Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

2BuZaUic3i.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2BuZaUic3i.exe.log

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp1C61.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp1C82.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp1C92.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp1CA3.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp1CB4.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmp1CC4.tmp

SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp5394.tmp

dropped

C:\Users\user\AppData\Local\Temp\tmp743B.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp744B.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp744C.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp745D.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp745E.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp746F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp7470.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp7480.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp7491.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp7492.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpACAA.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpACBB.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpACBC.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpACCD.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpACDD.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpACDE.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpACEF.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpACFF.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpAD10.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpC0B7.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpC0B8.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpC0B9.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpC0CA.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpC0CB.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpC0CC.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpC0CD.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpC0DD.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpE4BB.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE4BC.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE4BD.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE4CE.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE4CF.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpE4DF.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpE4E0.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpE4F1.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpE502.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpE503.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpE513.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\Local\Temp\tmpE524.tmp

SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2

dropped

There are 38 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\2BuZaUic3i.exe

"C:\Users\user\Desktop\2BuZaUic3i.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2104
Target ID:	0
Parent PID:	2580
Name:	2BuZaUic3i.exe
Path:	C:\Users\user\Desktop\2BuZaUic3i.exe
Commandline:	"C:\Users\user\Desktop\2BuZaUic3i.exe"
Size:	97792
MD5:	9FE5F95D5355185B04B8E78D1C8CEBE4
Time:	16:01:57
Date:	31/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xc00000
Modulesize:	122880
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Machine Learning detection for sample	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	4320
Target ID:	1
Parent PID:	2104
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	16:01:57
Date:	31/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

207.32.219.79:40826

http://207.32.219.79:40826/

207.32.219.79

https://ipinfo.io/ip%appdata%

unknown

https://duckduckgo.com/chrome_newtab

unknown

https://duckduckgo.com/ac/?q=

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous

unknown

http://tempuri.org/Endpoint/CheckConnectResponse

unknown

http://schemas.datacontract.org/2004/07/

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX

unknown

http://tempuri.org/Endpoint/EnvironmentSettings

unknown

https://api.ip.sb/geoip%USERPEnvironmentROFILE%

unknown

https://api.ip.sb

unknown

https://api.ip.sb/geoip

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://tempuri.org/

unknown

http://tempuri.org/Endpoint/CheckConnect

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

https://www.ecosia.org/newtab/

unknown

http://tempuri.org/Endpoint/VerifyUpdateResponse

unknown

http://tempuri.org/Endpoint/SetEnviron

unknown

http://tempuri.org/Endpoint/SetEnvironment

unknown

http://tempuri.org/Endpoint/SetEnvironmentResponse

unknown

http://207.32.219.79:40826t-dq

unknown

http://tempuri.org/Endpoint/GetUpdates

unknown

https://ac.ecosia.org/autocomplete?q=

unknown

https://api.ipify.orgcookies//settinString.Removeg

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://207.32.219.79:40826

unknown

http://207.32.219.79:4

unknown

http://tempuri.org/Endpoint/GetUpdatesResponse

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

http://tempuri.org/Endpoint/EnvironmentSettingsResponse

unknown

http://tempuri.org/Endpoint/VerifyUpdate

unknown

http://tempuri.org/0

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

http://schemas.xmlsoap.org/soap/actor/next

unknown

There are 29 hidden URLs, click here to show them.

Domains

Name

Malicious

api.ip.sb

unknown

IPs

Domain

Country

Malicious

207.32.219.79

unknown

United States

Details

IP:	207.32.219.79
TargetID:	0
Current Path:	C:\Users\user\Desktop\2BuZaUic3i.exe
Country:	United States
Countrycode:	USA
ASN number:	14315
ASN name:	1GSERVERSUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Connects to many ports of the same IP (likely port scanning)	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
HTTP GET or POST without a user agent	Networking
Connects to IPs without corresponding DNS lookups	Networking
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2BuZaUic3i_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

