IOC Report
PI-236031.exe

loading gif

Files

File Path
Type
Category
Malicious
PI-236031.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\autE024.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autE083.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\leucoryx
data
dropped
C:\Users\user\AppData\Local\Temp\seskin
ASCII text, with very long lines (28724), with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PI-236031.exe
"C:\Users\user\Desktop\PI-236031.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\PI-236031.exe"
 malicious

URLs

Name
IP
Malicious
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
 malicious

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
2F80000
direct allocation
page read and write
 malicious
4E80000
heap
page read and write
28EE000
stack
page read and write
29D4000
trusted library allocation
page read and write
395B000
trusted library allocation
page read and write
373D000
direct allocation
page read and write
2760000
trusted library allocation
page read and write
29F6000
trusted library allocation
page read and write
D50000
heap
page read and write
942000
heap
page read and write
C00000
trusted library allocation
page read and write
29E4000
trusted library allocation
page read and write
91C000
heap
page read and write
513F000
stack
page read and write
860000
heap
page read and write
A5A000
heap
page read and write
4D4E000
trusted library allocation
page read and write
3593000
direct allocation
page read and write
3593000
direct allocation
page read and write
4D42000
trusted library allocation
page read and write
3610000
direct allocation
page read and write
903000
heap
page read and write
A4E000
heap
page read and write
9C0000
trusted library allocation
page read and write
2966000
trusted library allocation
page read and write
9D0000
trusted library allocation
page read and write
373D000
direct allocation
page read and write
902000
heap
page read and write
C27000
trusted library allocation
page execute and read and write
4D30000
trusted library allocation
page read and write
3034000
heap
page read and write
4D3B000
trusted library allocation
page read and write
A30000
heap
page read and write
2A0A000
trusted library allocation
page read and write
3593000
direct allocation
page read and write
CFE000
stack
page read and write
987000
heap
page read and write
9E5000
heap
page read and write
4D56000
trusted library allocation
page read and write
B0E000
heap
page read and write
60E7000
trusted library allocation
page read and write
38F9000
trusted library allocation
page read and write
2F70000
direct allocation
page execute and read and write
517D000
stack
page read and write
63F0000
heap
page read and write
3610000
direct allocation
page read and write
7BF000
stack
page read and write
4EF0000
heap
page read and write
173E000
stack
page read and write
AEF000
heap
page read and write
6110000
trusted library allocation
page execute and read and write
37AE000
direct allocation
page read and write
C22000
trusted library allocation
page read and write
28F1000
trusted library allocation
page read and write
C40000
trusted library allocation
page read and write
91C000
heap
page read and write
3470000
direct allocation
page read and write
7FBE0000
trusted library allocation
page execute and read and write
2780000
trusted library allocation
page read and write
942000
heap
page read and write
3610000
direct allocation
page read and write
29DE000
trusted library allocation
page read and write
503E000
stack
page read and write
29CC000
trusted library allocation
page read and write
977000
heap
page read and write
2A04000
trusted library allocation
page read and write
60F0000
trusted library allocation
page read and write
C12000
trusted library allocation
page read and write
AFF000
heap
page read and write
A38000
heap
page read and write
E28000
unkown
page readonly
955000
heap
page read and write
43E000
system
page execute and read and write
E1F000
unkown
page write copy
91C000
heap
page read and write
5CA000
stack
page read and write
8F8000
stack
page read and write
AA8000
heap
page read and write
990000
heap
page read and write
29BA000
trusted library allocation
page read and write
91C000
heap
page read and write
E15000
unkown
page readonly
2770000
trusted library allocation
page read and write
7DB000
stack
page read and write
C10000
trusted library allocation
page read and write
903000
heap
page read and write
F00000
trusted library allocation
page execute and read and write
E15000
unkown
page readonly
942000
heap
page read and write
904000
heap
page read and write
91C000
heap
page read and write
8C8000
heap
page read and write
3470000
direct allocation
page read and write
9DD000
trusted library allocation
page execute and read and write
38F1000
trusted library allocation
page read and write
60E0000
trusted library allocation
page read and write
E1F000
unkown
page read and write
6160000
trusted library allocation
page read and write
997000
heap
page read and write
4D4A000
trusted library allocation
page read and write
958000
heap
page read and write
4EF3000
heap
page read and write
