IOC Report
JgRVqrgNs4.exe

loading gif

Files

File Path
Type
Category
Malicious
JgRVqrgNs4.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JgRVqrgNs4.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\JgRVqrgNs4.exe
"C:\Users\user\Desktop\JgRVqrgNs4.exe"
 malicious
C:\Users\user\Desktop\JgRVqrgNs4.exe
"C:\Users\user\Desktop\JgRVqrgNs4.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\JgRVqrgNs4.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://103.130.147.85
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\JgRVqrgNs4_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2FE1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
42C9000
trusted library allocation
page read and write
 malicious
5CB0000
trusted library section
page readonly
5790000
trusted library allocation
page read and write
6510000
trusted library allocation
page read and write
145A000
heap
page read and write
30E6000
trusted library allocation
page read and write
1A80000
heap
page execute and read and write
113E000
stack
page read and write
579D000
stack
page read and write
1680000
trusted library allocation
page read and write
64DE000
stack
page read and write
166B000
trusted library allocation
page execute and read and write
5950000
trusted library allocation
page read and write
54F0000
trusted library allocation
page read and write
312E000
trusted library allocation
page read and write
1643000
trusted library allocation
page read and write
59AE000
stack
page read and write
5D97000
heap
page read and write
5CC0000
heap
page read and write
163D000
trusted library allocation
page execute and read and write
1660000
trusted library allocation
page read and write
5DD1000
heap
page read and write
3147000
trusted library allocation
page read and write
64F0000
trusted library allocation
page read and write
57E0000
trusted library allocation
page read and write
1450000
trusted library allocation
page read and write
5810000
heap
page execute and read and write
53FD000
stack
page read and write
11A0000
heap
page read and write
5766000
trusted library allocation
page read and write
60DE000
stack
page read and write
13CE000
stack
page read and write
1A64000
trusted library allocation
page read and write
5910000
trusted library allocation
page read and write
6530000
heap
page read and write
54D0000
trusted library allocation
page read and write
1337000
stack
page read and write
5A1E000
stack
page read and write
5DDA000
heap
page read and write
2C9E000
unkown
page read and write
1650000
trusted library allocation
page read and write
DD0000
heap
page read and write
2DEE000
stack
page read and write
1537000
heap
page read and write
3094000
trusted library allocation
page read and write
144E000
stack
page read and write
599E000
stack
page read and write
663E000
stack
page read and write
2DA0000
trusted library allocation
page read and write
30EA000
trusted library allocation
page read and write
1370000
heap
page read and write
1630000
trusted library allocation
page read and write
5780000
trusted library allocation
page read and write
5A20000
heap
page execute and read and write
2D53000
heap
page read and write
5A10000
trusted library allocation
page read and write
AEC000
stack
page read and write
2C50000
heap
page read and write
1A90000
trusted library allocation
page read and write
2CE0000
heap
page read and write
511C000
stack
page read and write
5C1E000
stack
page read and write
308F000
trusted library allocation
page read and write
7C3E000
stack
page read and write
42C1000
trusted library allocation
page read and write
1662000
trusted library allocation
page read and write
59B0000
trusted library section
page read and write
155A000
heap
page read and write
686A000
heap
page read and write
32C1000
trusted library allocation
page read and write
165A000
trusted library allocation
page execute and read and write
58E0000
heap
page read and write
5620000
heap
page read and write
54C6000
trusted library allocation
page read and write
165A000
trusted library allocation
page execute and read and write
13AD000
heap
page read and write
774E000
heap
page read and write
57DE000
stack
page read and write
7D3E000
stack
page read and write
2FDE000
stack
page read and write
313A000
trusted library allocation
page read and write
699E000
stack
page read and write
7070000
heap
page read and write
61DE000
stack
page read and write
52FB000
stack
page read and write
318C000
trusted library allocation
page read and write
1677000
heap
page read and write
3190000
trusted library allocation
page read and write
58C0000
trusted library allocation
page read and write
6B5E000
stack
page read and write
311E000
trusted library allocation
page read and write
D5F000
stack
page read and write
3FE1000
trusted library allocation
page read and write
1405000
heap
page read and write
29ED000
stack
page read and write
14CD000
heap
page read and write
5960000
heap
page read and write
5CD0000
heap
page read and write
6F6E000
stack
page read and write
30BF000
trusted library allocation
page read and write
797E000
stack
page read and write
33D0000
trusted library allocation
page read and write
5C21000
trusted library allocation
page read and write
2EC0000
trusted library allocation
page read and write
575E000
stack
page read and write
64E0000
trusted library allocation
page execute and read and write
69DE000
stack
page read and write
5785000
trusted library allocation
page read and write
1633000
trusted library allocation
page execute and read and write
3098000
trusted library allocation
page read and write
548E000
trusted library allocation
page read and write
1667000
trusted library allocation
page execute and read and write
1630000
trusted library allocation
page read and write
1AB0000
heap
page read and write
2D8E000
stack
page read and write
D6B000
stack
page read and write
66DE000
stack
page read and write
62DE000
stack
page read and write
2CDE000
stack
page read and write
DF0000
heap
page read and write
1AAF000
trusted library allocation
page read and write
787D000
stack
page read and write
1A60000
trusted library allocation
page read and write
5A06000
trusted library allocation
page read and write
1634000
trusted library allocation
page read and write
591A000
trusted library allocation
page read and write
30A7000
trusted library allocation
page read and write
5A0C000
trusted library allocation
page read and write
13A4000
heap
page read and write
575E000
trusted library allocation
page read and write
63DE000
stack
page read and write
7740000
heap
page read and write
10F7000
stack
page read and write
28ED000
stack
page read and write
6EE06000
