IOC Report
#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe_

loading gif

Files

File Path
Type
Category
Malicious
#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5yynygse.zfg.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gljjiien.hsp.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n50tx1ur.3ua.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ou1lcgr4.bk3.psm1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe
"C:\Users\user\Desktop\#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe"
 malicious
C:\Users\user\Desktop\#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe
"C:\Users\user\Desktop\#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/155.94.241.188$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://reallyfreegeoip.org/xml/155.94.241.188
188.114.97.3
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
193.122.6.168
unknown
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\#U304a#U898b#U7a4d#U308a#U4f9d#U983c_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
3071000
trusted library allocation
page read and write
 malicious
5440000
trusted library section
page read and write
 malicious
39A1000
trusted library allocation
page read and write
 malicious
278E000
stack
page read and write
6CBE000
stack
page read and write
683E000
stack
page read and write
1340000
trusted library allocation
page read and write
F30000
trusted library allocation
page read and write
33E5000
heap
page read and write
9CFE000
stack
page read and write
5CEE000
stack
page read and write
5490000
heap
page read and write
422000
remote allocation
page execute and read and write
A0BD000
stack
page read and write
6DD7000
heap
page read and write
5A1D000
stack
page read and write
3BCB000
trusted library allocation
page read and write
1334000
trusted library allocation
page read and write
FAE000
stack
page read and write
327F000
stack
page read and write
311A000
trusted library allocation
page read and write
F0B000
stack
page read and write
4E90000
trusted library allocation
page read and write
DAC000
stack
page read and write
18A9000
trusted library allocation
page read and write
1356000
trusted library allocation
page execute and read and write
3110000
heap
page read and write
2722000
trusted library allocation
page read and write
2FDE000
stack
page read and write
31F0000
heap
page read and write
1670000
heap
page read and write
165E000
stack
page read and write
1352000
trusted library allocation
page read and write
DEC000
stack
page read and write
33CC000
heap
page read and write
27E0000
trusted library allocation
page read and write
5E2000
unkown
page readonly
31E3000
trusted library allocation
page read and write
E50000
heap
page read and write
BA6000
heap
page read and write
6B60000
heap
page read and write
6B3E000
stack
page read and write
6C3E000
stack
page read and write
FB0000
heap
page read and write
5770000
trusted library allocation
page read and write
E9E000
stack
page read and write
2712000
trusted library allocation
page read and write
7F7000
stack
page read and write
33E3000
heap
page read and write
A1BD000
stack
page read and write
EA0000
heap
page read and write
31B4000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
6CFE000
stack
page read and write
2936000
trusted library allocation
page read and write
6C7E000
stack
page read and write
A90000
heap
page read and write
29A1000
trusted library allocation
page read and write
4FE0000
trusted library section
page readonly
B76000
heap
page read and write
3132000
trusted library allocation
page read and write
70BD000
stack
page read and write
135A000
trusted library allocation
page execute and read and write
54B0000
heap
page read and write
1894000
trusted library allocation
page read and write
520C000
stack
page read and write
6D9F000
stack
page read and write
2A3B000
trusted library allocation
page read and write
3174000
trusted library allocation
page read and write
9CB0000
trusted library allocation
page read and write
3122000
trusted library allocation
page read and write
9F3E000
stack
page read and write
31C0000
trusted library allocation
page read and write
323E000
stack
page read and write
5580000
trusted library allocation
page execute and read and write
13B8000
heap
page read and write
687E000
stack
page read and write
A60000
heap
page read and write
FE0000
heap
page read and write
B09000
heap
page read and write
18A6000
trusted library allocation
page read and write
4FF3000
heap
page read and write
3178000
trusted library allocation
page read and write
66FE000
stack
page read and write
2720000
trusted library allocation
page read and write
