IOC Report
xxx.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\xxx.exe
"C:\Users\user\Desktop\xxx.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://156.245.12.57:8000/999.html
156.245.12.57
http://156.245.12.57/
unknown
http://156.245.12.57:8000/999.html:
unknown
http://156.245.12.57:8000/999.html)
unknown
http://156.245.12.57/nes
unknown

IPs

IP
Domain
Country
Malicious
156.245.12.57
unknown
Seychelles

Memdumps

Base Address
Regiontype
Protect
Malicious
405000
unkown
page readonly
400000
unkown
page readonly
28CF000
stack
page read and write
80000
heap
page read and write
6F0000
heap
page read and write
401000
unkown
page execute read
762000
heap
page read and write
2ECF000
stack
page read and write
412000
unkown
page readonly
722000
heap
page read and write
9EE000
stack
page read and write
160000
heap
page read and write
6FC000
heap
page read and write
400000
unkown
page readonly
40D000
unkown
page readonly
412000
unkown
page readonly
77F000
heap
page read and write
2ACF000
stack
page read and write
405000
unkown
page readonly
61A000
stack
page read and write
1D0000
heap
page read and write
401000
unkown
page execute read
238E000
stack
page read and write
1D5000
heap
page read and write
6F6000
heap
page read and write
749000
heap
page read and write
2CCE000
stack
page read and write
180000
heap
page read and write
409000
unkown
page write copy
40D000
unkown
page readonly
30C8000
stack
page read and write
409000
unkown
page read and write
32CD000
stack
page read and write
702000
heap
page read and write
There are 24 hidden memdumps, click here to show them.