Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Document1094680387_02012021.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Last Saved By: Friner, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Feb 1 14:40:50 2021, Security: 0

initial sample

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Last Saved By: Friner, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Feb 1 14:40:50 2021, Security: 0
Entropy:	3.9082210251254503
Filename:	Document1094680387_02012021.xls
Filesize:	64512
MD5:	9423ee9775707d51960e0eac95b3f6cc
SHA1:	debc0defc997fde77a2f0cee9b3b1fcbed54ea91
SHA256:	7034e21128da9ce58c2d5249d3fd73dd766cf90437fa52f79faa50098f359634
SHA512:	0cff3519c5453bdeb13201849c571cbb142ed6780c2e6cae572104904af1190ff4d4e068ff0109953745b153fc219c618519318cadd4dcac300b3d280643bc53
SSDEEP:	1536:TcPiTQAVW/89BQnmlcGvgZ6GrvhpJ8YUOMUt/BI/s/Vk/OZ/R/7/Gm/UQ/OhGW/x:TcPiTQAVW/89BQnmlcGvgZ6Gr3J8YUOA
Preview:	........................>.......................\|...........................{..................................................................................................................................................................................

Signature Hits	Behavior Group	Mitre Attack
Found Excel 4.0 Macro with suspicious formulas	System Summary,	Scripting
Yara signature match	System Summary,
Document contains an OLE Workbook stream indicating a Microsoft Excel file	System Summary,
Document has a 'vbamacros' value indicative of goodware	System Summary,

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\32-422-76[1].htm

HTML document, ASCII text

downloaded

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\32-422-76[1].htm
IE cache URL:	http://healthymachinery.com/health/32-422-76.assp
Category:	downloaded
Dump:	32-422-76[1].htm.0.dr
ID:	dr_6
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	HTML document, ASCII text
Entropy:	4.978706497143023
Encrypted:	false
Ssdeep:	96:1j9jwIjYjyDK/DZD8jH+k1fiPvJADh/pRscs1szbGD:1j9jhjYjWK/lyH+k0RADh/pmcs1sfGD
Size:	4318
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\B5CE0000

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\B5CE0000
Category:	dropped
Dump:	B5CE0000.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	data
Entropy:	7.568364582865906
Encrypted:	false
Ssdeep:	384:1nnowDuBP+y+mjZ0VTquDznB3dPjZ8aoVT0QNuzWKPqGndVVBdd:1nnlDuBP+Tmje3nXPj6W+u7qkPLdd
Size:	26497
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue Feb 23 04:42:36 2021, atime=Tue Feb 23 04:42:36 2021, length=12288, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
Category:	dropped
Dump:	Desktop.LNK.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue Feb 23 04:42:36 2021, atime=Tue Feb 23 04:42:36 2021, length=12288, window=hide
Entropy:	4.468842484038273
Encrypted:	false
Ssdeep:	12:85Qc0LgXg/XAlCPCHaXgzB8IB/iGkZX+Wnicvb4AubDtZ3YilMMEpxRljKXlcTdK:85Zi/XTwz6IAjYekAiDv3qPrNru/
Size:	867
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Document1094680387_02012021.LNK

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:12 2020, mtime=Tue Feb 23 04:42:36 2021, atime=Tue Feb 23 04:42:36 2021, length=44032, window=hide

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Document1094680387_02012021.LNK
Category:	dropped
Dump:	Document1094680387_02012021.LNK.0.dr
ID:	dr_4
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:12 2020, mtime=Tue Feb 23 04:42:36 2021, atime=Tue Feb 23 04:42:36 2021, length=44032, window=hide
Entropy:	4.500480590351624
Encrypted:	false
Ssdeep:	24:8HYn/XTwz6I4U8WcqFekAxqZDv3qPdM7dD2HYn/XTwz6I4U8WcqFekAxqZDv3qPg:8M/XT3Ing+YJPQh2M/XT3Ing+YJPQ/
Size:	2198
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
Category:	dropped
Dump:	index.dat.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	ASCII text, with CRLF line terminators
Entropy:	4.703385008978903
Encrypted:	false
Ssdeep:	3:oyBVomMUdRRMJ9+XVEAl5S/dRRMJ9+XVEAlmMUdRRMJ9+XVEAlv:dj6zJVArS6JVAxzJVA1
Size:	134
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\LI22RCU4.txt

ASCII text

downloaded

Details

File:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\LI22RCU4.txt
IE cache URL:	healthymachinery.com/
Category:	downloaded
Dump:	LI22RCU4.txt.0.dr
ID:	dr_5
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	ASCII text
Entropy:	4.5618514532497425
Encrypted:	false
Ssdeep:	3:GmM/5DyQiqWyD0XQvHU8VXT7OHHRESNSRcuRYigjmXReWpD:XM/5DD1D3JuHS3cuKjmUWpD
Size:	122
Whitelisted:	false
Reputation:	low

C:\Users\user\Desktop\76CE0000

Applesoft BASIC program data, first line number 16

dropped

Details

File:	C:\Users\user\Desktop\76CE0000
Category:	dropped
Dump:	76CE0000.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	Applesoft BASIC program data, first line number 16
Entropy:	6.230482106115366
Encrypted:	false
Ssdeep:	1536:nZ8rmjAItyzElBIL6lECbgBGGP5xLmQWVxdEfq6PkHZ8rmjAItyzElBIL6lECbgT:nZ8rmjAItyzElBIL6lECbgBGGP5xLm7W
Size:	69069
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary,	Masquerading

