Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\171429109375b3b920cee552fad739e9c4a7f13922ed9d66bf32a3993fab5b757bcc601074656.dat-decoded.exe

"C:\Users\user\Desktop\171429109375b3b920cee552fad739e9c4a7f13922ed9d66bf32a3993fab5b757bcc601074656.dat-decoded.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2260
Target ID:	0
Parent PID:	2580
Name:	171429109375b3b920cee552fad739e9c4a7f13922ed9d66bf32a3993fab5b757bcc601074656.dat-decoded.exe
Path:	C:\Users\user\Desktop\171429109375b3b920cee552fad739e9c4a7f13922ed9d66bf32a3993fab5b757bcc601074656.dat-decoded.exe
Commandline:	"C:\Users\user\Desktop\171429109375b3b920cee552fad739e9c4a7f13922ed9d66bf32a3993fab5b757bcc601074656.dat-decoded.exe"
Size:	34304
MD5:	D80A57C22C976DD67CB96F64E009E923
Time:	09:59:54
Date:	28/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x320000
Modulesize:	57344
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected XWorm	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Sample uses string decryption to hide its real strings	AV Detection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///

Details

Is windows:	true
Is dropped:	false
PID:	7148
Target ID:	1
Parent PID:	3756
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:00:00
Date:	28/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/

Details

Is windows:	true
Is dropped:	false
PID:	6968
Target ID:	2
Parent PID:	3756
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:00:00
Date:	28/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 --field-trial-handle=2496,i,13517212685356134340,2370661816050994569,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	7480
Target ID:	4
Parent PID:	7148
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 --field-trial-handle=2496,i,13517212685356134340,2370661816050994569,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:00:00
Date:	28/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1124 --field-trial-handle=2028,i,13329251012211762179,12573226295212013179,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	7620
Target ID:	5
Parent PID:	6968
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1124 --field-trial-handle=2028,i,13329251012211762179,12573226295212013179,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	10:00:01
Date:	28/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

nmds.duckdns.org

https://www.google.com/async/ddljson?async=ntp:2

172.253.115.147

https://play.google.com/log?format=json&hasfast=true

unknown

http://www.broofa.com

unknown

https://csp.withgoogle.com/csp/lcreport/

unknown

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0

172.253.122.102

https://www.google.com/async/newtab_promos

172.253.115.147

https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

172.253.115.147

https://apis.google.com

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1

unknown

https://domains.google.com/suggest/flow

unknown

https://clients6.google.com

unknown

https://plus.google.com

unknown

There are 4 hidden URLs, click here to show them.

Domains

Name

Malicious

nmds.duckdns.org

87.121.105.4

Details

Name:	nmds.duckdns.org
IP:	87.121.105.4
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Snort IDS alert for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Sample uses string decryption to hide its real strings	AV Detection
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

google.com

172.253.63.100

Details

Name:	google.com
IP:	172.253.63.100
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

plus.l.google.com

172.253.122.102

www.google.com

172.253.115.147

Details

Name:	www.google.com
IP:	172.253.115.147
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

apis.google.com

unknown

Details

Name:	apis.google.com
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

192.168.2.4

unknown

Details

IP:	192.168.2.4
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Private:	true

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Uses secure TLS version for HTTPS connections	Compliance, Networking

87.121.105.4

nmds.duckdns.org

Bulgaria

Details

IP:	87.121.105.4
TargetID:	0
Current Path:	C:\Users\user\Desktop\171429109375b3b920cee552fad739e9c4a7f13922ed9d66bf32a3993fab5b757bcc601074656.dat-decoded.exe
Country:	Bulgaria
Countrycode:	BGR
ASN number:	43561
ASN name:	NET1-ASBG
Private:	false
Domain:	nmds.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

