IOC Report
tfSYi9zABT.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\tfSYi9zABT.exe
"C:\Users\user\Desktop\tfSYi9zABT.exe"
 malicious

URLs

Name
IP
Malicious
http://ip-api.com/json/
208.95.112.1
 malicious
~^')}-{#
malicious
http://api.ipify.org/
unknown
http://freegeoip.net/xml/
unknown
http://schemas.datacontract.org/2004/07/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
 malicious
crissnda5.ddns.net
87.121.86.32
 malicious

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
87.121.86.32
crissnda5.ddns.net
Bulgaria
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tfSYi9zABT_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
B02000
unkown
page readonly
 malicious
7FFD9B770000
trusted library allocation
page read and write
7FFD9B940000
trusted library allocation
page read and write
7FFD9B77D000
trusted library allocation
page execute and read and write
1B9E2000
heap
page read and write
1B280000
heap
page read and write
106B000
trusted library allocation
page read and write
7FFD9B75D000
trusted library allocation
page execute and read and write
12BE000
stack
page read and write
7FF4DC9A0000
trusted library allocation
page execute and read and write
7FFD9B950000
trusted library allocation
page execute and read and write
1080000
trusted library allocation
page read and write
1060000
trusted library allocation
page read and write
FD0000
heap
page read and write
7FFD9B970000
trusted library allocation
page read and write
1B9E0000
heap
page read and write
1BCAB000
stack
page read and write
7FFD9B77B000
trusted library allocation
page execute and read and write
1B48D000
stack
page read and write
1C2EE000
stack
page read and write
1B7D0000
heap
page read and write
1030000
heap
page read and write
2F01000
trusted library allocation
page read and write
B00000
unkown
page readonly
7FFD9B806000
trusted library allocation
page read and write
7FFD9B980000
trusted library allocation
page read and write
7FFD9B763000
trusted library allocation
page read and write
10FF000
heap
page read and write
10B0000
heap
page read and write
EF4000
stack
page read and write
7FFD9B90D000
trusted library allocation
page read and write
7FFD9B774000
trusted library allocation
page read and write
7FFD9B920000
trusted library allocation
page execute and read and write
2CE0000
heap
page read and write
1130000
heap
page read and write
35AB000
trusted library allocation
page read and write
1BDAE000
stack
page read and write
1BA2C000
heap
page read and write
1C4E9000
stack
page read and write
7FFD9B9A0000
trusted library allocation
page read and write
1BA39000
heap
page read and write
7FFD9B754000
trusted library allocation
page read and write
1090000
trusted library allocation
page read and write
1035000
heap
page read and write
7FFD9B752000
trusted library allocation
page read and write
30B3000
trusted library allocation
page read and write
1C5EA000
stack
page read and write
1B9FF000
heap
page read and write
2DF0000
heap
page read and write
7FFD9B8F0000
trusted library allocation
page read and write
2EFE000
stack
page read and write
1BA28000
heap
page read and write
112A000
heap
page read and write
7FFD9B914000
trusted library allocation
page read and write
7FFD9B76D000
trusted library allocation
page execute and read and write
7FFD9B80C000
trusted library allocation
page execute and read and write
7FFD9B960000
trusted library allocation
page read and write
1B9D4000
heap
page read and write
7FFD9B990000
trusted library allocation
page read and write
7FFD9B900000
trusted library allocation
page read and write
10B5000
heap
page read and write
1010000
heap
page read and write
1B9B0000
heap
page read and write
7FFD9B870000
trusted library allocation
page execute and read and write
7FFD9B753000
trusted library allocation
page execute and read and write
7FFD9B750000
trusted library allocation
page read and write
7FFD9B96C000
trusted library allocation
page read and write
7FFD9B910000
trusted library allocation
page read and write
7FFD9B7AC000
trusted library allocation
page execute and read and write
1BA18000
heap
page read and write
7FFD9B810000
trusted library allocation
page execute and read and write
12F01000
trusted library allocation
page read and write
2D30000
heap
page execute and read and write
1B9A0000
heap
page execute and read and write
10C9000
heap
page read and write
B5A000
unkown
page readonly
7FFD9B836000
trusted library allocation
page execute and read and write
FF0000
heap
page read and write
7FFD9B906000
trusted library allocation
page read and write
1B8CE000
heap
page read and write
BE0000
heap
page read and write
10E7000
heap
page read and write
10FD000
heap
page read and write
1B9DE000
heap
page read and write
7FFD9B800000
trusted library allocation
page read and write
B00000
unkown
page readonly
7FFD9B930000
trusted library allocation
page execute and read and write
1093000
trusted library allocation
page read and write
10C0000
heap
page read and write
1AF30000
trusted library allocation
page read and write
1B87B000
heap
page read and write
There are 81 hidden memdumps, click here to show them.