IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\Public\Desktop\Google Chrome.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 05:47:14 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\TmpDC02.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\TmpDC13.tmp
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious

URLs

Name
IP
Malicious
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
unknown
http://tempuri.org/Entity/Id14ResponseD
unknown
http://tempuri.org/Entity/Id23ResponseD
unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
unknown
http://tempuri.org/Entity/Id12Response
unknown
http://tempuri.org/
unknown
http://tempuri.org/Entity/Id2Response
unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
unknown
http://tempuri.org/Entity/Id21Response
unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
unknown
http://tempuri.org/Entity/Id9
unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
unknown
http://tempuri.org/Entity/Id8
unknown
http://tempuri.org/Entity/Id6ResponseD
unknown
http://tempuri.org/Entity/Id5
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
unknown
http://tempuri.org/Entity/Id4
unknown
http://tempuri.org/Entity/Id7
unknown
http://tempuri.org/Entity/Id6
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
unknown
http://tempuri.org/Entity/Id19Response
unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
unknown
http://tempuri.org/Entity/Id13ResponseD
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat
unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
unknown
http://tempuri.org/Entity/Id15Response
unknown
http://tempuri.org/Entity/Id5ResponseD
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
unknown
http://tempuri.org/Entity/Id6Response
unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
unknown
https://api.ip.sb/ip
unknown
http://schemas.xmlsoap.org/ws/2004/04/sc
unknown
http://tempuri.org/Entity/Id1ResponseD
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
unknown
http://tempuri.org/Entity/Id9Response
unknown
http://tempuri.org/Entity/Id20
unknown
http://tempuri.org/Entity/Id21
unknown
http://tempuri.org/Entity/Id22
unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
unknown
http://tempuri.org/Entity/Id23
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
unknown
http://tempuri.org/Entity/Id24
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
unknown
http://tempuri.org/Entity/Id24Response
unknown
http://tempuri.org/Entity/Id1Response
unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
unknown
http://tempuri.org/Entity/Id21ResponseD
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
unknown
http://schemas.xmlsoap.org/ws/2004/04/trust
unknown
http://tempuri.org/Entity/Id10
unknown
http://tempuri.org/Entity/Id11
unknown
http://tempuri.org/Entity/Id10ResponseD
unknown
http://tempuri.org/Entity/Id12
unknown
http://tempuri.org/Entity/Id16Response
unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
unknown
http://tempuri.org/Entity/Id13
unknown
http://tempuri.org/Entity/Id14
unknown
http://tempuri.org/Entity/Id15
unknown
http://tempuri.org/Entity/Id16
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
unknown
http://tempuri.org/Entity/Id17
unknown
http://tempuri.org/Entity/Id18
unknown
http://tempuri.org/Entity/Id5Response
unknown
http://tempuri.org/Entity/Id19
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
unknown
http://tempuri.org/Entity/Id15ResponseD
unknown
http://tempuri.org/Entity/Id10Response
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
unknown
http://tempuri.org/Entity/Id11ResponseD
unknown
http://tempuri.org/Entity/Id8Response
unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
unknown
http://tempuri.org/Entity/Id17ResponseD
unknown
http://schemas.xmlsoap.org/soap/envelope/
unknown
http://tempuri.org/Entity/Id8ResponseD
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust
unknown
There are 90 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
5.42.65.96
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064
Blob
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Owner
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
SessionHash
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Sequence
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
RegFiles0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
RegFilesHash

Memdumps

Base Address
Regiontype
Protect
Malicious
2F91000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
8DD000
unkown
page read and write
 malicious
3038000
trusted library allocation
page read and write
 malicious
FE0000
heap
page read and write
6870000
trusted library allocation
page read and write
424A000
trusted library allocation
page read and write
31E1000
trusted library allocation
page read and write
3FB2000
trusted library allocation
page read and write
6885000
trusted library allocation
page read and write
11B7000
trusted library allocation
page execute and read and write
5961000
heap
page read and write
316C000
trusted library allocation
page read and write
3156000
trusted library allocation
page read and write
4250000
trusted library allocation
