Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Kofc4rRZdp.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\42ZqUg._
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Kofc4rRZdp.exe
|
"C:\Users\user\Desktop\Kofc4rRZdp.exe"
|
|
|
|
C:\Windows\SysWOW64\regsvr32.exe
|
"C:\Windows\System32\regsvr32.exe" /u /s .\42ZQUg._
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2D97000
|
heap
|
page read and write
|
||
|
2D39000
|
heap
|
page read and write
|
||
|
762000
|
unkown
|
page read and write
|
||
|
4956000
|
direct allocation
|
page read and write
|
||
|
970000
|
heap
|
page read and write
|
||
|
549F000
|
stack
|
page read and write
|
||
|
2D44000
|
heap
|
page read and write
|
||
|
2D30000
|
heap
|
page read and write
|
||
|
2990000
|
heap
|
page readonly
|
||
|
2D6C000
|
heap
|
page read and write
|
||
|
4FA0000
|
trusted library allocation
|
page read and write
|
||
|
29ED000
|
stack
|
page read and write
|
||
|
920000
|
heap
|
page read and write
|
||
|
711000
|
unkown
|
page execute read
|
||
|
710000
|
unkown
|
page readonly
|
||
|
742000
|
unkown
|
page readonly
|
||
|
3241000
|
trusted library allocation
|
page read and write
|
||
|
2916000
|
stack
|
page read and write
|
||
|
2D50000
|
heap
|
page read and write
|
||
|
910000
|
heap
|
page read and write
|
||
|
960000
|
direct allocation
|
page execute and read and write
|
||
|
772C000
|
stack
|
page read and write
|
||
|
76EF000
|
stack
|
page read and write
|
||
|
2CD0000
|
heap
|
page read and write
|
||
|
2D84000
|
heap
|
page read and write
|
||
|
2D37000
|
heap
|
page read and write
|
||
|
2D39000
|
heap
|
page read and write
|
||
|
2D84000
|
heap
|
page read and write
|
||
|
4951000
|
direct allocation
|
page execute read
|
||
|
2CFB000
|
stack
|
page read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
2FCD000
|
stack
|
page read and write
|
||
|
300E000
|
stack
|
page read and write
|
||
|
2D3A000
|
heap
|
page read and write
|
||
|
4A71000
|
direct allocation
|
page execute read
|
||
|
2D84000
|
heap
|
page read and write
|
||
|
2D5B000
|
heap
|
page read and write
|
||
|
4F90000
|
heap
|
page read and write
|
||
|
2D99000
|
heap
|
page read and write
|
||
|
782D000
|
stack
|
page read and write
|
||
|
3260000
|
heap
|
page read and write
|
||
|
2D36000
|
heap
|
page read and write
|
||
|
2D56000
|
heap
|
page read and write
|
||
|
2D6C000
|
heap
|
page read and write
|
||
|
4B68000
|
direct allocation
|
page read and write
|
||
|
2D3A000
|
heap
|
page read and write
|
||
|
2D39000
|
heap
|
page read and write
|
||
|
310E000
|
stack
|
page read and write
|
||
|
2D5B000
|
heap
|
page read and write
|
||
|
525E000
|
stack
|
page read and write
|
||
|
2D63000
|
heap
|
page read and write
|
||
|
29F0000
|
heap
|
page read and write
|
||
|
2D63000
|
heap
|
page read and write
|
||
|
76D000
|
unkown
|
page readonly
|
||
|
325A000
|
trusted library allocation
|
page read and write
|
||
|
4E50000
|
heap
|
page read and write
|
||
|
2C1E000
|
stack
|
page read and write
|
||
|
29A0000
|
heap
|
page read and write
|
||
|
74E000
|
unkown
|
page read and write
|
||
|
4FC0000
|
heap
|
page read and write
|
||
|
75E000
|
unkown
|
page read and write
|
||
|
2D27000
|
heap
|
page read and write
|
||
|
76C000
|
unkown
|
page readonly
|
||
|
75EE000
|
stack
|
page read and write
|
||
|
4FD0000
|
heap
|
page read and write
|
||
|
6C50000
|
trusted library allocation
|
page read and write
|
||
|
2D2A000
|
heap
|
page read and write
|
||
|
2B9E000
|
stack
|
page read and write
|
||
|
2D40000
|
heap
|
page read and write
|
||
|
2C5F000
|
stack
|
page read and write
|
||
|
2D6C000
|
heap
|
page read and write
|
||
|
2D74000
|
heap
|
page read and write
|
||
|
2D39000
|
heap
|
page read and write
|
||
|
74E000
|
unkown
|
page write copy
|
||
|
76C000
|
unkown
|
page write copy
|
||
|
742000
|
unkown
|
page readonly
|
||
|
4D27000
|
direct allocation
|
page read and write
|
||
|
2CEC000
|
stack
|
page read and write
|
||
|
97A000
|
heap
|
page read and write
|
||
|
3267000
|
heap
|
page read and write
|
||
|
2D2F000
|
heap
|
page read and write
|
||
|
2980000
|
heap
|
page read and write
|
||
|
89C000
|
stack
|
page read and write
|
||
|
535E000
|
stack
|
page read and write
|
||
|
2BDF000
|
stack
|
page read and write
|
||
|
539E000
|
stack
|
page read and write
|
||
|
2D00000
|
heap
|
page read and write
|
||
|
326B000
|
heap
|
page read and write
|
||
|
4FA0000
|
heap
|
page read and write
|
||
|
2D84000
|
heap
|
page read and write
|
||
|
4A7B000
|
direct allocation
|
page readonly
|
||
|
2D40000
|
heap
|
page read and write
|
||
|
2D41000
|
heap
|
page read and write
|
||
|
2D63000
|
heap
|
page read and write
|
||
|
85B000
|
stack
|
page read and write
|
||
|
2D76000
|
heap
|
page read and write
|
||
|
710000
|
unkown
|
page readonly
|
||
|
29A5000
|
heap
|
page read and write
|
||
|
2D6C000
|
heap
|
page read and write
|
||
|
2D08000
|
heap
|
page read and write
|
||
|
2DC0000
|
heap
|
page read and write
|
||
|
3214000
|
heap
|
page read and write
|
||
|
2D6C000
|
heap
|
page read and write
|
||
|
2D39000
|
heap
|
page read and write
|
||
|
711000
|
unkown
|
page execute read
|
||
|
4570000
|
heap
|
page read and write
|
||
|
2D62000
|
heap
|
page read and write
|
||
|
757000
|
unkown
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
2D99000
|
heap
|
page read and write
|
||
|
3210000
|
heap
|
page read and write
|
||
|
2D84000
|
heap
|
page read and write
|
There are 102 hidden memdumps, click here to show them.