172.253.122.102

plus.l.google.com

United States

239.255.255.250

unknown

Reserved

172.253.115.147

www.google.com

United States

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\082C2C722F273426B981

4DA7B92DD81FF96931AA9012EABAA0878D13C78DC3CD840B102CE7E15FEC4B7B

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\082C2C722F273426B981
Value name:	4DA7B92DD81FF96931AA9012EABAA0878D13C78DC3CD840B102CE7E15FEC4B7B
Value data:	00 6E 00 00 1F 8B 08 00 00 00 00 00 04 00 ED 7D 69 60 1C D5 91 70 75 CF D5 33 23 8D D4 33 D2 48 96 25 6B 7C E1 B1 75 20 59 92 2D 59 80 AD D3 16 58 B6 B0 7C 81 01 7B 34 6A CB 03 A3 69 D1 33 B2 2D 0E 47 E2 48 30 18 12 93 80 17 43 36 9C 09 4E 02 81 40 20 84 90 D8 5C 81 10 02 E4 36 21 5E 58 72 40 B2 D9 40 12 B2 4B 48 CC 57 55 AF 7B 0E 49 06 76 BF FD BE FC D9 B1 BB BA AA 5E BD 7A F5 EA D5 AB F7 FA F5 8C DD 7B F6 A7 C0 06 00 76 BC DE 7F 1F E0 EB 20 3E 2B E0 C3 3F E3 78 F9 2A BF E1 83 07 DD CF CF FE BA B4 FA F9 D9 EB 77 C4 92 A1 11 43 1F 32 22 C3 A1 68 24 91 D0 53 A1 01 2D 64 8C 26 42 B1 44 A8 73 6D 7F 68 58 1F D4 6A F3 F3 3D F3 4C 1D 7D 5D 00 AB 25 1B FC D4 FD 4A D4 D2 FB 2A CC 09 79 A5 3E 80 ED 48 38 05 EF AF 57 20 08 E1 75 2B 93 85 8C CB C2 6E 80 CC 1D 2B 33 9F 3E 36 58 71 25 89 D2 DF CC 3D 7D E3 CF DD A8 77 2D 08 BD 57 D9 A6 E9 E4 61 80 BC 8F E0 8B 29 1F B4 4F C9 22 15 A4 57 65 D1 B5 29 6D 77 8A 10 4D C8 72 5F E5 29 2A B6 D5 1A 49 83 1C C3 B6 A1 8D DC D1 1D B9 72 2B F0 6F AD A1 C5 F5 A8 69 EB 61 53 57 7C 8A 5C FB 64 33 5F B9 42 DC 57 71 15 07 7C FD 74 80 E6 16 00 C9 2C 7F EB F2 4C 4C 7C 94 CF 2C 39 3C 0B C0 B3 E8 24 90 C3 95 88 C0 A2 CF 27 B1 1F 9E 71 54 68 4F CE 26 8C 46 2D 39 87 30 1B 61 73 09 C3 5E D9 17 05 EA 24 1E 1B 14 55 61 0F 55 D0 31 4C 3C 9E 2A 70 A6 CB 64 2E 23 15 FA FC C9 65 36 2E 23 A5 FA 49 93 CB EC 5C 46 CD E8 0B 32 65 32 9C 82 65 0E 2E 43 68 2F 0A 87 B1 D0 EB AA 9E 6D 60 F3 23 2F 22 4F 0E 2F 44 96 BE 08 41 B2 0A 41 9E 32 EE 60 75 5C 21 DD 86 17 38 54 51 8F D3 62 CF 01 79 9C 88 45 1B 93 38 2A CE 70 35 D6 4E 21 43 1E 77 11 17 3D 55 43 9E 02 B0 EA BB B8 BE CB AA 9F CB 0F E7 A3 0E E6 3F 54 74 DC 59 8C 44 B2 96 6C 3A 99 DC A7 90 ED C7 9D 65 B9 5C B7 D9 4C 9D 68 06 66 62 7F 37 01 C7 A5 4A 66 78 B0 DC 36 8E 2D D8 ED E3 A8 DD EE 18 47 3B ED 3E FB B8 0F 6F 7B 48 A7 5E 4F 43 B8 C7 9D 46 8F CD 9C 1F 5E 4C 2E 02 97 DE 80 F7 70 23 71 C3 4D 08 8F 01 D9 2C F1 E4 92 28 86 66 E2 C8 4A 57 07 C7 0B B0 76 F0 FC 71 95 06 7B 09 D9 15 20 F5 D4 E0 78 11 59 88 76 B9 E0 07 58 CB 4D 76 95 96 94 27 97 92 14 2A B2 17 8B 6A 25 D7 E2 14 95 C6 FD B9 1A 48 20 04 CF 00 E8 CD 6C 65 86 6E 21 5A 30 F6 50 27 F7 50 1F C3 CB 68 1C 5B A9 A8 84 6D 32 D0 BE 91 3D 64 42 18 A3 C0 B3 C7 67 61 E1 53 09 94 D2 80 0A 1D D4 70 90 E1 75 B1 20 FA 39 48 7E 3E 8D EA 50 B1 BE 1C B1 93 8E 15 0B CF A0 37 66 50 4D CB 27 E8 78 E1 93 D3 E1 C2 47 A1 98 7C 42 FD 7D 4B 62 1B 71 BC D9 3D C7 25 8F B3 DA 29 6A 9A 96 CB FA 0A 8E C5 E0 71 39 4F 69 D9 85 F2 7B 54 76 C9 71 29 DF DD F2 08 89 B1 5D FB B1 72 C0 AE DA 5B F6 11 8B 3C A3 B7 91 FD 61 8A B9 76 F2 16 55 13 05 1D D4 68 96 0B 55 1E 1A AC EF 50 1D D5 4B 4C 6F 7F F4 3E FF A2 86 D2 04 6B 29 39 FF E5 87 4B 7E 92 19 27 A8 2A 12 C6 98 46 EA 9D DC 5F 68 FE 12 58 66 8A 12 97 DE C5 A3 C7 F6 75 93 7E 52 87 26 39 55 67 F5 79 7B 30 77 D8 AB 5D 7C AB 0A EE A9 A4 22 E7 69 64 CA 4A 14 9D 3F 1E 4A 77 8D FB BC 8A AC B2 BA 31 5D 8F 4B B2 2D 9C 23 4C CF 34 FD F2 94 5E 00 54 B9 CD 01 3D D6 F1 5F 08 86 A0 08 86 80 2B 27 1A 24 58 D4 56 2E F2 24 86 1D 3C 89 DE FB 19 5E A8 01 44 5C C8 10 B6 E6 01 26 9E 10 37 3B D3 8A 2B E7 34 33 6E 91 35 DF 70 46 CE 14 3A 1C F0 69 E4 78 59 87 E8 B9 47 0E 2F A0 60 C0 44 E6 F4 BA AE 8B 85 7B 90 69 60 8A 18 09 9F 4E 1A A9 30 CF A9 04 95 EB 62 62 30 9C AE A0 CB C2 B9 57 C5 25 FA 19 D4 2F 26 9C EC EB A0 93 5D F6 70 50 5F CD 3D CE 03 67 B5 CB A9 F7 52 9D 57 AC C9 90 3F 65 32 48 E5 94 C3 DD A0 25 AC 65 55 82 8B 2F B1 E6 85 0C 4F 03 AF 61 2A 88 BC 21 9A D7 D7 A4 2D D1 D7 66 A7 A1 E9 9D 62 06 53 5F 26 AE 3A 3E 3C 77 81 48 78 67 66 4B E6 81 32 AD A4 7B 8A 64 3E B8 A7 1B 1D EC 54 23 70 06 9F 11 12 E3 03 B8 E2 CC D8 60 E1 17 82 EF 63 16 7E 33 F8 0E 65 C6 F0 59 AC 95 4F 7E 68 7E 14 B1 50 DD 28 40 78 5D 26 AD E9 FD D4 7B 67 CB E5 60 0D B2 D7 68 A0 01 4D 0F 74 9E 32 FD 40 E7 BB DC 41 B7 35 B8 AE AC 41 9F 3A D0 2E 31 D0 AE 9C 81 0E AF E7 