IOC Report
z34PDnVzyEItkXaInw.exe

loading gif

Files

File Path
Type
Category
Malicious
z34PDnVzyEItkXaInw.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\z34PDnVzyEItkXaInw.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\z34PDnVzyEItkXaInw.exe
"C:\Users\user\Desktop\z34PDnVzyEItkXaInw.exe"
 malicious
C:\Users\user\Desktop\z34PDnVzyEItkXaInw.exe
"C:\Users\user\Desktop\z34PDnVzyEItkXaInw.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.telegram.org
unknown
https://api.ipify.org/t
unknown
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
api.ipify.org
172.67.74.152
api.telegram.org
149.154.167.220

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\z34PDnVzyEItkXaInw_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
30A1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
3776000
trusted library allocation
page read and write
 malicious
30C7000
trusted library allocation
page read and write
 malicious
7FB000
trusted library allocation
page execute and read and write
8970000
heap
page read and write
726000
heap
page read and write
4A9B000
stack
page read and write
1480000
trusted library allocation
page execute and read and write
73A0000
trusted library allocation
page execute and read and write
6CFE000
stack
page read and write
25D5000
trusted library allocation
page read and write
309D000
trusted library allocation
page read and write
4B60000
heap
page read and write
2FA6000
trusted library allocation
page read and write
1098000
heap
page read and write
1446000
trusted library allocation
page execute and read and write
32000
unkown
page readonly
61E000
stack
page read and write
8680000
heap
page read and write
6853000
heap
page read and write
514E000
stack
page read and write
F4000
unkown
page readonly
70EE000
stack
page read and write
1420000
trusted library allocation
page read and write
6892000
heap
page read and write
24A0000
heap
page execute and read and write
4E2E000
stack
page read and write
22C0000
trusted library allocation
page read and write
6832000
trusted library allocation
page read and write
291B000
trusted library allocation
page read and write
1452000
trusted library allocation
page read and write
2939000
trusted library allocation
page read and write
292F000
trusted library allocation
page read and write
2927000
trusted library allocation
page read and write
5490000
heap
page read and write
30000
unkown
page readonly
647000
heap
page read and write
6BFD000
stack
page read and write
6FFE000
stack
page read and write
886F000
stack
page read and write
6B98000
trusted library allocation
page read and write
640000
heap
page read and write
1F0000
heap
page read and write
7E2000
trusted library allocation
page read and write
4957000
trusted library allocation
page read and write
7E6000
trusted library allocation
page execute and read and write
4E70000
trusted library allocation
page read and write
8AAE000
stack
page read and write
6C3000
trusted library allocation
page execute and read and write
4EC0000
heap
page read and write
896D000
stack
page read and write
2937000
trusted library allocation
page read and write
4CD0000
trusted library allocation
page read and write
1440000
trusted library allocation
page read and write
6630000
heap
page read and write
4EE0000
heap
page read and write
681A000
heap
page read and write
30E9000
trusted library allocation
page read and write
73F0000
trusted library allocation
page read and write
10C4000
heap
page read and write
292B000
trusted library allocation
page read and write
4CE0000
trusted library allocation
page execute and read and write
4980000
trusted library allocation
page execute and read and write
3085000
trusted library allocation
page read and write
1050000
heap
page read and write
3508000
trusted library allocation
page read and write
1430000
trusted library allocation
page read and write
6BA0000
trusted library allocation
page read and write
2FE0000
trusted library allocation
page read and write
29B0000
trusted library allocation
page read and write
1423000
trusted library allocation
page execute and read and write
10F9000
heap
page read and write
2621000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
4EA0000
trusted library allocation
page execute and read and write
40BA000
trusted library allocation
page read and write
4AA0000
heap
page read and write
6C00000
trusted library allocation
page execute and read and write
4E7C000
trusted library allocation
page read and write
2E30000
heap
page read and write
2921000
trusted library allocation
page read and write
5060000
trusted library allocation
page execute and read and write
6F80000
heap
page read and write
77C000
heap
page read and write
26F4000
trusted library allocation
page read and write
2919000
trusted library allocation
page read and write
