Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
OC. 4515924646.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\aut5891.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\unnervousness
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\OC. 4515924646.exe
|
"C:\Users\user\Desktop\OC. 4515924646.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\OC. 4515924646.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://account.dyn.com/
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ip-api.com/line/?fields=hosting
|
208.95.112.1
|
||
|
http://ip-api.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
ip-api.com
|
208.95.112.1
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.95.112.1
|
ip-api.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
172000
|
system
|
page execute and read and write
|
|
|
|
1920000
|
direct allocation
|
page read and write
|
|
|
|
4210000
|
direct allocation
|
page read and write
|
||
|
770000
|
unkown
|
page readonly
|
||
|
7A8000
|
heap
|
page read and write
|
||
|
226E000
|
stack
|
page read and write
|
||
|
4210000
|
direct allocation
|
page read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
5769000
|
heap
|
page read and write
|
||
|
1BE5000
|
heap
|
page read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
45AD000
|
stack
|
page read and write
|
||
|
1BE5000
|
heap
|
page read and write
|
||
|
A17000
|
trusted library allocation
|
page execute and read and write
|
||
|
2486000
|
trusted library allocation
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
8F6000
|
trusted library allocation
|
page execute and read and write
|
||
|
4210000
|
direct allocation
|
page read and write
|
||
|
161B000
|
stack
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
A20000
|
heap
|
page read and write
|
||
|
454E000
|
direct allocation
|
page read and write
|
||
|
8E0000
|
trusted library allocation
|
page read and write
|
||
|
44D9000
|
direct allocation
|
page read and write
|
||
|
1A7D000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
1A7E000
|
heap
|
page read and write
|
||
|
5B80000
|
trusted library allocation
|
page read and write
|
||
|
22F0000
|
trusted library allocation
|
page read and write
|
||
|
5C20000
|
heap
|
page read and write
|
||
|
5B77000
|
trusted library allocation
|
page read and write
|
||
|
3EC4000
|
heap
|
page read and write
|
||
|
4970000
|
heap
|
page execute and read and write
|
||
|
906000
|
heap
|
page read and write
|
||
|
A12000
|
trusted library allocation
|
page read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
170000
|
system
|
page execute and read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
19CC000
|
heap
|
page read and write
|
||
|
43B0000
|
direct allocation
|
page read and write
|
||
|
4F9000
|
stack
|
page read and write
|
||
|
8D0000
|
trusted library allocation
|
page read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
24F4000
|
trusted library allocation
|
page read and write
|
||
|
841000
|
unkown
|
page execute and write copy
|
||
|
2508000
|
trusted library allocation
|
page read and write
|
||
|
1AAF000
|
heap
|
page read and write
|
||
|
22B0000
|
trusted library allocation
|
page read and write
|
||
|
22BB000
|
trusted library allocation
|
page read and write
|
||
|
454E000
|
direct allocation
|
page read and write
|
||
|
5B60000
|
trusted library allocation
|
page read and write
|
||
|
24F8000
|
trusted library allocation
|
page read and write
|
||
|
1A02000
|
heap
|
page read and write
|
||
|
22C2000
|
trusted library allocation
|
page read and write
|
||
|
1BF4000
|
heap
|
page read and write
|
||
|
2210000
|
trusted library allocation
|
page read and write
|
||
|
89D000
|
heap
|
page read and write
|
||
|
43B0000
|
direct allocation
|
page read and write
|
||
|
5C30000
|
heap
|
page read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
182E000
|
stack
|
page read and write
|
||
|
4BFE000
|
stack
|
page read and write
|
||
|
5060000
|
trusted library allocation
|
page execute and read and write
|
||
|
5720000
|
heap
|
page read and write
|
||
|
1C2B000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
837000
|
heap
|
page read and write
|
||
|
4BBC000
|
stack
|
page read and write
|
||
|
1239000
|
stack
|
page read and write
|
||
|
454E000
|
