IOC Report
xOg18pHQGOQK.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\xOg18pHQGOQK.exe
"C:\Users\user\Desktop\xOg18pHQGOQK.exe"
 malicious

URLs

Name
IP
Malicious
sendfiletiahforem.duckdns.org
malicious
http://go.microsoft.
unknown
http://go.microsoft.LinkId=42127
unknown

Domains

Name
IP
Malicious
sendfiletiahforem.duckdns.org
85.60.29.68
 malicious

IPs

IP
Domain
Country
Malicious
85.60.29.68
sendfiletiahforem.duckdns.org
Spain
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
HKEY_CURRENT_USER\SOFTWARE\1d3f999c897
[kl]

Memdumps

Base Address
Regiontype
Protect
Malicious
1D2000
unkown
page readonly
 malicious
AC2000
trusted library allocation
page execute and read and write
90F000
heap
page read and write
4A8C000
stack
page read and write
4ACC000
stack
page read and write
B4E000
stack
page read and write
5C0000
heap
page read and write
4B90000
unclassified section
page read and write
4A30000
trusted library allocation
page read and write
566000
stack
page read and write
90C000
heap
page read and write
4B10000
trusted library allocation
page read and write
2771000
trusted library allocation
page read and write
840000
heap
page execute and read and write
B80000
heap
page read and write
81F000
stack
page read and write
494E000
stack
page read and write
B07000
trusted library allocation
page execute and read and write
1D8000
unkown
page readonly
4B80000
trusted library allocation
page execute and read and write
242E000
stack
page read and write
4970000
trusted library allocation
page read and write
AFA000
trusted library allocation
page execute and read and write
8AE000
heap
page read and write
B60000
heap
page read and write
710000
heap
page read and write
715000
heap
page read and write
AD7000
trusted library allocation
page execute and read and write
860000
heap
page read and write
2774000
trusted library allocation
page read and write
8AA000
heap
page read and write
4980000
trusted library allocation
page execute and read and write
569000
stack
page read and write
AE0000
heap
page read and write
ACA000
trusted library allocation
page execute and read and write
8E0000
heap
page read and write
8A0000
heap
page read and write
469000
stack
page read and write
ABA000
trusted library allocation
page execute and read and write
850000
heap
page read and write
AC0000
trusted library allocation
page read and write
AB2000
trusted library allocation
page execute and read and write
AF2000
trusted library allocation
page execute and read and write
6EE000
stack
page read and write
4A40000
heap
page read and write
4778000
trusted library allocation
page read and write
ADA000
trusted library allocation
page execute and read and write
B0B000
trusted library allocation
page execute and read and write
3771000
trusted library allocation
page read and write
AA4000
trusted library allocation
page read and write
1D0000
unkown
page readonly
B02000
trusted library allocation
page read and write
4A2D000
stack
page read and write
AA0000
trusted library allocation
page read and write
484E000
stack
page read and write
6A0000
heap
page read and write
ACC000
trusted library allocation
page execute and read and write
29FB000
trusted library allocation
page read and write
27C1000
trusted library allocation
page read and write
4B09000
stack
page read and write
There are 50 hidden memdumps, click here to show them.