IOC Report
https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msi

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\Desktop\cmdline.out
ASCII text, with CRLF line terminators
modified
C:\Users\user\Desktop\download\OPNC-v1.1.25.0.msi
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {E36AFA06-1EFD-49D1-8CD4-4C1A142E76B2}, Number of Words: 10, Subject: OPWC, Author: OPWC, Name of Creating Application: OPWC, Template: ;1033, Comments: This installer database contains the logic and data required to install OPWC., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu Feb 1 04:04:35 2024, Last Saved Time/Date: Thu Feb 1 04:04:35 2024, Last Printed: Thu Feb 1 04:04:35 2024, Number of Pages: 450
dropped

Processes

Path
Cmdline
Malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msi" > cmdline.out 2>&1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\wget.exe
wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msi"
C:\Windows\System32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding

URLs

Name
IP
Malicious
https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msi
malicious
https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msi
3.160.156.148
 malicious
https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msir
unknown
 malicious
https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msi)
unknown
 malicious
https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msiNA-PCN
unknown
 malicious
https://d226ryxb715ss0.cloudfront.net/OPNC-v1.1.25.0.msiCESSOR_
unknown
 malicious
http://d2q8odwdblz94i.cloudfront.net
unknown

Domains

Name
IP
Malicious
d226ryxb715ss0.cloudfront.net
3.160.156.148

IPs

IP
Domain
Country
Malicious
3.160.156.148
d226ryxb715ss0.cloudfront.net
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Mozilla Firefox\firefox.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Mozilla Firefox\firefox.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Internet Explorer\iexplore.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Internet Explorer\iexplore.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\mspaint.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\mspaint.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\NOTEPAD.EXE.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\NOTEPAD.EXE.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\root\Office16\Winword.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Microsoft Office\root\Office16\Winword.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Windows Media Player\wmplayer.exe.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files (x86)\Windows Media Player\wmplayer.exe.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.ApplicationCompany
There are 8 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
14E2A449000
heap
page read and write
14E2A3C9000
heap
page read and write
14E2A2DA000
heap
page read and write
14E2A2E9000
heap
page read and write
2B87000
heap
page read and write
14E2A442000
heap
page read and write
14E2A47D000
heap
page read and write
14E2845D000
heap
page read and write
2B81000
heap
page read and write
14E2A463000
heap
page read and write
14E284AF000
heap
page read and write
14E2A2DE000
heap
page read and write
14E2A452000
heap
page read and write
14E2846D000
heap
page read and write
14E2A44F000
heap
page read and write
14E2A3BD000
heap
page read and write
14E2A2D5000
heap
page read and write
14E2A491000
heap
page read and write
14E2847D000
heap
page read and write
14E28476000
heap
page read and write
14E2A462000
heap
page read and write
14E2A435000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2A2F2000
heap
page read and write
14E2EE00000
heap
page readonly
14E2A2DE000
heap
page read and write
14E28488000
heap
page read and write
14E2A2DE000
heap
page read and write
14E2A3EB000
heap
page read and write
14E2A2DA000
heap
page read and write
14E2A2D5000
heap
page read and write
14E2A2D5000
heap
page read and write
9CC000
stack
page read and write
14E2845E000
heap
page read and write
14E2A44F000
heap
page read and write
2B76000
heap
page read and write
14E2A3C1000
heap
page read and write
14E2A3C5000
heap
page read and write
14E2A3C1000
heap
page read and write
14E2A463000
heap
page read and write
9B000
stack
page read and write
14E28494000
heap
page read and write
14E2A434000
heap
page read and write
14E2A2B0000
heap
page read and write
105C000
heap
page read and write
14E2A2ED000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2A3C3000
heap
page read and write
14E2A2DA000
heap
page read and write
105E000
heap
page read and write
14E2A441000
heap
page read and write
2B7E000
heap
page read and write
14E2A2C8000
heap
page read and write
14E2A3CB000
