IOC Report
WER9Fz381n.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\WER9Fz381n.exe
"C:\Users\user\Desktop\WER9Fz381n.exe"
 malicious
C:\Users\user\Desktop\WER9Fz381n.exe
"C:\Users\user\Desktop\WER9Fz381n.exe"
 malicious

URLs

Name
IP
Malicious
http://dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onion
unknown
 malicious
http://www.exabot.com/go/robot)Opera/9.80
unknown
 malicious
http://dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onion9e146be9-c76a-4720-bcdb-53011b8
unknown
 malicious
http://dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.oniont
unknown
 malicious
http://dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onionhttp://dg2sz7pxs7llf2t25fsbutlv
unknown
 malicious
http://dg2sz7pxs7llf2t25fsbutlvvrjij4pmojugn75cmxnvoshmju6dzcad.onionS-1-5-21-2246122658-3693405117-
unknown
 malicious
http://search.msn.com/msnbot.htm)net/http:
unknown
http://help.yahoo.com/help/us/ysea
unknown
http://ww82.trythisgid.com/
199.59.243.227
http://invalidlog.txtlookup
unknown
http://search.msn.com/msnbot.htm)msnbot/1.1
unknown
http://search.msn.com/msn
unknown
http://gais.cs.ccu.edu.tw/robot.php)Gulper
unknown
https://raw.githubusercontent.c
unknown
http://www.google.com/bot.html)tls:
unknown
http://www.spidersoft.com)Wget/1.9
unknown
http://www.archive.org/details/archive.org_bot)Opera/9.80
unknown
http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
unknown
http://yandex.com/bots)Opera/9.51
unknown
http://www.google.com/bot.html)Mozilla/5.0
unknown
http://www.google.com/bot.h
unknown
http://https://_bad_pdb_file.pdb
unknown
http://archive.org/details/archive.org_bot)Mozilla/5.0
unknown
https://www.google.com
unknown
http://devlog.gregarius.net/docs/ua)Links
unknown
http://misc.yahoo.com.cn/help.html)QueryPerformanceFrequency
unknown
http://www.bloglines.com)F
unknown
https://cdn.discordapp.com/attachments/1023299088751538198/1023549843135795230/to
unknown
http://www.alltheweb.com/help/webmaster/crawler)POLARIS/6.01(BREW
unknown
http://www.google.com/feedfetcher.html)HKLM
unknown
http://grub.org)Mozilla/5.0
unknown
http://crl.g
unknown
https://blockchain.infoindex
unknown
http://search.ms
unknown
http://yandex.com/bots)Opera/9.80
unknown
https://trythisgid.com/app-install-failureinsufficient
unknown
https://turnitin.com/robot/crawlerinfo.html)gentraceback
unknown
http://www.avantbrowser.com)MOT-V9mm/00.62
unknown
https://trythisgid.com/app-install-failure
46.8.8.100
https://blockstream.info/apiinvalid
unknown
http://search.msn.com/msnbot.htm)pkcs7:
unknown
http://www.alexa.com/help/webmasters;
unknown
http://www.google.com/adsbot.html)Encountered
unknown
https://cdn.discordapp.com/attachments/925779512644497442/933676145558310953/obfs4proxy.exehttps://g
unknown
http://www.googlebot.com/bot.html)Links
unknown
http://ww82.trythisgid.com/Fri
unknown
There are 36 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ww82.trythisgid.com
unknown
 malicious
s-part-0017.t-0009.t-msedge.net
13.107.246.45
trythisgid.com
46.8.8.100
63214.bodis.com
199.59.243.227

IPs

IP
Domain
Country
Malicious
199.59.243.227
63214.bodis.com
United States
46.8.8.100
trythisgid.com
Russian Federation

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
Servers
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
UUID
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
FirstInstallDate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
ServiceVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
PGDSE
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
ServersVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
OSCaption
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
OSArchitecture
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
IsAdmin
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
AV
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
PatchTime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
CPU
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
GPU
There are 3 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3700000
direct allocation
page read and write
 malicious
37F0000
direct allocation
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
400000
unkown
page execute and read and write
 malicious
327A000
direct allocation
page execute and read and write
 malicious
336A000
direct allocation
page execute and read and write
 malicious
13C36000
direct allocation
page read and write
13C0E000
direct allocation
page read and write
347B1000
heap
page read and write
13D79000
direct allocation
page read and write
2E80000
direct allocation
page execute and read and write
13D38000
direct allocation
page read and write
C7C000
unkown
page execute and read and write
13C08000
direct allocation
page read and write
13C46000
direct allocation
page read and write
3713000
direct allocation
page read and write
13C0C000
direct allocation
page read and write
EEA000
heap
page read and write
13D30000
direct allocation
page read and write
13D72000
direct allocation
page read and write
A7C000
