Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

4TWEQh2HJb.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Invoice 720710 from Quickbooks, LLC, Author: Quickbooks, LLC, Last Saved By: user, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Jul 14 09:38:23 2021, Last Saved Time/Date: Wed Jul 14 15:06:14 2021, Security: 0

initial sample

Details

Filetype:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Invoice 720710 from Quickbooks, LLC, Author: Quickbooks, LLC, Last Saved By: user, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Jul 14 09:38:23 2021, Last Saved Time/Date: Wed Jul 14 15:06:14 2021, Security: 0
Entropy:	7.524113368644345
Filename:	4TWEQh2HJb.xls
Filesize:	728064
MD5:	40425d09e54ff26289dd074649f0cad9
SHA1:	ae7e4df26092d9acf01b732c8144f0170ccc6556
SHA256:	6f8f1b26324ea0f3f566fbdcb4a61eb92d054ccf0300c52b3549c774056b8f02
SHA512:	db62ee5908d05d96ca63a852880f79b8ad584d4d7490543e50801d2dcdbb62faab3f311263b14e0ce6e0f6d349be94953dd0d532992739ca71684ad7f4f8dfb7
SSDEEP:	12288:IRYbXrlUc6XS/CwRl+4MW1H5onZHBDznxcp/c0UGtkbByxlFYd2Drpkk:LUc6EjDMW1UrDjxcNcfgZI2
Preview:	........................>...................................z...................b.......d.......f.......h.......j..............................................................................................................................................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Document contains an embedded VBA macro which may execute processes	System Summary
Document contains an embedded VBA macro with suspicious strings	System Summary
Machine Learning detection for sample	AV Detection
Document contains an embedded VBA macro which executes code when the document is opened / closed	System Summary	Scripting
Document contains embedded VBA macros	System Summary
Document contains an OLE Workbook stream indicating a Microsoft Excel file	System Summary
Sample is known by Antivirus	System Summary

C:\ProgramData\qDialogMainChartType.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\ProgramData\qDialogMainChartType.exe
Category:	dropped
Dump:	qDialogMainChartType.exe.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Windows\System32\mshta.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.4919139330417055
Encrypted:	false
Ssdeep:	3072:hWiJzQu5JD9ko9WY1wzxWrPAEN87L5cWlvsRwmhnxONgkf:hLquAkPAE+X5WncNgk
Size:	167936
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing
Machine Learning detection for dropped file	AV Detection
Tries to delay execution (extensive OutputDebugStringW loop)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Tries to detect sandboxes / dynamic malware analysis system (file name check)	Malware Analysis System Evasion	Security Software Discovery Virtualization/Sandbox Evasion
Abnormal high CPU Usage	System Summary
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)	System Summary
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)	Anti Debugging
Contains functionality to call native functions	System Summary
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging	Security Software Discovery
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	System Information Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected potential crypto function	System Summary	Encrypted Channel Archive Collected Data
Drops PE files	Persistence and Installation Behavior
Drops PE files to the application program directory (C:\ProgramData)	Persistence and Installation Behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains functionality to query system information	Malware Analysis System Evasion	System Information Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Spawns processes	System Summary	Process Injection

C:\ProgramData\qRangeAutoFormatLocalFormat3.sct

HTML document, ASCII text, with very long lines, with CRLF line terminators

dropped

Details

File:	C:\ProgramData\qRangeAutoFormatLocalFormat3.sct
Category:	dropped
Dump:	qRangeAutoFormatLocalFormat3.sct.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Entropy:	4.787304123915109
Encrypted:	false
Ssdeep:	96:CgAe+y62lIJ62lIAh62lIu62lInv62lIyHJyhn62lIr:hxlIvlIMlIOlInllIwyhtlIr
Size:	5621
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (creates forbidden files)	Software Vulnerabilities	Exploitation for Client Execution
Microsoft Office creates scripting files	System Summary	Scripting
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Spawns processes	System Summary	Process Injection

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2820
Target ID:	0
Parent PID:	584
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Size:	27641504
MD5:	5FB0A0F93382ECD19F5F499A5CAA59F0
Time:	19:59:44
Date:	14/07/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13f460000
Modulesize:	27758592
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\mshta.exe

mshta 'C:\ProgramData\qRangeAutoFormatLocalFormat3.sct'

Details

Is windows:	true
Is dropped:	false
PID:	2104
Target ID:	2
Parent PID:	2820
Name:	mshta.exe
Class:	system-tools
Path:	C:\Windows\System32\mshta.exe
Commandline:	mshta 'C:\ProgramData\qRangeAutoFormatLocalFormat3.sct'
Size:	13824
MD5:	95828D670CFD3B16EE188168E083C3C5
Time:	19:59:47
Date:	14/07/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x13f060000
Modulesize:	32768
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\ProgramData\qDialogMainChartType.exe