7E E7 81 AB DA E5 32 87 1B 20 1D F0 F6 49 23 0E 25 01 47 F3 A9 EF D3 D6 D2 1C FB 45 A0 DF 64 8D BD 0A FF 74 08 82 D4 E7 EB 45 22 DE 40 13 B5 98 B0 8D 64 FA 72 CB F4 F1 12 5A 29 E6 EC 09 52 1E 80 45 8B 65 21 19 34 D7 0F 05 9C 38 CE 3E 73 DE 2C 22 1F 50 FA DB C3 9A 28 9B 17 07 C3 9B 44 BC 04 0F 7A 5D 64 2A 3A 28 D4 BF FB 21 A3 FD 2D 5A 11 43 BF BA 7D 57 57 53 4A 09 19 EE DA D6 A6 45 4A E8 FC 35 FF 1E 6A AD C6 04 50 85 85 CD 77 1D 3E A9 B5 55 16 04 49 B4 5E 87 BB 8C E6 95 7E AA F9 DB B1 73 57 34 55 28 A1 81 E2 F9 CB 5B B7 D9 84 10 31 5B EF C7 51 6D 9E C3 42 1B BF 74 69 67 EB 35 92 28 A4 B6 5A 77 93 06 07 17 0E 8E FE 6A 03 B5 F9 A7 BF FA 56 B6 EE 33 35 EC BC E1 17 1B 5A 8F 98 04 49 B4 FE 3B 1A D0 FC 43 95 6A AC F8 75 49 94 DA 3C FF B7 07 36 B5 EE 33 D5 12 B3 F5 B3 24 74 2F 0B BD 7E D7 5F 76 B4 56 9A 56 53 57 85 86 FD 5C B8 ED E2 6D 5F A1 FE 56 37 3F 78 25 B5 FD F5 25 91 5D AD 09 53 93 FF 3F 97 5C D1 EA 36 09 92 68 2D A3 9A 9B B8 E6 F7 1D 0F 7D 9E DA 7E E4 FB 33 6E 6F DD 63 0A 11 B3 F5 13 D4 DF C5 2C 54 75 75 C7 17 5B BF 64 B6 4D 6D B5 3E 4E 85 C5 5C F8 AD 42 F8 4E 53 BB 12 7A E7 12 FB 23 A4 69 FE 65 FB 1F 6A DD 66 6A 22 66 EB 7B B4 52 BC 51 48 C2 CB 1F 3B FB DB EC C9 2A B3 66 EB 00 69 7A 8E 0B 5B FE DE 7B 94 34 FC A9 DE F9 4C EB 2B 20 84 88 D9 FA 25 12 FA 3C 0B 9D F4 EA 9F FF 58 BB 9E 4A 26 4E 7B E2 DD D6 36 EA CA 3E 2C 71 19 38 3D 46 82 E1 CD 18 18 2D C3 C4 DD C9 DC B3 32 DC 28 71 B7 31 77 38 C3 BD 86 B8 A7 33 F7 CA 0C 77 2E 0D 68 23 73 3F 99 E1 FE 15 77 89 CD B3 98 FB D9 0C F7 6C 5C E5 9B 15 E6 DE 93 E1 5E 40 DC 3F 16 10 F7 A9 0C F7 63 C4 7D 85 B9 FF 92 E1 BE 4E DC A7 99 FB FB 0C F7 1C DC 2A 36 DF C7 DC 77 32 DC 2F 10 F7 20 73 25 29 CD 7D 9E B8 57 30 B7 38 C3 9D C0 2C D8 9C 60 6E 43 86 7B 80 B8 9B 99 7B 66 86 7B 0F 71 DB 99 AB 67 B8 CF 10 B7 9A B9 97 67 B8 C7 88 1B 64 EE 67 33 DC E5 98 49 9B 81 B9 0F 64 B8 E7 12 F7 B7 3E E2 3E 96 E1 7E 97 B8 3F 62 EE 13 19 2E 65 C4 E6 6F 31 F7 B9 0C F7 4D E2 DE CD DC 1F 66 B8 3F C0 45 B1 F9 7A E6 FE 3C C3 DD 85 B9 A8 F9 12 E6 BE 99 E1 DE 4B DC ED CC 7D 3B C3 FD 32 71 FB 98 FB 6E 86 FB 45 E2 2E 63 AE 5B 4E 73 BF 87 E9 BB 79 1E 73 03 19 EE 6F 88 EB 43 AE 99 27 9B 65 C2 39 BA 44 B6 3A 2B BD 15 65 2C CD 0B CF A3 AC 76 56 EE F6 B4 F9 C9 7C F8 68 D5 9D 25 07 C3 73 2C 0D 44 CC 9D 46 DD B1 73 AC D5 EC 23 68 34 E6 63 AF 26 F1 CC 45 70 92 5A 6B 2D 68 0E B2 B5 80 CD D3 86 D5 A8 4F BB A5 BA 17 C9 B6 8C 97 EE A4 B5 C1 6E 9C 99 E1 1C 17 9C 2D 19 4E 44 62 8E 96 E1 1C E1 7C 2B 7F 34 87 04 C3 67 93 81 69 9F 98 74 DA 2D 53 24 27 BB FE 11 E9 A3 35 54 59 36 A9 25 8B 31 4D 53 56 D1 E4 B6 7A 3F 62 5B EC B1 F0 96 9C E6 B2 78 D3 B4 98 55 3A B9 D1 9F 7D C4 D0 32 46 A7 69 74 F4 03 1B 1D 3D 51 A3 55 DB 3F 4A 8B 15 93 3C 5A 71 42 87 56 4C EB 4F 7C 8E 3F 76 9E B9 61 71 FC 77 63 5D 75 7C 70 B0 2F F4 58 B1 8E 4F 32 C6 B5 99 58 57 91 BC 39 43 2E A8 EA 01 67 E9 C1 92 F0 39 40 5B EF D2 83 E1 73 A9 C5 BB 64 6B D7 36 9B 4D 9E C7 45 E7 7D A0 0C B6 FA 80 5B 34 1A DE 8A EC 93 08 61 C9 87 73 25 9B F7 99 62 C1 60 71 78 DB 07 4A 0E 90 64 32 82 8C F9 C6 B3 58 A6 0F 90 09 F3 8D A3 88 63 25 E3 1D 92 8F 22 4F 1F E4 82 12 5D 13 02 EF 92 F0 76 93 37 64 DE 77 F0 3D A8 C7 E8 1E 3E FF 03 5B 7E 43 B1 1C E8 52 5D B9 0E 74 65 3B B0 A1 6A 00 C2 B8 53 73 EA 17 50 6E 2B 3D E8 9C 71 50 8F E7 38 CA 61 CB 75 54 FD D4 0A C3 1F 58 01 3D 7B 16 99 93 55 AD E4 A0 9E A0 00 52 8C 12 9B 15 3F B9 E7 08 59 B1 A2 4C 93 8E 27 CF B7 FF 74 99 63 92 D4 49 AF 5B 75 A3 39 FA 08 D9 A5 BA F5 0B D9 3E CB 57 F3 73 ED 6B FE A6 2B FD 20 10 60 B1 A4 41 A8 57 F5 52 97 92 D4 E2 0C 71 DF 33 47 3C 51 CF 11 4F D4 B3 F9 89 BA 8D 9E 61 53 34 C6 E3 C4 DF 33 4A E3 B9 93 0C F7 84 77 11 BE 9B 5A 3F E6 03 D5 5B AD A8 5E 73 DB CF BB 89 69 3B 9E 3E 54 51 3D E2 C1 FC 24 6B 4B 3E F9 80 85 74 7A 50 A7 C7 D4 D9 FC 47 3A 00 29 0D E4 61 1F D4 BC F0 58 4E AF 1B 26 F5 FA 69 92 0D 06 F2 49 36 7F 92 6C C7 24 D9 83 CE 29 C3 77 51 4E 85 FE 49 15 62 4E 73 26 5D 4C 0E E8 F8 40 D9 53 2D D9 4B 72 3A 1B F0 A1 F7 03 05 6A 81 A1 E5 56 30 2E B7 7D 58 CA 51 7D 93 19 05 53 22 E6 69 87 68 96 C6 98 1F FC E6 13 B8 34 C7 D4 DB 26 99 7A 3D D5 D9 43 8F 53 E1 3D C8 A5 C3 A3 42 B5 B0 FA 5C C1 FA 18 CD 48 46 8D AF 59 15 49 D5 24 ED 42 E2 A9 B4 C4 D4 F6 8D 1F 53 21 37 09 55 B8 9F C8 B7 A7 C9 E6 82 B4 09 99 46 92 E3 14 AF AA AA 9A B9 02 93 24 8E D0 A0 40 39 51 04 