IOC Report
NXPYoHNSgv.exe

loading gif

Files

File Path
Type
Category
Malicious
NXPYoHNSgv.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NXPYoHNSgv.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_exhoishc.xrs.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nv2p2dje.kec.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pmps5ltr.ytq.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwl3as5g.ckd.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\Documents\VIPRecovery\Screenshot.png
PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\NXPYoHNSgv.exe
"C:\Users\user\Desktop\NXPYoHNSgv.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\NXPYoHNSgv.exe"
 malicious
C:\Users\user\Desktop\NXPYoHNSgv.exe
"C:\Users\user\Desktop\NXPYoHNSgv.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

URLs

Name
IP
Malicious
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:035347%0D%0ADate%20and%20Time:%2008/10/2024%20/%2017:20:50%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20035347%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
http://aborters.duckdns.org:8081
unknown
https://www.office.com/
unknown
http://checkip.dyndns.org/
132.226.247.73
http://51.38.247.67:8081/_send_.php?L
unknown
https://api.telegram.org/bot
unknown
http://anotherarmy.dns.army:8081
unknown
http://checkip.dyndns.org/q
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://chrome.google.com/webstore?hl=en
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://varders.kozow.com:8081
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 4 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
api.telegram.org
149.154.167.220
 malicious
mail.jhxkgroup.online
217.12.218.219
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
217.12.218.219
mail.jhxkgroup.online
Ukraine
malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NXPYoHNSgv_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402D000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
3381000
trusted library allocation
page read and write
 malicious
33EC000
trusted library allocation
page read and write
 malicious
3E09000
trusted library allocation
page read and write
 malicious
34B4000
trusted library allocation
page read and write
32ED000
trusted library allocation
page read and write
78BE000
stack
page read and write
117C000
stack
page read and write
31E0000
trusted library allocation
page read and write
32D8000
trusted library allocation
page read and write
3270000
heap
page read and write
31B6000
trusted library allocation
page read and write
3369000
trusted library allocation
page read and write
2CC0000
heap
page read and write
5700000
heap
page read and write
313A000
trusted library allocation
page read and write
7B8E000
heap
page read and write
379D000
trusted library allocation
page read and write
7105000
trusted library allocation
page read and write
7B80000
heap
page read and write
1505000
trusted library allocation
page execute and read and write
444D000
trusted library allocation
page read and write
14C0000
trusted library allocation
page read and write
57DE000
trusted library allocation
page read and write
1090000
trusted library allocation
page read and write
3095000
trusted library allocation
page read and write
31FC000
stack
page read and write
100E000
stack
page read and write
10D0000
trusted library allocation
page read and write
73D0000
heap
page read and write
69EE000
stack
page read and write
118E000
heap
page read and write
7090000
trusted library allocation
page read and write
5EB4000
trusted library allocation
page read and write
73AC000
stack
page read and write
6FD0000
trusted library allocation
page read and write
6A2E000
stack
page read and write
A4D9000
heap
page read and write
7A7E000
stack
page read and write
74F9000
trusted library allocation
page read and write
1410000
heap
page read and write
1230000
heap
page read and write
7B7F000
stack
page read and write
30FD000
trusted library allocation
page read and write
6B63000
heap
page read and write
7CA0000
trusted library allocation
page read and write
31F4000
trusted library allocation
page read and write
5240000
trusted library allocation
page read and write
ABFE000
stack
page read and write
33B1000
trusted library allocation
page read and write
6F3E000
heap
page read and write
14ED000
trusted library allocation
page execute and read and write
A8BE000
stack
page read and write
55FB000
stack
page read and write
A87E000
stack
page read and write
5E40000
heap
page read and write
3FD2000
trusted library allocation
page read and write
10B0000
heap
page read and write
59B0000
trusted library allocation
page read and write
70B6000
trusted library allocation
page read and write
5690000
heap
page read and write
7460000
trusted library section
page read and write
7020000
trusted library allocation
page execute and read and write
33B9000
trusted library allocation
page read and write
70F4000
trusted library allocation
page read and write
7F630000
trusted library allocation
page execute and read and write
3254000
trusted library allocation
page read and write
1450000
heap
page read and write
7ECD000
stack
page read and write
3285000
trusted library allocation
page read and write
6FAD000
stack
page read and write
10C6000
trusted library allocation
page execute and read and write
6B2E000
stack
page read and write
5261000
trusted library allocation
page read and write
321E000
trusted library allocation
page read and write
77A0000
trusted library allocation
page read and write
AAFC000
stack
page read and write
34BC000
trusted library allocation
page read and write
5340000
trusted library allocation
page execute and read and write
3200000
heap
page execute and read and write
4381000
trusted library allocation