direct allocation
|
page read and write
|
||
|
5B5E000
|
stack
|
page read and write
|
||
|
8F2000
|
trusted library allocation
|
page read and write
|
||
|
19D9000
|
heap
|
page read and write
|
||
|
3474000
|
trusted library allocation
|
page read and write
|
||
|
15FC000
|
stack
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
889000
|
heap
|
page read and write
|
||
|
163D000
|
stack
|
page read and write
|
||
|
44DD000
|
direct allocation
|
page read and write
|
||
|
1780000
|
heap
|
page read and write
|
||
|
771000
|
unkown
|
page execute and read and write
|
||
|
3EC0000
|
heap
|
page read and write
|
||
|
8D4000
|
trusted library allocation
|
page read and write
|
||
|
4418000
|
trusted library allocation
|
page read and write
|
||
|
24EB000
|
trusted library allocation
|
page read and write
|
||
|
7BE000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
1C3A000
|
heap
|
page read and write
|
||
|
199A000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
251B000
|
trusted library allocation
|
page read and write
|
||
|
4AB3000
|
heap
|
page read and write
|
||
|
88E000
|
unkown
|
page execute and read and write
|
||
|
4FFE000
|
stack
|
page read and write
|
||
|
43B0000
|
direct allocation
|
page read and write
|
||
|
1A90000
|
heap
|
page read and write
|
||
|
19F8000
|
heap
|
page read and write
|
||
|
1BE8000
|
heap
|
page read and write
|
||
|
16A0000
|
heap
|
page read and write
|
||
|
573D000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
22D1000
|
trusted library allocation
|
page read and write
|
||
|
2300000
|
heap
|
page execute and read and write
|
||
|
43B0000
|
direct allocation
|
page read and write
|
||
|
4333000
|
direct allocation
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
43B0000
|
direct allocation
|
page read and write
|
||
|
19D7000
|
heap
|
page read and write
|
||
|
4E3E000
|
stack
|
page read and write
|
||
|
454E000
|
direct allocation
|
page read and write
|
||
|
4210000
|
direct allocation
|
page read and write
|
||
|
8FA000
|
trusted library allocation
|
page execute and read and write
|
||
|
454E000
|
direct allocation
|
page read and write
|
||
|
813000
|
heap
|
page read and write
|
||
|
44D9000
|
direct allocation
|
page read and write
|
||
|
8D3000
|
trusted library allocation
|
page execute and read and write
|
||
|
44D9000
|
direct allocation
|
page read and write
|
||
|
1BE2000
|
heap
|
page read and write
|
||
|
22CA000
|
trusted library allocation
|
page read and write
|
||
|
7D7000
|
heap
|
page read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
4E7D000
|
stack
|
page read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
82A000
|
unkown
|
page execute and read and write
|
||
|
5050000
|
heap
|
page read and write
|
||
|
218E000
|
stack
|
page read and write
|
||
|
22CE000
|
trusted library allocation
|
page read and write
|
||
|
1BE2000
|
heap
|
page read and write
|
||
|
2200000
|
trusted library allocation
|
page read and write
|
||
|
44DD000
|
direct allocation
|
page read and write
|
||
|
17CE000
|
stack
|
page read and write
|
||
|
24FA000
|
trusted library allocation
|
page read and write
|
||
|
4333000
|
direct allocation
|
page read and write
|
||
|
44DD000
|
direct allocation
|
page read and write
|
||
|
24CA000
|
trusted library allocation
|
page read and write
|
||
|
7A0000
|
heap
|
page read and write
|
||
|
454E000
|
direct allocation
|
page read and write
|
||
|
5A5F000
|
stack
|
page read and write
|
||
|
8F0000
|
trusted library allocation
|
page read and write
|
||
|
199E000
|
heap
|
page read and write
|
||
|
44D9000
|
direct allocation
|
page read and write
|
||
|
21E0000
|
trusted library allocation
|
page read and write
|
||
|
24E4000
|
trusted library allocation
|
page read and write
|
||
|
44D9000
|
direct allocation
|
page read and write
|
||
|
21F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
43B0000
|
direct allocation
|
page read and write
|
||
|
4333000
|
direct allocation
|
page read and write
|
||
|
44DD000
|
direct allocation
|
page read and write
|
||
|
454E000
|
direct allocation
|
page read and write
|
||
|
8C0000
|
trusted library allocation
|
page read and write
|
||
|
1C2A000
|
heap
|
page read and write
|
||
|
3411000
|
trusted library allocation
|
page read and write
|
||
|
4980000
|
