IOC Report
JHGFDFG.exe

loading gif

Files

File Path
Type
Category
Malicious
JHGFDFG.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JHGFDFG.exe.log
CSV text
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\JHGFDFG.exe
"C:\Users\user\Desktop\JHGFDFG.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious

URLs

Name
IP
Malicious
http://checkip.dyndns.org/
193.122.6.168
https://reallyfreegeoip.org/xml/8.46.123.189
104.21.48.1
https://reallyfreegeoip.org/xml/8.46.123.189l
unknown
http://checkip.dyndns.comd
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.orgd
unknown
https://reallyfreegeoip.org/xml/8.46.123.189d
unknown
http://reallyfreegeoip.org
unknown
http://checkip.dyndns.orgd
unknown
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.com
unknown
http://checkip.dyndns.org/d
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://api.telegram.org/bot-/sendDocument?chat_id=
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 6 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
104.21.48.1
checkip.dyndns.com
193.122.6.168
checkip.dyndns.org
unknown

IPs

IP
Domain
Country
Malicious
104.21.48.1
reallyfreegeoip.org
United States
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3BF5000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
3411000
trusted library allocation
page read and write
9EE000
stack
page read and write
F7D000
trusted library allocation
page execute and read and write
3456000
trusted library allocation
page read and write
5E50000
trusted library allocation
page execute and read and write
5E10000
trusted library allocation
page execute and read and write
6AC0000
heap
page read and write
6810000
trusted library allocation
page read and write
15D0000
heap
page read and write
2BEE000
stack
page read and write
5E0E000
stack
page read and write
662C000
heap
page read and write
F4E000
stack
page read and write
3396000
trusted library allocation
page read and write
5E20000
trusted library allocation
page read and write
FE0000
heap
page read and write
1025000
heap
page read and write
33D9000
trusted library allocation
page read and write
1535000
trusted library allocation
page execute and read and write
5890000
trusted library allocation
page read and write
57AD000
stack
page read and write
183E000
trusted library allocation
page read and write
33AE000
trusted library allocation
page read and write
15B0000
trusted library allocation
page execute and read and write
1664000
heap
page read and write
4369000
trusted library allocation
page read and write
6A60000
heap
page read and write
340C000
trusted library allocation
page read and write
339E000
trusted library allocation
page read and write
184E000
trusted library allocation
page read and write
F84000
trusted library allocation
page read and write
F60000
trusted library allocation
page read and write
2990000
trusted library allocation
page read and write
332E000
stack
page read and write
183B000
trusted library allocation
page read and write
3331000
trusted library allocation
page read and write
15AE000
stack
page read and write
1522000
trusted library allocation
page read and write
1870000
trusted library allocation
page read and write
FAB000
trusted library allocation
page execute and read and write
344F000
trusted library allocation
page read and write
5870000
trusted library allocation
page read and write
5DCE000
stack
page read and write
185D000
trusted library allocation
page read and write
1537000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
660E000
stack
page read and write
2980000
trusted library allocation
page execute and read and write
FC0000
heap
page read and write
163B000
heap
page read and write
589B000
trusted library allocation
page read and write
189C000
trusted library allocation
page read and write
1851000
trusted library allocation
page read and write
1836000
trusted library allocation
page read and write
12F7000
stack
page read and write
6820000
trusted library allocation
page read and write
16C2000
heap
page read and write
980000
heap
page read and write
5E40000
trusted library allocation
page execute and read and write
18B0000
heap
page read and write
5880000
heap
page execute and read and write
5E3A000
trusted library allocation
page read and write
6610000
heap
page read and write
9A0000
heap
page read and write
2AE0000
heap
page read and write
57EE000
stack
page read and write
58A3000
heap
page read and write
F74000
trusted library allocation
page read and write
E45000
heap
page read and write
832000
unkown
page readonly
15C0000
trusted library allocation
page read and write
1014000
heap
page read and write
1862000
trusted library allocation
page read and write
5B8E000
stack
page read and write
1510000
trusted library allocation
page read and write
153B000
trusted library allocation
page execute and read and write
3449000
trusted library allocation
page read and write
1310000
heap
page read and write
1022000
heap
page read and write
582E000
stack
page read and write
542E000
stack
page read and write
342A000
trusted library allocation
page read and write
1530000
trusted library allocation
page read and write
F73000
trusted library allocation
page execute and read and write
58A0000
heap
page read and write
CF9000
stack
page read and write
3433000
trusted library allocation
page read and write
29A0000
heap
page execute and read and write
6950000
heap
page read and write
33EA000
trusted library allocation
page read and write
344B000
trusted library allocation
page read and write
14A0000
heap
page read and write
5E36000
trusted library allocation
page read and write
F80000
trusted library allocation
page read and write
1620000
trusted library allocation
page read and write
33CD000
trusted library allocation
page read and write
5C8E000
stack
page read and write
1560000
heap
page read and write
2ACD000
stack
page read and write
FE8000
heap
page read and write
13F0000
heap
page read and write
33E6000
trusted library allocation
page read and write
150D000
trusted library allocation
page execute and read and write
876000
unkown
page readonly
152A000
trusted library allocation
page execute and read and write
43A1000
trusted library allocation
page read and write
3393000
trusted library allocation
page read and write
3486000
trusted library allocation
page read and write
3420000
trusted library allocation
page read and write
5060000
heap
page execute and read and write
1526000
trusted library allocation
page execute and read and write
14D0000
heap
page read and write
16BE000
heap
page read and write
3443000
trusted library allocation
page read and write
1504000
trusted library allocation
page read and write
1890000
trusted library allocation
page read and write
680E000
stack
page read and write
91C000
stack
page read and write
339B000
trusted library allocation
page read and write
1503000
trusted library allocation
page execute and read and write
33EE000
trusted library allocation
page read and write
33B0000
trusted library allocation
page read and write
11DE000
stack
page read and write
FA9000
stack
page read and write
E10000
heap
page read and write
342F000
trusted library allocation
page read and write
3220000
heap
page execute and read and write
1899000
trusted library allocation
page read and write
990000
heap
page read and write
1550000
trusted library allocation
page read and write
E40000
heap
page read and write
5D8F000
stack
page read and write
1500000
trusted library allocation
page read and write
2BF1000
trusted library allocation
page read and write
4331000
trusted library allocation
page read and write
435D000
trusted library allocation
page read and write
29EE000
stack
page read and write
1856000
trusted library allocation
page read and write
6840000
trusted library allocation
page read and write
3BF1000
trusted library allocation
page read and write
161E000
stack
page read and write
1532000
trusted library allocation
page read and write
14D5000
heap
page read and write
FEE000
heap
page read and write
4CED000
stack
page read and write
151D000
trusted library allocation
page execute and read and write
14F0000
trusted library allocation
page read and write
1520000
trusted library allocation
page read and write
3417000
trusted library allocation
page read and write
FA7000
trusted library allocation
page execute and read and write
6652000
heap
page read and write
4354000
trusted library allocation
page read and write
5E34000
trusted library allocation
page read and write
1007000
heap
page read and write
830000
unkown
page readonly
184A000
trusted library allocation
page read and write
1830000
trusted library allocation
page read and write
100B000
heap
page read and write
E0E000
stack
page read and write
6830000
trusted library allocation
page execute and read and write
1630000
heap
page read and write
1677000
heap
page read and write
There are 154 hidden memdumps, click here to show them.