IOC Report
j6OUc3S2uP.exe

loading gif

Files

File Path
Type
Category
Malicious
j6OUc3S2uP.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_j6OUc3S2uP.exe_ec5336e1243d7bf75db30977b6a261e84eea9ad_ad983b20_5cee530d-8701-4278-8562-3cfde6cd09e4\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC43.tmp.dmp
Mini DuMP crash report, 16 streams, Wed Jul 3 14:27:53 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD9C.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBDDB.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\j6OUc3S2uP.exe
"C:\Users\user\Desktop\j6OUc3S2uP.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5800 -s 1020
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://upx.sf.net
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
132.226.8.169
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://reallyfreegeoip.orgP
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.8.169

IPs

IP
Domain
Country
Malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
132.226.8.169
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
FileDirectory
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
ProgramId
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
FileId
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
LowerCaseLongPath
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
LongPathHash
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
Name
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
OriginalFileName
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
Publisher
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
Version
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
BinFileVersion
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
BinaryType
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
ProductName
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
ProductVersion
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
LinkDate
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
BinProductVersion
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
AppxPackageFullName
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
AppxPackageRelativeId
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
Size
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
Language
\REGISTRY\A\{f2614513-160b-220a-9f8e-3cb522b0b38e}\Root\InventoryApplicationFile\j6ouc3s2up.exe|3417ce135fca55c1
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018000DDABBE6B3
There are 28 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1D22110B000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
1D2311C9000
trusted library allocation
page read and write
 malicious
2C51000
trusted library allocation
page read and write
 malicious
7FFD34590000
trusted library allocation
page read and write
E40000
heap
page read and write
2758000
heap
page read and write
6255000
heap
page read and write
2700000
heap
page read and write
2D4E000
trusted library allocation
page read and write
650E000
stack
page read and write
16EDFE000
stack
page read and write
2D92000
trusted library allocation
page read and write
F70000
trusted library allocation
page read and write
693C000
stack
page read and write
1D21F6E5000
heap
page read and write
1D21F675000
heap
page read and write
9FB000
stack
page read and write
64CE000
stack
page read and write
1D21F5E0000
trusted library section
page read and write
29CE000
stack
page read and write
29E0000
heap
page read and write
2C1C000
stack
page read and write
7FF48C190000
trusted library allocation
page execute and read and write
2DDC000
trusted library allocation
page read and write
FB0000
heap
page read and write
513E000
trusted library allocation
page read and write
2D4A000
trusted library allocation
page read and write
2DA6000
trusted library allocation
page read and write
668E000
stack
page read and write
2BCF000
heap
page read and write
FB8000
heap
page read and write
634D000
stack
page read and write
5134000
trusted library allocation
page read and write
2D10000
trusted library allocation
page read and write
F40000
trusted library allocation
page read and write
7FFD34729000
trusted library allocation
page read and write
1D21F42C000
heap
page read and write
1D2210C0000
heap
page execute and read and write
2D8E000
trusted library allocation
page read and write
3C79000
trusted library allocation
page read and write
697E000
stack
page read and write
E50000
heap
page read and write
12AE000
stack
page read and write
638E000
stack
page read and write
620F000
stack
page read and write
6268000
heap
page read and write
7FFD34710000
trusted library allocation
page read and write
2340000
heap
page read and write
2D56000
trusted library allocation
page read and write
7FFD34740000
trusted library allocation
page read and write
2D13000
trusted library allocation
page read and write
5D8E000
stack
page read and write
1D21F463000
heap
page read and write
1D2211B3000
trusted library allocation
page read and write
CF7000
stack
page read and write
56C0000
trusted library allocation
page read and write
1D2210F0000
trusted library allocation
page read and write
1D21F5A0000
trusted library allocation
page read and write
7FFD34574000
trusted library allocation
page read and write
16ECF3000
stack
page read and write
11AE000
stack
page read and write
274E000
stack
page read and write
5144000
trusted library allocation
page read and write
FDA000
heap
page read and write
1D2310D1000
trusted library allocation
page read and write
F80000
trusted library allocation
page read and write
7FFD3458D000
trusted library allocation
page execute and read and write
2870000
heap
page read and write
2750000
heap
page read and write
2A6F000
unkown
page read and write
610E000
stack
page read and write
1D21F670000
heap
page read and write
41CF000
stack
page read and write
7FFD3474E000
trusted library allocation
page read and write
7FFD34626000
trusted library allocation
page read and write
3C51000
trusted library allocation
page read and write
16F4FE000
stack
page read and write
56AE000
stack
page read and write
FE6000
heap
page read and write
5F8F000
stack
page read and write
683C000
stack
page read and write
1D21F4F9000
heap
page read and write
6A80000
heap
page read and write
2B6F000
stack
page read and write
4DEC000
stack
page read and write
7FFD34720000
trusted library allocation
page read and write
2850000
heap
page read and write
2C20000
trusted library allocation
page read and write
1D2312A3000
trusted library allocation
page read and write
2BCF000
heap
page read and write
2C40000
heap
page read and write
5180000
heap
page execute and read and write
658E000
stack
page read and write
F50000
heap
page read and write
