Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

SWIFT COPY.pdf.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.6047456297753016
Filename:	SWIFT COPY.pdf.exe
Filesize:	686592
MD5:	d01daeb6c9af5256a25dffe76a448f04
SHA1:	50aab2959bbc6d9e31eb477e6602ffbcb64343ce
SHA256:	490ae1eb1637910af1a69c6317ef81a47518b809f5b6da4b8f66d72582e25b9b
SHA512:	f7ec0d4e48d6cdbcaa0ea67e67589488aa939c8052adbc8d4545d7040f2b251d58625530cb294436df0c81821d77387a3da56dacf2b0b9ab06ab29da96aaf00f
SSDEEP:	12288:Gx3ZC2zGSQW+Lfs4AGcsx3gOYgIDslrNUspGrBA3qTYo9TiZRzI:Gx3ZNGSdmk1sx9xGQTqTYoF0zI
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P..f..........z.... ........@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains very large array initializations	System Summary
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)	Malware Analysis System Evasion	Native API Disable or Modify Tools
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Input Capture
Machine Learning detection for sample	AV Detection
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)	Malware Analysis System Evasion	Windows Management Instrumentation
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)	Malware Analysis System Evasion	Access Token Manipulation
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)	Stealing of Sensitive Information	Access Token Manipulation Credentials in Registry
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping Data from Local System
Tries to harvest and steal ftp login credentials	Stealing of Sensitive Information	Ingress Tool Transfer
Tries to steal Mail credentials (via file access)	Stealing of Sensitive Information	Email Collection
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job Access Token Manipulation
Antivirus or Machine Learning detection for unpacked file	AV Detection	Access Token Manipulation
Contains capabilities to detect virtual machines	Malware Analysis System Evasion
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Contains functionality to call native functions	System Summary
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates a DirectInput object (often for capturing keystrokes)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Creates a window with clipboard capturing capabilities	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Detected potential crypto function	System Summary	Access Token Manipulation Encrypted Channel
Drops PE files	Persistence and Installation Behavior	Access Token Manipulation
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Monitors certain registry keys / values for changes (often done to protect autostart functionality)	Hooking and other Techniques for Hiding and Protection	Query Registry
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
.NET source code contains calls to encryption/decryption functions	System Summary	Deobfuscate/Decode Files or Information Archive Collected Data
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging
Creates mutexes	System Summary	Access Token Manipulation
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries process information (via WMI, Win32_Process)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary	Access Token Manipulation
Reads the hosts file	System Summary	Remote System Discovery Ingress Tool Transfer
SQL strings found in memory and binary data	System Summary
Sample is known by Antivirus	System Summary	Access Token Manipulation
Sample might require command line arguments	System Summary	Access Token Manipulation
Sample reads its own file content	System Summary	Access Token Manipulation
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Checks if Microsoft Office is installed	System Summary	Access Token Manipulation
PE file contains a COM descriptor data directory	System Summary
Uses new MSVCR Dlls	Compliance, System Summary	Access Token Manipulation
Uses Microsoft Silverlight	System Summary	Access Token Manipulation

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SWIFT COPY.pdf.exe.log

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SWIFT COPY.pdf.exe.log
Category:	modified
Dump:	SWIFT COPY.pdf.exe.log.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.288448637977022
Encrypted:	false
Ssdeep:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk70U2xANlW3ANv:MLF20NaL3z2p29hJ5g522rW2xAi3A9
Size:	664
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Temp\tmp15D1.tmp

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\tmp15D1.tmp
Category:	dropped
Dump:	tmp15D1.tmp.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Entropy:	5.179103515573141
Encrypted:	false
Ssdeep:	24:2dH4+SEqC/S7hblNMFp//rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBGOYtn:cbhK79lNQR/rydbz9I3YODOLNdq3i
Size:	1641
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates temporary files	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Roaming\bSlxGzdE.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\bSlxGzdE.exe
Category:	dropped
Dump:	bSlxGzdE.exe.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.6047456297753016
Encrypted:	false
Ssdeep:	12288:Gx3ZC2zGSQW+Lfs4AGcsx3gOYgIDslrNUspGrBA3qTYo9TiZRzI:Gx3ZNGSdmk1sx9xGQTqTYoF0zI
Size:	686592
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Machine Learning detection for dropped file	AV Detection
Drops PE files	Persistence and Installation Behavior
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\AppData\Roaming\bSlxGzdE.exe:Zone.Identifier

