Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

rBhzchsT4L.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rBhzchsT4L.exe.log

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp2F09.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmp2F29.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmp2F2A.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmp2F3B.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmp2F4B.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmp2F4C.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmp2F5D.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmp5BE7.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp5BE8.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp5BF9.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp5BFA.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp5BFB.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp5C0B.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp68AE.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp68AF.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp68C0.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp68D0.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp68D1.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp68D2.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp68E3.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp68F3.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp6904.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp6915.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpA1E9.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpA1EA.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpA1FA.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpA22A.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpA23B.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpA24B.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpBA6A.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpBA6B.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpBA7C.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpBA8C.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpBA8D.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpBA9E.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpBAAF.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmpDAB2.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpDAC2.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpDAD3.tmp

SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpDAE4.tmp

dropped

C:\Users\user\AppData\Local\Temp\tmpF4EA.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmpF4FB.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmpF53A.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

C:\Users\user\AppData\Local\Temp\tmpF54B.tmp

SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6

dropped

There are 36 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\rBhzchsT4L.exe

"C:\Users\user\Desktop\rBhzchsT4L.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7652
Target ID:	0
Parent PID:	3964
Name:	rBhzchsT4L.exe
Path:	C:\Users\user\Desktop\rBhzchsT4L.exe
Commandline:	"C:\Users\user\Desktop\rBhzchsT4L.exe"
Size:	97796
MD5:	D61A140FE054B706B617BDD7E04D1D90
Time:	09:57:10
Date:	14/03/2025
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xe90000
Modulesize:	122880
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	7660
Target ID:	1
Parent PID:	7652
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	09:57:10
Date:	14/03/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff62fc20000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://209.38.151.4:55123/

209.38.151.4

209.38.151.4:55123

https://ipinfo.io/ip%appdata%

unknown

http://209.38.151.4:55123

unknown

https://duckduckgo.com/ac/?q=

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous

unknown

http://tempuri.org/Endpoint/CheckConnectResponse

unknown

http://schemas.datacontract.org/2004/07/

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX

unknown

http://tempuri.org/Endpoint/EnvironmentSettings

unknown

https://api.ip.sb/geoip%USERPEnvironmentROFILE%

unknown

https://api.ip.sb/geoip

104.26.12.31

http://schemas.xmlsoap.org/soap/envelope/

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

https://ac.ecosia.org?q=

unknown

http://tempuri.org/

unknown

http://tempuri.org/Endpoint/CheckConnect

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

http://tempuri.org/Endpoint/VerifyUpdateResponse

unknown

http://tempuri.org/Endpoint/SetEnvironment

unknown

http://tempuri.org/Endpoint/SetEnvironmentResponse

unknown

http://tempuri.org/Endpoint/GetUpdates

unknown

https://www.google.com/images/branding/product/ico/googleg_alldp.ico

unknown

https://www.ecosia.org/newtab/v20

unknown

https://api.ipify.orgcookies//settinString.Removeg

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

https://duckduckgo.com/chrome_newtabv20

unknown

http://tempuri.org/Endpoint/GetUpdatesResponse

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

http://tempuri.org/Endpoint/EnvironmentSettingsResponse

unknown

http://tempuri.org/Endpoint/VerifyUpdate

unknown

http://tempuri.org/0

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

https://gemini.google.com/app?q=

unknown

http://schemas.xmlsoap.org/soap/actor/next

unknown

There are 26 hidden URLs, click here to show them.

Domains

Name

Malicious

api.ip.sb.cdn.cloudflare.net

104.26.12.31

api.ip.sb

unknown

Details

Name:	api.ip.sb
TargetID:	-1
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

209.38.151.4

unknown

United States

Details

IP:	209.38.151.4
TargetID:	0
Current Path:	C:\Users\user\Desktop\rBhzchsT4L.exe
Country:	United States
Countrycode:	USA
ASN number:	7018
ASN name:	ATT-INTERNET4US
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
HTTP GET or POST without a user agent	Networking
Connects to IPs without corresponding DNS lookups	Networking
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

104.26.12.31

api.ip.sb.cdn.cloudflare.net

United States

Details

IP:	104.26.12.31
TargetID:	0
Current Path:	C:\Users\user\Desktop\rBhzchsT4L.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	api.ip.sb.cdn.cloudflare.net

Signature Hits	Behavior Group	Mitre Attack
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rBhzchsT4L_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

