Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\cjB7bj6Fb4.exe
|
"C:\Users\user\Desktop\cjB7bj6Fb4.exe"
|
 |
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://160.22.121.182/STATO/Ohcbxyza.datM
|
unknown
|
||
|
http://160.22.121.182/STATO/Ohcbxyza.dat
|
160.22.121.182
|
||
|
http://160.22.121.182
|
unknown
|
||
|
http://160.22.121.182D
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://160.22.121.182/STATO/Ohcbxyza.datP
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
198.187.3.20.in-addr.arpa
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
160.22.121.182
|
unknown
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\cjB7bj6Fb4_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2A50000
|
heap
|
page read and write
|
||
|
1020000
|
trusted library allocation
|
page read and write
|
||
|
5C1E000
|
stack
|
page read and write
|
||
|
740000
|
unkown
|
page readonly
|
||
|
2B25000
|
trusted library allocation
|
page read and write
|
||
|
10E0000
|
heap
|
page execute and read and write
|
||
|
E49000
|
heap
|
page read and write
|
||
|
2E91000
|
trusted library allocation
|
page read and write
|
||
|
2A4D000
|
stack
|
page read and write
|
||
|
B9D000
|
stack
|
page read and write
|
||
|
2C8A000
|
trusted library allocation
|
page read and write
|
||
|
5D1E000
|
stack
|
page read and write
|
||
|
5FFD000
|
stack
|
page read and write
|
||
|
2E59000
|
trusted library allocation
|
page read and write
|
||
|
53BD000
|
stack
|
page read and write
|
||
|
2A0E000
|
stack
|
page read and write
|
||
|
105A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1167000
|
heap
|
page read and write
|
||
|
2DC8000
|
trusted library allocation
|
page read and write
|
||
|
10D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2EC7000
|
trusted library allocation
|
page read and write
|
||
|
6110000
|
heap
|
page read and write
|
||
|
5120000
|
trusted library allocation
|
page read and write
|
||
|
4BFD000
|
stack
|
page read and write
|
||
|
54BE000
|
stack
|
page read and write
|
||
|
2F2D000
|
trusted library allocation
|
page read and write
|
||
|
B40000
|
heap
|
page read and write
|
||
|
2E8D000
|
trusted library allocation
|
page read and write
|
||
|
2D34000
|
trusted library allocation
|
page read and write
|
||
|
6100000
|
heap
|
page read and write
|
||
|
5130000
|
heap
|
page execute and read and write
|
||
|
FBD000
|
stack
|
page read and write
|
||
|
2F5C000
|
trusted library allocation
|
page read and write
|
||
|
2EF3000
|
trusted library allocation
|
page read and write
|
||
|
DB4000
|
heap
|
page read and write
|
||
|
3A61000
|
trusted library allocation
|
page read and write
|
||
|
E2F000
|
heap
|
page read and write
|
||
|
1050000
|
trusted library allocation
|
page read and write
|
||
|
5A1C000
|
stack
|
page read and write
|
||
|
B50000
|
heap
|
page read and write
|
||
|
503D000
|
stack
|
page read and write
|
||
|
2F15000
|
trusted library allocation
|
page read and write
|
||
|
50BE000
|
stack
|
page read and write
|
||
|
1067000
|
trusted library allocation
|
page execute and read and write
|
||
|
5A9E000
|
stack
|
page read and write
|
||
|
507D000
|
stack
|
page read and write
|
||
|
2CD8000
|
trusted library allocation
|
page read and write
|
||
|
2E49000
|
trusted library allocation
|
page read and write
|
||
|
EBD000
|
stack
|
page read and write
|
||
|
2E6D000
|
trusted library allocation
|
page read and write
|
||
|
1040000
|
trusted library allocation
|
page read and write
|
||
|
103D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2AA7000
|
trusted library allocation
|
