IOC Report
artifact.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\artifact.exe
"C:\Users\user\Desktop\artifact.exe"
 malicious

URLs

Name
IP
Malicious
http://101.78.63.44:None/UphQey
malicious
http://101.78.63.44/
unknown
 malicious
http://101.78.63.44/UphQey
malicious
http://101.78.63.44/UphQeyp
unknown
http://101.78.63.44/UphQeya
unknown
http://101.78.63.44/2
unknown

IPs

IP
Domain
Country
Malicious
101.78.63.44
unknown
China
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
1F0000
direct allocation
page execute read
 malicious
7D7000
heap
page read and write
78E000
stack
page read and write
2DBF000
stack
page read and write
401000
unkown
page execute read
805000
heap
page read and write
110000
heap
page read and write
730000
heap
page read and write
2B7F000
stack
page read and write
403000
unkown
page write copy
400000
unkown
page readonly
406000
unkown
page write copy
64E000
stack
page read and write
7AE000
heap
page read and write
7A0000
heap
page read and write
6FC000
stack
page read and write
6B0000
heap
page read and write
7F6000
heap
page read and write
69E000
stack
page read and write
404000
unkown
page readonly
401000
unkown
page execute read
E9D000
stack
page read and write
2DFE000
stack
page read and write
F0000
heap
page read and write
7AA000
heap
page read and write
304E000
stack
page read and write
60D000
stack
page read and write
100000
heap
page read and write
36DB000
stack
page read and write
404000
unkown
page readonly
115000
heap
page read and write
2BBE000
stack
page read and write
400000
unkown
page readonly
349E000
stack
page read and write
7ED000
heap
page read and write
2FFF000
stack
page read and write
34DE000
stack
page read and write
9D000
stack
page read and write
324F000
stack
page read and write
329E000
stack
page read and write
403000
unkown
page read and write
406000
unkown
page read and write
C9F000
stack
page read and write
A9F000
stack
page read and write
There are 34 hidden memdumps, click here to show them.