Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

hPEMPaXhhr.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hPEMPaXhhr.exe.log

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp1B3D.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp1B4E.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp1B5E.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp1B7F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp1B8F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp1BA0.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp2E4F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmp2E5F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmp2E70.tmp

SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp2E81.tmp

dropped

C:\Users\user\AppData\Local\Temp\tmp531C.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp533C.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp534D.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp536D.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp6467.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp6468.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp8A8C.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp8ACB.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp8ADC.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp8AEC.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp9953.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp9954.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp9955.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp9956.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp9957.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp9968.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpC18E.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpC19E.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpC19F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpC1C0.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpC1D0.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpC1F0.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpE300.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE301.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE321.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE322.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE342.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE343.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE354.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpF824.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpF835.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpF846.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpF856.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpF867.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpF878.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpF888.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

There are 38 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\hPEMPaXhhr.exe

"C:\Users\user\Desktop\hPEMPaXhhr.exe"

Details

Is windows:	false
Is dropped:	false
PID:	3176
Target ID:	0
Parent PID:	1028
Name:	hPEMPaXhhr.exe
Path:	C:\Users\user\Desktop\hPEMPaXhhr.exe
Commandline:	"C:\Users\user\Desktop\hPEMPaXhhr.exe"
Size:	97792
MD5:	AC5F78EB678258499CF14F06E7C3C20A
Time:	19:46:49
Date:	01/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xf70000
Modulesize:	122880
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	2364
Target ID:	1
Parent PID:	3176
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	19:46:49
Date:	01/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://54.39.249.56:61562/

54.39.249.56

54.39.249.56:61562

https://ipinfo.io/ip%appdata%

unknown

https://duckduckgo.com/chrome_newtab

unknown

http://54.39.249.56:61562t-

unknown

https://duckduckgo.com/ac/?q=

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous

unknown

http://tempuri.org/Endpoint/CheckConnectResponse

unknown

http://schemas.datacontract.org/2004/07/

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX

unknown

http://tempuri.org/Endpoint/EnvironmentSettings

unknown

https://api.ip.sb/geoip%USERPEnvironmentROFILE%

unknown

http://ns.adobe.0/xmp

unknown

https://api.ip.sb

unknown

https://api.ip.sb/geoip

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://tempuri.org/

unknown

http://tempuri.org/Endpoint/CheckConnect

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

http://54.39.249.56:61562

unknown

https://www.ecosia.org/newtab/

unknown

http://tempuri.org/Endpoint/VerifyUpdateResponse

unknown

http://tempuri.org/Endpoint/SetEnvironment

unknown

http://tempuri.org/Endpoint/SetEnvironmentResponse

unknown

http://tempuri.org/Endpoint/GetUpdates

unknown

https://ac.ecosia.org/autocomplete?q=

unknown

https://api.ipify.orgcookies//settinString.Removeg

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://tempuri.org/Endpoint/GetUpdatesResponse

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

http://tempuri.org/Endpoint/EnvironmentSettingsResponse

unknown

http://tempuri.org/Endpoint/VerifyUpdate

unknown

http://tempuri.org/0

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

http://ns.adob/1.0/P

unknown

http://schemas.xmlsoap.org/soap/actor/next

unknown

There are 29 hidden URLs, click here to show them.

Domains

Name

Malicious

api.ip.sb

unknown

IPs

Domain

Country

Malicious

54.39.249.56

unknown

Canada

Details

IP:	54.39.249.56
TargetID:	0
Current Path:	C:\Users\user\Desktop\hPEMPaXhhr.exe
Country:	Canada
Countrycode:	CAN
ASN number:	16276
ASN name:	OVHFR
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
HTTP GET or POST without a user agent	Networking
Connects to IPs without corresponding DNS lookups	Networking
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\hPEMPaXhhr_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

