IOC Report
7Xex8yR90g.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\7Xex8yR90g.exe
"C:\Users\user\Desktop\7Xex8yR90g.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://94.228.166.55/924cf5c06b0c4fee.php
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
229000
unkown
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
1F1000
unkown
page execute read
254000
unkown
page readonly
1330000
heap
page read and write
254000
unkown
page readonly
229000
unkown
page write copy
99C000
stack
page read and write
12FC000
stack
page read and write
2AF0000
heap
page read and write
637000
remote allocation
page execute and read and write
14B0000
heap
page read and write
15DF000
stack
page read and write
625000
remote allocation
page execute and read and write
120F000
stack
page read and write
14D0000
heap
page read and write
E80000
direct allocation
page execute and read and write
FCC000
stack
page read and write
21C000
unkown
page readonly
2D3E000
stack
page read and write
21C000
unkown
page readonly
102F000
heap
page read and write
250000
unkown
page read and write
1610000
heap
page read and write
E2E000
stack
page read and write
101A000
heap
page read and write
2C3E000
stack
page read and write
E6E000
stack
page read and write
DE0000
heap
page read and write
1F0000
unkown
page readonly
1010000
heap
page read and write
1410000
heap
page read and write
1F1000
unkown
page execute read
CFC000
stack
page read and write
E90000
heap
page read and write
101E000
heap
page read and write
161A000
heap
page read and write
1F0000
unkown
page readonly
D00000
heap
page read and write
F9F000
stack
page read and write
147E000
stack
page read and write
There are 31 hidden memdumps, click here to show them.