IOC Report
5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe
"C:\Users\user\Desktop\5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
unknown
https://api.ipify.org
unknown
https://sectigo.com/CPS0
unknown
https://account.dyn.com/
unknown
http://ocsp.sectigo.com0
unknown
https://api.ipify.org/t
unknown
http://mail.privateemail.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
mail.privateemail.com
198.54.122.135
 malicious
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
198.54.122.135
mail.privateemail.com
United States
malicious
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
82000
unkown
page readonly
 malicious
25AC000
trusted library allocation
page read and write
 malicious
2581000
trusted library allocation
page read and write
 malicious
25B4000
trusted library allocation
page read and write
 malicious
B60000
trusted library allocation
page read and write
4E3E000
stack
page read and write
5D9F000
stack
page read and write
257D000
trusted library allocation
page read and write
2420000
heap
page execute and read and write
4F7E000
stack
page read and write
B77000
heap
page read and write
5920000
heap
page read and write
907000
trusted library allocation
page execute and read and write
23E2000
trusted library allocation
page read and write
6680000
heap
page read and write
23FD000
trusted library allocation
page read and write
1E0000
heap
page read and write
23DE000
trusted library allocation
page read and write
62C0000
trusted library allocation
page read and write
950000
heap
page read and write
4F8000
stack
page read and write
3559000
trusted library allocation
page read and write
6650000
trusted library allocation
page read and write
6E0000
trusted library allocation
page read and write
4A4C000
stack
page read and write
627F000
stack
page read and write
1C0000
heap
page read and write
5F1E000
stack
page read and write
66D0000
heap
page read and write
4AA0000
heap
page execute and read and write
23EE000
trusted library allocation
page read and write
742000
heap
page read and write
5937000
heap
page read and write
902000
trusted library allocation
page read and write
14A000
stack
page read and write
2330000
trusted library allocation
page read and write
238E000
stack
page read and write
5040000
heap
page read and write
6DD000
trusted library allocation
page execute and read and write
256F000
trusted library allocation
page read and write
6160000
trusted library allocation
page read and write
735000
heap
page read and write
616D000
trusted library allocation
page read and write
5EDF000
stack
page read and write
23D0000
trusted library allocation
page read and write
4AB3000
heap
page read and write
1B0000
heap
page read and write
7FC80000
trusted library allocation
page execute and read and write
676000
heap
page read and write
571E000
stack
page read and write
920000
trusted library allocation
page read and write
670000
heap
page read and write
46CE000
stack
page read and write
4CFE000
stack
page read and write
4CBC000
stack
page read and write
4F3F000
stack
page read and write
2571000
trusted library allocation
page read and write
615F000
stack
page read and write
23F6000
trusted library allocation
page read and write
61E0000
trusted library allocation
page execute and read and write
61C0000
heap
page read and write
25BF000
trusted library allocation
page read and write
90B000
trusted library allocation
page execute and read and write
5C5E000
stack
page read and write
23EA000
trusted library allocation
page read and write
601D000
stack
page read and write
61D0000
trusted library allocation
page execute and read and write
B70000
heap
page read and write
2567000
trusted library allocation
page read and write
940000
trusted library allocation
page read and write
23CC000
stack
page read and write
6170000
trusted library allocation
page read and write
25A8000
trusted library allocation
page read and write
61BE000
stack
page read and write
6F6000
trusted library allocation
page execute and read and write
252E000
stack
page read and write
6D0000
trusted library allocation
page read and write
23DB000
trusted library allocation
page read and write
7C5000
heap
page read and write
70E000
heap
page read and write
2531000
trusted library allocation
page read and write
6F0000
trusted library allocation
page read and write
73F000
heap
page read and write
6ED000
trusted library allocation
page execute and read and write
930000
trusted library allocation
page execute and read and write
6FA000
trusted library allocation
page execute and read and write
905000
trusted library allocation
page execute and read and write
4DFE000
stack
page read and write
25A6000
trusted library allocation
page read and write
3531000
trusted library allocation
page read and write
70B000
heap
page read and write
5059000
trusted library allocation
page read and write
593E000
heap
page read and write
23F1000
trusted library allocation
page read and write
6D4000
trusted library allocation
page read and write
62D0000
trusted library allocation
page read and write
2340000
heap
page read and write
6F2000
trusted library allocation
page read and write
59A7000
heap
page read and write
7CD000
heap
page read and write
5DDD000
stack
page read and write
6D3000
trusted library allocation
page execute and read and write
59B0000
heap
page read and write
4538000
trusted library allocation
page read and write
4AC0000
heap
page read and write
5C9D000
stack
page read and write
6640000
trusted library allocation
page read and write
6C0000
trusted library allocation
page read and write
7EE000
heap
page read and write
6690000
trusted library allocation
page execute and read and write
4AB0000
heap
page read and write
80000
unkown
page readonly
700000
heap
page read and write
25AA000
trusted library allocation
page read and write
62D7000
trusted library allocation
page read and write
2320000
trusted library allocation
page read and write
503D000
stack
page read and write
605E000
stack
page read and write
6177000
trusted library allocation
page read and write
78F000
heap
page read and write
3599000
trusted library allocation
page read and write
5050000
trusted library allocation
page read and write
There are 112 hidden memdumps, click here to show them.