Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Bzw4UJiXNj.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\RarSFX0\Icon-https.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\RarSFX0\microsoft_office_word_logo_icon_145724.ico
|
MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\RarSFX0\microsoft_office_word_logo_icon_145724.png
|
PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Bzw4UJiXNj.exe
|
"C:\Users\user\Desktop\Bzw4UJiXNj.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.apache.org/licenses/LICENSE-2.0
|
unknown
|
||
|
http://www.apache.org/
|
unknown
|
||
|
http://www.zeustech.net/
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\1e\417C44EB
|
@%SystemRoot%\System32\ndfapi.dll,-40001
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2794DB70000
|
heap
|
page read and write
|
||
|
2794DB64000
|
heap
|
page read and write
|
||
|
2794B936000
|
heap
|
page read and write
|
||
|
27949985000
|
heap
|
page read and write
|
||
|
27949B6E000
|
heap
|
page read and write
|
||
|
2794B933000
|
heap
|
page read and write
|
||
|
2794DB6B000
|
heap
|
page read and write
|
||
|
7FF646D80000
|
unkown
|
page readonly
|
||
|
2794DCA5000
|
heap
|
page read and write
|
||
|
2794994D000
|
heap
|
page read and write
|
||
|
2794DB91000
|
heap
|
page read and write
|
||
|
2794DB25000
|
heap
|
page read and write
|
||
|
2794994D000
|
heap
|
page read and write
|
||
|
2794DCA5000
|
heap
|
page read and write
|
||
|
2794B830000
|
heap
|
page read and write
|
||
|
2794DAE3000
|
heap
|
page read and write
|
||
|
2794B6A0000
|
heap
|
page read and write
|
||
|
2794DCA5000
|
heap
|
page read and write
|
||
|
2794DB61000
|
heap
|
page read and write
|
||
|
2794992D000
|
heap
|
page read and write
|
||
|
2794999C000
|
heap
|
page read and write
|
||
|
27949B65000
|
heap
|
page read and write
|
||
|
2794DBA0000
|
heap
|
page read and write
|
||
|
7FF646D80000
|
unkown
|
page readonly
|
||
|
2794DCA5000
|
heap
|
page read and write
|
||
|
BDD95FB000
|
stack
|
page read and write
|
||
|
2794997C000
|
heap
|
page read and write
|
||
|
2794DB99000
|
heap
|
page read and write
|
||
|
BDD8EFD000
|
stack
|
page read and write
|
||
|
2794DB24000
|
heap
|
page read and write
|
||
|
27949964000
|
heap
|
page read and write
|
||
|
27949969000
|
heap
|
page read and write
|
||
|
2794DB24000
|
heap
|
page read and write
|
||
|
279499C2000
|
heap
|
page read and write
|
||
|
27949992000
|
heap
|
page read and write
|
||
|
7FF646DEA000
|
unkown
|
page readonly
|
||
|
2794DA67000
|
heap
|
page read and write
|
||
|
2794DB7F000
|
heap
|
page read and write
|
||
|
27949942000
|
heap
|
page read and write
|
||
|
2794DB78000
|
heap
|
page read and write
|
||
|
2794992E000
|
heap
|
page read and write
|
||
|
2794D090000
|
trusted library allocation
|
page read and write
|
||
|
7FF646DEA000
|
unkown
|
page readonly
|
||
|
7FF646DC8000
|
unkown
|
page readonly
|
||
|
279498D0000
|
heap
|
page readonly
|
||
|
27949937000
|
heap
|
page read and write
|
||
|
2794DB60000
|
heap
|
page read and write
|
||
|
27949907000
|
heap
|
page read and write
|
||
|
2794997C000
|
heap
|
page read and write
|
||
|
27949AE0000
|
heap
|
page read and write
|
||
|
2794D890000
|
heap
|
page read and write
|
||
|
2794994D000
|
heap
|
page read and write
|
||
|
2794DB79000
|
heap
|
page read and write
|
||
|
2794DB78000
|
heap
|
page read and write
|
||
|
2794999D000
|
heap
|
page read and write
|
||
|
2794B6E0000
|
heap
|
page read and write
|
||
|
27949967000
|
heap
|
page read and write
|
||
|
2794DB85000
|
heap
|
page read and write
|
||
|
2794DB6F000
|
heap
|
page read and write
|
||
|
279499E4000
|
heap
|
page read and write
|
||
|
279499E2000
|
heap
|
page read and write
|
||
|
2794994D000
|
heap
|
page read and write
|
||
|
7FF646DE4000
|
unkown
|
page read and write
|
||
|
7FF646DEF000
|
unkown
|
page readonly
|
||
|
2794D09E000
|
heap
|
page read and write
|
||
|
2794DB71000
|
heap
|
page read and write
|
||
|
2794DB71000
|
heap
|
page read and write
|
||
|
7FF646DDB000
|
unkown
|
page write copy
|
||
|
2794DB83000
|
heap
|
page read and write
|
||
|
27949926000
|
heap
|
page read and write
|
||
|
BDD8BA5000
|
stack
|