heap
page read and write
14E2CF60000
heap
page read and write
14E2845B000
heap
page read and write
14E2A3A2000
heap
page read and write
14E2A3CB000
heap
page read and write
14E28451000
heap
page read and write
14E2A464000
heap
page read and write
14E28459000
heap
page read and write
14E28250000
heap
page read and write
FCE000
stack
page read and write
14E2A2F2000
heap
page read and write
14E2A3DF000
heap
page read and write
14E2A3C9000
heap
page read and write
14E2A2DE000
heap
page read and write
14E283C9000
heap
page read and write
14E2A2B7000
heap
page read and write
14E2A2F2000
heap
page read and write
14E28457000
heap
page read and write
F0000
heap
page read and write
4B09B7E000
stack
page read and write
14E2842F000
heap
page read and write
2E3F000
stack
page read and write
F70000
heap
page read and write
14E2A2F2000
heap
page read and write
14E2A3DA000
heap
page read and write
14E28497000
heap
page read and write
14E2A2DA000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2A2EA000
heap
page read and write
14E2847B000
heap
page read and write
14E2A2FA000
heap
page read and write
14E2A3D2000
heap
page read and write
14E2A2EA000
heap
page read and write
14E2A2CF000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2A2E1000
heap
page read and write
14E2A2ED000
heap
page read and write
14E2A3D2000
heap
page read and write
14E2A2F2000
heap
page read and write
4B09AFF000
stack
page read and write
14E2A3D2000
heap
page read and write
14E2A2E4000
heap
page read and write
14E2A433000
heap
page read and write
14E28476000
heap
page read and write
14E28464000
heap
page read and write
14E2A428000
heap
page read and write
14E2A2ED000
heap
page read and write
14E2CD20000
heap
page read and write
14E2A2ED000
heap
page read and write
2B4D000
heap
page read and write
7DF4A5001000
trusted library allocation
page execute read
14E2A2E4000
heap
page read and write
14E2CD35000
heap
page read and write
14E28457000
heap
page read and write
14E2A476000
heap
page read and write
14E2A2DA000
heap
page read and write
CFF000
stack
page read and write
F8000
heap
page read and write
14E28475000
heap
page read and write
14E2A2DE000
heap
page read and write
14E2A2CF000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2A46B000
heap
page read and write
14E2A46B000
heap
page read and write
2B87000
heap
page read and write
14E2A44F000
heap
page read and write
AFE000
stack
page read and write
14E2A2FE000
heap
page read and write
14E2844D000
heap
page read and write
14E2C4F0000
trusted library allocation
page read and write
14E2A462000
heap
page read and write
14E2A434000
heap
page read and write
14E2A3C7000
heap
page read and write
2B7A000
heap
page read and write
14E2A2FE000
heap
page read and write
14E2A441000
heap
page read and write
14E2CD33000
heap
page read and write
14E2A47C000
heap
page read and write
14E2A2E4000
heap
page read and write
9E0000
heap
page read and write
14E2A2DE000
heap
page read and write
14E29DE0000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2848A000
heap
page read and write
14E2A3F7000
heap
page read and write
14E2A434000
heap
page read and write
14E2CF20000
trusted library allocation
page read and write
14E2A44F000
heap
page read and write
14E2A434000
heap
page read and write
14E2A47D000
heap
page read and write
14E2A468000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2A441000
heap
page read and write
4B09C7B000
stack
page read and write
14E2A476000
heap
page read and write
14E2A3D2000
heap
page read and write
14E2A433000
heap
page read and write
14E2A2ED000
heap
page read and write
14E2A2CF000
heap
page read and write
14E2A476000
heap
page read and write
14E2A3B1000
heap
page read and write
14E2A2E4000
heap
page read and write
14E2A2E4000
heap
page read and write
14E2A425000
heap
page read and write
14E2A2C7000
heap
page read and write
14E2A2D5000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2845E000
heap
page read and write
14E2A2ED000
heap
page read and write
4B09A7E000
stack
page read and write
14E2A3C5000
heap
page read and write
14E2A3DF000
heap
page read and write
14E2A2F2000
heap
page read and write
14E2A2E4000
heap
page read and write
4B09E7D000
stack
page read and write
14E2A2E9000
heap
page read and write
14E2A2F9000
heap
page read and write
14E2A452000
heap
page read and write
14E2CD39000
heap
page read and write
14E2A2CB000
heap
page read and write
14E2A2E4000
heap
page read and write
14E2A2E4000
heap
page read and write
14E2A2F2000
heap
page read and write
14E2CD2E000
heap
page read and write
14E28477000
heap
page read and write
14E283C0000
heap
page read and write
14E2A2F2000
heap
page read and write
14E2A2E4000
heap
page read and write
14E2A441000
heap
page read and write
14E2CD3D000