E92000

unkown

page readonly

1407000

heap

page read and write

4261000

trusted library allocation

page read and write

32B0000

trusted library allocation

page read and write

5D70000

trusted library allocation

page read and write

69E2000

heap

page read and write

18A0000

heap

page read and write

6B0E000

stack

page read and write

7380000

trusted library allocation

page read and write

69A0000

heap

page read and write

714C000

trusted library allocation

page read and write

7CEA000

heap

page read and write

70FE000

stack

page read and write

17C2000

trusted library allocation

page read and write

7450000

trusted library allocation

page read and write

131E000

heap

page read and write

44C7000

trusted library allocation

page read and write

3707000

trusted library allocation

page read and write

71D0000

trusted library allocation

page read and write

7390000

trusted library allocation

page read and write

7146000

trusted library allocation

page read and write

6AB2000

trusted library allocation

page read and write

5B20000

trusted library allocation

page read and write

5AB0000

trusted library allocation

page read and write

5AD0000

trusted library allocation

page read and write

43BB000

trusted library allocation

page read and write

689F000

stack

page read and write

719F000

trusted library allocation

page read and write

74B0000

trusted library allocation

page execute and read and write

5710000

heap

page execute and read and write

6C65000

trusted library allocation

page read and write

43AB000

trusted library allocation

page read and write

604E000

stack

page read and write

17C5000

trusted library allocation

page execute and read and write

1790000

trusted library allocation

page read and write

679F000

stack

page read and write

43D0000

trusted library allocation

page read and write

7168000

trusted library allocation

page read and write

74C0000

trusted library allocation

page read and write

6CDD000

stack

page read and write

3134000

trusted library allocation

page read and write

6AB0000

trusted library allocation

page read and write

1793000

trusted library allocation

page execute and read and write

4272000

trusted library allocation

page read and write

591E000

stack

page read and write

7DE1000

heap

page read and write

1344000

heap

page read and write

6C38000

trusted library allocation

page read and write

71C0000

trusted library allocation

page read and write

1318000

heap

page read and write

7B80000

heap

page read and write

17E0000

trusted library allocation

page read and write

7161000

trusted library allocation

page read and write

7CE6000

heap

page read and write

71E0000

trusted library allocation

page read and write

17C7000

trusted library allocation

page execute and read and write

5D7B000

trusted library allocation

page read and write

FD0000

heap

page read and write

6C29000

trusted library allocation

page read and write

85D8000

heap

page read and write

88BE000

stack

page read and write

87BE000

stack

page read and write

6C22000

trusted library allocation

page read and write

7F100000

trusted library allocation

page execute and read and write

F3B000

stack

page read and write

5B10000

trusted library allocation

page read and write

5D7E000

trusted library allocation

page read and write

5B30000

trusted library allocation

page execute and read and write

3250000

heap

page execute and read and write

85C1000

heap

page read and write

7480000

trusted library allocation

page read and write

7166000

trusted library allocation

page read and write

3050000

trusted library allocation

page read and write

5BB0000

trusted library allocation

page read and write

5A8E000

trusted library allocation

page read and write

85DE000

heap

page read and write

7158000

trusted library allocation

page read and write

1880000

trusted library allocation

page read and write

43C7000

trusted library allocation

page read and write

56F0000

trusted library allocation

page read and write

3130000

trusted library allocation

page read and write

32E0000

trusted library allocation

page read and write

7B1D000

stack

page read and write

17CB000

trusted library allocation

page execute and read and write

6A89000

heap

page read and write

1495000

heap

page read and write

7DE3000

heap

page read and write

5BAD000

trusted library allocation

page read and write

1870000

trusted library allocation

page execute and read and write

859E000

heap

page read and write

335D000

trusted library allocation

page read and write

43B4000

trusted library allocation

page read and write

3058000

trusted library allocation

page read and write

6C20000

trusted library allocation

page read and write

600D000

stack

page read and write

4398000

trusted library allocation

page read and write

5BC0000

trusted library allocation

page read and write

69A8000

heap

page read and write

71E6000

trusted library allocation

page read and write

56E0000

trusted library allocation

page read and write

715E000

trusted library allocation

page read and write

5C5E000

stack

page read and write

7220000

trusted library allocation

page read and write

7230000

trusted library allocation

page read and write

8602000

heap

page read and write

32D7000

trusted library allocation

page read and write

5701000

trusted library allocation

page read and write

7144000

trusted library allocation

page read and write

7175000

trusted library allocation

page read and write

426D000

trusted library allocation

page read and write

714F000

trusted library allocation

page read and write

43FE000

trusted library allocation

page read and write

7300000

trusted library allocation

page execute and read and write

5AC0000

trusted library allocation

page read and write

5B90000

trusted library allocation

page read and write

6DE0000

heap

page read and write

5A82000

trusted library allocation

page read and write

324F000

stack

page read and write

6C1E000

stack

page read and write

1382000

heap

page read and write

6070000

trusted library allocation

page read and write

6C4A000

trusted library allocation

page read and write

