IOC Report
e-dekont.exe

loading gif

Files

File Path
Type
Category
Malicious
e-dekont.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e-dekont.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\e-dekont.exe
"C:\Users\user\Desktop\e-dekont.exe"
 malicious
C:\Users\user\Desktop\e-dekont.exe
"C:\Users\user\Desktop\e-dekont.exe"
 malicious

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://www.fontbureau.com/designers?
unknown
https://reallyfreegeoip.org/xml/154.16.105.36$
unknown
http://tempuri.org/DataSet1.xsd
unknown
http://www.tiro.com
unknown
http://checkip.dyndns.org
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://checkip.dyndns.org/
158.101.44.242
http://checkip.dyndns.org/q
unknown
http://www.jiyu-kobo.co.jp/
unknown
https://scratchdreams.tk
unknown
http://reallyfreegeoip.org
unknown
http://www.galapagosdesign.com/DPlease
unknown
https://reallyfreegeoip.org
unknown
http://www.fontbureau.com/designers8
unknown
https://reallyfreegeoip.org/xml/154.16.105.36
104.21.67.152
https://scratchdreams.tk/_send_.php?TS
104.21.27.85
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://checkip.dyndns.com
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
http://scratchdreams.tk
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 29 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
checkip.dyndns.org
unknown
 malicious
reallyfreegeoip.org
104.21.67.152
scratchdreams.tk
104.21.27.85
checkip.dyndns.com
158.101.44.242

