IOC Report
r)_78768.exe

loading gif

Files

File Path
Type
Category
Malicious
r)_78768.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\aut3B9B.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut3BFA.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\derogates
ASCII text, with very long lines (29744), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\putrefactible
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\r)_78768.exe
"C:\Users\user\Desktop\r)_78768.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\r)_78768.exe"
 malicious

URLs

Name
IP
Malicious
http://ip-api.com/line/?fields=hosting80
unknown
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting-0?
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
37B0000
direct allocation
page read and write
 malicious
402000
system
page execute and read and write
 malicious
B20000
heap
page read and write
3963000
direct allocation
page read and write
AD0000
trusted library allocation
page read and write
A92000
trusted library allocation
page read and write
3721000
trusted library allocation
page read and write
5437000
trusted library allocation
page read and write
F34000
heap
page read and write
F6E000
heap
page read and write
980000
heap
page read and write
B9A000
heap
page read and write
51CE000
stack
page read and write
D65000
unkown
page readonly
5D0000
heap
page read and write
3B7E000
direct allocation
page read and write
A86000
trusted library allocation
page execute and read and write
3782000
trusted library allocation
page read and write
B10000
heap
page read and write
D3F000
unkown
page readonly
3B0D000
direct allocation
page read and write
3913000
direct allocation
page read and write
A70000
trusted library allocation
page read and write
3B7E000
direct allocation
page read and write
1001000
heap
page read and write
3913000
direct allocation
page read and write
A63000
trusted library allocation
page execute and read and write
39E0000
direct allocation
page read and write
3B2E000
direct allocation
page read and write
A8A000
trusted library allocation
page execute and read and write
F70000
heap
page read and write
3963000
direct allocation
page read and write
B53000
heap
page read and write
4D76000
trusted library allocation
page read and write
6130000
trusted library allocation
page read and write
F70000
heap
page read and write
938000
stack
page read and write
F18000
heap
page read and write
C09000
heap
page read and write
AC0000
trusted library allocation
page execute and read and write
F70000
heap
page read and write
4D5E000
trusted library allocation
page read and write
BEF000
heap
page read and write
3963000
direct allocation
page read and write
F36000
heap
page read and write
612E000
stack
page read and write
1001000
heap
page read and write
B95000
heap
page read and write
D65000
unkown
page readonly
37F0000
direct allocation
page read and write
5EED000
stack
page read and write
4D90000
trusted library allocation
page read and write
9F0000
heap
page read and write
4D7D000
trusted library allocation
page read and write
A6D000
trusted library allocation
page execute and read and write
3990000
direct allocation
page read and write
CB0000
unkown
page readonly
3ABD000
direct allocation
page read and write
3840000
direct allocation
page read and write
A60000
trusted library allocation
page read and write
5420000
trusted library allocation
page read and write
2835000
trusted library allocation
page read and write
F55000
heap
page read and write
AF0000
trusted library allocation
page read and write
1011000
heap
page read and write
5FEF000
stack
page read and write
6150000
trusted library allocation
page read and write
F57000
heap
page read and write
3B0D000
direct allocation
page read and write
D73000
unkown
page write copy
DF0000
heap
page read and write
A64000
trusted library allocation
page read and write
D78000
unkown
page readonly
4D6A000
trusted library allocation
page read and write
7F4F0000
trusted library allocation
page execute and read and write
3AB9000
direct allocation
page read and write
56A000
stack
page read and write
6270000
heap
page read and write
F56000
heap
page read and write
61A0000
trusted library allocation
page execute and read and write
2804000
trusted library allocation
page read and write
400000
system
page execute and read and write
4D71000
trusted library allocation
page read and write
5430000
trusted library allocation
page read and write
BBF000
stack
page read and write
E70000
heap
page read and write
5B83000
heap
page read and write
3729000
trusted library allocation
page read and write
FB5000
heap
page read and write
F70000
heap
page read and write
B56000
heap
page read and write
3B2E000
direct allocation
page read and write
2610000
heap
page execute and read and write
A40000
trusted library allocation
page read and write
C1D000
heap
page read and write
D6F000
unkown
page write copy
6148000
trusted library allocation
page read and write
BFC000
stack
page read and write
3B2E000
direct allocation
page read and write
B16000
heap
page read and write
