IOC Report
pdusf6w2SJ.exe

loading gif

Files

File Path
Type
Category
Malicious
pdusf6w2SJ.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pdusf6w2SJ.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\pdusf6w2SJ.exe
"C:\Users\user\Desktop\pdusf6w2SJ.exe"
 malicious

URLs

Name
IP
Malicious
147.45.44.221:1912
malicious
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
unknown
https://duckduckgo.com/ac/?q=
unknown
http://tempuri.org/Entity/Id23ResponseD
unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
unknown
http://tempuri.org/Entity/Id12Response
unknown
http://tempuri.org/
unknown
http://tempuri.org/Entity/Id2Response
unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
unknown
http://tempuri.org/Entity/Id21Response
unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
unknown
http://tempuri.org/Entity/Id9
unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
unknown
http://tempuri.org/Entity/Id8
unknown
http://tempuri.org/Entity/Id5
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
unknown
http://tempuri.org/Entity/Id4
unknown
http://tempuri.org/Entity/Id7
unknown
http://tempuri.org/Entity/Id6
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
unknown
http://tempuri.org/Entity/Id19Response
unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat
unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
unknown
http://tempuri.org/Entity/Id15Response
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
unknown
http://tempuri.org/Entity/Id6Response
unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
unknown
https://api.ip.sb/ip
unknown
http://schemas.xmlsoap.org/ws/2004/04/sc
unknown
http://tempuri.org/Entity/Id1ResponseD
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
unknown
http://tempuri.org/Entity/Id9Response
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://tempuri.org/Entity/Id20
unknown
http://tempuri.org/Entity/Id21
unknown
http://tempuri.org/Entity/Id22
unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
unknown
http://tempuri.org/Entity/Id23
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
unknown
http://tempuri.org/Entity/Id24
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
unknown
http://tempuri.org/Entity/Id24Response
unknown
https://www.ecosia.org/newtab/
unknown
http://tempuri.org/Entity/Id1Response
unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
unknown
http://schemas.xmlsoap.org/ws/2004/04/trust
unknown
http://tempuri.org/Entity/Id10
unknown
http://tempuri.org/Entity/Id11
unknown
http://tempuri.org/Entity/Id12
unknown
http://tempuri.org/Entity/Id16Response
unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
unknown
http://tempuri.org/Entity/Id13
unknown
http://tempuri.org/Entity/Id14
unknown
http://tempuri.org/Entity/Id15
unknown
http://tempuri.org/Entity/Id16
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
unknown
http://tempuri.org/Entity/Id17
unknown
http://tempuri.org/Entity/Id18
unknown
http://tempuri.org/Entity/Id5Response
unknown
http://tempuri.org/Entity/Id19
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
unknown
http://tempuri.org/Entity/Id10Response
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
unknown
http://tempuri.org/Entity/Id8Response
unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
unknown
http://schemas.xmlsoap.org/soap/envelope/
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust
unknown
https://duckduckgo.com/chrome_newtabS
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
unknown
http://tempuri.org/Entity/Id3ResponseD
unknown
http://tempuri.org/Entity/Id23Response
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
unknown
http://tempuri.org/D
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
147.45.44.221
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Owner
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
SessionHash
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Sequence
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
RegFiles0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
RegFilesHash

