Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

http://covid-19.in.th/

URL

initial url

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\8120Q1N4\www.cloudflare[1].xml

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FBE078CF-E967-11EB-90E4-ECF4BB862DED}.dat

Microsoft Word Document

dropped

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FBE078D1-E967-11EB-90E4-ECF4BB862DED}.dat

Microsoft Word Document

dropped

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FBE078D2-E967-11EB-90E4-ECF4BB862DED}.dat

Microsoft Word Document

dropped

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\5xx-error-landing[1].htm

HTML document, UTF-8 Unicode text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ao-com[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\discord[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\e34df59b-4a48-4bf9-b2b5-7a4bb09cd231[1].json

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\en[1].json

UTF-8 Unicode text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\log-me-in[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\logo-cloudflare[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\mapbox[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\marketo[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\otBannerSdk[1].js

ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\otFlat[1].json

ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\5xx-error-screenshot[1].png

PNG image data, 3473 x 2127, 8-bit/color RGB, non-interlaced

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\api[1].js

UTF-8 Unicode text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\cookie-banner-close[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\crunchbase[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\favicon[1].ico

MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\library-of-congress[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\logo-cloudflare-dark[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\montecito[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\okcupid[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\trace[1].txt

ASCII text

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\udacity[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\zendesk[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\api[1].js

UTF-8 Unicode text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\application-ee0728fba2.min[1].css

UTF-8 Unicode text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\chunk-01f71c423e068664057e[1].js

UTF-8 Unicode text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\chunk-06380521ff19239efe05[1].js

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\chunk-1c4da1169909c3c43069[1].js

ASCII text, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\chunk-27eef9fa207b28718df2[1].js

ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\chunk-3125ea56e87c986b133e[1].js

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\chunk-55d37f7935d3778f0709[1].js

ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\chunk-5d677ef1b4eeb74635d3[1].js

UTF-8 Unicode text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\digital-ocean[1].svg

SVG Scalable Vector Graphics image

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\otPcCenter[1].json

ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-1560bda32b9d6d231e95[1].js

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-232ffa51e57f882f0534[1].js

UTF-8 Unicode text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-55ad6e1817237ece29a0[1].js

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-5c6ec7c6f9d0b6f9dd57[1].js

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-5f991135348b5b16cb1b[1].js

HTML document, UTF-8 Unicode text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-962e1864decb73b3a75a[1].js

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-cc3c9c6363f24544e951[1].js

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-cd8895b507ee9e702e17[1].js

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-e06d79a8c06c0d46865a[1].js

ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-e50bafad0559f7d0a0f0[1].js

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chunk-e6a0177c9a8b595a3dd2[1].js

UTF-8 Unicode text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\main[1].css

ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\otSDKStub[1].js

ASCII text, with very long lines

downloaded

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\runtime-6a16446847617098e330[1].js

ASCII text, with very long lines, with no line terminators

downloaded

C:\Users\user\AppData\Local\Temp\~DF57B235A356874BB7.TMP

data

dropped

C:\Users\user\AppData\Local\Temp\~DF64BF8B4AEFB55D6C.TMP

data

dropped

C:\Users\user\AppData\Local\Temp\~DFF8637F91E2C9D542.TMP

data

dropped

There are 47 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\internet explorer\iexplore.exe

'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2396
Target ID:	2
Parent PID:	792
Name:	iexplore.exe
Class:	iexplore
Path:	C:\Program Files\internet explorer\iexplore.exe
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Size:	823560
MD5:	6465CB92B25A7BC1DF8E01D8AC5E7596
Time:	07:37:18
Date:	20/07/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7bbc90000
Modulesize:	831488
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files (x86)\Internet Explorer\iexplore.exe

'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2396 CREDAT:17410 /prefetch:2

Details

Is windows:	true
Is dropped:	false
PID:	4800
Target ID:	3
Parent PID:	2396
Name:	iexplore.exe
Class:	iexplore
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2396 CREDAT:17410 /prefetch:2
Size:	822536
MD5:	071277CC2E3DF41EEEA8013E2AB58D5A
Time:	07:37:19
Date:	20/07/2021
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x200000
Modulesize:	827392
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://jquery.org/license