F72000

unkown

page readonly

32C0000

trusted library allocation

page read and write

5B3B000

trusted library allocation

page read and write

6B53000

heap

page read and write

37F1000

trusted library allocation

page read and write

1337000

stack

page read and write

375C000

trusted library allocation

page read and write

7BFF000

stack

page read and write

5B90000

trusted library allocation

page read and write

3550000

trusted library allocation

page read and write

3271000

trusted library allocation

page read and write

1887000

trusted library allocation

page execute and read and write

6D30000

trusted library allocation

page read and write

6E40000

trusted library allocation

page read and write

5CB0000

trusted library allocation

page execute and read and write

6D40000

trusted library allocation

page read and write

6E95000

trusted library allocation

page read and write

4443000

trusted library allocation

page read and write

3491000

trusted library allocation

page read and write

F70000

unkown

page readonly

8910000

trusted library allocation

page execute and read and write

7C40000

trusted library allocation

page read and write

58D0000

trusted library allocation

page read and write

16E0000

heap

page read and write

353B000

trusted library allocation

page read and write

7D80000

heap

page read and write

4463000

trusted library allocation

page read and write

7342000

trusted library allocation

page read and write

6AB2000

heap

page read and write

6DFF000

stack

page read and write

732D000

stack

page read and write

1355000

heap

page read and write

7C60000

trusted library allocation

page execute and read and write

6B92000

trusted library allocation

page read and write

47AC000

trusted library allocation

page read and write

6A6E000

stack

page read and write

6B90000

trusted library allocation

page read and write

7EB8000

heap

page read and write

80A0000

trusted library allocation

page read and write

456E000

trusted library allocation

page read and write

186D000

trusted library allocation

page execute and read and write

47BE000

trusted library allocation

page read and write

47BB000

trusted library allocation

page read and write

6A88000

heap

page read and write

6BEE000

stack

page read and write

30B8000

trusted library allocation

page read and write

612E000

stack

page read and write

7C10000

trusted library allocation

page read and write

326F000

stack

page read and write

6D42000

trusted library allocation

page read and write

1872000

trusted library allocation

page read and write

60EE000

stack

page read and write

6D18000

trusted library allocation

page read and write

479F000

trusted library allocation

page read and write

47D0000

trusted library allocation

page read and write

5E50000

trusted library allocation

page read and write

3499000

trusted library allocation

page read and write

6E20000

trusted library allocation

page read and write

721B000

stack

page read and write

7C80000

heap

page read and write

13C0000

heap

page read and write

5B2E000

stack

page read and write

6B46000

heap

page read and write

3579000

trusted library allocation

page read and write

348F000

trusted library allocation

page read and write

3556000

trusted library allocation

page read and write

7EEF000

heap

page read and write

5C70000

trusted library allocation

page read and write

7C90000

heap

page read and write

5D3E000

stack

page read and write

33E3000

trusted library allocation

page read and write

185D000

trusted library allocation

page execute and read and write

3301000

trusted library allocation

page read and write

8900000

heap

page read and write

5B52000

trusted library allocation

page read and write

36E1000

trusted library allocation

page read and write

37C4000

trusted library allocation

page read and write

1880000

trusted library allocation

page read and write

6A70000

heap

page read and write

32F0000

trusted library allocation

page read and write

4282000

trusted library allocation

page read and write

1876000

trusted library allocation

page execute and read and write

13F4000

heap

page read and write

7FBA0000

trusted library allocation

page execute and read and write

1854000

trusted library allocation

page read and write

5BE0000

trusted library allocation

page execute and read and write

88FE000

stack

page read and write

5B46000

trusted library allocation

page read and write

6DBD000

stack

page read and write

3753000

trusted library allocation

page read and write

879E000

stack

page read and write

3501000

trusted library allocation

page read and write

1390000

heap

page read and write

5C00000

trusted library allocation

page read and write

6BF0000

trusted library allocation

page execute and read and write

5C8A000

trusted library allocation

page read and write

6EA0000

trusted library allocation

page read and write

1840000

trusted library allocation

page read and write

5E4E000

stack

page read and write

3160000

heap

page read and write

7D90000

heap

page read and write

47B5000

trusted library allocation

page read and write

182E000

stack

page read and write

74C0000

trusted library allocation

page execute and read and write

6E88000

trusted library allocation

page read and write

1860000

trusted library allocation

page read and write

7C50000

trusted library allocation

page execute and read and write

7EF2000

heap

page read and write

74B0000

trusted library allocation

page read and write

36EB000

trusted library allocation

page read and write

3544000

trusted library allocation

page read and write

5B41000

trusted library allocation

page read and write

47C4000

trusted library allocation

page read and write

5B71000

trusted library allocation

page read and write

7C20000

trusted library allocation

page read and write

56F0000

heap

page read and write

7340000

trusted library allocation

page read and write

696E000

stack

page read and write

6EC0000

trusted library allocation

page execute and read and write

87FE000

stack

page read and write

6D25000

trusted library allocation

page read and write

6D05000

trusted library allocation

page read and write

5B30000

trusted library allocation

page read and write

