IOC Report
llD1w4ROY5.exe

loading gif

Files

File Path
Type
Category
Malicious
llD1w4ROY5.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SzvWIzD.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\aut4D89.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut4DE8.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\hurtling
data
dropped
C:\Users\user\AppData\Local\Temp\spiketop
ASCII text, with very long lines (28740), with no line terminators
modified
C:\Users\user\AppData\Roaming\SzvWIzD\SzvWIzD.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\llD1w4ROY5.exe
"C:\Users\user\Desktop\llD1w4ROY5.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\llD1w4ROY5.exe"
 malicious
C:\Users\user\AppData\Roaming\SzvWIzD\SzvWIzD.exe
"C:\Users\user\AppData\Roaming\SzvWIzD\SzvWIzD.exe"
malicious
C:\Users\user\AppData\Roaming\SzvWIzD\SzvWIzD.exe
"C:\Users\user\AppData\Roaming\SzvWIzD\SzvWIzD.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.12.205
https://api.ipif8f
unknown
https://api.ipify.org
unknown
https://api.ipify.org/p
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/T
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://api.ipify.org
unknown
http://ip-api.com
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
 malicious
api.ipify.org
104.26.12.205

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
104.26.12.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SzvWIzD
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
3FE0000
direct allocation
page read and write
 malicious
EE2000
unkown
page readonly
4E10000
trusted library allocation
page execute and read and write
31E0000
trusted library allocation
page read and write
17FF000
heap
page read and write
32CE000
trusted library allocation
page read and write
3359000
trusted library allocation
page read and write
6B0E000
stack
page read and write
1648000
heap
page read and write
538E000
stack
page read and write
4251000
trusted library allocation
page read and write
43E000
system
page execute and read and write
4339000
direct allocation
page read and write
42E9000
direct allocation
page read and write
14D4000
trusted library allocation
page read and write
530E000
stack
page read and write
1647000
heap
page read and write
1604000
trusted library allocation
page read and write
6D70000
trusted library allocation
page read and write
2EDA000
trusted library allocation
page execute and read and write
433D000
direct allocation
page read and write
6D80000
trusted library allocation
page read and write
F60000
trusted library allocation
page read and write
13CE000
stack
page read and write
DF0000
heap
page read and write
14E4000
trusted library allocation
page read and write
315F000
stack
page read and write
42E9000
direct allocation
page read and write
6D90000
trusted library allocation
page read and write
6B9E000
stack
page read and write
FE0000
heap
page execute and read and write
6D67000
trusted library allocation
page read and write
31B6000
trusted library allocation
page read and write
3251000
trusted library allocation
page read and write
4193000
direct allocation
page read and write
6ECE000
stack
page read and write
5710000
heap
page read and write
1583000
heap
page read and write
1610000
heap
page read and write
2EEB000
trusted library allocation
page execute and read and write
3000000
trusted library allocation
page read and write
31D0000
trusted library allocation
page read and write
D80000
trusted library allocation
page read and write
B95000
heap
page read and write
13B0000
heap
page read and write
3326000
trusted library allocation
page read and write
1490000
heap
page read and write
D6F000
stack
page read and write
32B0000
trusted library allocation
page read and write
42ED000
direct allocation
page read and write
6EDF1000
unkown
page execute read
1230000
heap
page read and write
6B5D000
stack
page read and write
1507000
trusted library allocation
page execute and read and write
D8A000
stack
page read and write
1641000
heap
page read and write
688E000
stack
page read and write
6EE0F000
unkown
page readonly
14C0000
trusted library allocation
page read and write
4E7E000
stack
page read and write
A1E000
stack
page read and write
3353000
trusted library allocation
page read and write
6D5F000
stack
page read and write
330F000
trusted library allocation
page read and write
58BE000
stack
page read and write
1568000
heap
page read and write
57BE000
stack
page read and write
14ED000
trusted library allocation
page execute and read and write
641F000
heap
page read and write
22C0000
direct allocation
page execute and read and write
42E9000
direct allocation
page read and write
3211000
trusted library allocation
page read and write
3240000
heap
page read and write
1540000
heap
page read and write
6CDE000
stack
page read and write
319B000
trusted library allocation
page read and write
1833000
heap
page read and write
678D000
stack
page read and write
3341000
trusted library allocation
page read and write
1600000
trusted library allocation
page read and write
6EE06000
unkown
page readonly
210000
unkown
page readonly
16F9000
heap
page read and write
17F0000
heap
page read and write
1285000
heap
page read and write
6DF0000
trusted library allocation
page read and write
AA3000
heap
page read and write
1881000
heap
page read and write
2ECD000
trusted library allocation
page execute and read and write
2F4E000
stack
