IOC Report
Implosions.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Implosions.exe
"C:\Users\user\Desktop\Implosions.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://209.38.151.4:55123/
209.38.151.4
 malicious
209.38.151.4:55123
malicious
https://ipinfo.io/ip%appdata%
unknown
http://209.38.151.4:55123
unknown
http://tempuri.org/Endpoint/CheckConnectLR
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
unknown
http://tempuri.org/Endpoint/CheckConnectResponse
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%
unknown
http://schemas.xmlsoap.org/soap/envelope/
unknown
http://tempuri.org/
unknown
http://tempuri.org/Endpoint/CheckConnect
unknown
http://tempuri.org/Endpoint/EnvironmentSettingsLR
unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse
unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse
unknown
http://tempuri.org/Endpoint/SetEnvironmentLR
unknown
https://api.ipify.orgcookies//settinString.Removeg
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing
unknown
http://tempuri.org/Endpoint/GetUpdatesLR
unknown
http://tempuri.org/Endpoint/VerifyUpdateLR
unknown
http://tempuri.org/Endpoint/GetUpdatesResponse
unknown
http://tempuri.org/Endpoint/
unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse
unknown
http://tempuri.org/Endpoint/CheckConnectT
unknown
http://tempuri.org/0
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://schemas.xmlsoap.org/soap/actor/next
unknown
There are 17 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
209.38.151.4
unknown
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Implosions_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2F2000
unkown
page readonly
 malicious
B02000
trusted library allocation
page read and write
B80000
trusted library allocation
page read and write
5D0E000
stack
page read and write
7AA000
heap
page read and write
4FE0000
trusted library allocation
page read and write
50BE000
stack
page read and write
4EF1000
trusted library allocation
page read and write
B05000
trusted library allocation
page execute and read and write
54AE000
stack
page read and write
4ECE000
stack
page read and write
4B9E000
trusted library allocation
page read and write
4F80000
trusted library allocation
page read and write
765000
heap
page read and write
AF0000
trusted library allocation
page read and write
476E000
stack
page read and write
6F7000
stack
page read and write
B0B000
trusted library allocation
page execute and read and write
2663000
trusted library allocation
page read and write
4ED0000
trusted library allocation
page read and write
AA0000
heap
page read and write
2F0000
unkown
page readonly
4BA1000
trusted library allocation
page read and write
810000
heap
page read and write
A70000
trusted library allocation
page read and write
4BB0000
trusted library allocation
page read and write
5C0F000
stack
page read and write
4B81000
trusted library allocation
page read and write
4B92000
trusted library allocation
page read and write
51D0000
trusted library allocation
page read and write
35D1000
trusted library allocation
page read and write
2666000
trusted library allocation
page read and write
7EE80000
trusted library allocation
page execute and read and write
26AF000
trusted library allocation
page read and write
B70000
trusted library allocation
page read and write
266F000
trusted library allocation
page read and write
51CE000
stack
page read and write
4F70000
trusted library allocation
page read and write
265E000
trusted library allocation
page read and write
A8D000
trusted library allocation
page execute and read and write
710000
heap
page read and write
B90000
heap
page read and write
25D1000
trusted library allocation
page read and write
B40000
heap
page read and write
5E0E000
stack
page read and write
7A0000
heap
page read and write
7C7000
heap
page read and write
4FF0000
trusted library allocation
page read and write
2685000
trusted library allocation
page read and write
A83000
trusted library allocation
page execute and read and write
5E24000
heap
page read and write
4BC0000
heap
page execute and read and write
265B000
trusted library allocation
page read and write
A84000
trusted library allocation
page read and write
7D4000
heap
page read and write
4F30000
trusted library allocation
page read and write
4F60000
trusted library allocation
page execute and read and write
266C000
trusted library allocation
page read and write
A9D000
trusted library allocation
page execute and read and write
B60000
heap
page execute and read and write
2793000
trusted library allocation
page read and write
24C0000
heap
page read and write
4B6E000
stack
page read and write
50C0000
trusted library allocation
page execute and read and write
500D000
trusted library allocation
page read and write
25CF000
stack
page read and write
7AE000
heap
page read and write
4B7B000
trusted library allocation
page read and write
5020000
trusted library allocation
page read and write
700000
heap
page read and write
39C000
stack
page read and write
5030000
trusted library allocation
page execute and read and write
760000
heap
page read and write
500A000
trusted library allocation
page read and write
AF6000
trusted library allocation
page execute and read and write
267C000
trusted library allocation
page read and write
AFA000
trusted library allocation
page execute and read and write
A80000
trusted library allocation
page read and write
7E1000
heap
page read and write
4BB8000
trusted library allocation
page read and write
4B86000
trusted library allocation
page read and write
AF2000
trusted library allocation
page read and write
4B70000
trusted library allocation
page read and write
24BE000
stack
page read and write
247E000
stack
page read and write
4BBA000
trusted library allocation
page read and write
4F10000
trusted library allocation
page read and write
507D000
stack
page read and write
5010000
trusted library allocation
page read and write
4F20000
trusted library allocation
page read and write
4F90000
trusted library allocation
page execute and read and write
B30000
trusted library allocation
page execute and read and write
546E000
stack
page read and write
B07000
trusted library allocation
page execute and read and write
279A000
trusted library allocation
page read and write
A90000
trusted library allocation
page read and write
889000
heap
page read and write
5E10000
heap
page read and write
5E52000
heap
page read and write
4BB4000
trusted library allocation
page read and write
4EE0000
trusted library allocation
page read and write
There are 91 hidden memdumps, click here to show them.