6D00000
trusted library allocation
page read and write
3735000
trusted library allocation
page read and write
9EBE000
stack
page read and write
7A1000
heap
page read and write
4E73000
trusted library allocation
page read and write
2FE4000
trusted library allocation
page read and write
12DE000
stack
page read and write
4940000
heap
page read and write
6BB0000
trusted library allocation
page read and write
6B90000
trusted library allocation
page read and write
1470000
trusted library allocation
page read and write
189000
stack
page read and write
5050000
trusted library allocation
page execute and read and write
159E000
stack
page read and write
6F70000
heap
page read and write
6E0E000
stack
page read and write
2E50000
heap
page read and write
870000
heap
page read and write
7F7000
trusted library allocation
page execute and read and write
860000
trusted library allocation
page execute and read and write
4F7000
stack
page read and write
4E90000
trusted library allocation
page read and write
2441000
trusted library allocation
page read and write
34B1000
trusted library allocation
page read and write
73E0000
trusted library allocation
page execute and read and write
2480000
trusted library allocation
page read and write
647D000
stack
page read and write
6CBF000
stack
page read and write
292D000
trusted library allocation
page read and write
10C6000
heap
page read and write
6D0000
trusted library allocation
page read and write
243E000
trusted library allocation
page read and write
7100000
trusted library section
page read and write
810000
trusted library allocation
page read and write
35A4000
trusted library allocation
page read and write
2584000
trusted library allocation
page read and write
85E000
stack
page read and write
241C000
stack
page read and write
4F00000
heap
page read and write
45AC000
stack
page read and write
4E80000
trusted library allocation
page execute and read and write
2929000
trusted library allocation
page read and write
2E20000
trusted library allocation
page read and write
4AC0000
heap
page execute and read and write
135E000
stack
page read and write
6F80000
trusted library section
page read and write
139E000
stack
page read and write
6EE000
heap
page read and write
2F9C000
stack
page read and write
5D0000
heap
page read and write
650000
heap
page read and write
7F2000
trusted library allocation
page read and write
2FA0000
trusted library allocation
page read and write
7E0000
trusted library allocation
page read and write
4EC5000
heap
page read and write
26D7000
trusted library allocation
page read and write
49B3000
heap
page read and write
6D10000
trusted library allocation
page read and write
1450000
trusted library allocation
page read and write
1060000
heap
page read and write
2F5E000
stack
page read and write
2470000
trusted library allocation
page read and write
657E000
stack
page read and write
6CD000
trusted library allocation
page execute and read and write
71AD000
stack
page read and write
1417000
heap
page read and write
2420000
trusted library allocation
page read and write
291F000
trusted library allocation
page read and write
78D000
heap
page read and write
2D7E000
stack
page read and write
6B0000
trusted library allocation
page read and write
2935000
trusted library allocation
page read and write
6D0F000
stack
page read and write
4AB0000
heap
page read and write
6C20000
trusted library allocation
page execute and read and write
23DE000
stack
page read and write
2925000
trusted library allocation
page read and write
3051000
trusted library allocation
page read and write
4C60000
trusted library allocation
page read and write
581C000
stack
page read and write
591E000
stack
page read and write
7CA000
heap
page read and write
715000
heap
page read and write
5B40000
heap
page read and write
721F000
stack
page read and write
4079000
trusted library allocation
page read and write
144A000
trusted library allocation
page execute and read and write
1490000
heap
page read and write
6D07000
trusted library allocation
page read and write
3556000
trusted library allocation
page read and write
7400000
trusted library allocation
page read and write
4CAE000
stack
page read and write
49B0000
heap
page read and write
368E000
trusted library allocation
page read and write
782000
heap
page read and write
2915000
trusted library allocation
page read and write
308F000
trusted library allocation
page read and write
6FD0000
heap
page read and write
2E40000
trusted library allocation
page read and write
22D0000
heap
page read and write
24B1000
trusted library allocation
page read and write
6800000
heap
page read and write
86DC000
heap
page read and write
B62E000
stack
page read and write
2FB2000
trusted library allocation
page read and write
6EBE000
stack
page read and write
6BB7000
