Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\YYF2G.a
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
"C:\Windows\System32\regsvr32.exe" -S .\YYF2G.A
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
F61000
|
unkown
|
page execute read
|
||
|
3280000
|
heap
|
page read and write
|
||
|
3481000
|
heap
|
page read and write
|
||
|
3400000
|
heap
|
page read and write
|
||
|
54B0000
|
heap
|
page read and write
|
||
|
533E000
|
stack
|
page read and write
|
||
|
EA0000
|
heap
|
page read and write
|
||
|
35A0000
|
heap
|
page read and write
|
||
|
3457000
|
heap
|
page read and write
|
||
|
38EB000
|
heap
|
page read and write
|
||
|
50B1000
|
direct allocation
|
page execute read
|
||
|
3489000
|
heap
|
page read and write
|
||
|
38AA000
|
trusted library allocation
|
page read and write
|
||
|
3456000
|
heap
|
page read and write
|
||
|
330E000
|
stack
|
page read and write
|
||
|
5B1F000
|
stack
|
page read and write
|
||
|
344F000
|
heap
|
page read and write
|
||
|
57AE000
|
stack
|
page read and write
|
||
|
3457000
|
heap
|
page read and write
|
||
|
EFD000
|
stack
|
page read and write
|
||
|
53C0000
|
heap
|
page read and write
|
||
|
5350000
|
heap
|
page read and write
|
||
|
3426000
|
heap
|
page read and write
|
||
|
3315000
|
heap
|
page read and write
|
||
|
FA7000
|
unkown
|
page read and write
|
||
|
543E000
|
stack
|
page read and write
|
||
|
3445000
|
heap
|
page read and write
|
||
|
3429000
|
heap
|
page read and write
|
||
|
5B5B000
|
stack
|
page read and write
|
||
|
3891000
|
trusted library allocation
|
page read and write
|
||
|
38E7000
|
heap
|
page read and write
|
||
|
3448000
|
heap
|
page read and write
|
||
|
345A000
|
heap
|
page read and write
|
||
|
34C3000
|
heap
|
page read and write
|
||
|
F3D000
|
stack
|
page read and write
|
||
|
5446000
|
direct allocation
|
page read and write
|
||
|
3448000
|
heap
|
page read and write
|
||
|
FBC000
|
unkown
|
page readonly
|
||
|
328A000
|
heap
|
page read and write
|
||
|
F9E000
|
unkown
|
page read and write
|
||
|
4F7A000
|
direct allocation
|
page read and write
|
||
|
58DE000
|
stack
|
page read and write
|
||
|
53C4000
|
heap
|
page read and write
|
||
|
3465000
|
heap
|
page read and write
|
||
|
3407000
|
heap
|
page read and write
|
||
|
E39000
|
stack
|
page read and write
|
||
|
343A000
|
heap
|
page read and write
|
||
|
51D1000
|
direct allocation
|
page execute read
|
||
|
357F000
|
stack
|
page read and write
|
||
|
349A000
|
heap
|
page read and write
|
||
|
FBC000
|
unkown
|
page write copy
|
||
|
780D000
|
stack
|
page read and write
|
||
|
3489000
|
heap
|
page read and write
|
||
|
53B0000
|
heap
|
page read and write
|
||
|
353E000
|
stack
|
page read and write
|
||
|
F61000
|
unkown
|
page execute read
|
||
|
343E000
|
heap
|
page read and write
|
||
|
35FD000
|
stack
|
page read and write
|
||
|
3580000
|
direct allocation
|
page execute and read and write
|
||
|
50B6000
|
direct allocation
|
page read and write
|
||
|
3444000
|
heap
|
page read and write
|
||
|
344D000
|
heap
|
page read and write
|
||
|
3310000
|
heap
|
page read and write
|
||
|
33E0000
|
heap
|
page read and write
|
||
|
3483000
|
heap
|
page read and write
|
||
|
F92000
|
unkown
|
page readonly
|
||
|
349C000
|
heap
|
page read and write
|
||
|
52D0000
|
direct allocation
|
page read and write
|
||
|
349C000
|
heap
|
page read and write
|
||
|
6E10000
|
trusted library allocation
|
page read and write
|
||
|
59DF000
|
stack
|
page read and write
|
||
|
3462000
|
heap
|
page read and write
|
||
|
F60000
|
unkown
|
page readonly
|
||
|
343E000
|
heap
|
page read and write
|
||
|
3250000
|
heap
|
page read and write
|
||
|
51DE000
|
direct allocation
|
page readonly
|
||
|
F40000
|
heap
|
page read and write
|
||
|
2FEC000
|
stack
|
page read and write
|
||
|
3456000
|
heap
|
page read and write
|
||
|
2FAB000
|
stack
|
page read and write
|
||
|
38E0000
|
heap
|
page read and write
|
||
|
344D000
|
heap
|
page read and write
|
||
|
3456000
|
heap
|
page read and write
|
||
|
E2C000
|
stack
|
page read and write
|
||
|
329C000
|
heap
|
page read and write
|
||
|
F9E000
|
unkown
|
page write copy
|
||
|
3429000
|
heap
|
page read and write
|
||
|
F92000
|
unkown
|
page readonly
|
||
|
53D0000
|
heap
|
page read and write
|
||
|
3260000
|
heap
|
page read and write
|
||
|
FBD000
|
unkown
|
page readonly
|
||
|
34FF000
|
stack
|
page read and write
|
||
|
4EE0000
|
heap
|
page read and write
|
||
|
D36000
|
stack
|
page read and write
|
||
|
33DE000
|
stack
|
page read and write
|
||
|
3472000
|
heap
|
page read and write
|
||
|
EB0000
|
heap
|
page readonly
|
||
|
56B0000
|
trusted library allocation
|
page read and write
|
||
|
36FE000
|
stack
|
page read and write
|
||
|
7610000
|
heap
|
page read and write
|
||
|
F60000
|
unkown
|
page readonly
|
||
|
5A1E000
|
stack
|
page read and write
|
There are 92 hidden memdumps, click here to show them.