Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
draft_inv dec21.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\~DF91089FF9233BF8CB.TMP
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
 |
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\draft_inv dec21.exe
|
"C:\Users\user\Desktop\draft_inv dec21.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://statuswar.info/GHDFR/bin_rOlFDOAa61.bin
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2CA0000
|
unkown
|
page execute and read and write
|
|
|
|
104E647E000
|
unkown
|
page read and write
|
|
|
|
7FF5E52B4000
|
unkown image
|
page readonly
|
|
|
|
5AC0A7E000
|
stack
|
page read and write
|
|
|
|
104E6400000
|
unkown
|
page read and write
|
|
|
|
7FFC0000
|
unkown image
|
page readonly
|
|
|
|
8F93277000
|
stack
|
page read and write
|
|
|
|
7FF5C140F000
|
unkown image
|
page readonly
|
|
|
|
400000
|
unkown image
|
page readonly
|
|
|
|
2CF0000
|
unkown image
|
page read and write
|
|
|
|
7FF5C1157000
|
unkown image
|
page readonly
|
|
|
|
7FF5C1459000
|
unkown image
|
page readonly
|
|
|
|
104E6A60000
|
unkown image
|
page readonly
|
|
|
|
7FF5C0B1F000
|
unkown image
|
page readonly
|
|
|
|
7FF5C13EB000
|
unkown image
|
page readonly
|
|
|
|
421000
|
unkown image
|
page readonly
|
|
|
|
7FF5E5350000
|
unkown image
|
page readonly
|
|
|
|
2F837B000
|
stack
|
page read and write
|
|
|
|
41B000
|
unkown image
|
page execute read
|
|
|
|
104E6452000
|
unkown
|
page read and write
|
|
|
|
7FF5E524B000
|
unkown image
|
page readonly
|
|
|
|
104E6470000
|
unkown
|
page read and write
|
|
|
|
7DF50A220000
|
unkown image
|
page readonly
|
|
|
|
23307E60000
|
unkown
|
page read and write
|
|
|
|
8F92E7B000
|
unkown
|
page read and write
|
|
|
|
7DF5FA4C2000
|
unkown image
|
page readonly
|
|
|
|
21E0000
|
unkown image
|
page readonly
|
|
|
|
7FF4F4C85000
|
unkown image
|
page readonly
|
|
|
|
22554002000
|
unkown
|
page read and write
|
|
|
|
D80000
|
unkown image
|
page readonly
|
|
|
|
2F80FF000
|
stack
|
page read and write
|
|
|
|
7DF5D6570000
|
unkown image
|
page readonly
|
|
|
|
7FF4F50AA000
|
unkown image
|
page readonly
|
|
|
|
7FF4F50AE000
|
unkown image
|
page readonly
|
|
|
|
23307E59000
|
unkown
|
page read and write
|
|
|
|
7DF5FA4D2000
|
unkown image
|
page readonly
|
|
|
|
7FFB0000
|
unkown image
|
page readonly
|
|
|
|
23307D10000
|
unkown image
|
page readonly
|
|
|
|
2255382C000
|
unkown
|
page read and write
|
|
|
|
7DF5D6570000
|
unkown image
|
page readonly
|
|
|
|
7DF5D6552000
|
unkown image
|
page readonly
|
|
|
|
7DF50A232000
|
unkown image
|
page readonly
|
|
|
|
7FF5E529D000
|
unkown image
|
page readonly
|
|
|
|
22553D80000
|
unkown image
|
page readonly
|
|
|
|
98000
|
unkown
|
page read and write
|
|
|
|
7FF5E4F10000
|
unkown image
|
page readonly
|
|
|
|
7FF4F4FFD000
|
unkown image
|
page readonly
|
|
|
|
7FF5E543A000
|
unkown image
|
page readonly
|
|
|
|