heap
|
page read and write
|
||
|
81E000
|
unkown
|
page execute and read and write
|
||
|
24D0000
|
trusted library allocation
|
page read and write
|
||
|
1A7D000
|
heap
|
page read and write
|
||
|
44DD000
|
direct allocation
|
page read and write
|
||
|
4D3E000
|
stack
|
page read and write
|
||
|
610000
|
heap
|
page read and write
|
||
|
240E000
|
stack
|
page read and write
|
||
|
1900000
|
heap
|
page read and write
|
||
|
4210000
|
direct allocation
|
page read and write
|
||
|
494C000
|
stack
|
page read and write
|
||
|
44DD000
|
direct allocation
|
page read and write
|
||
|
7F0D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
250D000
|
trusted library allocation
|
page read and write
|
||
|
1BE1000
|
heap
|
page execute and read and write
|
||
|
1AE000
|
system
|
page execute and read and write
|
||
|
4210000
|
direct allocation
|
page read and write
|
||
|
48F0000
|
trusted library allocation
|
page read and write
|
||
|
869000
|
heap
|
page read and write
|
||
|
1BEB000
|
heap
|
page read and write
|
||
|
258E000
|
stack
|
page read and write
|
||
|
7D9000
|
heap
|
page read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
19CD000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
13A000
|
stack
|
page read and write
|
||
|
896000
|
unkown
|
page write copy
|
||
|
4333000
|
direct allocation
|
page read and write
|
||
|
2220000
|
heap
|
page read and write
|
||
|
22DD000
|
trusted library allocation
|
page read and write
|
||
|
2445000
|
trusted library allocation
|
page read and write
|
||
|
4F7E000
|
stack
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
4333000
|
direct allocation
|
page read and write
|
||
|
5040000
|
trusted library allocation
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
84B000
|
unkown
|
page execute and read and write
|
||
|
4CFE000
|
stack
|
page read and write
|
||
|
4AB0000
|
heap
|
page read and write
|
||
|
19D9000
|
heap
|
page read and write
|
||
|
44D9000
|
direct allocation
|
page read and write
|
||
|
503E000
|
stack
|
page read and write
|
||
|
22D6000
|
trusted library allocation
|
page read and write
|
||
|
655000
|
heap
|
page read and write
|
||
|
5BA0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1980000
|
heap
|
page read and write
|
||
|
5B90000
|
trusted library allocation
|
page read and write
|
||
|
5749000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
A1B000
|
trusted library allocation
|
page execute and read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
19D9000
|
heap
|
page read and write
|
||
|
5B70000
|
trusted library allocation
|
page read and write
|
||
|
17E0000
|
heap
|
page read and write
|
||
|
3419000
|
trusted library allocation
|
page read and write
|
||
|
8DD000
|
trusted library allocation
|
page execute and read and write
|
||
|
43B0000
|
direct allocation
|
page read and write
|
||
|
22BE000
|
trusted library allocation
|
page read and write
|
||
|
4210000
|
direct allocation
|
page read and write
|
||
|
160F000
|
stack
|
page read and write
|
||
|
2411000
|
trusted library allocation
|
page read and write
|
||
|
887000
|
heap
|
page read and write
|
||
|
3439000
|
trusted library allocation
|
page read and write
|
||
|
896000
|
unkown
|
page read and write
|
||
|
894000
|
unkown
|
page execute and write copy
|
||
|
8ED000
|
trusted library allocation
|
page execute and read and write
|
||
|
5C40000
|
trusted library allocation
|
page read and write
|
||
|
1990000
|
heap
|
page read and write
|
||
|
1BE2000
|
heap
|
page read and write
|
||
|
650000
|
heap
|
page read and write
|
||
|
770000
|
unkown
|
page readonly
|
||
|
630000
|
heap
|
page read and write
|
||
|
1C05000
|
heap
|
page read and write
|
||
|
44DD000
|
direct allocation
|
page read and write
|
||
|
44D9000
|
direct allocation
|
page read and write
|
||
|
1B66000
|
heap
|
page read and write
|
||
|
22AC000
|
stack
|
page read and write
|
||
|
1BE6000
|
heap
|
page read and write
|
||
|
5B67000
|
trusted library allocation
|
page read and write
|
||
|
86F000
|
heap
|
page read and write
|
||
|
4333000
|
direct allocation
|
page read and write
|
||
|
2521000
|
trusted library allocation
|
page read and write
|
||
|
4333000
|
direct allocation
|
page read and write
|
There are 229 hidden memdumps, click here to show them.