C02000

unkown

page readonly

6E6F000

stack

page read and write

58B0000

trusted library allocation

page read and write

117E000

stack

page read and write

15DE000

stack

page read and write

6E92000

trusted library allocation

page read and write

7140000

trusted library allocation

page read and write

69AF000

trusted library allocation

page read and write

69C4000

trusted library allocation

page read and write

7110000

trusted library allocation

page execute and read and write

553E000

stack

page read and write

11F0000

trusted library allocation

page read and write

7CA0000

trusted library allocation

page read and write

698F000

stack

page read and write

5920000

trusted library allocation

page read and write

69D5000

trusted library allocation

page read and write

CAB000

stack

page read and write

6992000

trusted library allocation

page read and write

1010000

heap

page read and write

2EE0000

trusted library allocation

page read and write

598D000

stack

page read and write

5570000

heap

page execute and read and write

6827000

heap

page read and write

3F93000

trusted library allocation

page read and write

5DE0000

trusted library allocation

page read and write

6995000

trusted library allocation

page read and write

120B000

trusted library allocation

page execute and read and write

113E000

stack

page read and write

2FB1000

trusted library allocation

page read and write

7170000

heap

page read and write

1637000

heap

page read and write

5E02000

trusted library allocation

page read and write

6FE0000

trusted library allocation

page read and write

67F1000

heap

page read and write

3071000

trusted library allocation

page read and write

580B000

trusted library allocation

page read and write

6EA4000

trusted library allocation

page read and write

11E0000

trusted library allocation

page read and write

14BE000

stack

page read and write

6E96000

trusted library allocation

page read and write

920A000

heap

page read and write

6880000

trusted library allocation

page execute and read and write

6ED9000

trusted library allocation

page read and write

11D3000

trusted library allocation

page execute and read and write

5AEB000

trusted library allocation

page read and write

5AE0000

trusted library allocation

page read and write

6B50000

trusted library allocation

page read and write

5890000

trusted library allocation

page read and write

337E000

trusted library allocation

page read and write

83EE000

stack

page read and write

5822000

trusted library allocation

page read and write

6999000

trusted library allocation

page read and write

5800000

trusted library allocation

page read and write

7ABE000

heap

page read and write

6EB6000

trusted library allocation

page read and write

6814000

heap

page read and write

7000000

trusted library allocation

page execute and read and write

5850000

trusted library allocation

page execute and read and write

11F2000

trusted library allocation

page read and write

788E000

stack

page read and write

6FF0000

trusted library allocation

page read and write

163B000

heap

page read and write

2F10000

heap

page execute and read and write

687E000

stack

page read and write

6EAE000

trusted library allocation

page read and write

6FDB000

stack

page read and write

69B5000

trusted library allocation

page read and write

7990000

heap

page read and write

1260000

heap

page read and write

675C000

heap

page read and write

7200000

heap

page read and write

11C0000

trusted library allocation

page read and write

59CE000

stack

page read and write

71D0000

trusted library allocation

page execute and read and write

5D7E000

stack

page read and write

12B4000

heap

page read and write

3F2E000

trusted library allocation

page read and write

5550000

trusted library allocation

page read and write

91F0000

heap

page read and write

11ED000

trusted library allocation

page execute and read and write

69A8000

trusted library allocation

page read and write

9206000

heap

page read and write

7C90000

trusted library allocation

page execute and read and write

2F01000

trusted library allocation

page read and write

2EDE000

stack

page read and write

1288000

heap

page read and write

2EF0000

trusted library allocation

page read and write

147E000

stack

page read and write

1240000

trusted library allocation

page read and write

2F21000

trusted library allocation

page read and write

6EE0000

trusted library allocation

page read and write

3F32000

trusted library allocation

page read and write

10F0000

heap

page read and write

69E0000

trusted library allocation

page read and write

2FA0000

trusted library allocation

page read and write

2F70000

trusted library allocation

page read and write

5940000

trusted library allocation

page execute and read and write

56FE000

stack

page read and write

591D000

trusted library allocation

page read and write

1230000

trusted library allocation

page execute and read and write

653E000

stack

page read and write

7A9E000

heap

page read and write

11D0000

trusted library allocation

page read and write

7130000

trusted library allocation

page read and write

69D2000

trusted library allocation

page read and write

30B3000

trusted library allocation

page read and write

6EB8000

trusted library allocation