unkown
page execute and read and write
13CB4000
direct allocation
page read and write
13D0C000
direct allocation
page read and write
3466F000
stack
page read and write
13CCE000
direct allocation
page read and write
F0B000
heap
page read and write
DCD000
heap
page read and write
13D5A000
direct allocation
page read and write
EEA000
heap
page read and write
F0A000
heap
page read and write
13CC4000
direct allocation
page read and write
3D7A000
direct allocation
page read and write
13D00000
direct allocation
page read and write
13CFA000
direct allocation
page read and write
13C8C000
direct allocation
page read and write
37FE000
direct allocation
page read and write
F0E000
heap
page read and write
13C92000
direct allocation
page read and write
13C70000
direct allocation
page read and write
13C48000
direct allocation
page read and write
13BEE000
stack
page read and write
37F1000
direct allocation
page read and write
2B0E000
stack
page read and write
13CDA000
direct allocation
page read and write
13D2E000
direct allocation
page read and write
F12000
heap
page read and write
13C58000
direct allocation
page read and write
73D06000
unkown
page readonly
C29000
unkown
page execute and read and write
EDF000
heap
page read and write
13C72000
direct allocation
page read and write
D80000
heap
page read and write
CA0000
heap
page read and write
13D62000
direct allocation
page read and write
349B000
direct allocation
page execute and read and write
13C12000
direct allocation
page read and write
13CB4000
direct allocation
page read and write
DCD000
heap
page read and write
13C9C000
direct allocation
page read and write
73CF0000
unkown
page readonly
13C64000
direct allocation
page read and write
13C72000
direct allocation
page read and write
29FE000
stack
page read and write
13C82000
direct allocation
page read and write
3715000
direct allocation
page read and write
345BF000
stack
page read and write
13C26000
direct allocation
page read and write
400000
unkown
page readonly
2A40000
heap
page read and write
13D3A000
direct allocation
page read and write
2B50000
heap
page read and write
13C4C000
direct allocation
page read and write
1F0000
heap
page read and write
358B000
direct allocation
page execute and read and write
2A70000
heap
page read and write
13D08000
direct allocation
page read and write
E32000
direct allocation
page read and write
401000
unkown
page execute read
13CDA000
direct allocation
page read and write
13D26000
direct allocation
page read and write
13D1E000
direct allocation
page read and write
1F7000
heap
page read and write
3447F000
stack
page read and write
13C76000
direct allocation
page read and write
2A3D000
stack
page read and write
13CE4000
direct allocation
page read and write
13D1A000
direct allocation
page read and write
13C66000
direct allocation
page read and write
13D5C000
direct allocation
page read and write
13C42000
direct allocation
page read and write
DC5000
heap
page read and write
D90000
heap
page read and write
13C70000
direct allocation
page read and write
13C74000
direct allocation
page read and write
13C84000
direct allocation
page read and write
D95000
heap
page read and write
C8B000
unkown
page execute and read and write
111F000
stack
page read and write
13D82000
direct allocation
page read and write
13C84000
direct allocation
page read and write
1F0000
heap
page read and write
347AF000
stack
page read and write
41D000
unkown
page execute read
2A50000
heap
page read and write
4015000
direct allocation
page read and write
37F3000
direct allocation
page read and write
13CF0000
direct allocation
page read and write
13CA4000
direct allocation
page read and write
1F5000
heap
page read and write
2980000
heap
page read and write
420000
unkown
page write copy
13D4E000
direct allocation
page read and write
13CB6000
direct allocation
page read and write
13C14000
direct allocation
page read and write
E70000
heap
page read and write
4018000
direct allocation
page read and write
400000
unkown
page readonly
13D0A000
direct allocation
page read and write
13C40000
direct allocation
page read and write
13CA2000
direct allocation
page read and write
13CC8000
direct allocation
page read and write
13D10000
direct allocation
page read and write
36A9000
direct allocation
page execute and read and write
13D22000
direct allocation
page read and write
19B000
stack
page read and write
E9F000
heap
page read and write
13D7C000
direct allocation
page read and write
13B1F000
stack
page read and write
13C50000
direct allocation
page read and write
3710000
direct allocation
page read and write
13CD6000
direct allocation
page read and write
13CBE000
direct allocation
page read and write
DCE000
heap
page read and write
13D68000
direct allocation
page read and write
13C88000
direct allocation
page read and write
13CE6000
direct allocation
page read and write
13D60000
direct allocation
page read and write
EA2000
heap
page read and write
9C000
stack
page read and write
13C3E000
direct allocation
page read and write
13C0C000