7FF5C1283000
|
unkown image
|
page readonly
|
|
|
|
7FF4F4C70000
|
unkown image
|
page readonly
|
|
|
|
23307C00000
|
unkown image
|
page readonly
|
|
|
|
7FF4F50B0000
|
unkown image
|
page readonly
|
|
|
|
2255386F000
|
unkown
|
page read and write
|
|
|
|
7FF4F50BB000
|
unkown image
|
page readonly
|
|
|
|
7FF4F5118000
|
unkown image
|
page readonly
|
|
|
|
7DF50A222000
|
unkown image
|
page readonly
|
|
|
|
2F807B000
|
unkown
|
page read and write
|
|
|
|
7FF4F50B5000
|
unkown image
|
page readonly
|
|
|
|
2220000
|
unkown
|
page read and write
|
|
|
|
104E6459000
|
unkown
|
page read and write
|
|
|
|
2255387B000
|
unkown
|
page read and write
|
|
|
|
7FF4F48E8000
|
unkown image
|
page readonly
|
|
|
|
104E6508000
|
unkown
|
page read and write
|
|
|
|
7FF5C1417000
|
unkown image
|
page readonly
|
|
|
|
104E644D000
|
unkown
|
page read and write
|
|
|
|
7DF5FA4C0000
|
unkown image
|
page readonly
|
|
|
|
7DF5FA4C0000
|
unkown image
|
page readonly
|
|
|
|
7FFD0000
|
unkown image
|
page readonly
|
|
|
|
104E6502000
|
unkown
|
page read and write
|
|
|
|
2240000
|
unkown
|
page read and write
|
|
|
|
8F92EFE000
|
stack
|
page read and write
|
|
|
|
104E6455000
|
unkown
|
page read and write
|
|
|
|
23307F08000
|
unkown
|
page read and write
|
|
|
|
7FF5E534E000
|
unkown image
|
page readonly
|
|
|
|
104E6413000
|
unkown
|
page read and write
|
|
|
|
7FF4F50C7000
|
unkown image
|
page readonly
|
|
|
|
22553900000
|
unkown
|
page read and write
|
|
|
|
7FF4F4C76000
|
unkown image
|
page readonly
|
|
|
|
2980000
|
unkown
|
page read and write
|
|
|
|
7DF5FA4E0000
|
unkown image
|
page readonly
|
|
|
|
22553690000
|
unkown image
|
page readonly
|
|
|
|
23308200000
|
unkown image
|
page readonly
|
|
|
|
7FF5E53C6000
|
unkown image
|
page readonly
|
|
|
|
104E6458000
|
unkown
|
page read and write
|
|
|
|
7FF5E50C7000
|
unkown image
|
page readonly
|
|
|
|
7DF5FA4C2000
|
unkown image
|
page readonly
|
|
|
|
7FF5C13CA000
|
unkown image
|
page readonly
|
|
|
|
7FEB0000
|
unkown image
|
page readonly
|
|
|
|
7FF5C13E5000
|
unkown image
|
page readonly
|
|
|
|
40000
|
unkown image
|
page readonly
|
|
|
|
7DF5D6550000
|
unkown image
|
page readonly
|
|
|
|
23307E80000
|
unkown
|
page read and write
|
|
|
|
2200000
|
heap private
|
page read and write
|
|
|
|
7FF4F51A1000
|
unkown image
|
page readonly
|
|
|
|
7DF5D6552000
|
unkown image
|
page readonly
|
|
|
|
471000
|
heap default
|
page read and write
|
|
|
|
7FF5E533A000
|
unkown image
|
page readonly
|
|
|
|
23307E66000
|
unkown
|
page read and write
|
|
|
|
7FF5C140C000
|
unkown image
|
page readonly
|
|
|
|
23307E5A000
|
unkown
|
page read and write
|
|
|
|
7DF5D6550000
|
unkown image
|
page readonly
|
|
|
|
22553680000
|
unkown image
|
page readonly
|
|
|
|
23308390000
|
unkown
|
page read and write
|
|
|
|
7FF4F4FAE000
|
unkown image
|
page readonly
|
|
|
|
2B00000
|
heap private
|
page read and write
|
|
|
|
