IOC Report
m8ufsTLLOU.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\m8ufsTLLOU.exe
"C:\Users\user\Desktop\m8ufsTLLOU.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.apache.org/licenses/LICEN
unknown
http://www.apache.org/
unknown
http://www.zeustech.net/
unknown

IPs

IP
Domain
Country
Malicious
188.166.177.132
unknown
Netherlands
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
500000
direct allocation
page execute and read and write
 malicious
28CF000
unkown
page read and write
40C000
unkown
page readonly
9D000
stack
page read and write
70A000
heap
page read and write
4F0000
heap
page read and write
23FA000
stack
page read and write
415000
unkown
page readonly
56E000
stack
page read and write
6B0000
heap
page read and write
401000
unkown
page execute read
22FD000
stack
page read and write
19D000
stack
page read and write
6AE000
stack
page read and write
415000
unkown
page readonly
400000
unkown
page readonly
8FF000
stack
page read and write
27BE000
stack
page read and write
2B0F000
stack
page read and write
2660000
heap
page read and write
520000
heap
page read and write
525000
heap
page read and write
28D0000
heap
page read and write
40C000
unkown
page readonly
700000
heap
page read and write
277E000
unkown
page read and write
40D000
unkown
page write copy
27C0000
heap
page read and write
1F0000
heap
page read and write
2CA0000
heap
page read and write
291C000
heap
page read and write
2910000
heap
page read and write
401000
unkown
page execute read
66F000
stack
page read and write
40D000
unkown
page write copy
980000
heap
page read and write
70E000
heap
page read and write
23FE000
stack
page read and write
400000
unkown
page readonly
There are 29 hidden memdumps, click here to show them.