IOC Report
f_001f19#U007e

loading gif

Processes

Path
Cmdline
Malicious
C:\Windows\System32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding

URLs

Name
IP
Malicious
https://metropolitanderm.com/wp-content/themes/jevelin/js/scripts.js
unknown
http://jquery.org/license
unknown
https://github.com/carhartl/jquery-cookie
unknown
http://masonry.desandro.com
unknown
https://metropolitanderm.com/wp-content/themes/jevelin/js/jquery.sumoselect.min.js
unknown
https://metropolitanderm.com/wp-includes/js/masonry.min.js
unknown
http://jqueryui.com
unknown
http://hemantnegi.github.io/jquery.sumoselect
unknown
https://github.com/imakewebthings/waypoints/blog/master/licenses.txt
unknown
https://metropolitanderm.com/wp-content/plugins/bellows-accordion-menu/assets/js/bellows.min.js
unknown
http://nkdev.info
unknown
http://js-socials.com
unknown
https://metropolitanderm.com/wp-includes/js/imagesloaded.min.js
unknown
https://metropolitanderm.com/wp-includes/js/jquery/ui/effect.min.js
unknown
https://github.com/jquery/jquery-color
unknown
https://metropolitanderm.com/wp-content/plugins/ml-slider/assets/sliders/flexslider/jquery.flexslide
unknown
http://gambit.ph
unknown
https://metropolitanderm.com/wp-content/themes/jevelin/js/scripts.lib.js
unknown
http://isotope.metafizzy.co
unknown
http://getbootstrap.com)
unknown
http://api.jqueryui.com/category/effects-core/
unknown
https://github.com/nk-o/jarallax
unknown
http://dreamerslab.com/)
unknown
https://metropolitanderm.com/wp-includes/js/wp-embed.min.js
unknown
https://nkdev.info
unknown
There are 15 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Mozilla Firefox\firefox.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Mozilla Firefox\firefox.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Internet Explorer\iexplore.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Internet Explorer\iexplore.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\mspaint.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\mspaint.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\NOTEPAD.EXE.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\NOTEPAD.EXE.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\root\Office16\Winword.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\root\Office16\Winword.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Windows Media Player\wmplayer.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Windows Media Player\wmplayer.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.ApplicationCompany
There are 8 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1F3C413F000
heap
page read and write
1F3C414F000
heap
page read and write
1F3C4251000
heap
page read and write
1F3C42CA000
heap
page read and write
1F3C229E000
heap
page read and write
1F3C22A3000
heap
page read and write
1F3C22EB000
heap
page read and write
1F3C2281000
heap
page read and write
1F3C228D000
heap
page read and write
1F3C4252000
heap
page read and write
1F3C413F000
heap
page read and write
1F3C4227000
heap
page read and write
1F3C3C30000
heap
page read and write
1F3C42BC000
heap
page read and write
1F3C22A4000
heap
page read and write
1F3C42AA000
heap
page read and write
1F3C42AA000
heap
page read and write
1F3C2298000
heap
page read and write
1F3C22A4000
heap
page read and write
1F3C22B3000
heap
page read and write
1F3C22B9000
heap
page read and write
1F3C4152000
heap
page read and write
1F3C4164000
heap
page read and write
1F3C229A000
heap
page read and write
1F3C4223000
heap
page read and write
1F3C2263000
heap
page read and write
1F3C4155000
heap
page read and write
1F3C42BC000
heap
page read and write
1F3C22EB000
heap
page read and write
1F3C6A83000
heap
page read and write
1F3C42DA000
heap
page read and write
1F3C4291000
heap
page read and write
49B747C000
stack
page read and write
1F3C6DE0000
heap
page read and write
1F3C415F000
heap
page read and write
1F3C415F000
heap
page read and write
1F3C4295000
heap
page read and write
1F3C6A69000
heap
page read and write
1F3C6A78000
heap
page read and write
1F3C4244000
heap
page read and write
1F3C4143000
heap
page read and write
1F3C422F000
heap
page read and write
1F3C6A7D000
heap
page read and write
1F3C4210000
heap
page read and write
1F3C42AE000
heap
page read and write
1F3C42A1000
heap
page read and write
49B72FE000
stack
page read and write
1F3C42DA000
heap
page read and write
1F3C22AC000
heap
page read and write
1F3C228E000
heap
page read and write
1F3C42CA000
heap
page read and write
