08000
|
heap
|
page read and write
|
||
|
E20000
|
heap
|
page read and write
|
||
|
C31000
|
heap
|
page read and write
|
||
|
3AD1000
|
trusted library allocation
|
page read and write
|
||
|
E27000
|
heap
|
page read and write
|
||
|
E07000
|
heap
|
page read and write
|
||
|
EAD000
|
stack
|
page read and write
|
||
|
4BCE000
|
stack
|
page read and write
|
||
|
DF7000
|
trusted library allocation
|
page execute and read and write
|
||
|
2B82000
|
trusted library allocation
|
page read and write
|
||
|
D7E000
|
stack
|
page read and write
|
||
|
DD0000
|
trusted library allocation
|
page read and write
|
||
|
558D000
|
stack
|
page read and write
|
||
|
2B29000
|
trusted library allocation
|
page read and write
|
||
|
5E50000
|
heap
|
page read and write
|
||
|
51CD000
|
stack
|
page read and write
|
||
|
520E000
|
stack
|
page read and write
|
||
|
2AC0000
|
heap
|
page execute and read and write
|
||
|
BB2000
|
heap
|
page read and write
|
||
|
E17000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A60000
|
trusted library allocation
|
page read and write
|
||
|
2B9C000
|
trusted library allocation
|
page read and write
|
||
|
6EE000
|
unkown
|
page readonly
|
||
|
7F5000
|
heap
|
page read and write
|
||
|
2AB0000
|
trusted library allocation
|
page read and write
|
||
|
BDE000
|
heap
|
page read and write
|
||
|
E12000
|
trusted library allocation
|
page read and write
|
||
|
2BA2000
|
trusted library allocation
|
page read and write
|
||
|
DD3000
|
trusted library allocation
|
page execute and read and write
|
||
|
2910000
|
trusted library allocation
|
page execute and read and write
|
||
|
5BAD000
|
stack
|
page read and write
|
||
|
2BC4000
|
trusted library allocation
|
page read and write
|
||
|
B78000
|
heap
|
page read and write
|
||
|
DD4000
|
trusted library allocation
|
page read and write
|
||
|
500D000
|
stack
|
page read and write
|
||
|
290E000
|
stack
|
page read and write
|
||
|
F2D000
|
stack
|
page read and write
|
||
|
2B31000
|
trusted library allocation
|
page read and write
|
||
|
2A30000
|
heap
|
page read and write
|
||
|
2B55000
|
trusted library allocation
|
page read and write
|
||
|
DC0000
|
trusted library allocation
|
page read and write
|
||
|
B98000
|
heap
|
page read and write
|
||
|
2A50000
|
trusted library allocation
|
page read and write
|
||
|
2B96000
|
trusted library allocation
|
page read and write
|
||
|
2BD8000
|
trusted library allocation
|
page read and write
|
||
|
AF8000
|
stack
|
page read and write
|
||
|
2BBD000
|
trusted library allocation
|
page read and write
|
||
|
2BDA000
|
trusted library allocation
|
page read and write
|
||
|
FAE000
|
stack
|
page read and write
|
||
|
2B4E000
|
trusted library allocation
|
page read and write
|
||
|
2B74000
|
trusted library allocation
|
page read and write
|
||
|
DDD000
|
trusted library allocation
|
page execute and read and write
|
||
|
B70000
|
heap
|
page read and write
|
||
|
2920000
|
heap
|
page read and write
|
||
|
2BCA000
|
trusted library allocation
|
page read and write
|
||
|
59EC000
|
stack
|
page read and write
|
||
|
F6D000
|
stack
|
page read and write
|
||
|
27E0000
|
trusted library allocation
|
page read and write
|
||
|
2B6F000
|
trusted library allocation
|
page read and write
|
||
|
2B37000
|
trusted library allocation
|
page read and write
|
||
|
282E000
|
stack
|
page read and write
|
||
|
2A2F000
|
stack
|
page read and write
|
||
|
2BCC000
|
trusted library allocation
|
page read and write
|
||
|
2B5C000
|
trusted library allocation
|
page read and write
|
There are 89 hidden memdumps, click here to show them.