3739000
direct allocation
page read and write
D60000
unkown
page readonly
B2C000
heap
page read and write
5B94000
heap
page read and write
E28000
unkown
page readonly
3919000
trusted library allocation
page read and write
962000
heap
page read and write
27A0000
heap
page execute and read and write
EE0000
heap
page read and write
980000
heap
page read and write
8F3000
heap
page read and write
3739000
direct allocation
page read and write
29F1000
trusted library allocation
page read and write
930000
heap
page read and write
549D000
stack
page read and write
8F3000
heap
page read and write
942000
heap
page read and write
8E3000
heap
page read and write
3739000
direct allocation
page read and write
373D000
direct allocation
page read and write
49EE000
stack
page read and write
37AE000
direct allocation
page read and write
8F2000
heap
page read and write
3739000
direct allocation
page read and write
400000
system
page execute and read and write
840000
heap
page read and write
4D70000
heap
page read and write
3593000
direct allocation
page read and write
C2B000
trusted library allocation
page execute and read and write
F16000
heap
page read and write
8E8000
heap
page read and write
990000
heap
page read and write
373D000
direct allocation
page read and write
C8E000
stack
page read and write
29B4000
trusted library allocation
page read and write
8E8000
heap
page read and write
A64000
heap
page read and write
6120000
trusted library allocation
page execute and read and write
942000
heap
page read and write
942000
heap
page read and write
C0D000
trusted library allocation
page execute and read and write
8F3000
heap
page read and write
3739000
direct allocation
page read and write
942000
heap
page read and write
DEF000
unkown
page readonly
9D3000
trusted library allocation
page execute and read and write
D61000
unkown
page execute read
3739000
direct allocation
page read and write
133E000
stack
page read and write
373D000
direct allocation
page read and write
942000
heap
page read and write
D61000
unkown
page execute read
37AE000
direct allocation
page read and write
60DE000
stack
page read and write
CD0000
heap
page read and write
C1A000
trusted library allocation
page execute and read and write
F10000
heap
page read and write
CCC000
stack
page read and write
3470000
direct allocation
page read and write
27E0000
heap
page read and write
91C000
heap
page read and write
942000
heap
page read and write
3470000
direct allocation
page read and write
E23000
unkown
page write copy
4D51000
trusted library allocation
page read and write
911000
heap
page read and write
91C000
heap
page read and write
8C0000
heap
page read and write
2925000
trusted library allocation
page read and write
3030000
heap
page read and write
4D62000
trusted library allocation
page read and write
3470000
direct allocation
page read and write
3610000
direct allocation
page read and write
91C000
heap
page read and write
4EDC000
stack
page read and write
8AE000
stack
page read and write
4E90000
heap
page execute and read and write
903000
heap
page read and write
903000
heap
page read and write
54A0000
trusted library allocation
page read and write
3470000
direct allocation
page read and write
947000
heap
page read and write
91C000
heap
page read and write
91D000
heap
page read and write
5B60000
heap
page read and write
527E000
stack
page read and write
A66000
heap
page read and write
942000
heap
page read and write
4D3E000
trusted library allocation
page read and write
830000
heap
page read and write
2790000
trusted library allocation
page read and write
B01000
heap
page read and write
6100000
trusted library allocation
page read and write
947000
heap
page read and write
29E2000
trusted library allocation
page read and write
C16000
trusted library allocation
page execute and read and write
7CF000
stack
page read and write
37AE000
direct allocation
page read and write
4D5D000
trusted library allocation
page read and write
3593000
direct allocation
page read and write
7FC000
stack
page read and write
37AE000
direct allocation
page read and write
4EE0000
trusted library allocation
page read and write
D60000
unkown
page readonly
91C000
heap
page read and write
971000
heap
page read and write
942000
heap
page read and write
3610000
direct allocation
page read and write
4D36000
trusted library allocation
page read and write
B1A000
heap
page read and write
5F9E000
stack
page read and write
1CA000
stack
page read and write
5FDE000
stack
page read and write
DEF000
unkown
page readonly
373D000
direct allocation
page read and write
3610000
direct allocation
page read and write
947000
heap
page read and write
4FFC000
stack
page read and write
6150000
heap
page read and write
D40000
heap
page read and write
9D4000
trusted library allocation
page read and write
9E0000
heap
page read and write
26C8000
trusted library allocation
page read and write
3593000
direct allocation
page read and write
AC9000
heap
page read and write
54A7000
trusted library allocation
page read and write
37AE000
direct allocation
page read and write
There are 220 hidden memdumps, click here to show them.