7FF5C1456000
|
unkown image
|
page readonly
|
|
|
|
7DF50A220000
|
unkown image
|
page readonly
|
|
|
|
104E68E0000
|
unkown image
|
page readonly
|
|
|
|
5AC0AFF000
|
stack
|
page read and write
|
|
|
|
23307BE0000
|
unkown image
|
page readonly
|
|
|
|
7FF5C12A1000
|
unkown image
|
page readonly
|
|
|
|
401000
|
unkown image
|
page execute read
|
|
|
|
7FF5E52A3000
|
unkown image
|
page readonly
|
|
|
|
7FF5E5211000
|
unkown image
|
page readonly
|
|
|
|
7FF4F50DF000
|
unkown image
|
page readonly
|
|
|
|
22553660000
|
unkown image
|
page readonly
|
|
|
|
7FF5C13F7000
|
unkown image
|
page readonly
|
|
|
|
7FFC2000
|
unkown image
|
page readonly
|
|
|
|
7FF4F510F000
|
unkown image
|
page readonly
|
|
|
|
7FF5C14D1000
|
unkown image
|
page readonly
|
|
|
|
7FF4F48E2000
|
unkown image
|
page readonly
|
|
|
|
401000
|
unkown image
|
page execute read
|
|
|
|
22553C00000
|
unkown image
|
page readonly
|
|
|
|
7FF5C1434000
|
unkown image
|
page readonly
|
|
|
|
23308000000
|
unkown image
|
page readonly
|
|
|
|
22553850000
|
unkown
|
page read and write
|
|
|
|
7FF4F509C000
|
unkown image
|
page readonly
|
|
|
|
7FF4F4FAB000
|
unkown image
|
page readonly
|
|
|
|
104E66D0000
|
unkown image
|
page readonly
|
|
|
|
7FF5E4B88000
|
unkown image
|
page readonly
|
|
|
|
7FF5C134C000
|
unkown image
|
page readonly
|
|
|
|
22553A00000
|
unkown image
|
page readonly
|
|
|
|
7FF5C145D000
|
unkown image
|
page readonly
|
|
|
|
7FF5E51A1000
|
unkown image
|
page readonly
|
|
|
|
23308402000
|
unkown
|
page read and write
|
|
|
|
7DF50A240000
|
unkown image
|
page readonly
|
|
|
|
7FF5C0FA6000
|
unkown image
|
page readonly
|
|
|
|
2B10000
|
unkown
|
page read and write
|
|
|
|
7FF5E537C000
|
unkown image
|
page readonly
|
|
|
|
7FF4F5014000
|
unkown image
|
page readonly
|
|
|
|
104E6450000
|
unkown
|
page read and write
|
|
|
|
7FF5E53CD000
|
unkown image
|
page readonly
|
|
|
|
22553640000
|
unkown image
|
page read and write
|
|
|
|
23307F13000
|
unkown
|
page read and write
|
|
|
|
7FF4F4F01000
|
unkown image
|
page readonly
|
|
|
|
7FF5C0FA0000
|
unkown image
|
page readonly
|
|
|
|
7FF5C1448000
|
unkown image
|
page readonly
|
|
|
|
23308380000
|
unkown image
|
page readonly
|
|
|
|
40000
|
unkown image
|
page readonly
|
|
|
|
7FF5C13DE000
|
unkown image
|
page readonly
|
|
|
|
104E643C000
|
unkown
|
page read and write
|
|
|
|
400000
|
unkown image
|
page readonly
|
|
|
|
7FF5E5394000
|
unkown image
|
page readonly
|
|
|
|
C00000
|
unkown image
|
page readonly
|
|
|
|
7FF5C1333000
|
unkown image
|
page readonly
|
|
|
|
23307BE0000
|
unkown image
|
page readonly
|
|
|
|
7FF5C1424000
|
unkown image
|
page readonly
|
|
|
|
23307BC0000
|
unkown image
|
page read and write
|
|
|
|
23307E3C000
|
unkown
|
page read and write
|
|
|
|
7FF5E524E000
|
unkown image
|
page readonly
|
|
|
|
7FF5E5367000
|
unkown image
|
page readonly
|
|
|
|
104E644F000
|
unkown
|
page read and write