FC AA 5F 9F 60 DD AD 69 65 CD 4F D8 85 0B 8C 18 F2 CC A7 BC 40 51 30 50 DC FC 02 ED 18 8A D4 E2 83 81 00 A8 01 E1 B6 CB A8 34 A8 06 AB 4F 33 39 68 B9 55 46 DE 12 8E BA 9C 5B CD 62 1B C3 F6 1C 27 42 BA 94 5C 18 28 51 4B AA 7B 32 A1 F5 01 AA 4B F4 2B 3E 5C F7 B1 42 73 69 2A CD 3C 45 AB C5 25 3F 09 14 AB C5 6A D1 75 B1 E3 F6 C0 0C 75 C6 B2 10 3E 54 37 3F 69 9B A6 FB 33 83 81 72 D1 FD 99 6A F9 C1 40 19 A8 65 59 DD AF 50 2B B0 FB 65 69 1B CB 26 77 FF 4A 36 31 8B 6D 5C 3A A5 FB 65 59 DD 9F A5 CE CA E9 FE 89 55 97 E8 1F FF 70 DD E9 EE 57 66 75 BF 1C BB 5F AE 96 AB 33 B9 FB 21 35 24 BA FF 94 78 63 12 AE C0 AA 45 C6 35 A8 2A 78 2D C6 95 54 54 54 54 12 FE 04 C5 F2 B1 0A 53 DB 6C 50 67 4F 73 44 63 1C C0 4A C9 AB 88 BF 97 C0 D5 08 52 01 3A 45 98 C5 AB B9 D0 FC 1A 0A 95 B0 E6 F9 41 F4 F6 ED 45 45 C1 92 F0 35 39 F3 EC CD DC 7E A4 DB 9D 03 EA 9C 69 DA 6D F6 C8 1F 62 B9 F1 6E 3A CA D3 CA E6 82 3A 77 3A 65 8F F1 39 2C 65 11 B2 A7 86 67 C6 A1 1C 5E 35 F3 6E 90 D2 09 23 B9 8F 14 CE 33 70 32 8E E0 DA 60 54 D0 BD EC 60 F8 5A 62 CF 77 CE 3C 18 38 09 D4 F9 C6 6C 64 8B F4 44 6B 7C F8 3A 2A 5D A0 2E 50 E7 E9 9F E4 A1 5C 60 CC 47 09 FD 53 82 D0 F7 B3 CF 17 98 E6 86 C1 A8 C1 52 35 2C 6C 3E 7D 8A E1 EA 49 39 81 BB 30 18 58 D4 3C 41 E3 BD 50 5D 74 30 50 A5 56 89 90 AD 56 AB AB B5 E4 F5 84 D6 A8 35 D8 F6 A7 B9 B9 9A 99 D7 6E E4 21 51 E7 DF 3E BF 84 4D BD 7D 7E 29 5B 7B FB FC 19 26 5D 86 4A 68 80 6E 0F 7F 86 82 B3 4A BF 81 4C 34 99 C6 06 C7 A4 E8 03 75 11 86 DA 22 75 91 BA 90 43 AD 56 AD 5D 96 C0 50 AB 3A D7 5C 3C 6E 14 19 91 96 E6 03 90 BD 65 B8 3C 57 55 55 35 54 16 61 B0 7C 92 4C 2C A1 77 61 CE CC 56 E7 66 C7 E4 ED C5 B1 D3 4D 9F 9D 0C C6 13 8E 0F 5D 1C 4E FE C0 BD E7 22 80 B6 3C F1 06 EF CF 68 F4 19 78 5F 8E 39 F7 1C F3 9C 99 F8 B7 23 7D 15 86 E0 22 DC D5 9C 67 F2 29 22 0B BC E2 7D E8 79 5E 3E 4F E3 0F F1 ED 48 DF 8B F7 AF 66 F1 E9 53 8C C4 7D 78 7F CA 27 DE AB 5A FA 8B 0A 04 FF C9 82 5C FE 9F 91 C6 99 05 7E 64 56 64 F1 FF 84 7C F4 27 5C 3D 89 7F 2F D2 0B F1 FE D3 49 FC D5 2A C0 32 BC 7F 1C EF 0B B2 F8 04 1E F1 03 7C C3 4F 6F 5C AC 73 75 3B E0 28 98 E7 EA 56 D0 18 AF 71 7C 94 F0 9B A8 AC B8 31 E9 32 59 44 8C B9 4D F9 E0 53 78 98 F2 DE 2B 80 6D D2 BB B6 02 6A 53 E6 31 4A FE 13 D0 31 ED FB D8 6C 9E 4B BF 09 89 FC 60 C0 5E 35 DF AD DA 0F 06 1C 8A 21 39 71 AA 38 F4 83 14 20 01 C4 79 2A E6 E1 33 2E 06 24 3E 2E BB 39 1E F1 59 A2 E6 FB 8A F5 7E D0 0E 34 5B 0A 4F D0 86 B1 01 B5 E8 37 5B 0D 9D 2E 1A B2 FA AF 60 DF B1 B9 5B 68 6E CC 2F 35 CE 75 92 37 66 20 E7 B3 14 86 4E BF 33 FC CF 5C 54 26 8A D8 19 93 AD C1 8D 79 CD 21 D3 1A 7A BF 68 87 37 F9 54 17 FF B2 0D DE CC B2 A0 7F 8E C0 AD A4 A4 F9 F3 74 E4 AA DF 46 86 B9 F5 DB A9 39 7A 7F 75 1D 79 D0 AD DF 41 B4 43 75 94 9E D5 45 6B FB 12 33 00 FB F0 A2 77 27 55 3B C0 65 7C 0C 2D 72 EB 77 E6 78 CA 5B B5 86 8E DE A6 2D 69 C4 92 9B A6 2D 29 C3 92 BB A6 2D E1 F0 56 F4 BB D8 1B AA 73 D9 19 98 05 8E 79 95 6A 97 62 6E 55 5D 56 BF 69 EC 65 70 C1 4B 3F E3 D7 B5 EC 07 7A AD EF 17 E7 D1 C9 CF 93 BE 32 7E AB 94 E7 52 82 65 FA 17 28 05 29 C1 F0 DD E4 01 70 05 93 87 D8 07 EE 92 97 CD 97 4F D8 7F BB EA 08 BA F5 2F 72 B2 72 78 8E E1 22 6E C7 6D B2 DD 3A 71 CF 3A 7D 17 36 F0 D9 7A 35 54 F4 88 E9 49 EF 58 D6 6C 12 E7 EC 64 0F CD FD 00 DB 23 DE 16 C8 D7 C5 C2 5F A2 C1 60 83 F8 05 00 B8 4A D8 90 7C B7 1C C4 62 FD CB C4 74 EB F7 80 38 EF 77 57 BB DC 56 CF 79 53 EF C9 7D 09 E0 5C 24 6C 98 07 C5 2D A2 5D 19 14 E8 5E 23 70 7A D7 4E 2F A4 8A F8 5D 36 66 12 8F AC 7F 05 CC 17 F1 59 E5 C5 59 E5 F7 65 95 53 1F 86 80 DF 95 A9 90 BC 9F BA 90 FC 2A 47 A4 4B D9 43 AF AD 79 03 AA 3F 40 41 F6 20 D9 E3 2A D5 BF C6 77 FD 21 EA 93 8C EE 55 ED 41 D5 8E 1D 7B 98 8D 9F 95 3E 00 B0 9E E4 A7 7F 97 9D 0F CB 56 42 85 95 47 FE 9B 36 7C FD 7F CE 06 07 FC 06 39 25 E6 BB 0E 4E FE 75 28 3A 5E 4E EF 8C 05 5D 4F 34 66 4B FB B1 82 F4 4B 69 53 A5 8D 25 B2 57 5D 6F 30 AF 19 B7 3E D8 87 83 F9 E0 36 EE A7 9C F1 88 39 27 AB 7B DD 62 05 A6 F7 C3 CB DD A2 94 67 B6 FE 0D 5A 90 A8 CD 3D D4 50 69 F8 64 4A 93 6E B1 BC 3D EA CC 59 DE C4 2B 23 FA A4 37 32 4E 50 A7 7D 73 A7 94 FC 24 4F 71 59 B9 65 D9 0E 9C 73 E2 9D 21 E5 D6 B9 F3 A0 40 E4 F9 75 30 F0 60 C6 1F BF FA 1F F7 C7 27 4E E4 0F 1B 54 F5 40 96 4F 96 99 3E E1 DE 66 DC 51 12 AE CD 72 C7 EF 4E E0 8E FF AA 37 CE 67 6F C0 B4 FE D8 F6 D5 4C 8C BE 89 9C 52 F6 07 6B 82 CA