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Roaming\bSlxGzdE.exe:Zone.Identifier
Category:	dropped
Dump:	bSlxGzdE.exe_Zone.Identifier.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.95006375643621
Encrypted:	false
Ssdeep:	3:ggPYV:rPYV
Size:	26
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Machine Learning detection for dropped file	AV Detection

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\SWIFT COPY.pdf.exe

'C:\Users\user\Desktop\SWIFT COPY.pdf.exe'

Details

Is windows:	false
Is dropped:	false
PID:	4800
Target ID:	0
Parent PID:	5916
Name:	SWIFT COPY.pdf.exe
Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Commandline:	'C:\Users\user\Desktop\SWIFT COPY.pdf.exe'
Size:	686592
MD5:	D01DAEB6C9AF5256A25DFFE76A448F04
Time:	19:54:16
Date:	12/05/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x120000
Modulesize:	712704
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Suspicious Double Extension	System Summary
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Uses an obfuscated file name to hide its real file extension (double extension)	Hooking and other Techniques for Hiding and Protection	Masquerading Obfuscated Files or Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\SysWOW64\schtasks.exe

'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\bSlxGzdE' /XML 'C:\Users\user\AppData\Local\Temp\tmp15D1.tmp'

Details

Is windows:	true
Is dropped:	false
PID:	6112
Target ID:	1
Parent PID:	4800
Name:	schtasks.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\schtasks.exe
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\bSlxGzdE' /XML 'C:\Users\user\AppData\Local\Temp\tmp15D1.tmp'
Size:	185856
MD5:	15FF7D8324231381BAD48A052F85DF04
Time:	19:54:19
Date:	12/05/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x9c0000
Modulesize:	204800
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Uses schtasks.exe or at.exe to add and modify task schedules	Boot Survival	Scheduled Task/Job
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Users\user\Desktop\SWIFT COPY.pdf.exe

Details

Is windows:	false
Is dropped:	false
PID:	1372
Target ID:	3
Parent PID:	4800
Name:	SWIFT COPY.pdf.exe
Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Commandline:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Size:	686592
MD5:	D01DAEB6C9AF5256A25DFFE76A448F04
Time:	19:54:20
Date:	12/05/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	245760
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Suspicious Double Extension	System Summary
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Uses an obfuscated file name to hide its real file extension (double extension)	Hooking and other Techniques for Hiding and Protection	Masquerading Obfuscated Files or Information
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	4296
Target ID:	2
Parent PID:	6112
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	625664
MD5:	EA777DEEA782E8B4D7C7C33BBF8A4496
Time:	19:54:19
Date:	12/05/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff724c50000
Modulesize:	651264
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://127.0.0.1:HTTP/1.1

unknown

Details

Name:	http://127.0.0.1:HTTP/1.1
TargetID:	3
From Memory:	true
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Source:	SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://api.ipify.org%GETMozilla/5.0

unknown

Details

Name:	https://api.ipify.org%GETMozilla/5.0
TargetID:	3
From Memory:	true
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Source:	SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://DynDns.comDynDNS

unknown

Details

Name:	http://DynDns.comDynDNS
TargetID:	3
From Memory:	true
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Source:	SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

unknown

Details

Name:	https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
TargetID:	3
From Memory:	true
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Source:	SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://hcVzVgyZjXO8egOI.net

unknown

Details

Name:	http://hcVzVgyZjXO8egOI.net
TargetID:	3
From Memory:	true
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Source:	SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://api.ipify.org%

unknown

Details

Name:	https://api.ipify.org%
TargetID:	3
From Memory:	true
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Source:	SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip

unknown

Details

Name:	https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Source:	SWIFT COPY.pdf.exe

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

unknown

Details

Name:	https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Source:	SWIFT COPY.pdf.exe, 00000000.00000002.651169792.00000000028EB000.00000004.00000001.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://hsfZEB.com

unknown

Details

Name:	http://hsfZEB.com
TargetID:	3
From Memory:	true
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Source:	SWIFT COPY.pdf.exe, 00000003.00000002.907665647.0000000002BC1000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

mail.esquiresweaters.com

192.185.171.219

Details

Name:	mail.esquiresweaters.com
IP:	192.185.171.219
TargetID:	3
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