page read and write
42ED000
direct allocation
page read and write
1641000
heap
page read and write
63D2000
heap
page read and write
1648000
heap
page read and write
64A1000
heap
page read and write
21AE000
stack
page read and write
6EE0000
heap
page read and write
433D000
direct allocation
page read and write
5A3E000
stack
page read and write
71BE000
stack
page read and write
1550000
trusted library allocation
page read and write
189D000
heap
page read and write
13B5000
heap
page read and write
6BDE000
stack
page read and write
22A0000
heap
page read and write
D94000
trusted library allocation
page read and write
1320000
heap
page read and write
435E000
direct allocation
page read and write
185B000
heap
page read and write
520F000
stack
page read and write
DC7000
trusted library allocation
page execute and read and write
1601000
heap
page read and write
38F1000
trusted library allocation
page read and write
4219000
trusted library allocation
page read and write
4070000
direct allocation
page read and write
5770000
heap
page execute and read and write
6EDF0000
unkown
page readonly
28EE000
stack
page read and write
2ED6000
trusted library allocation
page execute and read and write
1630000
heap
page read and write
6A0E000
stack
page read and write
4020000
direct allocation
page read and write
4210000
direct allocation
page read and write
4239000
trusted library allocation
page read and write
319E000
trusted library allocation
page read and write
1560000
heap
page read and write
14E0000
trusted library allocation
page read and write
43AE000
direct allocation
page read and write
3332000
trusted library allocation
page read and write
4339000
direct allocation
page read and write
FC0000
heap
page read and write
2EE0000
trusted library allocation
page read and write
131E000
stack
page read and write
2308000
heap
page read and write
12D0000
heap
page read and write
435E000
direct allocation
page read and write
4210000
direct allocation
page read and write
150B000
trusted library allocation
page execute and read and write
32E8000
trusted library allocation
page read and write
13DB000
stack
page read and write
3010000
trusted library allocation
page read and write
1648000
heap
page read and write
1320000
trusted library allocation
page read and write
5B3F000
stack
page read and write
6D1E000
stack
page read and write
127E000
stack
page read and write
29F000
unkown
page readonly
A5D000
stack
page read and write
31A2000
trusted library allocation
page read and write
DF0000
trusted library allocation
page execute and read and write
EEA000
unkown
page readonly
4193000
direct allocation
page read and write
2D8000
unkown
page readonly
4143000
direct allocation
page read and write
2CF000
unkown
page write copy
96A000
stack
page read and write
1716000
heap
page read and write
ABA000
heap
page read and write
1620000
heap
page read and write
43AE000
direct allocation
page read and write
12D7000
heap
page read and write
63D6000
heap
page read and write
2F58000
trusted library allocation
page read and write
2C5000
unkown
page readonly
1646000
heap
page read and write
3AB0000
heap
page read and write
15A5000
heap
page read and write
312F000
stack
page read and write
15A5000
heap
page read and write
FC9000
stack
page read and write
3261000
trusted library allocation
page read and write
150E000
stack
page read and write
AFE000
heap
page read and write
6DE0000
trusted library allocation
page execute and read and write
15FF000
heap
page read and write
32B8000
trusted library allocation
page read and write
1280000
heap
page read and write
31BD000
trusted library allocation
page read and write
6DD0000
heap
page read and write
2ED2000
trusted library allocation
page read and write
211000
unkown
page execute read
6EE0D000
unkown
page read and write
1578000
heap
page read and write
41C0000
direct allocation
page read and write
140F000
heap
page read and write
15C2000
heap
page read and write
13AE000
stack
page read and write
2FF0000
trusted library allocation
page execute and read and write
332C000
trusted library allocation
page read and write
3345000
trusted library allocation
page read and write
191F000
stack
page read and write
4275000
trusted library allocation
page read and write
211000
unkown
page execute read
1570000
heap
page read and write
3250000
trusted library allocation
page read and write
158A000
heap
page read and write
4020000
direct allocation
page read and write
2300000
heap
page read and write
4143000
direct allocation
page read and write
31AA000
trusted library allocation
page read and write
32EE000
trusted library allocation
page read and write
FF0000
heap
page read and write
1500000
trusted library allocation
page read and write
433D000
direct allocation
page read and write
15E2000
heap
page read and write
59BC000
stack
page read and write
DCB000
trusted library allocation
page execute and read and write
58FE000
stack
page read and write
5723000
heap
page read and write
9D0000
heap
page read and write
510E000
stack
page read and write
3200000
heap
page execute and read and write
A88000
heap
page read and write
2214000
heap
page read and write
2EE7000
trusted library allocation
page execute and read and write
15C2000
heap
page read and write
142D000
heap
page read and write
B90000
heap
page read and write
2F00000
trusted library allocation
page read and write
1D6D000
stack
page read and write
13D4000
heap
