IOC Report
PM114079-990528.exe

loading gif

Files

File Path
Type
Category
Malicious
PM114079-990528.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PM114079-990528.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PM114079-990528.exe
"C:\Users\user\Desktop\PM114079-990528.exe"
 malicious
C:\Users\user\Desktop\PM114079-990528.exe
"C:\Users\user\Desktop\PM114079-990528.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\PM114079-990528.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
http://checkip.dyndns.org/
193.122.6.168
https://aka.ms/dotnet-warnings/
unknown
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://checkip.dyndns.org/q
unknown
https://aka.ms/serializationformat-binary-obsolete
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org
unknown
https://aka.ms/binaryformatter
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PM114079-990528_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4179000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
2991000
trusted library allocation
page read and write
 malicious
6AB000
stack
page read and write
A7A000
heap
page read and write
64BD000
stack
page read and write
5CFC000
stack
page read and write
5FEE000
stack
page read and write
56AE000
trusted library allocation
page read and write
D9E000
stack
page read and write
2ACB000
trusted library allocation
page read and write
3171000
trusted library allocation
page read and write
154E000
stack
page read and write
5B50000
heap
page read and write
1391000
heap
page read and write
5AF0000
heap
page read and write
26B3000
trusted library allocation
page execute and read and write
5C5E000
trusted library allocation
page read and write
2AF5000
trusted library allocation
page read and write
2FB0000
heap
page read and write
6590000
heap
page read and write
134A000
heap
page read and write
4A8C000
stack
page read and write
26A0000
trusted library allocation
page read and write
2B59000
trusted library allocation
page read and write
5D60000
trusted library allocation
page execute and read and write
2840000
heap
page read and write
827E000
stack
page read and write
2A3A000
trusted library allocation
page read and write
5970000
heap
page execute and read and write
53BE000
stack
page read and write
6188000
heap
page read and write
1584000
heap
page read and write
5BC7000
heap
page read and write
34A0000
heap
page read and write
274E000
stack
page read and write
615F000
heap
page read and write
32FD000
stack
page read and write
59DE000
stack
page read and write
26D2000
trusted library allocation
page read and write
5C50000
trusted library allocation
page read and write
5C76000
trusted library allocation
page read and write
537E000
stack
page read and write
6870000
heap
page read and write
150E000
stack
page read and write
2950000
trusted library allocation
page read and write
63EF000
stack
page read and write
5B60000
heap
page read and write
64AE000
stack
page read and write
A10000
heap
page read and write
5950000
trusted library allocation
page read and write
6170000
heap
page read and write
6595000
heap
page read and write
294F000
stack
page read and write
26C0000
trusted library allocation
page read and write
15B2000
trusted library allocation
page read and write
3050000
trusted library allocation
page read and write
2700000
trusted library allocation
page read and write
2A8F000
trusted library allocation
page read and write
FE5000
heap
page read and write
15A0000
trusted library allocation
page read and write
26B4000
trusted library allocation
page read and write
39E0000
heap
page read and write
5DAD000
stack
page read and write
3663000
heap
page read and write
83DE000
stack
page read and write
676B000
stack
page read and write
5C56000
trusted library allocation
page read and write
A5F000
stack
page read and write
ECF000
stack
page read and write
865F000
stack
page read and write
A20000
heap
page read and write
2B4B000
trusted library allocation
page read and write
56E0000
trusted library allocation
page read and write
65D6000
heap
page read and write
4DE0000
trusted library allocation
page read and write
170E000
stack
page read and write
2A3F000
trusted library allocation
page read and write
56B1000
trusted library allocation
page read and write
51B0000
heap
page execute and read and write
B0D000
heap
page read and write
15BA000
trusted library allocation
page execute and read and write
1300000
heap
page read and write
76AE000
heap
page read and write
A1E000
stack
page read and write
A45000
heap
page read and write
FE0000
heap
page read and write
2B02000
trusted library allocation
page read and write
E00000
heap
page read and write
68BE000
stack
page read and write
1343000
heap
page read and write
5C5A000
trusted library allocation
page read and write
3040000
trusted library allocation
page read and write
595C000
trusted library allocation
page read and write
2B60000
trusted library allocation
page read and write
5C6E000
stack
page read and write
130E000
heap
page read and write
5AE0000
trusted library allocation
page read and write
5D30000
trusted library allocation
page execute and read and write
2ADB000
trusted library allocation
page read and write
2ADF000
trusted library allocation
page read and write
26E0000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
841E000
stack
page read and write
6540000
trusted library allocation
page read and write
4F90000
heap
page read and write
2AE7000
trusted library allocation
page read and write
5D00000
heap
page read and write
15CB000
trusted library allocation
page execute and read and write
2A93000
trusted library allocation
page read and write
2A37000
trusted library allocation
page read and write
305F000
trusted library allocation
page read and write
602E000
stack
page read and write
626D000
stack
page read and write
2F4D000
stack
page read and write
1570000
trusted library allocation
page read and write
AD3000
heap
page read and write
57B0000
heap
page read and write
5B00000
trusted library section
page read and write
130A000
heap
page read and write
2970000
trusted library allocation
page read and write
69BE000
stack
page read and write
4EAE000
stack
page read and write
5EEE000
stack
page read and write
5C60000
trusted library allocation
page read and write
2980000
heap
page execute and read and write
FC0000
heap
page read and write
6165000
heap
page read and write
595A000
trusted library allocation
page read and write
D5F000
stack
page read and write
524C000
stack
page read and write
15B6000
trusted library allocation
page execute and read and write
3280000
trusted library allocation
page read and write
A64000
heap
page read and write
595F000