page read and write
5A50000
trusted library allocation
page read and write
42C9000
trusted library allocation
page read and write
3432000
trusted library allocation
page read and write
4066000
trusted library allocation
page read and write
F10000
heap
page read and write
69B0000
trusted library allocation
page execute and read and write
124E000
stack
page read and write
8D3000
unkown
page readonly
75AA000
heap
page read and write
7515000
heap
page read and write
57DA000
heap
page read and write
57D3000
heap
page read and write
2F5D000
trusted library allocation
page read and write
6880000
trusted library allocation
page read and write
407E000
trusted library allocation
page read and write
3461000
trusted library allocation
page read and write
119D000
trusted library allocation
page execute and read and write
6BFC000
stack
page read and write
66D8000
trusted library allocation
page read and write
755C000
heap
page read and write
6B60000
heap
page execute and read and write
42B7000
trusted library allocation
page read and write
30EE000
trusted library allocation
page read and write
F1B000
heap
page read and write
6B40000
trusted library allocation
page read and write
121E000
stack
page read and write
7718000
trusted library allocation
page read and write
68C1000
trusted library allocation
page read and write
FC0000
heap
page read and write
100E000
heap
page read and write
3F9F000
trusted library allocation
page read and write
545E000
stack
page read and write
55D0000
heap
page execute and read and write
6875000
trusted library allocation
page read and write
758B000
heap
page read and write
6887000
trusted library allocation
page read and write
11D0000
trusted library allocation
page read and write
76F0000
trusted library allocation
page execute and read and write
6ECA000
trusted library allocation
page read and write
4279000
trusted library allocation
page read and write
6E4B000
trusted library allocation
page read and write
922000
unkown
page read and write
FB9000
heap
page read and write
3116000
trusted library allocation
page read and write
2D5E000
stack
page read and write
11BB000
trusted library allocation
page execute and read and write
7804000
trusted library allocation
page read and write
6E3C000
stack
page read and write
77DE000
stack
page read and write
400000
remote allocation
page execute and read and write
2F34000
trusted library allocation
page read and write
8DF000
unkown
page write copy
648E000
stack
page read and write
687A000
trusted library allocation
page read and write
56DE000
stack
page read and write
6910000
trusted library allocation
page read and write
11A2000
trusted library allocation
page read and write
57A5000
heap
page read and write
5799000
heap
page read and write
4261000
trusted library allocation
page read and write
55C0000
heap
page read and write
3101000
trusted library allocation
page read and write
437000
remote allocation
page execute and read and write
56E0000
heap
page read and write
4083000
trusted library allocation
page read and write
310A000
trusted library allocation
page read and write
6889000
trusted library allocation
page read and write
4235000
trusted library allocation
page read and write
1184000
trusted library allocation
page read and write
3469000
trusted library allocation
page read and write
10F5000
heap
page read and write
75F6000
heap
page read and write
4275000
trusted library allocation
page read and write
429D000
trusted library allocation
page read and write
7730000
trusted library allocation
page read and write
6E90000
trusted library allocation
page read and write
54A3000
heap
page read and write
6900000
trusted library allocation
page read and write
6EA9000
trusted library allocation
page read and write
57C4000
heap
page read and write
5330000
heap
page read and write
2D60000
trusted library allocation
page read and write
6940000
trusted library allocation
page read and write
6EB8000
trusted library allocation
page read and write
6878000
trusted library allocation
page read and write
6990000
trusted library allocation
page read and write
2F4E000
trusted library allocation
page read and write
35A6000
trusted library allocation
page read and write
66F0000
trusted library allocation
page read and write
614E000
stack
page read and write
760A000
heap
page read and write
92E000
unkown
page execute and read and write
2F51000
trusted library allocation
page read and write
405F000
trusted library allocation
page read and write
7810000
trusted library allocation
page execute and read and write
92B000
unkown
page execute and read and write
6920000
trusted library allocation
page read and write
68E1000
trusted library allocation
page read and write
BD0000
heap
page read and write
758F000
heap
page read and write
11B2000
trusted library allocation
page read and write
92C000
unkown
page readonly
3144000
trusted library allocation
page read and write
1190000
trusted library allocation
page read and write
75C4000
heap
page read and write
68D2000
trusted library allocation
page read and write
30F3000
trusted library allocation
page read and write
33C9000
trusted library allocation
