Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

qg155Ew08h.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	6.73523840649229
Filename:	qg155Ew08h.exe
Filesize:	630272
MD5:	5710e8153d3061cb80c0a4c8d1d59fec
SHA1:	1aaa05a14f5643d5e4b7db83fe0c305ebde11808
SHA256:	dd4f243c9479d1de2347886a12ef03febcfc4a1ce97af2b604736b68d5e62105
SHA512:	6beb60cfe1adf6a2d9edb184709dcee04792c8f04c239006ec6bcb4e0749541efbc15ee73b590ac95e83a0e310594e463780f09f4b85aed00bd85c33c45f4a21
SSDEEP:	12288:JdHXZpAPZdx9+ysrGGbH8X1gajA9m+QHPto5sFTL3mXXiWthWAqThdbxKVTJz2rE:JdiZdPshclgaoWe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\X.f................................. ........@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains potential unpacker	Data Obfuscation	Software Packing
.NET source code contains very large array initializations	System Summary	Disable or Modify Tools
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion
Contains functionality to inject code into remote processes	HIPS / PFW / Operating System Protection Evasion	Security Software Discovery
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
Machine Learning detection for sample	AV Detection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains functionality to call native functions	System Summary	Security Software Discovery
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection Security Software Discovery
Detected potential crypto function	System Summary	Security Software Discovery Archive Collected Data
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion	Virtualization/Sandbox Evasion Security Software Discovery
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Security Software Discovery
Sample file is different than original file name gathered from version info	System Summary	Security Software Discovery
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Contains functionality to modify the execution of threads in other processes
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to register its own exception handler	Anti Debugging	Security Software Discovery
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Security Software Discovery
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qg155Ew08h.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qg155Ew08h.exe.log
Category:	dropped
Dump:	qg155Ew08h.exe.log.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\qg155Ew08h.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	4.0050635535766075
Encrypted:	false
Ssdeep:	3:QHXMKa/xwwUy:Q3La/xwQ
Size:	42
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Roaming\d3d9.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Roaming\d3d9.dll
Category:	dropped
Dump:	d3d9.dll.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\qg155Ew08h.exe
Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy:	6.069611518899029
Encrypted:	false
Ssdeep:	6144:3aQMm5qN8yhCXbEqzkjM5CgCcfAht4njAHnISLnl2M9V4AdFDDB:IOqN8yhWTQjMsgmkAHfnlzV9/
Size:	474112
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Machine Learning detection for dropped file	AV Detection
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log
Category:	dropped
Dump:	MSBuild.exe.log.2.dr
ID:	dr_2
Target ID:	2
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.33145931749415
Encrypted:	false
Ssdeep:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
Size:	3094
Whitelisted:	false
Reputation:	high

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\qg155Ew08h.exe

"C:\Users\user\Desktop\qg155Ew08h.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2568
Target ID:	0
Parent PID:	2580
Name:	qg155Ew08h.exe
Path:	C:\Users\user\Desktop\qg155Ew08h.exe
Commandline:	"C:\Users\user\Desktop\qg155Ew08h.exe"
Size:	630272
MD5:	5710E8153D3061CB80C0A4C8D1D59FEC
Time:	08:36:54
Date:	27/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x6e0000
Modulesize:	655360
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Details

Is windows:	true
Is dropped:	false
PID:	6664
Target ID:	2
Parent PID:	2568
Name:	MSBuild.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Size:	262432
MD5:	8FDF47E0FF70C40ED3A17014AEEA4232
Time:	08:36:55
Date:	27/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x840000
Modulesize:	262144
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	6484
Target ID:	1
Parent PID:	2568
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	08:36:54
Date:	27/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/sct

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk

unknown

https://duckduckgo.com/ac/?q=

unknown

http://tempuri.org/Entity/Id14ResponseD

unknown

http://tempuri.org/Entity/Id23ResponseD

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary

unknown

http://tempuri.org/Entity/Id12Response

unknown

http://tempuri.org/

unknown

http://tempuri.org/Entity/Id2Response

unknown

http://tempuri.org/Entity/Id15V

unknown

http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1

unknown

http://tempuri.org/Entity/Id21Response

unknown

http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap

unknown

http://tempuri.org/Entity/Id9

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID

unknown

http://tempuri.org/Entity/Id8

unknown

http://tempuri.org/Entity/Id6ResponseD

unknown

http://tempuri.org/Entity/Id5

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare

unknown

http://tempuri.org/Entity/Id4

unknown

http://tempuri.org/Entity/Id7

unknown

http://tempuri.org/Entity/Id6

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret

unknown

http://tempuri.org/Entity/Id19Response

unknown

http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence

unknown

http://tempuri.org/Entity/Id13ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/fault

