Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

c4RAHq3BNl.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\ProgramData\nss3.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\ProgramData\AFHDAKJKFCFBGCBGDHCBAFCAKE

SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3

dropped

C:\ProgramData\BAFBFCBGHDGCFHJJECAFBGDHDH

SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7

dropped

C:\ProgramData\CAAAAFBKFIECAAKECGCA

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\ProgramData\ECFCBFBG

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\ProgramData\EEGWXUHVUG.docx

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\ProgramData\EFOYFBOLXA.docx

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\ProgramData\EGIDHDGCBFBKECBFHCAFHJDBGH

SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5

dropped

C:\ProgramData\GRXZDKKVDB.xlsx

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\ProgramData\IIIDAKJDHJKFHIEBFCGHCGHDGC

SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2

dropped

C:\ProgramData\JDGCFBAF

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\ProgramData\NVWZAPQSQL.docx

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\ProgramData\NVWZAPQSQL.xlsx

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\ProgramData\PALRGUCVEH.xlsx

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\ProgramData\freebl3.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\ProgramData\mozglue.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\ProgramData\msvcp140.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\ProgramData\softokn3.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\ProgramData\vcruntime140.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 2 23:07:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

dropped

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

data

dropped

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

data

dropped

Chrome Cache Entry: 95

ASCII text, with very long lines (4568)

downloaded

There are 26 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\c4RAHq3BNl.exe

"C:\Users\user\Desktop\c4RAHq3BNl.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6488
Target ID:	0
Parent PID:	1028
Name:	c4RAHq3BNl.exe
Path:	C:\Users\user\Desktop\c4RAHq3BNl.exe
Commandline:	"C:\Users\user\Desktop\c4RAHq3BNl.exe"
Size:	356352
MD5:	5451FDDD7B59B191DF90B89A06EF1691
Time:	02:06:59
Date:	03/05/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	40976384
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Detected unpacking (changes PE section rights)	Data Obfuscation	Software Packing
Detected unpacking (overwrites its own PE header)	Compliance, Data Obfuscation	Software Packing
Multi AV Scanner detection for submitted file	AV Detection
Yara detected Mars stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Stealc	Stealing of Sensitive Information, Remote Access Functionality
Yara detected Vidar stealer	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///

Details

Is windows:	true
Is dropped:	false
PID:	3148
Target ID:	2
Parent PID:	4912
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	02:07:04
Date:	03/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2024,i,11327387611839351283,1554127739086396422,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2220
Target ID:	4
Parent PID:	3148
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2024,i,11327387611839351283,1554127739086396422,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	02:07:04
Date:	03/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2024,i,11327387611839351283,1554127739086396422,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	7764
Target ID:	8
Parent PID:	3148
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=2024,i,11327387611839351283,1554127739086396422,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	02:08:29
Date:	03/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff715980000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://shaffatta.co

unknown

https://shaffatta.com

unknown

https://duckduckgo.com/chrome_newtab

unknown

https://shaffatta.com/M%

unknown

https://duckduckgo.com/ac/?q=

unknown

https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YOPbGKrV0LEGIjBS7GnGmqaZ9EWfyRGfksWN7UDK3EXq_-bjwYmJEf0C5nRkSFOpXYOxhCcsjI-KqzoyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

142.250.176.196

https://shaffatta.com/fdca69ae739b4897.php8ec24d29b45ae0b00693c3ad9a656

unknown

https://shaffatta.com/L

unknown

https://shaffatta.com/fdca69ae739b4897.php

168.119.248.46

https://shaffatta.com/d32e011d2eaa85a0/mozglue.dll

168.119.248.46

https://shaffatta.com/

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

https://shaffatta.com/d32e011d2eaa85a0/msvcp140.dll

168.119.248.46

https://shaffatta.com/AKJDHJKFHIEBFCGHCGHDGC

unknown

https://shaffatta.com/d32e011d2eaa85a0/freebl3.dll)

unknown

https://shaffatta.com/d32e011d2eaa85a0/sqlite3.dllu#

unknown

https://shaffatta.com/fdca69ae739b4897.phpiYW4qLCpjYXJkcyosKmJhbmtzKiwqY3Z2KiwqY3ZjKiwqYWNjb3VudCosK

unknown

https://shaffatta.com/(

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

https://shaffatta.com/d32e011d2eaa85a0/nss3.dll3

unknown

https://shaffatta.com/ktop

unknown

https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

142.250.176.196

https://shaffatta.com/:

unknown

http://www.sqlite.org/copyright.html.