page read and write
1648000
heap
page read and write
5700000
trusted library allocation
page read and write
1647000
heap
page read and write
3274000
trusted library allocation
page read and write
2EC0000
trusted library allocation
page read and write
1648000
heap
page read and write
4070000
direct allocation
page read and write
6D98000
trusted library allocation
page read and write
1365000
heap
page read and write
17BC000
heap
page read and write
6D60000
trusted library allocation
page read and write
A80000
heap
page read and write
1530000
trusted library allocation
page execute and read and write
F70000
heap
page read and write
41C0000
direct allocation
page read and write
4FC0000
heap
page execute and read and write
1647000
heap
page read and write
136E000
stack
page read and write
50CE000
stack
page read and write
4FBE000
stack
page read and write
58B0000
heap
page execute and read and write
14DD000
trusted library allocation
page execute and read and write
1602000
heap
page read and write
1040000
heap
page read and write
13FC000
stack
page read and write
1649000
heap
page read and write
2D8000
unkown
page readonly
1601000
heap
page read and write
A60000
heap
page read and write
43AE000
direct allocation
page read and write
1540000
trusted library allocation
page read and write
4143000
direct allocation
page read and write
1603000
trusted library allocation
page execute and read and write
32D2000
trusted library allocation
page read and write
31B1000
trusted library allocation
page read and write
15D1000
heap
page read and write
3330000
trusted library allocation
page read and write
15AD000
heap
page read and write
D93000
trusted library allocation
page execute and read and write
DAD000
trusted library allocation
page execute and read and write
EE0000
unkown
page readonly
F7C000
stack
page read and write
F1E000
stack
page read and write
31AE000
trusted library allocation
page read and write
DA4000
trusted library allocation
page read and write
330B000
trusted library allocation
page read and write
1596000
heap
page read and write
568C000
stack
page read and write
2210000
heap
page read and write
3200000
heap
page execute and read and write
185F000
stack
page read and write
32FD000
trusted library allocation
page read and write
15A3000
heap
page read and write
86C000
stack
page read and write
2EE2000
trusted library allocation
page read and write
5720000
heap
page read and write
15A1000
heap
page read and write
59FE000
stack
page read and write
FE0000
heap
page read and write
6483000
heap
page read and write
12FA000
stack
page read and write
2ED0000
trusted library allocation
page read and write
15B3000
heap
page read and write
1367000
heap
page read and write
1290000
heap
page read and write
15B3000
heap
page read and write
165E000
heap
page read and write
4A8E000
stack
page read and write
4339000
direct allocation
page read and write
28F1000
trusted library allocation
page read and write
D9D000
trusted library allocation
page execute and read and write
FBC000
stack
page read and write
4210000
direct allocation
page read and write
1520000
trusted library allocation
page read and write
AAF000
heap
page read and write
63D0000
heap
page read and write
7F5F0000
trusted library allocation
page execute and read and write
18A9000
heap
page read and write
528C000
stack
page read and write
2C5000
unkown
page readonly
AA8000
heap
page read and write
3246000
trusted library allocation
page read and write
E10000
heap
page read and write
6493000
heap
page read and write
175F000
stack
page read and write
1530000
heap
page read and write
E00000
trusted library allocation
page read and write
1510000
heap
page read and write
3020000
heap
page read and write
41C0000
direct allocation
page read and write
2D3000
unkown
page write copy
42ED000
direct allocation
page read and write
1648000
heap
page read and write
1A40000
heap
page read and write
4193000
direct allocation
page read and write
1338000
heap
page read and write
F5E000
stack
page read and write
2CF000
unkown
page read and write
4211000
trusted library allocation
page read and write
6DC0000
trusted library allocation
page execute and read and write
EC9000
stack
page read and write
4020000
direct allocation
page read and write
4070000
direct allocation
page read and write
15A5000
heap
page read and write
316C000
stack
page read and write
6405000
heap
page read and write
4F7F000
stack
page read and write
1893000
heap
page read and write
64AC000
heap
page read and write
1A30000
trusted library allocation
page execute and read and write
325D000
trusted library allocation
page read and write
1330000
heap
page read and write
13FA000
heap
page read and write
1A2E000
stack
page read and write
160D000
trusted library allocation
page execute and read and write
15DE000
heap
page read and write
210000
unkown
page readonly
400000
system
page execute and read and write
DA0000
trusted library allocation
page read and write
167D000
heap
page read and write
5730000
heap
page read and write
3190000
trusted library allocation
page read and write
3170000
heap
page read and write
1DAE000
stack
page read and write
13BF000
stack
page read and write
435E000
direct allocation
page read and write
15FF000
stack
page read and write
29F000
unkown
page readonly
14D3000
trusted library allocation
page execute and read and write
There are 341 hidden memdumps, click here to show them.