IOC Report
z30ProofofPaymentAttached.exe

loading gif

Files

File Path
Type
Category
Malicious
z30ProofofPaymentAttached.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\aut719C.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\murky
data
modified

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\z30ProofofPaymentAttached.exe
"C:\Users\user\Desktop\z30ProofofPaymentAttached.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\z30ProofofPaymentAttached.exe"
 malicious

URLs

Name
IP
Malicious
https://www.office.com/
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:648351%0D%0ADate%20a
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://api.telegram.org
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://api.telegram.org/bot
unknown
https://www.office.com/lB
unknown
http://mzgold.ir
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://r10.o.lencr.org0#
unknown
http://checkip.dyndns.org
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:648351%0D%0ADate%20and%20Time:%2019/11/2024%20/%2005:20:42%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20648351%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
https://api.telegram.org/bot/sendMessage?chat_id=&text=
unknown
https://chrome.google.com/webstore?hl=en
unknown
https://www.ecosia.org/newtab/
unknown
https://chrome.google.com/webstore?hl=en8
unknown
http://varders.kozow.com:8081
unknown
http://aborters.duckdns.org:8081
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://www.office.com/8
unknown
http://checkip.dyndns.org/
193.122.6.168
http://51.38.247.67:8081/_send_.php?L
unknown
http://anotherarmy.dns.army:8081
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://checkip.dyndns.org/q
unknown
https://chrome.google.com/webstore?hl=enlB
unknown
https://reallyfreegeoip.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://reallyfreegeoip.org/xml/155.94.241.187$
unknown
https://reallyfreegeoip.org/xml/155.94.241.187
188.114.97.3
http://r10.i.lencr.org/0
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 28 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mzgold.ir
217.144.107.148
 malicious
reallyfreegeoip.org
188.114.97.3
api.telegram.org
149.154.167.220
checkip.dyndns.com
193.122.6.168
checkip.dyndns.org
unknown

