Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Arba Outstanding Statement.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.035150501409864
Filename:	Arba Outstanding Statement.exe
Filesize:	1219584
MD5:	de2adabbce0147d01ae2fc5d80e9efbd
SHA1:	5c499b18b0a6059a8266c14c2a7db79ef1511637
SHA256:	c6a9cf5bccffab4f117d72117c58d725d779ed907d449426eb93a86956d33947
SHA512:	1e13c6b64043253af3be935e7bc83934a2ec47b9a48a184e0d3d0b76e4881d1630b3c7090a408eebc9a5c2fb7fd4d7e985e565f40c99813dca2e57fa50d3124c
SSDEEP:	24576:JAHnh+eWsN3skA4RV1Hom2KXMmHa1DIx+YJbBHtT95:Qh+ZkldoPK8Ya1kxxJrb
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection	Application Window Discovery
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Valid Accounts Access Token Manipulation
Contains functionality to launch a process as a different user	System Summary
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found evasive API chain (date check)	Malware Analysis System Evasion	Native API
Found large amount of non-executed APIs	Malware Analysis System Evasion
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	System Shutdown/Reboot
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sample file is different than original file name gathered from version info	System Summary	System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
Contains functionality for error logging	System Summary
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary
Contains functionality to check free disk space	System Summary	System Information Discovery
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection
Contains functionality to query windows version	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Discovery
Might use command line arguments	System Summary
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\Idonna

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Idonna
Category:	dropped
Dump:	Idonna.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Users\user\Desktop\Arba Outstanding Statement.exe
Type:	data
Entropy:	7.867975334001988
Encrypted:	false
Ssdeep:	6144:eA3B4jPohevB+3xdUOEdJAH6N5uEsXL91FO+5klmaeMeA0:eIBgoh6shdUOmUWuEmPklmBMa
Size:	268288
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\aut8131.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut8131.tmp
Category:	dropped
Dump:	aut8131.tmp.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\Desktop\Arba Outstanding Statement.exe
Type:	data
Entropy:	7.975070531448954
Encrypted:	false
Ssdeep:	6144:AOr4KCILpsc3cxYjiWlriGMNyDRs/MSmvnICcouy3ewOlp:jrjbLpDjiozMwD6j9i347
Size:	266358
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\aut8181.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut8181.tmp
Category:	dropped
Dump:	aut8181.tmp.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Users\user\Desktop\Arba Outstanding Statement.exe
Type:	data
Entropy:	7.601903049612647
Encrypted:	false
Ssdeep:	192:1DyaFcKXZG02JtX5WK0nYoa4qyedmysGOSk0qNY/50gOQUblxLr7LJtb/Ed:3F7XZGRJtX5OYnnyedmVGAdY50gUBxXG
Size:	9848
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\reaffection

ASCII text, with very long lines (28708), with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\reaffection
Category:	dropped
Dump:	reaffection.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Users\user\Desktop\Arba Outstanding Statement.exe
Type:	ASCII text, with very long lines (28708), with no line terminators
Entropy:	3.592282537092259
Encrypted:	false
Ssdeep:	768:ciTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbiE+Ik6Ng4vfF3if6gyB:ciTZ+2QoioGRk6ZklputwjpjBkCiw2RP
Size:	28708
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Arba Outstanding Statement.exe

"C:\Users\user\Desktop\Arba Outstanding Statement.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7004
Target ID:	1
Parent PID:	4004
Name:	Arba Outstanding Statement.exe
Path:	C:\Users\user\Desktop\Arba Outstanding Statement.exe
Commandline:	"C:\Users\user\Desktop\Arba Outstanding Statement.exe"
Size:	1219584
MD5:	DE2ADABBCE0147D01AE2FC5D80E9EFBD
Time:	22:35:03
Date:	18/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x30000
Modulesize:	1245184
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\Arba Outstanding Statement.exe"

Details

Is windows:	true
Is dropped:	false
PID:	3620
Target ID:	2
Parent PID:	7004
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\Arba Outstanding Statement.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	22:35:04
Date:	18/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xba0000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected PureLog Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

URLs

Name

Malicious

https://api.ipify.org/

104.26.12.205

Details

Name:	https://api.ipify.org/
IP:	104.26.12.205
TargetID:	2
From Memory:	false
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

https://api.ipify.org

unknown

Details

Name:	https://api.ipify.org
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3370341203.0000000005530000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3370537578.00000000055F0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3368046380.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3368520343.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3369690584.00000000041B1000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://sectigo.com/CPS

unknown

http://kino2.top

unknown

https://sectigo.com/CPS0

unknown

Details

Name:	https://sectigo.com/CPS0
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3368520343.0000000003237000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3370861371.00000000057EE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3366951698.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3366951698.0000000001188000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3370341203.0000000005530000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3370537578.00000000055F0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3368046380.0000000002CDF000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3369690584.00000000041B1000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://api.ipify.org/t

unknown

Details

Name:	https://api.ipify.org/t
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3368520343.00000000031B1000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.3368520343.00000000031B1000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://mail.kino2.top

unknown

Domains

Name

Malicious

mail.kino2.top

unknown

api.ipify.org

104.26.12.205

Details

Name:	api.ipify.org
IP:	104.26.12.205
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

kino2.top

185.244.151.84

Details

Name:	kino2.top
IP:	185.244.151.84
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