|
|
|
|
7DF5D6560000
|
unkown image
|
page readonly
|
|
|
|
2210000
|
unkown image
|
page readonly
|
|
|
|
2F8477000
|
stack
|
page read and write
|
|
|
|
22553660000
|
unkown image
|
page readonly
|
|
|
|
22553650000
|
heap private
|
page read and write
|
|
|
|
7FF5C1231000
|
unkown image
|
page readonly
|
|
|
|
7FF4F512D000
|
unkown image
|
page readonly
|
|
|
|
7FF5E539A000
|
unkown image
|
page readonly
|
|
|
|
7DF50A230000
|
unkown image
|
page readonly
|
|
|
|
104E68D0000
|
unkown image
|
page readonly
|
|
|
|
2F857E000
|
stack
|
page read and write
|
|
|
|
104E6457000
|
unkown
|
page read and write
|
|
|
|
A00000
|
unkown image
|
page readonly
|
|
|
|
5AC0DF7000
|
stack
|
page read and write
|
|
|
|
22553813000
|
unkown
|
page read and write
|
|
|
|
7FF5C12DE000
|
unkown image
|
page readonly
|
|
|
|
430000
|
unkown image
|
page readonly
|
|
|
|
7DF5D6560000
|
unkown image
|
page readonly
|
|
|
|
7FF5C14CA000
|
unkown image
|
page readonly
|
|
|
|
23307E53000
|
unkown
|
page read and write
|
|
|
|
104E644C000
|
unkown
|
page read and write
|
|
|
|
7FF5E53AF000
|
unkown image
|
page readonly
|
|
|
|
22553908000
|
unkown
|
page read and write
|
|
|
|
7FF5E533C000
|
unkown image
|
page readonly
|
|
|
|
19C000
|
unkown
|
page read and write
|
|
|
|
2230000
|
heap private
|
page read and write
|
|
|
|
225536B0000
|
heap default
|
page read and write
|
|
|
|
104E6C02000
|
unkown
|
page read and write
|
|
|
|
7FF5E534A000
|
unkown image
|
page readonly
|
|
|
|
7FF5E53B8000
|
unkown image
|
page readonly
|
|
|
|
D90000
|
unkown image
|
page readonly
|
|
|
|
7FF5E5100000
|
unkown image
|
page readonly
|
|
|
|
7DF4080F0000
|
unkown image
|
page readonly
|
|
|
|
400000
|
unkown image
|
page readonly
|
|
|
|
7FF5E5441000
|
unkown image
|
page readonly
|
|
|
|
7FF5E4F25000
|
unkown image
|
page readonly
|
|
|
|
23307E29000
|
unkown
|
page read and write
|
|
|
|
7FFC0000
|
unkown image
|
page readonly
|
|
|
|
7FF4F4E27000
|
unkown image
|
page readonly
|
|
|
|
440000
|
unkown
|
page read and write
|
|
|
|
7FF4F509A000
|
unkown image
|
page readonly
|
|
|
|
7FF4F4F53000
|
unkown image
|
page readonly
|
|
|
|
7FFB2000
|
unkown image
|
page readonly
|
|
|
|
8F92F7E000
|
stack
|
page read and write
|
|
|
|
104E63A0000
|
unkown image
|
page readonly
|
|
|
|
7FF5C13E0000
|
unkown image
|
page readonly
|
|
|
|
104E6454000
|
unkown
|
page read and write
|
|
|
|
5AC0FFE000
|
stack
|
page read and write
|
|
|
|
7FF5C143F000
|
unkown image
|
page readonly
|
|
|
|
34D000
|
unkown
|
page read and write
|
|
|
|
21B0000
|
heap private
|
page read and write
|
|
|
|
23307E00000
|
unkown
|
page read and write
|
|
|
|
7DF4D4420000
|
unkown image
|
page readonly
|
|
|
|
7FF5E53A4000
|
unkown image
|
page readonly
|
|
|
|
104E63D0000
|
unkown image
|
page readonly
|
|
|
|
7FF4F4E60000
|
unkown image
|
page readonly
|
|
|
|
23307F02000
|
unkown
|
page read and write
|
|
|
|
22553829000
|