page read and write

30BB000

trusted library allocation

page read and write

6EA8000

trusted library allocation

page read and write

11DD000

trusted library allocation

page execute and read and write

59D0000

trusted library allocation

page execute and read and write

67A6000

heap

page read and write

30D4000

trusted library allocation

page read and write

2F97000

trusted library allocation

page read and write

6990000

trusted library allocation

page read and write

71F0000

trusted library allocation

page execute and read and write

5E00000

trusted library allocation

page read and write

69C0000

trusted library allocation

page read and write

57FE000

stack

page read and write

14C0000

trusted library allocation

page read and write

1624000

trusted library allocation

page read and write

6EC5000

trusted library allocation

page read and write

6EB1000

trusted library allocation

page read and write

7120000

trusted library allocation

page read and write

128E000

heap

page read and write

DA8000

stack

page read and write

1220000

trusted library allocation

page read and write

12A7000

heap

page read and write

6740000

heap

page read and write

1630000

heap

page read and write

4F28000

trusted library allocation

page read and write

1207000

trusted library allocation

page execute and read and write

56BE000

stack

page read and write

682C000

heap

page read and write

591A000

trusted library allocation

page read and write

6B4E000

stack

page read and write

7F8C0000

trusted library allocation

page execute and read and write

11D4000

trusted library allocation

page read and write

725E000

stack

page read and write

5AEE000

trusted library allocation

page read and write

7A90000

heap

page read and write

14D0000

heap

page read and write

161C000

stack

page read and write

6E9C000

trusted library allocation

page read and write

6B0E000

stack

page read and write

71E0000

trusted library allocation

page read and write

6ED0000

trusted library allocation

page read and write

5840000

trusted library allocation

page read and write

79A0000

heap

page read and write

7180000

heap

page read and write

4053000

trusted library allocation

page read and write

30DA000

trusted library allocation

page read and write

6E70000

trusted library allocation

page read and write

5930000

trusted library allocation

page read and write

6AC0000

trusted library allocation

page execute and read and write

5816000

trusted library allocation

page read and write

3F21000

trusted library allocation

page read and write

7AD7000

heap

page read and write

67A8000

heap

page read and write

6AB0000

trusted library allocation

page read and write

69BF000

trusted library allocation

page read and write

6E80000

trusted library allocation

page execute and read and write

1250000

heap

page read and write

7210000

trusted library allocation

page read and write

6810000

heap

page read and write

33E8000

trusted library allocation

page read and write

4F20000

trusted library allocation

page read and write

69D0000

trusted library allocation

page read and write

6E9F000

trusted library allocation

page read and write

6A8F000

stack

page read and write

6E2E000

stack

page read and write

69AA000

trusted library allocation

page read and write

1205000

trusted library allocation

page execute and read and write

1620000

trusted library allocation

page read and write

58A0000

trusted library allocation

page execute and read and write

6E94000

trusted library allocation

page read and write

12C1000

heap

page read and write

1180000

heap

page read and write

1202000

trusted library allocation

page read and write

5ADF000

stack

page read and write

5900000

trusted library allocation

page read and write

50BD000

stack

page read and write

582E000

trusted library allocation

page read and write

543E000

stack

page read and write

5831000

trusted library allocation

page read and write

6EC2000

trusted library allocation

page read and write

C00000

unkown

page readonly

6F70000

trusted library allocation

page read and write

5560000

trusted library allocation

page read and write

1200000

trusted library allocation

page read and write

6A4D000

stack

page read and write

162A000

trusted library allocation

page read and write

67BA000

heap

page read and write

6EBD000

trusted library allocation

page read and write

6782000

heap

page read and write

11F6000

trusted library allocation

page execute and read and write

673E000

stack

page read and write

5E10000

trusted library allocation

page execute and read and write

663E000

stack

page read and write

2FAD000

trusted library allocation

page read and write

5880000

trusted library allocation

page read and write

42FA000

trusted library allocation

page read and write

5811000

trusted library allocation

page read and write

6AA0000

trusted library allocation

page read and write

69BA000

trusted library allocation

page read and write

1280000

heap

page read and write

55BE000

stack

page read and write

1185000

heap

page read and write

5DBE000

stack

page read and write

There are 199 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
2BuZaUic3i.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report2BuZaUic3i.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
2BuZaUic3i.exe