IOC Report
AIO.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\AIO.exe
"C:\Users\user\Desktop\AIO.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

IPs

IP
Domain
Country
Malicious
185.25.204.244
unknown
Italy

Memdumps

Base Address
Regiontype
Protect
Malicious
2228A620000
heap
page read and write
2D0000
unkown
page readonly
47A000
unkown
page readonly
C000086000
direct allocation
page read and write
C000084000
direct allocation
page read and write
C00003F000
direct allocation
page read and write
C000090000
direct allocation
page read and write
C00001A000
direct allocation
page read and write
1A0000
unkown
page readonly
C0000E2000
direct allocation
page read and write
C000035000
direct allocation
page read and write
C000070000
direct allocation
page read and write
C000023000
direct allocation
page read and write
402000
unkown
page write copy
C00008A000
direct allocation
page read and write
9405BFE000
stack
page read and write
2228A870000
heap
page read and write
2228A420000
heap
page read and write
C000004000
direct allocation
page read and write
C000038000
direct allocation
page read and write
2228A820000
direct allocation
page read and write
9405DFE000
stack
page read and write
409000
unkown
page write copy
C0000BC000
direct allocation
page read and write
94063FF000
stack
page read and write
C00006C000
direct allocation
page read and write
C0000BA000
direct allocation
page read and write
C00001E000
direct allocation
page read and write
C000052000
direct allocation
page read and write
C0000C6000
direct allocation
page read and write
41C000
unkown
page read and write
2228A5A4000
direct allocation
page read and write
2D0000
unkown
page readonly
57C000
unkown
page write copy
2228A628000
heap
page read and write
407000
unkown
page write copy
C00002E000
direct allocation
page read and write
C00008E000
direct allocation
page read and write
C0000B2000
direct allocation
page read and write
C0000A2000
direct allocation
page read and write
4BE000
unkown
page readonly
4BE000
unkown
page readonly
C00000E000
direct allocation
page read and write
C000043000
direct allocation
page read and write
416000
unkown
page read and write
2228A840000
direct allocation
page read and write
569000
unkown
page readonly
C0000AE000
direct allocation
page read and write
C000094000
direct allocation
page read and write
417000
unkown
page write copy
222B0180000
direct allocation
page read and write
C000020000
direct allocation
page read and write
C00005E000
direct allocation
page read and write
2228A875000
heap
page read and write
C000018000
direct allocation
page read and write
2228A5A9000
direct allocation
page read and write
C0000DA000
direct allocation
page read and write
C0000C2000
direct allocation
page read and write
41B000
unkown
page write copy
C0000AC000
direct allocation
page read and write
2228A5A0000
direct allocation
page read and write
C00000C000
direct allocation
page read and write
C000006000
direct allocation
page read and write
474000
unkown
page read and write
1A0000
unkown
page readonly
222B0184000
direct allocation
page read and write
C000002000
direct allocation
page read and write
41A000
unkown
page read and write
C0000AA000
direct allocation
page read and write
C00005B000
direct allocation
page read and write
C000074000
direct allocation
page read and write
2228A430000
direct allocation
page read and write
94059FD000
stack
page read and write
C00009C000
direct allocation
page read and write
2228A5AB000
direct allocation
page read and write
C0000C4000
direct allocation
page read and write
C00003A000
direct allocation
page read and write
C0000B8000
direct allocation
page read and write
2228A580000
heap
page read and write
C000088000
direct allocation
page read and write
94065FF000
stack
page read and write
C000098000
direct allocation
page read and write
9405FFF000
stack
page read and write
44D000
unkown
page read and write
569000
unkown
page readonly
2228A560000
heap
page read and write
1A1000
unkown
page execute read
C0000D8000
direct allocation
page read and write
C0000BE000
direct allocation
page read and write
1A1000
unkown
page execute read
2228A824000
direct allocation
page read and write
57C000
unkown
page write copy
C000016000
direct allocation
page read and write
47A000
unkown
page readonly
C0000CC000
direct allocation
page read and write
C00004E000
direct allocation
page read and write
57D000
unkown
page readonly
402000
unkown
page read and write
C000010000
direct allocation
page read and write
C000033000
direct allocation
page read and write
408000
unkown
page read and write