IOC Report
7vwfhMuUQg.exe

loading gif

Files

File Path
Type
Category
Malicious
7vwfhMuUQg.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7vwfhMuUQg.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\7vwfhMuUQg.exe
"C:\Users\user\Desktop\7vwfhMuUQg.exe"
 malicious
C:\Users\user\Desktop\7vwfhMuUQg.exe
"C:\Users\user\Desktop\7vwfhMuUQg.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\7vwfhMuUQg.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
132.226.247.73
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://103.130.147.85
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\7vwfhMuUQg_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
532000
remote allocation
page execute and read and write
 malicious
3889000
trusted library allocation
page read and write
 malicious
2591000
trusted library allocation
page read and write
 malicious
23A0000
heap
page read and write
2416000
trusted library allocation
page read and write
CF2000
trusted library allocation
page read and write
900000
heap
page read and write
6CB0000
heap
page read and write
71AE000
stack
page read and write
CDD000
trusted library allocation
page execute and read and write
2D4F000
unkown
page read and write
263B000
trusted library allocation
page read and write
4D90000
trusted library allocation
page execute and read and write
B3F000
stack
page read and write
5B00000
trusted library allocation
page read and write
A90000
heap
page read and write
28F0000
heap
page read and write
49D000
stack
page read and write
2480000
heap
page execute and read and write
2643000
trusted library allocation
page read and write
4CE1000
trusted library allocation
page read and write
87E000
stack
page read and write
5AEE000
stack
page read and write
5B64000
heap
page read and write
81F000
stack
page read and write
72AE000
stack
page read and write
4D50000
heap
page read and write
886000
trusted library allocation
page execute and read and write
51E3000
heap
page read and write
5430000
trusted library allocation
page read and write
531C000
stack
page read and write
E80000
trusted library allocation
page execute and read and write
2B74000
heap
page read and write
A08000
heap
page read and write
81D000
trusted library allocation
page execute and read and write
5A6F000
stack
page read and write
E7E000
stack
page read and write
23F4000
trusted library allocation
page read and write
26CC000
trusted library allocation
page read and write
4F7000
stack
page read and write
E30000
trusted library allocation
page read and write
2396000
trusted library allocation
page read and write
57EE000
stack
page read and write
2A00000
heap
page read and write
2690000
trusted library allocation
page read and write
470000
unkown
page readonly
26D8000
trusted library allocation
page read and write
5B25000
heap
page read and write
5293000
trusted library allocation
page read and write
2760000
trusted library allocation
page read and write
2694000
trusted library allocation
page read and write
45C000
stack
page read and write
5180000
heap
page read and write
4E7E000
trusted library allocation
page read and write
4CCB000
trusted library allocation
page read and write
26D0000
trusted library allocation
page read and write
2750000
trusted library allocation
page read and write
26E0000
trusted library allocation
page read and write
4E77000
trusted library allocation
page read and write
612D000
stack
page read and write
530000
remote allocation
page execute and read and write
2B5C000
heap
page read and write
510000
heap
page read and write
5B30000
heap
page read and write
4D60000
heap
page read and write
52B0000
trusted library allocation
page read and write
6F2E000
stack
page read and write
2770000
heap
page read and write
5CEE000
stack
page read and write
26F4000
trusted library allocation
page read and write
A4E000
stack
page read and write
800000
trusted library allocation
page read and write
3597000
trusted library allocation
page read and write
53F0000
trusted library allocation
page execute and read and write
4CDE000
trusted library allocation
page read and write
6CBE000
heap
page read and write
4D8C000
trusted library allocation
page read and write
2425000
trusted library allocation
page read and write
4E60000
trusted library allocation
page read and write
6F0000
heap
page read and write
5E6F000
stack
page read and write
29BE000
unkown
page read and write
4DAD000
stack
page read and write
CED000
trusted library allocation
page execute and read and write
5E2D000
stack
page read and write
283D000
stack
page read and write
5FDC000
stack
page read and write
CFA000
trusted library allocation
page execute and read and write
51EC000
heap
page read and write
91A000
heap
page read and write
5280000
trusted library allocation
page read and write
9B4000
heap
page read and write
E90000
heap
page read and write
CF6000
trusted library allocation
page execute and read and write
5340000
heap
page read and write
5330000
heap
page read and write
94A000
heap
page read and write
CC0000
trusted library allocation
page read and write
56EE000
stack
page read and write
6DEE000
stack
page read and write
2656000
trusted library allocation
page read and write
26F0000
heap
page execute and read and write
6EEE000
stack
page read and write
5320000
trusted library section
page readonly
4A0D000
stack
page read and write
2990000
trusted library allocation
page read and write
C6F000
stack
page read and write
A37000
heap
page read and write
4D8A000
trusted library allocation
page read and write
5291000
trusted library allocation
page read and write
98D000
heap
page read and write
A60000
heap
page read and write
CE0000
trusted library allocation
page read and write
2394000
trusted library allocation
page read and write
898000
heap
page read and write
2430000
trusted library allocation
page read and write
2715000
trusted library allocation
page read and write
4CED000
trusted library allocation
page read and write
2970000
heap
page read and write
2390000
trusted library allocation
page read and write
4E80000
heap
page read and write
5F0000
heap
page read and write
CD0000
