IOC Report
MV Nicos Tomasos Vessel Parts.exe

loading gif

Files

File Path
Type
Category
Malicious
MV Nicos Tomasos Vessel Parts.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MV Nicos Tomasos Vessel Parts.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MV Nicos Tomasos_b692d4534bd2b1b9e5532da6cfaa5e4d81bb2595_a4498119_50bfddeb-fee5-46c2-9160-f42a9ccc2a6d\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F42.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Jan 16 01:35:17 2025, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER50BA.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER50DA.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\MV Nicos Tomasos Vessel Parts.exe
"C:\Users\user\Desktop\MV Nicos Tomasos Vessel Parts.exe"
 malicious
C:\Users\user\Desktop\MV Nicos Tomasos Vessel Parts.exe
"C:\Users\user\Desktop\MV Nicos Tomasos Vessel Parts.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 1488

URLs

Name
IP
Malicious
http://upx.sf.net
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
https://reallyfreegeoip.org/xml/
unknown

Domains

Name
IP
Malicious
checkip.dyndns.com
193.122.6.168
checkip.dyndns.org
unknown

IPs

IP
Domain
Country
Malicious
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MV Nicos Tomasos Vessel Parts_RASMANCS
FileDirectory
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
ProgramId
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
FileId
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
LowerCaseLongPath
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
LongPathHash
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
Name
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
OriginalFileName
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
Publisher
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
Version
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
BinFileVersion
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
BinaryType
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
ProductName
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
ProductVersion
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
LinkDate
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
BinProductVersion
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
AppxPackageFullName
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
AppxPackageRelativeId
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
Size
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
Language
\REGISTRY\A\{1be27620-887f-39fc-9395-778e50f30d08}\Root\InventoryApplicationFile\mv nicos tomasos|4277eda7dd2b1cbb
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 26 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3231000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
36B6000
trusted library allocation
page read and write
 malicious
1760000
trusted library allocation
page read and write
2611000
trusted library allocation
page read and write
18AF000
stack
page read and write
A2A000
trusted library allocation
page execute and read and write
192000
unkown
page readonly
3064000
trusted library allocation
page read and write
B80000
trusted library allocation
page read and write
1790000
trusted library allocation
page execute and read and write
17A0000
heap
page read and write
53CE000
stack
page read and write
4E10000
heap
page execute and read and write
3B7000
stack
page read and write
190000
unkown
page readonly
C65000
trusted library allocation
page read and write
3080000
heap
page execute and read and write
3050000
trusted library allocation
page read and write
870000
heap
page read and write
173B000
trusted library allocation
page execute and read and write
A03000
trusted library allocation
page execute and read and write
4BC0000
trusted library section
page read and write
1770000
heap
page read and write
A0D000
trusted library allocation
page execute and read and write
81A000
heap
page read and write
A26000
trusted library allocation
page execute and read and write
1740000
heap
page read and write
C50000
trusted library allocation
page read and write
6D5000
heap
page read and write
172A000
trusted library allocation
page execute and read and write
674F000
stack
page read and write
1737000
trusted library allocation
page execute and read and write
1720000
trusted library allocation
page read and write
C70000
heap
page read and write
5BAE000
stack
page read and write
664F000
stack
page read and write
4C4E000
trusted library allocation
page read and write
4259000
trusted library allocation
page read and write
C60000
trusted library allocation
page read and write
14F6000
heap
page read and write
4C65000
trusted library allocation
page read and write
16BE000
stack
page read and write
32F0000
trusted library allocation
page read and write
310D000
stack
page read and write
4C51000
trusted library allocation
page read and write
5745000
trusted library allocation
page read and write
1340000
heap
page read and write
4CC0000
trusted library section
