IOC Report
Proforma Invoice - Well Ergon.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe
"C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe"
 malicious
C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe
"C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe"
 malicious
C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe
"C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe"
 malicious
C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe
"C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe"
 malicious
C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe
"C:\Users\user\Desktop\Proforma Invoice - Well Ergon.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 80
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 80
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7656 -s 80

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://mail.iaa-airferight.com
unknown

Domains

Name
IP
Malicious
mail.iaa-airferight.com
46.175.148.58
 malicious
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
46.175.148.58
mail.iaa-airferight.com
Ukraine
malicious
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Proforma Invoice - Well Ergon_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
2B1C000
trusted library allocation
page read and write
 malicious
2AF1000
trusted library allocation
page read and write
 malicious
2AD0000
direct allocation
page execute and read and write
 malicious
3B74000
trusted library allocation
page read and write
 malicious
648E000
stack
page read and write
F86000
heap
page read and write
D8D000
stack
page read and write
66E0000
trusted library allocation
page read and write
4F42000
trusted library allocation
page read and write
F0E000
heap
page read and write
55FD000
stack
page read and write
634E000
stack
page read and write
7FB90000
trusted library allocation
page execute and read and write
11BE000
stack
page read and write
AF9000
stack
page read and write
2C52000
trusted library allocation
page read and write
8AC000
stack
page read and write
F2D000
heap
page read and write
2812000
trusted library allocation
page read and write
F20000
trusted library allocation
page read and write
280A000
trusted library allocation
page execute and read and write
2A8E000
stack
page read and write
F43000
heap
page read and write
7C0000
unkown
page readonly
1130000
trusted library allocation
page read and write
54EF000
stack
page read and write
2B60000
heap
page read and write
BCB000
heap
page read and write
63D9000
heap
page read and write
51A0000
heap
page execute and read and write
EF4000
trusted library allocation
page read and write
6A70000
trusted library allocation
page execute and read and write
7FA000
stack
page read and write
4F60000
trusted library allocation
page read and write
B60000
heap
page read and write
E4E000
stack
page read and write
5690000
trusted library allocation
page read and write
117E000
stack
page read and write
6350000
heap
page read and write
6AA0000
trusted library allocation
page read and write
F34000
trusted library allocation
page read and write
6590000
trusted library allocation
page execute and read and write
111B000
trusted library allocation
page execute and read and write
53EE000
stack
page read and write
EEF000
stack
page read and write
D00000
heap
page read and write
573E000
stack
page read and write
2AD7000
trusted library allocation
page read and write
11D0000
trusted library allocation
page read and write
C65000
heap
page read and write
6392000
heap
page read and write
4FD000
stack
page read and write
6A50000
trusted library allocation
page read and write
28BC000
stack
page read and write
2B18000
trusted library allocation
page read and write
518E000
stack
page read and write
BDD000
heap
page read and write
580D000
stack
page read and write
B97000
heap
page read and write
50F0000
trusted library allocation
page read and write
7C2000
unkown
page readonly
27FD000
trusted library allocation
page execute and read and write
65B0000
trusted library allocation
page read and write
F3D000
trusted library allocation
page execute and read and write
CB5000
heap
page read and write
2B32000
trusted library allocation
page read and write
DCE000
stack
page read and write
F30000
trusted library allocation
page read and write
15C000
stack
page read and write
522C000
stack
page read and write
4F22000
trusted library allocation
page read and write
2B20000
heap
page execute and read and write
53AE000
stack
page read and write
65FD000
stack
page read and write
694E000
stack
page read and write
11C0000
trusted library allocation
page execute and read and write
4F1B000
trusted library allocation
page read and write
6368000
heap
page read and write
688F000
stack
page read and write
514E000
stack
page read and write
63D2000
heap
page read and write
BDA000
heap
page read and write
1FC000
stack
page read and write
6DC0000
heap
page read and write
E0E000
stack
page read and write
1117000
trusted library allocation
page execute and read and write
4F50000
trusted library allocation
