Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\m8ufsTLLOU.exe
|
"C:\Users\user\Desktop\m8ufsTLLOU.exe"
|
||
C:\Windows\SysWOW64\cmd.exe
|
cmd
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://www.apache.org/licenses/LICENSE-2.0
|
unknown
|
||
http://www.apache.org/licenses/LICEN
|
unknown
|
||
http://www.apache.org/
|
unknown
|
||
http://www.zeustech.net/
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
188.166.177.132
|
unknown
|
Netherlands
|
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
500000
|
direct allocation
|
page execute and read and write
|
||
28CF000
|
unkown
|
page read and write
|
||
40C000
|
unkown
|
page readonly
|
||
9D000
|
stack
|
page read and write
|
||
70A000
|
heap
|
page read and write
|
||
4F0000
|
heap
|
page read and write
|
||
23FA000
|
stack
|
page read and write
|
||
415000
|
unkown
|
page readonly
|
||
56E000
|
stack
|
page read and write
|
||
6B0000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
22FD000
|
stack
|
page read and write
|
||
19D000
|
stack
|
page read and write
|
||
6AE000
|
stack
|
page read and write
|
||
415000
|
unkown
|
page readonly
|
||
400000
|
unkown
|
page readonly
|
||
8FF000
|
stack
|
page read and write
|
||
27BE000
|
stack
|
page read and write
|
||
2B0F000
|
stack
|
page read and write
|
||
2660000
|
heap
|
page read and write
|
||
520000
|
heap
|
page read and write
|
||
525000
|
heap
|
page read and write
|
||
28D0000
|
heap
|
page read and write
|
||
40C000
|
unkown
|
page readonly
|
||
700000
|
heap
|
page read and write
|
||
277E000
|
unkown
|
page read and write
|
||
40D000
|
unkown
|
page write copy
|
||
27C0000
|
heap
|
page read and write
|
||
1F0000
|
heap
|
page read and write
|
||
2CA0000
|
heap
|
page read and write
|
||
291C000
|
heap
|
page read and write
|
||
2910000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
66F000
|
stack
|
page read and write
|
||
40D000
|
unkown
|
page write copy
|
||
980000
|
heap
|
page read and write
|
||
70E000
|
heap
|
page read and write
|
||
23FE000
|
stack
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
There are 29 hidden memdumps, click here to show them.