IOC Report
uk1HIyOQbk.exe

loading gif

Files

File Path
Type
Category
Malicious
uk1HIyOQbk.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\uk1HIyOQbk.exe.log
CSV text
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\uk1HIyOQbk.exe
"C:\Users\user\Desktop\uk1HIyOQbk.exe"
 malicious

URLs

Name
IP
Malicious
https://www.upload.ee
unknown
http://www.upload.ee
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://www.upload.ee/files/16412149/RouletteBotPro_x64.exe.html?msg=sess_error
unknown
https://www.upload.ee/download/16412149/89c46e99b3111e814466/RouletteBotPro_x64.exe
51.91.30.159

Domains

Name
IP
Malicious
www.upload.ee
51.91.30.159

IPs

IP
Domain
Country
Malicious
51.91.30.159
www.upload.ee
France

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uk1HIyOQbk_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
36DF000
trusted library allocation
page read and write
13668000
trusted library allocation
page read and write
7FFD9B7AD000
trusted library allocation
page execute and read and write
7FFD9B7B0000
trusted library allocation
page read and write
17CE000
stack
page read and write
1FC50000
trusted library allocation
page read and write
7FFD9B793000
trusted library allocation
page execute and read and write
A50000
heap
page read and write
7FFD9B940000
trusted library allocation
page execute and read and write
1CD1E000
stack
page read and write
3250000
heap
page execute and read and write
31E0000
heap
page read and write
8B2000
heap
page read and write
1D920000
heap
page read and write
36D3000
trusted library allocation
page read and write
1C2000
unkown
page readonly
1FB43000
heap
page read and write
1D98F000
heap
page read and write
36F8000
trusted library allocation
page read and write
89A000
heap
page read and write
7FFD9B794000
trusted library allocation
page read and write
7FFD9B7B4000
trusted library allocation
page read and write
1FB40000
heap
page read and write
1366D000
trusted library allocation
page read and write
3661000
trusted library allocation
page read and write
13C5000
heap
page read and write
EFE000
stack
page read and write
36E6000
trusted library allocation
page read and write
876000
heap
page read and write
AF5000
heap
page read and write
AF0000
heap
page read and write
3738000
trusted library allocation
page read and write
7FFD9B79D000
trusted library allocation
page execute and read and write
3701000
trusted library allocation
page read and write
8E0000
heap
page read and write
7FFD9B846000
trusted library allocation
page read and write
36E2000
trusted library allocation
page read and write
1C0000
unkown
page readonly
3715000
trusted library allocation
page read and write
36E9000
trusted library allocation
page read and write
36D6000
trusted library allocation
page read and write
1D9B5000
heap
page read and write
13661000
trusted library allocation
page read and write
3713000
trusted library allocation
page read and write
970000
heap
page read and write
1D989000
heap
page read and write
7FFD9B933000
trusted library allocation
page read and write
3725000
trusted library allocation
page read and write
1D953000
heap
page read and write
36D9000
trusted library allocation
page read and write
7FFD9B7BB000
trusted library allocation
page execute and read and write
7FFD9B84C000
trusted library allocation
page execute and read and write
8E8000
heap
page read and write
1D955000
heap
page read and write
1D997000
heap
page read and write
13663000
trusted library allocation
page read and write
A90000
heap
page read and write
365F000
stack
page read and write
7FFD9B850000
trusted library allocation
page execute and read and write
7FFD9B840000
trusted library allocation
page read and write
1D11D000
stack
page read and write
8FC000
heap
page read and write
7FF4DC5E0000
trusted library allocation
page execute and read and write
13CE000
heap
page read and write
8B5000
heap
page read and write
1D985000
heap
page read and write
1C51E000
stack
page read and write
AE0000
trusted library allocation
page read and write
36DC000
trusted library allocation
page read and write
1D51E000
stack
page read and write
1310000
trusted library allocation
page read and write
8A4000
heap
page read and write
A70000
heap
page read and write
7FFD9B7A3000
trusted library allocation
page read and write
870000
heap
page read and write
958000
heap
page read and write
7FFD9B7EC000
trusted library allocation
page execute and read and write
12FE000
stack
page read and write
1E220000
heap
page read and write
1E21E000
stack
page read and write
1DE1E000
stack
page read and write
832000
stack
page read and write
1BDDC000
stack
page read and write
87C000
heap
page read and write
13B0000
heap
page execute and read and write
7FFD9B876000
trusted library allocation
page execute and read and write
3721000
trusted library allocation
page read and write
7FFD9B8B0000
trusted library allocation
page execute and read and write
1C91E000
stack
page read and write
3090000
heap
page read and write
7FFD9B7A8000
trusted library allocation
page read and write
1D91E000
stack
page read and write
13C0000
heap
page read and write
7FFD9B7BD000
trusted library allocation
page execute and read and write
There are 84 hidden memdumps, click here to show them.