unkown
|
page read and write
|
|
|
|
23307E13000
|
unkown
|
page read and write
|
|
|
|
7FFB2000
|
unkown image
|
page readonly
|
|
|
|
7DF5FA4E0000
|
unkown image
|
page readonly
|
|
|
|
7FF5C0FB5000
|
unkown image
|
page readonly
|
|
|
|
41F000
|
unkown image
|
page read and write
|
|
|
|
23307C10000
|
unkown image
|
page readonly
|
|
|
|
22553902000
|
unkown
|
page read and write
|
|
|
|
7FF5C12C1000
|
unkown image
|
page readonly
|
|
|
|
450000
|
heap default
|
page read and write
|
|
|
|
41B000
|
unkown image
|
page execute read
|
|
|
|
104E6380000
|
unkown image
|
page read and write
|
|
|
|
5AC0CFB000
|
stack
|
page read and write
|
|
|
|
23307BD0000
|
heap private
|
page read and write
|
|
|
|
104E6429000
|
unkown
|
page read and write
|
|
|
|
30000
|
unkown image
|
page read and write
|
|
|
|
7FF4F5104000
|
unkown image
|
page readonly
|
|
|
|
22553800000
|
unkown
|
page read and write
|
|
|
|
7FF5C132D000
|
unkown image
|
page readonly
|
|
|
|
7FF4F50F4000
|
unkown image
|
page readonly
|
|
|
|
7DF5D6562000
|
unkown image
|
page readonly
|
|
|
|
7DF5FA4D0000
|
unkown image
|
page readonly
|
|
|
|
7DF50A230000
|
unkown image
|
page readonly
|
|
|
|
7FF5C1190000
|
unkown image
|
page readonly
|
|
|
|
2B90000
|
unkown image
|
page readonly
|
|
|
|
1F0000
|
unkown
|
page read and write
|
|
|
|
22553913000
|
unkown
|
page read and write
|
|
|
|
5A0000
|
heap default
|
page read and write
|
|
|
|
7FF5C142A000
|
unkown image
|
page readonly
|
|
|
|
7FF5E5231000
|
unkown image
|
page readonly
|
|
|
|
104E63A0000
|
unkown image
|
page readonly
|
|
|
|
7FFB0000
|
unkown image
|
page readonly
|
|
|
|
22553790000
|
unkown image
|
page readonly
|
|
|
|
23307E80000
|
unkown
|
page read and write
|
|
|
|
7FF5E4F16000
|
unkown image
|
page readonly
|
|
|
|
104E6513000
|
unkown
|
page read and write
|
|
|
|
7DF5D6562000
|
unkown image
|
page readonly
|
|
|
|
7FF5E5387000
|
unkown image
|
page readonly
|
|
|
|
7FF4F4F71000
|
unkown image
|
page readonly
|
|
|
|
8F9347E000
|
stack
|
page read and write
|
|
|
|
7FF4F511E000
|
unkown image
|
page readonly
|
|
|
|
23307E82000
|
unkown
|
page read and write
|
|
|
|
7DF5FA4D0000
|
unkown image
|
page readonly
|
|
|
|
7FFD0000
|
unkown image
|
page readonly
|
|
|
|
7FF4F5003000
|
unkown image
|
page readonly
|
|
|
|
7FF5C1344000
|
unkown image
|
page readonly
|
|
|
|
2F867F000
|
stack
|
page read and write
|
|
|
|
23307F00000
|
unkown
|
page read and write
|
|
|
|
7FFC2000
|
unkown image
|
page readonly
|
|
|
|
22553855000
|
unkown
|
page read and write
|
|
|
|
45A000
|
heap default
|
page read and write
|
|
|
|
23307C30000
|
heap default
|
page read and write
|
|
|
|
104E644B000
|
unkown
|
page read and write
|
|
|
|
104E63F0000
|
heap default
|
page read and write
|
|
|
|
7DF5FA4D2000
|
unkown image
|
page readonly
|
|
|
|
421000
|
unkown image
|
page readonly
|
|
|
|
7FF5E4B82000
|
unkown image
|
page readonly
|
|
|
|
