IOC Report
file.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious

URLs

Name
IP
Malicious
http://62.204.41.159/
62.204.41.159
 malicious
http://62.204.41.159/edd20096ecef326d.php
62.204.41.159
 malicious
http://62.204.41.159
unknown
 malicious
http://62.204.41.159/c
unknown
http://62.204.41.159/edd20096ecef326d.phpl#
unknown
http://62.204.41.159/edd20096ecef326d.php(#
unknown
http://62.204.41.159/edd20096ecef326d.phpH#
unknown
http://62.204.41.159/edd20096ecef326d.php#
unknown
http://62.204.41.159/ows
unknown
http://62.204.41.159(
unknown
http://62.204.41.159/=
unknown
http://62.204.41.159/edd20096ecef326d.php=a
unknown
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
s-part-0032.t-0009.t-msedge.net
13.107.246.60
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
62.204.41.159
unknown
United Kingdom
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
1597000
heap
page read and write
 malicious
40C000
unkown
page read and write
 malicious
1B54F000
stack
page read and write
45B000
unkown
page readonly
1B2AC000
stack
page read and write
13D0000
heap
page read and write
1B550000
heap
page read and write
459000
unkown
page execute and read and write
FF0000
heap
page read and write
4E2000
remote allocation
page execute and read and write
12FD000
stack
page read and write
3E0000
unkown
page readonly
45B000
unkown
page readonly
FE0000
heap
page read and write
17EF000
stack
page read and write
123C000
stack
page read and write
402000
unkown
page readonly
14EE000
stack
page read and write
133E000
stack
page read and write
3E0000
unkown
page readonly
16EF000
stack
page read and write
140E000
stack
page read and write
1B1AD000
stack
page read and write
18F3000
heap
page read and write
15F3000
heap
page read and write
15D7000
heap
page read and write
13B0000
heap
page read and write
F6D000
stack
page read and write
14F0000
heap
page read and write
1B79E000
stack
page read and write
178E000
stack
page read and write
1B2ED000
stack
page read and write
1335000
stack
page read and write
45A000
unkown
page read and write
18EE000
stack
page read and write
188E000
stack
page read and write
65C000
remote allocation
page execute and read and write
1B3ED000
stack
page read and write
144E000
stack
page read and write
14FE000
heap
page read and write
18F0000
heap
page read and write
4B1000
remote allocation
page execute and read and write
64A000
remote allocation
page execute and read and write
402000
unkown
page readonly
1590000
heap
page read and write
13D5000
heap
page read and write
1B44E000
stack
page read and write
13A0000
heap
page read and write
40C000
unkown
page write copy
3E1000
unkown
page execute read
1B69D000
stack
page read and write
FD0000
heap
page read and write
1B16F000
stack
page read and write
1890000
heap
page read and write
3E1000
unkown
page execute read
4BD000
remote allocation
page execute and read and write
1870000
heap
page read and write
152E000
stack
page read and write
14FA000
heap
page read and write
There are 50 hidden memdumps, click here to show them.