Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
G47wmLn8uy.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\~DFAFA5F207726209AF.TMP
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
 |
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\G47wmLn8uy.exe
|
"C:\Users\user\Desktop\G47wmLn8uy.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\subideal\Eyeliners
|
HARNISKKLDT
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4D10000
|
unkown
|
page execute and read and write
|
|
|
|
7FF5A7368000
|
unkown image
|
page readonly
|
|
|
|
2D5AF38D000
|
unkown
|
page read and write
|
|
|
|
7FF50ACB4000
|
unkown image
|
page readonly
|
|
|
|
7DF51E112000
|
unkown image
|
page readonly
|
|
|
|
7FF51B1E2000
|
unkown image
|
page readonly
|
|
|
|
2D5AF38E000
|
unkown
|
page read and write
|
|
|
|
610000
|
heap private
|
page read and write
|
|
|
|
1DEE284B000
|
unkown
|
page read and write
|
|
|
|
DF6C67F000
|
stack
|
page read and write
|
|
|
|
1E2C4230000
|
unkown image
|
page readonly
|
|
|
|
7FF5A73CC000
|
unkown image
|
page readonly
|
|
|
|
1DEE2900000
|
unkown
|
page read and write
|
|
|
|
2D5AF202000
|
unkown
|
page read and write
|
|
|
|
2D5AF391000
|
unkown
|
page read and write
|
|
|
|
2D5AEA00000
|
unkown
|
page read and write
|
|
|
|
7FF5842C8000
|
unkown image
|
page readonly
|
|
|
|
2050000
|
unkown
|
page read and write
|
|
|
|
2D5AF366000
|
unkown
|
page read and write
|
|
|
|
7FF5A72A1000
|
unkown image
|
page readonly
|
|
|
|
1DEE2886000
|
unkown
|
page read and write
|
|
|
|
1D790B30000
|
unkown image
|
page readonly
|
|
|
|
2B59000
|
heap private
|
page read and write
|
|
|
|
2D5AF35D000
|
unkown
|
page read and write
|
|
|
|
7FF51B107000
|
unkown image
|
page readonly
|
|
|
|
1E2C3DB0000
|
unkown image
|
page readonly
|
|
|
|
2D5AEA48000
|
unkown
|
page read and write
|
|
|
|
2D5AF802000
|
unkown
|
page read and write
|
|
|
|
7FF5841C4000
|
unkown image
|
page readonly
|
|
|
|
29A000
|
unkown
|
page read and write
|
|
|
|
1D51E83C000
|
unkown
|
page read and write
|
|
|
|
1E2C3E86000
|
heap default
|
page read and write
|
|
|
|
7FF51B11F000
|
unkown image
|
page readonly
|
|
|
|
2D5AF366000
|
unkown
|
page read and write
|
|
|
|
7FF50A820000
|
unkown image
|
page readonly
|
|
|
|
7DF5BC5D0000
|
unkown image
|
page readonly
|
|
|
|
2D5AF120000
|
unkown
|
page read and write
|
|
|
|
1D790E00000
|
unkown image
|
page readonly
|
|
|
|
19C000
|
unkown
|
page read and write
|
|
|
|
7FF51B0FB000
|
unkown image
|
page readonly
|
|
|
|
7FF50ABAD000
|
unkown image
|
page readonly
|
|
|
|
2D5AF388000
|
unkown
|
page read and write
|
|
|
|
7FF50AC4C000
|
unkown image
|
page readonly
|
|
|
|
7FF51B158000
|
unkown image
|
page readonly
|
|
|
|
2D5AF364000
|
unkown
|
page read and write
|
|
|
|
2D5AE8A0000
|
heap private
|
page read and write
|
|
|
|
1D791402000
|
unkown
|
page read and write
|
|
|
|
7FF509008000
|
unkown image
|
page readonly
|
|
|
|
1D51ED80000
|
unkown image
|
page readonly
|
|
|
|
7FF50AAB1000
|
unkown image
|
page readonly
|
|
|
|
7FF5A7026000
|
unkown image
|
page readonly
|
|
|
|
20B0000
|
heap private
|
page read and write
|
|
|
|
2D5AF38E000
|
unkown
|
page read and write
|
|
|
|
2C336CC000
|
unkown
|
page read and write
|
|
|
|
1D790C7B000
|
unkown
|
page read and write
|
|
|
|
7FF5A744A000
|
unkown image
|
page readonly
|
|
|
|
1D51E640000
|
heap private
|
page read and write
|
|
|
|
1D790C50000
|
unkown
|
page read and write
|
|
|
|
2D5AF397000
|
unkown
|
page read and write
|
|
|
|
1DEE2879000
|
unkown
|
page read and write
|
|
|
|
2C33CF7000
|
stack
|
page read and write
|
|
|
|
1D790C13000
|
unkown
|
page read and write
|
|
|
|
2D5AF380000
|
unkown
|
page read and write
|
|
|
|
7FF51B0DC000
|
unkown image
|
page readonly
|
|
|
|
2204000
|
heap private
|
page read and write
|
|
|
|
7FF5A6DB3000
|
unkown image
|
page readonly
|
|
|
|
234D07B000
|
unkown
|
page read and write
|
|
|
|
2060000
|
unkown
|
page execute read
|
|
|
|
7FF50ACBF000
|
unkown image
|
page readonly
|
|
|
|
1DEE2650000
|
unkown image
|
page read and write
|
|
|
|
2D5AF802000
|
unkown
|
page read and write
|
|
|
|
7FF5A7465000
|
unkown image
|
page readonly
|
|
|
|
2D5AF38E000
|
unkown
|
page read and write
|
|