unknown

https://shaffatta.com/d32e011d2eaa85a0/nss3.dll

168.119.248.46

https://shaffatta.com/d32e011d2eaa85a0/freebl3.dll

168.119.248.46

http://www.mozilla.com/en-US/blocklist/

unknown

https://shaffatta.com/d32e011d2eaa85a0/freebl3.dll/$oT

unknown

https://mozilla.org0/

unknown

https://shaffatta.com/t%

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

https://shaffatta.com/d32e011d2eaa85a0/vcruntime140.dll8

unknown

https://shaffatta.com/d32e011d2eaa85a0/mozglue.dllG#

unknown

https://shaffatta.com/d32e011d2eaa85a0/sqlite3.dllg$

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

https://shaffatta.com/d32e011d2eaa85a0/sqlite3.dll

168.119.248.46

https://www.google.com/async/newtab_promos

142.250.176.196

https://shaffatta.com/d32e011d2eaa85a0/vcruntime140.dll

168.119.248.46

https://shaffatta.com/fdca69ae739b4897.phpindows

unknown

https://shaffatta.com/fdca69ae739b4897.phption:

unknown

https://shaffatta.com/fdca69ae739b4897.phpnts

unknown

https://www.ecosia.org/newtab/

unknown

https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br

unknown

https://ac.ecosia.org/autocomplete?q=

unknown

https://www.google.com/async/ddljson?async=ntp:2

142.250.176.196

https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YOPbGKrV0LEGIjCEBr3ti8UCkjxZ8z1bhLV56wHmRrKhu4Vx7PJg1CB49b8tfAh4AUocopkgP0IK5pYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

142.250.176.196

https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw

142.250.176.196

https://shaffatta.com/fatta.com/

unknown

https://shaffatta.com/fatta.com/X

unknown

https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL

unknown

https://shaffatta.com/amData

unknown

https://shaffatta.com/d32e011d2eaa85a0/softokn3.dll

168.119.248.46

https://shaffatta.com/32e011d2eaa85a0/nss3.dll

unknown

https://support.mozilla.org

unknown

https://shaffatta.com/fatta.com/DGIDAKEBAAKFCGHCBAKJDA

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

https://shaffatta.com/d3e

unknown

There are 47 hidden URLs, click here to show them.

Domains

Name

Malicious

shaffatta.com

168.119.248.46

Details

Name:	shaffatta.com
IP:	168.119.248.46
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Sample uses string decryption to hide its real strings	AV Detection
HTTP GET or POST without a user agent	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

www.google.com

142.250.176.196

Details

Name:	www.google.com
IP:	142.250.176.196
TargetID:	4
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

168.119.248.46

shaffatta.com

Germany

Details

IP:	168.119.248.46
TargetID:	0
Current Path:	C:\Users\user\Desktop\c4RAHq3BNl.exe
Country:	Germany
Countrycode:	DEU
ASN number:	24940
ASN name:	HETZNER-ASDE
Private:	false
Domain:	shaffatta.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

142.250.176.196

www.google.com

United States

239.255.255.250

unknown

Reserved

192.168.2.13

unknown

192.168.2.5

unknown

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Owner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