IPs

IP
Domain
Country
Malicious
217.144.107.148
mzgold.ir
Iran (ISLAMIC Republic Of)
malicious
149.154.167.220
api.telegram.org
United Kingdom
188.114.97.3
reallyfreegeoip.org
European Union
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2E21000
trusted library allocation
page read and write
 malicious
3019000
trusted library allocation
page read and write
 malicious
F60000
direct allocation
page read and write
 malicious
402000
system
page execute and read and write
 malicious
103D000
unkown
page readonly
5260000
trusted library allocation
page read and write
36DD000
direct allocation
page read and write
7DB000
stack
page read and write
40D8000
trusted library allocation
page read and write
BE0000
trusted library allocation
page execute and read and write
36D9000
direct allocation
page read and write
65EE000
stack
page read and write
2EE2000
trusted library allocation
page read and write
54E0000
heap
page read and write
1000000
heap
page read and write
B26000
heap
page read and write
FD0000
trusted library allocation
page read and write
30AC000
trusted library allocation
page read and write
379E000
direct allocation
page read and write
5281000
trusted library allocation
page read and write
C0C000
heap
page read and write
2FB0000
trusted library allocation
page read and write
A18000
heap
page read and write
4007000
trusted library allocation
page read and write
374E000
direct allocation
page read and write
6830000
trusted library allocation
page execute and read and write
419D000
trusted library allocation
page read and write
1040000
heap
page read and write
A17000
heap
page read and write
312E000
trusted library allocation
page read and write
1360000
trusted library allocation
page read and write
2E72000
trusted library allocation
page read and write
4140000
trusted library allocation
page read and write
2CB0000
heap
page execute and read and write
ABA000
heap
page read and write
2FA8000
trusted library allocation
page read and write
18BF000
stack
page read and write
3E8D000
trusted library allocation
page read and write
13C0000
trusted library allocation
page read and write
5295000
trusted library allocation
page read and write
2FAC000
trusted library allocation
page read and write
41EF000
trusted library allocation
page read and write
4032000
trusted library allocation
page read and write
A1E000
heap
page read and write
2ECA000
trusted library allocation
page read and write
35B0000
direct allocation
page read and write
319B000
trusted library allocation
page read and write
1191000
heap
page read and write
36D9000
direct allocation
page read and write
BC0000
trusted library allocation
page read and write
40B1000
trusted library allocation
page read and write
6820000
trusted library allocation
page execute and read and write
2BE8000
trusted library allocation
page read and write
2ED2000
trusted library allocation
page read and write
117A000
heap
page read and write
3600000
direct allocation
page read and write
6800000
trusted library allocation
page execute and read and write
31C3000
trusted library allocation
page read and write
528D000
trusted library allocation
page read and write
2C90000
trusted library allocation
page read and write
7FC000
stack
page read and write
3044000
trusted library allocation
page read and write
9D0000
heap
page read and write
5400000
heap
page read and write
6900000
trusted library allocation
page read and write
3410000
direct allocation
page read and write
1396000
trusted library allocation
page execute and read and write
30E9000
trusted library allocation
page read and write
1380000
trusted library allocation
page read and write
30A2000
trusted library allocation
page read and write
3E21000
trusted library allocation
page read and write
3E34000
trusted library allocation
page read and write
6810000
trusted library allocation
page execute and read and write
1150000
heap
page read and write
2FE7000
trusted library allocation
page read and write
1236000
heap
page read and write
138D000
trusted library allocation
page execute and read and write
3533000
direct allocation
page read and write
40E9000
trusted library allocation
page read and write
2FAE000
trusted library allocation
page read and write
68F4000
trusted library allocation
page read and write
106A000
unkown
page write copy
2E95000
trusted library allocation
page read and write
ACC000
heap
page read and write
313D000
trusted library allocation
page read and write
374E000
direct allocation
page read and write
BA0000
heap
page read and write
3099000
trusted library allocation
page read and write
B90000
heap
page read and write
2F2E000
trusted library allocation
page read and write
1045000
heap
page read and write
BD0000
trusted library allocation
page read and write
372D000
direct allocation
page read and write
9DE000
heap
page read and write
527A000
trusted library allocation
page read and write
ABA000
heap
page read and write
67B0000
trusted library allocation
page read and write
3583000
direct allocation
page read and write
2FDF000
trusted library allocation
page read and write
35B0000
direct allocation
page read and write
13A2000
trusted library allocation
page read and write
3583000
direct allocation
page read and write
3583000
direct allocation
page read and write
3EDD000
trusted library allocation
page read and write
B80000
heap
page read and write
4051000
trusted library allocation
page read and write
B26000
heap
page read and write
35B0000
direct allocation
page read and write
581E000
stack
page read and write
2FEC000
trusted library allocation
page read and write
41F3000
trusted library allocation
page read and write
52FD000
stack
page read and write
960000
heap
page read and write
3139000
trusted library allocation
page read and write
1010000
heap
page read and write
599D000
stack
page read and write
400000
system
page execute and read and write
67E0000
trusted library allocation
page execute and read and write
3035000
trusted library allocation
page read and write
1AB0000
heap
page read and write
3F4C000
trusted library allocation
page read and write
1A08000
heap
page read and write
59B6000
trusted library allocation
page read and write
2E8A000
trusted library allocation
page read and write
30B5000
trusted library allocation
page read and write
666E000
stack
page read and write
3133000
trusted library allocation
page read and write
2C80000
trusted library allocation
page read and write
30B1000
trusted library allocation
page read and write
14BE000
stack
page read and write
64AE000
stack
page read and write
2EC2000
trusted library allocation
page read and write
54D0000
heap
page execute and read and write
139A000
trusted library allocation
page execute and read and write
67C0000
trusted library allocation
page execute and read and write
379E000
direct allocation
page read and write
412A000
trusted library allocation
page read and write
3E41000
trusted library allocation
page read and write
63AA000
heap
page read and write
3460000
direct allocation
page read and write
68A0000
trusted library allocation
page execute and read and write
19F4000
heap
page read and write
2FE1000
trusted library allocation
page read and write
4085000
trusted library allocation
page read and write
67F0000
trusted library allocation
page read and write
3E3B000
trusted library allocation
page read and write
2CFC000
stack
page read and write
BAC000
heap
page read and write
3460000
direct allocation
page read and write
446000
