IOC Report
edlyEKgpaz.exe

loading gif

Files

File Path
Type
Category
Malicious
edlyEKgpaz.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\edlyEKgpaz.exe.log
CSV text
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\edlyEKgpaz.exe
"C:\Users\user\Desktop\edlyEKgpaz.exe"
 malicious
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\edlyEKgpaz.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
132.226.247.73
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/102.129.152.231p
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
https://scratchdreams.tk
unknown
https://reallyfreegeoip.org/xml/102.129.152.231
104.21.67.152
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
checkip.dyndns.org
unknown
 malicious
reallyfreegeoip.org
104.21.67.152
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
104.21.67.152
reallyfreegeoip.org
United States
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\edlyEKgpaz_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3BB1000
trusted library allocation
page read and write
 malicious
922000
unkown
page readonly
 malicious
3D5A000
trusted library allocation
page read and write
3D8D000
trusted library allocation
page read and write
1143000
heap
page read and write
2654F810000
heap
page read and write
3DD7000
trusted library allocation
page read and write
3CFA000
trusted library allocation
page read and write
3D4A000
trusted library allocation
page read and write
3CA5000
trusted library allocation
page read and write
7FFB4B1C6000
trusted library allocation
page read and write
1240000
trusted library allocation
page read and write
F784DBE000
stack
page read and write
3D52000
trusted library allocation
page read and write
FF2000
stack
page read and write
2654F7E0000
heap
page read and write
7FF4A9170000
trusted library allocation
page execute and read and write
3CAA000
trusted library allocation
page read and write
2ECABF28000
heap
page read and write
1FB0E000
stack
page read and write
6A664FF000
unkown
page read and write
7FFB4B120000
trusted library allocation
page read and write
1CDDE000
stack
page read and write
7FFB4B2C0000
trusted library allocation
page execute and read and write
1E1DE000
stack
page read and write
7FFB4B11D000
trusted library allocation
page execute and read and write
7FFB4B1D0000
trusted library allocation
page execute and read and write
3DD3000
trusted library allocation
page read and write
1D9DF000
stack
page read and write
113B000
heap
page read and write
1C7FE000
heap
page read and write
10D0000
heap
page read and write
3DB5000
trusted library allocation
page read and write
1D1DE000
stack
page read and write
7FFB4B12D000
trusted library allocation
page execute and read and write
1E9DE000
stack
page read and write
920000
unkown
page readonly
2654F7D0000
heap
page read and write
7FFB4B13D000
trusted library allocation
page execute and read and write
7FFB4B1CC000
trusted library allocation
page execute and read and write
3CA7000
trusted library allocation
page read and write
37A0000
heap
page read and write
7FFB4B1C0000
trusted library allocation
page read and write
7FFB4B1F6000
trusted library allocation
page execute and read and write
7FFB4B129000
trusted library allocation
page read and write
2ECABEF5000
heap
page read and write
1C43D000
stack
page read and write
2ECABEF0000
heap
page read and write
2ECABE80000
heap
page read and write
1260000
trusted library allocation
page read and write
2654F85B000
heap
page read and write
13BC1000
trusted library allocation
page read and write
2654F874000
heap
page read and write
3D56000
trusted library allocation
page read and write
3DFD000
trusted library allocation
page read and write
9E0000
heap
page read and write
3700000
heap
page read and write
2ECABD80000
heap
page read and write
13BB8000
trusted library allocation
page read and write
6A661FC000
stack
page read and write
3D04000
trusted library allocation
page read and write
3D4E000
trusted library allocation
page read and write
3D62000
trusted library allocation
page read and write
377E000
stack
page read and write
1183000
heap
page read and write
1C822000
heap
page read and write
1E5DD000
stack
page read and write
2ECABF20000
heap
page read and write
1AEE000
stack
page read and write
7FFB4B123000
trusted library allocation
page read and write
3CC2000
trusted library allocation
page read and write
2654F878000
heap
page read and write
12E5000
heap
page read and write
3D7A000
trusted library allocation
page read and write
1D5DD000
stack
page read and write
2654F7E5000
heap
page read and write
7FFB4B130000
trusted library allocation
page read and write
1C890000
heap
page execute and read and write
1FF1E000
stack
page read and write
7FFB4B16C000
trusted library allocation
page execute and read and write
F784D3F000
stack
page read and write
9D0000
heap
page read and write
1280000
heap
page read and write
7FFB4B113000
trusted library allocation
page execute and read and write
1DDDE000
stack
page read and write
2ECABE60000
heap
page read and write
3D10000
trusted library allocation
page read and write
3D0C000
trusted library allocation
page read and write
3D5E000
trusted library allocation
page read and write
12E0000
heap
page read and write
3D08000
trusted library allocation
page read and write
117D000
heap
page read and write
36CF000
stack
page read and write
3730000
heap
page execute and read and write
F784CBC000
stack
page read and write
7FFB4B230000
trusted library allocation
page execute and read and write
2654FA20000
heap
page read and write
1EEE000
stack
page read and write
7FFB4B2B0000
trusted library allocation
page read and write
6A665FF000
stack
page read and write
1F6EB000
stack
page read and write
7FFB4B114000
trusted library allocation
page read and write
3BAE000
stack
page read and write
1150000
heap
page read and write
1EDDE000
stack
page read and write
3DE9000
trusted library allocation
page read and write
13BBD000
trusted library allocation
page read and write
3D66000
trusted library allocation
page read and write
1153000
heap
page read and write
2654F7F0000
heap
page read and write
1C7C8000
heap
page read and write
13BB3000
trusted library allocation
page read and write
1285000
heap
page read and write
13BB1000
trusted library allocation
page read and write
1110000
heap
page read and write
1116000
heap
page read and write
3DA1000
trusted library allocation
page read and write
2654F850000
heap
page read and write
16EE000
stack
page read and write
1F1DF000
stack
page read and write
7FFB4B134000
trusted library allocation
page read and write
3CE2000
trusted library allocation
page read and write
1C7CA000
heap
page read and write
10F0000
heap
page read and write
7FFB4B13B000
trusted library allocation
page execute and read and write
1C780000
heap
page read and write
There are 116 hidden memdumps, click here to show them.