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat

unknown

http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey

unknown

http://tempuri.org/Entity/Id15Response

unknown

http://tempuri.org/Entity/Id5ResponseD

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register

unknown

http://tempuri.org/Entity/Id6Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey

unknown

https://api.ip.sb/ip

unknown

http://schemas.xmlsoap.org/ws/2004/04/sc

unknown

http://tempuri.org/Entity/Id1ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel

unknown

http://tempuri.org/Entity/Id9Response

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://tempuri.org/Entity/Id20

unknown

http://tempuri.org/Entity/Id21

unknown

http://tempuri.org/Entity/Id22

unknown

http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1

unknown

http://tempuri.org/Entity/Id23

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1

unknown

http://tempuri.org/Entity/Id24

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue

unknown

http://tempuri.org/Entity/Id24Response

unknown

https://www.ecosia.org/newtab/

unknown

http://tempuri.org/Entity/Id1Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego

unknown

http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey

unknown

http://tempuri.org/Entity/Id21ResponseD

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue

unknown

http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust

unknown

http://tempuri.org/Entity/Id10

unknown

http://tempuri.org/Entity/Id11

unknown

http://tempuri.org/Entity/Id10ResponseD

unknown

http://tempuri.org/Entity/Id12

unknown

http://tempuri.org/Entity/Id16Response

unknown

http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel

unknown

http://tempuri.org/Entity/Id13

unknown

http://tempuri.org/Entity/Id14

unknown

http://tempuri.org/Entity/Id15

unknown

http://tempuri.org/Entity/Id16

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce

unknown

http://tempuri.org/Entity/Id17

unknown

http://tempuri.org/Entity/Id18

unknown

http://tempuri.org/Entity/Id5Response

unknown

http://tempuri.org/Entity/Id19

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns

unknown

http://tempuri.org/Entity/Id15ResponseD

unknown

http://tempuri.org/Entity/Id10Response

unknown

http://schemas.xmlsoap.org/ws/2005/02/trust/Renew

unknown

http://tempuri.org/Entity/Id11ResponseD

unknown

http://tempuri.org/Entity/Id8Response

unknown

http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0

unknown

http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID

unknown

http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT

unknown

http://schemas.xmlsoap.org/ws/2006/02/addressingidentity

unknown

http://tempuri.org/Entity/Id17ResponseD

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

http://tempuri.org/Entity/Id8ResponseD

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

fp2e7a.wpc.phicdn.net

192.229.221.95

IPs

Domain

Country

Malicious

5.42.92.213

unknown

Russian Federation

Details

IP:	5.42.92.213
TargetID:	2
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Country:	Russian Federation
Countrycode:	RUS
ASN number:	39493
ASN name:	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Owner