page read and write
75D6000
heap
page read and write
42D6000
trusted library allocation
page read and write
1290000
trusted library allocation
page read and write
6ECF000
trusted library allocation
page read and write
345D000
trusted library allocation
page read and write
2F30000
trusted library allocation
page read and write
2F3B000
trusted library allocation
page read and write
6B90000
trusted library allocation
page execute and read and write
594F000
stack
page read and write
6BB0000
trusted library allocation
page execute and read and write
8B1000
unkown
page execute read
2F56000
trusted library allocation
page read and write
40F0000
trusted library allocation
page read and write
6950000
trusted library allocation
page read and write
3455000
trusted library allocation
page read and write
446000
remote allocation
page execute and read and write
57D0000
heap
page read and write
4230000
trusted library allocation
page read and write
42DA000
trusted library allocation
page read and write
55D3000
heap
page execute and read and write
6EBF000
trusted library allocation
page read and write
2D98000
trusted library allocation
page read and write
4079000
trusted library allocation
page read and write
52E0000
trusted library allocation
page read and write
3445000
trusted library allocation
page read and write
658E000
stack
page read and write
406C000
trusted library allocation
page read and write
8B1000
unkown
page execute read
66E0000
trusted library allocation
page read and write
FD0000
heap
page read and write
61CE000
stack
page read and write
7720000
trusted library allocation
page read and write
B2A000
stack
page read and write
30FF000
trusted library allocation
page read and write
5978000
heap
page read and write
118D000
trusted library allocation
page execute and read and write
31AE000
trusted library allocation
page read and write
426A000
trusted library allocation
page read and write
5350000
trusted library allocation
page execute and read and write
618E000
stack
page read and write
4267000
trusted library allocation
page read and write
11A0000
trusted library allocation
page read and write
7585000
heap
page read and write
120E000
heap
page read and write
3453000
trusted library allocation
page read and write
57CD000
heap
page read and write
1180000
trusted library allocation
page read and write
432000
remote allocation
page execute and read and write
8DD000
unkown
page write copy
57A8000
heap
page read and write
74F0000
heap
page read and write
31BE000
trusted library allocation
page read and write
2D75000
trusted library allocation
page read and write
407B000
trusted library allocation
page read and write
604E000
stack
page read and write
7FB0000
trusted library allocation
page read and write
E6C000
stack
page read and write
5722000
heap
page read and write
549E000
stack
page read and write
785E000
stack
page read and write
68C6000
trusted library allocation
page read and write
574E000
heap
page read and write
78BC000
trusted library allocation
page read and write
344D000
trusted library allocation
page read and write
6905000
trusted library allocation
page read and write
F56000
heap
page read and write
7599000
heap
page read and write
3150000
trusted library allocation
page read and write
426C000
trusted library allocation
page read and write
2C50000
heap
page read and write
42D0000
trusted library allocation
page read and write
7BCE000
stack
page read and write
34D1000
trusted library allocation
page read and write
42E6000
trusted library allocation
page read and write
FB5000
heap
page read and write
43EF000
trusted library allocation
page read and write
8D3000
unkown
page readonly
6B30000
trusted library allocation
page read and write
3F91000
trusted library allocation
page read and write
11B0000
trusted library allocation
page read and write
11B5000
trusted library allocation
page execute and read and write
12B0000
heap
page read and write
FCD000
heap
page read and write
7D4E000
stack
page read and write
779D000
stack
page read and write
7F5D0000
trusted library allocation
page execute and read and write
10E0000
trusted library allocation
page read and write
4075000
trusted library allocation
page read and write
1205000
heap
page read and write
113E000
stack
page read and write
66CF000
stack
page read and write
412C000
trusted library allocation
page read and write
757A000
heap
page read and write
68B0000
trusted library allocation
page read and write
3177000
trusted library allocation
page read and write
2B5F000
stack
page read and write
754C000
heap
page read and write
315C000
trusted library allocation
page read and write
74FE000
heap
page read and write
77F0000
trusted library allocation
page read and write
6EC5000
trusted library allocation
page read and write
3459000
trusted library allocation
page read and write
1200000
heap
page read and write
7704000
trusted library allocation
page read and write
5300000
heap
page read and write
4240000
trusted library allocation
page read and write
8B0000
unkown
page readonly
40C0000
trusted library allocation
page read and write
10F0000
heap
page read and write
