IOC Report
wnGDKyXdAo

loading gif

Files

File Path
Type
Category
Malicious
wnGDKyXdAo.exe
PE32+ executable (console) x86-64, for MS Windows
initial sample
 malicious
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\wnGDKyXdAo.exe
"C:\Users\user\Desktop\wnGDKyXdAo.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://http://Mozilla/5.0
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
9AB0DFF000
stack
page read and write
7FF6B9C81000
unkown
page execute read
7FF6B9C81000
unkown
page execute read
264FF86A000
heap
page read and write
264FF770000
heap
page read and write
264FF840000
heap
page read and write
264FF790000
heap
page read and write
264FF7A0000
heap
page read and write
264FF88F000
heap
page read and write
264FF860000
heap
page read and write
264FF907000
heap
page read and write
264FF84C000
heap
page read and write
264FF89E000
heap
page read and write
7FF6B9D1A000
unkown
page readonly
7FF6B9D13000
unkown
page read and write
7FF6B9CF1000
unkown
page readonly
264FFCD0000
heap
page read and write
264FF88C000
heap
page read and write
7FF6B9C80000
unkown
page readonly
264FFCD1000
heap
page read and write
7FF6B9D13000
unkown
page write copy
264FFD6D000
heap
page read and write
264FF880000
heap
page read and write
7FF6B9D1A000
unkown
page readonly
264FF690000
heap
page read and write
264FF87C000
heap
page read and write
7FF6B9C80000
unkown
page readonly
264FF906000
heap
page read and write
264FF89C000
heap
page read and write
9AB0CFE000
stack
page read and write
9AB091C000
stack
page read and write
7FF6B9CF1000
unkown
page readonly
There are 22 hidden memdumps, click here to show them.