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

SessionHash

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

Sequence

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFiles0000

HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000

RegFilesHash

Memdumps

Base Address

Regiontype

Protect

Malicious

2C81000

trusted library allocation

page read and write

2D14000

trusted library allocation

page read and write

6CFA9000

unkown

page read and write

402000

remote allocation

page execute and read and write

632C000

stack

page read and write

1218000

trusted library allocation

page read and write

FA8000

heap

page read and write

2E50000

trusted library allocation

page read and write

6B45000

trusted library allocation

page read and write

3CA1000

trusted library allocation

page read and write

56E0000

heap

page read and write

D1E000

heap

page read and write

11A0000

heap

page read and write

D10000

heap

page read and write

970000

heap

page read and write

71DF000

stack

page read and write

6B05000

trusted library allocation

page read and write

1320000

trusted library allocation

page read and write

6CFA2000

unkown

page readonly

11C0000

heap

page execute and read and write

DE9000

heap

page read and write

721E000

stack

page read and write

4BDE000

stack

page read and write

2BE0000

trusted library allocation

page read and write

A3C000

stack

page read and write

3C8F000

trusted library allocation

page read and write

2AA8000

trusted library allocation

page read and write

56ED000

heap

page read and write

6AAD000

stack

page read and write

5470000

trusted library allocation

page execute and read and write

568B000

heap

page read and write

E30000

trusted library allocation

page read and write

5080000

trusted library allocation

page read and write

53F0000

trusted library allocation

page execute and read and write

2C40000

trusted library allocation

page read and write

4ADE000

stack

page read and write

7CFE000

stack

page read and write

12FC000

stack

page read and write

5100000

heap

page read and write

11CE000

stack

page read and write

DCA000

heap

page read and write

5480000

trusted library allocation

page read and write

6C10000

trusted library allocation

page read and write

E75000

trusted library allocation

page execute and read and write

EC0000

trusted library allocation

page execute and read and write

51A0000

heap

page read and write

5642000

heap

page read and write

E40000

trusted library allocation

page read and write

435000

remote allocation

page execute and read and write

3EC3000

trusted library allocation

page read and write

6C40000

trusted library allocation

page read and write

2BFE000

trusted library allocation

page read and write

622E000

stack

page read and write

749E000

stack

page read and write

6EFA000

heap

page read and write

F40000

trusted library allocation

page read and write

6EA9000

heap

page read and write

3FFB000

trusted library allocation

page read and write

F0E000

stack

page read and write

E5D000

trusted library allocation

page execute and read and write

5410000

trusted library allocation

page read and write

F97000

heap

page read and write

EA0000

heap

page read and write

DE2000

heap

page read and write

E60000

trusted library allocation

page read and write

514A000

trusted library allocation

page read and write

6AD0000

trusted library allocation

page read and write

3AA1000

trusted library allocation

page read and write

4498000

trusted library allocation

page read and write

725F000

stack

page read and write

D3C000

heap

page read and write

6B42000

trusted library allocation

page read and write

5390000

trusted library allocation

page read and write

1310000

trusted library allocation

page read and write

69AE000

stack

page read and write

7BFD000

stack

page read and write

6F1A000

heap

page read and write

6B30000

trusted library allocation

page read and write

5604000

heap

page read and write

120E000

stack

page read and write

2E49000

trusted library allocation

page read and write

6950000

trusted library allocation

page read and write

7510000

trusted library allocation

page read and write

30F7000

trusted library allocation

page read and write

2C60000

trusted library allocation

page read and write

2E37000

trusted library allocation

page read and write

EFA000

heap

page read and write

DD4000

heap

page read and write

11D0000

heap

page read and write

5350000

trusted library allocation

page read and write

F34000

trusted library allocation

page read and write

2E45000

trusted library allocation

page read and write

61DC000

stack

page read and write

74A0000

trusted library allocation

page execute and read and write

4F5E000

stack

page read and write

5182000

trusted library allocation

page read and write

E6A000

trusted library allocation

page execute and read and write

30F1000

trusted library allocation

page read and write

3107000

trusted library allocation

page read and write

E50000

trusted library allocation

page read and write

3F00000

trusted library allocation

page read and write

D18000

heap

page read and write

4021000

trusted library allocation

page read and write

439A000

trusted library allocation

page read and write

6C0F000

stack

page read and write

5140000

trusted library allocation

page read and write

6EE7000

heap

page read and write

5380000

trusted library allocation

page read and write

5120000

trusted library allocation

page read and write

5148000

