IOC Report
5802733_scan.exe

loading gif

Files

File Path
Type
Category
Malicious
5802733_scan.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\disturb
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\5802733_scan.exe
"C:\Users\user\Desktop\5802733_scan.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\5802733_scan.exe"
 malicious

URLs

Name
IP
Malicious
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
 malicious

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
3A80000
direct allocation
page read and write
 malicious
3456000
trusted library allocation
page read and write
111F000
stack
page read and write
431F000
heap
page read and write
34E0000
trusted library allocation
page read and write
3C89000
heap
page read and write
15B4000
heap
page read and write
3415000
trusted library allocation
page read and write
1830000
trusted library allocation
page read and write
3D74000
heap
page read and write
34A2000
trusted library allocation
page read and write
3E61000
heap
page read and write
3DA1000
heap
page execute and read and write
15DA000
heap
page read and write
401000
unkown
page execute read
3D74000
heap
page read and write
3122000
trusted library allocation
page read and write
31BC000
stack
page read and write
311B000
trusted library allocation
page read and write
3D74000
heap
page read and write
400000
unkown
page readonly
3D73000
heap
page read and write
1492000
trusted library allocation
page read and write
4553000
direct allocation
page read and write
1620000
heap
page read and write
46FD000
direct allocation
page read and write
3D74000
heap
page read and write
9A000
stack
page read and write
3ED4000
heap
page read and write
3E61000
heap
page read and write
1693000
heap
page read and write
147D000
trusted library allocation
page execute and read and write
3D91000
heap
page read and write
3D74000
heap
page read and write
6E80000
heap
page read and write
3E61000
heap
page read and write
3E61000
heap
page read and write
46F9000
direct allocation
page read and write
5A9C000
stack
page read and write
490000
unkown
page write copy
34A8000
trusted library allocation
page read and write
3D74000
heap
page read and write
16BB000
trusted library allocation
page execute and read and write
401000
unkown
page execute read
46F9000
direct allocation
page read and write
1810000
trusted library allocation
page execute and read and write
3DA2000
heap
page read and write
311E000
trusted library allocation
page read and write
476E000
direct allocation
page read and write
33E1000
trusted library allocation
page read and write
3D91000
heap
page read and write
8AF000
stack
page read and write
3C8E000
heap
page read and write
15E8000
heap
page read and write
34CC000
trusted library allocation
page read and write
1480000
trusted library allocation
page read and write
3DA5000
heap
page read and write
16D0000
trusted library allocation
page read and write
312E000
trusted library allocation
page read and write
8B4000
stack
page read and write
1840000
heap
page read and write
43E9000
trusted library allocation
page read and write
149A000
trusted library allocation
page execute and read and write
5993000
heap
page read and write
32D0000
heap
page read and write
1767000
heap
page read and write
3D0C000
heap
page read and write
15B0000
heap
page read and write
45D0000
direct allocation
page read and write
4449000
trusted library allocation
page read and write
5D9F000
stack
page read and write
45D0000
direct allocation
page read and write
4430000
direct allocation
page read and write
14A0000
heap
page read and write
3E71000
heap
page read and write
34E4000
trusted library allocation
page read and write
4430000
direct allocation
page read and write
46FD000
direct allocation
page read and write
34BA000
trusted library allocation
page read and write
312A000
trusted library allocation
page read and write
6BE0000
trusted library allocation
page execute and read and write
1670000
heap
page read and write
1650000
heap
page read and write
482000
unkown
page readonly
5F30000
trusted library allocation
page read and write
FD0000
heap
page read and write
3AE0000
heap
page read and write
115E000
stack
page read and write
46FD000
direct allocation
page read and write
4409000
trusted library allocation
page read and write
E0000
heap
page read and write
16B7000
trusted library allocation
page execute and read and write
3AE1000
heap
page read and write
34C2000
trusted library allocation
page read and write
1820000
trusted library allocation
page read and write
43E1000
trusted library allocation
page read and write
5C9E000
stack
page read and write
697E000
stack
page read and write
45D0000
direct allocation
page read and write
34D0000
trusted library allocation
page read and write
5980000
heap
page read and write
4260000
heap
page read and write
1625000
heap
page read and write
3C91000
heap
page read and write
3C68000
heap
page read and write
7F8C0000
trusted library allocation
page execute and read and write
3E61000
heap
page read and write
6ABE000
stack
page read and write
1580000
heap
page read and write
1F0000
heap
page read and write
3D74000
heap
page read and write
3CF0000
heap
page read and write
3C94000
heap
page read and write
16B0000
trusted library allocation
page read and write
5B9F000
stack
page read and write
