IOC Report
171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe
"C:\Users\user\Desktop\171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.12.205
https://api.telegram.org/bot6957776389:AAGE3Y2I0YZ27F-41ZLwjxi6zM96chGzSyw/sendDocument
149.154.167.220
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.telegram.org
unknown
https://api.ipify.org/t
unknown
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://api.telegram.org/bot6957776389:AAGE3Y2I0YZ27F-41ZLwjxi6zM96chGzSyw/
unknown

Domains

Name
IP
Malicious
api.ipify.org
104.26.12.205
api.telegram.org
149.154.167.220

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
104.26.12.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
12000
unkown
page readonly
 malicious
2381000
trusted library allocation
page read and write
 malicious
23AC000
trusted library allocation
page read and write
 malicious
23B8000
trusted library allocation
page read and write
 malicious
2379000
trusted library allocation
page read and write
63B0000
heap
page read and write
481E000
trusted library allocation
page read and write
5FE0000
heap
page read and write
5E80000
trusted library allocation
page read and write
5FF0000
trusted library allocation
page execute and read and write
6380000
trusted library allocation
page read and write
5B94000
heap
page read and write
236F000
trusted library allocation
page read and write
8FE000
stack
page read and write
2371000
trusted library allocation
page read and write
5B6A000
heap
page read and write
7CE000
stack
page read and write
2331000
trusted library allocation
page read and write
614000
trusted library allocation
page read and write
483D000
trusted library allocation
page read and write
62DE000
stack
page read and write
6368000
trusted library allocation
page read and write
5AE0000
heap
page read and write
870000
heap
page read and write
4F60000
heap
page read and write
3331000
trusted library allocation
page read and write
339B000
trusted library allocation
page read and write
6CD000
heap
page read and write
6E0000
heap
page read and write
5E8D000
trusted library allocation
page read and write
4990000
heap
page execute and read and write
2482000
trusted library allocation
page read and write
5B61000
heap
page read and write
4870000
heap
page read and write
62D000
trusted library allocation
page execute and read and write
650000
heap
page read and write
49B3000
heap
page read and write
4842000
trusted library allocation
page read and write
636000
trusted library allocation
page execute and read and write
1E8000
stack
page read and write
4816000
trusted library allocation
page read and write
93C000
stack
page read and write
4AFC000
stack
page read and write
556000
heap
page read and write
65DE000
stack
page read and write
530000
heap
page read and write
61D000
trusted library allocation
page execute and read and write
4850000
trusted library allocation
page read and write
EA000
stack
page read and write
49B0000
heap
page read and write
6630000
heap
page read and write
5E90000
trusted library allocation
page read and write
5E6E000
stack
page read and write
5B8B000
heap
page read and write
4822000
trusted library allocation
page read and write
8B0000
heap
page read and write
61DE000
unkown
page read and write
694000
heap
page read and write
687000
heap
page read and write
2462000
trusted library allocation
page read and write
2472000
trusted library allocation
page read and write
620000
trusted library allocation
page read and write
3359000
trusted library allocation
page read and write
3341000
trusted library allocation
page read and write
65E000
heap
page read and write
8B7000
heap
page read and write
610000
trusted library allocation
page read and write
4810000
trusted library allocation
page read and write
2474000
trusted library allocation
page read and write
23AA000
trusted library allocation
page read and write
59E000
stack
page read and write
4D3E000
stack
page read and write
890000
heap
page execute and read and write
2365000
trusted library allocation
page read and write
4338000
trusted library allocation
page read and write
5DE000
stack
page read and write
5EF0000
trusted library allocation
page execute and read and write
64B000
trusted library allocation
page execute and read and write
6360000
trusted library allocation
page read and write
960000
trusted library allocation
page read and write
5D29000
trusted library allocation
page read and write
4F3E000
stack
page read and write
23A8000
trusted library allocation
page read and write
80E000
stack
page read and write
642000
trusted library allocation
page read and write
6F4000
heap
page read and write
A8E000
stack
page read and write
647000
trusted library allocation
page execute and read and write
4BFF000
unkown
page read and write
23B0000
trusted library allocation
page read and write
673E000
stack
page read and write
632000
trusted library allocation
page read and write
585E000
stack
page read and write
658000
heap
page read and write
5FDE000
stack
page read and write
613000
trusted library allocation
page execute and read and write
4831000
trusted library allocation
page read and write
950000
trusted library allocation
page read and write
7F3C0000
trusted library allocation
page execute and read and write
987000
heap
page read and write
23B4000
trusted library allocation
page read and write
970000
heap
page read and write
5B7F000
heap
page read and write
860000
trusted library allocation
page read and write
691000
heap
page read and write
5EE0000
trusted library allocation
page read and write
23C7000
trusted library allocation
page read and write
237D000
trusted library allocation
page read and write
49FC000
stack
page read and write
63D0000
trusted library allocation
page execute and read and write
697000
heap
page read and write
940000
trusted library allocation
page read and write
78E000
stack
page read and write
245E000
trusted library allocation
page read and write
630000
trusted library allocation
page read and write
232E000
stack
page read and write
5BC2000
heap
page read and write
5F9D000
stack
page read and write
450000
heap
page read and write
5D20000
trusted library allocation
page read and write
5F00000
trusted library allocation
page execute and read and write
2416000
trusted library allocation
page read and write
63A000
trusted library allocation
page execute and read and write
550000
heap
page read and write
5AF7000
heap
page read and write
4836000
trusted library allocation
page read and write
5B29000
heap
page read and write
6370000
trusted library allocation
page read and write
600000
trusted library allocation
page read and write
481B000
trusted library allocation
page read and write
482A000
trusted library allocation
page read and write
8A0000
trusted library allocation
page execute and read and write
5D6E000
stack
page read and write
980000
heap
page read and write
10000
unkown
page readonly
44CE000
stack
page read and write
5E97000
trusted library allocation
page read and write
645000
trusted library allocation
page execute and read and write
482E000
trusted library allocation
page read and write
There are 129 hidden memdumps, click here to show them.