192.185.171.219

mail.esquiresweaters.com

United States

Details

IP:	192.185.171.219
TargetID:	3
Current Path:	C:\Users\user\Desktop\SWIFT COPY.pdf.exe
Country:	United States
Countrycode:	USA
ASN number:	46606
ASN name:	UNIFIEDLAYER-AS-1US
Private:	false
Domain:	mail.esquiresweaters.com

Memdumps

Base Address

Regiontype

Protect

Malicious

402000

unkown image

page execute and read and write

28EB000

unkown

page read and write

402000

unkown

page execute and read and write

2BC1000

unkown

page read and write

38C1000

unkown

page read and write

A70000

unkown

page readonly

8B0000

unkown

page readonly

4A5000

unkown

page read and write

5E5E000

unkown

page read and write

556000

unkown

page read and write

A10000

unkown

page read and write

2440000

unkown

page read and write

562E000

unkown

page read and write

A474000

unkown

page read and write

AD0000

unkown

page read and write

968000

unkown

page read and write

725000

heap default

page read and write

A77000

unkown

page read and write

AD0000

unkown

page read and write

120000

unkown image

page readonly

5910000

unkown

page read and write

4A0000

unkown

page read and write

4A0000

unkown

page read and write

AD7000

unkown

page read and write

1CA000

unkown image

page readonly

B22000

unkown

page execute and read and write

A40000

unkown

page read and write

241E000

unkown

page read and write

A20000

unkown

page read and write

AB0000

unkown

page read and write

2398000

unkown

page read and write

5600000

unkown

page read and write

A70000

unkown

page read and write

AF0000

unkown

page execute and read and write

C37000

unkown

page read and write

9EA000

unkown

page execute and read and write

A90000

unkown

page read and write

5690000

unkown

page readonly

7430000

unkown

page read and write

5A0F000

unkown

page read and write

5920000

unkown

page execute and read and write

529E000

unkown

page read and write

49EB000

unkown

page readonly

490000

heap private

page read and write

AF0000

unkown

page read and write

4A2000

unkown

page read and write

AD0000

unkown

page read and write

2610000

unkown

page readonly

5A70000

unkown

page read and write

5360000

unkown

page readonly

54E0000

unkown

page execute and read and write

AE0000

unkown

page read and write

968000

unkown

page read and write

A490000

unkown

page read and write

644000

unkown

page read and write

A80000

unkown

page read and write

4A0000

unkown

page read and write

2690000

heap private

page execute and read and write

4A5000

unkown

page read and write

4D80000

unkown

page read and write

567D000

unkown

page read and write

A19000

unkown

page read and write

A00000

unkown

page read and write

984000

heap default

page read and write

4C0000

unkown

page read and write

5600000

unkown

page read and write

4A0000

unkown

page read and write

AD0000

unkown

page read and write

730000

unkown

page readonly

A00000

unkown

page read and write

4A0000

unkown

page read and write

4C20000

heap private

page read and write

552D000

unkown

page read and write

256E000

unkown

page read and write

7430000

unkown

page read and write

B16000

unkown

page execute and read and write

E70000

unkown

page readonly

5BDD000

unkown

page read and write

A02000

unkown

page read and write

5F9E000

unkown

page read and write

AD0000

unkown

page read and write

C12000

heap default

page read and write

E60000

heap private

page read and write

96F000

unkown

page read and write

AD5000

unkown

page read and write

3E9000

unkown

page read and write

2440000

unkown

page read and write

596D000

unkown

page read and write

96E000

unkown

page read and write

3A96000

unkown

page read and write

3E0000

unkown

page read and write

3FE000

unkown

page read and write

96F000

unkown

page read and write

4A0000

unkown

page read and write

2959000

unkown

page read and write

4ACC000

unkown

page read and write

ADA000

unkown

page read and write

5C0000

unkown

page readonly

7430000

unkown

page read and write

BA0000

unkown

page read and write

7F2000

unkown

page read and write

2870000

heap private

page read and write

AD0000

unkown

page read and write

5640000

unkown

page readonly

CB1000

unkown

page read and write

4A0000

unkown

page read and write

5D5E000

unkown

page read and write

2580000

unkown

page readonly

51FE000

unkown

page read and write

9D0000

unkown

page read and write

4A0000

unkown

page read and write

23DE000

unkown

