IOC Report
SecuriteInfo.com.Win32.PWSX-gen.25877.26069.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win32.PWSX-gen.25877.26069.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.25877.26069.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25877.26069.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.25877.26069.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.12.205
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://account.dyn.com/
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
https://api.ipify.org/t
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
https://api.ipify.org
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://mail.nationalkham.com
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://ip-api.com
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
There are 23 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mail.nationalkham.com
192.185.35.67
 malicious
api.ipify.org
104.26.12.205
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
192.185.35.67
mail.nationalkham.com
United States
malicious
208.95.112.1
ip-api.com
United States
104.26.12.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4C27000
trusted library allocation
page read and write
 malicious
5890000
trusted library section
page read and write
 malicious
4239000
trusted library allocation
page read and write
 malicious
2BBA000
trusted library allocation
page read and write
 malicious
2B95000
trusted library allocation
page read and write
 malicious
C0E000
stack
page read and write
173D000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
294D000
trusted library allocation
page read and write
5110000
heap
page read and write
634E000
stack
page read and write
4ECC000
stack
page read and write
319B000
trusted library allocation
page read and write
1756000
trusted library allocation
page execute and read and write
3B31000
trusted library allocation
page read and write
1750000
trusted library allocation
page read and write
141E000
stack
page read and write
E96000
heap
page read and write
14CB000
heap
page read and write
1780000
trusted library allocation
page read and write
31D0000
trusted library allocation
page read and write
4F30000
heap
page read and write
C5D000
trusted library allocation
page execute and read and write
E72000
unkown
page readonly
FCE000
stack
page read and write
56E0000
trusted library allocation
page read and write
17D0000
trusted library allocation
page execute and read and write
2952000
trusted library allocation
page read and write
1466000
heap
page read and write
1474000
heap
page read and write
DA7000
trusted library allocation
page execute and read and write
1762000
trusted library allocation
page read and write
D93E000
stack
page read and write
6970000
heap
page read and write
7C0000
heap
page read and write
5850000
heap
page read and write
597E000
stack
page read and write
143A000
heap
page read and write
E4C000
stack
page read and write
1472000
heap
page read and write
63CE000
stack
page read and write
1430000
heap
page read and write
5C80000
heap
page read and write
17E0000
heap
page read and write
31F0000
trusted library allocation
page read and write
7E0000
heap
page read and write
789E000
stack
page read and write
5BBE000
heap
page read and write
5840000
heap
page read and write
EE3000
heap
page read and write
799F000
stack
page read and write
65E0000
trusted library allocation
page execute and read and write
1743000
trusted library allocation
page read and write
7C20000
trusted library allocation
page read and write
4AA0000
trusted library allocation
page read and write
2920000
trusted library allocation
page read and write
34CC000
trusted library allocation
page read and write
6780000
trusted library allocation
page execute and read and write
17CE000
stack
page read and write
31C2000
trusted library allocation
page read and write
31B1000
trusted library allocation
page read and write
E0E000
stack
page read and write
3231000
trusted library allocation
page read and write
31B6000
trusted library allocation
page read and write
A300000
trusted library section
page read and write
5980000
heap
page read and write
2964000
trusted library allocation
page read and write
65A0000
trusted library allocation
page read and write
7BE000
stack
page read and write
3200000
trusted library allocation
page read and write
1767000
trusted library allocation
page execute and read and write
D5BE000
stack
page read and write
2910000
trusted library allocation
page read and write
5700000
trusted library allocation
page execute and read and write
105E000
stack
page read and write
C6D000
trusted library allocation
page execute and read and write
34C2000
trusted library allocation
page read and write
2BD7000
trusted library allocation
page read and write
172E000
stack
page read and write
2B1E000
stack
page read and write
7B50000
trusted library allocation
page execute and read and write
13D0000
heap
page read and write
56D0000
trusted library allocation
page execute and read and write
C17000
heap
page read and write
174D000
trusted library allocation
page execute and read and write
F09000
stack
page read and write
DA5000
trusted library allocation
page execute and read and write
E7F000
heap
page read and write
12F7000
stack
page read and write
5855000
heap
page read and write
2BCB000
trusted library allocation
page read and write
2B65000
trusted library allocation
page read and write
2988000
trusted library allocation
page read and write
640E000
stack
page read and write
620E000
stack
page read and write
3070000
trusted library allocation
page read and write
70A000
stack
page read and write
C70000
heap
page read and write
65C0000
trusted library allocation
page read and write
7350000
trusted library allocation
page read and write
5DB1000
heap
page read and write
57D0000
trusted library section
page readonly
C54000
trusted library allocation
page read and write
F60000
heap
page read and write
5670000
trusted library allocation
page read and write
57E3000
heap
page read and write
5D90000
heap
page read and write
6B6F000
stack
page read and write
56C0000
trusted library allocation
page read and write
58B0000
heap
page execute and read and write
2900000
trusted library allocation
page read and write
3495000
trusted library allocation
page read and write
31BD000
trusted library allocation
page read and write
770000
