Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

PL_Proforma Invoice.xlsx

CDFV2 Encrypted

initial sample

Details

Filetype:	CDFV2 Encrypted
Entropy:	7.996721540452697
Filename:	PL_Proforma Invoice.xlsx
Filesize:	2516480
MD5:	07518e9ef3f985d592423d9c60c5c895
SHA1:	973721e65ade599942b6a166fedf17d0ccc7feb6
SHA256:	16ccda8530923cd7a4c92d8f2cfbb89c99c476c928e5af6e8248374e24a09f60
SHA512:	e69524a4826f3b9d0ee1d6fc912b581a3b6e4726673fd0862ced88fae6d7a6982972b14b679ac1c908712c79db3253ce71ab84244645843efcfd8670d2292a62
SSDEEP:	49152:zg74FxUyP7FRn1ALaMbX8DZzXKk97Cj1ePMniwInYear39OV:s7g7r1Av8dGgOZePRYlr3m
Preview:	........................>...................'...................................................................................\|.......~...............z.......\|.......~...............z.......\|.......~...............z.......\|..............................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection,
Document misses a certain OLE stream usually present in this Microsoft Office document type	System Summary,
Document contains OLE streams with high entropy indicating encrypted embedded content	Hooking and other Techniques for Hiding and Protection,
Sample is known by Antivirus	System Summary,
Document has a 'vbamacros' value indicative of goodware	System Summary,
Document has an 'encrypted' value indicative of goodware	System Summary,
Submission file is bigger than most known malware samples	System Summary,

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe

PE32 executable (GUI) Intel 80386, for MS Windows

downloaded

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe
IE cache URL:	http://kalamikwsdyonlinwtmg.dns.army/kaladoc/vbc.exe
Category:	downloaded
Dump:	vbc[1].exe.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.441995489867964
Encrypted:	false
Ssdeep:	1536:VMmOBBPTp3C7uIaILxhhn3JbPMfIxvktHFoDZNDA87itMmO:CmAJTpSkUbaf+vktHClND7iqm
Size:	98304
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: File Dropped By EQNEDT32EXE	System Summary,
Office equation editor drops PE file	System Summary,
Drops PE files	Persistence and Installation Behavior,

C:\Users\user\Desktop\~$PL_Proforma Invoice.xlsx

data

dropped

Details

File:	C:\Users\user\Desktop\~$PL_Proforma Invoice.xlsx
Category:	dropped
Dump:	~$PL_Proforma Invoice.xlsx.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	1.4377382811115937
Encrypted:	false
Ssdeep:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
Size:	330
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection,
Document misses a certain OLE stream usually present in this Microsoft Office document type	System Summary,
Creates files inside the user directory	System Summary,	Masquerading
Document contains OLE streams with high entropy indicating encrypted embedded content	Hooking and other Techniques for Hiding and Protection,	Obfuscated Files or Information
Sample is known by Antivirus	System Summary,
Document has a 'vbamacros' value indicative of goodware	System Summary,
Document has an 'encrypted' value indicative of goodware	System Summary,
Submission file is bigger than most known malware samples	System Summary,

C:\Users\Public\vbc.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\Public\vbc.exe
Category:	dropped
Dump:	vbc.exe.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.441995489867964
Encrypted:	false
Ssdeep:	1536:VMmOBBPTp3C7uIaILxhhn3JbPMfIxvktHFoDZNDA87itMmO:CmAJTpSkUbaf+vktHClND7iqm
Size:	98304
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Droppers Exploiting CVE-2017-11882	System Summary,
Drops PE files to the user root directory	Boot Survival,	Masquerading
Office equation editor drops PE file	System Summary,
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)	Exploits,	Exploitation for Client Execution
Sigma detected: Executables Started in Suspicious Folder	System Summary,
Sigma detected: Execution in Non-Executable Folder	System Summary,
Sigma detected: Suspicious Program Location Process Starts	System Summary,
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion,	Security Software Discovery
Abnormal high CPU Usage	System Summary,
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)	System Summary,
Contains functionality for execution timing, often used to detect debuggers	Malware Analysis System Evasion, Anti Debugging,	Security Software Discovery
Contains functionality to read the PEB	Anti Debugging,
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Detected potential crypto function	System Summary,	Encrypted Channel Archive Collected Data
Drops PE files	Persistence and Installation Behavior,
Drops PE files to the user directory	Persistence and Installation Behavior,	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation,	Obfuscated Files or Information
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection,
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion,	Security Software Discovery
Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)	System Summary,
Queries the cryptographic machine GUID	Language, Device and Operating System Detection,	System Information Discovery
Reads software policies	System Summary,	System Information Discovery
Spawns processes	System Summary,	Process Injection