direct allocation
page read and write
13CF6000
direct allocation
page read and write
33DFF000
stack
page read and write
13CA6000
direct allocation
page read and write
FDF000
stack
page read and write
13C9C000
direct allocation
page read and write
F0A000
heap
page read and write
E02000
heap
page read and write
13CEC000
direct allocation
page read and write
3423F000
stack
page read and write
13C3C000
direct allocation
page read and write
C8E000
unkown
page execute and read and write
DFA000
heap
page read and write
13B0F000
stack
page read and write
3442E000
stack
page read and write
13C19000
direct allocation
page read and write
DFD000
heap
page read and write
9C000
stack
page read and write
13CE0000
direct allocation
page read and write
DEA000
heap
page read and write
13C24000
direct allocation
page read and write
73D0D000
unkown
page read and write
13C88000
direct allocation
page read and write
13CAE000
direct allocation
page read and write
D97000
heap
page read and write
13CE4000
direct allocation
page read and write
C26000
unkown
page execute and read and write
ED9000
heap
page read and write
13CAC000
direct allocation
page read and write
13C57000
direct allocation
page read and write
3433F000
stack
page read and write
35EB000
direct allocation
page execute and read and write
DDE000
stack
page read and write
345C1000
heap
page read and write
13C1E000
direct allocation
page read and write
13C02000
direct allocation
page read and write
13CAA000
direct allocation
page read and write
DA0000
heap
page read and write
DC8000
heap
page read and write
34710000
heap
page read and write
13C20000
direct allocation
page read and write
101E000
stack
page read and write
D70000
heap
page read and write
2B4E000
stack
page read and write
13D28000
direct allocation
page read and write
13C40000
direct allocation
page read and write
13C16000
direct allocation
page read and write
346C0000
trusted library allocation
page read and write
13C2B000
direct allocation
page read and write
13C36000
direct allocation
page read and write
13C02000
direct allocation
page read and write
C26000
unkown
page execute and read and write
13C90000
direct allocation
page read and write
33CFF000
stack
page read and write
13D48000
direct allocation
page read and write
33CFF000
stack
page read and write
13C7E000
direct allocation
page read and write
13D5E000
direct allocation
page read and write
ED8000
heap
page read and write
13C86000
direct allocation
page read and write
96C000
unkown
page readonly
13C1E000
direct allocation
page read and write
13C0A000
direct allocation
page read and write
13C65000
direct allocation
page read and write
13D32000
direct allocation
page read and write
13CDC000
direct allocation
page read and write
13C80000
direct allocation
page read and write
13C86000
direct allocation
page read and write
37F7000
direct allocation
page read and write
13D2A000
direct allocation
page read and write
28C0000
direct allocation
page read and write
73D0F000
unkown
page readonly
13CF4000
direct allocation
page read and write
13C5A000
direct allocation
page read and write
13CC2000
direct allocation
page read and write
34FB000
direct allocation
page execute and read and write
13C54000
direct allocation
page read and write
13C7C000
direct allocation
page read and write
13C2B000
direct allocation
page read and write
13CE2000
direct allocation
page read and write
13CB0000
direct allocation
page read and write
DFE000
heap
page read and write
2A8F000
stack
page read and write
13CF2000
direct allocation
page read and write
2B60000
heap
page read and write
3740000
direct allocation
page read and write
3F25000
direct allocation
page read and write
DFD000
heap
page read and write
33EFF000
stack
page read and write
2ACE000
stack
page read and write
C29000
unkown
page execute and read and write
41D000
unkown
page execute read
EDE000
stack
page read and write
2900000
direct allocation
page read and write
EAF000
heap
page read and write
13B54000
direct allocation
page read and write
DD3000
heap
page read and write
13CF2000
direct allocation
page read and write
13B24000
direct allocation
page read and write
13C38000
direct allocation
page read and write
13CF8000
direct allocation
page read and write
13CF4000
direct allocation
page read and write
13C24000
direct allocation
page read and write
13C38000
direct allocation
page read and write
73D0F000
unkown
page readonly
420000
unkown
page write copy
13C5E000
direct allocation
page read and write
73D06000
unkown
page readonly
13C08000
direct allocation
page read and write
EDA000
heap
page read and write
2970000
heap
page read and write
13B9E000
stack
page read and write
346AE000
stack
page read and write
3706000
direct allocation
page read and write
13CCA000
direct allocation
page read and write
E7A000
heap
page read and write
343EF000
stack
page read and write
13CB2000
direct allocation
page read and write
34A20000
heap
page read and write
13D6A000
direct allocation
page read and write
73D0D000
unkown
page read and write
13A1F000
