IOC Report
ugslmd.exe

loading gif

Files

File Path
Type
Category
Malicious
ugslmd.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ugslmd.exe
"C:\Users\user\Desktop\ugslmd.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Memdumps

Base Address
Regiontype
Protect
Malicious
580000
unkown
page read and write
5DF000
unkown
page readonly
680000
unkown
page execute and read and write
2720000
heap
page read and write
55F000
unkown
page readonly
19B000
stack
page read and write
681000
unkown
page execute and write copy
5E0000
unkown
page execute read
569000
unkown
page read and write
9C000
stack
page read and write
6A0000
heap
page read and write
880000
heap
page read and write
685000
unkown
page execute and write copy
C70000
heap
page read and write
401000
unkown
page execute read
88A000
heap
page read and write
196000
stack
page read and write
D95000
heap
page read and write
830000
heap
page read and write
400000
unkown
page readonly
D90000
heap
page read and write
B7F000
stack
page read and write
755000
heap
page read and write
750000
heap
page read and write
684000
unkown
page execute and read and write
57B000
unkown
page read and write
590000
unkown
page read and write
690000
heap
page read and write
5EB000
unkown
page execute and write copy
6EE000
stack
page read and write
635000
unkown
page execute and read and write
8AB000
heap
page read and write
400000
unkown
page readonly
72E000
stack
page read and write
5DF000
unkown
page readonly
636000
unkown
page execute and write copy
5EB000
unkown
page execute and write copy
A7F000
stack
page read and write
88E000
heap
page read and write
There are 29 hidden memdumps, click here to show them.