IOC Report
bfsvc.exe

loading gif

Files

File Path
Type
Category
Malicious
bfsvc.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\~SF8771.tmp
data
modified

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\bfsvc.exe
"C:\Users\user\Desktop\bfsvc.exe"
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
190000
heap
page read and write
70E000
stack
page read and write
80E000
stack
page read and write
14B000
stack
page read and write
510000
heap
page read and write
140000000
unkown
page readonly
519000
heap
page read and write
140000000
unkown
page readonly
55A000
heap
page read and write
148000
stack
page read and write
1401BE000
unkown
page write copy
14026F000
unkown
page read and write
140001000
unkown
page execute read
242F000
heap
page read and write
336E000
heap
page read and write
4D0000
direct allocation
page execute and read and write
1FE0000
direct allocation
page execute and read and write
140288000
unkown
page readonly
1401BE000
unkown
page read and write
2110000
heap
page read and write
1A0000
heap
page read and write
30D5000
heap
page read and write
1FD9000
direct allocation
page execute and read and write
35F0000
unclassified section
page read and write
557000
heap
page read and write
1D0000
heap
page read and write
14025F000
unkown
page read and write
51C000
heap
page read and write
2410000
heap
page read and write
140271000
unkown
page readonly
140288000
unkown
page readonly
140001000
unkown
page execute read
516000
heap
page read and write
2280000
heap
page read and write
1FE3000
direct allocation
page execute and read and write
2E4E000
heap
page read and write
1FB1000
direct allocation
page execute and read and write
14025E000
unkown
page write copy
140260000
unkown
page write copy
140271000
unkown
page readonly
There are 30 hidden memdumps, click here to show them.