trusted library allocation
page read and write
E2E000
stack
page read and write
9FE000
stack
page read and write
CAE000
stack
page read and write
5420000
trusted library allocation
page execute and read and write
D02000
trusted library allocation
page read and write
620000
heap
page read and write
26E8000
trusted library allocation
page read and write
5CF0000
heap
page read and write
5BAE000
stack
page read and write
7DE000
stack
page read and write
992000
heap
page read and write
275F000
trusted library allocation
page read and write
272C000
trusted library allocation
page read and write
268C000
trusted library allocation
page read and write
79F000
stack
page read and write
702F000
stack
page read and write
2671000
trusted library allocation
page read and write
997000
trusted library allocation
page execute and read and write
CD3000
trusted library allocation
page execute and read and write
952000
heap
page read and write
88A000
trusted library allocation
page execute and read and write
5B40000
heap
page read and write
5F0000
heap
page read and write
4B30000
heap
page read and write
2EB0000
heap
page read and write
813000
trusted library allocation
page execute and read and write
5BEE000
stack
page read and write
D0B000
trusted library allocation
page execute and read and write
582E000
stack
page read and write
287F000
stack
page read and write
A10000
heap
page read and write
4CE6000
trusted library allocation
page read and write
60E0000
heap
page read and write
890000
heap
page read and write
A30000
heap
page read and write
1FB000
stack
page read and write
2683000
trusted library allocation
page read and write
5B20000
heap
page read and write
2EC0000
heap
page read and write
2765000
trusted library allocation
page read and write
51EA000
heap
page read and write
CD4000
trusted library allocation
page read and write
97C000
heap
page read and write
26FF000
trusted library allocation
page read and write
716E000
stack
page read and write
29FE000
stack
page read and write
4CF2000
trusted library allocation
page read and write
2450000
trusted library allocation
page read and write
8F7000
stack
page read and write
6B0000
heap
page read and write
880000
trusted library allocation
page read and write
2404000
trusted library allocation
page read and write
2B73000
heap
page read and write
502E000
stack
page read and write
4A4E000
stack
page read and write
4DD0000
heap
page execute and read and write
706E000
stack
page read and write
73B2000
trusted library allocation
page read and write
992000
trusted library allocation
page read and write
596D000
stack
page read and write
4D20000
trusted library allocation
page read and write
52A0000
trusted library section
page read and write
4E70000
trusted library allocation
page read and write
75E000
stack
page read and write
2636000
trusted library allocation
page read and write
592E000
stack
page read and write
258F000
stack
page read and write
5D3E000
heap
page read and write
E97000
heap
page read and write
512E000
stack
page read and write
26E0000
trusted library allocation
page read and write
4E83000
heap
page read and write
2380000
trusted library allocation
page read and write
3591000
trusted library allocation
page read and write
882000
trusted library allocation
page read and write
4FDE000
stack
page read and write
628000
heap
page read and write
590000
heap
page read and write
810000
trusted library allocation
page read and write
A00000
trusted library allocation
page execute and read and write
23EC000
stack
page read and write
A95000
heap
page read and write
910000
heap
page read and write
23FE000
trusted library allocation
page read and write
4E0000
heap
page read and write
6AE000
stack
page read and write
5130000
trusted library section
page read and write
4CC0000
trusted library allocation
page read and write
501E000
stack
page read and write
4A80000
heap
page read and write
5296000
trusted library allocation
page read and write
4A60000
trusted library allocation
page read and write
98B000
heap
page read and write
35B9000
trusted library allocation
page read and write
52C0000
trusted library allocation
page read and write
60DC000
stack
page read and write
7FE000
stack
page read and write
2B50000
heap
page read and write
273C000
stack
page read and write
4D8F000
trusted library allocation
page read and write
9D2000
heap
page read and write
2740000
trusted library allocation
page read and write
4D80000
trusted library allocation
page read and write
58A000
stack
page read and write
820000
trusted library allocation
page read and write
3881000
trusted library allocation
page read and write
CF0000
trusted library allocation
page read and write
958000
heap
page read and write
8BA000
heap
page read and write
4D00000
trusted library allocation
page read and write
270A000
trusted library allocation
page read and write
91E000
heap
page read and write
2411000
trusted library allocation
page read and write
472000
unkown
page readonly
2A20000
heap
page read and write
497D000
stack
page read and write
814000
trusted library allocation
page read and write
8C7000
heap
page read and write
D07000
trusted library allocation
page execute and read and write
830000
heap
page read and write
4EDE000
stack
page read and write
4D70000
heap
page execute and read and write
4E7C000
trusted library allocation
page read and write
26E4000
trusted library allocation
page read and write
D20000
heap
page read and write
293D000
stack
page read and write
99B000
trusted library allocation
page execute and read and write
6F5000
heap
page read and write
2E4F000
stack
page read and write
26DC000
trusted library allocation
page read and write
9B0000
trusted library allocation
page read and write
2419000
trusted library allocation
page read and write
51E8000
heap
page read and write
622F000
stack
page read and write
26D4000
trusted library allocation
page read and write
5AAE000
stack
page read and write
468C000
stack
page read and write
918000
heap
page read and write
2881000
trusted library allocation
page read and write
There are 252 hidden memdumps, click here to show them.