SessionHash

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Sequence

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFiles0000

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFilesHash

Memdumps

Base Address

Regiontype

Protect

Malicious

400000

unkown

page execute and read and write

2C80000

direct allocation

page execute and read and write

2CB0000

direct allocation

page read and write

2D76000

heap

page read and write

549000

unkown

page execute and read and write

23785000

heap

page read and write

237BF000

heap

page read and write

6C752000

unkown

page readonly

44B000

unkown

page execute and read and write

2DD9000

heap

page read and write

2BF0000

heap

page read and write

2C00000

direct allocation

page execute and read and write

23797000

heap

page read and write

1D473000

heap

page read and write

3090000

heap

page read and write

237B1000

heap

page read and write

2AE9000

unkown

page execute and read and write

237A0000

heap

page read and write

237BF000

heap

page read and write

2E1E000

heap

page read and write

6C945000

unkown

page readonly

235C4000

heap

page read and write

2E1E000

heap

page read and write

1D4AB000

heap

page read and write

2DDE000

heap

page read and write

2C80000

direct allocation

page read and write

2DD6000

heap

page read and write

1D412000

heap

page read and write

2F8FD000

heap

page read and write

2FC0000

heap

page read and write

301E000

stack

page read and write

61EB7000

direct allocation

page readonly

237BE000

heap

page read and write

2379D000

heap

page read and write

2F8EB000

heap

page read and write

23570000

heap

page read and write

23791000

heap

page read and write

1D190000

remote allocation

page read and write

2F0E000

stack

page read and write

237B8000

heap

page read and write

1D4ED000

heap

page read and write

1CD0F000

stack

page read and write

237A0000

heap

page read and write

237B1000

heap

page read and write

237B0000

heap

page read and write

1D410000

trusted library allocation

page read and write

6C940000

unkown

page read and write

1CC0F000

stack

page read and write

237A0000

heap

page read and write

237AC000

heap

page read and write

1D484000

heap

page read and write

2C70000

heap

page read and write

2EC0000

heap

page read and write

43E000

unkown

page write copy

237B2000

heap

page read and write

1D14E000

stack

page read and write

237A0000

heap

page read and write

9B000

stack

page read and write

2F8F1000

heap

page read and write

1D48A000

heap

page read and write

1D190000

remote allocation

page read and write

401000

unkown

page execute read

61ECC000

direct allocation

page read and write

23793000

heap

page read and write

23796000

heap

page read and write

1D190000

remote allocation

page read and write

6C93F000

unkown

page write copy

2E1D000

heap

page read and write

237A7000

heap

page read and write

19C000

stack

page read and write

2379A000

heap

page read and write

6C6C1000

unkown

page execute read

237A8000

heap

page read and write

234EE000

stack

page read and write

237B1000

heap

page read and write

23797000

heap

page read and write

1D311000

heap

page read and write

2E1E000

heap

page read and write

237B0000

heap

page read and write

2FC7000

heap

page read and write

6C8FF000

unkown

page readonly

2E60000

heap

page read and write

41A000

unkown

page readonly

2E14000

heap

page read and write

61EB4000

direct allocation

page read and write

237A0000

heap

page read and write

23796000

heap

page read and write

2AFC000

unkown

page readonly

237B1000

heap

page read and write

237A0000

heap

page read and write

2D37000

heap

page execute and read and write

1D2CF000

stack

page read and write

2C75000

heap

page read and write

237BB000

heap

page read and write

1D500000

heap

page read and write

2F4E000

stack

page read and write

2D60000

heap

page execute and read and write

1D310000

heap

page read and write

1D47D000

heap

page read and write

237A0000

heap

page read and write

237B0000

heap

page read and write

237A0000

heap

page read and write

1D1CE000

stack

page read and write

23798000

heap

page read and write

2C14000

direct allocation

page execute and read and write

237A0000

heap

page read and write

23797000

heap

page read and write

2E1E000

heap

page read and write

2D20000

heap

page read and write

237BF000

heap

page read and write

2D2E000

heap

page read and write

237A0000

heap

page read and write