page read and write

49C0000

unkown

page readonly

85E000

unkown

page read and write

AD0000

unkown

page read and write

5760000

unkown

page read and write

4A0000

unkown

page read and write

AD0000

unkown

page read and write

71E000

unkown

page read and write

49C7000

unkown

page readonly

3BE7000

unkown

page read and write

A9C000

unkown

page read and write

A70000

unkown

page read and write

A40000

unkown

page read and write

648000

unkown

page read and write

3EC000

unkown

page read and write

7C0000

unkown

page read and write

AB0000

unkown

page read and write

2460000

heap private

page read and write

73E0000

unkown

page read and write

4D81000

unkown

page read and write

4A5000

unkown

page read and write

A90000

unkown

page read and write

50BE000

unkown

page read and write

5A20000

unkown

page read and write

95E000

heap default

page read and write

C2A000

unkown

page read and write

B32000

unkown

page read and write

A40000

unkown

page read and write

96F000

unkown

page read and write

A70000

unkown

page read and write

27A8000

unkown

page read and write

96F000

unkown

page read and write

966000

unkown

page read and write

4A10000

unkown

page readonly

4A5000

unkown

page read and write

4CBD000

unkown

page read and write

5070000

unkown

page read and write

AD2000

unkown

page read and write

B3B000

unkown

page execute and read and write

96F000

unkown

page read and write

4A5000

unkown

page read and write

4A80000

unkown

page read and write

4A0000

unkown

page read and write

5900000

unkown

page read and write

7C2000

unkown

page execute and read and write

4D31000

unkown

page read and write

3BD2000

unkown

page read and write

2440000

unkown

page readonly

3BC1000

unkown

page read and write

E40000

unkown

page read and write

AD0000

unkown

page read and write

4A2000

unkown

page read and write

96E000

unkown

page read and write

5A6D000

unkown

page read and write

A00000

unkown

page read and write

A3E000

unkown

page read and write

A70000

unkown

page read and write

A10000

unkown

page read and write

1CA000

unkown image

page readonly

49BD000

unkown

page read and write

95E000

unkown

page read and write

4A0000

unkown

page read and write

7BA000

unkown

page execute and read and write

2390000

unkown

page read and write

3F2000

unkown

page read and write

7440000

unkown

page read and write

4A5000

unkown

page read and write

7FBD0000

unkown

page execute and read and write

B02000

unkown

page execute and read and write

96F000

unkown

page read and write

BEE000

unkown

page read and write

5740000

unkown

page readonly

4A2000

unkown

page read and write

4A5000

unkown

page read and write

AD0000

unkown

page read and write

7430000

unkown

page read and write

AD0000

unkown

page read and write

B50000

heap private

page read and write

5C1E000

unkown

page read and write

5070000

unkown

page read and write

C5B000

heap default

page read and write

AD0000

unkown

page read and write

4F9B000

unkown

page readonly

4FC0000

unkown

page read and write

590E000

unkown

page read and write

966000

heap default

page read and write

968000

unkown

page read and write

7EA000

unkown

page execute and read and write

4E40000

unkown

page read and write

4F7C000

unkown

page readonly

5A20000

unkown

page read and write

957000

unkown

page read and write

AD0000

unkown

page read and write

8D0000

unkown

page read and write

CC5000

unkown

page read and write

9F0000

heap default

page read and write

5B0000

unkown

page read and write

96E000

unkown

page read and write

4A5000

unkown

page read and write

7CC000

unkown

page execute and read and write

4A0000

unkown

page read and write

A10000

unkown

page read and write

A50000

unkown

page read and write

54EF000

unkown

page read and write

92C000

heap default

page read and write

3F5000

unkown

page read and write

A80000

unkown

page read and write

4A5000

unkown

page read and write

B2A000

unkown

page execute and read and write

4A0000

unkown

page read and write

7430000

unkown

page read and write

5AD000

unkown

page read and write

2430000

unkown

page read and write

4A0000

unkown

page read and write

B37000

unkown

page execute and read and write

4A70000

heap private

page read and write

2390000

unkown

page read and write

4A5000

unkown

page read and write

5A10000

unkown

page read and write

4F70000

unkown

page readonly

515E000

unkown

page read and write

4F30000