7460000

trusted library allocation

page execute and read and write

7B5E000

stack

page read and write

7370000

trusted library allocation

page execute and read and write

7172000

trusted library allocation

page read and write

6C62000

trusted library allocation

page read and write

6D40000

trusted library allocation

page read and write

6D30000

trusted library allocation

page read and write

85FA000

heap

page read and write

1794000

trusted library allocation

page read and write

1780000

trusted library allocation

page read and write

5A76000

trusted library allocation

page read and write

7470000

trusted library allocation

page read and write

43C0000

trusted library allocation

page read and write

FB0000

heap

page read and write

17AD000

trusted library allocation

page execute and read and write

6A97000

heap

page read and write

6C25000

trusted library allocation

page read and write

7191000

trusted library allocation

page read and write

17C0000

trusted library allocation

page read and write

5B00000

trusted library allocation

page execute and read and write

5D6F000

stack

page read and write

17A0000

trusted library allocation

page read and write

74A0000

heap

page read and write

85F0000

heap

page read and write

32ED000

trusted library allocation

page read and write

6AC0000

trusted library allocation

page execute and read and write

358A000

trusted library allocation

page read and write

858C000

heap

page read and write

42B4000

trusted library allocation

page read and write

43AE000

trusted library allocation

page read and write

6D1E000

stack

page read and write

6A38000

heap

page read and write

5A71000

trusted library allocation

page read and write

144E000

stack

page read and write

43E3000

trusted library allocation

page read and write

85CE000

heap

page read and write

85C6000

heap

page read and write

72FB000

stack

page read and write

313A000

trusted library allocation

page read and write

85F7000

heap

page read and write

182E000

stack

page read and write

43CA000

trusted library allocation

page read and write

45DF000

trusted library allocation

page read and write

85BD000

heap

page read and write

6C50000

trusted library allocation

page read and write

43EE000

trusted library allocation

page read and write

43D7000

trusted library allocation

page read and write

1351000

heap

page read and write

18AB000

heap

page read and write

1890000

trusted library allocation

page read and write

36A1000

trusted library allocation

page read and write

7142000

trusted library allocation

page read and write

8616000

heap

page read and write

6C60000

trusted library allocation

page read and write

43DC000

trusted library allocation

page read and write

85D1000

heap

page read and write

7154000

trusted library allocation

page read and write

137D000

heap

page read and write

176F000

stack

page read and write

6C70000

trusted library allocation

page read and write

7490000

trusted library allocation

page execute and read and write

7BC0000

heap

page read and write

535D000

stack

page read and write

716D000

trusted library allocation

page read and write

7180000

trusted library allocation

page read and write

6A18000

heap

page read and write

5C60000

trusted library allocation

page execute and read and write

32F1000

trusted library allocation

page read and write

43A4000

trusted library allocation

page read and write

46DF000

trusted library allocation

page read and write

6A9C000

heap

page read and write

5A5E000

stack

page read and write

5A6B000

trusted library allocation

page read and write

1490000

heap

page read and write

85B7000

heap

page read and write

6C4F000

trusted library allocation

page read and write

17B2000

trusted library allocation

page read and write

699E000

stack

page read and write

7DE6000

heap

page read and write

6C54000

trusted library allocation

page read and write

581E000

stack

page read and write

312E000

stack

page read and write

56DE000

stack

page read and write

E90000

unkown

page readonly

179D000

trusted library allocation

page execute and read and write

6C3F000

trusted library allocation

page read and write

8585000

heap

page read and write

148E000

stack

page read and write

85A9000

heap

page read and write

7DD0000

heap

page read and write

17B6000

trusted library allocation

page execute and read and write

6C3A000

trusted library allocation

page read and write

3261000

trusted library allocation

page read and write

FA0000

heap

page read and write

6C45000

trusted library allocation

page read and write

5C1D000

stack

page read and write

17B0000

trusted library allocation

page read and write

6B10000

trusted library allocation

page execute and read and write

7CD0000

heap

page read and write

5BAA000

trusted library allocation

page read and write

1310000

heap

page read and write

12F7000

stack

page read and write

5A91000

trusted library allocation

page read and write

5BD0000

trusted library allocation

page execute and read and write

6D60000

trusted library allocation

page execute and read and write

71F0000

trusted library allocation

page read and write

186C000

stack

page read and write

5A60000

trusted library allocation

page read and write

73A0000

trusted library allocation

page execute and read and write

85E6000

heap

page read and write

7394000

trusted library allocation

page read and write

5B80000

trusted library allocation

page read and write

166E000

stack

page read and write

439F000

trusted library allocation

page read and write

595E000

stack

page read and write

70BE000

stack

page read and write

6DCE000

stack

page read and write

6A90000

heap

page read and write

7FCE000

stack

page read and write

FE0000

heap

page read and write

713E000

stack

page read and write

8580000

heap

page read and write

18A7000

heap

page read and write

3140000

heap

page read and write

There are 236 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
rBhzchsT4L.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportrBhzchsT4L.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
rBhzchsT4L.exe