IOC Report
xtnhsVjQTxvH.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\xtnhsVjQTxvH.exe
"C:\Users\user\Desktop\xtnhsVjQTxvH.exe"
 malicious

URLs

Name
IP
Malicious
2%b@)=Y3[YWrz<S
malicious
http://api.ipify.org/
unknown
http://freegeoip.net/xml/
unknown
http://schemas.datacontract.org/2004/07/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/json/
208.95.112.1

Domains

Name
IP
Malicious
proxybreve.duckdns.org
94.156.79.26
 malicious
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
94.156.79.26
proxybreve.duckdns.org
Bulgaria
malicious
208.95.112.1
ip-api.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\xtnhsVjQTxvH_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
572000
unkown
page readonly
 malicious
28F1000
trusted library allocation
page read and write
 malicious
D90000
trusted library allocation
page read and write
6470000
trusted library allocation
page read and write
2692000
trusted library allocation
page read and write
28A1000
trusted library allocation
page read and write
DAD000
trusted library allocation
page execute and read and write
D70000
heap
page read and write
4A8E000
stack
page read and write
38F1000
trusted library allocation
page read and write
DB3000
trusted library allocation
page read and write
2740000
heap
page read and write
B55000
heap
page read and write
663D000
stack
page read and write
DA3000
trusted library allocation
page execute and read and write
EEA000
heap
page read and write
28AD000
trusted library allocation
page read and write
64F0000
trusted library allocation
page execute and read and write
684E000
stack
page read and write
6E80000
heap
page read and write
53C8000
heap
page read and write
2850000
trusted library allocation
page execute and read and write
2929000
trusted library allocation
page read and write
289E000
trusted library allocation
page read and write
A30000
heap
page read and write
5B6E000
stack
page read and write
A10000
heap
page read and write
694F000
stack
page read and write
4DF7000
trusted library allocation
page read and write
284F000
stack
page read and write
B50000
heap
page read and write
DD0000
heap
page read and write
9C0000
heap
page read and write
502B000
heap
page read and write
4FB0000
heap
page read and write
A5A000
heap
page read and write
A4E000
heap
page read and write
4EAE000
stack
page read and write
48F8000
trusted library allocation
page read and write
958000
stack
page read and write
288E000
trusted library allocation
page read and write
3901000
trusted library allocation
page read and write
4ED0000
trusted library allocation
page read and write
2690000
trusted library allocation
page read and write
5CA000
unkown
page readonly
859000
stack
page read and write
4F00000
heap
page read and write
DD7000
heap
page read and write
570000
unkown
page readonly
AAD000
heap
page read and write
4DF0000
trusted library allocation
page read and write
28C0000
trusted library allocation
page read and write
28B2000
trusted library allocation
page read and write
26B0000
trusted library allocation
page read and write
6480000
trusted library allocation
page read and write
502F000
heap
page read and write
2860000
trusted library allocation
page read and write
EE0000
heap
page read and write
4EC0000
heap
page execute and read and write
50B0000
heap
page read and write
28E0000
heap
page execute and read and write
53B0000
heap
page read and write
DA0000
trusted library allocation
page read and write
EE7000
heap
page read and write
D93000
trusted library allocation
page read and write
2998000
trusted library allocation
page read and write
53AC000
stack
page read and write
26FE000
stack
page read and write
269B000
trusted library allocation
page execute and read and write
DBD000
trusted library allocation
page execute and read and write
DCA000
trusted library allocation
page execute and read and write
4DE0000
trusted library allocation
page read and write
DA4000
trusted library allocation
page read and write
9D0000
trusted library allocation
page read and write
4FCD000
heap
page read and write
7FA70000
trusted library allocation
page execute and read and write
54B0000
heap
page read and write
2870000
trusted library allocation
page read and write
64E0000
trusted library allocation
page read and write
273C000
stack
page read and write
A67000
heap
page read and write
2884000
trusted library allocation
page read and write
2892000
trusted library allocation
page read and write
653E000
stack
page read and write
4E4C000
stack
page read and write
DC0000
trusted library allocation
page read and write
630F000
stack
page read and write
DC2000
trusted library allocation
page read and write
28A6000
trusted library allocation
page read and write
288B000
trusted library allocation
page read and write
DC6000
trusted library allocation
page execute and read and write
289A000
trusted library allocation
page read and write
2886000
trusted library allocation
page read and write
64D0000
trusted library allocation
page execute and read and write
6460000
trusted library allocation
page execute and read and write
6450000
trusted library allocation
page read and write
28D0000
trusted library allocation
page read and write
5126000
heap
page read and write
620D000
stack
page read and write
A38000
heap
page read and write
2880000
trusted library allocation
page read and write
2C8A000
trusted library allocation
page read and write
2697000
trusted library allocation
page execute and read and write
4FF2000
heap
page read and write
There are 94 hidden memdumps, click here to show them.