unkown

page read and write

2390000

unkown

page read and write

8E0000

unkown

page execute and read and write

120000

unkown image

page readonly

C38000

unkown

page read and write

AD3000

unkown

page read and write

AD0000

unkown

page read and write

750000

unkown

page read and write

54F0000

unkown

page execute and read and write

AD0000

unkown

page read and write

5C0000

unkown

page readonly

49CC000

unkown

page readonly

A470000

unkown

page read and write

AD2000

unkown

page read and write

58DC000

unkown

page read and write

53CE000

unkown

page read and write

AD0000

unkown

page read and write

96C000

unkown

page read and write

4A0000

unkown

page read and write

4A0000

unkown

page read and write

5D0000

unkown

page readonly

B9E000

unkown

page read and write

54D0000

unkown

page execute and read and write

96F000

unkown

page read and write

740000

unkown

page readonly

45B000

unkown

page read and write

AF0000

unkown

page read and write

8C0000

unkown

page readonly

C49000

heap default

page read and write

5060000

unkown

page read and write

58CD000

unkown

page read and write

539E000

unkown

page read and write

7430000

unkown

page read and write

DDE000

unkown

page read and write

28C1000

unkown

page read and write

A40000

unkown

page read and write

7FA80000

unkown

page execute and read and write

C29000

unkown

page read and write

56A0000

unkown

page readonly

2CF5000

unkown

page read and write

5A10000

unkown

page execute and read and write

58F0000

unkown

page read and write

AD2000

unkown

page read and write

4D30000

unkown

page read and write

3DC000

unkown

page read and write

AC0000

unkown

page read and write

E30000

unkown

page readonly

96F000

unkown

page read and write

2390000

unkown

page read and write

4A0000

unkown

page read and write

4A0000

unkown

page read and write

7B2000

unkown

page execute and read and write

5060000

unkown

page read and write

2CC1000

unkown

page read and write

4BD0000

unkown

page read and write

4AE000

unkown

page read and write

BD0000

heap private

page read and write

790000

heap private

page read and write

2880000

unkown

page readonly

53ED000

unkown

page read and write

4C10000

unkown

page read and write

AD0000

unkown

page read and write

7440000

unkown

page read and write

4D4F000

unkown

page read and write

7F7000

unkown

page execute and read and write

A60000

unkown

page read and write

968000

unkown

page read and write

A30000

unkown

page read and write

A80000

unkown

page read and write

4A0000

unkown

page readonly

5E0000

unkown

page read and write

A50000

unkown

page read and write

7450000

unkown

page read and write

A50000

unkown

page read and write

A60000

unkown

page readonly

400000

unkown image

page readonly

4D4F000

unkown

page read and write

2430000

unkown

page readonly

727000

unkown

page read and write

2640000

unkown

page readonly

A20000

unkown

page read and write

122000

unkown image

page readonly

C9E000

unkown

page read and write

A10000

unkown

page read and write

96F000

unkown

page read and write

57CE000

unkown

page read and write

5610000

unkown

page read and write

B12000

unkown

page read and write

89C000

unkown

page read and write

5A21000

unkown

page read and write

4C0000

unkown

page read and write

4C0000

unkown

page read and write

2390000

unkown

page read and write

9E2000

unkown

page execute and read and write

7A0000

unkown

page read and write

8F9000

unkown

page read and write

2632000

unkown

page read and write

A80000

unkown

page read and write

A480000

unkown

page read and write

4A0000

unkown

page read and write

2630000

unkown

page read and write

B10000

unkown

page read and write

A00000

unkown

page read and write

6DE000

unkown

page read and write

AD0000

unkown

page read and write

4D33000

unkown

page read and write

CC8000

unkown

page read and write

A70000

unkown

page read and write

96F000

unkown

page read and write

2D41000

unkown

page read and write

5600000

unkown

page read and write

AD0000

unkown

page read and write

2390000

unkown

page read and write

AD0000

unkown

page read and write

23A0000

unkown

page read and write

B2C000

unkown

page execute and read and write

54CD000

unkown

page read and write

5CAF000

unkown

page read and write

A16000

unkown

page read and write

7447000

unkown

page read and write

BC0000

unkown

page read and write

A30000

unkown

page read and write

E1E000