Memdumps

Base Address
Regiontype
Protect
Malicious
E42000
unkown
page readonly
 malicious
31F4000
trusted library allocation
page read and write
 malicious
FC0000
heap
page read and write
303C000
stack
page read and write
564B000
trusted library allocation
page read and write
148A000
trusted library allocation
page execute and read and write
4256000
trusted library allocation
page read and write
17B0000
trusted library allocation
page read and write
32C1000
trusted library allocation
page read and write
158F000
heap
page read and write
5AA0000
trusted library allocation
page read and write
75D2000
trusted library allocation
page read and write
6440000
heap
page read and write
F90000
heap
page read and write
5980000
trusted library allocation
page read and write
75FF000
trusted library allocation
page read and write
3534000
trusted library allocation
page read and write
64B5000
heap
page read and write
3395000
trusted library allocation
page read and write
149B000
trusted library allocation
page execute and read and write
66CE000
stack
page read and write
7E90000
trusted library allocation
page read and write
5753000
heap
page read and write
145D000
trusted library allocation
page execute and read and write
5BA0000
trusted library allocation
page read and write
324E000
trusted library allocation
page read and write
680C000
stack
page read and write
7605000
trusted library allocation
page read and write
5AF0000
trusted library allocation
page read and write
5C10000
trusted library allocation
page read and write
594B000
trusted library allocation
page read and write
596E000
trusted library allocation
page read and write
5971000
trusted library allocation
page read and write
76C0000
trusted library allocation
page read and write
1480000
trusted library allocation
page read and write
5661000
trusted library allocation
page read and write
1800000
trusted library allocation
page read and write
3526000
trusted library allocation
page read and write
64A5000
heap
page read and write
35CE000
trusted library allocation
page read and write
373B000
trusted library allocation
page read and write
3644000
trusted library allocation
page read and write
70FC000
stack
page read and write
7CA6000
heap
page read and write
7AAF000
stack
page read and write
63D2000
heap
page read and write
35DE000
trusted library allocation
page read and write
5644000
trusted library allocation
page read and write
358B000
trusted library allocation
page read and write
36E9000
trusted library allocation
page read and write
7700000
trusted library allocation
page execute and read and write
7C8E000
stack
page read and write
6FFC000
stack
page read and write
1582000
heap
page read and write
3252000
trusted library allocation
page read and write
68DE000
stack
page read and write
7203000
trusted library allocation
page read and write
7610000
trusted library allocation
page read and write
181A000
heap
page read and write
32D8000
trusted library allocation
page read and write
75EF000
trusted library allocation
page read and write
75D9000
trusted library allocation
page read and write
645D000
heap
page read and write
5640000
trusted library allocation
page read and write
43EC000
trusted library allocation
page read and write
565E000
trusted library allocation
page read and write
569E000
trusted library allocation
page read and write
32C9000
trusted library allocation
page read and write
72CB000
heap
page read and write
72B2000
heap
page read and write
6820000
trusted library allocation
page execute and read and write
3256000
trusted library allocation
page read and write
72C2000
heap
page read and write
3665000
trusted library allocation
page read and write
4161000
trusted library allocation
page read and write
5AC0000
trusted library allocation
page read and write
42AF000
trusted library allocation
page read and write
5962000
trusted library allocation
page read and write
5168000
trusted library allocation
page read and write
5D00000
trusted library allocation
page execute and read and write
7366000
heap
page read and write
7602000
trusted library allocation
page read and write
5CBE000
stack
page read and write
593E000
stack
page read and write
36A9000
trusted library allocation
page read and write
3040000
trusted library allocation
page read and write
5B40000
trusted library allocation
page read and write
1490000
trusted library allocation
page read and write
644A000
heap
page read and write
35FF000
trusted library allocation
page read and write
6497000
heap
page read and write
7B80000
heap
page read and write
75D5000
trusted library allocation
page read and write
36F7000
trusted library allocation
page read and write
3599000
trusted library allocation
page read and write
7B10000
heap
page read and write
32DA000
trusted library allocation
page read and write
5AE0000
trusted library allocation
page read and write
36CA000
trusted library allocation
page read and write
1495000
trusted library allocation
page execute and read and write
36BD000
trusted library allocation
page read and write
5748000
trusted library allocation
page read and write
1482000
trusted library allocation
page read and write
1450000
trusted library allocation
page read and write
1497000
trusted library allocation
page execute and read and write
3709000
trusted library allocation
page read and write
332C000
trusted library allocation
page read and write
416F000
trusted library allocation
page read and write
779E000
stack
page read and write
5710000
heap
page read and write
17C0000
trusted library allocation
page execute and read and write
144E000
stack
page read and write
36D4000
trusted library allocation
page read and write
3607000
trusted library allocation
page read and write
5C20000
trusted library allocation
page read and write
1492000
trusted library allocation
page read and write
63D0000
heap
page read and write
35E6000
trusted library allocation
page read and write
767D000
stack
page read and write
3580000
trusted library allocation
page read and write
63E2000
heap
page read and write
7A6F000
stack
page read and write
17D0000
heap
page read and write
597A000
trusted library allocation
page read and write
5956000
trusted library allocation
page read and write
3372000
trusted library allocation
page read and write
14A8000
heap
page read and write
5CFE000
stack
page read and write
3305000
trusted library allocation
page read and write
169E000
stack
page read and write
3657000
trusted library allocation
page read and write
76D0000
trusted library allocation
page read and write
74A0000
heap
page read and write
5C30000
trusted library allocation
page execute and read and write
5C00000
trusted library allocation
page execute and read and write
5B70000
trusted library allocation
page read and write
3161000
trusted library allocation
page read and write
3503000
trusted library allocation
page read and write
63F4000
heap
page read and write
32F9000
trusted library allocation
page read and write
56A0000
trusted library allocation
page read and write
687E000
stack
page read and write
351B000
trusted library allocation
page read and write
35CC000
trusted library allocation
page read and write