IPs

IP
Domain
Country
Malicious
104.21.67.152
reallyfreegeoip.org
United States
158.101.44.242
checkip.dyndns.com
United States
104.21.27.85
scratchdreams.tk
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\e-dekont_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
44BE000
trusted library allocation
page read and write
 malicious
3160000
trusted library allocation
page read and write
 malicious
2FA1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
7020000
heap
page read and write
2970000
heap
page read and write
50B3000
heap
page read and write
30DF000
trusted library allocation
page read and write
E02000
trusted library allocation
page read and write
5460000
trusted library allocation
page execute and read and write
2E2E000
trusted library allocation
page read and write
D3E000
stack
page read and write
7EFE0000
trusted library allocation
page execute and read and write
30F7000
trusted library allocation
page read and write
E20000
trusted library allocation
page read and write
3124000
trusted library allocation
page read and write
30A7000
trusted library allocation
page read and write
68FE000
stack
page read and write
14D0000
heap
page read and write
2C63000
trusted library allocation
page read and write
5082000
trusted library allocation
page read and write
E0B000
trusted library allocation
page execute and read and write
5440000
heap
page read and write
DF2000
trusted library allocation
page read and write
1370000
heap
page read and write
6C1B000
trusted library allocation
page read and write
71D0000
heap
page read and write
7400000
trusted library section
page read and write
4B65000
trusted library allocation
page read and write
DED000
trusted library allocation
page execute and read and write
3116000
trusted library allocation
page read and write
3216000
trusted library allocation
page read and write
5480000
heap
page read and write
5450000
heap
page read and write
4033000
trusted library allocation
page read and write
3207000
trusted library allocation
page read and write
2E36000
trusted library allocation
page read and write
5470000
heap
page read and write
E66000
heap
page read and write
513E000
stack
page read and write
4FC0000
trusted library allocation
page read and write
5070000
heap
page execute and read and write
2950000
trusted library allocation
page execute and read and write
F12000
heap
page read and write
1433000
trusted library allocation
page execute and read and write
403C000
trusted library allocation
page read and write
7180000
heap
page read and write
323E000
trusted library allocation
page read and write
2E1E000
trusted library allocation
page read and write
744E000
stack
page read and write
3066000
trusted library allocation
page read and write
BD0000
heap
page read and write
DFCE000
stack
page read and write
DD0000
trusted library allocation
page read and write
E40E000
stack
page read and write
5590000
heap
page read and write
119A000
heap
page read and write
1263000
heap
page read and write
5090000
trusted library allocation
page read and write
DE0000
trusted library allocation
page read and write
2AAD000
trusted library allocation
page read and write
CDA000
stack
page read and write
73F0000
trusted library allocation
page execute and read and write
2DC0000
trusted library allocation
page execute and read and write
6C42000
trusted library allocation
page read and write
1170000
heap
page read and write
71A1000
heap
page read and write
4385000
trusted library allocation
page read and write
146B000
trusted library allocation
page execute and read and write
3250000
trusted library allocation
page read and write
73AE000
stack
page read and write
7170000
heap
page read and write
1440000
trusted library allocation
page read and write
31F8000
trusted library allocation
page read and write
73B0000
trusted library section
page read and write
6C00000
trusted library allocation
page execute and read and write
3FC9000
trusted library allocation
page read and write
5B37000
trusted library allocation
page read and write
2DE0000
trusted library allocation
page read and write
30AB000
trusted library allocation
page read and write
4C7C000
stack
page read and write
321A000
trusted library allocation
page read and write
6C60000
trusted library allocation
page read and write
4FD0000
trusted library allocation
page read and write
677F000
stack
page read and write
DF0000
trusted library allocation
page read and write
5B3C000
trusted library allocation
page read and write
145A000
trusted library allocation
page execute and read and write
2DF0000
trusted library allocation
page read and write
2AC0000
trusted library allocation
page read and write
E18E000
stack
page read and write
E3CF000
stack
page read and write
78E000
unkown
page readonly
6780000
heap
page read and write
E73000
heap
page read and write
5710000
trusted library allocation
page read and write
AB97000
trusted library allocation
page read and write
567E000
stack
page read and write
13B0000
heap
page read and write
700000
unkown
page readonly
5B40000
trusted library allocation
page execute and read and write
112E000
stack
page read and write
2DD0000
trusted library allocation
page read and write
12AF000
stack
page read and write
30EB000
trusted library allocation
page read and write
2AE1000
trusted library allocation
page read and write
72AE000
stack
page read and write
DDD000
trusted library allocation
page execute and read and write
294B000
stack
page read and write
7550000
trusted library allocation
page read and write
1452000
trusted library allocation
page read and write
12EE000
stack
page read and write
7560000
trusted library allocation
page read and write
2DE4000
trusted library allocation
page read and write
1465000
trusted library allocation
page execute and read and write
5010000
trusted library allocation
page read and write
4030000
trusted library allocation
page read and write
4B50000
trusted library allocation
page read and write
309F000
trusted library allocation
page read and write
3095000
trusted library allocation
page read and write
3049000
trusted library allocation
page read and write
5593000
heap
page read and write
54D0000
heap
page read and write
31FE000
trusted library allocation
page read and write
290E000
stack
page read and write
30FB000
trusted library allocation
page read and write
143D000
trusted library allocation
page execute and read and write
CF5000
heap
page read and write
702000
unkown
page readonly
118E000
heap
page read and write
4026000
trusted library allocation
page read and write
2E16000
trusted library allocation
page read and write
2F88000
trusted library allocation
page read and write
CF0000
heap
page read and write
6AFE000
stack
page read and write