unkown
page readonly
574B000
trusted library allocation
page read and write
30E2000
trusted library allocation
page read and write
1380000
heap
page read and write
146E000
heap
page read and write
EF0000
unkown
page readonly
3136000
trusted library allocation
page read and write
689A000
heap
page read and write
2ED0000
heap
page read and write
65DE000
stack
page read and write
1634000
trusted library allocation
page read and write
309B000
trusted library allocation
page read and write
319F000
trusted library allocation
page read and write
14A2000
heap
page read and write
1667000
trusted library allocation
page execute and read and write
555D000
stack
page read and write
671E000
stack
page read and write
1239000
stack
page read and write
3155000
trusted library allocation
page read and write
695D000
stack
page read and write
5460000
heap
page read and write
1652000
trusted library allocation
page read and write
312A000
trusted library allocation
page read and write
5484000
trusted library allocation
page read and write
685D000
heap
page read and write
2EA0000
trusted library allocation
page execute and read and write
5C23000
trusted library allocation
page read and write
6F2C000
stack
page read and write
7BFE000
stack
page read and write
DE0000
heap
page read and write
4009000
trusted library allocation
page read and write
5772000
trusted library allocation
page read and write
501C000
stack
page read and write
308C000
trusted library allocation
page read and write
17BF000
stack
page read and write
5CAB000
stack
page read and write
6B9E000
stack
page read and write
5494000
trusted library allocation
page read and write
119D000
stack
page read and write
EF2000
unkown
page readonly
C30000
heap
page read and write
1620000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
5C50000
trusted library allocation
page read and write
3100000
heap
page read and write
6640000
heap
page read and write
6C9F000
stack
page read and write
1656000
trusted library allocation
page execute and read and write
681E000
stack
page read and write
30D4000
trusted library allocation
page read and write
79BE000
stack
page read and write
3163000
trusted library allocation
page read and write
6EDF0000
unkown
page readonly
5A0A000
trusted library allocation
page read and write
70BE000
stack
page read and write
54B5000
trusted library allocation
page read and write
14DB000
heap
page read and write
310E000
stack
page read and write
58E3000
heap
page read and write
1460000
heap
page read and write
166B000
trusted library allocation
page execute and read and write
164D000
trusted library allocation
page execute and read and write
2D20000
heap
page read and write
2D3C000
heap
page read and write
706F000
stack
page read and write
30DE000
trusted library allocation
page read and write
6820000
heap
page read and write
2D30000
heap
page read and write
32B0000
heap
page read and write
5900000
heap
page read and write
59DE000
stack
page read and write
2FFF000
unkown
page read and write
6E2C000
stack
page read and write
DC0000
heap
page read and write
B50000
heap
page read and write
3220000
heap
page read and write
11A5000
heap
page read and write
1650000
trusted library allocation
page read and write
54A6000
trusted library allocation
page read and write
6EDF1000
unkown
page execute read
31AC000
trusted library allocation
page read and write
CBF000
stack
page read and write
6851000
heap
page read and write
6EE0D000
unkown
page read and write
54C0000
trusted library allocation
page read and write
3126000
trusted library allocation
page read and write
71BE000
stack
page read and write
1652000
trusted library allocation
page read and write
31C8000
heap
page read and write
1670000
heap
page read and write
6859000
heap
page read and write
163D000
trusted library allocation
page execute and read and write
1A50000
trusted library allocation
page execute and read and write
137F000
stack
page read and write
1540000
heap
page read and write
6EE0F000
unkown
page readonly
1633000
trusted library allocation
page execute and read and write
CC0000
heap
page read and write
5A00000
trusted library allocation
page read and write
54A9000
trusted library allocation
page read and write
1400000
heap
page read and write
6B1E000
stack
page read and write
1690000
heap
page read and write
1662000
trusted library allocation
page read and write
1640000
trusted library allocation
page read and write
D1E000
stack
page read and write
576D000
trusted library allocation
page read and write
6885000
heap
page read and write
1660000
trusted library allocation
page read and write
320F000
stack
page read and write
5744000
trusted library allocation
page read and write
3087000
trusted library allocation
page read and write
5D80000
heap
page read and write
1AA0000
trusted library allocation
page read and write
3122000
trusted library allocation
page read and write
5C40000
trusted library allocation
page read and write
5761000
trusted library allocation
page read and write
16B0000
heap
page read and write
7AFE000
stack
page read and write
1398000
heap
page read and write
AAC000
stack
page read and write
18BE000
stack
page read and write
54C4000
trusted library allocation
page read and write
3FE7000
trusted library allocation
page read and write
5920000
trusted library allocation
page execute and read and write
1A70000
trusted library allocation
page read and write
7ABE000
stack
page read and write
30A4000
trusted library allocation
page read and write
6650000
heap
page read and write
14CF000
heap
page read and write
31C0000
heap
page read and write
1533000
heap
page read and write
5A0E000
trusted library allocation
page read and write
30FF000
stack
page read and write
13C7000
heap
page read and write
C7E000
stack
page read and write
2E90000
heap
page read and write
5C30000
trusted library section
page read and write
1AB7000
heap
page read and write
1390000
heap
page read and write
5740000
trusted library allocation
page read and write
147F000
heap
page read and write
5E80000
trusted library allocation
page execute and read and write
5C26000
trusted library allocation
page read and write
3132000
trusted library allocation
page read and write
591F000
trusted library allocation
page read and write
5DD5000
heap
page read and write
6ADE000
stack
page read and write
591C000
trusted library allocation
page read and write
2EB0000
heap
page execute and read and write
6535000
heap
page read and write
1656000
trusted library allocation
page execute and read and write
30D6000
trusted library allocation
page read and write
There are 279 hidden memdumps, click here to show them.