IOC Report
WAdE7vk6kk.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\WAdE7vk6kk.exe
"C:\Users\user\Desktop\WAdE7vk6kk.exe"
 malicious

URLs

Name
IP
Malicious
https://curl.se/docs/hsts.html
unknown
https://curl.se/docs/alt-svc.html#
unknown
https://curl.se/docs/http-cookies.html#
unknown
https://curl.se/docs/alt-svc.html
unknown
https://curl.se/docs/http-cookies.html
unknown
https://curl.se/docs/hsts.html#
unknown

Domains

Name
IP
Malicious
helloitelemetry.cc
104.21.65.101

IPs

IP
Domain
Country
Malicious
127.0.0.1
unknown
unknown
104.21.65.101
helloitelemetry.cc
United States

Memdumps

Base Address
Regiontype
Protect
Malicious
8A1000
unkown
page execute read
F6E000
heap
page read and write
12DD000
stack
page read and write
1360000
heap
page read and write
131E000
stack
page read and write
125E000
stack
page read and write
DB0000
heap
page read and write
DC0000
heap
page read and write
980000
unkown
page write copy
F60000
heap
page read and write
F98000
heap
page read and write
156E000
stack
page read and write
E60000
heap
page read and write
E65000
heap
page read and write
F40000
heap
page read and write
146E000
stack
page read and write
8A0000
unkown
page readonly
129E000
stack
page read and write
E4E000
stack
page read and write
8A1000
unkown
page execute read
980000
unkown
page read and write
985000
unkown
page readonly
C5D000
stack
page read and write
166F000
stack
page read and write
E50000
remote allocation
page read and write
942000
unkown
page readonly
E0E000
stack
page read and write
E50000
remote allocation
page read and write
985000
unkown
page readonly
D5D000
stack
page read and write
942000
unkown
page readonly
8A0000
unkown
page readonly
E50000
remote allocation
page read and write
F6A000
heap
page read and write
115E000
stack
page read and write
F8D000
heap
page read and write
There are 26 hidden memdumps, click here to show them.