Signature Hits	Behavior Group	Mitre Attack
Stores large binary data to the registry	Hooking and other Techniques for Hiding and Protection	Modify Registry

HKEY_CURRENT_USER\SOFTWARE\082C2C722F273426B981

91E582DD0FE0224A74B326FAA35161958AAE425DF4B6151646B9C330E7BD5487

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\082C2C722F273426B981
Value name:	91E582DD0FE0224A74B326FAA35161958AAE425DF4B6151646B9C330E7BD5487
Value data:	00 48 00 00 1F 8B 08 00 00 00 00 00 04 00 ED 7C 7F 7C 1B D5 B1 EF EC AE B4 BB 92 25 39 B2 63 D9 49 EC A0 FC 20 28 B1 23 E2 FC 80 18 12 12 C7 CE 0F 37 31 31 71 48 02 04 12 59 DA 38 4A 64 AD 59 C9 09 86 26 28 05 4A 29 04 48 29 2D 29 A5 17 DA D2 DB F4 D7 2B B7 A5 05 FA B8 D0 47 29 D0 16 2E F4 42 FB 68 D3 94 3C 6E 7B CB 6D FB FA BB D0 77 7B E1 7E 67 76 25 D9 71 28 ED FB BC CF FB E3 7D 9E 13 CD 99 99 33 67 CE 9C 99 39 73 CE AE 95 F4 5E 7A 3B 69 44 E4 C3 E7 AD B7 88 1E 22 F7 67 25 BD F3 4F 09 9F C8 19 8F 44 E8 CB 81 67 67 3C A4 6C 78 76 C6 E6 DD D9 42 7C D8 B1 07 9D D4 50 3C 9D CA E7 ED 62 7C C0 8A 3B 23 F9 78 36 1F EF DE D8 1F 1F B2 33 56 32 1C 0E CE F6 74 F4 AD 26 DA A0 68 F4 FD C0 F1 74 59 EF 2B 34 33 5E A3 F4 B9 46 E8 2E EF B7 3B 00 E2 F8 EC 14 72 92 E0 AA 6B 37 51 B5 A5 7B 5D 3E FF 68 B4 F2 06 16 E5 BF D5 B6 D2 B8 E2 D0 BB 91 5C BD 77 69 A7 5F 64 E8 AF F0 C5 84 1F D8 67 8E 21 4D D0 EB C6 D0 C9 A2 75 55 11 ED 1B 2B 5C 59 59 AB 3A 41 C5 CE A4 53 70 D8 31 62 1B 6C 94 85 AE 1A 2F 87 A1 2B 93 8E 95 B3 D3 9E AD 25 4F D7 9A 09 72 A7 8C 24 7A 71 87 DB AE 93 21 7E BA 6B 31 62 32 8F 48 F1 FA 7F 76 45 35 27 FE 9A 9F E9 6A A2 91 28 38 6F 0E A9 89 26 20 34 EF 53 85 29 68 4B 50 E8 2B 4C 65 8C A3 56 98 C6 98 C6 58 33 63 58 95 6F 5E FD 02 45 62 03 D1 28 1D E4 01 76 0B 3A 83 AD A4 57 FA 54 E9 63 15 F6 F4 53 FB 34 E9 63 A5 F6 19 A7 F6 F9 A4 8F A7 B1 E3 D5 3E 95 96 A1 CF 2F 7D 80 BE C9 89 19 E8 AC 31 DA 66 38 98 7E F8 79 F0 D4 C4 4C B0 EC 59 00 05 24 6D 30 64 96 FC A2 4E 06 54 E6 A8 21 49 55 E8 D1 CB EC 99 A4 96 98 98 B7 A5 80 A8 E8 89 33 31 BA 08 86 5A 32 98 0B 4F CD 61 4F 11 95 C7 1B 32 DE 28 8F 1F CF 4F 84 A1 43 F8 5F 99 FC A6 DE 00 A2 70 16 DB 94 60 F7 99 6C FB 9B FA D4 F1 DC 80 37 CD 5C 77 1A 9A 86 F5 6E 25 C9 CB 28 9B 11 44 BF 56 C2 0C 3E 5F 09 DA 7D FE 12 EC F4 45 7C A5 08 9A 83 AC D3 9E C7 21 3C 18 A8 A0 27 A6 9D 99 68 65 17 91 61 B7 A1 4D CC 67 6E 22 09 78 82 D8 66 45 36 97 42 4B 3B 68 1A 7C A6 BC 3F 56 AA C5 E8 D8 9E 52 94 83 7D 36 DB 55 CF EA 79 C2 D2 64 B6 10 76 19 34 0D FE 0E B0 5D 4D 8D CD 85 05 2C 05 45 BE 06 77 58 E3 61 A4 AE 52 AA 1B AF 81 05 E2 F4 34 91 DD 2E 56 56 E9 85 4C BB 8C 83 BC C8 83 BC C6 C4 22 8E E3 62 EE 6A 14 9B 12 4B 98 71 0E AF A6 4E 49 9C CB 59 E1 C0 E4 E1 83 6C 55 62 29 E8 3A 4A 74 A0 B9 A5 1B B3 0B 63 5C D7 79 6F D3 75 30 52 C6 12 E7 33 68 E2 CC 70 8D E1 15 C4 04 DE 9A 8D 21 60 31 0E D8 32 1E C3 DD F6 72 60 73 4E 34 B8 2E 0E 51 62 0A 8F 2C 3B B7 EC DB 77 D1 23 3E A5 81 7D CB 7E FB B5 22 6B 45 DE 88 9B DF 54 82 7A 9B EE 0E F4 3C A0 DA 17 48 4E C7 DE 54 43 66 C7 7E C8 1F 8C 8A 6B DF 54 C2 81 8E 87 59 4C CC 3A 82 C1 F5 BE A8 AF E3 16 66 B1 87 ED 15 6C FE 4C CE DD 95 EC 75 1E E6 76 74 F2 A4 63 42 11 95 10 63 BC 3F EA 6F 3B C7 8B DA 5F BF E4 1F CD E7 72 23 5A 1A F7 FC E0 AB 8D DF AB C6 9B 5A 27 BB C6 78 46 DA AB 64 BD B4 F4 B3 54 36 D3 ED 31 EC 2E C9 02 B1 AF 9B F5 B3 3A 98 A4 47 F5 B6 2B 0E 22 08 BE 36 43 9A D6 D8 C1 46 EE D2 3B D8 14 9C 3F C1 33 4B 4D 95 A5 C9 9A D7 B0 55 E5 65 9C 6E C5 8D 63 2D 9C E9 9A 5E 9D FA 07 13 56 41 D4 1A F0 E2 79 A2 EB 6F C8 85 98 9B 0B F5 C6 B8 64 50 68 5E 67 B3 5B 6F 91 75 F4 0D 78 EF BF E3 03 0D E4 E6 85 4A 28 00 5C 3B 78 9F 27 5A 64 5A 6F E7 06 49 3F CD CE 9D 57 DE B7 D8 D9 D3 5C 1D 7E BA 83 E4 3C 81 0E 77 E5 41 95 CB A3 14 32 BD C6 B8 35 9B 58 0B A6 03 A5 C3 89 75 AC 91 3B 43 BA 19 33 6F CD BA C1 D0 8D 98 51 C6 65 55 0D 8D 76 0F AF 4B 08 5D 7C 1D D3 C5 65 5F 8D D9 EF 92 15 87 48 6F 33 74 7B 3D 8F 39 5E DE 0B E1 89 7B A1 99 CF 82 00 59 F9 F2 F1 AC D0 35 EF A6 86 F2 FA BF 09 4E 98 6D 77 EB 8F 3B BD BD A1 62 89 DD 3B B6 9C 9D DE 29 5E 32 5D 58 CD AB CE 77 AE 81 E4 16 CE 8D 63 25 43 64 9E 56 32 30 41 32 4C 81 D3 45 07 8B 5A 4C 72 12 4C 89 BB F1 21 9C 5C 53 2E 2E E3 57 52 E4 DA 32 7E 37 45 8E 55 63 F8 0C 46 45 D8 0F 4B BF 06 2C BE 60 84 28 D1 57 2D 8F F6 45 BC 7A BD E3 3A 2A 07 B9 C6 39 9B 03 5A 09 