trusted library allocation
page read and write
1090000
heap
page read and write
2FF0000
trusted library allocation
page read and write
7F480000
trusted library allocation
page execute and read and write
7110000
trusted library allocation
page read and write
293B000
trusted library allocation
page read and write
6FC0000
trusted library allocation
page execute and read and write
2FAE000
trusted library allocation
page read and write
49A0000
trusted library section
page readonly
9BBD000
trusted library allocation
page read and write
6F40000
trusted library allocation
page read and write
6C10000
trusted library allocation
page read and write
571C000
stack
page read and write
4051000
trusted library allocation
page read and write
2490000
trusted library allocation
page read and write
DE9000
stack
page read and write
97E000
stack
page read and write
2FC1000
trusted library allocation
page read and write
8B20000
trusted library section
page read and write
2FCD000
trusted library allocation
page read and write
1455000
trusted library allocation
page execute and read and write
A7E000
stack
page read and write
7F110000
trusted library allocation
page execute and read and write
6886000
heap
page read and write
1139000
heap
page read and write
2E33000
heap
page read and write
7010000
trusted library section
page read and write
2913000
trusted library allocation
page read and write
6A7E000
stack
page read and write
291D000
trusted library allocation
page read and write
CE9000
stack
page read and write
73F5000
trusted library allocation
page read and write
2933000
trusted library allocation
page read and write
7EA000
trusted library allocation
page execute and read and write
6B7F000
stack
page read and write
2931000
trusted library allocation
page read and write
2923000
trusted library allocation
page read and write
4950000
trusted library allocation
page read and write
10B9000
heap
page read and write
1410000
heap
page read and write
869D000
heap
page read and write
2446000
trusted library allocation
page read and write
2FAB000
trusted library allocation
page read and write
8AED000
stack
page read and write
2FBA000
trusted library allocation
page read and write
1126000
heap
page read and write
69E000
stack
page read and write
2709000
trusted library allocation
page read and write
68C5000
heap
page read and write
22AD000
stack
page read and write
1457000
trusted library allocation
page execute and read and write
145B000
trusted library allocation
page execute and read and write
4900000
trusted library allocation
page read and write
4ED0000
heap
page read and write
6BAD000
trusted library allocation
page read and write
2460000
trusted library allocation
page read and write
225E000
stack
page read and write
2485000
trusted library allocation
page read and write
B52E000
stack
page read and write
26C5000
trusted library allocation
page read and write
6C4000
trusted library allocation
page read and write
1442000
trusted library allocation
page read and write
1070000
heap
page read and write
6DD000
trusted library allocation
page execute and read and write
6F90000
trusted library allocation
page read and write
1424000
trusted library allocation
page read and write
6FA0000
trusted library allocation
page read and write
3040000
heap
page execute and read and write
724000
heap
page read and write
4CC0000
trusted library allocation
page execute and read and write
6E0000
heap
page read and write
4960000
trusted library allocation
page read and write
4E6E000
stack
page read and write
142D000
trusted library allocation
page execute and read and write
244D000
trusted library allocation
page read and write
6F0F000
stack
page read and write
2917000
trusted library allocation
page read and write
2D88000
trusted library allocation
page read and write
799000
heap
page read and write
2FBE000
trusted library allocation
page read and write
2FC6000
trusted library allocation
page read and write
4EB0000
trusted library allocation
page read and write
1055000
heap
page read and write
4DED000
stack
page read and write
2260000
trusted library allocation
page read and write
72AE000
stack
page read and write
5590000
heap
page execute and read and write
6C0000
trusted library allocation
page read and write
1400000
trusted library allocation
page read and write
70F0000
trusted library section
page read and write
4CB0000
trusted library allocation
page read and write
6E8000
heap
page read and write
143D000
trusted library allocation
page execute and read and write
8670000
heap
page read and write
129E000
stack
page read and write
4B50000
trusted library allocation
page read and write
1497000
heap
page read and write
7000000
trusted library allocation
page execute and read and write
There are 281 hidden memdumps, click here to show them.