page read and write
|
||
|
27949992000
|
heap
|
page read and write
|
||
|
27949985000
|
heap
|
page read and write
|
||
|
27949994000
|
heap
|
page read and write
|
||
|
27949996000
|
heap
|
page read and write
|
||
|
2794B651000
|
trusted library allocation
|
page read and write
|
||
|
2794DB71000
|
heap
|
page read and write
|
||
|
2794DB76000
|
heap
|
page read and write
|
||
|
279499E2000
|
heap
|
page read and write
|
||
|
2794DB8A000
|
heap
|
page read and write
|
||
|
2794DB70000
|
heap
|
page read and write
|
||
|
279498F0000
|
heap
|
page read and write
|
||
|
279499A2000
|
heap
|
page read and write
|
||
|
2794DAA2000
|
heap
|
page read and write
|
||
|
2794DCA8000
|
heap
|
page read and write
|
||
|
BDD93FB000
|
stack
|
page read and write
|
||
|
BDD96FC000
|
stack
|
page read and write
|
||
|
2794DB25000
|
heap
|
page read and write
|
||
|
7FF646DDB000
|
unkown
|
page read and write
|
||
|
2794993A000
|
heap
|
page read and write
|
||
|
BDD91FE000
|
stack
|
page read and write
|
||
|
27949900000
|
heap
|
page read and write
|
||
|
279499E2000
|
heap
|
page read and write
|
||
|
7FF646D81000
|
unkown
|
page execute read
|
||
|
2794DA61000
|
heap
|
page read and write
|
||
|
2794993A000
|
heap
|
page read and write
|
||
|
2794DB96000
|
heap
|
page read and write
|
||
|
2794DB88000
|
heap
|
page read and write
|
||
|
2794DB25000
|
heap
|
page read and write
|
||
|
2794DB73000
|
heap
|
page read and write
|
||
|
27949992000
|
heap
|
page read and write
|
||
|
2794DB99000
|
heap
|
page read and write
|
||
|
2794999D000
|
heap
|
page read and write
|
||
|
2794DB76000
|
heap
|
page read and write
|
||
|
7FF646DEE000
|
unkown
|
page write copy
|
||
|
2794B6E4000
|
heap
|
page read and write
|
||
|
2794DB24000
|
heap
|
page read and write
|
||
|
27949B60000
|
heap
|
page read and write
|
||
|
2794DB7D000
|
heap
|
page read and write
|
||
|
27949987000
|
heap
|
page read and write
|
||
|
2794993A000
|
heap
|
page read and write
|
||
|
2794997C000
|
heap
|
page read and write
|
||
|
2794994D000
|
heap
|
page read and write
|
||
|
27949969000
|
heap
|
page read and write
|
||
|
BDD8B9F000
|
stack
|
page read and write
|
||
|
2794998F000
|
heap
|
page read and write
|
||
|
7FF646DEE000
|
unkown
|
page readonly
|
||
|
2794DAE2000
|
heap
|
page read and write
|
||
|
2794999E000
|
heap
|
page read and write
|
||
|
2794997C000
|
heap
|
page read and write
|
||
|
27949925000
|
heap
|
page read and write
|
||
|
279499E2000
|
heap
|
page read and write
|
||
|
27949942000
|
heap
|
page read and write
|
||
|
BDD8FFE000
|
stack
|
page read and write
|
||
|
279498C0000
|
heap
|
page read and write
|
||
|
7FF646D81000
|
unkown
|
page execute read
|
||
|
27949942000
|
heap
|
page read and write
|
||
|
7FF646DC8000
|
unkown
|
page readonly
|
||
|
2794DB7B000
|
heap
|
page read and write
|
||
|
2794DB88000
|
heap
|
page read and write
|
||
|
BDD92FE000
|
stack
|
page read and write
|
||
|
27949922000
|
heap
|
page read and write
|
||
|
2794DB65000
|
heap
|
page read and write
|
||
|
2794D097000
|
heap
|
page read and write
|
||
|
2794DB23000
|
heap
|
page read and write
|
||
|
2794997C000
|
heap
|
page read and write
|
||
|
27949983000
|
heap
|
page read and write
|
||
|
27949AC0000
|
heap
|
page read and write
|
||
|
2794B930000
|
trusted library allocation
|
page read and write
|
||
|
27949944000
|
heap
|
page read and write
|
||
|
2794DB62000
|
heap
|
page read and write
|
||
|
BDD94FF000
|
stack
|
page read and write
|
||
|
2794DB99000
|
heap
|
page read and write
|
||
|
27949941000
|
heap
|
page read and write
|
||
|
279499E2000
|
heap
|
page read and write
|
||
|
2794B930000
|
heap
|
page read and write
|
||
|
27949987000
|
heap
|
page read and write
|
||
|
2794993B000
|
heap
|
page read and write
|
||
|
2794DCA5000
|
heap
|
page read and write
|
||
|
2794DB85000
|
heap
|
page read and write
|
||
|
2794B66A000
|
trusted library allocation
|
page read and write
|
||
|
2794DA60000
|
heap
|
page read and write
|
||
|
2794998F000
|
heap
|
page read and write
|
||
|
2794993A000
|
heap
|
page read and write
|
||
|
2794DAA1000
|
heap
|
page read and write
|
There are 145 hidden memdumps, click here to show them.