IOC Report
SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious

URLs

Name
IP
Malicious
plaintediousidowsko.shop
malicious
acceptabledcooeprs.shop
malicious
zippyfinickysofwps.shop
malicious
pearcyworkeronej.shop
malicious
boredimperissvieos.shop
malicious
obsceneclassyjuwks.shop
malicious
sweetsquarediaslw.shop
malicious
holicisticscrarws.shop
malicious
miniaturefinerninewjs.shop
malicious
https://pearcyworkeronej.shop/api
172.67.131.204
 malicious
https://pearcyworkeronej.shop/apibu4
unknown
https://pearcyworkeronej.shop/
unknown
https://pearcyworkeronej.shop:443/api
unknown
https://pearcyworkeronej.shop/s
unknown
There are 4 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
pearcyworkeronej.shop
172.67.131.204
 malicious

IPs

IP
Domain
Country
Malicious
172.67.131.204
pearcyworkeronej.shop
United States
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
FFD000
unkown
page read and write
 malicious
E67000
heap
page read and write
306E000
stack
page read and write
FD1000
unkown
page execute read
E5C000
heap
page read and write
DE0000
heap
page read and write
1150000
heap
page read and write
FD0000
unkown
page readonly
E71000
heap
page read and write
9FC000
stack
page read and write
296D000
stack
page read and write
ECA000
heap
page read and write
2F6E000
stack
page read and write
EBF000
heap
page read and write
2E2E000
stack
page read and write
144E000
stack
page read and write
FFD000
unkown
page write copy
E1A000
heap
page read and write
1053000
unkown
page execute and read and write
E3B000
heap
page read and write
292E000
stack
page read and write
A3B000
stack
page read and write
E75000
heap
page read and write
1051000
unkown
page readonly
282E000
stack
page read and write
ED0000
heap
page read and write
400000
remote allocation
page execute and read and write
FD1000
unkown
page execute read
EE1000
heap
page read and write
DDE000
stack
page read and write
B70000
heap
page read and write
30BC000
trusted library allocation
page read and write
115A000
heap
page read and write
E30000
heap
page read and write
2CE0000
heap
page read and write
115E000
heap
page read and write
2A6E000
stack
page read and write
1051000
unkown
page readonly
EBE000
stack
page read and write
26ED000
stack
page read and write
F0B000
heap
page read and write
3520000
heap
page read and write
E5F000
heap
page read and write
33DF000
stack
page read and write
E53000
heap
page read and write
E10000
heap
page read and write
EED000
heap
page read and write
E45000
heap
page read and write
FF3000
unkown
page readonly
C50000
heap
page read and write
FD0000
unkown
page readonly
32DE000
stack
page read and write
FFF000
unkown
page write copy
C90000
heap
page read and write
104F000
unkown
page execute and read and write
1053000
unkown
page execute and read and write
2F2F000
stack
page read and write
EDB000
heap
page read and write
3114000
trusted library allocation
page read and write
D50000
heap
page read and write
E7E000
stack
page read and write
457000
remote allocation
page execute and read and write
B39000
stack
page read and write
134F000
stack
page read and write
CFD000
stack
page read and write
CDD000
stack
page read and write
3080000
trusted library allocation
page read and write
3180000
heap
page read and write
C55000
heap
page read and write
FF3000
unkown
page readonly
C60000
heap
page read and write
27ED000
stack
page read and write
There are 62 hidden memdumps, click here to show them.