unkown

page read and write

2CEF000

unkown

page read and write

5600000

unkown

page read and write

96C000

unkown

page read and write

2390000

unkown

page read and write

122000

unkown image

page readonly

BE0000

heap default

page read and write

3FB000

unkown

page read and write

4A0000

unkown

page read and write

7430000

unkown

page read and write

7DA000

unkown

page execute and read and write

A50000

unkown

page read and write

720000

heap default

page read and write

400000

unkown image

page execute and read and write

4A0000

unkown

page read and write

120000

unkown image

page readonly

4AA000

unkown image

page readonly

3C36000

unkown

page read and write

4E80000

unkown

page readonly

968000

unkown

page read and write

279E000

unkown

page read and write

BEA000

heap default

page read and write

5ADE000

unkown

page read and write

8F0000

heap default

page read and write

A70000

unkown

page read and write

400000

unkown

page execute and read and write

5630000

unkown

page readonly

BF0000

unkown

page readonly

A86000

unkown

page read and write

3A68000

unkown

page read and write

5BAE000

unkown

page read and write

3EF000

unkown

page read and write

2390000

unkown

page read and write

A30000

unkown

page read and write

2CBD000

unkown

page read and write

AE0000

unkown

page read and write

AA0000

unkown

page read and write

B20000

unkown

page read and write

50FE000

unkown

page read and write

96E000

unkown

page read and write

AD0000

unkown

page read and write

C39000

unkown

page read and write

4C30000

unkown

page read and write

577E000

unkown

page read and write

2431000

unkown

page read and write

810000

heap private

page read and write

AD0000

unkown

page read and write

5600000

unkown

page read and write

5E9E000

unkown

page read and write

E67000

heap private

page read and write

A53000

unkown

page read and write

8F6000

unkown

page read and write

AD0000

unkown

page read and write

AD0000

unkown

page read and write

A50000

unkown

page read and write

A1E000

unkown

page read and write

AD2000

unkown

page read and write

5061000

unkown

page read and write

AA0000

unkown

page read and write

5600000

unkown

page read and write

AD0000

unkown

page read and write

AD0000

unkown

page read and write

7D7000

unkown

page execute and read and write

4A0000

unkown

page read and write

2390000

unkown

page execute and read and write

523E000

unkown

page read and write

A20000

unkown

page read and write

3F8000

unkown

page read and write

533F000

unkown

page read and write

968000

unkown

page read and write

8A0000

unkown

page read and write

1200000

unkown

page readonly

4C0000

unkown

page readonly

AD0000

unkown

page read and write

525E000

unkown

page read and write

4F77000

unkown

page readonly

A70000

unkown

page read and write

5370000

unkown

page execute and read and write

5A71000

unkown

page read and write

CC8000

unkown

page read and write

A60000

unkown

page read and write

7FB000

unkown

page execute and read and write

5F0000

unkown

page read and write

2630000

unkown

page read and write

A460000

unkown

page read and write

57DE000

unkown

page read and write

900000

unkown

page readonly

CC8000

heap default

page read and write

7E2000

unkown

page execute and read and write

402000

unkown image

page readonly

268E000

unkown

page read and write

AD0000

unkown

page read and write

4A5000

unkown

page read and write

A00000

unkown

page read and write

E20000

unkown

page readonly

9F5000

heap default

page read and write

4D4E000

unkown

page read and write

5D1D000

unkown

page read and write

4C0000

unkown

page read and write

4CC0000

unkown

page readonly

4BCD000

unkown

page read and write

5050000

unkown

page execute and read and write

2390000

unkown

page read and write

C79000

unkown

page read and write

C99000

unkown

page read and write

5630000

unkown

page readonly

B1A000

unkown

page execute and read and write

2570000

heap private

page execute and read and write

E50000

unkown

page execute and read and write

5600000

unkown

page read and write

96A000

unkown

page read and write

A70000

unkown

page read and write

AD0000

unkown

page read and write

AEF000

unkown

page read and write

4A5000

unkown

page read and write

690000

unkown

page read and write

AD0000

unkown

page read and write

53B000

unkown

page read and write

There are 462 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Memdumps