Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

bUh1IJVxyQ.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bUh1IJVxyQ.exe.log

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp218.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp219.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp229.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp22A.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp23B.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp23C.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp24C.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp25D.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp25E.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp27E.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp3A1A.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp3A1B.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp3A2B.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp3A3C.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp3A4D.tmp

SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp3A4E.tmp

dropped

C:\Users\user\AppData\Local\Temp\tmp90C9.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp90DA.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp90DB.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp90EB.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp90EC.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp90ED.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp90FE.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp910F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp9110.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp9120.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp9131.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp9132.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpA930.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpA931.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpA932.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpA943.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpA944.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpA954.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpA955.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpA966.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpC9A8.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpC9A9.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpC9BA.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpC9CA.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpC9CB.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpC9DC.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpC9FC.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpCA0D.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpCA0E.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpCA0F.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

There are 38 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\bUh1IJVxyQ.exe

"C:\Users\user\Desktop\bUh1IJVxyQ.exe"

Details

Is windows:	false
Is dropped:	false
PID:	3196
Target ID:	0
Parent PID:	2580
Name:	bUh1IJVxyQ.exe
Path:	C:\Users\user\Desktop\bUh1IJVxyQ.exe
Commandline:	"C:\Users\user\Desktop\bUh1IJVxyQ.exe"
Size:	98304
MD5:	3618D640F96E5D7858CD7FBD2D065DBE
Time:	02:06:49
Date:	29/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xa0000
Modulesize:	122880
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	6612
Target ID:	1
Parent PID:	3196
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	02:06:49
Date:	29/03/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://41.216.183.150:32356/

41.216.183.150

41.216.183.150:32356

https://ipinfo.io/ip%appdata%

unknown

https://duckduckgo.com/chrome_newtab

unknown

https://duckduckgo.com/ac/?q=

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous

unknown

http://tempuri.org/Endpoint/CheckConnectResponse

unknown

http://schemas.datacontract.org/2004/07/

unknown

http://tempuri.org/Endpoint/EnvironmentSettings

unknown

https://api.ip.sb/geoip%USERPEnvironmentROFILE%

unknown

https://api.ip.sb

unknown

https://api.ip.sb/geoip

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

http://41.216.183.150:

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://tempuri.org/

unknown

http://tempuri.org/P

unknown

http://41.216.183.150:32356

unknown

http://tempuri.org/Endpoint/CheckConnect

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

https://www.ecosia.org/newtab/

unknown

http://tempuri.org/Endpoint/VerifyUpdateResponse

unknown

http://tempuri.org/Endpoint/SetEnviron

unknown

http://tempuri.org/Endpoint/SetEnvironment

unknown

http://tempuri.org/Endpoint/SetEnvironmentResponse

unknown

http://tempuri.org/Endpoint/GetUpdates

unknown

https://ac.ecosia.org/autocomplete?q=

unknown

http://41.216.183.150:32356t-

unknown

https://api.ipify.orgcookies//settinString.Removeg

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/fault

unknown

http://tempuri.org/Endpoint/GetUpdatesResponse

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

http://tempuri.org/0(/x

unknown

http://tempuri.org/Endpoint/EnvironmentSettingsResponse

unknown

http://tempuri.org/Endpoint/VerifyUpdate

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

http://schemas.xmlsoap.org/soap/actor/next

unknown

There are 30 hidden URLs, click here to show them.

Domains

Name

Malicious

api.ip.sb

unknown

IPs

Domain

Country

Malicious

41.216.183.150

unknown

South Africa

Details

IP:	41.216.183.150
TargetID:	0
Current Path:	C:\Users\user\Desktop\bUh1IJVxyQ.exe
Country:	South Africa
Countrycode:	ZAF
ASN number:	40676
ASN name:	AS40676US
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
HTTP GET or POST without a user agent	Networking
Connects to IPs without corresponding DNS lookups	Networking
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bUh1IJVxyQ_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

