Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\eJeQNTcb4A.exe
|
"C:\Users\user\Desktop\eJeQNTcb4A.exe"
|
||
C:\Windows\SysWOW64\cmd.exe
|
cmd
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://www.apache.org/licenses/LICENSE-2.0
|
unknown
|
||
http://www.apache.org/
|
unknown
|
||
http://www.zeustech.net/
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
188.166.177.132
|
unknown
|
Netherlands
|
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
590000
|
direct allocation
|
page execute and read and write
|
||
80F000
|
stack
|
page read and write
|
||
90F000
|
stack
|
page read and write
|
||
2FBF000
|
stack
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
2B3E000
|
stack
|
page read and write
|
||
610000
|
heap
|
page read and write
|
||
40C000
|
unkown
|
page readonly
|
||
A30000
|
heap
|
page read and write
|
||
40D000
|
unkown
|
page write copy
|
||
3110000
|
heap
|
page read and write
|
||
4F0000
|
heap
|
page read and write
|
||
2AFA000
|
stack
|
page read and write
|
||
500000
|
heap
|
page read and write
|
||
76E000
|
unkown
|
page read and write
|
||
720000
|
heap
|
page read and write
|
||
58E000
|
stack
|
page read and write
|
||
2BC0000
|
heap
|
page read and write
|
||
19D000
|
stack
|
page read and write
|
||
415000
|
unkown
|
page readonly
|
||
2CE0000
|
heap
|
page read and write
|
||
5A0000
|
heap
|
page read and write
|
||
9D000
|
stack
|
page read and write
|
||
6BD000
|
stack
|
page read and write
|
||
40C000
|
unkown
|
page readonly
|
||
415000
|
unkown
|
page readonly
|
||
2EBF000
|
unkown
|
page read and write
|
||
2FC0000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
400000
|
unkown
|
page readonly
|
||
54E000
|
stack
|
page read and write
|
||
770000
|
heap
|
page read and write
|
||
1F0000
|
heap
|
page read and write
|
||
61E000
|
heap
|
page read and write
|
||
2BC7000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
4F5000
|
heap
|
page read and write
|
||
40D000
|
unkown
|
page write copy
|
||
61A000
|
heap
|
page read and write
|
There are 29 hidden memdumps, click here to show them.