trusted library allocation
page read and write
180F000
stack
page read and write
4E39000
trusted library allocation
page read and write
5C71000
trusted library allocation
page read and write
646F000
stack
page read and write
569B000
trusted library allocation
page read and write
13C7000
heap
page read and write
5D10000
trusted library section
page readonly
5B6E000
stack
page read and write
C5E000
stack
page read and write
85C000
stack
page read and write
1594000
trusted library allocation
page read and write
15A3000
trusted library allocation
page read and write
26DA000
trusted library allocation
page execute and read and write
A40000
heap
page read and write
855E000
stack
page read and write
DC7000
heap
page read and write
3665000
heap
page read and write
2B39000
trusted library allocation
page read and write
E52000
unkown
page readonly
612E000
stack
page read and write
2ACF000
trusted library allocation
page read and write
15C7000
trusted library allocation
page execute and read and write
2A8B000
trusted library allocation
page read and write
2A82000
trusted library allocation
page read and write
13B5000
heap
page read and write
65B0000
heap
page read and write
A6E000
heap
page read and write
2A52000
trusted library allocation
page read and write
2966000
trusted library allocation
page read and write
1590000
trusted library allocation
page read and write
BC0000
heap
page read and write
2AD3000
trusted library allocation
page read and write
533D000
stack
page read and write
7A7000
stack
page read and write
5C5C000
trusted library allocation
page read and write
5C73000
trusted library allocation
page read and write
2AD7000
trusted library allocation
page read and write
E50000
unkown
page readonly
15F0000
trusted library allocation
page execute and read and write
F5A000
stack
page read and write
5A6F000
stack
page read and write
62EE000
stack
page read and write
4171000
trusted library allocation
page read and write
3020000
heap
page execute and read and write
534C000
stack
page read and write
2830000
trusted library allocation
page execute and read and write
AE0000
heap
page read and write
2A54000
trusted library allocation
page read and write
6169000
heap
page read and write
56D5000
trusted library allocation
page read and write
26EB000
trusted library allocation
page execute and read and write
76A0000
heap
page read and write
3640000
heap
page read and write
15C2000
trusted library allocation
page read and write
2964000
trusted library allocation
page read and write
4E36000
trusted library allocation
page read and write
26E2000
trusted library allocation
page read and write
5960000
trusted library allocation
page execute and read and write
1580000
heap
page read and write
56C2000
trusted library allocation
page read and write
3662000
heap
page read and write
26B0000
trusted library allocation
page read and write
2A42000
trusted library allocation
page read and write
DC0000
heap
page read and write
2B3D000
trusted library allocation
page read and write
4E1E000
trusted library allocation
page read and write
62AF000
stack
page read and write
39B9000
trusted library allocation
page read and write
A30000
heap
page read and write
FD0000
heap
page read and write
26BD000
trusted library allocation
page execute and read and write
5C90000
trusted library allocation
page read and write
4E24000
trusted library allocation
page read and write
364C000
heap
page read and write
5EAE000
stack
page read and write
2AE3000
trusted library allocation
page read and write
5D6F000
stack
page read and write
686C000
stack
page read and write
15AD000
trusted library allocation
page execute and read and write
5690000
trusted library allocation
page read and write
642E000
stack
page read and write
4E31000
trusted library allocation
page read and write
B3F000
heap
page read and write
2A97000
trusted library allocation
page read and write
A9E000
stack
page read and write
3010000
trusted library allocation
page read and write
56D0000
trusted library allocation
page read and write
8290000
trusted library allocation
page read and write
2670000
heap
page read and write
3410000
heap
page read and write
26E7000
trusted library allocation
page execute and read and write
4EEE000
stack
page read and write
518E000
stack
page read and write
383E000
stack
page read and write
2FEE000
stack
page read and write
A58000
heap
page read and write
BC8000
heap
page read and write
5ADE000
stack
page read and write
3997000
trusted library allocation
page read and write
56B6000
trusted library allocation
page read and write
4E00000
heap
page read and write
8F0000
heap
page read and write
57A0000
heap
page read and write
5770000
trusted library allocation
page read and write
2FF0000
heap
page read and write
5CA0000
trusted library allocation
page read and write
A87000
heap
page read and write
3991000
trusted library allocation
page read and write
851E000
stack
page read and write
51A0000
trusted library allocation
page read and write
159D000
trusted library allocation
page execute and read and write
6130000
heap
page read and write
A50000
heap
page read and write
4E14000
trusted library allocation
page read and write
56BD000
trusted library allocation
page read and write
3030000
trusted library allocation
page read and write
658E000
stack
page read and write
340E000
stack
page read and write
57B3000
heap
page read and write
26D6000
trusted library allocation
page execute and read and write
282C000
stack
page read and write
26D0000
trusted library allocation
page read and write
65AE000
stack
page read and write
3060000
heap
page read and write
316F000
stack
page read and write
35AF000
unkown
page read and write
ADE000
stack
page read and write
9D0000
heap
page read and write
82DE000
stack
page read and write
5C80000
trusted library section
page read and write
2960000
trusted library allocation
page read and write
1384000
heap
page read and write
1593000
trusted library allocation
page execute and read and write
7DA2000
trusted library allocation
page read and write
4E45000
trusted library allocation
page read and write
1600000
heap
page read and write
65A0000
heap
page read and write
1336000
heap
page read and write
2A6D000
trusted library allocation
page read and write
2FFE000
unkown
page read and write
89D000
stack
page read and write
12F7000
stack
page read and write
15B0000
trusted library allocation
page read and write
15C0000
trusted library allocation
page read and write
15E0000
trusted library allocation
page read and write
5D20000
heap
page read and write
2B1D000
trusted library allocation
page read and write
There are 272 hidden memdumps, click here to show them.