unknown

http://covid-19.in.th/

172.67.159.246

https://assets.www.cloudflare.com/js/chunk-01f71c423e068664057e.js

unknown

https://assets.www.cloudflare.com/js/chunk-232ffa51e57f882f0534.js

unknown

https://assets.www.cloudflare.com/js/chunk-1c4da1169909c3c43069.js

unknown

http://greensock.com/standard-license

unknown

http://jqueryui.com

unknown

https://assets.www.cloudflare.com/js/chunk-5d677ef1b4eeb74635d3.js

unknown

https://assets.www.cloudflare.com/js/chunk-55d37f7935d3778f0709.js

unknown

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

unknown

https://www.cloudflare.com/vendor/onetrust/scripttemplates/otSDKStub.js

unknown

https://github.com/polygonplanet/weakmap-polyfill

unknown

https://www.cloudflare.com/favicon.ico~

unknown

https://www.cloudflare.com/img/cf-facebook-card.png

unknown

http://schema.org/Article

unknown

http://covid-19.in.th/cdn-cgi/styles/main.css

172.67.159.246

http://schema.org

unknown

https://cdn.cookielaw.org/vendorlist/googleData.json

unknown

https://www.linkedin.com/company/cloudflare

unknown

https://assets.www.cloudflare.com/js/chunk-1560bda32b9d6d231e95.js

unknown

https://cdn.cookielaw.org/vendorlist/iabData.json

unknown

https://vimeo.com/api/oembed.json?url=

unknown

https://assets.www.cloudflare.com/js/chunk-55ad6e1817237ece29a0.js

unknown

http://covid-19.in.th/cdn-cgi/bm/cv/669835187/api.js

172.67.159.246

https://cdn.cookielaw.org/vendorlist/iab2Data.json

unknown

https://assets.www.cloudflare.com/js/chunk-06380521ff19239efe05.js

unknown

https://assets.www.cloudflare.com/js/chunk-cc3c9c6363f24544e951.js

unknown

https://www.cloudflare.com/img/cf-twitter-card.png

unknown

http://greensock.com

unknown

http://www.twitter.com/cloudflare

unknown

https://assets.www.cloudflare.com/js/chunk-962e1864decb73b3a75a.js

unknown

https://assets.www.cloudflare.com/js/chunk-e6a0177c9a8b595a3dd2.js

unknown

http://covid-19.in.th/N

unknown

https://assets.www.cloudflare.com/js/chunk-5c6ec7c6f9d0b6f9dd57.js

unknown

https://assets.www.cloudflare.com/css/application-ee0728fba2.min.css

unknown

https://github.com/imakewebthings/waypoints/blob/master/licenses.txt

unknown

http://getify.mit-license.org

unknown

https://assets.www.cloudflare.com/js/chunk-e06d79a8c06c0d46865a.js

unknown

https://github.com/antoinevastel/picasso-like-canvas-fingerprinting

unknown

http://api.jqueryui.com/category/ui-core/

unknown

http://covid-19.in.th/cdn-cgi/bm/cv/result?req_id=6719d64d08990eb7

172.67.159.246

https://www.cloudflare.com

unknown

https://assets.www.cloudflare.com/js/chunk-27eef9fa207b28718df2.js

unknown

http://covid-19.in.th/

http://covid-19.in.th/Root

unknown

https://assets.www.cloudflare.com/js/chunk-5f991135348b5b16cb1b.js

unknown

https://jquery.org/license

unknown

https://www.cloudflare.com/5xx-error-landing/

http://plus.google.com/

unknown

https://jquery.com/

unknown

https://assets.www.cloudflare.com/js/runtime-6a16446847617098e330.js

unknown

https://www.cloudflare.com/5xx-error-landing/

unknown

http://www.youtube.com/user/CloudflareTeam

unknown

https://www.cloudflare.com/favicon.ico

unknown

http://www.cloudflare.com

unknown

https://sizzlejs.com/

unknown

https://js.foundation/

unknown

https://assets.www.cloudflare.com/js/chunk-3125ea56e87c986b133e.js

unknown

https://assets.www.cloudflare.com/js/chunk-cd8895b507ee9e702e17.js

unknown

https://assets.www.cloudflare.com/js/chunk-e50bafad0559f7d0a0f0.js

unknown

There are 50 hidden URLs, click here to show them.

