IOC Report
file.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://drive-connect.cyou/api
104.21.79.7
 malicious
drive-connect.cyou
malicious
dare-curbys.biz
impend-differ.biz
http://crl.m
unknown
zinc-sneark.biz
covery-mover.biz
formy-spill.biz
https://drive-connect.cyou/apin
unknown
https://drive-connect.cyou/
unknown
se-blurry.biz
print-vexer.biz
https://drive-connect.cyou/c
unknown
https://drive-connect.cyou/apis&&4
unknown
dwell-exclaim.biz
There are 5 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
drive-connect.cyou
104.21.79.7
 malicious

IPs

IP
Domain
Country
Malicious
104.21.79.7
drive-connect.cyou
United States
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
273F000
heap
page read and write
 malicious
506000
unkown
page write copy
980000
heap
page read and write
4D1000
unkown
page execute read
16CD000
heap
page read and write
163D000
stack
page read and write
4FB000
unkown
page readonly
A30000
heap
page read and write
4FB000
unkown
page readonly
174C000
heap
page read and write
506000
unkown
page write copy
173C000
heap
page read and write
A2E000
stack
page read and write
3180000
remote allocation
page read and write
506000
unkown
page write copy
3180000
remote allocation
page read and write
16E3000
heap
page read and write
31E0000
heap
page read and write
1748000
heap
page read and write
4D0000
unkown
page readonly
16E3000
heap
page read and write
1753000
heap
page read and write
173E000
heap
page read and write
507000
unkown
page read and write
189E000
stack
page read and write
4D0000
unkown
page readonly
ACE000
heap
page read and write
4FB000
unkown
page readonly
174C000
heap
page read and write
506000
unkown
page write copy
142E000
stack
page read and write
34EE000
stack
page read and write
4D1000
unkown
page execute read
506000
unkown
page write copy
1470000
heap
page read and write
32ED000
stack
page read and write
50D000
unkown
page write copy
304C000
trusted library allocation
page read and write
93C000
stack
page read and write
50B000
unkown
page readonly
1490000
heap
page read and write
FBB000
stack
page read and write
3AAE000
stack
page read and write
1753000
heap
page read and write
3C5F000
stack
page read and write
108F000
stack
page read and write
3B50000
heap
page read and write
50D000
unkown
page write copy
4D1000
unkown
page execute read
14F5000
heap
page read and write
4D1000
unkown
page execute read
3AEE000
stack
page read and write
1310000
heap
page read and write
506000
unkown
page execute and read and write
4D0000
unkown
page readonly
16E7000
heap
page read and write
174C000
heap
page read and write
990000
heap
page read and write
16A8000
heap
page read and write
50D000
unkown
page write copy
9DE000
stack
page read and write
4D0000
unkown
page readonly
16CD000
heap
page read and write
1753000
heap
page read and write
50B000
unkown
page readonly
50B000
unkown
page readonly
14F0000
heap
page read and write
174C000
heap
page read and write
386E000
stack
page read and write
453000
remote allocation
page execute and read and write
272D000
stack
page read and write
28D0000
heap
page read and write
D8F000
stack
page read and write
16B8000
heap
page read and write
50B000
unkown
page readonly
14ED000
stack
page read and write
1750000
heap
page read and write
50D000
unkown
page write copy
317E000
stack
page read and write
50B000
unkown
page readonly
4FB000
unkown
page readonly
16BC000
heap
page read and write
15FF000
stack
page read and write
33EF000
stack
page read and write
4FB000
unkown
page readonly
4D1000
unkown
page execute read
A7D000
stack
page read and write
146E000
stack
page read and write
4D0000
unkown
page readonly
ACA000
heap
page read and write
50B000
unkown
page readonly
4D0000
unkown
page readonly
313E000
stack
page read and write
174E000
heap
page read and write
AC0000
heap
page read and write
3180000
remote allocation
page read and write
39AD000
stack
page read and write
50D000
unkown
page write copy
83C000
stack
page read and write
396F000
stack
page read and write
12FB000
stack
page read and write
1753000
heap
page read and write
16E6000
heap
page read and write
167E000
stack
page read and write
16A0000
heap
page read and write
4D1000
unkown
page execute read
50D000
unkown
page write copy
4FB000
unkown
page readonly
16BC000
heap
page read and write
There are 100 hidden memdumps, click here to show them.