system
page execute and read and write
1392000
trusted library allocation
page read and write
5403000
heap
page read and write
A0E000
heap
page read and write
BC7000
trusted library allocation
page read and write
137D000
trusted library allocation
page execute and read and write
105E000
unkown
page readonly
2FBB000
trusted library allocation
page read and write
1374000
trusted library allocation
page read and write
3EF3000
trusted library allocation
page read and write
3F6C000
trusted library allocation
page read and write
2E9D000
trusted library allocation
page read and write
626E000
stack
page read and write
13AB000
trusted library allocation
page execute and read and write
FB1000
unkown
page execute read
87E000
stack
page read and write
312A000
trusted library allocation
page read and write
2F0A000
trusted library allocation
page read and write
526E000
trusted library allocation
page read and write
31C1000
trusted library allocation
page read and write
2E1E000
stack
page read and write
A1E000
heap
page read and write
595E000
stack
page read and write
3600000
direct allocation
page read and write
2EDE000
trusted library allocation
page read and write
3729000
direct allocation
page read and write
67BD000
trusted library allocation
page read and write
3533000
direct allocation
page read and write
3F20000
trusted library allocation
page read and write
BAC000
heap
page read and write
6C70000
heap
page read and write
6378000
heap
page read and write
19F0000
heap
page read and write
106A000
unkown
page read and write
A82000
heap
page read and write
64EE000
stack
page read and write
591E000
stack
page read and write
67AE000
stack
page read and write
3E49000
trusted library allocation
page read and write
606E000
stack
page read and write
41C5000
trusted library allocation
page read and write
13A5000
trusted library allocation
page execute and read and write
636E000
stack
page read and write
5286000
trusted library allocation
page read and write
B1A000
stack
page read and write
A9000
stack
page read and write
662E000
stack
page read and write
67D0000
trusted library allocation
page read and write
63E1000
heap
page read and write
A18000
heap
page read and write
A1F000
heap
page read and write
68C6000
trusted library allocation
page read and write
2EDA000
trusted library allocation
page read and write
106F000
unkown
page write copy
1430000
heap
page read and write
1373000
trusted library allocation
page execute and read and write
3E2F000
trusted library allocation
page read and write
6890000
trusted library allocation
page read and write
36DD000
direct allocation
page read and write
A28000
heap
page read and write
59A0000
trusted library allocation
page read and write
3410000
direct allocation
page read and write
54CE000
stack
page read and write
83D000
stack
page read and write
1390000
trusted library allocation
page read and write
5266000
trusted library allocation
page read and write
A19000
heap
page execute and read and write
6902000
trusted library allocation
page read and write
133E000
stack
page read and write
9DA000
heap
page read and write
B26000
heap
page read and write
6905000
trusted library allocation
page read and write
36DD000
direct allocation
page read and write
2FB6000
trusted library allocation
page read and write
7BC000
stack
page read and write
1187000
heap
page read and write
30DE000
trusted library allocation
page read and write
AA2000
heap
page read and write
374E000
direct allocation
page read and write
3137000
trusted library allocation
page read and write
31CE000
trusted library allocation
page read and write
3729000
direct allocation
page read and write
31BB000
trusted library allocation
page read and write
2FDD000
trusted library allocation
page read and write
3060000
trusted library allocation
page read and write
3600000
direct allocation
page read and write
AEB000
heap
page read and write
3FF4000
trusted library allocation
page read and write
ABB000
heap
page read and write
13A0000
trusted library allocation
page read and write
A0B000
heap
page read and write
1F0000
heap
page read and write
105E000
unkown
page readonly
BB0000
trusted library allocation
page read and write
103D000
unkown
page readonly
3410000
direct allocation
page read and write
526B000
trusted library allocation
page read and write
FB1000
unkown
page execute read
A18000
heap
page read and write
3F82000
trusted library allocation
page read and write
316E000
trusted library allocation
page read and write
3460000
direct allocation
page read and write
2E7F000
trusted library allocation
page read and write
9A0000
heap
page read and write
3054000
trusted library allocation
page read and write
2E99000
trusted library allocation
page read and write
1420000
trusted library allocation
page read and write
110000
heap
page read and write
63EC000
heap
page read and write
30E2000
trusted library allocation
page read and write
372D000
direct allocation
page read and write
59BA000
trusted library allocation
page read and write
6910000
trusted library allocation
page read and write
1074000
unkown
page readonly
40E7000
trusted library allocation
page read and write
13A7000
trusted library allocation
page execute and read and write
2FD9000
trusted library allocation
page read and write
A42000
heap
page read and write
308E000
trusted library allocation
page read and write
40EF000
trusted library allocation
page read and write
140E000
stack
page read and write
3029000
trusted library allocation
page read and write
2D10000
heap
page read and write
FB0000
unkown
page readonly
31C5000
trusted library allocation
page read and write
40DB000
trusted library allocation
page read and write
4035000
trusted library allocation
page read and write
3F0B000
trusted library allocation
page read and write
2ED6000
trusted library allocation
page read and write
30DC000
trusted library allocation
page read and write
533E000
stack
page read and write
1410000
trusted library allocation
page execute and read and write
2ECE000
trusted library allocation
page read and write
1158000
heap
page read and write
1189000
heap
page read and write
372D000
direct allocation
page read and write
379E000
direct allocation
page read and write
3533000
direct allocation
page read and write
31CA000
trusted library allocation
page read and write
1074000
unkown
page readonly
EF7000
stack
page read and write
40E1000
trusted library allocation
page read and write
41B2000
trusted library allocation
page read and write
4F1E000
stack
page read and write
FB0000
unkown
page readonly
3FDF000
trusted library allocation
page read and write
A63000
heap
page read and write
3729000
direct allocation
page read and write
2CA0000
trusted library allocation
page read and write
1370000
trusted library allocation
page read and write
59B4000
trusted library allocation
page read and write
40D1000
trusted library allocation
page read and write
2EC6000
trusted library allocation
page read and write
40E4000
trusted library allocation
page read and write
36D9000
direct allocation
page read and write
3093000
trusted library allocation
page read and write
527E000
trusted library allocation
page read and write
7CE000
stack
page read and write
30D6000
trusted library allocation
page read and write
4066000
trusted library allocation
page read and write
66AE000
stack
page read and write
6370000
heap
page read and write
A5D000
heap
page read and write
There are 302 hidden memdumps, click here to show them.