IOC Report
scan copy.exe

loading gif

Files

File Path
Type
Category
Malicious
scan copy.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\scan copy.exe.log
CSV text
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\scan copy.exe
"C:\Users\user\Desktop\scan copy.exe"
 malicious
C:\Users\user\Desktop\scan copy.exe
"C:\Users\user\Desktop\scan copy.exe"
 malicious

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
https://reallyfreegeoip.org/xml/8.46.123.33p
unknown
http://checkip.dyndns.org/
132.226.8.169
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.8.169

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
132.226.8.169
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\scan copy_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
140002000
remote allocation
page execute and read and write
 malicious
3742000
trusted library allocation
page read and write
 malicious
13C65000
trusted library allocation
page read and write
 malicious
3501000
trusted library allocation
page read and write
 malicious
E50000
heap
page read and write
37D7000
trusted library allocation
page read and write
3B00000
trusted library allocation
page read and write
1CF00000
heap
page read and write
386A000
trusted library allocation
page read and write
DF2000
stack
page read and write
EAB000
heap
page read and write
7B5000
heap
page read and write
177E000
stack
page read and write
7FFB4B51C000
trusted library allocation
page execute and read and write
7FFB4B48D000
trusted library allocation
page execute and read and write
1810000
heap
page read and write
E78000
heap
page read and write
13501000
trusted library allocation
page read and write
5D2000
unkown
page readonly
7FFB4B462000
trusted library allocation
page read and write
1CD00000
heap
page read and write
3732000
trusted library allocation
page read and write
36FB000
trusted library allocation
page read and write
7FFB4B500000
trusted library allocation
page read and write
366B000
trusted library allocation
page read and write
7D0000
heap
page read and write
1D1E0000
trusted library section
page read and write
1C13E000
stack
page read and write
5D0000
unkown
page readonly
1E24F000
stack
page read and write
1905000
heap
page read and write
36B8000
trusted library allocation
page read and write
1EA8E000
stack
page read and write
36E7000
trusted library allocation
page read and write
2CD0000
heap
page execute and read and write
381E000
trusted library allocation
page read and write
2C23000
trusted library allocation
page read and write
7FFB4B570000
trusted library allocation
page execute and read and write
7B0000
heap
page read and write
7FFB4B4BC000
trusted library allocation
page execute and read and write
E98000
heap
page read and write
135A1000
trusted library allocation
page read and write
1E68D000
stack
page read and write
7FFB4B484000
trusted library allocation
page read and write
EDC000
heap
page read and write
E70000
heap
page read and write
1CDD7000
heap
page read and write
1C580000
heap
page read and write
7FFB4B473000
trusted library allocation
page read and write
3612000
trusted library allocation
page read and write
1900000
heap
page read and write
7FFB4B480000
trusted library allocation
page read and write
37EA000
trusted library allocation
page read and write
790000
heap
page read and write
E8C000
heap
page read and write
1C5E0000
heap
page read and write
140000000
remote allocation
page execute and read and write
EC0000
heap
page read and write
7FFB4B47D000
trusted library allocation
page execute and read and write
7FFB4B463000
trusted library allocation
page execute and read and write
1C58E000
stack
page read and write
1358B000
trusted library allocation
page read and write
2CF0000
heap
page read and write
35EC000
trusted library allocation
page read and write
EB1000
heap
page read and write
3A5E000
stack
page read and write
7FFB4B67D000
trusted library allocation
page read and write
7FFB4B650000
trusted library allocation
page read and write
36A8000
trusted library allocation
page read and write
13B7B000
trusted library allocation
page read and write
37F3000
trusted library allocation
page read and write
7FFB4B470000
trusted library allocation
page read and write
18E0000
trusted library allocation
page read and write
7FFB4B48B000
trusted library allocation
page execute and read and write
7FFB4B657000
trusted library allocation
page read and write
7FFB4B474000
trusted library allocation
page read and write
7FFB4B45D000
trusted library allocation
page execute and read and write
137E000
stack
page read and write
7FFB4B5F0000
trusted library allocation
page read and write
1CE14000
heap
page read and write
F0D000
heap
page read and write
7FFB4B653000
trusted library allocation
page read and write
7FFB4B50C000
trusted library allocation
page execute and read and write
7FFB4B46D000
trusted library allocation
page execute and read and write
1CFD4000
heap
page read and write
7FFB4B460000
trusted library allocation
page read and write
7FFB4B47D000
trusted library allocation
page execute and read and write
36AC000
trusted library allocation
page read and write
E20000
heap
page read and write
1ECE0000
heap
page read and write
13570000
trusted library allocation
page read and write
E80000
heap
page read and write
3602000
trusted library allocation
page read and write
1C1DC000
stack
page read and write
1C150000
heap
page read and write
1C610000
heap
page execute and read and write
7FFB4B506000
trusted library allocation
page read and write
E25000
heap
page read and write
370E000
trusted library allocation
page read and write
185A000
heap
page read and write
7FFB4B536000
trusted library allocation
page execute and read and write