page read and write
6A6B000
trusted library allocation
page read and write
4F3D000
trusted library allocation
page read and write
19D000
stack
page read and write
2B1A000
trusted library allocation
page read and write
2C50000
trusted library allocation
page read and write
624E000
stack
page read and write
2800000
trusted library allocation
page read and write
1110000
trusted library allocation
page read and write
63C9000
heap
page read and write
2AA1000
trusted library allocation
page read and write
28D8000
trusted library allocation
page read and write
2802000
trusted library allocation
page read and write
55BF000
stack
page read and write
B90000
heap
page read and write
52AE000
stack
page read and write
2B24000
trusted library allocation
page read and write
F40000
heap
page read and write
65B7000
trusted library allocation
page read and write
DDD000
trusted library allocation
page execute and read and write
2AE0000
trusted library allocation
page read and write
C3C000
heap
page read and write
2980000
trusted library allocation
page read and write
DE5000
heap
page read and write
66E7000
trusted library allocation
page read and write
4FE000
stack
page read and write
B70000
heap
page read and write
2B34000
trusted library allocation
page read and write
66D0000
heap
page read and write
3B71000
trusted library allocation
page read and write
2990000
heap
page execute and read and write
287E000
stack
page read and write
CF0000
heap
page read and write
50E0000
heap
page execute and read and write
4F36000
trusted library allocation
page read and write
110A000
trusted library allocation
page execute and read and write
512C000
stack
page read and write
C10000
heap
page read and write
DD4000
trusted library allocation
page read and write
10FE000
stack
page read and write
4F00000
trusted library allocation
page read and write
BA8000
heap
page read and write
2AC0000
direct allocation
page execute and read and write
104E000
stack
page read and write
6A4D000
stack
page read and write
56FD000
stack
page read and write
4F2E000
trusted library allocation
page read and write
65AD000
trusted library allocation
page read and write
2806000
trusted library allocation
page execute and read and write
6A60000
trusted library allocation
page read and write
F00000
heap
page read and write
4FD000
stack
page read and write
620000
heap
page read and write
5670000
heap
page read and write
6AB0000
trusted library allocation
page execute and read and write
9A9000
stack
page read and write
577E000
stack
page read and write
BD7000
heap
page read and write
DD3000
trusted library allocation
page execute and read and write
2AED000
trusted library allocation
page read and write
4F31000
trusted library allocation
page read and write
4EE0000
heap
page read and write
6AC0000
heap
page read and write
F0A000
heap
page read and write
DE0000
heap
page read and write
2C3C000
trusted library allocation
page read and write
CB0000
heap
page read and write
1100000
trusted library allocation
page read and write
2830000
trusted library allocation
page read and write
3AC9000
trusted library allocation
page read and write
2A9E000
stack
page read and write
BBE000
heap
page read and write
1B0000
heap
page read and write
27F0000
trusted library allocation
page read and write
281B000
trusted library allocation
page execute and read and write
3B09000
trusted library allocation
page read and write
5F8E000
stack
page read and write
4D0E000
stack
page read and write
2B71000
trusted library allocation
page read and write
BA0000
heap
page read and write
590D000
stack
page read and write
65A0000
trusted library allocation
page read and write
66CE000
stack
page read and write
4FB0000
heap
page read and write
2970000
trusted library allocation
page execute and read and write
4FB4000
heap
page read and write
28C0000
heap
page read and write
818000
unkown
page readonly
2817000
trusted library allocation
page execute and read and write
4F1E000
trusted library allocation
page read and write
2815000
trusted library allocation
page execute and read and write
F36000
heap
page read and write
2810000
trusted library allocation
page read and write
5698000
trusted library allocation
page read and write
557D000
stack
page read and write
EF0000
trusted library allocation
page read and write
2A90000
heap
page read and write
F33000
trusted library allocation
page execute and read and write
4B9E000
stack
page read and write
3AA1000
trusted library allocation
page read and write
668E000
stack
page read and write
400000
remote allocation
page execute and read and write
566D000
stack
page read and write
F47000
heap
page read and write
DD0000
trusted library allocation
page read and write
11E0000
heap
page read and write
DC0000
trusted library allocation
page read and write
4FC0000
heap
page read and write
530000
heap
page read and write
D4E000
stack
page read and write
4F10000
trusted library allocation
page read and write
658F000
stack
page read and write
There are 189 hidden memdumps, click here to show them.