heap
page read and write
14E2CD42000
heap
page read and write
4B09708000
stack
page read and write
14E2A476000
heap
page read and write
14E2A3AA000
heap
page read and write
14E2A496000
heap
page read and write
14E2A2D5000
heap
page read and write
14E2CD14000
heap
page read and write
14E2A442000
heap
page read and write
2B85000
heap
page read and write
E0000
heap
page read and write
14E28451000
heap
page read and write
14E2A441000
heap
page read and write
1055000
heap
page read and write
14E2CD38000
heap
page read and write
14E2A44F000
heap
page read and write
14E28474000
heap
page read and write
14E28457000
heap
page read and write
14E2A2A0000
heap
page read and write
14E2A2D5000
heap
page read and write
14E2A2D5000
heap
page read and write
14E2CD10000
heap
page read and write
14E2A471000
heap
page read and write
14E2A2D5000
heap
page read and write
14E2A2C2000
heap
page read and write
14E29D00000
heap
page read and write
14E284BE000
heap
page read and write
14E2A2F5000
heap
page read and write
14E2A2D5000
heap
page read and write
14E2A2DA000
heap
page read and write
14E2846E000
heap
page read and write
14E2849F000
heap
page read and write
14E2A463000
heap
page read and write
14E2845E000
heap
page read and write
14E2A2B5000
heap
page read and write
14E2A3B6000
heap
page read and write
105D000
heap
page read and write
14E2A44F000
heap
page read and write
E6000
heap
page read and write
2F00000
heap
page read and write
14E2847C000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2A2DE000
heap
page read and write
14E2845E000
heap
page read and write
14E28489000
heap
page read and write
14E2A2BB000
heap
page read and write
14E2A3EA000
heap
page read and write
14E2A442000
heap
page read and write
14E2A2CA000
heap
page read and write
14E2CD2D000
heap
page read and write
14E2A3C3000
heap
page read and write
14E2A3F7000
heap
page read and write
14E2A2DE000
heap
page read and write
14E28491000
heap
page read and write
14E2A2DE000
heap
page read and write
14E2A2E5000
heap
page read and write
14E2845E000
heap
page read and write
14E2A493000
heap
page read and write
4B09BFC000
stack
page read and write
14E2A2DE000
heap
page read and write
F40000
heap
page read and write
14E2A434000
heap
page read and write
14E2A3BD000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2A2DE000
heap
page read and write
14E2A2ED000
heap
page read and write
14E2A44F000
heap
page read and write
14E2A2E9000
heap
page read and write
14E2A2ED000
heap
page read and write
14E2A438000
heap
page read and write
1050000
heap
page read and write
14E2A2DB000
heap
page read and write
14E2A463000
heap
page read and write
14E2A3F4000
heap
page read and write
14E28457000
heap
page read and write
14E2A2DE000
heap
page read and write
14E2A3DF000
heap
page read and write
2B82000
heap
page read and write
2B84000
heap
page read and write
14E2A463000
heap
page read and write
14E2A3BD000
heap
page read and write
14E2A2E4000
heap
page read and write
14E28491000
heap
page read and write
14E2849C000
heap
page read and write
14E2A2CF000
heap
page read and write
14E29DE5000
heap
page read and write
14E2A2E4000
heap
page read and write
14E2846F000
heap
page read and write
14E28468000
heap
page read and write
14E28463000
heap
page read and write
F3F000
stack
page read and write
14E2A2DA000
heap
page read and write
14E2A3A0000
heap
page read and write
2B4A000
heap
page read and write
2B87000
heap
page read and write
14E2A2E4000
heap
page read and write
14E2A2E9000
heap
page read and write
105B000
heap
page read and write
14E2A431000
heap
page read and write
14E28469000
heap
page read and write
14E2A2DA000
heap
page read and write
14E2A2ED000
heap
page read and write
14E2A3DA000
heap
page read and write
14E2A2CF000
heap
page read and write
F60000
heap
page read and write
14E2A2EE000
heap
page read and write
14E2A2B9000
heap
page read and write
14E2A2C5000
heap
page read and write
D3E000
stack
page read and write
14E28330000
heap
page read and write
14E28370000
heap
page read and write
4B09EFB000
stack
page read and write
14E2A2BB000
heap
page read and write
14E2A3C7000
heap
page read and write
14E2A2ED000
heap
page read and write
14E2A2B1000
heap
page read and write
2B87000
heap
page read and write
14E2A2FE000
heap
page read and write
2B40000
heap
page read and write
14E28451000
heap
page read and write
4B0978E000
stack
page read and write
14E2A3D2000
heap
page read and write
14E28470000
heap
page read and write
14E2A2CB000
heap
page read and write
14E284BB000
heap
page read and write
14E2A463000
heap
page read and write
14E2A2D0000
heap
page read and write
14E2A497000
heap
page read and write
14E2A44F000
heap
page read and write
There are 302 hidden memdumps, click here to show them.