page read and write
|
||
|
106B000
|
trusted library allocation
|
page execute and read and write
|
||
|
1080000
|
trusted library allocation
|
page read and write
|
||
|
2ADA000
|
trusted library allocation
|
page read and write
|
||
|
FE7000
|
heap
|
page read and write
|
||
|
FE0000
|
heap
|
page read and write
|
||
|
BA0000
|
heap
|
page read and write
|
||
|
2DD3000
|
trusted library allocation
|
page read and write
|
||
|
1150000
|
trusted library allocation
|
page read and write
|
||
|
DFD000
|
heap
|
page read and write
|
||
|
4A60000
|
trusted library allocation
|
page read and write
|
||
|
2C4C000
|
trusted library allocation
|
page read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
742000
|
unkown
|
page readonly
|
||
|
7DC000
|
stack
|
page read and write
|
||
|
D7C000
|
stack
|
page read and write
|
||
|
2C64000
|
trusted library allocation
|
page read and write
|
||
|
1057000
|
trusted library allocation
|
page execute and read and write
|
||
|
5BDD000
|
stack
|
page read and write
|
||
|
112C000
|
stack
|
page read and write
|
||
|
1033000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A61000
|
trusted library allocation
|
page read and write
|
||
|
2C91000
|
trusted library allocation
|
page read and write
|
||
|
AF8000
|
stack
|
page read and write
|
||
|
D8E000
|
heap
|
page read and write
|
||
|
2EA3000
|
trusted library allocation
|
page read and write
|
||
|
1160000
|
heap
|
page read and write
|
||
|
2C73000
|
trusted library allocation
|
page read and write
|
||
|
BA5000
|
heap
|
page read and write
|
||
|
2C7E000
|
trusted library allocation
|
page read and write
|
||
|
60FC000
|
stack
|
page read and write
|
||
|
2EEC000
|
trusted library allocation
|
page read and write
|
||
|
2EE1000
|
trusted library allocation
|
page read and write
|
||
|
E36000
|
heap
|
page read and write
|
||
|
2AB8000
|
trusted library allocation
|
page read and write
|
||
|
1034000
|
trusted library allocation
|
page read and write
|
||
|
E66000
|
heap
|
page read and write
|
||
|
5A5E000
|
stack
|
page read and write
|
||
|
2C7C000
|
trusted library allocation
|
page read and write
|
||
|
2A92000
|
trusted library allocation
|
page read and write
|
||
|
2F47000
|
trusted library allocation
|
page read and write
|
||
|
2F5F000
|
trusted library allocation
|
page read and write
|
||
|
2EB1000
|
trusted library allocation
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
5ADD000
|
stack
|
page read and write
|
||
|
2EF7000
|
trusted library allocation
|
page read and write
|
||
|
2C68000
|
trusted library allocation
|
page read and write
|
||
|
591D000
|
stack
|
page read and write
|
||
|
1062000
|
trusted library allocation
|
page read and write
|
||
|
1060000
|
trusted library allocation
|
page read and write
|
||
|
2F27000
|
trusted library allocation
|
page read and write
|
||
|
D8A000
|
heap
|
page read and write
|
||
|
4A68000
|
trusted library allocation
|
page read and write
|
||
|
2A9E000
|
trusted library allocation
|
page read and write
|
||
|
50FE000
|
stack
|
page read and write
|
||
|
1130000
|
trusted library allocation
|
page read and write
|
||
|
2F4D000
|
trusted library allocation
|
page read and write
|
||
|
10CE000
|
stack
|
page read and write
|
||
|
1030000
|
trusted library allocation
|
page read and write
|
||
|
2CA0000
|
trusted library allocation
|
page read and write
|
||
|
2C6B000
|
trusted library allocation
|
page read and write
|
||
|
523D000
|
stack
|
page read and write
|
||
|
2EC5000
|
trusted library allocation
|
page read and write
|
There are 105 hidden memdumps, click here to show them.