2E19000

heap

page read and write

61ED4000

direct allocation

page readonly

1D410000

heap

page read and write

23793000

heap

page read and write

61ED0000

direct allocation

page read and write

237B9000

heap

page read and write

636000

unkown

page execute and read and write

237A0000

heap

page read and write

1D473000

heap

page read and write

6C6C0000

unkown

page readonly

2DD9000

heap

page read and write

2DD9000

heap

page read and write

237B4000

heap

page read and write

2DD9000

heap

page read and write

1D300000

heap

page read and write

400000

unkown

page readonly

237B0000

heap

page read and write

624000

unkown

page execute and read and write

23799000

heap

page read and write

237BB000

heap

page read and write

23788000

heap

page read and write

2E5E000

stack

page read and write

2E1D000

heap

page read and write

2DAA000

heap

page read and write

237A0000

heap

page read and write

235A0000

heap

page read and write

237B9000

heap

page read and write

1C6CF000

stack

page read and write

235C0000

heap

page read and write

237AF000

heap

page read and write

2379D000

heap

page read and write

61ED3000

direct allocation

page read and write

2F50000

heap

page read and write

1CF0D000

stack

page read and write

2E16000

heap

page read and write

237BE000

heap

page read and write

2FCB000

heap

page read and write

23796000

heap

page read and write

23794000

heap

page read and write

1D478000

heap

page read and write

2E1E000

heap

page read and write

6C74E000

unkown

page read and write

1F0000

heap

page read and write

23786000

heap

page read and write

6C73D000

unkown

page readonly

1D51A000

heap

page read and write

1D4EC000

heap

page read and write

448000

unkown

page execute and read and write

237BB000

heap

page read and write

2C93000

direct allocation

page read and write

1D311000

heap

page read and write

6C761000

unkown

page execute read

23797000

heap

page read and write

1CB0F000

stack

page read and write

237B2000

heap

page read and write

2DD2000

heap

page read and write

2FBE000

stack

page read and write

2379F000

heap

page read and write

2F84F000

stack

page read and write

2C77000

heap

page read and write

2DC7000

heap

page read and write

237A0000

heap

page read and write

2D2A000

heap

page read and write

1D4AB000

heap

page read and write

61E01000

direct allocation

page execute read

2D5B000

heap

page read and write

61ECD000

direct allocation

page readonly

23783000

heap

page read and write

237B1000

heap

page read and write

237B1000

heap

page read and write

1D04E000

stack

page read and write

1D00E000

stack

page read and write

2DD9000

heap

page read and write

237B1000

heap

page read and write

195000

stack

page read and write

305E000

stack

page read and write

2DD9000

heap

page read and write

6C760000

unkown

page readonly

23793000

heap

page read and write

319E000

stack

page read and write

1D473000

heap

page read and write

235C8000

heap

page read and write

2F8E3000

heap

page read and write

237BF000

heap

page read and write

237B9000

heap

page read and write

6C93E000

unkown

page read and write

2CAC000

direct allocation

page read and write

23580000

heap

page read and write

2CEE000

stack

page read and write

2DD2000

heap

page read and write

2DE2000

heap

page read and write

237A0000

heap

page read and write

23883000

heap

page read and write

23799000

heap

page read and write

237BB000

heap

page read and write

1CE0F000

stack

page read and write

237BB000

heap

page read and write

2FCB000

heap

page read and write

23780000

heap

page read and write

2EBE000

stack

page read and write

237B2000

heap

page read and write

2DE2000

heap

page read and write

2379B000

heap

page read and write

23797000

heap

page read and write

61E00000

direct allocation

page execute and read and write

237B1000

heap

page read and write

40C000

unkown

page readonly

2AFC000

unkown

page readonly

2C77000

heap

page read and write

23786000

heap

page read and write

2F8F5000

heap

page read and write

23785000

heap

page read and write

237BB000

heap

page read and write

237A0000

heap

page read and write

237BF000

heap

page read and write

2DD6000

heap

page read and write

There are 218 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
c4RAHq3BNl.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportc4RAHq3BNl.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
c4RAHq3BNl.exe