1F3C4143000
heap
page read and write
1F3C4297000
heap
page read and write
49B76FE000
stack
page read and write
1F3C4110000
heap
page read and write
1F3C4247000
heap
page read and write
1F3C42BC000
heap
page read and write
1F3C4155000
heap
page read and write
1F3C415A000
heap
page read and write
1F3C4131000
heap
page read and write
1F3C228D000
heap
page read and write
1F3C414B000
heap
page read and write
1F3C42F9000
heap
page read and write
1F3C42AA000
heap
page read and write
1F3C4244000
heap
page read and write
1F3C42AE000
heap
page read and write
1F3C4232000
heap
page read and write
1F3C424D000
heap
page read and write
1F3C22BC000
heap
page read and write
1F3C42A1000
heap
page read and write
1F3C228D000
heap
page read and write
1F3C413F000
heap
page read and write
1F3C42DE000
heap
page read and write
1F3C414B000
heap
page read and write
1F3C413F000
heap
page read and write
1F3C2286000
heap
page read and write
1F3C415C000
heap
page read and write
1F3C42DA000
heap
page read and write
1F3C414F000
heap
page read and write
1F3C4167000
heap
page read and write
49B77FB000
stack
page read and write
1F3C6A94000
heap
page read and write
49B737E000
stack
page read and write
1F3C4146000
heap
page read and write
1F3C4144000
heap
page read and write
1F3C42C1000
heap
page read and write
1F3C4140000
heap
page read and write
1F3C414C000
heap
page read and write
1F3C42F9000
heap
page read and write
1F3C415F000
heap
page read and write
1F3C4144000
heap
page read and write
1F3C42AE000
heap
page read and write
1F3C415F000
heap
page read and write
1F3C42C1000
heap
page read and write
1F3C414F000
heap
page read and write
1F3C415A000
heap
page read and write
1F3C2294000
heap
page read and write
1F3C4138000
heap
page read and write
1F3C4134000
heap
page read and write
1F3C423A000
heap
page read and write
1F3C3B20000
heap
page read and write
1F3C22BD000
heap
page read and write
1F3C2297000
heap
page read and write
1F3C42AE000
heap
page read and write
1F3C42BC000
heap
page read and write
1F3C22EB000
heap
page read and write
1F3C422F000
heap
page read and write
1F3C6A7E000
heap
page read and write
1F3C415A000
heap
page read and write
1F3C3C35000
heap
page read and write
1F3C422F000
heap
page read and write
1F3C22C5000
heap
page read and write
1F3C421A000
heap
page read and write
1F3C42DA000
heap
page read and write
1F3C21F0000
heap
page read and write
1F3C42DA000
heap
page read and write
1F3C416C000
heap
page read and write
1F3C415F000
heap
page read and write
1F3C2281000
heap
page read and write
1F3C21A0000
heap
page read and write
1F3C42BC000
heap
page read and write
1F3C415C000
heap
page read and write
1F3C22A3000
heap
page read and write
1F3C42A1000
heap
page read and write
1F3C42A1000
heap
page read and write
1F3C228B000
heap
page read and write
1F3C2285000
heap
page read and write
1F3C229E000
heap
page read and write
1F3C2263000
heap
page read and write
1F3C6A72000
heap
page read and write
1F3C416C000
heap
page read and write
1F3C426E000
heap
page read and write
1F3C20C0000
heap
page read and write
1F3C42BC000
heap
page read and write
1F3C42BC000
heap
page read and write
1F3C4155000
heap
page read and write
1F3C4164000
heap
page read and write
1F3C42A1000
heap
page read and write
1F3C4129000
heap
page read and write
1F3C415A000
heap
page read and write
1F3C22EB000
heap
page read and write
1F3C4155000
heap
page read and write
1F3C22EB000
heap
page read and write
1F3C2285000
heap
page read and write
1F3C22A4000
heap
page read and write
1F3C228B000
heap
page read and write
1F3C414F000
heap
page read and write
1F3C4144000
heap
page read and write
1F3C414F000
heap
page read and write
1F3C42AA000
heap
page read and write
1F3C415F000
heap
page read and write
1F3C416B000
heap
page read and write
1F3C4120000
heap
page read and write
1F3C6A60000
heap
page read and write
1F3C414F000
heap
page read and write
1F3C4164000
heap
page read and write
1F3C22AE000
heap
page read and write
1F3C22BD000
heap
page read and write
1F3C413F000
heap
page read and write
49B73FD000
stack
page read and write
1F3C4155000
heap
page read and write
1F3C22B1000
heap
page read and write
1F3C415F000
heap
page read and write
1F3C4164000
heap
page read and write
1F3C42DA000
heap
page read and write
1F3C42AE000
heap
page read and write
1F3C22EB000
heap
page read and write
1F3C42AE000
heap
page read and write
1F3C42A1000
heap
page read and write
1F3C22E3000
heap
page read and write
1F3C4135000
heap
page read and write
1F3C4126000
heap
page read and write