A2000

unkown

page readonly

2580000

trusted library allocation

page read and write

5760000

trusted library allocation

page read and write

8144000

heap

page read and write

574B000

trusted library allocation

page read and write

49D1000

trusted library allocation

page read and write

8BB0000

heap

page read and write

8B10000

trusted library allocation

page execute and read and write

680000

trusted library allocation

page read and write

80F3000

heap

page read and write

49CE000

trusted library allocation

page read and write

1D5000

heap

page read and write

48D0000

trusted library allocation

page execute and read and write

683000

trusted library allocation

page execute and read and write

7FB0000

heap

page read and write

98E000

stack

page read and write

7690000

heap

page read and write

68D000

trusted library allocation

page execute and read and write

734000

heap

page read and write

49B0000

trusted library allocation

page read and write

24CD000

stack

page read and write

2330000

trusted library allocation

page read and write

4E10000

trusted library allocation

page read and write

4E50000

trusted library allocation

page read and write

77F000

heap

page read and write

7769000

heap

page read and write

4B80000

heap

page execute and read and write

4E05000

trusted library allocation

page read and write

4E54000

trusted library allocation

page read and write

9B0000

trusted library allocation

page read and write

5BE0000

trusted library allocation

page execute and read and write

7FD60000

trusted library allocation

page execute and read and write

490A000

trusted library allocation

page read and write

7640000

trusted library allocation

page read and write

490F000

trusted library allocation

page read and write

80BE000

heap

page read and write

4970000

trusted library allocation

page execute and read and write

2500000

trusted library allocation

page read and write

8490000

trusted library allocation

page execute and read and write

1D0000

heap

page read and write

49CA000

trusted library allocation

page read and write

5CEE000

stack

page read and write

5700000

trusted library allocation

page read and write

26BA000

trusted library allocation

page read and write

48EA000

trusted library allocation

page read and write

8410000

trusted library allocation

page read and write

49C4000

trusted library allocation

page read and write

57DD000

stack

page read and write

35A2000

trusted library allocation

page read and write

24F0000

trusted library allocation

page read and write

811D000

heap

page read and write

8129000

heap

page read and write

49BC000

trusted library allocation

page read and write

8DBE000

stack

page read and write

79CE000

stack

page read and write

48C0000

trusted library allocation

page read and write

50EE000

stack

page read and write

9BD1000

heap

page read and write

76BA000

heap

page read and write

4DE0000

trusted library allocation

page read and write

49B6000

trusted library allocation

page read and write

50A0000

heap

page read and write

29A2000

trusted library allocation

page read and write

4CCE000

stack

page read and write

4920000

trusted library allocation

page read and write

7ACE000

stack

page read and write

48F5000

trusted library allocation

page read and write

4DCE000

stack

page read and write

1C0000

heap

page read and write

82D0000

trusted library allocation

page read and write

48F0000

trusted library allocation

page read and write

4E32000

trusted library allocation

page read and write

4924000

trusted library allocation

page read and write

7D90000

trusted library allocation

page execute and read and write

80BB000

heap

page read and write

9A0000

trusted library allocation

page read and write

49F0000

trusted library allocation

page read and write

9A6000

trusted library allocation

page execute and read and write

4E0C000

trusted library allocation

page read and write

7784000

heap

page read and write

8ACD000

stack

page read and write

9BB000

trusted library allocation

page execute and read and write

88E000

stack

page read and write

2338000

trusted library allocation

page read and write

49B4000

trusted library allocation

page read and write

581D000

stack

page read and write

8B40000

trusted library allocation

page execute and read and write

230C000

stack

page read and write

A20000

heap

page read and write

25AA000

trusted library allocation

page read and write

740000

heap

page read and write

4908000

trusted library allocation

page read and write

7708000

heap

page read and write

25B2000

trusted library allocation

page read and write

4915000

trusted library allocation

page read and write

24D0000

heap

page read and write

670000

trusted library allocation

page read and write

56F0000

trusted library allocation

page read and write

5780000

trusted library allocation

page read and write

2510000

trusted library allocation

page read and write

80D1000

heap

page read and write

7D4E000

stack

page read and write

4930000

trusted library allocation

page read and write

49D6000

trusted library allocation

page read and write

22CE000

stack

page read and write

4F50000

heap

page read and write

4C8E000

stack

page read and write

76F4000

heap

page read and write

5770000

trusted library allocation

page read and write

585D000

stack

page read and write

29F1000

trusted library allocation

page read and write

3562000

trusted library allocation

page read and write

25BE000

trusted library allocation

page read and write

4B3E000

stack

page read and write

4E70000

trusted library allocation