104.26.12.205

api.ipify.org

United States

Details

IP:	104.26.12.205
TargetID:	2
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	api.ipify.org

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

185.244.151.84

kino2.top

Netherlands

Details

IP:	185.244.151.84
TargetID:	2
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	60117
ASN name:	HSAE
Private:	false
Domain:	kino2.top

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

5530000

trusted library section

page read and write

D90000

direct allocation

page read and write

55F0000

trusted library section

page read and write

3237000

trusted library allocation

page read and write

400000

system

page execute and read and write

322F000

trusted library allocation

page read and write

2CDF000

heap

page read and write

3204000

trusted library allocation

page read and write

41B1000

trusted library allocation

page read and write

3200000

trusted library allocation

page read and write

2C36000

trusted library allocation

page execute and read and write

54F0000

trusted library allocation

page read and write

38D9000

direct allocation

page read and write

37B0000

direct allocation

page read and write

6A5E000

stack

page read and write

3610000

direct allocation

page read and write

394E000

direct allocation

page read and write

2C45000

trusted library allocation

page execute and read and write

5A7C000

stack

page read and write

E5000

unkown

page readonly

65A000

stack

page read and write

31000

unkown

page execute read

2C40000

trusted library allocation

page read and write

E7B000

heap

page read and write

2EB3000

heap

page read and write

64DE000

stack

page read and write

37B0000

direct allocation

page read and write

AB0000

heap

page read and write

EE5000

heap

page read and write

6AB0000

trusted library allocation

page read and write

38DD000

direct allocation

page read and write

FB0000

heap

page read and write

38D9000

direct allocation

page read and write

5590000

trusted library allocation

page read and write

FD7000

heap

page read and write

6F90000

heap

page read and write

3610000

direct allocation

page read and write

394E000

direct allocation

page read and write

1110000

heap

page read and write

38DD000

direct allocation

page read and write

3610000

direct allocation

page read and write

550E000

trusted library allocation

page read and write

2C2D000

trusted library allocation

page execute and read and write

E5000

unkown

page readonly

3010000

trusted library allocation

page read and write

6AFE000

stack

page read and write

EE5000

heap

page read and write

3050000

heap

page read and write

A3B000

stack

page read and write

5BBE000

stack

page read and write

D40000

direct allocation

page execute and read and write

FE5000

heap

page read and write

6A80000

trusted library allocation

page read and write

42AF000

trusted library allocation

page read and write

E80000

heap

page read and write

E48000

heap

page read and write

3733000

direct allocation

page read and write

31000

unkown

page execute read

EDB000

heap

page read and write

31A0000

heap

page execute and read and write

54F6000

trusted library allocation

page read and write

EE5000

heap

page read and write

2C3A000

trusted library allocation

page execute and read and write

7F270000

trusted library allocation

page execute and read and write

F8000

unkown

page readonly

2C20000

trusted library allocation

page read and write

2C1D000

trusted library allocation

page execute and read and write

54FE000

trusted library allocation

page read and write

550A000

trusted library allocation

page read and write

3610000

direct allocation

page read and write

FD8000

heap

page read and write

F3000

unkown

page write copy

BF000

unkown

page readonly

E74000

heap

page read and write

5858000

heap

page read and write

F8000

unkown

page readonly

1134000

heap

page read and write

31EA000

trusted library allocation

page read and write

394E000

direct allocation

page read and write

FB8000

heap

page read and write

2DC8000

trusted library allocation

page read and write

38D9000

direct allocation

page read and write

2FD0000

heap

page read and write

38D9000

direct allocation

page read and write

5BFE000

stack

page read and write

5861000

heap

page read and write

5CFE000

stack

page read and write

F05000

heap

page read and write

2CAE000

stack

page read and write

E72000

heap

page read and write

6B8F000

stack

page read and write

EE5000

heap

page read and write

FF7000

heap

page read and write

5502000

trusted library allocation

page read and write

5780000

heap

page read and write

394E000

direct allocation

page read and write

5880000

heap

page read and write

57EE000

heap

page read and write

5511000

trusted library allocation

page read and write

FC8000

heap

page read and write

5DC0000

heap

page read and write

6BD7000

trusted library allocation

page read and write

EE5000

heap

page read and write

2C23000

trusted library allocation

page read and write

38DD000

direct allocation

page read and write

7260000

heap

page read and write

322B000

trusted library allocation

page read and write

3020000

trusted library allocation

page read and write

322D000

trusted library allocation

page read and write

5E1D000

stack

page read and write

6BD0000

trusted library allocation

page read and write

582F000

heap

page read and write

FB8000

heap

page read and write

C60000

heap

page read and write

E7B000