Domains

Name

Malicious

www.cloudflare.com

104.16.124.96

Details

Name:	www.cloudflare.com
IP:	104.16.124.96
TargetID:	3
Current Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

assets.www.cloudflare.com

104.16.124.96

Details

Name:	assets.www.cloudflare.com
IP:	104.16.124.96
TargetID:	3
Current Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

covid-19.in.th

172.67.159.246

Details

Name:	covid-19.in.th
IP:	172.67.159.246
TargetID:	3
Current Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

favicon.ico

unknown

IPs

Domain

Country

Malicious

172.67.159.246

covid-19.in.th

United States

Details

IP:	172.67.159.246
TargetID:	3
Current Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	covid-19.in.th

104.16.124.96

www.cloudflare.com

United States

Details

IP:	104.16.124.96
TargetID:	3
Current Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	www.cloudflare.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

C:\Program Files\internet explorer\iexplore.exe

{FBE078CF-E967-11EB-90E4-ECF4BB862DED}

C:\Program Files\internet explorer\iexplore.exe

AdminActive

C:\Program Files\internet explorer\iexplore.exe

Count

C:\Program Files\internet explorer\iexplore.exe

Time

C:\Program Files\internet explorer\iexplore.exe

Blocked

C:\Program Files\internet explorer\iexplore.exe

Count

C:\Program Files\internet explorer\iexplore.exe

Time

C:\Program Files\internet explorer\iexplore.exe

Count

C:\Program Files\internet explorer\iexplore.exe

Time

C:\Program Files\internet explorer\iexplore.exe

LoadTimeArray

C:\Program Files\internet explorer\iexplore.exe

LoadTimeArray

C:\Program Files\internet explorer\iexplore.exe

Count

C:\Program Files\internet explorer\iexplore.exe

Time

C:\Program Files\internet explorer\iexplore.exe

Blocked

C:\Program Files\internet explorer\iexplore.exe

Count

C:\Program Files\internet explorer\iexplore.exe

Time

C:\Program Files\internet explorer\iexplore.exe

LoadTimeArray

C:\Program Files\internet explorer\iexplore.exe

Count

C:\Program Files\internet explorer\iexplore.exe

Time

C:\Program Files\internet explorer\iexplore.exe

LoadTimeArray

C:\Program Files\internet explorer\iexplore.exe

DecayDateQueue

C:\Program Files\internet explorer\iexplore.exe

LastProcessed

C:\Program Files (x86)\Internet Explorer\iexplore.exe

@C:\Windows\System32\ieframe.dll,-912

C:\Program Files (x86)\Internet Explorer\iexplore.exe

@C:\Windows\System32\ieframe.dll,-903

C:\Program Files (x86)\Internet Explorer\iexplore.exe

NumberOfSubdomains

C:\Program Files (x86)\Internet Explorer\iexplore.exe

NULL

C:\Program Files (x86)\Internet Explorer\iexplore.exe

NULL

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Total

C:\Program Files (x86)\Internet Explorer\iexplore.exe

NULL

C:\Program Files (x86)\Internet Explorer\iexplore.exe

NULL

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Total

C:\Program Files (x86)\Internet Explorer\iexplore.exe

NULL

C:\Program Files (x86)\Internet Explorer\iexplore.exe

NULL

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Total

C:\Program Files (x86)\Internet Explorer\iexplore.exe

NULL

C:\Program Files (x86)\Internet Explorer\iexplore.exe

NULL

C:\Program Files (x86)\Internet Explorer\iexplore.exe

Total

There are 27 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

7FF5DA1BD000

unkown

page readonly

22003424000

unkown

page read and write

22003513000

unkown

page read and write

7FF5DA326000

unkown

page readonly

7FF5DA39E000

unkown

page readonly

7FF5DA2B8000

unkown

page readonly

7FF5EADD6000

unkown

page readonly

3E0F7FB000

unkown

page read and write

7FF5EAE04000

unkown

page readonly

22003A70000

unkown

page readonly

7FF5D9EB0000

unkown

page readonly

7FF5DA2E5000

unkown

page readonly

7FF5DA12F000

unkown

page readonly

3E0F29B000

unkown

page read and write

22003481000

unkown

page read and write

16266462000

unkown

page read and write

16266429000

unkown

page read and write

7FF5D9EA0000

unkown

page readonly

7FF5EAE00000

unkown

page readonly

7FF5EACA7000

unkown

page readonly

16266508000

unkown

page read and write

16266481000

unkown

page read and write

7FF5DA1E7000

unkown

page readonly

16266370000

unkown

page readonly

3E0F39E000

unkown

page read and write

7FF5DA0CA000

unkown

page readonly

7FF5DA2B2000

unkown

page readonly

7FF5DA1B3000