page read and write
32C3000
trusted library allocation
page read and write
57E6000
trusted library allocation
page read and write
A4C0000
heap
page read and write
7120000
trusted library allocation
page read and write
1604000
heap
page read and write
77E0000
trusted library allocation
page execute and read and write
3439000
trusted library allocation
page read and write
BFD000
stack
page read and write
337E000
trusted library allocation
page read and write
311E000
stack
page read and write
2DE0000
trusted library allocation
page read and write
3178000
trusted library allocation
page read and write
98B0000
heap
page read and write
5860000
trusted library section
page read and write
5272000
trusted library allocation
page read and write
33B4000
trusted library allocation
page read and write
5290000
trusted library allocation
page read and write
30E8000
trusted library allocation
page read and write
1500000
trusted library allocation
page read and write
A9FC000
stack
page read and write
6BAD000
heap
page read and write
3220000
heap
page read and write
2DD0000
trusted library allocation
page execute and read and write
7B85000
heap
page read and write
6FF0000
trusted library allocation
page read and write
56A0000
heap
page read and write
5EA0000
trusted library allocation
page read and write
5320000
heap
page read and write
1180000
heap
page read and write
3209000
trusted library allocation
page read and write
782B000
stack
page read and write
10B5000
heap
page read and write
52E0000
trusted library allocation
page read and write
57ED000
trusted library allocation
page read and write
7052000
trusted library allocation
page read and write
337F000
stack
page read and write
10D7000
trusted library allocation
page execute and read and write
6FC0000
trusted library allocation
page execute and read and write
14B0000
trusted library allocation
page read and write
3126000
trusted library allocation
page read and write
6CED000
stack
page read and write
77C0000
heap
page read and write
52B0000
trusted library allocation
page read and write
1093000
trusted library allocation
page execute and read and write
3E01000
trusted library allocation
page read and write
7840000
trusted library allocation
page read and write
10DB000
trusted library allocation
page execute and read and write
3355000
trusted library allocation
page read and write
6FE0000
trusted library allocation
page execute and read and write
1518000
heap
page read and write
3398000
trusted library allocation
page read and write
185D000
stack
page read and write
38E3000
trusted library allocation
page read and write
5244000
trusted library allocation
page read and write
3271000
trusted library allocation
page read and write
30BF000
trusted library allocation
page read and write
7000000
trusted library allocation
page execute and read and write
10F0000
trusted library allocation
page read and write
181D000
stack
page read and write
68EE000
stack
page read and write
5C8E000
stack
page read and write
31A2000
trusted library allocation
page read and write
15DB000
heap
page read and write
98A0000
heap
page read and write
7F7E000
stack
page read and write
5903000
heap
page read and write
34B8000
trusted library allocation
page read and write
10AD000
trusted library allocation
page execute and read and write
11BF000
heap
page read and write
70A0000
trusted library allocation
page execute and read and write
8F7E000
trusted library allocation
page read and write
3128000
trusted library allocation
page read and write
547D000
stack
page read and write
1080000
trusted library allocation
page read and write
70B0000
trusted library allocation
page read and write
3340000
trusted library allocation
page read and write
1197000
stack
page read and write
3111000
trusted library allocation
page read and write
70C6000
trusted library allocation
page read and write
1502000
trusted library allocation
page read and write
7130000
trusted library allocation
page read and write
1538000
heap
page read and write
2DF0000
heap
page execute and read and write
30D0000
trusted library allocation
page read and write
B3A000
stack
page read and write
150B000
trusted library allocation
page execute and read and write
43E6000
trusted library allocation
page read and write
3384000
trusted library allocation
page read and write
7102000
trusted library allocation
page read and write
1030000
heap
page read and write
BB0000
heap
page read and write
147F000
stack
page read and write
314F000
trusted library allocation
page read and write
7C80000
trusted library allocation
page read and write
A02000
unkown
page readonly
57E1000
trusted library allocation
page read and write
7C90000
trusted library allocation
page read and write
33D9000
trusted library allocation
page read and write
33E0000
trusted library allocation
page read and write
3240000
trusted library allocation
page read and write
78FE000
stack
page read and write
6CAF000
stack
page read and write
5350000
trusted library allocation
page read and write
3302000
trusted library allocation
page read and write
11C2000
heap
page read and write
7F95000
heap
page read and write
A4AE000
stack
page read and write
7110000
trusted library allocation
page read and write
BA0000
heap
page read and write
A00000
unkown
page readonly
1225000
heap
page read and write
1507000
trusted library allocation
page execute and read and write
14F0000
trusted library allocation
page read and write
332B000
trusted library allocation
page read and write
190E000
stack
page read and write
446000
remote allocation
page execute and read and write
57C0000
trusted library allocation
page read and write
10A0000
trusted library allocation
page read and write
10D2000
trusted library allocation
page read and write
32AF000
trusted library allocation