C:\Users\user\MORI.BAST

HTML document, ASCII text

dropped

Details

File:	C:\Users\user\MORI.BAST
Category:	dropped
Dump:	MORI.BAST.0.dr
ID:	dr_7
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	HTML document, ASCII text
Entropy:	4.978706497143023
Encrypted:	false
Ssdeep:	96:1j9jwIjYjyDK/DZD8jH+k1fiPvJADh/pRscs1szbGD:1j9jhjYjWK/lyH+k0RADh/pmcs1sfGD
Size:	4318
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2200
Target ID:	0
Parent PID:	584
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Size:	27641504
MD5:	5FB0A0F93382ECD19F5F499A5CAA59F0
Time:	21:42:33
Date:	22/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13f970000
Modulesize:	27758592
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary,
Spawns processes	System Summary,	Process Injection

C:\Windows\System32\rundll32.exe

rundll32 ..\MORI.BAST,DllRegisterServer

Details

Is windows:	true
Is dropped:	false
PID:	2372
Target ID:	3
Parent PID:	2200
Name:	rundll32.exe
Class:	rundll32
Path:	C:\Windows\System32\rundll32.exe
Commandline:	rundll32 ..\MORI.BAST,DllRegisterServer
Size:	45568
MD5:	DD81D91FF3B0763C392422865C9AC12E
Time:	21:42:36
Date:	22/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff790000
Modulesize:	61440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities,	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary,
Runs a DLL by calling functions	System Summary,	Rundll32
Spawns processes	System Summary,	Process Injection

URLs

Name

Malicious

http://healthymachinery.com/health/32-422-76.assp

172.67.149.197

http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check

unknown

http://www.windows.com/pctv.

unknown

http://investor.msn.com

unknown

http://www.msnbc.com/news/ticker.txt

unknown

http://www.icra.org/vocabulary/.

unknown

http://windowsmedia.com/redir/services.asp?WMPFriendly=true

unknown

http://www.hotmail.com/oe

unknown

http://investor.msn.com/

unknown

https://www.cloudflare.com/5xx-error-landing

unknown

Domains

Name

Malicious

healthymachinery.com

172.67.149.197

Details

Name:	healthymachinery.com
IP:	172.67.149.197
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for domain / URL	AV Detection,
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities,	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities,	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities,	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking,	Application Layer Protocol
Downloads files from webservers via HTTP	Networking,	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking,	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Active

Malicious

172.67.149.197

unknown

United States

unknown

Details

IP:	172.67.149.197
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities,	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities,	Exploitation for Client Execution

Registry

Path

Value

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

,v7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

MTTT

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ReviewToken

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC246

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

VBAFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DefaultSheetR2L

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

UseSystemSeparators

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ThousandsSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DecimalSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC504

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC63C

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC6C8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

t 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

F3A62

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

F3BA9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

LastPurgeTime

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EXCELFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_3082

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1036

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SpellingAndGrammarFiles_1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

SavedLegacySettings

There are 95 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

2995000

unkown

page readonly

2A3D000

unkown

page readonly

AD000

heap default

page read and write

2339000

heap private

page read and write

384000

heap private

page read and write

29F5000

unkown

page readonly

2330000

heap private

page read and write

2C42000

unkown

page readonly

490000

unkown

page readonly

200000

unkown

page readonly

2270000

heap private

page read and write

60000

unkown

page read and write

610000

unkown

page readonly

1F90000

unkown

page readonly

2A06000

unkown

page readonly

2335000

heap private

page read and write

BBE000

unkown

page read and write

2A39000

unkown

page readonly

4DF000

unkown

page read and write

29B2000

unkown

page readonly

2170000

unkown

page read and write

2932000

unkown

page readonly

3C6000

unkown

page read and write

2C80000

unkown

page readonly

2752000

unkown

page readonly

1BB0000

unkown

page readonly

29E2000

unkown

page readonly

2AB9000

unkown

page readonly

18E000

heap default

page read and write

2CC0000

unkown

page readonly

22AB000

heap private

page read and write

2AD5000

unkown

page readonly

2954000

unkown

page readonly

250000

unkown

page readonly

380000

heap private

page read and write

23D0000

unkown

page readonly

2A75000

unkown

page readonly

2C0000

unkown

page write copy

2A6000

unkown

page read and write

1D97000

unkown

page readonly

7B0000

unkown

page readonly

29A6000

unkown

page readonly

2A82000

unkown

page readonly

1FD000

unkown

page read and write

2A12000

unkown

page readonly

2275000

heap private

page read and write

20F0000

heap private

page read and write

20000

unkown

page readonly

2AA5000

unkown

page readonly

2952000

unkown

page readonly

454000

heap private

page read and write

10B000

unkown

page read and write

29D6000

unkown

page readonly

2A89000

unkown

page readonly

2A25000

unkown

page readonly

2AB2000

unkown

page readonly

2A36000

unkown

page readonly

77000

heap default

page read and write

270000

unkown

page read and write

B2F000

unkown

page read and write

2852000

unkown

page readonly

450000

heap private

page read and write

70000

heap default

page read and write

29C5000

unkown

page readonly

2CA0000

unkown

page readonly

157000

heap default

page read and write

2914000

unkown

page readonly

2A52000

unkown

page readonly

2A59000

unkown

page readonly

2934000

unkown

page readonly

150000

heap default

page read and write

2982000

unkown

page readonly

2758000

unkown

page readonly

390000

unkown

page read and write

BD000

heap default

page read and write

110000

unkown

page readonly

70000

unkown

page read and write

23B0000

unkown

page readonly

2CE0000

unkown

page readonly

B6000

heap default

page read and write

2912000

unkown

page readonly

5EF000

unkown

page read and write

There are 72 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Registry

Memdumps