7FFD345CC000
trusted library allocation
page execute and read and write
6BCE000
stack
page read and write
1D21F465000
heap
page read and write
5159000
trusted library allocation
page read and write
F82000
trusted library allocation
page read and write
16F1FC000
stack
page read and write
7FFD34573000
trusted library allocation
page execute and read and write
230D000
stack
page read and write
2DF8000
trusted library allocation
page read and write
2DA2000
trusted library allocation
page read and write
2E18000
trusted library allocation
page read and write
7FFD34570000
trusted library allocation
page read and write
1D21F300000
heap
page read and write
EE7000
heap
page read and write
566D000
stack
page read and write
2DCE000
trusted library allocation
page read and write
2A70000
trusted library allocation
page read and write
2D07000
trusted library allocation
page read and write
2B70000
heap
page read and write
7FFD3457D000
trusted library allocation
page execute and read and write
1D21F400000
heap
page read and write
7FFD34750000
trusted library allocation
page read and write
5165000
trusted library allocation
page read and write
1070000
heap
page read and write
298F000
stack
page read and write
2D52000
trusted library allocation
page read and write
7FFD34582000
trusted library allocation
page read and write
F97000
trusted library allocation
page execute and read and write
1D21F590000
trusted library allocation
page read and write
628B000
heap
page read and write
7FFD34724000
trusted library allocation
page read and write
1D21F4E0000
heap
page read and write
2CF3000
trusted library allocation
page read and write
2DB3000
trusted library allocation
page read and write
60CE000
stack
page read and write
2A80000
heap
page read and write
2C30000
trusted library allocation
page read and write
23CE000
unkown
page read and write
5E8F000
stack
page read and write
3C57000
trusted library allocation
page read and write
6210000
heap
page read and write
16F5FF000
stack
page read and write
F10000
heap
page read and write
7FFD34594000
trusted library allocation
page read and write
E9E000
stack
page read and write
1D21F270000
unkown
page readonly
273E000
stack
page read and write
5FCE000
stack
page read and write
109E000
heap
page read and write
1D2310D7000
trusted library allocation
page read and write
7FFD3462C000
trusted library allocation
page execute and read and write
2ADE000
stack
page read and write
51FE000
stack
page read and write
F8A000
trusted library allocation
page execute and read and write
2C26000
trusted library allocation
page read and write
6A7F000
stack
page read and write
27AC000
heap
page read and write
E55000
heap
page read and write
16F3FE000
stack
page read and write
F60000
trusted library allocation
page read and write
5156000
trusted library allocation
page read and write
1D21F491000
heap
page read and write
1D239100000
trusted library allocation
page read and write
7FFD3459D000
trusted library allocation
page execute and read and write
27A0000
heap
page read and write
7FFD34630000
trusted library allocation
page execute and read and write
1D21F272000
unkown
page readonly
52B0000
heap
page read and write
2E0A000
trusted library allocation
page read and write
1D21F420000
heap
page read and write
1D21F6E0000
heap
page read and write
7FFD34620000
trusted library allocation
page read and write
2BDE000
stack
page read and write
2380000
heap
page read and write
2D9E000
trusted library allocation
page read and write
7FFD3459B000
trusted library allocation
page execute and read and write
269C000
stack
page read and write
62A3000
heap
page read and write
16F0FF000
stack
page read and write
1D21F3E0000
heap
page read and write
63CE000
stack
page read and write
1D21F570000
trusted library allocation
page read and write
2A60000
trusted library allocation
page execute and read and write
2D96000
trusted library allocation
page read and write
16EFFF000
stack
page read and write
2D2B000
trusted library allocation
page read and write
2DFC000
trusted library allocation
page read and write
2DC1000
trusted library allocation
page read and write
2C80000
heap
page read and write
7FFD34580000
trusted library allocation
page read and write
562E000
stack
page read and write
7FFD34572000
trusted library allocation
page read and write
52C0000
heap
page read and write
1D21F5A3000
trusted library allocation
page read and write
1D21F501000
heap
page read and write
23D0000
heap
page read and write
2CFB000
trusted library allocation
page read and write
2D04000
trusted library allocation
page read and write
1D2210D1000
trusted library allocation
page read and write
1D220F90000
heap
page read and write
F64000
trusted library allocation
page read and write
7FFD34690000
trusted library allocation
page execute and read and write
F9B000
trusted library allocation
page execute and read and write
26FD000
stack
page read and write
2A50000
trusted library allocation
page read and write
F86000
trusted library allocation
page execute and read and write
623D000
heap
page read and write
D60000
heap
page read and write
7FFD34730000
trusted library allocation
page read and write
2A90000
heap
page execute and read and write
654E000
stack
page read and write
EE0000
heap
page read and write
F92000
trusted library allocation
page read and write
2D9A000
trusted library allocation
page read and write
1D21F44B000
heap
page read and write
5190000
trusted library allocation
page read and write
1D21F496000
heap
page read and write
F6D000
trusted library allocation
page execute and read and write
1D21F520000
heap
page read and write
1D2398D0000
heap
page read and write
6ACD000
stack
page read and write
2D42000
trusted library allocation
page read and write
1D21F4E8000
heap
page read and write
1D23139C000
trusted library allocation
page read and write
55EE000
stack
page read and write
7FFD34656000
trusted library allocation
page execute and read and write
265C000
stack
page read and write
EDD000
stack
page read and write
F63000
trusted library allocation
page execute and read and write
2D8A000
trusted library allocation
page read and write
6282000
heap
page read and write
6239000
heap
page read and write
1D221424000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
2D40000
trusted library allocation
page read and write
16EEFE000
stack
page read and write
1D21F5D0000
heap
page execute and read and write
27C3000
heap
page read and write
5151000
trusted library allocation
page read and write
7FFD34770000
trusted library allocation
page read and write
16F2FE000
stack
page read and write
7FFD34760000
trusted library allocation
page execute and read and write
There are 227 hidden memdumps, click here to show them.