74 C8 3C 7D A0 C3 46 20 16 28 07 D7 18 13 F4 89 81 36 DC 40 1B E3 02 9D D8 24 EB 0E 91 D1 66 18 5E B8 89 2A 09 EF 3B 25 E2 D4 58 EF 5F BA FC 2D BE A2 7A B1 9F 47 F6 D1 72 EC A3 74 D7 31 8A F1 9A 57 B9 75 B8 9F 37 6A 83 9C 2E 7C EE F9 A9 17 57 86 5A 6F 3F CC E1 B5 71 59 3B C8 12 52 A4 1B 62 89 CD 6E 1E C4 3E 52 63 B0 F7 B1 F0 F8 C9 F6 17 1E 5D 72 96 19 BF E7 EB 5F B9 F1 FC 47 79 13 E3 1E D7 F0 78 E4 0B E7 7F D3 23 58 22 99 59 FA 82 22 37 BC 2F 3E F2 A3 25 8D 66 7C DB 9A 17 BE 95 5C D6 EA 71 92 97 2D FD 07 E9 7E E2 F5 4F FD 38 99 61 F6 8F BF F7 FB FF 48 FA 97 DE 0D B6 E1 60 FA E1 58 E2 62 CC DE F1 5E 2E 6C 37 08 B7 BF C2 6D BB 76 A9 23 AC CB AA 82 1F 60 C1 ED C2 4D 57 B9 F7 33 77 8D 70 F7 56 B9 8F 31 77 81 70 0B 55 EE 53 CC 9D 2A DC 03 55 EE 71 E6 FA B8 18 BB DE 5F FA 06 7B 57 6F FC 48 62 0B BA F5 26 B7 2D 6C 65 62 8A 4B F0 ED 02 82 FF F4 CE 82 C8 6B 7D CE D2 4F 95 05 17 79 82 DC 16 B6 B1 C0 25 52 33 A6 B8 AC 58 2C D6 98 38 83 75 B7 EE FB 4B F2 AD DB 88 B9 97 F2 E6 61 B1 CB 24 7B A2 BE 58 60 BE D6 D4 AA C4 0E 6E 67 D1 38 CF DD 3A 9F 62 89 CB B9 1F C7 94 73 1B 96 CD 03 AE F0 F4 4A C6 CF 62 B0 43 F4 22 19 5B BC 64 D4 29 7A DA A2 89 95 94 EB 30 FB 6C 3E 72 2C 89 4F 8B 57 87 EB 17 68 84 8A C3 F7 4F DC DF 76 F2 E6 8A 85 50 10 C3 66 BD 2F 00 1B 7C F5 7A EB 59 46 54 FF 88 9D 42 9F EA C6 80 4F 61 23 CA 9B 02 1D C1 D6 28 A6 6E FC 1E 1F 62 51 7F FB 3F 4F AE DC 5B A3 92 F5 AC 77 80 C7 F2 D5 DF BD D4 12 DF 27 DD FE BA 31 FD 99 31 FD D3 16 F8 C8 62 39 77 3F 14 2C B6 6C AA 9C 56 21 EC E4 A9 F6 2E DE A0 66 2C 31 28 15 C9 88 15 76 8B 53 03 8D 3F F0 0E 35 36 3E EA 8F 05 EC 2C 4B 46 FD C1 13 53 29 EA 6B 33 A3 BE F2 4E 1E B3 AB 65 4E 77 CF B6 51 4B 0F 97 23 B7 76 5F B8 D5 DD BF 6C CF 76 F7 2C 8B 96 AB 90 8A AA B3 87 4B A7 18 24 85 85 8C 46 31 24 1C 50 63 E8 B6 F7 32 33 60 E7 BC 3A 12 68 33 02 DE 8C 6E C1 09 8E 2F 2E FA 3C D7 86 D9 D4 D0 E1 CE AB E2 26 BC E6 C2 AA 0D 58 2E 35 B0 0D 85 21 36 A1 90 97 D2 6D 98 07 F9 5A 2C F9 61 DB 60 D9 C3 52 F2 9A EC 2B A5 B5 1D B6 49 85 7B 90 74 51 1C E6 76 41 26 9F EE 25 8F 9F A2 FE BF 74 57 0E D3 79 6B A9 C5 AD D7 FF DB 36 14 FF CF D9 10 A0 B5 AA DC 25 90 3B 95 1B 72 B0 8A D6 07 EB 82 89 11 36 AE CA 0B 19 75 6A 62 1F 6F CC FD 12 A0 C4 55 92 30 07 47 79 CA AB DD 1D E7 B3 AF 91 6D 8D 9B 33 8F 46 C3 03 60 97 CB 8E C7 E9 3B 94 48 F0 3E 85 E8 BB D9 4C F4 49 4B 89 03 AC A2 06 1B 26 94 38 C8 68 F8 8C F8 19 71 A9 2E F5 91 68 38 1A 29 5C CB 46 44 6B A2 21 D3 2E 49 3E 34 79 2B AF A5 68 6D E2 D0 D8 45 43 FB 7B 3C ED EF 71 33 E8 3A DE 21 89 EB 59 7C 52 74 52 DB 99 14 50 0B 37 F0 3A 2A 5A B0 0B A3 E3 B5 78 79 5A AF 1F 44 D1 0E 6A 7B 0A 37 32 65 38 77 F0 21 89 27 53 BD DE 6C 2C BC 8F 79 81 68 C0 BE 89 97 18 35 3E EE 9D BA F5 75 B1 FA FA 68 5D 5D 7D E2 FD A2 73 BC 6F F9 49 A4 7E B2 A7 BF 21 10 6D 88 9A 50 71 33 4B CA B1 E0 9E 70 B7 B0 F3 1A DC EB EA EC F2 81 26 DC 31 0F 29 93 DF FE F9 65 F2 DF F6 FC 72 22 42 D1 06 6C F0 86 F2 CD 2C 12 AD 07 59 97 38 2C 11 3A 4E 27 26 79 BE 8A 55 7C E4 1E F1 C8 B1 95 EC AF F7 D1 92 47 A9 C9 BD A3 BC 41 35 9A 22 B8 4A 37 28 37 45 54 AF 26 5C A1 3C 3E DD C5 89 36 29 3F 3A 5B 9D 54 DE 17 97 63 54 A3 EC 0B 29 0F 63 BD 1E AA 3A 3D EC F9 1C F5 DF F5 B9 59 71 B9 3F 86 22 EA AF D3 27 B8 DC AC 33 5D 97 1B 9E CB 03 54 38 8F 03 18 8C 06 ED F3 19 A9 89 D6 B8 09 51 1F 8A 86 A2 01 EC 31 37 1A 95 F4 08 53 34 3C 3E 3D 4E 0D 54 E0 1D 02 65 BC 7D A0 8C BF 3D 50 81 36 CE 98 4A A0 74 90 FE 89 81 8A 9C 12 28 A9 D3 9D 19 D7 FB DC 30 7D 2B 3E 4D DE 79 A6 7A 7C BE 51 CC 52 88 BC 40 C9 AB 26 3C AE D0 1F F1 59 34 86 CF 3F ED 7C CE 80 D7 AD B8 EF DD DC 73 51 A5 05 AE DE 68 FC C9 7B 9A 0F 05 D5 B6 33 63 35 AD 93 55 C3 C6 7C 41 3D 15 BF 43 21 E5 D2 A0 D1 B8 AD C6 50 6D 9C D4 C1 B3 D5 D6 93 E5 B3 0F E7 1A 4D E1 5C 50 35 B9 E8 25 6E A7 CA E1 C6 EF 4C B8 A0 4F 95 FE C4 11 3A E5 3D D0 34 E6 3F 3F A9 FC 5E A7 D2 17 2A 9F 97 6A E2 03 34 E6 FD 10 9F E5 CD C2 BF C5 8F D1 93 DF 54 6A 8C 36 33 81 D5 B4 06 5B FD A4 8A E0 1C D2 DE 6C E0 6E 79 ED 35 D7 CD 7A F7 1C 46 9E B1 0E 8C BF E6 83 9C 72 77 72 F6 1A B7 98 AE AE 90 D9 36 39 01 F7 B5 D6 B8 DD 86 FD 21 89 12 19 A2 77 53 59 9B 5A F8 30 9A 03 2C 32 2F 59 40 B6 EA 25 7E 84 9D B7 50 2B E2 19 62 1A BF 72 93 F7 45 AA C4 6A BA D4 EE 56 4E B3 BB 78 3A D5 48 2C 2B BF 3C AA 47 7D BF 1B 32 67 B0 8C C6 0F BA 7A 4D 9D FA 66 03 EA BD