188E000
trusted library allocation
page read and write
30FD000
stack
page read and write
2800000
heap
page read and write
DCF000
stack
page read and write
673E000
stack
page read and write
31AC000
trusted library allocation
page read and write
4FF0000
heap
page read and write
145A000
heap
page read and write
65FE000
stack
page read and write
B44000
heap
page read and write
7100000
trusted library allocation
page execute and read and write
50E0000
heap
page read and write
3162000
trusted library allocation
page read and write
18C0000
heap
page read and write
A3FE000
stack
page read and write
5CAE000
stack
page read and write
1350000
trusted library allocation
page read and write
314D000
trusted library allocation
page read and write
323A000
trusted library allocation
page read and write
13B0000
heap
page read and write
2740000
trusted library allocation
page read and write
3164000
trusted library allocation
page read and write
F50000
trusted library allocation
page read and write
5D40000
trusted library allocation
page read and write
F5D000
trusted library allocation
page execute and read and write
368F000
heap
page read and write
B20000
heap
page read and write
6FA000
stack
page read and write
697F000
stack
page read and write
161C000
stack
page read and write
6C9E000
stack
page read and write
A95000
heap
page read and write
7F0C0000
trusted library allocation
page execute and read and write
293D000
trusted library allocation
page read and write
4077000
trusted library allocation
page read and write
6DA0000
heap
page read and write
35BF000
stack
page read and write
29E6000
trusted library allocation
page read and write
27F0000
trusted library allocation
page read and write
1664000
trusted library allocation
page read and write
5110000
heap
page execute and read and write
2970000
trusted library allocation
page read and write
2950000
trusted library allocation
page read and write
1333000
trusted library allocation
page execute and read and write
3620000
heap
page read and write
5D2D000
stack
page read and write
A92C000
stack
page read and write
187E000
stack
page read and write
DE0000
heap
page read and write
9E3E000
stack
page read and write
5470000
heap
page read and write
B0E000
heap
page read and write
F60000
heap
page read and write
5E0000
unkown
page readonly
E2E000
stack
page read and write
33C0000
heap
page read and write
5790000
heap
page read and write
1367000
trusted library allocation
page execute and read and write
1666000
trusted library allocation
page read and write
2931000
trusted library allocation
page read and write
63FE000
stack
page read and write
A50000
heap
page read and write
31C8000
trusted library allocation
page read and write
A2FE000
stack
page read and write
4071000
trusted library allocation
page read and write
333F000
unkown
page read and write
69BC000
heap
page read and write
33E1000
heap
page read and write
27CC000
stack
page read and write
B42000
heap
page read and write
1884000
trusted library allocation
page read and write
4EF0000
trusted library allocation
page execute and read and write
1330000
trusted library allocation
page read and write
A07E000
stack
page read and write
13E6000
heap
page read and write
A6AE000
stack
page read and write
F4D000
trusted library allocation
page execute and read and write
2FF0000
heap
page read and write
12F7000
stack
page read and write
49A8000
trusted library allocation
page read and write
6ABE000
stack
page read and write
50D0000
heap
page read and write
31D5000
trusted library allocation
page read and write
271A000
trusted library allocation
page execute and read and write
4FC0000
trusted library allocation
page read and write
3B8C000
trusted library allocation
page read and write
2965000
trusted library allocation
page read and write
69BE000
heap
page read and write
5590000
trusted library allocation
page read and write
A96E000
stack
page read and write
6FBC000
stack
page read and write
322C000
trusted library allocation
page read and write
3340000
heap
page read and write
A82B000
stack
page read and write
ADE000
stack
page read and write
3380000
heap
page read and write
59DD000
stack
page read and write
4ED0000
heap
page read and write
1380000
trusted library allocation
page read and write
5660000
heap
page read and write
2990000
heap
page execute and read and write
2716000
trusted library allocation
page execute and read and write
316C000
trusted library allocation
page read and write
6E03000
heap
page read and write
50F0000
trusted library allocation
page execute and read and write
77AE000
stack
page read and write
321E000
trusted library allocation
page read and write