page read and write
A04000
trusted library allocation
page read and write
4CB0000
trusted library allocation
page read and write
1710000
trusted library allocation
page read and write
2600000
heap
page read and write
7B0000
heap
page read and write
470D000
stack
page read and write
14B0000
heap
page read and write
2BB000
stack
page read and write
505E000
stack
page read and write
3060000
trusted library allocation
page read and write
14AE000
stack
page read and write
5980000
heap
page read and write
58F0000
heap
page read and write
322F000
stack
page read and write
7F0000
heap
page read and write
A3B000
trusted library allocation
page execute and read and write
57BD000
stack
page read and write
400000
remote allocation
page execute and read and write
36B4000
trusted library allocation
page read and write
C47000
trusted library allocation
page read and write
1350000
heap
page read and write
535E000
stack
page read and write
4CB5000
trusted library allocation
page read and write
146E000
stack
page read and write
170D000
trusted library allocation
page execute and read and write
834000
heap
page read and write
3066000
trusted library allocation
page read and write
67E000
stack
page read and write
1703000
trusted library allocation
page execute and read and write
630000
heap
page read and write
4DFE000
stack
page read and write
FDB000
stack
page read and write
694E000
stack
page read and write
A50000
heap
page read and write
14C0000
heap
page read and write
32F4000
trusted library allocation
page read and write
C6D000
trusted library allocation
page read and write
30CE000
stack
page read and write
1726000
trusted library allocation
page execute and read and write
6D0000
heap
page read and write
1587000
heap
page read and write
85C000
heap
page read and write
6BE000
stack
page read and write
4C89000
trusted library allocation
page read and write
B5E000
stack
page read and write
B90000
heap
page execute and read and write
4C84000
trusted library allocation
page read and write
C68000
trusted library allocation
page read and write
5E1E000
stack
page read and write
1704000
trusted library allocation
page read and write
4C8E000
trusted library allocation
page read and write
7FE000
heap
page read and write
3070000
trusted library allocation
page read and write
C20000
trusted library allocation
page read and write
4C30000
trusted library allocation
page read and write
251E000
stack
page read and write
BDE000
stack
page read and write
525F000
stack
page read and write
515E000
stack
page read and write
B60000
trusted library allocation
page read and write
654F000
stack
page read and write
684E000
stack
page read and write
3611000
trusted library allocation
page read and write
7FA000
heap
page read and write
3120000
heap
page read and write
1732000
trusted library allocation
page read and write
4C10000
trusted library allocation
page read and write
5B6E000
stack
page read and write
4E9E000
stack
page read and write
4D0E000
stack
page read and write
5DDE000
stack
page read and write
C40000
trusted library allocation
page read and write
A14000
trusted library allocation
page read and write
4C20000
heap
page read and write
A00000
trusted library allocation
page read and write
4C32000
trusted library allocation
page read and write
A10000
trusted library allocation
page read and write
5CDF000
stack
page read and write
14DE000
heap
page read and write
A37000
trusted library allocation
page execute and read and write
5BD0000
heap
page execute and read and write
307B000
trusted library allocation
page read and write
4C80000
trusted library allocation
page read and write
1730000
trusted library allocation
page read and write
5E9E000
stack
page read and write
58CD000
stack
page read and write
14E9000
heap
page read and write
4237000
trusted library allocation
page read and write
4C56000
trusted library allocation
page read and write
5750000
trusted library allocation
page read and write
620000
heap
page read and write
85F000
heap
page read and write
1355000
heap
page read and write
12F7000
stack
page read and write
4C90000
trusted library allocation
page read and write
4C70000
trusted library allocation
page read and write
9EF000
stack
page read and write
C58000
trusted library allocation
page read and write
862000
heap
page read and write
16F0000
trusted library allocation
page read and write
4E5E000
stack
page read and write
14C8000
heap
page read and write
4C34000
trusted library allocation
page read and write
15B4000
heap
page read and write
C1E000
stack
page read and write
58E0000
heap
page read and write
5E5E000
stack
page read and write
4231000
trusted library allocation
page read and write
4C3B000
trusted library allocation
page read and write
9F0000
trusted library allocation
page read and write
4BBE000
stack
page read and write
3615000
trusted library allocation
page read and write
25FE000
stack
page read and write
B70000
trusted library allocation
page execute and read and write
There are 153 hidden memdumps, click here to show them.