Details

Is windows:	false
Is dropped:	true
PID:	3028
Target ID:	3
Parent PID:	2104
Name:	qDialogMainChartType.exe
Path:	C:\ProgramData\qDialogMainChartType.exe
Commandline:	C:\ProgramData\qDialogMainChartType.exe
Size:	167936
MD5:	EA91555829C1DFDFD47709496461C5D6
Time:	19:59:49
Date:	14/07/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x10000000
Modulesize:	172032
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing
Yara detected Dridex unpacked file	E-Banking Fraud
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Drops PE files to the application program directory (C:\ProgramData)	Persistence and Installation Behavior
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

URLs

Name

Malicious

http://fontfabrik.comQ

unknown

http://www.msnbc.com/news/ticker.txt

unknown

http://onlinefastsolutions.com:8088/images/details.bin

unknown

http://www.tiro.com;Copyright

unknown

http://www.fontbureau.com/designers?

unknown

http://insiderushings.com:8088/js/file13.binj

unknown

http://paymentadvisry.com:8088/wp-theme/file7.bin3.sct

unknown

http://onlinefastsolutions.com:8088/js/file1.bin

unknown

http://www.ncst.ernet.in/~rkjoshi

unknown

http://www.typography.netD

unknown

http://www.galapagosdesign.com/staff/dennis.htm

unknown

http://www.icra.org/vocabulary/.

unknown

http://onlinefastsolutions.com:8088/images/file13.bin

unknown

http://onlinefastsolutions.com:8088/tpls/file3.bind

unknown

http://onlinefastsolutions.com:8088/tpls/file3.binc

unknown

http://investor.msn.com/

unknown

http://buyer-remindment.com:8088/fonts/file8.bin

unknown

http://www.%s.comPA

unknown

http://www.fonts.com

unknown

http://www.sandoll.co.kr

unknown

http://onlinefastsolutions.com:8088/tpls/file3.binQ

unknown

http://www.urwpp.de

unknown

http://www.zhongyicts.com.cn

unknown

http://www.sakkal.com

unknown

http://onlinefastsolutions.com:8088/tpls/file3.binX

unknown

http://www.bethmardutho.org.P

unknown

http://insiderushings.com:8088/js/file13.bin

unknown

http://www.windows.com/pctv.

unknown

http://investor.msn.com

unknown

http://www.fontbureau.com

unknown

http://www.galapagosdesign.com/

unknown

http://www.ascendercorp.com/

unknown

http://fasteasyupdates.com:8088/vendors/file4.bin

unknown

http://www.c-and-g.co.jp

unknown

http://windowsmedia.com/redir/services.asp?WMPFriendly=true

unknown

http://www.hotmail.com/oe

unknown

http://paymentadvisry.com:8088/wp-theme/file7.bin

unknown

http://buyer-remindment.com:8088/tpls/file4.bin

unknown

http://onlinefastsolutions.com:8088/js/file1.binT

unknown

http://onlinefastsolutions.com:8088/images/details.binG

unknown

http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check

unknown

http://www.founder.com.cn/cn/

unknown

http://www.fontbureau.com/designers/cabarga.htmlN

unknown

http://www.founder.com.cn/cn

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.

unknown

http://www.fontbureau.com/designers/frere-jones.html

unknown

http://onlinefastsolutions.com:8088/tpls/file3.bin

208.83.69.35

http://www.ascendercorp.com/typedesigners.htmlt

unknown

http://buyer-remindment.com:8088/tpls/file4.bin:

unknown

http://buyer-remindment.com:8088/css/file7.bin

unknown

http://www.fontbureau.com/designers/

unknown

There are 41 hidden URLs, click here to show them.

Domains

Name

Malicious

onlinefastsolutions.com

208.83.69.35

Details

Name:	onlinefastsolutions.com
IP:	208.83.69.35
TargetID:	2
Current Path:	C:\Windows\System32\mshta.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

78.46.78.42

unknown

Germany

Details

IP:	78.46.78.42
TargetID:	255
Country:	Germany
Countrycode:	DEU
ASN number:	24940
ASN name:	HETZNER-ASDE
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

202.29.60.34

unknown

Thailand

Details

IP:	202.29.60.34
TargetID:	255
Country:	Thailand
Countrycode:	THA
ASN number:	24344
ASN name:	CMRU-AS-APChiangmaiRajabhatUniversityTH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

