IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\file.exe.log
CSV text
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
https://duckduckgo.com/chrome_newtab
unknown
https://t.me/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://t.me/freakcodingspot
unknown
https://api.telegram.org
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://api.telegram.org/bot
unknown
http://schemas.xmlsoap.org/soap/encoding/
unknown
https://t.me/TheDyer
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://get.geH
unknown
https://www.ecosia.org/newtab/
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://get.geojs.io
unknown
https://api.tele
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://schemas.xmlsoap.org/wsdl/
unknown
https://get.geojs.io
unknown
https://api.telegram.org/bot6217988193:AAFiJwdcFHDuCM08fAA_dnBQZGLDPSVjUQY/sendDocument
149.154.167.220
https://get.geojs.io/v1/ip/geo.json
104.26.0.100
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://t.me/webster480
unknown
There are 15 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
api.telegram.org
149.154.167.220
 malicious
get.geojs.io
104.26.0.100

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
104.26.0.100
get.geojs.io
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1E394D0B000
trusted library allocation
page read and write
 malicious
1E393384000
heap
page read and write
7FF848F40000
trusted library allocation
page read and write
1E3A5051000
trusted library allocation
page read and write
1E393440000
heap
page execute and read and write
1E3AD8C8000
heap
page read and write
1E3AD8A5000
heap
page read and write
1E3932D1000
heap
page read and write
1E394EEA000
trusted library allocation
page read and write
1E3AE680000
heap
page read and write
7FF848F44000
trusted library allocation
page read and write
1E3AD79D000
heap
page read and write
7FF848D8D000
trusted library allocation
page execute and read and write
1E3931F0000
heap
page read and write
1E3AD553000
heap
page read and write
1E3AD7D2000
heap
page read and write
1E3AD7C9000
heap
page read and write
1E394E73000
trusted library allocation
page read and write
7FF848F71000
trusted library allocation
page read and write
1E3AD5B0000
heap
page execute and read and write
1E3AD84B000
heap
page read and write
1E3AD7EE000
heap
page read and write
7FF848F50000
trusted library allocation
page execute and read and write
1E3932F4000
heap
page read and write
1E393020000
unkown
page readonly
42B5DFE000
stack
page read and write
1E3AD8EC000
heap
page read and write
1E3AD48D000
heap
page read and write
1E3AD7A9000
heap
page read and write
7FF848D74000
trusted library allocation
page read and write
1E3932B0000
heap
page read and write
1E3AD690000
heap
page read and write
1E3AD8D8000
heap
page read and write
42B52FE000
stack
page read and write
42B4DEF000
stack
page read and write
7FF848D70000
trusted library allocation
page read and write
1E394EC4000
trusted library allocation
page read and write
7FF848D9B000
trusted library allocation
page execute and read and write
7FF848D73000
trusted library allocation
page execute and read and write
7FF848F80000
trusted library allocation
page read and write
1E3AD800000
heap
page read and write
1E3AD770000
heap
page read and write
1E394E7B000
trusted library allocation
page read and write
7FF848F60000
trusted library allocation
page execute and read and write
1E3AD8DC000
heap
page read and write
42B5FFD000
stack
page read and write
7FF4D6120000
trusted library allocation
page execute and read and write
1E393020000
unkown
page readonly
1E3AD46E000
heap
page read and write
42B5BFE000
stack
page read and write
1E3AD885000
heap
page read and write
1E394DC6000
trusted library allocation
page read and write
42B53FF000
stack
page read and write
1E394CF9000
trusted library allocation
page read and write
7FF848E56000
trusted library allocation
page execute and read and write
42B5CFD000
stack
page read and write
1E3A52E7000
trusted library allocation
page read and write
1E3AD868000
heap
page read and write
1E3A4EF9000
trusted library allocation
page read and write
1E395095000
trusted library allocation
page read and write
1E393250000
trusted library allocation
page read and write
1E394CF0000
trusted library allocation
page read and write
7FF848D94000
trusted library allocation
page read and write
7FF848D7D000
trusted library allocation