5460000
trusted library allocation
page read and write
5B2F000
stack
page read and write
31F0000
trusted library allocation
page read and write
1660000
trusted library allocation
page read and write
69E0000
heap
page read and write
F53000
trusted library allocation
page read and write
2960000
trusted library allocation
page read and write
15BE000
stack
page read and write
2914000
trusted library allocation
page read and write
9DFE000
stack
page read and write
FD0000
heap
page read and write
5C6D000
stack
page read and write
6DBB000
heap
page read and write
F67000
heap
page read and write
18B5000
trusted library allocation
page read and write
1360000
trusted library allocation
page read and write
6DF2000
heap
page read and write
5480000
heap
page read and write
1362000
trusted library allocation
page read and write
FD5000
heap
page read and write
9F7E000
stack
page read and write
F43000
trusted library allocation
page execute and read and write
F40000
trusted library allocation
page read and write
6980000
heap
page read and write
321A000
trusted library allocation
page read and write
4B3B000
stack
page read and write
503B000
stack
page read and write
7640000
trusted library section
page read and write
AA80000
trusted library allocation
page read and write
2BB9000
trusted library allocation
page read and write
5A20000
heap
page execute and read and write
F44000
trusted library allocation
page read and write
31B8000
trusted library allocation
page read and write
6DEE000
heap
page read and write
31FE000
trusted library allocation
page read and write
70D0000
heap
page read and write
2710000
trusted library allocation
page read and write
4EE0000
trusted library allocation
page read and write
AA82000
trusted library allocation
page read and write
69C1000
heap
page read and write
18A1000
trusted library allocation
page read and write
6DC5000
heap
page read and write
A44E000
stack
page read and write
711E000
stack
page read and write
1390000
trusted library allocation
page execute and read and write
292E000
trusted library allocation
page read and write
6DD2000
heap
page read and write
B00000
heap
page read and write
136B000
trusted library allocation
page execute and read and write
15C0000
trusted library allocation
page read and write
A7AF000
stack
page read and write
3450000
heap
page read and write
AA6F000
stack
page read and write
323E000
unkown
page read and write
6DFE000
stack
page read and write
AE0000
heap
page read and write
4F00000
trusted library allocation
page read and write
3458000
heap
page read and write
564F000
stack
page read and write
6DFE000
heap
page read and write
2942000
trusted library allocation
page read and write
27D0000
trusted library allocation
page execute and read and write
337E000
stack
page read and write
18C7000
heap
page read and write
2727000
trusted library allocation
page execute and read and write
B35000
heap
page read and write
272B000
trusted library allocation
page execute and read and write
133D000
trusted library allocation
page execute and read and write
6DB3000
heap
page read and write
31C4000
trusted library allocation
page read and write
2DAD000
stack
page read and write
721F000
stack
page read and write
13DA000
heap
page read and write
177F000
stack
page read and write
1498000
heap
page read and write
291B000
trusted library allocation
page read and write
F60000
heap
page read and write
3135000
trusted library allocation
page read and write
13CE000
heap
page read and write
F2E000
stack
page read and write
6AFF000
stack
page read and write
13A0000
heap
page read and write
1320000
trusted library allocation
page read and write
55A0000
trusted library allocation
page read and write
50C0000
heap
page read and write
4EE2000
trusted library allocation
page read and write
290E000
stack
page read and write
31B0000
trusted library allocation
page read and write
A1C0000
heap
page read and write
31BC000
trusted library allocation
page read and write
7262000
trusted library allocation
page read and write
714E000
stack
page read and write
A54E000
stack
page read and write
B28000
heap
page read and write
3170000
trusted library allocation
page read and write
15D0000
heap
page execute and read and write
4099000
trusted library allocation
page read and write
53AE000
stack
page read and write
5475000
heap
page read and write
368F000
heap
page read and write
BBE000
heap
page read and write
5C2E000
stack
page read and write
5650000
trusted library allocation
page read and write
2910000
trusted library allocation
page read and write
64FE000
stack
page read and write
There are 288 hidden memdumps, click here to show them.