66.175.217.172

unknown

United States

Details

IP:	66.175.217.172
TargetID:	255
Country:	United States
Countrycode:	USA
ASN number:	63949
ASN name:	LINODE-APLinodeLLCUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol

208.83.69.35

onlinefastsolutions.com

United States

Details

IP:	208.83.69.35
TargetID:	2
Current Path:	C:\Windows\System32\mshta.exe
Country:	United States
Countrycode:	USA
ASN number:	22438
ASN name:	CLEAR-RATE-COMMUNICATIONSUS
Private:	false
Domain:	onlinefastsolutions.com

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution

Registry

Path

Value

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

<~9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

MTTT

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

VBAFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ReviewToken

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EEEE1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

8f9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

F51C8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 2

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 3

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 4

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 5

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 6

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 8

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 9

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 10

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 11

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 12

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 13

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 14

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 15

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 16

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 17

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 18

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 19

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 20

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

F68D1

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

LastPurgeTime

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

1033

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EXCELFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ProductFiles

There are 47 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

10001000

unkown image

page execute read

4D4C000

unkown

page read and write

D0000

heap default

page read and write

45D5000

unkown

page readonly

4536000

unkown

page readonly

2470000

unkown

page readonly

4542000

unkown

page readonly

2390000

unkown

page read and write

2495000

heap private

page read and write

5830000

heap private

page read and write

370000

heap default

page read and write

10000000

unkown image

page readonly

4D5B000

unkown

page read and write

7DF60000

unkown

page read and write

25A4000

unkown

page read and write

2570000

unkown

page read and write

279B000

heap private

page read and write

1D10000

unkown

page readonly

53F0000

heap private

page read and write

546000

heap private

page read and write

4F0000

heap private

page read and write

2720000

unkown

page readonly

2540000

unkown

page read and write

259C000

unkown

page read and write

7DE80000

unkown

page read and write

1F4000

heap private

page read and write

1FA000

heap private

page read and write

2440000

unkown

page readonly

44F5000

unkown

page readonly

4DA0000

unkown

page read and write

47D0000

unkown

page readonly

4D76000

unkown

page read and write

3B4000

unkown

page read and write

362000

unkown

page read and write

3F00000

unkown

page readonly

25A8000

unkown

page read and write

4506000

unkown

page readonly

4D5C000

unkown

page read and write

251C000

unkown

page read and write

7EFDF000

unkown

page read and write

4D00000

unkown

page read and write

2B00000

heap private

page read and write

258C000

unkown

page read and write

4D70000

unkown

page read and write

4D5E000

unkown

page read and write

4D59000

unkown

page read and write

4482000

unkown

page readonly

4444000

unkown

page readonly

4772000

unkown

page readonly

394000

unkown

page read and write

24B2000

heap private

page read and write

220000

unkown

page readonly

25B4000

unkown

page read and write

7DFE0000

unkown

page read and write

22C0000

unkown

page read and write

1BF000

heap default

page read and write

4484000

unkown

page readonly

4D59000

unkown

page read and write

24D0000

unkown

page read and write

49F0000

unkown

page write copy

3E65000

heap private

page read and write

4C0B000

heap private

page read and write

2534000

unkown

page read and write

4288000

unkown

page readonly

DE0000

unkown

page readonly

44B2000

unkown

page readonly

2100000

unkown

page read and write

377000

heap default

page read and write

44D6000

unkown

page readonly

D7000

heap default

page read and write

2550000

unkown

page read and write

7DF71000

unkown

page read and write

7DF80000

unkown

page read and write

23A0000

unkown

page write copy

25C0000

unkown

page read and write

359000

unkown

page read and write

10000000

unkown image

page readonly

25C4000

unkown

page read and write

45E9000

unkown

page readonly

5510000

unkown

page read and write

47B0000

unkown

page readonly

1B0000

unkown

page readonly

39E0000

unkown

page readonly

8C000

unkown

page read and write

250C000

unkown

page read and write

4D64000

unkown

page read and write

2D0000

unkown

page read and write

60000

unkown

page readonly

25A0000

unkown