6E50000

trusted library allocation

page read and write

5BA0000

trusted library allocation

page read and write

6D00000

trusted library allocation

page read and write

6E66000

trusted library allocation

page read and write

5B61000

trusted library allocation

page read and write

7C95000

heap

page read and write

58C0000

trusted library allocation

page read and write

6D2F000

trusted library allocation

page read and write

6AE9000

heap

page read and write

6E8D000

trusted library allocation

page read and write

5CA0000

trusted library allocation

page read and write

1401000

heap

page read and write

32FD000

trusted library allocation

page read and write

6E46000

trusted library allocation

page read and write

18C8000

heap

page read and write

6E81000

trusted library allocation

page read and write

6E62000

trusted library allocation

page read and write

18A0000

trusted library allocation

page read and write

47B0000

trusted library allocation

page read and write

5720000

trusted library allocation

page read and write

37CF000

trusted library allocation

page read and write

6CFF000

stack

page read and write

686F000

stack

page read and write

7220000

heap

page read and write

15CE000

stack

page read and write

3493000

trusted library allocation

page read and write

1350000

heap

page read and write

5C60000

trusted library allocation

page read and write

3487000

trusted library allocation

page read and write

7EBB000

heap

page read and write

750E000

stack

page read and write

4271000

trusted library allocation

page read and write

6B06000

heap

page read and write

6D50000

trusted library allocation

page read and write

5D40000

trusted library allocation

page execute and read and write

6D02000

trusted library allocation

page read and write

371C000

trusted library allocation

page read and write

7350000

heap

page read and write

6E74000

trusted library allocation

page read and write

7C30000

heap

page read and write

6D45000

trusted library allocation

page read and write

34CF000

trusted library allocation

page read and write

427E000

trusted library allocation

page read and write

1853000

trusted library allocation

page execute and read and write

5C10000

trusted library allocation

page execute and read and write

378D000

trusted library allocation

page read and write

7C49000

trusted library allocation

page read and write

6E6C000

trusted library allocation

page read and write

6B4F000

heap

page read and write

1850000

trusted library allocation

page read and write

6BA0000

trusted library allocation

page execute and read and write

1870000

trusted library allocation

page read and write

58BA000

trusted library allocation

page read and write

52AC000

stack

page read and write

5710000

trusted library allocation

page read and write

7330000

trusted library allocation

page read and write

58B0000

trusted library allocation

page read and write

7D93000

heap

page read and write

5A2E000

stack

page read and write

13CE000

heap

page read and write

5C90000

trusted library allocation

page read and write

5CFD000

stack

page read and write

30AE000

stack

page read and write

5B5E000

trusted library allocation

page read and write

586E000

stack

page read and write

58AE000

stack

page read and write

5BF0000

trusted library allocation

page read and write

13A0000

heap

page read and write

188B000

trusted library allocation

page execute and read and write

6E64000

trusted library allocation

page read and write

58E0000

heap

page execute and read and write

7C70000

trusted library allocation

page read and write

4343000

trusted library allocation

page read and write

172D000

stack

page read and write

16CE000

stack

page read and write

5E5E000

trusted library allocation

page read and write

6E6F000

trusted library allocation

page read and write

6EB0000

trusted library allocation

page read and write

7EA0000

heap

page read and write

6D2A000

trusted library allocation

page read and write

7D85000

heap

page read and write

34D9000

trusted library allocation

page read and write

59EE000

stack

page read and write

6B35000

heap

page read and write

6B60000

heap

page read and write

6D34000

trusted library allocation

page read and write

1882000

trusted library allocation

page read and write

7C00000

trusted library allocation

page read and write

6D1A000

trusted library allocation

page read and write

6B4A000

heap

page read and write

6A8C000

heap

page read and write

47B9000

trusted library allocation

page read and write

74A0000

trusted library allocation

page read and write

5BB0000

trusted library allocation

page read and write

7EB0000

heap

page read and write

32DE000

trusted library allocation

page read and write

3150000

trusted library allocation

page execute and read and write

5E5B000

trusted library allocation

page read and write

6AD7000

heap

page read and write

1885000

trusted library allocation

page execute and read and write

18B0000

heap

page execute and read and write

18C0000

heap

page read and write

47A6000

trusted library allocation

page read and write

58B4000

trusted library allocation

page read and write

6E7E000

trusted library allocation

page read and write

32E9000

trusted library allocation

page read and write

53AD000

stack

page read and write

6B70000

trusted library allocation

page read and write

6E78000

trusted library allocation

page read and write

6D1F000

trusted library allocation

page read and write

5C8D000

trusted library allocation

page read and write

869E000

stack

page read and write

18CE000

heap

page read and write

6D09000

trusted library allocation

page read and write

6E92000

trusted library allocation

page read and write

7530000

trusted library allocation

page execute and read and write

6E86000

trusted library allocation

page read and write

576E000

stack

page read and write

7540000

trusted library allocation

page execute and read and write

123B000

stack

page read and write

There are 233 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
hPEMPaXhhr.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReporthPEMPaXhhr.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
hPEMPaXhhr.exe