IOC Report
Payload.exe

loading gifProcessesURLsDomainsIPsRegistryMemdumps21020102Label

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Payload.exe
"C:\Users\user\Desktop\Payload.exe"
 malicious

URLs

Name
IP
Malicious
https://pastebin.com/raw/???
unknown

Domains

Name
IP
Malicious
size-ingredients.gl.at.ply.gg
147.185.221.27
 malicious

IPs

IP
Domain
Country
Malicious
147.185.221.27
size-ingredients.gl.at.ply.gg
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
 malicious
HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS
 malicious
HKEY_CURRENT_USER\SOFTWARE\a1cb840a8f8b330a9629751db128f43f
[kl]

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
352000
unkown
page readonly
 malicious
2A7D000
trusted library allocation
page read and write
360000
unkown
page readonly
8F0000
heap
page read and write
B5A000
trusted library allocation
page execute and read and write
4C7C000
stack
page read and write
B6A000
trusted library allocation
page execute and read and write
2BB1000
trusted library allocation
page read and write
B50000
trusted library allocation
page read and write
4D30000
unclassified section
page read and write
3FA000
stack
page read and write
BC0000
heap
page read and write
865000
heap
page read and write
4BF0000
heap
page read and write
4C3B000
stack
page read and write
860000
heap
page read and write
4CB9000
stack
page read and write
6F6000
stack
page read and write
B52000
trusted library allocation
page execute and read and write
4D20000
trusted library allocation
page execute and read and write
F60000
heap
page read and write
4B10000
trusted library allocation
page read and write
350000
unkown
page readonly
2A12000
trusted library allocation
page read and write
B8B000
trusted library allocation
page execute and read and write
49FE000
stack
page read and write
2A35000
trusted library allocation
page read and write
95E000
heap
page read and write
4B20000
trusted library allocation
page execute and read and write
8AE000
stack
page read and write
D0E000
stack
page read and write
B90000
heap
page read and write
B82000
trusted library allocation
page read and write
4BDD000
stack
page read and write
4B30000
trusted library allocation
page read and write
B7A000
trusted library allocation
page execute and read and write
4BE0000
trusted library allocation
page read and write
840000
heap
page read and write
4AFE000
stack
page read and write
8FE000
heap
page read and write
B87000
trusted library allocation
page execute and read and write
29C1000
trusted library allocation
page read and write
92F000
heap
page read and write
DC0000
heap
page read and write
D18000
trusted library allocation
page read and write
B3A000
trusted library allocation
page execute and read and write
AEE000
stack
page read and write
267F000
stack
page read and write
8F8000
heap
page read and write
760000
heap
page read and write
B5C000
trusted library allocation
page execute and read and write
B20000
trusted library allocation
page read and write
B32000
trusted library allocation
page execute and read and write
B40000
heap
page execute and read and write
B67000
trusted library allocation
page execute and read and write
2A59000
trusted library allocation
page read and write
39C1000
trusted library allocation
page read and write
B72000
trusted library allocation
page execute and read and write
There are 48 hidden memdumps, click here to show them.