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\45EE6A89.emf

Windows Enhanced Metafile (EMF) image data version 0x10000

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\45EE6A89.emf
Category:	dropped
Dump:	45EE6A89.emf.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Entropy:	5.196322083411459
Encrypted:	false
Ssdeep:	6144:KsKbuaQVuLEdgMZdxIDn3Z6dsLOo0C+roioMl:VKbutpdgsdq3USeCd9k
Size:	910720
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Downloads files	Networking,	Ingress Tool Transfer

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\75BEF67F.jpeg

gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\75BEF67F.jpeg
Category:	dropped
Dump:	75BEF67F.jpeg.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
Entropy:	7.801842363879827
Encrypted:	false
Ssdeep:	768:uLgWImQ6AMqTeyjskbJeYnriZvApugsiKi7iszQ2rvBZzmFz3/soBqZhsglgDQPT:uLgY4MqTeywVYr+0ugbDTzQ27A3UXsgf
Size:	48770
Whitelisted:	false
Reputation:	moderate

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F2EEFEF6.jpeg

gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F2EEFEF6.jpeg
Category:	dropped
Dump:	F2EEFEF6.jpeg.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
Entropy:	7.801842363879827
Encrypted:	false
Ssdeep:	768:uLgWImQ6AMqTeyjskbJeYnriZvApugsiKi7iszQ2rvBZzmFz3/soBqZhsglgDQPT:uLgY4MqTeywVYr+0ugbDTzQ27A3UXsgf
Size:	48770
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2584
Target ID:	2
Parent PID:	584
Name:	EQNEDT32.EXE
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Size:	543304
MD5:	A87236E214F6D42A65F5DEDAC816AEC8
Time:	18:59:23
Date:	21/01/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	581632
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Droppers Exploiting CVE-2017-11882	System Summary,
Sigma detected: EQNEDT32.EXE connecting to internet	System Summary,
Sigma detected: File Dropped By EQNEDT32EXE	System Summary,
Sigma detected: Executables Started in Suspicious Folder	System Summary,
Sigma detected: Execution in Non-Executable Folder	System Summary,
Sigma detected: Suspicious Program Location Process Starts	System Summary,
Office Equation Editor has been started	Exploits,
Spawns processes	System Summary,	Process Injection

C:\Users\Public\vbc.exe

'C:\Users\Public\vbc.exe'

Details

Is windows:	false
Is dropped:	true
PID:	2816
Target ID:	4
Parent PID:	2584
Name:	vbc.exe
Path:	C:\Users\Public\vbc.exe
Commandline:	'C:\Users\Public\vbc.exe'
Size:	98304
MD5:	3421EBB45A538C5044D484703448F2A7
Time:	18:59:26
Date:	21/01/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	102400
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Droppers Exploiting CVE-2017-11882	System Summary,
Yara detected GuLoader	Data Obfuscation,
Drops PE files to the user root directory	Boot Survival,	Masquerading
Office equation editor drops PE file	System Summary,
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)	Exploits,	Exploitation for Client Execution
Sigma detected: Executables Started in Suspicious Folder	System Summary,
Sigma detected: Execution in Non-Executable Folder	System Summary,
Sigma detected: Suspicious Program Location Process Starts	System Summary,
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion,	Security Software Discovery
Yara detected VB6 Downloader Generic	Data Obfuscation,
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Drops PE files	Persistence and Installation Behavior,
Drops PE files to the user directory	Persistence and Installation Behavior,	Masquerading
Uses a known web browser user agent for HTTP communication	Networking,	Application Layer Protocol
Downloads files from webservers via HTTP	Networking,	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion,	Security Software Discovery
Spawns processes	System Summary,	Process Injection

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	1144
Target ID:	0
Parent PID:	584
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Size:	27641504
MD5:	5FB0A0F93382ECD19F5F499A5CAA59F0
Time:	18:59:03
Date:	21/01/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13f620000
Modulesize:	27758592
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary,	Process Injection