heap
page read and write
D3FE000
stack
page read and write
1752000
trusted library allocation
page read and write
5DBC000
heap
page read and write
60CE000
stack
page read and write
3080000
heap
page read and write
D800000
heap
page read and write
5DAC000
heap
page read and write
4B3C000
trusted library allocation
page read and write
3B59000
trusted library allocation
page read and write
F53000
heap
page read and write
2F98000
trusted library allocation
page read and write
2970000
heap
page read and write
65B0000
trusted library allocation
page read and write
638D000
stack
page read and write
7372000
trusted library allocation
page read and write
D96000
trusted library allocation
page execute and read and write
3B9B000
trusted library allocation
page read and write
2B81000
trusted library allocation
page read and write
DC2000
unkown
page readonly
31F5000
trusted library allocation
page read and write
DA2000
trusted library allocation
page read and write
5E50000
heap
page read and write
2B7D000
trusted library allocation
page read and write
C10000
heap
page read and write
DC0000
unkown
page readonly
5E3C000
heap
page read and write
5830000
heap
page read and write
F3D000
heap
page read and write
318E000
stack
page read and write
E68000
heap
page read and write
43C000
remote allocation
page execute and read and write
31AE000
trusted library allocation
page read and write
65F0000
trusted library allocation
page read and write
D92000
trusted library allocation
page read and write
1733000
trusted library allocation
page execute and read and write
C60000
trusted library allocation
page read and write
C75000
heap
page read and write
5860000
trusted library allocation
page read and write
4E70000
trusted library allocation
page read and write
532C000
stack
page read and write
E99000
heap
page read and write
56AE000
stack
page read and write
7C24000
trusted library allocation
page read and write
7B40000
trusted library allocation
page read and write
34AB000
trusted library allocation
page read and write
143E000
heap
page read and write
2946000
trusted library allocation
page read and write
4AEE000
trusted library allocation
page read and write
E50000
trusted library allocation
page execute and read and write
5870000
trusted library allocation
page execute and read and write
4231000
trusted library allocation
page read and write
57E0000
heap
page read and write
2960000
trusted library allocation
page read and write
175A000
trusted library allocation
page execute and read and write
C53000
trusted library allocation
page execute and read and write
293E000
trusted library allocation
page read and write
5120000
heap
page execute and read and write
6590000
trusted library allocation
page read and write
D7FE000
stack
page read and write
43E000
remote allocation
page execute and read and write
624E000
stack
page read and write
F27000
heap
page read and write
CBE000
stack
page read and write
D90000
trusted library allocation
page read and write
1760000
trusted library allocation
page read and write
7C40000
trusted library allocation
page execute and read and write
D3BE000
stack
page read and write
784F000
stack
page read and write
34AE000
trusted library allocation
page read and write
57B0000
trusted library allocation
page read and write
D9A000
trusted library allocation
page execute and read and write
D6BE000
stack
page read and write
1420000
trusted library allocation
page read and write
6700000
trusted library allocation
page execute and read and write
1730000
trusted library allocation
page read and write
2B20000
heap
page execute and read and write
2941000
trusted library allocation
page read and write
1740000
trusted library allocation
page read and write
17E7000
heap
page read and write
F70000
heap
page read and write
DA3F000
stack
page read and write
1734000
trusted library allocation
page read and write
14D8000
heap
page read and write
3194000
trusted library allocation
page read and write
2932000
trusted library allocation
page read and write
5D90000
trusted library section
page read and write
E8B000
heap
page read and write
6620000
heap
page read and write
65B3000
trusted library allocation
page read and write
2926000
trusted library allocation
page read and write
292E000
trusted library allocation
page read and write
DAB000
trusted library allocation
page execute and read and write
5E4B000
heap
page read and write
C50000
trusted library allocation
page read and write
5B7D000
stack
page read and write
3190000
trusted library allocation
page read and write
152B000
heap
page read and write
65A7000
trusted library allocation
page read and write
1526000
heap
page read and write
31E0000
trusted library allocation
page read and write
65D0000
trusted library allocation
page read and write
6710000
trusted library allocation
page read and write
D80000
heap
page read and write
292B000
trusted library allocation
page read and write
65CA000
trusted library allocation
page read and write
5B80000
heap
page read and write
67CE000
stack
page read and write
5D80000
trusted library allocation
page execute and read and write
D6FE000
stack
page read and write
EF5000
heap
page read and write
7B90000
trusted library allocation
page read and write
176B000
trusted library allocation
page execute and read and write
522C000
stack
page read and write
162F000
stack
page read and write
28FE000
stack
page read and write
2B6F000
trusted library allocation
page read and write
306B000
stack
page read and write
E60000
heap
page read and write
2B31000
trusted library allocation
page read and write
AF9000
stack
page read and write
4F33000
heap
page read and write
5E3E000
heap
page read and write
7F020000
trusted library allocation
page execute and read and write
3220000
heap
page execute and read and write
5B90000
heap
page read and write
650E000
stack
page read and write
56B0000
heap
page read and write
582B000
stack
page read and write
3756000
trusted library allocation
page read and write
5BD0000
heap
page read and write
F80000
heap
page read and write
610E000
stack
page read and write
293A000
trusted library allocation
page read and write
4F40000
heap
page read and write
7850000
trusted library allocation
page read and write
DC0000
trusted library allocation
page read and write
C40000
trusted library allocation
page read and write
There are 241 hidden memdumps, click here to show them.