324A000
trusted library allocation
page read and write
3AE1000
trusted library allocation
page read and write
5475000
heap
page read and write
2AA1000
trusted library allocation
page read and write
3150000
trusted library allocation
page read and write
CB0000
heap
page read and write
67C4000
heap
page read and write
6C70000
trusted library allocation
page read and write
DC0000
trusted library allocation
page read and write
3068000
trusted library allocation
page read and write
2A80000
trusted library allocation
page read and write
3056000
trusted library allocation
page read and write
693E000
stack
page read and write
2AA6000
trusted library allocation
page read and write
5080000
trusted library allocation
page read and write
6C50000
trusted library allocation
page read and write
1400000
heap
page read and write
51AB000
stack
page read and write
3131000
trusted library allocation
page read and write
1239000
heap
page read and write
3AE8000
trusted library allocation
page read and write
DD3000
trusted library allocation
page execute and read and write
5B30000
trusted library allocation
page read and write
2C5A000
trusted library allocation
page read and write
2E3D000
trusted library allocation
page read and write
314D000
trusted library allocation
page read and write
304E000
trusted library allocation
page read and write
1015000
heap
page read and write
6797000
heap
page read and write
5480000
heap
page read and write
73E0000
trusted library section
page read and write
D90000
heap
page read and write
4B6E000
trusted library allocation
page read and write
50B0000
heap
page read and write
7230000
heap
page read and write
DD4000
trusted library allocation
page read and write
CD7000
heap
page read and write
6C30000
trusted library allocation
page execute and read and write
2960000
trusted library allocation
page read and write
6A3E000
stack
page read and write
1456000
trusted library allocation
page execute and read and write
116E000
stack
page read and write
1462000
trusted library allocation
page read and write
53B0000
trusted library section
page readonly
2A8B000
trusted library allocation
page read and write
6C6B000
trusted library allocation
page read and write
E3A000
heap
page read and write
6C20000
trusted library allocation
page execute and read and write
2A7E000
stack
page read and write
2F9E000
trusted library allocation
page read and write
5060000
trusted library allocation
page execute and read and write
2DBD000
stack
page read and write
2A9E000
trusted library allocation
page read and write
E70000
heap
page read and write
11FD000
heap
page read and write
2E90000
heap
page read and write
67DB000
heap
page read and write
DE3000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
2F47000
trusted library allocation
page read and write
DA0000
heap
page read and write
2F9F000
stack
page read and write
31F3000
trusted library allocation
page read and write
68BD000
stack
page read and write
2E10000
trusted library allocation
page read and write
1420000
trusted library allocation
page read and write
54BE000
heap
page read and write
3051000
trusted library allocation
page read and write
7150000
trusted library allocation
page read and write
4AE0000
trusted library section
page read and write
6BFF000
stack
page read and write
754E000
stack
page read and write
2AD0000
heap
page execute and read and write
2C65000
trusted library allocation
page read and write
318A000
trusted library allocation
page read and write
DFA000
trusted library allocation
page execute and read and write
DF8E000
stack
page read and write
2FA0000
trusted library allocation
page read and write
6CA0000
heap
page read and write
6C40000
trusted library allocation
page read and write
E2CE000
stack
page read and write
CD0000
heap
page read and write
2E00000
heap
page execute and read and write
11AB000
heap
page read and write
1450000
trusted library allocation
page read and write
1460000
trusted library allocation
page read and write
30F3000
trusted library allocation
page read and write
30E7000
trusted library allocation
page read and write
30A3000
trusted library allocation
page read and write
A69000
stack
page read and write
3081000
trusted library allocation
page read and write
5490000
heap
page read and write
2E2A000
trusted library allocation
page read and write
144D000
trusted library allocation
page execute and read and write
E28E000
stack
page read and write
1010000
heap
page read and write
E50F000
stack
page read and write
4337000
trusted library allocation
page read and write
43D3000
trusted library allocation
page read and write
E07000
trusted library allocation
page execute and read and write
7610000
trusted library allocation
page execute and read and write
14CE000
stack
page read and write
51B0000
heap
page read and write
30E3000
trusted library allocation
page read and write
6C10000
trusted library allocation
page read and write
2E1B000
trusted library allocation
page read and write
1430000
trusted library allocation
page read and write
3245000
trusted library allocation
page read and write
5050000
heap
page read and write
DD7000
stack
page read and write
1480000
trusted library allocation
page read and write
4FE0000
trusted library allocation
page read and write
7140000
trusted library allocation
page read and write
1178000
heap
page read and write
30DB000
trusted library allocation
page read and write
1434000
trusted library allocation
page read and write
DF6000
trusted library allocation
page execute and read and write
2E31000
trusted library allocation
page read and write
6C20000
trusted library allocation
page read and write
596E000
stack
page read and write
53AD000
stack
page read and write
5720000
heap
page execute and read and write
6D10000
trusted library allocation
page execute and read and write
3FA1000
trusted library allocation
page read and write
30EF000
trusted library allocation
page read and write
15DE000
stack
page read and write
1467000
trusted library allocation
page execute and read and write
E30000
heap
page read and write
B67000
stack
page read and write
667E000
stack
page read and write
2E60000
trusted library allocation
page read and write
EBC000
heap
page read and write
5B39000
trusted library allocation
page read and write
4FD5000
trusted library allocation
page read and write
4B60000
trusted library allocation
page read and write
1050000
heap
page read and write
3211000
trusted library allocation
page read and write
400B000
trusted library allocation
page read and write
6C5E000
trusted library allocation
page read and write
102E000
stack
page read and write
D7E000
stack
page read and write
E3E000
heap
page read and write
There are 267 hidden memdumps, click here to show them.