trusted library allocation

page read and write

7270000

heap

page read and write

2C20000

trusted library allocation

page read and write

4003000

trusted library allocation

page read and write

C35000

heap

page read and write

9A0000

heap

page read and write

F94000

heap

page read and write

3DA3000

trusted library allocation

page read and write

E62000

trusted library allocation

page read and write

5176000

trusted library allocation

page read and write

6B40000

trusted library allocation

page read and write

E77000

trusted library allocation

page execute and read and write

2E42000

trusted library allocation

page read and write

DDC000

heap

page read and write

FE1000

trusted library allocation

page read and write

756D000

stack

page read and write

7260000

heap

page read and write

2E3A000

trusted library allocation

page read and write

5F8E000

stack

page read and write

60CC000

stack

page read and write

5340000

trusted library allocation

page read and write

55C0000

trusted library allocation

page read and write

56BE000

heap

page read and write

2F73000

trusted library allocation

page read and write

6B1F000

trusted library allocation

page read and write

E70000

trusted library allocation

page read and write

1330000

heap

page read and write

5E4E000

stack

page read and write

6B60000

trusted library allocation

page execute and read and write

6C70000

trusted library allocation

page read and write

6B25000

trusted library allocation

page read and write

569F000

heap

page read and write

3FB7000

trusted library allocation

page read and write

2BE4000

trusted library allocation

page read and write

B3B000

stack

page read and write

E66000

trusted library allocation

page execute and read and write

30FD000

trusted library allocation

page read and write

2AA1000

trusted library allocation

page read and write

4D7C000

stack

page read and write

3FF5000

trusted library allocation

page read and write

E90000

trusted library allocation

page read and write

F67000

trusted library allocation

page execute and read and write

F44000

trusted library allocation

page read and write

5653000

heap

page read and write

E7B000

trusted library allocation

page execute and read and write

564D000

heap

page read and write

2E32000

trusted library allocation

page read and write

2EA6000

trusted library allocation

page read and write

42A5000

trusted library allocation

page read and write

2C06000

trusted library allocation

page read and write

31DB000

trusted library allocation

page read and write

444000

remote allocation

page execute and read and write

133A000

heap

page read and write

560C000

heap

page read and write

56DC000

heap

page read and write

C30000

heap

page read and write

5600000

heap

page read and write

6ED1000

heap

page read and write

6EEB000

heap

page read and write

ED0000

heap

page read and write

F68000

heap

page read and write

2DCA000

trusted library allocation

page read and write

3FC1000

trusted library allocation

page read and write

5E0F000

stack

page read and write

5113000

heap

page execute and read and write

3FEB000

trusted library allocation

page read and write

3FCC000

trusted library allocation

page read and write

5145000

trusted library allocation

page read and write

6CFF5000

unkown

page readonly

6ADA000

trusted library allocation

page read and write

980000

heap

page read and write

5375000

trusted library allocation

page read and write

ED8000

heap

page read and write

8B16000

heap

page read and write

3109000

trusted library allocation

page read and write

56C4000

heap

page read and write

1300000

trusted library allocation

page read and write

2BEB000

trusted library allocation

page read and write

B70000

heap

page read and write

6EA0000

heap

page read and write

573E000

stack

page read and write

401C000

trusted library allocation

page read and write

5686000

heap

page read and write

6EA2000

heap

page read and write

430000

remote allocation

page execute and read and write

5F4E000

stack

page read and write

5090000

heap

page execute and read and write

5191000

trusted library allocation

page read and write

44C0000

trusted library allocation

page read and write

6AD7000

trusted library allocation

page read and write

6CFEA000

unkown

page read and write

2C35000

trusted library allocation

page read and write

5740000

trusted library allocation

page execute and read and write

5677000

heap

page read and write

537B000

trusted library allocation

page read and write

55B0000

trusted library allocation

page execute and read and write

2E4E000

trusted library allocation

page read and write

505F000

stack

page read and write

9A5000

heap

page read and write

56C6000

heap

page read and write

F6B000

trusted library allocation

page execute and read and write

6B50000

trusted library allocation

page read and write

11F0000

heap

page read and write

B80000

heap

page read and write

6B09000

trusted library allocation

page read and write

5160000

trusted library allocation

page read and write

12B0000

heap

page read and write

55F0000

heap

page execute and read and write

3103000

trusted library allocation

page read and write

30F5000

trusted library allocation

page read and write

11E0000

trusted library allocation

page read and write

56B5000

heap

page read and write

55D0000

trusted library allocation

page read and write

5110000

heap

page execute and read and write

400F000

trusted library allocation

page read and write

