Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_RegDLL.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_setup64.tmp
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\nsi2AC5.tmp\SelfDel.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-3T87F.tmp\_isetup\_shfoldr.dll
|
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
|
|
C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe
|
C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe /VERYSILENT /SP- /NORESTART
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp
|
"C:\Users\user\AppData\Local\Temp\is-K5V3G.tmp\Youbak_MSN_PARTNER2036.tmp" /SL5="$20468,737659,54272,C:\Users\user\AppData\Local\Temp\Youbak_MSN_PARTNER2036.exe"
/VERYSILENT /SP- /NORESTART
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.innosetup.com/
|
unknown
|
||
|
http://nsis.sf.net/NSIS_Error
|
unknown
|
||
|
http://www.remobjects.com/psU
|
unknown
|
||
|
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
||
|
http://www.remobjects.com/ps
|
unknown
|
||
|
http://msn.youbak.com2
|
unknown
|
||
|
http://msn.youbak.com#
|
unknown
|
||
|
http://msn.youbak.com
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
643000
|
heap
|
page read and write
|
||
|
20C0000
|
heap
|
page read and write
|
||
|
313E000
|
stack
|
page read and write
|
||
|
72A000
|
heap
|
page read and write
|
||
|
73C000
|
heap
|
page read and write
|
||
|
27CF000
|
stack
|
page read and write
|
||
|
337F000
|
stack
|
page read and write
|
||
|
21E8000
|
direct allocation
|
page read and write
|
||
|
40B000
|
unkown
|
page read and write
|
||
|
1F61000
|
direct allocation
|
page read and write
|
||
|
49B000
|
unkown
|
page write copy
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
500000
|
heap
|
page read and write
|
||
|
755000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
9B000
|
stack
|
page read and write
|
||
|
1F3F000
|
stack
|
page read and write
|
||
|
409000
|
unkown
|
page read and write
|
||
|
21DC000
|
direct allocation
|
page read and write
|
||
|
60B000
|
heap
|
page read and write
|
||
|
498000
|
unkown
|
page write copy
|
||
|
430000
|
heap
|
page read and write
|
||
|
21D7000
|
direct allocation
|
page read and write
|
||
|
1F40000
|
heap
|
page read and write
|
||
|
221C000
|
direct allocation
|
page read and write
|
||
|
6C0000
|
heap
|
page read and write
|
||
|
770000
|
heap
|
page read and write
|
||
|
670000
|
heap
|
page read and write
|
||
|
600000
|
heap
|
page read and write
|
||
|
220C000
|
direct allocation
|
page read and write
|
||
|
650000
|
heap
|
page read and write
|
||
|
251F000
|
stack
|
page read and write
|
||
|
21D0000
|
direct allocation
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
407000
|
unkown
|
page readonly
|
||
|
52A000
|
heap
|
page read and write
|
||
|
6D0000
|
heap
|
page read and write
|
||
|
21D8000
|
direct allocation
|
page read and write
|
||
|
1F68000
|
direct allocation
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
4A9000
|
unkown
|
page readonly
|
||
|
675000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
411000
|
unkown
|
page readonly
|
||
|
409000
|
unkown
|
page write copy
|
||
|
20BF000
|
stack
|
page read and write
|
||
|
2214000
|
direct allocation
|
page read and write
|
||
|
510000
|
heap
|
page read and write
|
||
|
67A000
|
heap
|
page read and write
|
||
|
61D000
|
heap
|
page read and write
|
||
|
48E000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
19A000
|
stack
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
700000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
20C4000
|
heap
|
page read and write
|
||
|
2210000
|
direct allocation
|
page read and write
|
||
|
21DF000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
40B000
|
unkown
|
page write copy
|
||
|
690000
|
direct allocation
|
page execute and read and write
|
||
|
60E000
|
stack
|
page read and write
|
||
|
21D0000
|
direct allocation
|
page read and write
|
||
|
1F54000
|
direct allocation
|
page read and write
|
||
|
7B2000
|
heap
|
page read and write
|
||
|
407000
|
unkown
|
page readonly
|
||
|
4A9000
|
unkown
|
page readonly
|
||
|
830000
|
heap
|
page read and write
|
||
|
1E3E000
|
stack
|
page read and write
|
||
|
740000
|
heap
|
page read and write
|
||
|
651000
|
heap
|
page read and write
|
||
|
3100000
|
direct allocation
|
page read and write
|
||
|
652000
|
heap
|
page read and write
|
||
|
520000
|
heap
|
page read and write
|
||
|
5CE000
|
stack
|
page read and write
|
||
|
651000
|
heap
|
page read and write
|
||
|
4B0000
|
heap
|
page read and write
|
||
|
53D000
|
heap
|
page read and write
|
||
|
73E000
|
stack
|
page read and write
|
||
|
2780000
|
trusted library allocation
|
page read and write
|
||
|
7B3000
|
heap
|
page read and write
|
||
|
42C000
|
unkown
|
page readonly
|
||
|
420000
|
heap
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
27D9000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
22DF000
|
stack
|
page read and write
|
||
|
241E000
|
stack
|
page read and write
|
||
|
766000
|
heap
|
page read and write
|
||
|
2204000
|
direct allocation
|
page read and write
|
||
|
421000
|
unkown
|
page read and write
|
||
|
21F4000
|
direct allocation
|
page read and write
|
||
|
411000
|
unkown
|
page readonly
|
||
|
7B5000
|
heap
|
page read and write
|
||
|
7B2000
|
heap
|
page read and write
|
||
|
98000
|
stack
|
page read and write
|
||
|
323F000
|
stack
|
page read and write
|
||
|
27DA000
|
heap
|
page read and write
|
||
|
42C000
|
unkown
|
page readonly
|
||
|
327E000
|
stack
|
page read and write
|
||
|
21E8000
|
direct allocation
|
page read and write
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
7B5000
|
heap
|
page read and write
|
||
|
4C0000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
27D3000
|
heap
|
page read and write
|
||
|
5B0000
|
heap
|
page read and write
|
||
|
21D0000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
4B5000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
64E000
|
stack
|
page read and write
|
||
|
2380000
|
heap
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
2018000
|
direct allocation
|
page read and write
|
||
|
2201000
|
direct allocation
|
page read and write
|
||
|
700000
|
direct allocation
|
page read and write
|
||
|
40D000
|
unkown
|
page write copy
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2208000
|
direct allocation
|
page read and write
|
||
|
7BE000
|
stack
|
page read and write
|
||
|
20DF000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
1F50000
|
direct allocation
|
page read and write
|
||
|
497000
|
unkown
|
page write copy
|
||
|
400000
|
unkown
|
page readonly
|
||
|
497000
|
unkown
|
page read and write
|
||
|
2218000
|
direct allocation
|
page read and write
|
||
|
429000
|
unkown
|
page read and write
|
||
|
644000
|
heap
|
page read and write
|
||
|
3100000
|
direct allocation
|
page read and write
|
||
|
751000
|
heap
|
page read and write
|
||
|
2203000
|
direct allocation
|
page read and write
|
||
|
21CF000
|
stack
|
page read and write
|
||
|
499000
|
unkown
|
page read and write
|
||
|
1F61000
|
direct allocation
|
page read and write
|
There are 127 hidden memdumps, click here to show them.