AA A1 88 AF E3 02 6C 5E 83 25 FB CC 6B E0 44 DF 0F C2 E6 35 2D 42 4D 63 AA DE 67 F0 CB 00 BD DE 6F 60 1F 24 56 30 8A 7D 15 D5 13 5D 8C 1A B8 15 C4 D0 61 94 0B FA 05 52 D0 FD 51 43 FA 81 25 3A B9 D5 0C 7E A6 00 AD 27 8E CA 26 04 B2 4A 18 A6 1B C8 55 FD EF 5A A5 78 6F 21 39 36 FB 16 27 17 24 17 2D 58 D4 DE C1 1C 3F E1 D4 A7 ED B8 2D CC C2 79 F0 34 DA 57 70 B9 9F D5 5F 74 B2 F9 C1 02 4B 7C 1A 47 E5 E7 38 DF 2E EE A7 CD 33 BD DC 5B 7B 71 4F 37 E7 30 E8 5F 18 A0 57 E5 EC 81 6A 0E 2B 5B 5B 3E DE 12 80 1E FA 5F CA 22 3E 00 79 76 7E 3D 1A 73 63 28 EF 48 B1 0A 3A EA DD F7 BA 5D 3F F2 FB 43 7E 77 25 81 D3 3C 3C E2 C9 F8 BD D6 F0 FA DC 57 BC 2F 19 EE CA 74 BA D0 7F 71 48 A7 AF 09 3C D3 77 73 4D 2D 3D C8 2F 0B 69 97 6F 6E 40 A7 76 3F C3 8F 0B CC 0B BC 51 E0 E7 A5 77 93 AF 16 A3 9E D3 18 FE 49 38 4F FB 3E AC 07 E9 37 DA 07 F0 24 73 97 F6 19 23 48 1D BE CF 18 11 1A D0 7E 52 13 A1 5F 06 8F D5 E8 74 12 B3 44 E8 80 2F 19 8A D0 9D BE 94 A2 53 7D A4 D5 8C D0 83 41 96 89 F9 99 73 96 C6 9C 16 2A 41 C3 71 ED EF 4D 9D 4C 8C D2 E9 4B 1A DB 79 55 70 04 F0 60 60 72 00 27 92 F6 16 7A 3F A8 EC D2 75 BA 38 D0 6A 06 A9 3B F2 E5 B0 4E AA 79 02 FB 69 AB FE 5D BD 8E 8E AB DF 45 EF 1D 98 45 A7 1D C6 2E 70 EC 40 09 76 BE 6E 7C 1B 9C BB 95 03 B5 28 5B 01 86 97 9A 07 6A EB E8 0B 01 1E F5 9E 1A 86 8F 04 4B 80 EF 0E 97 F4 18 35 D5 24 C2 75 F4 8D 08 F3 EF 10 9D AA C6 3A 1F 50 19 7E AC 76 2E EC 39 20 F6 7C 2B B2 4B 8F D0 39 4A 32 14 A4 5F E8 37 D7 04 E9 EF 6B BF 1C 0E D2 0C 8D 61 48 63 0B 7F E2 E7 35 2E 0F 27 43 31 BA D7 4C 84 23 F4 21 E0 3A 5D 4E AC ED 22 83 D7 F2 2F 21 96 34 B1 16 1D 19 C3 6B FC B6 CE FC 6B 54 E6 DF 2F F3 3E 25 F2 43 E1 8B E1 CF 37 42 29 25 42 AF 2B EC C3 EF C9 7A AF AE 61 78 2F F0 F5 CA D6 20 47 F6 A7 2A 6B DB AF AB 58 EF 0B 41 D6 B6 53 65 3F AC 36 D9 03 0B 05 0E AB 0C AF C1 D8 18 DD 1A E6 55 5B F0 83 4E E7 D4 B0 0D 67 80 CF D9 B3 4B 72 A8 BC 4B 7E 63 EE AC ED A9 50 3F 0F EE AC ED 05 CE 79 3D 89 A6 46 76 D6 5E 0E 4A 93 64 BC 3D F4 DE D0 E5 C8 4C 53 FA C2 E1 9D B5 37 20 3F 6B A4 EF DB B5 2C 69 22 7F B9 5E 7E C3 FC 86 C9 54 AD 68 AD 0D 33 15 44 5C B9 EF 82 08 53 B5 78 8A 10 C9 10 53 0D 5C 5F 21 FA 99 20 53 31 54 22 1E F7 6C C0 A5 CE 12 6A 45 AD 4B B9 BF 64 C0 65 96 98 9A 4F 7E 50 DF AF 71 A9 A4 50 6D 5E DF 12 F2 63 37 6B 0A 53 8D 74 AE EC A1 CD 1A 53 53 E8 3C D9 55 6B C9 A5 96 0B D5 2B D4 54 EC CF 20 C6 FC 16 D4 CB A0 7A 70 16 C5 83 53 7D ED F4 7A 60 26 60 4D 70 1E 60 47 70 A1 2F 4A 7B CD F3 00 BB B5 0B 00 67 AB 5D BE 18 E4 D7 02 A6 05 BE 1E D9 00 78 42 E0 EB C4 F0 25 81 DF 12 F8 B0 B2 11 F0 D7 D8 8D 31 5A 69 6C 05 1C 0A 5E 0A F8 2B BA C2 77 0E 24 D3 98 85 E1 0C 8A D4 3E A6 9D 43 CF 63 6F C7 C8 47 7B 7C 5B 4A FF 4E B6 4F A7 F5 11 86 DF 0F 30 4C 0B DE 6F DA BE BE B8 54 88 A6 B9 D8 77 0A 6D 1B 47 0D 08 15 6D 3A BB E6 31 50 B7 08 55 6F 9E 08 3A 78 76 FF B4 47 9D 34 F7 83 FA 86 47 3D 10 7C 37 A8 57 3C EA A9 9A 43 A0 FE EC 51 C5 E0 7B 41 75 CF 70 A9 36 ED 66 50 97 79 D4 52 ED 08 A8 CC 8C EA 7C 2A 5D 3D A3 6A 8B 4A D7 0B 15 33 6F 8C DC E5 53 E9 A3 DE 38 0A 33 F5 A5 71 E3 4E 8E 1B F7 0B 77 1C ED 08 DC E3 1B DF 67 D0 CE 99 D5 71 C6 29 7D D7 CF 74 C7 B5 45 B8 EF BF CE 72 A9 16 FD 53 3E 83 5E 3C D3 A5 DE AF 7C DE 67 52 D3 1C 97 7A 4D 79 04 35 F9 45 8F 7A 52 79 8C EF 45 67 B9 54 4A 67 EA F9 44 75 BE E0 B8 F9 50 03 12 AE E4 6D D0 19 A4 ED AD DE 0C 81 2F F9 6A 64 A7 95 28 16 7F 28 F2 88 2F E4 51 F5 F1 CF 45 9E 40 1E 7D D9 93 BC 95 BE ED 6B A0 17 3D EA 17 F4 02 A2 FF 7B 8F 3A 16 FE BE AF 91 AE 6F 73 A9 7B 41 35 91 39 DF A5 B6 D7 7C DF 37 85 6E F1 A8 0B 40 4D 1D 67 D9 34 6F BE 68 BC 14 39 E1 9B 46 93 92 AE E4 A5 DA CF 7D B3 C7 49 CE A9 D8 D9 52 FB 3B DF 1C FA E4 02 57 F2 76 F5 75 50 C5 85 12 31 7A 53 7F CB 97 A0 2F 0A F5 4D 75 46 F8 56 6D 2E 3D EF 51 EB D5 B7 B0 5F 7F 26 D4 75 34 45 F3 F9 E7 91 6F 91 DB F7 98 FE 15 F4 35 0B 15 C5 BD 30 80 BE D5 42 29 54 AB 44 FD AD B4 71 51 D5 96 36 DA 2E 94 66 4E 56 37 82 BA 67 5C DF 58 AB DB E8 1F 16 55 A3 D2 46 FF E8 8D AB A1 29 FE F1 92 F3 E9 3B AE 16 BA D1 9C EE 9F 4F BF F6 A8 F6 DA D9 A0 C6 4A 26 2B 9E 28 45 5A FD 55 EA 63 81 A5 FE 73 2B D4 11 5A E1 3F AF 42 7D 81 BA FD E7 57 A8 37 C2 DD FE 65 15 2A 1C E9 F1 2F 1F 37 C3 8A 4A DF 86 DA 8D FE 2A F5 35 E8 AC 52 9F A4 1E FF CA 0A F5 5C B8 DF BF 4A FC 65 E8 0C 9F 23 BE 27 FC 8C 57 8B CA C5 6F AF FF 99 F8 26 71 52