7FF4F519A000
|
unkown image
|
page readonly
|
|
|
|
7FF4F5126000
|
unkown image
|
page readonly
|
|
|
|
2B09000
|
heap private
|
page read and write
|
|
|
|
7FF5E53C9000
|
unkown image
|
page readonly
|
|
|
|
2C50000
|
unkown image
|
page readonly
|
|
|
|
7FF4F50DC000
|
unkown image
|
page readonly
|
|
|
|
8F9357F000
|
stack
|
page read and write
|
|
|
|
7DF50A232000
|
unkown image
|
page readonly
|
|
|
|
23307E8C000
|
unkown
|
page read and write
|
|
|
|
7FF5E53BE000
|
unkown image
|
page readonly
|
|
|
|
5AC078C000
|
unkown
|
page read and write
|
|
|
|
104E6488000
|
unkown
|
page read and write
|
|
|
|
104E6B50000
|
unkown
|
page read and write
|
|
|
|
2A80000
|
unkown image
|
page read and write
|
|
|
|
104E63C0000
|
unkown image
|
page readonly
|
|
|
|
349000
|
unkown
|
page read and write
|
|
|
|
7FF4F501C000
|
unkown image
|
page readonly
|
|
|
|
7FF5C14D2000
|
unkown image
|
page readonly
|
|
|
|
7FF5E537F000
|
unkown image
|
page readonly
|
|
|
|
7DF4F8390000
|
unkown image
|
page readonly
|
|
|
|
7FF5E52BC000
|
unkown image
|
page readonly
|
|
|
|
7DF50A240000
|
unkown image
|
page readonly
|
|
|
|
21D0000
|
unkown
|
page read and write
|
|
|
|
7FF4F4F91000
|
unkown image
|
page readonly
|
|
|
|
2255383C000
|
unkown
|
page read and write
|
|
|
|
8F9317B000
|
stack
|
page read and write
|
|
|
|
7FF4F5129000
|
unkown image
|
page readonly
|
|
|
|
7FF5C12DB000
|
unkown image
|
page readonly
|
|
|
|
104E6447000
|
unkown
|
page read and write
|
|
|
|
5AC0EFC000
|
stack
|
page read and write
|
|
|
|
7FF5C14C4000
|
unkown image
|
page readonly
|
|
|
|
104E6446000
|
unkown
|
page read and write
|
|
|
|
7DF50A222000
|
unkown image
|
page readonly
|
|
|
|
7FF4F5194000
|
unkown image
|
page readonly
|
|
|
|
2F817F000
|
stack
|
page read and write
|
|
|
|
7FF4F50FA000
|
unkown image
|
page readonly
|
|
|
|
7FF4F50E7000
|
unkown image
|
page readonly
|
|
|
|
2204000
|
heap private
|
page read and write
|
|
|
|
2CE0000
|
heap private
|
page read and write
|
|
|
|
7FF5C13CC000
|
unkown image
|
page readonly
|
|
|
|
23307E02000
|
unkown
|
page read and write
|
|
|
|
7FF5E5442000
|
unkown image
|
page readonly
|
|
|
|
8F9337F000
|
stack
|
page read and write
|
|
|
|
7FF5C13DA000
|
unkown image
|
page readonly
|
|
|
|
590000
|
unkown
|
page execute read
|
|
|
|
7FF4F51A2000
|
unkown image
|
page readonly
|
|
|
|
7FF5E51F3000
|
unkown image
|
page readonly
|
|
|
|
104E6500000
|
unkown
|
page read and write
|
|
|
|
104E6390000
|
heap private
|
page read and write
|
|
|
|
7FF5E5355000
|
unkown image
|
page readonly
|
|
|
|
7FF5E535B000
|
unkown image
|
page readonly
|
|
|
|
1A0000
|
unkown image
|
page readonly
|
|
|
|
7FF5C144E000
|
unkown image
|
page readonly
|
|
|
|
22553885000
|
unkown
|
page read and write
|
|
|
|
7FF5E5434000
|
unkown image
|
page readonly
|
|
|
|
225537B0000
|
unkown
|
page read and write
|
|
There are 322 hidden memdumps, click here to show them.