3840000
direct allocation
page read and write
4DEC000
stack
page read and write
1011000
heap
page read and write
3990000
direct allocation
page read and write
4D62000
trusted library allocation
page read and write
530D000
stack
page read and write
3840000
direct allocation
page read and write
A7D000
trusted library allocation
page execute and read and write
2806000
trusted library allocation
page read and write
5B5F000
heap
page read and write
D3F000
unkown
page readonly
37F0000
direct allocation
page read and write
6200000
trusted library allocation
page read and write
5BA4000
heap
page read and write
C3E000
stack
page read and write
C7E000
stack
page read and write
FD1000
heap
page read and write
FB5000
heap
page read and write
4E4E000
stack
page read and write
F55000
heap
page read and write
3749000
trusted library allocation
page read and write
CB1000
unkown
page execute read
3990000
direct allocation
page read and write
AE0000
heap
page read and write
3B09000
direct allocation
page read and write
A30000
heap
page read and write
BBA000
heap
page read and write
27DA000
trusted library allocation
page read and write
4E90000
heap
page read and write
4728000
trusted library allocation
page read and write
2821000
trusted library allocation
page read and write
FE2000
heap
page read and write
D78000
unkown
page readonly
F44000
heap
page read and write
6190000
heap
page read and write
540E000
stack
page read and write
37F0000
direct allocation
page read and write
39E0000
direct allocation
page read and write
2721000
trusted library allocation
page read and write
1001000
heap
page read and write
39E0000
direct allocation
page read and write
C84000
heap
page read and write
4D40000
heap
page read and write
5B30000
heap
page read and write
281C000
trusted library allocation
page read and write
3913000
direct allocation
page read and write
2794000
trusted library allocation
page read and write
282F000
trusted library allocation
page read and write
3ABD000
direct allocation
page read and write
1011000
heap
page read and write
25CE000
stack
page read and write
83A000
stack
page read and write
F46000
heap
page read and write
F3C000
heap
page read and write
4E80000
heap
page execute and read and write
B49000
heap
page read and write
B28000
heap
page read and write
4D43000
heap
page read and write
17DF000
stack
page read and write
27F9000
trusted library allocation
page read and write
1BDF000
stack
page read and write
F70000
heap
page read and write
F46000
heap
page read and write
3B7E000
direct allocation
page read and write
F70000
heap
page read and write
52CE000
stack
page read and write
9D0000
heap
page read and write
A9B000
trusted library allocation
page execute and read and write
4D5B000
trusted library allocation
page read and write
F70000
heap
page read and write
F70000
heap
page read and write
CB1000
unkown
page execute read
E10000
direct allocation
page execute and read and write
F71000
heap
page read and write
6140000
trusted library allocation
page read and write
5410000
heap
page read and write
48BE000
stack
page read and write
260C000
stack
page read and write
A50000
heap
page read and write
5BA0000
heap
page read and write
A80000
trusted library allocation
page read and write
F10000
heap
page read and write
2808000
trusted library allocation
page read and write
602E000
stack
page read and write
FC4000
heap
page read and write
4D82000
trusted library allocation
page read and write
F70000
heap
page read and write
C80000
heap
page read and write
271E000
stack
page read and write
FE2000
heap
page read and write
AB0000
trusted library allocation
page read and write
BCF000
stack
page read and write
FB5000
heap
page read and write
5E0000
heap
page read and write
B00000
trusted library allocation
page read and write
518E000
stack
page read and write
6160000
trusted library allocation
page execute and read and write
4D6E000
trusted library allocation
page read and write
4D50000
trusted library allocation
page read and write
3B09000
direct allocation
page read and write
FB5000
heap
page read and write
3ABD000
direct allocation
page read and write
D6F000
unkown
page read and write
BE0000
heap
page read and write
508C000
stack
page read and write
4D56000
trusted library allocation
page read and write
3B09000
direct allocation
page read and write
2755000
trusted library allocation
page read and write
3AB9000
direct allocation
page read and write
3B0D000
direct allocation
page read and write
F57000
heap
page read and write
A97000
trusted library allocation
page execute and read and write
BDB000
stack
page read and write
A55000
heap
page read and write
27F2000
trusted library allocation
page read and write
F70000
heap
page read and write
27DE000
trusted library allocation
page read and write
3AB9000
direct allocation
page read and write
A82000
trusted library allocation
page read and write
F70000
heap
page read and write
E30000
heap
page read and write
CB0000
unkown
page readonly
F55000
heap
page read and write
There are 213 hidden memdumps, click here to show them.