IOC Report

loading gif

Files

File Path
Type
Category
Malicious
REVGKXx6Ns.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\Temp\~DF6497174BCC55AD21.TMP
Unknown
dropped
clean

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\REVGKXx6Ns.exe
"C:\Users\user\Desktop\REVGKXx6Ns.exe"
malicious

URLs

Name
IP
Malicious
http://topqualityfreeware.com
unknown
clean
http://www.topqualityfreeware.com/
unknown
clean

Memdumps

Base Address
Regiontype
Protect
Malicious
2180000
unkown
page execute and read and write
malicious
23417C02000
unkown
page read and write
clean
7FF50F6CA000
unkown image
page readonly
clean
23418250000
unkown image
page readonly
clean
23417C4E000
unkown
page read and write
clean
1941C392000
unkown
page read and write
clean
1941C395000
unkown
page read and write
clean
23418402000
unkown
page read and write
clean
1941C963000
unkown
page read and write
clean
1941C39D000
unkown
page read and write
clean
7FF50F6C4000
unkown image
page readonly
clean
7FFD0000
unkown image
page readonly
clean
7FF54E2BB000
unkown image
page readonly
clean
1941BA78000
unkown
page read and write
clean
1941BB13000
unkown
page read and write
clean
620000
unkown
page read and write
clean
23417BE0000
unkown image
page readonly
clean
7FF569BAD000
unkown image
page readonly
clean
7FF54E38F000
unkown image
page readonly
clean
27A160FE000
unkown
page read and write
clean
23417C4A000
unkown
page read and write
clean
7FF50F4C1000
unkown image
page readonly
clean
1941BA4B000
unkown
page read and write
clean
7DF57F4E0000
unkown image
page readonly
clean
1CDAF04B000
unkown
page read and write
clean
7FF5A854E000
unkown image
page readonly
clean
7FF4FD697000
unkown image
page readonly
clean
4BDF000
stack
page read and write
clean
7DF5BD680000
unkown image
page readonly
clean
1CDAF802000
unkown
page read and write
clean
CBA7DCF000
stack
page read and write
clean
1CDAF108000
unkown
page read and write
clean
7FF54DF86000
unkown image
page readonly
clean
7FF54DC0D000
unkown image
page readonly
clean
7DF57F4E0000
unkown image
page readonly
clean
4B0000
unkown image
page readonly
clean
1941BA70000
unkown
page read and write
clean
21C0000
heap private
page read and write
clean
7FF54E40A000
unkown image
page readonly
clean
CBA817F000
stack
page read and write
clean
CBA80FE000
stack
page read and write
clean
1EE68FB000
stack
page read and write
clean
1A0000
unkown image
page readonly
clean
7DF5BD660000
unkown image
page readonly
clean
7FF50F659000
unkown image
page readonly
clean
7FF4FD5D3000
unkown image
page readonly
clean
1941C39F000
unkown
page read and write
clean
7FFC2000
unkown image
page readonly
clean
7FF56A3DD000
unkown image
page readonly
clean
334000
unkown
page read and write
clean
7FF4FD6F9000
unkown image
page readonly
clean
7FF4FD6DF000
unkown image
page readonly
clean
7FF54E3C0000
unkown image
page readonly
clean
7FF54E439000
unkown image
page readonly
clean
7DF512802000
unkown image
page readonly
clean
7FEB0000
unkown image
page readonly
clean
1941C3A7000
unkown
page read and write
clean
7DF563532000
unkown image
page readonly
clean
1941B870000
unkown image
page readonly
clean
1941C963000
unkown
page read and write
clean
1941B850000
unkown image
page read and write
clean
A79007F000
stack
page read and write
clean
23417ED0000
unkown image
page readonly
clean
1941C39F000
unkown
page read and write
clean
4D1F000
stack
page read and write
clean
2AC8177000
stack
page read and write
clean
1CDAEF80000
unkown image
page readonly
clean
4C0000
unkown
page read and write
clean
23417B70000
heap private
page read and write
clean
7DF57F4E2000
unkown image
page readonly
clean
426000
unkown image
page readonly
clean
1941B860000
heap private
page read and write