769F000

stack

page read and write

3FF9000

trusted library allocation

page read and write

5698000

heap

page read and write

3FE6000

trusted library allocation

page read and write

3101000

trusted library allocation

page read and write

2E4C000

trusted library allocation

page read and write

E44000

trusted library allocation

page read and write

6B1A000

trusted library allocation

page read and write

519A000

trusted library allocation

page read and write

F33000

trusted library allocation

page execute and read and write

FF0000

heap

page read and write

8B00000

heap

page read and write

FCE000

stack

page read and write

5122000

trusted library allocation

page read and write

53B0000

trusted library allocation

page read and write

2C0D000

trusted library allocation

page read and write

516B000

trusted library allocation

page read and write

5646000

heap

page read and write

C0E000

stack

page read and write

5681000

heap

page read and write

2A9F000

stack

page read and write

739E000

stack

page read and write

6B2F000

trusted library allocation

page read and write

5400000

trusted library allocation

page read and write

7520000

heap

page read and write

2C30000

trusted library allocation

page read and write

DD1000

heap

page read and write

6E0000

unkown

page readonly

A820000

trusted library allocation

page execute and read and write

F20000

trusted library allocation

page read and write

56AE000

heap

page read and write

70DE000

stack

page read and write

6CF80000

unkown

page readonly

FCC000

heap

page read and write

6B18000

trusted library allocation

page read and write

518E000

trusted library allocation

page read and write

56CD000

heap

page read and write

31CE000

trusted library allocation

page read and write

750B000

stack

page read and write

566B000

heap

page read and write

10FE000

stack

page read and write

6B00000

trusted library allocation

page read and write

90A000

stack

page read and write

D51000

heap

page read and write

6C24000

trusted library allocation

page read and write

6B34000

trusted library allocation

page read and write

2C70000

heap

page execute and read and write

6F27000

heap

page read and write

9EE000

stack

page read and write

6BCE000

stack

page read and write

2EF0000

trusted library allocation

page read and write

2BDE000

stack

page read and write

537E000

trusted library allocation

page read and write

FD0000

trusted library allocation

page execute and read and write

5672000

heap

page read and write

6EBB000

heap

page read and write

55E0000

trusted library allocation

page execute and read and write

2E83000

trusted library allocation

page read and write

5370000

trusted library allocation

page read and write

E4D000

trusted library allocation

page execute and read and write

E0E000

stack

page read and write

5171000

trusted library allocation

page read and write

6B02000

trusted library allocation

page read and write

BCE000

stack

page read and write

51A3000

heap

page read and write

6C60000

trusted library allocation

page execute and read and write

74B0000

heap

page read and write

310D000

trusted library allocation

page read and write

3C81000

trusted library allocation

page read and write

3FDB000

trusted library allocation

page read and write

10CE000

stack

page read and write

6E2000

unkown

page readonly

6CF81000

unkown

page execute read

133E000

heap

page read and write

F08000

heap

page read and write

5070000

trusted library section

page read and write

6C5D000

trusted library allocation

page read and write

50F0000

heap

page read and write

E20000

heap

page read and write

4386000

trusted library allocation

page read and write

E43000

trusted library allocation

page execute and read and write

6C20000

trusted library allocation

page read and write

D37000

heap

page read and write

5130000

trusted library allocation

page execute and read and write

759E000

stack

page read and write

3F8F000

trusted library allocation

page read and write

CF7000

stack

page read and write

F9F000

heap

page read and write

1337000

heap

page read and write

608F000

stack

page read and write

55A0000

trusted library allocation

page read and write

53A0000

trusted library allocation

page read and write

E72000

trusted library allocation

page read and write

6B2A000

trusted library allocation

page read and write

6F1E000

heap

page read and write

53E0000

trusted library allocation

page read and write

D44000

heap

page read and write

56E5000

heap

page read and write

2C01000

trusted library allocation

page read and write

6C30000

trusted library allocation

page execute and read and write

4538000

trusted library allocation

page read and write

2C12000

trusted library allocation

page read and write

FF6D0000

trusted library allocation

page execute and read and write

6C50000

trusted library allocation

page read and write

60D0000

trusted library allocation

page execute and read and write

5361000

trusted library allocation

page read and write

1210000

trusted library allocation

page read and write

400000

remote allocation

page execute and read and write

30FB000

trusted library allocation

page read and write

5460000

trusted library allocation

page execute and read and write

D7E000

heap

page read and write

There are 325 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
qg155Ew08h.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportqg155Ew08h.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
qg155Ew08h.exe