heap

page read and write

111C000

heap

page read and write

37B0000

direct allocation

page read and write

5ABE000

stack

page read and write

FF7000

heap

page read and write

BCE000

stack

page read and write

EE5000

heap

page read and write

2BE0000

trusted library section

page read and write

2C60000

trusted library allocation

page read and write

695E000

stack

page read and write

10D0000

heap

page read and write

38DD000

direct allocation

page read and write

3733000

direct allocation

page read and write

2C14000

trusted library allocation

page read and write

578A000

heap

page read and write

319E000

stack

page read and write

3733000

direct allocation

page read and write

A5C000

stack

page read and write

E40000

heap

page read and write

163F000

stack

page read and write

54FB000

trusted library allocation

page read and write

FE8000

heap

page read and write

3610000

direct allocation

page read and write

6A94000

trusted library allocation

page read and write

55EC000

stack

page read and write

31000

unkown

page execute read

5784000

heap

page read and write

FD8000

heap

page read and write

3733000

direct allocation

page read and write

578E000

heap

page read and write

BF000

unkown

page readonly

2CB7000

heap

page read and write

2C4B000

trusted library allocation

page execute and read and write

5890000

heap

page read and write

A1F000

stack

page read and write

1119000

heap

page read and write

2C10000

trusted library allocation

page read and write

31B1000

trusted library allocation

page read and write

D80000

heap

page read and write

C40000

heap

page read and write

426000

system

page execute and read and write

FC9000

heap

page read and write

3733000

direct allocation

page read and write

FB5000

heap

page read and write

10E8000

heap

page read and write

37B0000

direct allocation

page read and write

57E3000

heap

page read and write

1139000

heap

page read and write

2C42000

trusted library allocation

page read and write

31DE000

stack

page read and write

EF000

unkown

page read and write

30000

unkown

page readonly

394E000

direct allocation

page read and write

A2E000

stack

page read and write

38D9000

direct allocation

page read and write

3610000

direct allocation

page read and write

2BF0000

trusted library section

page read and write

C50000

heap

page read and write

394E000

direct allocation

page read and write

5516000

trusted library allocation

page read and write

6A88000

trusted library allocation

page read and write

57A0000

heap

page read and write

37B0000

direct allocation

page read and write

5D3D000

stack

page read and write

EE6000

heap

page read and write

2C30000

trusted library allocation

page read and write

5670000

heap

page execute and read and write

BD0000

heap

page read and write

38DD000

direct allocation

page read and write

2C32000

trusted library allocation

page read and write

691F000

stack

page read and write

1188000

heap

page read and write

FD7000

heap

page read and write

2C13000

trusted library allocation

page execute and read and write

551D000

trusted library allocation

page read and write

EF000

unkown

page write copy

E3A000

stack

page read and write

2FC0000

trusted library allocation

page read and write

2C47000

trusted library allocation

page execute and read and write

FC8000

heap

page read and write

37B0000

direct allocation

page read and write

2E9C000

stack

page read and write

31F3000

trusted library allocation

page read and write

2FE0000

heap

page read and write

2EB0000

heap

page read and write

6A90000

trusted library allocation

page read and write

2AD0000

heap

page read and write

5808000

heap

page read and write

38D9000

direct allocation

page read and write

6AA0000

trusted library allocation

page execute and read and write

6F60000

trusted library allocation

page read and write

315E000

stack

page read and write

445000

system

page execute and read and write

E80000

heap

page read and write

5DD0000

trusted library allocation

page execute and read and write

5660000

trusted library allocation

page read and write

10E0000

heap

page read and write

E80000

heap

page read and write

3030000

trusted library allocation

page read and write

2FBE000

stack

page read and write

577E000

stack

page read and write

CAE000

stack

page read and write

30000

unkown

page readonly

32E8000

trusted library allocation

page read and write

FE8000

heap

page read and write

566D000

trusted library allocation

page read and write

F38000

stack

page read and write

C44000

heap

page read and write

EE5000

heap

page read and write

2CB0000

heap

page read and write

6F50000

trusted library allocation

page execute and read and write

6BE0000

trusted library allocation

page read and write

2C00000

trusted library allocation

page read and write

FA0000

heap

page read and write

E58000

heap

page read and write

2EA0000

trusted library allocation

page execute and read and write

EC0000

heap

page read and write

3733000

direct allocation

page read and write

4273000

trusted library allocation

page read and write

3243000

trusted library allocation

page read and write

38DD000

direct allocation

page read and write

There are 225 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Arba Outstanding Statement.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportArba Outstanding Statement.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
Arba Outstanding Statement.exe