1F3C4272000
heap
page read and write
1F3C2285000
heap
page read and write
1F3C42CA000
heap
page read and write
1F3C4143000
heap
page read and write
1F3C415A000
heap
page read and write
1F3C22BF000
heap
page read and write
1F3C42DA000
heap
page read and write
1F3C4251000
heap
page read and write
1F3C22B8000
heap
page read and write
1F3C6A9D000
heap
page read and write
1F3C22B3000
heap
page read and write
1F3C6A7C000
heap
page read and write
1F3C22D4000
heap
page read and write
1F3C414F000
heap
page read and write
1F3C22EE000
heap
page read and write
1F3C4251000
heap
page read and write
1F3C2295000
heap
page read and write
1F3C22C1000
heap
page read and write
49B74FB000
stack
page read and write
1F3C4147000
heap
page read and write
1F3C22B2000
heap
page read and write
1F3C42A1000
heap
page read and write
1F3C415F000
heap
page read and write
1F3C42CA000
heap
page read and write
1F3C413B000
heap
page read and write
1F3C42BC000
heap
page read and write
1F3C42DF000
heap
page read and write
1F3C414B000
heap
page read and write
1F3C22C1000
heap
page read and write
1F3C415F000
heap
page read and write
1F3C412C000
heap
page read and write
1F3C22AD000
heap
page read and write
1F3C6A78000
heap
page read and write
1F3C4293000
heap
page read and write
1F3C22AE000
heap
page read and write
1F3C6A7E000
heap
page read and write
1F3C42AA000
heap
page read and write
1F3C42C1000
heap
page read and write
1F3C4139000
heap
page read and write
1F3C22D7000
heap
page read and write
1F3C4164000
heap
page read and write
1F3C42C1000
heap
page read and write
1F3C4212000
heap
page read and write
1F3C42CA000
heap
page read and write
1F3C42CA000
heap
page read and write
1F3C2258000
heap
page read and write
1F3C42A1000
heap
page read and write
1F3C42CA000
heap
page read and write
1F3C3A90000
heap
page read and write
1F3C413F000
heap
page read and write
1F3C4251000
heap
page read and write
1F3C4164000
heap
page read and write
1F3C229D000
heap
page read and write
1F3C22A4000
heap
page read and write
1F3C42AE000
heap
page read and write
1F3C2294000
heap
page read and write
1F3C4251000
heap
page read and write
1F3C42DA000
heap
page read and write
1F3C6A74000
heap
page read and write
1F3C415F000
heap
page read and write
1F3C42CA000
heap
page read and write
1F3C6360000
trusted library allocation
page read and write
1F3C42AE000
heap
page read and write
1F3C4244000
heap
page read and write
1F3C4120000
heap
page read and write
1F3C4132000
heap
page read and write
1F3C415A000
heap
page read and write
1F3C414F000
heap
page read and write
1F3C22C4000
heap
page read and write
1F3C415F000
heap
page read and write
49B777D000
stack
page read and write
1F3C228D000
heap
page read and write
1F3C6A8B000
heap
page read and write
1F3C4128000
heap
page read and write
1F3C42F9000
heap
page read and write
1F3C4244000
heap
page read and write
1F3C2297000
heap
page read and write
1F3C42C1000
heap
page read and write
1F3C415A000
heap
page read and write
1F3C229E000
heap
page read and write
1F3C4140000
heap
page read and write
1F3C2295000
heap
page read and write
1F3C2225000
heap
page read and write
1F3C42E5000
heap
page read and write
1F3C42E3000
heap
page read and write
1F3C42AA000
heap
page read and write
1F3C412C000
heap
page read and write
1F3C6A90000
heap
page read and write
1F3C42AA000
heap
page read and write
1F3C415C000
heap
page read and write
1F3C2298000
heap
page read and write
1F3C4244000
heap
page read and write
1F3C412C000
heap
page read and write
1F3C22DF000
heap
page read and write
1F3C228D000
heap
page read and write
1F3C2285000
heap
page read and write
1F3C42C1000
heap
page read and write
1F3C22C8000
heap
page read and write
49B727E000
stack
page read and write
1F3C424C000
heap
page read and write
1F3C424C000
heap
page read and write
1F3C6A90000
heap
page read and write
1F3C22CF000
heap
page read and write
1F3C413F000
heap
page read and write
1F3C414F000
heap
page read and write
1F3C4155000
heap
page read and write
1F3C413A000
heap
page read and write
1F3C413F000
heap
page read and write
1F3C42AA000
heap
page read and write
1F3C42C1000
heap
page read and write
49B6FD6000
stack
page read and write
1F3C229E000
heap
page read and write
1F3C22ED000
heap
page read and write
1F3C42C1000
heap
page read and write
1F3C22A4000
heap
page read and write
1F3C423A000
heap
page read and write
1F3C413B000
heap
page read and write
1F3C4137000
heap
page read and write
1F3C424C000
heap
page read and write
There are 281 hidden memdumps, click here to show them.