page read and write

306D000

unkown

page read and write

1001A000

unkown image

page readonly

2430000

unkown

page readonly

582F000

unkown

page read and write

45A5000

unkown

page readonly

4555000

unkown

page readonly

3EE0000

unkown

page readonly

2480000

heap private

page read and write

4D59000

unkown

page read and write

10016000

unkown image

page write copy

4970000

heap private

page read and write

2578000

unkown

page read and write

3AF000

unkown

page read and write

45E2000

unkown

page readonly

4589000

unkown

page readonly

1C9000

heap default

page read and write

2580000

unkown

page read and write

346000

unkown

page read and write

2490000

heap private

page read and write

394000

heap default

page read and write

44E2000

unkown

page readonly

4D6B000

unkown

page read and write

4582000

unkown

page readonly

1D00000

heap private

page read and write

2569000

unkown

page read and write

2730000

unkown

page readonly

2548000

unkown

page read and write

6B62000

unkown

page read and write

4569000

unkown

page readonly

2554000

unkown

page read and write

4DAB000

unkown

page read and write

4462000

unkown

page readonly

4D8A000

unkown

page read and write

211D000

unkown

page read and write

C60000

unkown

page readonly

25B0000

unkown

page read and write

4C80000

heap private

page read and write

10E000

heap default

page read and write

3B3000

unkown

page read and write

2B05000

heap private

page read and write

4E90000

heap private

page read and write

4B30000

heap private

page read and write

4BD0000

heap private

page read and write

4566000

unkown

page readonly

1F0000

heap private

page read and write

325B000

unkown

page read and write

4880000

heap private

page read and write

250000

heap default

page read and write

4D74000

unkown

page read and write

540000

heap private

page read and write

4282000

unkown

page readonly

2530000

unkown

page read and write

10000000

unkown image

page readonly

25AA000

unkown

page read and write

6D0000

unkown

page readonly

2C8E000

unkown

page read and write

2D00000

unkown

page read and write

4D8F000

unkown

page read and write

3600000

unkown

page readonly

4D79000

unkown

page read and write

4464000

unkown

page readonly

4512000

unkown

page readonly

239D000

unkown

page read and write

44C5000

unkown

page readonly

37D000

unkown

page read and write

2510000

unkown

page read and write

10015000

unkown image

page readonly

350000

unkown

page read and write

2760000

heap private

page read and write

4605000

unkown

page readonly

10001000

unkown image

page execute read

7DF77000

unkown

page read and write

16F000

heap default

page read and write

2528000

unkown

page read and write

6F52000

unkown

page readonly

5610000

heap private

page read and write

1FD000

heap private

page read and write

2524000

unkown

page read and write

2508000

unkown

page read and write

25C8000

unkown

page read and write

3E69000

heap private

page read and write

F80000

unkown

page readonly

346F000

unkown

page read and write

456D000

unkown

page readonly

5B3E000

unkown

page read and write

3470000

unkown

page readonly

2484000

heap private

page read and write

4525000

unkown

page readonly

27E0000

unkown

page readonly

306000

unkown

page read and write

2730000

unkown

page read and write

45B9000

unkown

page readonly

2600000

unkown

page readonly

310000

unkown

page read and write

4D0A000

unkown

page read and write

18E000

unkown

page read and write

398000

unkown

page read and write

5490000

heap private

page read and write

37E7000

unkown

page readonly

2538000

unkown

page read and write

1001D000

unkown image

page read and write

1001F000

unkown image

page readonly

254C000

unkown

page read and write

22C0000

unkown

page read and write

4D7B000

unkown

page read and write

2EFF000

unkown

page read and write

4442000

unkown

page readonly

240000

unkown

page execute and read and write

20000

unkown

page read and write

2730000

unkown

page read and write

2380000

unkown

page readonly

7DF74000

unkown

page read and write

23F0000

unkown

page read and write

26E0000

unkown

page read and write

870000

unkown

page readonly

4F10000

unkown

page read and write

5B44000

unkown

page readonly

2520000

unkown

page read and write

4D61000

unkown

page read and write

5310000

unkown

page readonly

2CFE000

unkown

page read and write

2544000

unkown

page read and write

4382000

unkown

page readonly

7DE70000

unkown

page read and write

2765000

heap private

page read and write

3E60000

heap private

page read and write

4D72000

unkown

page read and write

230000

unkown

page read and write

2588000

unkown

page read and write

2518000

unkown

page read and write

4BD4000

heap private

page read and write

23B0000

unkown

page read and write

3AF000

unkown

page read and write

257C000

unkown

page read and write

5623000

heap private

page read and write

25AD000

unkown

page read and write

30C0000

heap private

page read and write

252C000

unkown

page read and write

4D88000

unkown

page read and write

2559000

unkown

page read and write

239A000

unkown

page read and write

4D5E000

unkown

page read and write

4D82000

unkown

page read and write

550000

unkown

page readonly

19A000

heap default

page read and write

59AF000

unkown

page read and write

10028000

unkown image

page readonly

45B2000

unkown

page readonly

47F0000

unkown

page readonly

There are 228 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Registry

Memdumps