7D5000
heap
page read and write
1DE4F000
stack
page read and write
13594000
trusted library allocation
page read and write
3667000
trusted library allocation
page read and write
7FFB4B454000
trusted library allocation
page read and write
7FFB4B4AC000
trusted library allocation
page execute and read and write
7FFB4B610000
trusted library allocation
page execute and read and write
365A000
trusted library allocation
page read and write
7FFB4B625000
trusted library allocation
page read and write
DED000
stack
page read and write
37D1000
trusted library allocation
page read and write
7FFB4B660000
trusted library allocation
page read and write
3642000
trusted library allocation
page read and write
3640000
trusted library section
page read and write
E86000
heap
page read and write
37EF000
trusted library allocation
page read and write
7FF4C5480000
trusted library allocation
page execute and read and write
1C180000
heap
page read and write
13A71000
trusted library allocation
page read and write
3663000
trusted library allocation
page read and write
1C7A0000
heap
page read and write
7FFB4B470000
trusted library allocation
page read and write
37CC000
trusted library allocation
page read and write
E40000
trusted library allocation
page read and write
7FFB4B600000
trusted library allocation
page read and write
1C8F0000
heap
page read and write
2C40000
heap
page execute and read and write
7FFB4B464000
trusted library allocation
page read and write
13A68000
trusted library allocation
page read and write
7FFB4B679000
trusted library allocation
page read and write
7FFB4B684000
trusted library allocation
page read and write
7FFB4B628000
trusted library allocation
page read and write
7FFB4B660000
trusted library allocation
page execute and read and write
7FFB4B46D000
trusted library allocation
page execute and read and write
1E28E000
stack
page read and write
710000
heap
page read and write
1CCFD000
stack
page read and write
1BA90000
trusted library allocation
page read and write
30FE000
stack
page read and write
36B4000
trusted library allocation
page read and write
35FA000
trusted library allocation
page read and write
7FFB4B630000
trusted library allocation
page read and write
7FFB4B620000
trusted library allocation
page execute and read and write
3670000
trusted library allocation
page read and write
36BC000
trusted library allocation
page read and write
7FFB4B640000
trusted library allocation
page read and write
7FFB4B630000
trusted library allocation
page execute and read and write
E00000
heap
page read and write
1850000
heap
page read and write
EC3000
heap
page read and write
ED8000
heap
page read and write
EAA000
heap
page read and write
1CE2B000
heap
page read and write
7FFB4B620000
trusted library allocation
page read and write
1E64E000
stack
page read and write
6B0000
heap
page read and write
1DA4E000
stack
page read and write
7FFB4B516000
trusted library allocation
page read and write
2C20000
trusted library allocation
page read and write
7FFB4B640000
trusted library allocation
page read and write
1BC7D000
stack
page read and write
3A61000
trusted library allocation
page read and write
36B0000
trusted library allocation
page read and write
1790000
trusted library allocation
page read and write
35EF000
trusted library allocation
page read and write
E60000
trusted library allocation
page read and write
2CCF000
stack
page read and write
1C690000
heap
page read and write
7FFB4B580000
trusted library allocation
page execute and read and write
7FFB4B453000
trusted library allocation
page execute and read and write
7E0000
heap
page read and write
3831000
trusted library allocation
page read and write
1C790000
heap
page read and write
E00000
heap
page read and write
34B0000
heap
page read and write
1CE1B000
heap
page read and write
7FFB4B600000
trusted library allocation
page read and write
1CDD5000
heap
page read and write
36C0000
trusted library allocation
page read and write
1D0E000
stack
page read and write
7FFB4B510000
trusted library allocation
page execute and read and write
7FFB4B460000
trusted library allocation
page read and write
7FFB4B520000
trusted library allocation
page execute and read and write
7FFB4B510000
trusted library allocation
page read and write
136E000
stack
page read and write
F0F000
heap
page read and write
7FFB4B610000
trusted library allocation
page execute and read and write
F69000
heap
page read and write
1C183000
heap
page read and write
372C000
trusted library allocation
page read and write
E30000
heap
page read and write
1CD90000
heap
page read and write
1C560000
trusted library section
page read and write
17B0000
trusted library allocation
page read and write
1CE00000
heap
page read and write
E95000
heap
page read and write
7FFB4B462000
trusted library allocation
page read and write
7FFB4B450000
trusted library allocation
page read and write
3824000
trusted library allocation
page read and write
37E1000
trusted library allocation
page read and write
F13000
heap
page read and write
EEF000
heap
page read and write
EB0000
heap
page read and write
1D64F000
stack
page read and write
7FFB4B546000
trusted library allocation
page execute and read and write
13A61000
trusted library allocation
page read and write
7FFB4B650000
trusted library allocation
page read and write
1C540000
trusted library section
page read and write
EAE000
heap
page read and write
36D4000
trusted library allocation
page read and write
382B000
trusted library allocation
page read and write
EF7000
heap
page read and write
3650000
heap
page execute and read and write
F7D000
heap
page read and write
1C693000
heap
page read and write
There are 206 hidden memdumps, click here to show them.