32CC000
trusted library allocation
page read and write
72A0000
heap
page read and write
1460000
trusted library allocation
page read and write
140E000
stack
page read and write
574A000
trusted library allocation
page read and write
1470000
heap
page read and write
12F7000
stack
page read and write
7AFC000
stack
page read and write
3568000
trusted library allocation
page read and write
72D7000
heap
page read and write
5C7E000
stack
page read and write
353C000
trusted library allocation
page read and write
1810000
heap
page read and write
7B6E000
stack
page read and write
36A6000
trusted library allocation
page read and write
5AC5000
trusted library allocation
page read and write
3510000
trusted library allocation
page read and write
76E0000
trusted library allocation
page read and write
3578000
trusted library allocation
page read and write
4238000
trusted library allocation
page read and write
5951000
trusted library allocation
page read and write
363E000
trusted library allocation
page read and write
7710000
trusted library allocation
page read and write
FF0000
trusted library allocation
page read and write
65CF000
stack
page read and write
5A9F000
stack
page read and write
181E000
heap
page read and write
56B0000
trusted library allocation
page read and write
5BF0000
trusted library allocation
page read and write
3575000
trusted library allocation
page read and write
3313000
trusted library allocation
page read and write
73A9000
heap
page read and write
E77000
unkown
page readonly
3632000
trusted library allocation
page read and write
5730000
trusted library allocation
page execute and read and write
72A8000
heap
page read and write
5B80000
trusted library allocation
page execute and read and write
72EB000
heap
page read and write
6412000
heap
page read and write
179F000
stack
page read and write
5745000
trusted library allocation
page read and write
3641000
trusted library allocation
page read and write
75EA000
trusted library allocation
page read and write
648F000
heap
page read and write
56A5000
trusted library allocation
page read and write
17E0000
heap
page read and write
315F000
stack
page read and write
5690000
trusted library allocation
page read and write
3572000
trusted library allocation
page read and write
5940000
trusted library allocation
page read and write
76F0000
trusted library allocation
page execute and read and write
6423000
heap
page read and write
330B000
trusted library allocation
page read and write
1486000
trusted library allocation
page execute and read and write
3698000
trusted library allocation
page read and write
75D0000
trusted library allocation
page read and write
E72000
unkown
page readonly
56D0000
trusted library allocation
page read and write
72FA000
heap
page read and write
5740000
trusted library allocation
page read and write
7C90000
heap
page read and write
36B1000
trusted library allocation
page read and write
7600000
trusted library allocation
page read and write
44EF000
trusted library allocation
page read and write
1453000
trusted library allocation
page execute and read and write
14AE000
heap
page read and write
67CE000
stack
page read and write
44FC000
trusted library allocation
page read and write
1817000
heap
page read and write
75B0000
trusted library allocation
page read and write
32CF000
trusted library allocation
page read and write
6400000
heap
page read and write
75F5000
trusted library allocation
page read and write
75A0000
trusted library allocation
page read and write
423D000
trusted library allocation
page read and write
5AB1000
trusted library allocation
page read and write
35D8000
trusted library allocation
page read and write
5ACB000
trusted library allocation
page read and write
75E8000
trusted library allocation
page read and write
14A0000
heap
page read and write
5672000
trusted library allocation
page read and write
3703000
trusted library allocation
page read and write
6880000
trusted library allocation
page read and write
5B00000
trusted library allocation
page execute and read and write
71FD000
stack
page read and write
5AD0000
trusted library allocation
page read and write
7E8E000
stack
page read and write
F2A000
stack
page read and write
775E000
stack
page read and write
36A3000
trusted library allocation
page read and write
3308000
trusted library allocation
page read and write
5B90000
trusted library allocation
page execute and read and write
7B00000
trusted library allocation
page read and write
350D000
trusted library allocation
page read and write
35F1000
trusted library allocation
page read and write
3050000
heap
page execute and read and write
3333000
trusted library allocation
page read and write
3501000
trusted library allocation
page read and write
75A3000
trusted library allocation
page read and write
75A6000
trusted library allocation
page read and write
1565000
heap
page read and write
5750000
heap
page read and write
7200000
trusted library allocation
page read and write
FA0000
heap
page read and write
35A1000
trusted library allocation
page read and write
5680000
trusted library allocation
page read and write
5720000
trusted library allocation
page read and write
5990000
heap
page execute and read and write
2FFE000
stack
page read and write
146D000
trusted library allocation
page execute and read and write
3513000
trusted library allocation
page read and write
331E000
trusted library allocation
page read and write
5722000
trusted library allocation
page read and write
4181000
trusted library allocation
page read and write
6439000
heap
page read and write
4231000
trusted library allocation
page read and write
FC5000
heap
page read and write
6474000
heap
page read and write
75C0000
trusted library allocation
page execute and read and write
36DE000
trusted library allocation
page read and write
5ACE000
trusted library allocation
page read and write
6461000
heap
page read and write
E86000
unkown
page readonly
5B50000
trusted library allocation
page read and write
4501000
trusted library allocation
page read and write
33B5000
trusted library allocation
page read and write
E40000
unkown
page readonly
7F1C0000
trusted library allocation
page execute and read and write
5666000
trusted library allocation
page read and write
75B4000
trusted library allocation
page read and write
75FA000
trusted library allocation
page read and write
1454000
trusted library allocation
page read and write
74B0000
heap
page read and write
427E000
trusted library allocation
page read and write
366C000
trusted library allocation
page read and write
35DB000
trusted library allocation
page read and write
5B60000
heap
page read and write
5B30000
trusted library allocation
page read and write
14C7000
heap
page read and write
52FC000
stack
page read and write
14E1000
heap
page read and write
3566000
trusted library allocation
page read and write
566D000
trusted library allocation
page read and write
364C000
trusted library allocation
page read and write
42EC000
trusted library allocation
page read and write
76BE000
stack
page read and write
4244000
trusted library allocation
page read and write
There are 281 hidden memdumps, click here to show them.