page read and write
30AA000
trusted library allocation
page read and write
3260000
trusted library allocation
page read and write
77D0000
heap
page read and write
109D000
trusted library allocation
page execute and read and write
14F2000
trusted library allocation
page read and write
EF7000
stack
page read and write
56A5000
heap
page read and write
5330000
trusted library allocation
page read and write
6F30000
heap
page read and write
3164000
trusted library allocation
page read and write
4464000
trusted library allocation
page read and write
6FB0000
trusted library allocation
page read and write
2C28000
trusted library allocation
page read and write
5E30000
heap
page read and write
6FBD000
trusted library allocation
page read and write
2E01000
trusted library allocation
page read and write
33AD000
trusted library allocation
page read and write
14A0000
heap
page read and write
5EBA000
trusted library allocation
page read and write
52C0000
heap
page read and write
75A9000
stack
page read and write
10CA000
trusted library allocation
page execute and read and write
52C3000
heap
page read and write
3250000
trusted library allocation
page read and write
3210000
trusted library allocation
page execute and read and write
11B4000
heap
page read and write
6E2E000
stack
page read and write
57F2000
trusted library allocation
page read and write
524B000
trusted library allocation
page read and write
7C85000
trusted library allocation
page read and write
14F6000
trusted library allocation
page execute and read and write
1465000
heap
page read and write
31CB000
trusted library allocation
page read and write
329A000
trusted library allocation
page read and write
3232000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
A9BF000
stack
page read and write
33CD000
trusted library allocation
page read and write
1547000
heap
page read and write
5E5E000
heap
page read and write
57CB000
trusted library allocation
page read and write
A63E000
stack
page read and write
5570000
heap
page execute and read and write
8F76000
trusted library allocation
page read and write
5800000
heap
page read and write
1037000
heap
page read and write
120C000
heap
page read and write
6C6D000
stack
page read and write
57CE000
trusted library allocation
page read and write
14FA000
trusted library allocation
page execute and read and write
171D000
stack
page read and write
5900000
heap
page read and write
1094000
trusted library allocation
page read and write
7400000
trusted library allocation
page read and write
113E000
stack
page read and write
14D0000
heap
page read and write
33E4000
trusted library allocation
page read and write
3427000
trusted library allocation
page read and write
14D7000
heap
page read and write
8F79000
trusted library allocation
page read and write
7F90000
heap
page read and write
6B30000
heap
page read and write
525E000
trusted library allocation
page read and write
74F0000
trusted library allocation
page read and write
318D000
trusted library allocation
page read and write
5332000
trusted library allocation
page read and write
8A9D000
stack
page read and write
5D8E000
stack
page read and write
6B9C000
heap
page read and write
7DBE000
stack
page read and write
14C4000
trusted library allocation
page read and write
33B7000
trusted library allocation
page read and write
7100000
trusted library allocation
page read and write
14CD000
trusted library allocation
page execute and read and write
7FA0000
trusted library allocation
page read and write
7500000
trusted library allocation
page read and write
6E6E000
stack
page read and write
3087000
trusted library allocation
page read and write
1252000
heap
page read and write
757E000
stack
page read and write
5B8D000
stack
page read and write
A77E000
stack
page read and write
2DCE000
stack
page read and write
717A000
stack
page read and write
580E000
stack
page read and write
5266000
trusted library allocation
page read and write
3247000
trusted library allocation
page read and write
A73E000
stack
page read and write
10C2000
trusted library allocation
page read and write
55A0000
trusted library allocation
page execute and read and write
10C0000
trusted library allocation
page read and write
767F000
stack
page read and write
1545000
heap
page read and write
6EAD000
stack
page read and write
1060000
heap
page read and write
5EB6000
trusted library allocation
page read and write
5600000
trusted library section
page readonly
5B40000
heap
page execute and read and write
30D3000
trusted library allocation
page read and write
6DED000
stack
page read and write
14E0000
trusted library allocation
page read and write
7190000
trusted library allocation
page execute and read and write
73E0000
heap
page read and write
1400000
heap
page read and write
137E000
stack
page read and write
7030000
trusted library allocation
page execute and read and write
325C000
trusted library allocation
page read and write
14A7000
heap
page read and write
109A000
stack
page read and write
5280000
trusted library allocation
page read and write
7530000
trusted library allocation
page execute and read and write
526D000
trusted library allocation
page read and write
1460000
heap
page read and write
7180000
trusted library allocation
page read and write
14C3000
trusted library allocation
page execute and read and write
3316000
trusted library allocation
page read and write
52A5000
trusted library allocation
page read and write
1510000
heap
page read and write
1050000
heap
page read and write
56B0000
heap
page read and write
10A3000
trusted library allocation
page read and write
52A0000
trusted library allocation
page read and write
76AD000
stack
page read and write
4EFC000
stack
page read and write
There are 316 hidden memdumps, click here to show them.