stack
page read and write
C8B000
unkown
page execute and read and write
13C7E000
direct allocation
page read and write
28D2000
direct allocation
page read and write
3452F000
stack
page read and write
ED6000
heap
page read and write
13CD2000
direct allocation
page read and write
13BCE000
stack
page read and write
13C6D000
direct allocation
page read and write
13D1C000
direct allocation
page read and write
96C000
unkown
page readonly
E9F000
heap
page read and write
E60000
direct allocation
page read and write
13C3A000
direct allocation
page read and write
73CF0000
unkown
page readonly
13C31000
direct allocation
page read and write
F10000
heap
page read and write
13C9A000
direct allocation
page read and write
3799000
direct allocation
page execute and read and write
C7C000
unkown
page execute and read and write
28CA000
direct allocation
page read and write
DCD000
heap
page read and write
13C94000
direct allocation
page read and write
73CF1000
unkown
page execute read
E2A000
direct allocation
page read and write
3487F000
stack
page read and write
13C68000
direct allocation
page read and write
13D6E000
direct allocation
page read and write
13C3E000
direct allocation
page read and write
370C000
direct allocation
page read and write
3456E000
stack
page read and write
13C18000
direct allocation
page read and write
13CCA000
direct allocation
page read and write
13D14000
direct allocation
page read and write
33DFE000
stack
page read and write
13CC0000
direct allocation
page read and write
13C78000
direct allocation
page read and write
13C6E000
direct allocation
page read and write
C8E000
unkown
page execute and read and write
A7C000
unkown
page execute and read and write
13C4E000
direct allocation
page read and write
116F000
stack
page read and write
DC5000
heap
page read and write
13C68000
direct allocation
page read and write
13C3A000
direct allocation
page read and write
13C0E000
direct allocation
page read and write
13C10000
direct allocation
page read and write
13D12000
direct allocation
page read and write
2F70000
direct allocation
page execute and read and write
DEA000
heap
page read and write
2960000
heap
page read and write
13C9E000
direct allocation
page read and write
13C10000
direct allocation
page read and write
13CAC000
direct allocation
page read and write
3E6A000
direct allocation
page read and write
3477D000
stack
page read and write
13D36000
direct allocation
page read and write
E9F000
heap
page read and write
13CEC000
direct allocation
page read and write
E1E000
stack
page read and write
13C06000
direct allocation
page read and write
3F28000
direct allocation
page read and write
3700000
direct allocation
page read and write
DD3000
heap
page read and write
E20000
direct allocation
page read and write
73CF1000
unkown
page execute read
13D64000
direct allocation
page read and write
13C5C000
direct allocation
page read and write
2B7B000
heap
page execute and read and write
13D18000
direct allocation
page read and write
F12000
heap
page read and write
401000
unkown
page execute read
13C14000
direct allocation
page read and write
295D000
stack
page read and write
13C52000
direct allocation
page read and write
348B0000
trusted library allocation
page read and write
13C8E000
direct allocation
page read and write
13C16000
direct allocation
page read and write
13CC6000
direct allocation
page read and write
346C0000
direct allocation
page read and write
13C74000
direct allocation
page read and write
EEA000
heap
page read and write
F0A000
heap
page read and write
13D4A000
direct allocation
page read and write
295E000
stack
page read and write
DFD000
heap
page read and write
13C42000
direct allocation
page read and write
EDF000
heap
page read and write
13C00000
direct allocation
page read and write
13CCE000
direct allocation
page read and write
345C0000
heap
page read and write
3437E000
stack
page read and write
13CE2000
direct allocation
page read and write
13D66000
direct allocation
page read and write
347B0000
heap
page read and write
344BE000
stack
page read and write
EAB000
heap
page read and write
13C90000
direct allocation
page read and write
DA8000
heap
page read and write
2A8C000
heap
page execute and read and write
13B4E000
stack
page read and write
29BE000
stack
page read and write
13CD8000
direct allocation
page read and write
EDF000
heap
page read and write
346C0000
trusted library allocation
page read and write
13C4C000
direct allocation
page read and write
106F000
stack
page read and write
13C26000
direct allocation
page read and write
13C12000
direct allocation
page read and write
13C04000
direct allocation
page read and write
13D56000
direct allocation
page read and write
EC2000
heap
page read and write
13D34000
direct allocation
page read and write
13D0E000
direct allocation
page read and write
19C000
stack
page read and write
3830000
direct allocation
page read and write
13CEE000
direct allocation
page read and write
E7E000
heap
page read and write
There are 369 hidden memdumps, click here to show them.