URLs

Name

Malicious

http://kalamikwsdyonlinwtmg.dns.army/kaladoc/vbc.exe

103.125.191.78

Details

Name:	http://kalamikwsdyonlinwtmg.dns.army/kaladoc/vbc.exe
IP:	103.125.191.78
TargetID:	2
From Memory:	false
Current Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection,
Sigma detected: EQNEDT32.EXE connecting to internet	System Summary,
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion,	Security Software Discovery
IP address seen in connection with other malware	Networking,
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities,	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities,	Exploitation for Client Execution
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion,	Security Software Discovery

Domains

Name

Malicious

kalamikwsdyonlinwtmg.dns.army

103.125.191.78

Details

Name:	kalamikwsdyonlinwtmg.dns.army
IP:	103.125.191.78
TargetID:	2
Current Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: EQNEDT32.EXE connecting to internet	System Summary,
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities,	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities,	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities,	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking,	Application Layer Protocol
Downloads files from webservers via HTTP	Networking,	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking,	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Active

Malicious

103.125.191.78

unknown

Viet Nam

unknown

Details

IP:	103.125.191.78
TargetID:	2
Current Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Country:	Viet Nam
Countrycode:	VNM
ASN number:	135905
ASN name:	VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: EQNEDT32.EXE connecting to internet	System Summary,
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities,	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities,	Exploitation for Client Execution

Registry

Path

Value

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

0#8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

MTTT

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ReviewToken

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

F36C9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

VBAFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DefaultSheetR2L

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

UseSystemSeparators

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ThousandsSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DecimalSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

5)8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

F7F1F

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

F8BCB

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 21

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

LastPurgeTime

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EXCELFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

F7F1F

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

EquationEditorFilesIntl_1033

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

SavedLegacySettings

There are 50 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

3339000

unkown

page readonly

340000

unkown

page read and write

3385000

unkown

page readonly

3132000

unkown

page readonly

415000

unkown image

page read and write

2710000

heap private

page read and write

240000

unkown

page read and write

3234000

unkown

page readonly

3319000

unkown

page readonly

3286000

unkown

page readonly

32F2000

unkown

page readonly

1B0000

unkown

page readonly

3292000

unkown

page readonly

417000

unkown image

page readonly

3560000

unkown

page readonly

3214000

unkown

page readonly

417000

unkown image

page readonly

2890000

unkown

page read and write

1D88000

heap private

page read and write

33B5000

unkown

page readonly

3580000

unkown

page readonly

32B6000

unkown

page readonly

25B0000

unkown

page readonly

1E94000

heap private

page read and write

31F4000

unkown

page readonly

32D5000

unkown

page readonly

400000

unkown image

page readonly

271A000

heap private

page read and write

3332000

unkown

page readonly

5C0000

unkown

page readonly

3369000

unkown

page readonly

220000

unkown

page execute read

1D8B000

heap private

page read and write

22E0000

unkown

page readonly

1D84000

heap private

page read and write

2738000

heap private

page read and write

3275000

unkown

page readonly

3392000

unkown

page readonly

1D80000

heap private

page read and write

2880000

heap private

page read and write

3212000

unkown

page readonly

35A0000

unkown

page readonly

2E0000

unkown

page execute and read and write

420000

unkown

page read and write

3399000

unkown

page readonly

3305000

unkown

page readonly

20000

unkown

page read and write

18D000

unkown

page read and write

3032000

unkown

page readonly

3262000

unkown

page readonly

1E90000

heap private

page read and write

3038000

unkown

page readonly

1ED0000

heap private

page read and write

330000

heap private

page read and write

3362000

unkown

page readonly

331D000

unkown

page readonly

3522000

unkown

page readonly

4C7000

heap default

page read and write

400000

unkown image

page readonly

4E4000

heap default

page read and write

3232000

unkown

page readonly

8E0000

unkown

page readonly

250000

heap default

page read and write

32C2000

unkown

page readonly

2CB0000

unkown

page readonly

1EB2000

heap private

page read and write

401000

unkown image

page execute read

32A5000

unkown

page readonly

3316000

unkown

page readonly

32E6000

unkown

page readonly

4C0000

heap default

page read and write

740000

unkown

page readonly

7EFDF000

unkown

page read and write

230000

unkown

page readonly

3355000

unkown

page readonly

8B000

unkown

page read and write

2D0000

unkown

page write copy

31F2000

unkown

page readonly

2C90000

unkown

page readonly

400000

unkown image

page readonly

401000

unkown image

page execute read

1EE0000

unkown

page read and write

There are 72 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Registry

Memdumps