Signature Hits	Behavior Group	Mitre Attack
Stores large binary data to the registry	Hooking and other Techniques for Hiding and Protection	Modify Registry

Memdumps

Base Address

Regiontype

Protect

Malicious

322000

unkown

page readonly

24E1000

trusted library allocation

page read and write

7FFD9B820000

trusted library allocation

page execute and read and write

7FFD9B9F0000

trusted library allocation

page execute and read and write

1C160000

trusted library allocation

page read and write

254B000

trusted library allocation

page read and write

7FFD9B910000

trusted library allocation

page read and write

1BE8B000

stack

page read and write

1B163000

heap

page read and write

7FFD9B980000

trusted library allocation

page read and write

1B0BC000

heap

page read and write

7F2000

heap

page read and write

7FFD9B9E0000

trusted library allocation

page read and write

8A7000

heap

page read and write

CE0000

heap

page execute and read and write

7FFD9B816000

trusted library allocation

page read and write

1B540000

heap

page read and write

26B2000

trusted library allocation

page read and write

1CCBC000

stack

page read and write

1AFAA000

stack

page read and write

7FFD9B9C0000

trusted library allocation

page read and write

7FFD9B900000

trusted library allocation

page read and write

2558000

trusted library allocation

page read and write

2556000

trusted library allocation

page read and write

7FFD9B770000

trusted library allocation

page read and write

2538000

trusted library allocation

page read and write

3E0000

heap

page read and write

2548000

trusted library allocation

page read and write

2535000

trusted library allocation

page read and write

7FFD9B930000

trusted library allocation

page read and write

1B125000

heap

page read and write

1B110000

heap

page read and write

D35000

heap

page read and write

801000

heap

page read and write

BBB000

stack

page read and write

1B165000

heap

page read and write

1CA8D000

heap

page read and write

1BD7C000

stack

page read and write

7A0000

trusted library allocation

page read and write

1B97E000

stack

page read and write

2563000

trusted library allocation

page read and write

253E000

trusted library allocation

page read and write

AA0000

heap

page execute and read and write

1CBB0000

heap

page read and write

1C0B0000

heap

page read and write

6F1000

stack

page read and write

1C29B000

stack

page read and write

3B0000

heap

page read and write

7FFD9B780000

trusted library allocation

page read and write

839000

heap

page read and write

AB5000

heap

page read and write

1C39C000

stack

page read and write

7FFD9B810000

trusted library allocation

page read and write

84F000

heap

page read and write

2541000

trusted library allocation

page read and write

AB0000

heap

page read and write

256D000

trusted library allocation

page read and write

255D000

trusted library allocation

page read and write

269A000

trusted library allocation

page read and write

257B000

trusted library allocation

page read and write

700000

heap

page read and write

7FFD9B764000

trusted library allocation

page read and write

1CA80000

heap

page read and write

750000

trusted library allocation

page read and write

7CC000

heap

page read and write

82D000

heap

page read and write

7FFD9B9B0000

trusted library allocation

page read and write

1A510000

trusted library allocation

page read and write

1BA79000

stack

page read and write

1B0F7000

heap

page read and write

7FFD9B99F000

trusted library allocation

page read and write

1AA6D000

stack

page read and write

2553000

trusted library allocation

page read and write

255F000

trusted library allocation

page read and write

1B0B0000

heap

page read and write

2698000

trusted library allocation

page read and write

320000

unkown

page readonly

793000

heap

page read and write

1B53F000

stack

page read and write

1BD80000

trusted library section

page read and write

1C49D000

stack

page read and write

7D5000

heap

page read and write

7FFD9B846000

trusted library allocation

page execute and read and write

7FFD9B76D000

trusted library allocation

page execute and read and write

256B000

trusted library allocation

page read and write

1C090000

trusted library section

page read and write

7FFD9B762000

trusted library allocation

page read and write

7FFD9B9E2000

trusted library allocation

page read and write

1B15C000

heap

page read and write

1D5C0000

heap

page read and write

8A3000

heap

page read and write

3C0000

heap

page read and write

2543000

trusted library allocation

page read and write

D30000

heap

page read and write

CBE000

stack

page read and write

7EA000

heap

page read and write

7A3000

trusted library allocation

page read and write

124F1000

trusted library allocation

page read and write

851000

heap

page read and write

1BB76000

stack

page read and write

7C0000

heap

page read and write

320000

unkown

page readonly

1B15F000

heap

page read and write

124E1000

trusted library allocation

page read and write

7FFD9B760000

trusted library allocation

page read and write

1CBB4000

heap

page read and write

1B3AE000

stack

page read and write

7FFD9B9D5000

trusted library allocation

page read and write

259C000

trusted library allocation

page read and write

7DF000

heap

page read and write

25EA000

trusted library allocation

page read and write

833000

heap

page read and write

7FFD9B81C000

trusted library allocation

page execute and read and write

1B116000

heap

page read and write

770000

trusted library allocation

page read and write

1B4AE000

stack

page read and write

258A000

trusted library allocation

page read and write

1CA83000

heap

page read and write

CF0000

heap

page read and write

1B14F000

heap

page read and write

12502000

trusted library allocation

page read and write

790000

heap

page read and write

1BF8B000

stack

page read and write

7FFD9B772000

trusted library allocation

page read and write

7FFD9B9D0000

trusted library allocation

page read and write

A8B000

stack

page read and write

7FF4C7F30000

trusted library allocation

page execute and read and write

804000

heap

page read and write

780000

heap

page read and write

7FFD9B880000

trusted library allocation

page execute and read and write

7FFD9B77D000

trusted library allocation

page execute and read and write

7FFD9B763000

trusted library allocation

page execute and read and write

254D000

trusted library allocation

page read and write

254F000

trusted library allocation

page read and write

1B2AE000

stack

page read and write

7E3000

heap

page read and write

7FFD9B78B000

trusted library allocation

page execute and read and write

1D5D0000

heap

page read and write

7FFD9B920000

trusted library allocation

page execute and read and write

25BE000

trusted library allocation

page read and write

1AEA5000

stack

page read and write

7FFD9B9A8000

trusted library allocation

page read and write

7FFD9B91C000

trusted library allocation

page read and write

1B0A4000

stack

page read and write

7FFD9B7BC000

trusted library allocation

page execute and read and write

7FFD9B94B000

trusted library allocation

page read and write

1BC7E000

stack

page read and write

7FFD9B78D000

trusted library allocation

page execute and read and write

1C088000

stack

page read and write

257D000

trusted library allocation

page read and write

There are 140 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
171429109375b3b920cee552fad739e9c4a7f13922ed9d66bf32a3993fab5b757bcc601074656.dat-decoded.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report171429109375b3b920cee552fad739e9c4a7f13922ed9d66bf32a3993fab5b757bcc601074656.dat-decoded.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
171429109375b3b920cee552fad739e9c4a7f13922ed9d66bf32a3993fab5b757bcc601074656.dat-decoded.exe