page execute and read and write
1E3AD496000
heap
page read and write
1E3AD881000
heap
page read and write
42B55FC000
stack
page read and write
1E3AD780000
heap
page read and write
1E394E82000
trusted library allocation
page read and write
7FF848D9D000
trusted library allocation
page execute and read and write
1E3AD915000
heap
page read and write
1E3AD48A000
heap
page read and write
1E393480000
heap
page read and write
42B50F3000
stack
page read and write
1E394EFA000
trusted library allocation
page read and write
1E393240000
heap
page read and write
42B56FE000
stack
page read and write
1E3A4EEC000
trusted library allocation
page read and write
1E3A4EDF000
trusted library allocation
page read and write
1E3932F1000
heap
page read and write
7FF848E2C000
trusted library allocation
page execute and read and write
1E3931D0000
heap
page read and write
1E394D25000
trusted library allocation
page read and write
1E3931B0000
heap
page read and write
7FF848DCC000
trusted library allocation
page execute and read and write
42B51FF000
stack
page read and write
1E3AD513000
heap
page read and write
1E3930D0000
heap
page read and write
1E393372000
heap
page read and write
1E393450000
trusted library allocation
page read and write
1E3AD895000
heap
page read and write
7FF848E26000
trusted library allocation
page read and write
1E3A4CB1000
trusted library allocation
page read and write
1E394E0E000
trusted library allocation
page read and write
1E39331E000
heap
page read and write
42B59FD000
stack
page read and write
1E3A4CF7000
trusted library allocation
page read and write
1E393387000
heap
page read and write
7FF848E90000
trusted library allocation
page execute and read and write
1E3932DC000
heap
page read and write
1E3934E5000
heap
page read and write
1E394C91000
trusted library allocation
page read and write
7FF848F20000
trusted library allocation
page read and write
1E3AD460000
heap
page read and write
1E3A4EE7000
trusted library allocation
page read and write
1E3AE691000
heap
page read and write
1E3AD816000
heap
page read and write
1E3934E0000
heap
page read and write
1E3AD874000
heap
page read and write
1E3A4CA0000
trusted library allocation
page read and write
1E3934EB000
heap
page read and write
1E3AD8F0000
heap
page read and write
1E3AD8CB000
heap
page read and write
42B54FE000
stack
page read and write
1E393270000
trusted library allocation
page read and write
1E394EC8000
trusted library allocation
page read and write
7FF848D80000
trusted library allocation
page read and write
7FF848F82000
trusted library allocation
page read and write
1E3A4C91000
trusted library allocation
page read and write
1E3AD535000
heap
page read and write
7FF848E30000
trusted library allocation
page execute and read and write
1E3AD858000
heap
page read and write
1E3AD7B2000
heap
page read and write
7FF848F10000
trusted library allocation
page read and write
1E39331C000
heap
page read and write
1E394CFB000
trusted library allocation
page read and write
1E3AD4CD000
heap
page read and write
7FF848F30000
trusted library allocation
page read and write
1E393245000
heap
page read and write
1E3AD7D7000
heap
page read and write
7FF848E20000
trusted library allocation
page read and write
1E3A4EF3000
trusted library allocation
page read and write
1E3AD532000
heap
page read and write
1E3A50D7000
trusted library allocation
page read and write
1E3AD483000
heap
page read and write
1E3ACCC0000
trusted library allocation
page read and write
7FF848D72000
trusted library allocation
page read and write
1E394EB8000
trusted library allocation
page read and write
1E3932B6000
heap
page read and write
1E3AD789000
heap
page read and write
1E394D07000
trusted library allocation
page read and write
1E393370000
heap
page read and write
7FF848D90000
trusted library allocation
page read and write
1E3AD825000
heap
page read and write
42B60FE000
stack
page read and write
1E3AE69A000
heap
page read and write
42B57FE000
stack
page read and write
1E3AD4C1000
heap
page read and write
1E3AD7DD000
heap
page read and write
1E394EB6000
trusted library allocation
page read and write
42B58FE000
stack
page read and write
1E3A4ED9000
trusted library allocation
page read and write
42B5EFE000
stack
page read and write
1E3AD7B9000
heap
page read and write
1E3AD883000
heap
page read and write
1E393022000
unkown
page readonly
There are 146 hidden memdumps, click here to show them.