unkown

page readonly

944D6FE000

unkown

page read and write

7FF5EADF5000

unkown

page readonly

7FF5EAE61000

unkown

page readonly

7FF5EAC73000

unkown

page readonly

7FF5DA347000

unkown

page readonly

7FF5EAB8A000

unkown

page readonly

7FF5DA2F9000

unkown

page readonly

1626645B000

unkown

page read and write

7FF5EABEF000

unkown

page readonly

22003320000

heap default

page read and write

7FF5DA2CA000

unkown

page readonly

7FF5EAC58000

unkown

page readonly

7FF5DA344000

unkown

page readonly

7FF5EADAF000

unkown

page readonly

22003C02000

unkown

page read and write

7FF5EA95A000

unkown

page readonly

16266453000

unkown

page read and write

7FF5DA17A000

unkown

page readonly

7FF5DA2A2000

unkown

page readonly

7FF5EA970000

unkown

page readonly

16266E00000

unkown

page readonly

16266500000

unkown

page read and write

944D67B000

unkown

page read and write

16266400000

unkown

page read and write

7FF5EADE6000

unkown

page readonly

7FF5DA2A0000

unkown

page readonly

7FF5D9E9A000

unkown

page readonly

7FF5EA54E000

unkown

page readonly

7FF5EAD72000

unkown

page readonly

944DA77000

unkown

page read and write

7FF5EAD9E000

unkown

page readonly

944D97B000

unkown

page read and write

7FF5EAC3A000

unkown

page readonly

220039A0000

unkown

page readonly

7FF5DA31C000

unkown

page readonly

16266502000

unkown

page read and write

22003400000

unkown

page read and write

16266390000

unkown

page read and write

3E0F9FE000

unkown

page read and write

7FF5EAD78000

unkown

page readonly

7FF5EA960000

unkown

page readonly

7FF5DA3A1000

unkown

page readonly

7FF5EA981000

unkown

page readonly

2200343C000

unkown

page read and write

7FF5DA198000

unkown

page readonly

7FF5DA3A9000

unkown

page readonly

7FF5EAE69000

unkown

page readonly

7FF5DA2EF000

unkown

page readonly

7FF5DA2B6000

unkown

page readonly

7FF5EADDC000

unkown

page readonly

22003E00000

unkown

page readonly

16266380000

unkown

page readonly

1626645F000

unkown

page read and write

16266600000

unkown

page readonly

7FF5EACDC000

unkown

page readonly

22003447000

unkown

page read and write

7FF5EADCD000

unkown

page readonly

16266513000

unkown

page read and write

944D77E000

unkown

page read and write

7FF5EADA5000

unkown

page readonly

7FF5EADEC000

unkown

page readonly

22003600000

unkown

page readonly

1626645D000

unkown

page read and write

7FF5EAC2E000

unkown

page readonly

944D87C000

unkown

page read and write

7FF5DA32C000

unkown

page readonly

7FF5EAE07000

unkown

page readonly

7FF5DA21C000

unkown

page readonly

944DC7E000

unkown

page read and write

220032C0000

heap private

page read and write

162662A0000

unkown

page readonly

7FF5EAE5E000

unkown

page readonly

16266230000

heap private

page read and write

7FF5EADB9000

unkown

page readonly

7FF5D9EC1000

unkown

page readonly

7FF5EAD62000

unkown

page readonly

22003413000

unkown

page read and write

7FF5EACA1000

unkown

page readonly

944DB7F000

unkown

page read and write

7FF5DA1E1000

unkown

page readonly

3E0F6F5000

unkown

page read and write

3E0FAFF000

unkown

page read and write

7FF5DA2DE000

unkown

page readonly

16266460000

unkown

page read and write

7FF5EAE69000

unkown

page readonly

7FF5DA335000

unkown

page readonly

7FF5EAD76000

unkown

page readonly

16266A60000

unkown

page readonly

7FF5DA340000

unkown

page readonly

22003A80000

unkown

page read and write

16266C02000

unkown

page read and write

3E0F8F7000

unkown

page read and write

16266413000

unkown

page read and write

22003502000

unkown

page read and write

7FF5DA316000

unkown

page readonly

1626643C000

unkown

page read and write

3E0F31E000

unkown

page read and write

22003800000

unkown

page readonly

16266290000

heap default

page read and write

7FF5DA16E000

unkown

page readonly

7FF5EAD8A000

unkown

page readonly

1626645C000

unkown

page read and write

2200346F000

unkown

page read and write

7FF5DA30D000

unkown

page readonly

7FF5EAD60000

unkown

page readonly

22003330000

unkown

page readonly

7FF5DA3A9000

unkown

page readonly

There are 125 hidden memdumps, click here to show them.

DOM / HTML

URL

Malicious

https://www.cloudflare.com/5xx-error-landing/

http://covid-19.in.th/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

DOM / HTML