IOC Report
615

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\615.exe
"C:\Users\user\Desktop\615.exe"
 malicious

Domains

Name
IP
Malicious
boa.eimaragon.org
unknown
 malicious
winsec.warii.club
103.224.212.210

IPs

IP
Domain
Country
Malicious
103.224.212.210
winsec.warii.club
Australia

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\NetWire
HostId
 malicious
HKEY_CURRENT_USER\SOFTWARE\NetWire
Install Date
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
417000
unkown
page write copy
 malicious
417000
unkown
page read and write
 malicious
6DC000
heap
page read and write
9C000
stack
page read and write
41D000
unkown
page read and write
422000
unkown
page read and write
2E0F000
stack
page read and write
6D5000
heap
page read and write
424000
unkown
page readonly
400000
unkown
page readonly
690000
heap
page read and write
69E000
heap
page read and write
1D0000
heap
page read and write
320E000
stack
page read and write
401000
unkown
page execute read
424000
unkown
page readonly
6C9000
heap
page read and write
401000
unkown
page execute read
D0C000
stack
page read and write
423000
unkown
page write copy
5FC000
stack
page read and write
D20000
heap
page read and write
698000
heap
page read and write
6B8000
heap
page read and write
33C0000
heap
page read and write
1E0000
heap
page read and write
670000
heap
page read and write
C8E000
stack
page read and write
F0000
heap
page read and write
422000
unkown
page write copy
418000
unkown
page write copy
400000
unkown
page readonly
62D000
stack
page read and write
1E5000
heap
page read and write
There are 24 hidden memdumps, click here to show them.