6A10000
trusted library allocation
page execute and read and write
68F0000
trusted library allocation
page read and write
690B000
trusted library allocation
page read and write
6A00000
trusted library allocation
page execute and read and write
7EAB000
stack
page read and write
7503000
heap
page read and write
4257000
trusted library allocation
page read and write
56E4000
heap
page read and write
2F80000
heap
page execute and read and write
2F2B000
stack
page read and write
6CFC000
stack
page read and write
7C10000
heap
page read and write
4070000
trusted library allocation
page read and write
F49000
heap
page read and write
74F4000
heap
page read and write
67A0000
trusted library allocation
page execute and read and write
6EBA000
trusted library allocation
page read and write
6E48000
trusted library allocation
page read and write
101E000
heap
page read and write
690E000
trusted library allocation
page read and write
7FAE000
stack
page read and write
92C000
unkown
page readonly
F6C000
stack
page read and write
92E000
unkown
page execute and read and write
FB1000
heap
page read and write
7800000
trusted library allocation
page read and write
117D000
stack
page read and write
12A0000
trusted library allocation
page read and write
7C0E000
stack
page read and write
11E0000
trusted library allocation
page execute and read and write
30F0000
trusted library allocation
page read and write
75E2000
heap
page read and write
7B8F000
stack
page read and write
11A6000
trusted library allocation
page execute and read and write
68DE000
trusted library allocation
page read and write
426F000
trusted library allocation
page read and write
1010000
heap
page read and write
7710000
trusted library allocation
page read and write
6980000
trusted library allocation
page read and write
5340000
trusted library allocation
page read and write
2D70000
trusted library allocation
page read and write
3161000
trusted library allocation
page read and write
8680000
trusted library allocation
page read and write
52EE000
trusted library allocation
page read and write
6930000
trusted library allocation
page read and write
313D000
trusted library allocation
page read and write
7540000
heap
page read and write
6D3E000
stack
page read and write
5973000
heap
page read and write
6780000
trusted library allocation
page execute and read and write
69A0000
trusted library allocation
page execute and read and write
65CE000
stack
page read and write
11F0000
trusted library allocation
page read and write
2F62000
trusted library allocation
page read and write
5342000
trusted library allocation
page read and write
7700000
trusted library allocation
page read and write
3130000
trusted library allocation
page read and write
91AE000
stack
page read and write
323A000
trusted library allocation
page read and write
FF7000
heap
page read and write
425D000
trusted library allocation
page read and write
2F70000
trusted library allocation
page read and write
7528000
heap
page read and write
1183000
trusted library allocation
page execute and read and write
6B70000
trusted library allocation
page read and write
101A000
heap
page read and write
913000
unkown
page read and write
145F000
stack
page read and write
77E0000
trusted library allocation
page execute and read and write
54A0000
heap
page read and write
866D000
stack
page read and write
3449000
trusted library allocation
page read and write
2C5E000
stack
page read and write
EF7000
stack
page read and write
131F000
stack
page read and write
B90000
heap
page read and write
75B6000
heap
page read and write
57AD000
heap
page read and write
FD5000
heap
page read and write
68BB000
trusted library allocation
page read and write
66D0000
trusted library allocation
page read and write
42AA000
trusted library allocation
page read and write
11AA000
trusted library allocation
page execute and read and write
7E50000
trusted library allocation
page execute and read and write
6E40000
trusted library allocation
page read and write
4291000
trusted library allocation
page read and write
6EA2000
trusted library allocation
page read and write
3123000
trusted library allocation
page read and write
78B0000
trusted library allocation
page read and write
8B0000
unkown
page readonly
FEB000
heap
page read and write
86A0000
heap
page read and write
30AC000
trusted library allocation
page read and write
6EA0000
trusted library allocation
page read and write
4098000
trusted library allocation
page read and write
7E4D000
stack
page read and write
2D80000
heap
page read and write
75B4000
heap
page read and write
862E000
stack
page read and write
344F000
trusted library allocation
page read and write
6B50000
trusted library allocation
page read and write
6EA5000
trusted library allocation
page read and write
42BE000
trusted library allocation
page read and write
852E000
stack
page read and write
6B80000
trusted library allocation
page read and write
42EF000
trusted library allocation
page read and write
135E000
stack
page read and write
BA0000
heap
page read and write
128C000
stack
page read and write
There are 331 hidden memdumps, click here to show them.