page read and write

8480000

trusted library allocation

page read and write

788E000

stack

page read and write

3531000

trusted library allocation

page read and write

80E4000

heap

page read and write

8134000

heap

page read and write

82E0000

trusted library allocation

page read and write

491A000

trusted library allocation

page read and write

48AE000

stack

page read and write

5090000

trusted library allocation

page read and write

9BD7000

heap

page read and write

9B5000

trusted library allocation

page execute and read and write

5740000

trusted library allocation

page read and write

8340000

trusted library allocation

page read and write

684000

trusted library allocation

page read and write

4F20000

trusted library allocation

page read and write

49BE000

trusted library allocation

page read and write

25C2000

trusted library allocation

page read and write

8420000

trusted library allocation

page execute and read and write

49E5000

trusted library allocation

page read and write

4E3E000

trusted library allocation

page read and write

2520000

heap

page execute and read and write

814B000

heap

page read and write

8460000

trusted library allocation

page read and write

4E26000

trusted library allocation

page read and write

990000

trusted library allocation

page read and write

5BBE000

stack

page read and write

5790000

trusted library allocation

page execute and read and write

A26000

heap

page read and write

64E000

stack

page read and write

48F2000

trusted library allocation

page read and write

4E07000

trusted library allocation

page read and write

4DF0000

trusted library allocation

page read and write

5720000

trusted library allocation

page read and write

49FD000

trusted library allocation

page read and write

9BC0000

heap

page read and write

7C4E000

stack

page read and write

4A3E000

stack

page read and write

25B0000

trusted library allocation

page read and write

50A4000

heap

page read and write

586C000

trusted library allocation

page read and write

698000

heap

page read and write

49E2000

trusted library allocation

page read and write

798F000

stack

page read and write

5750000

trusted library allocation

page execute and read and write

7789000

heap

page read and write

80EA000

heap

page read and write

49DD000

trusted library allocation

page read and write

4F30000

trusted library allocation

page read and write

512D000

stack

page read and write

8450000

trusted library allocation

page read and write

1F0000

heap

page read and write

4F8000

stack

page read and write

7630000

trusted library allocation

page execute and read and write

26BE000

trusted library allocation

page read and write

5710000

trusted library allocation

page execute and read and write

7BCE000

stack

page read and write

6D1000

heap

page read and write

2320000

heap

page read and write

7738000

heap

page read and write

775D000

heap

page read and write

1B0000

heap

page read and write

4E00000

trusted library allocation

page read and write

2310000

trusted library allocation

page execute and read and write

5080000

heap

page read and write

6B7000

heap

page read and write

4E5A000

trusted library allocation

page read and write

4E1B000

trusted library allocation

page read and write

6C4000

heap

page read and write

99D000

trusted library allocation

page execute and read and write

3542000

trusted library allocation

page read and write

690000

heap

page read and write

69E000

heap

page read and write

9D0000

trusted library allocation

page read and write

48E0000

trusted library allocation

page read and write

7620000

trusted library allocation

page read and write

574E000

trusted library allocation

page read and write

80C1000

heap

page read and write

82F0000

trusted library allocation

page execute and read and write

4940000

trusted library allocation

page read and write

A1E000

stack

page read and write

778E000

heap

page read and write

2531000

trusted library allocation

page read and write

80B0000

heap

page read and write

9A2000

trusted library allocation

page read and write

5860000

trusted library allocation

page read and write

7610000

trusted library allocation

page read and write

14B000

stack

page read and write

3909000

trusted library allocation

page read and write

25A3000

trusted library allocation

page read and write

4B7E000

stack

page read and write

8100000

heap

page read and write

8470000

trusted library allocation

page execute and read and write

5730000

trusted library allocation

page read and write

7C0F000

stack

page read and write

810B000

heap

page read and write

4E41000

trusted library allocation

page read and write

A0000

unkown

page readonly

49C8000

trusted library allocation

page read and write

27DC000

trusted library allocation

page read and write

3682000

trusted library allocation

page read and write

3535000

trusted library allocation

page read and write

60D000

stack

page read and write

4E21000

trusted library allocation

page read and write

9B7000

trusted library allocation

page execute and read and write

8B0E000

stack

page read and write

49D8000

trusted library allocation

page read and write

48F9000

trusted library allocation

page read and write

833C000

stack

page read and write

9B2000

trusted library allocation

page read and write

491F000

trusted library allocation

page read and write

There are 215 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
bUh1IJVxyQ.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportbUh1IJVxyQ.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
bUh1IJVxyQ.exe