IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\file.exe.log
CSV text
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
https://pastebin.com/raw/H3wFXmEi
unknown
http://nkprotect.net
unknown
http://exmple.com
unknown
https://api.telegram.org/bot
unknown
https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-windows-386.zip
unknown
https://evilcoder.mysellix.io
unknown
https://nkprotect.net
unknown
https://nkprotect.net/check.txt
82.197.80.96
https://t.me/XCoderGroup
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://www.google.com/maps/place/)icons8-letter-16.png
unknown
http://ip-api.com/csv/?fields=status
unknown
http://ip-api.com/line/?fields=hosting
unknown
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
nkprotect.net
82.197.80.96
s-part-0015.t-0009.t-msedge.net
13.107.246.43

IPs

IP
Domain
Country
Malicious
82.197.80.96
nkprotect.net
United Kingdom

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\file_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2273EEB7000
unkown
page readonly
 malicious
2273F209000
unkown
page readonly
 malicious
91B4BFE000
stack
page read and write
2273EB1D000
unkown
page readonly
2273E973000
unkown
page readonly
2273F895000
heap
page read and write
2273EE34000
unkown
page readonly
2273E9F6000
unkown
page readonly
2273E572000
unkown
page readonly
2273E5FF000
unkown
page readonly
91B52FE000
stack
page read and write
2273E9AA000
unkown
page readonly
7FF848D7D000
trusted library allocation
page execute and read and write
91B4CFF000
stack
page read and write
2273F860000
heap
page read and write
2273F702000
heap
page read and write
22741282000
heap
page read and write
2273EAA9000
unkown
page readonly
91B54FE000
stack
page read and write
2273EB61000
unkown
page readonly
7FF848E06000
trusted library allocation
page read and write
2274151F000
trusted library allocation
page read and write
2273F0A5000
unkown
page readonly
2273F1A1000
unkown
page readonly
2273F1DD000
unkown
page readonly
91B4FFB000
stack
page read and write
2273F4E0000
heap
page read and write
2273F650000
trusted library allocation
page read and write
2273F670000
trusted library allocation
page read and write
7FF848D74000
trusted library allocation
page read and write
7FF848EF1000
trusted library allocation
page read and write
7FF848D63000
trusted library allocation
page read and write
2273E965000
unkown
page readonly
7FF848D54000
trusted library allocation
page read and write
7FF848F10000
trusted library allocation
page read and write
2273F6EA000
heap
page read and write
2274152D000
trusted library allocation
page read and write
91B4EFD000
stack
page read and write
7FF848E00000
trusted library allocation
page read and write
2273F0BE000
unkown
page readonly
22759D00000
heap
page read and write
2273F6EF000
heap
page read and write
2273EB54000
unkown
page readonly
2273E9E8000
unkown
page readonly
227413F0000
heap
page read and write
7FF848D5D000
trusted library allocation
page execute and read and write
227412F4000
heap
page read and write
91B55FE000
stack
page read and write
2273F5C0000
heap
page read and write
22741260000
heap
page read and write
2273ED79000
unkown
page readonly
91B47C3000
stack
page read and write
7FF848E70000
trusted library allocation
page execute and read and write
2273EA64000
unkown
page readonly
2273F89E000
heap
page read and write
2273E9DD000
unkown
page readonly
2273EAB8000
unkown
page readonly
2274153E000
trusted library allocation
page read and write
22759CF0000
heap
page execute and read and write
91B59FE000
stack
page read and write
22751468000
trusted library allocation
page read and write
7FF848F00000
trusted library allocation
page read and write
2273F72C000
heap
page read and write
91B51FE000
stack
page read and write
2273EE76000
unkown
page readonly
91B56FE000
stack
page read and write
227412E2000
heap
page read and write
91B58FF000
stack
page read and write
2273F600000
heap
page read and write
2275146D000
trusted library allocation
page read and write
2273EE41000
unkown
page readonly
22741306000
heap
page read and write
2273F905000
heap
page read and write
22741531000
trusted library allocation
page read and write
22741461000
trusted library allocation
page read and write
7FF848EFB000
trusted library allocation
page read and write
2273F6C6000
heap
page read and write
227414EC000
trusted library allocation
page read and write
2273EA71000
unkown
page readonly
2275B650000
trusted library allocation
page read and write
227414E8000
trusted library allocation
page read and write
2273E9C4000
unkown
page readonly
7FF848D6D000
trusted library allocation
page execute and read and write
22751461000
trusted library allocation
page read and write
2273F1A5000
unkown
page readonly
2273F6C0000
heap
page read and write
2273EC1F000
unkown
page readonly
91B50FE000
stack
page read and write
7FF848D70000
trusted library allocation
page read and write
227412E0000
heap
page read and write
2273F6E3000
heap
page read and write
2273F7A8000
heap
page read and write
2273F0F7000
unkown
page readonly
2273EE19000
unkown
page readonly
2273EB36000
unkown
page readonly
7FF848DAC000
trusted library allocation
page execute and read and write
2273F0CC000
unkown
page readonly
227414DA000
trusted library allocation
page read and write
2273EA11000
unkown
page readonly
7FF4BB150000
trusted library allocation
page execute and read and write
2273EEA1000
unkown
page readonly
2273EA2A000
unkown
page readonly
7FF848E10000
trusted library allocation
page execute and read and write
2273F05B000
unkown
page readonly
2273E5F2000
unkown
page readonly
2273E94A000
unkown
page readonly
2273F900000
heap
page read and write
2273EDB1000
unkown
page readonly
22741502000
trusted library allocation
page read and write
2273E99C000
unkown
page readonly
7FF848E36000
trusted library allocation
page execute and read and write
2273EAB3000
unkown
page readonly
7FF848F20000
trusted library allocation
page execute and read and write
2273F0B3000
unkown
page readonly
2273EA56000
unkown
page readonly
2273F5E0000
heap
page read and write
2273EC2C000
unkown
page readonly
91B4AFE000
stack
page read and write
2273F125000
unkown
page readonly
7FF848D53000
trusted library allocation
page execute and read and write
2273EA38000
unkown
page readonly
91B53FB000
stack
page read and write
22741331000
heap
page read and write
2273EA7F000
unkown
page readonly
2273E9B7000
unkown
page readonly
7FF848E0C000
trusted library allocation
page execute and read and write
2273E570000
unkown
page readonly
2273F6DF000
heap
page read and write
2274150D000
trusted library allocation
page read and write
91B57FD000
stack
page read and write
22741450000
heap
page execute and read and write
2273F79E000
heap
page read and write
2273F6CC000
heap
page read and write
2273E970000
unkown
page readonly
2273F890000
heap
page read and write
227414D7000
trusted library allocation
page read and write
2273E96C000
unkown
page readonly
22741270000
heap
page read and write
91B4DFE000
stack
page read and write
227413F3000
heap
page read and write
2273F0FC000
unkown
page readonly
2273E959000
unkown
page readonly
2273F117000
unkown
page readonly
2273EE68000
unkown
page readonly
2273E570000
unkown
page readonly
7FF848D7B000
trusted library allocation
page execute and read and write
2273EAE3000
unkown
page readonly
2273EAF4000
unkown
page readonly
2273ED6B000
unkown
page readonly
There are 139 hidden memdumps, click here to show them.