IOC Report
eJeQNTcb4A.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\eJeQNTcb4A.exe
"C:\Users\user\Desktop\eJeQNTcb4A.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.apache.org/
unknown
http://www.zeustech.net/
unknown

IPs

IP
Domain
Country
Malicious
188.166.177.132
unknown
Netherlands
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
590000
direct allocation
page execute and read and write
 malicious
80F000
stack
page read and write
90F000
stack
page read and write
2FBF000
stack
page read and write
401000
unkown
page execute read
2B3E000
stack
page read and write
610000
heap
page read and write
40C000
unkown
page readonly
A30000
heap
page read and write
40D000
unkown
page write copy
3110000
heap
page read and write
4F0000
heap
page read and write
2AFA000
stack
page read and write
500000
heap
page read and write
76E000
unkown
page read and write
720000
heap
page read and write
58E000
stack
page read and write
2BC0000
heap
page read and write
19D000
stack
page read and write
415000
unkown
page readonly
2CE0000
heap
page read and write
5A0000
heap
page read and write
9D000
stack
page read and write
6BD000
stack
page read and write
40C000
unkown
page readonly
415000
unkown
page readonly
2EBF000
unkown
page read and write
2FC0000
heap
page read and write
401000
unkown
page execute read
400000
unkown
page readonly
54E000
stack
page read and write
770000
heap
page read and write
1F0000
heap
page read and write
61E000
heap
page read and write
2BC7000
heap
page read and write
400000
unkown
page readonly
4F5000
heap
page read and write
40D000
unkown
page write copy
61A000
heap
page read and write
There are 29 hidden memdumps, click here to show them.