IOC Report
ent.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ent.exe
"C:\Users\user\Desktop\ent.exe"
 malicious

URLs

Name
IP
Malicious
https://pastebin.com/raw/XzLzRHpk
172.67.19.24
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
0.tcp.eu.ngrok.io
3.124.142.205
 malicious
pastebin.com
172.67.19.24

IPs

IP
Domain
Country
Malicious
3.124.142.205
0.tcp.eu.ngrok.io
United States
malicious
172.67.19.24
pastebin.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ent_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
672000
unkown
page readonly
 malicious
29AB000
trusted library allocation
page read and write
 malicious
B30000
heap
page read and write
7FFD9B904000
trusted library allocation
page read and write
27C0000
heap
page read and write
C1D000
heap
page read and write
2783000
trusted library allocation
page read and write
7FFD9BAD0000
trusted library allocation
page read and write
12961000
trusted library allocation
page read and write
1B5F3000
heap
page read and write
1BF80000
heap
page read and write
2760000
trusted library allocation
page read and write
2C6C000
trusted library allocation
page read and write
1B570000
heap
page read and write
B10000
heap
page read and write
7FFD9B9B0000
trusted library allocation
page read and write
7FFD9B924000
trusted library allocation
page read and write
7FFD9BAC0000
trusted library allocation
page execute and read and write
1BA6F000
stack
page read and write
A10000
heap
page read and write
7FFD9B900000
trusted library allocation
page read and write
7FFD9BA20000
trusted library allocation
page execute and read and write
295E000
stack
page read and write
1C34E000
stack
page read and write
BD4000
heap
page read and write
27B0000
heap
page execute and read and write
DA0000
heap
page read and write
1B46E000
stack
page read and write
7FFD9B903000
trusted library allocation
page execute and read and write
C61000
heap
page read and write
B9C000
heap
page read and write
B96000
heap
page read and write
29E5000
trusted library allocation
page read and write
BFE000
heap
page read and write
7FFD9B92B000
trusted library allocation
page execute and read and write
1A960000
trusted library allocation
page read and write
1C84C000
stack
page read and write
7FFD9B9E6000
trusted library allocation
page execute and read and write
C64000
heap
page read and write
1C44C000
stack
page read and write
1B86C000
stack
page read and write
2AFA000
trusted library allocation
page read and write
7FFD9B910000
trusted library allocation
page read and write
670000
unkown
page readonly
1BC6E000
stack
page read and write
1B56C000
stack
page read and write
1BE64000
stack
page read and write
1B628000
heap
page read and write
7FFD9BAB0000
trusted library allocation
page execute and read and write
C09000
heap
page read and write
7FFD9B90D000
trusted library allocation
page execute and read and write
EAE000
stack
page read and write
CCE000
stack
page read and write
C00000
heap
page read and write
7FFD9B920000
trusted library allocation
page read and write
2C70000
trusted library allocation
page read and write
2850000
heap
page execute and read and write
FAD000
stack
page read and write
1B96E000
stack
page read and write
7FFD9B92D000
trusted library allocation
page execute and read and write
1B5BF000
heap
page read and write
1BF70000
heap
page read and write
C03000
heap
page read and write
7FFD9BAA2000
trusted library allocation
page read and write
7FFD9B91D000
trusted library allocation
page execute and read and write
1B5C1000
heap
page read and write
2961000
trusted library allocation
page read and write
7FFD9BAD2000
trusted library allocation
page read and write
D90000
trusted library allocation
page read and write
B75000
heap
page read and write
1B624000
heap
page read and write
1ACEE000
heap
page read and write
7FFD9B9C0000
trusted library allocation
page execute and read and write
1BD6A000
stack
page read and write
B70000
heap
page read and write
7FFD9B95C000
trusted library allocation
page execute and read and write
1296F000
trusted library allocation
page read and write
AF0000
heap
page read and write
BBC000
heap
page read and write
7C4000
stack
page read and write
7FFD9B913000
trusted library allocation
page read and write
67E000
unkown
page readonly
B90000
heap
page read and write
1AEED000
stack
page read and write
27C3000
heap
page read and write
7FF4E8190000
trusted library allocation
page execute and read and write
7FFD9B9BC000
trusted library allocation
page execute and read and write
DA5000
heap
page read and write
2770000
heap
page read and write
7FFD9B9B6000
trusted library allocation
page read and write
C26000
heap
page read and write
670000
unkown
page readonly
1B76C000
stack
page read and write
29E7000
trusted library allocation
page read and write
1C54A000
stack
page read and write
BD1000
heap
page read and write
1B5F1000
heap
page read and write
2780000
trusted library allocation
page read and write
There are 88 hidden memdumps, click here to show them.