6500000
heap
page read and write
4553000
direct allocation
page read and write
14A5000
heap
page read and write
4430000
direct allocation
page read and write
46FD000
direct allocation
page read and write
6BF0000
trusted library allocation
page execute and read and write
3136000
trusted library allocation
page read and write
4430000
direct allocation
page read and write
FC0000
heap
page read and write
4430000
direct allocation
page read and write
3D74000
heap
page read and write
6C30000
trusted library allocation
page read and write
8D0000
heap
page read and write
652A000
heap
page read and write
3131000
trusted library allocation
page read and write
15B0000
heap
page read and write
3E61000
heap
page read and write
3150000
trusted library allocation
page read and write
4AB000
unkown
page readonly
353E000
stack
page read and write
5F37000
trusted library allocation
page read and write
1473000
trusted library allocation
page execute and read and write
45D0000
direct allocation
page read and write
16B2000
trusted library allocation
page read and write
45D0000
direct allocation
page read and write
1470000
trusted library allocation
page read and write
33DE000
stack
page read and write
5F47000
trusted library allocation
page read and write
3D74000
heap
page read and write
397F000
stack
page read and write
15B8000
heap
page read and write
89F000
stack
page read and write
3A70000
heap
page read and write
476E000
direct allocation
page read and write
32AD000
stack
page read and write
3E60000
heap
page read and write
12F9000
stack
page read and write
3D74000
heap
page read and write
4553000
direct allocation
page read and write
1778000
trusted library allocation
page read and write
3BE0000
heap
page read and write
46F9000
direct allocation
page read and write
34D2000
trusted library allocation
page read and write
110000
heap
page read and write
3DBB000
heap
page read and write
45D0000
direct allocation
page read and write
5820000
heap
page read and write
6A7F000
stack
page read and write
46F9000
direct allocation
page read and write
3D0C000
heap
page read and write
175C000
stack
page read and write
3E61000
heap
page read and write
F5A000
stack
page read and write
8EE000
heap
page read and write
1496000
trusted library allocation
page execute and read and write
4553000
direct allocation
page read and write
43E000
system
page execute and read and write
D1E000
stack
page read and write
482000
unkown
page readonly
4AB000
unkown
page readonly
155E000
stack
page read and write
3E61000
heap
page read and write
3E61000
heap
page read and write
3E61000
heap
page read and write
15CE000
heap
page read and write
3CFC000
heap
page read and write
3E61000
heap
page read and write
322E000
stack
page read and write
1760000
heap
page read and write
8E0000
heap
page read and write
3B5E000
heap
page read and write
3DA2000
heap
page read and write
3160000
trusted library allocation
page read and write
5F20000
trusted library allocation
page read and write
3D84000
heap
page read and write
326D000
stack
page read and write
3B7D000
heap
page read and write
5990000
heap
page read and write
46F9000
direct allocation
page read and write
31D0000
heap
page execute and read and write
476E000
direct allocation
page read and write
357E000
stack
page read and write
3DBB000
heap
page read and write
490000
unkown
page read and write
171E000
stack
page read and write
476E000
direct allocation
page read and write
6C20000
heap
page read and write
46FD000
direct allocation
page read and write
6BBE000
stack
page read and write
1490000
trusted library allocation
page read and write
148D000
trusted library allocation
page execute and read and write
3E61000
heap
page read and write
313D000
trusted library allocation
page read and write
91C000
heap
page read and write
3E61000
heap
page read and write
4A7000
unkown
page read and write
3110000
trusted library allocation
page read and write
8EA000
heap
page read and write
32C0000
heap
page execute and read and write
5F40000
trusted library allocation
page read and write
34F2000
trusted library allocation
page read and write
1474000
trusted library allocation
page read and write
476E000
direct allocation
page read and write
54DD000
stack
page read and write
3116000
trusted library allocation
page read and write
400000
system
page execute and read and write
1460000
trusted library allocation
page read and write
3988000
heap
page read and write
6BC0000
trusted library allocation
page read and write
1647000
heap
page read and write
15E5000
heap
page read and write
46FD000
direct allocation
page read and write
400000
unkown
page readonly
3DBB000
heap
page read and write
30F0000
heap
page read and write
E5000
heap
page read and write
6BD0000
trusted library allocation
page read and write
476E000
direct allocation
page read and write
4553000
direct allocation
page read and write
16A7000
heap
page read and write
15FE000
stack
page read and write
34F8000
trusted library allocation
page read and write
3E61000
heap
page read and write
3D74000
heap
page read and write
168B000
heap
page read and write
4553000
direct allocation
page read and write
3D74000
heap
page read and write
4430000
direct allocation
page read and write
46F9000
direct allocation
page read and write
There are 235 hidden memdumps, click here to show them.