Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
xbOnlYALvtUq.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\xbOnlYALvtUq.exe
|
C:\Users\user\Desktop\xbOnlYALvtUq.exe
|
|
|
|
C:\Windows\SysWOW64\netsh.exe
|
netsh firewall add allowedprogram "C:\Users\user\Desktop\xbOnlYALvtUq.exe" "xbOnlYALvtUq.exe" ENABLE
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
0.tcp.sa.ngrok.io
|
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
0.tcp.sa.ngrok.io
|
18.228.115.60
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
18.228.115.60
|
0.tcp.sa.ngrok.io
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER
|
di
|
||
|
HKEY_CURRENT_USER\Environment
|
SEE_MASK_NOZONECHECKS
|
||
|
HKEY_CURRENT_USER\SOFTWARE\5bfe00b9b88f2456727afb4cd20491af
|
[kl]
|
||
|
HKEY_CURRENT_USER\SOFTWARE\5bfe00b9b88f2456727afb4cd20491af
|
3fc6b884fbc29ec00482827c26669b2b
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7A2000
|
unkown
|
page readonly
|
|
|
|
59B0000
|
trusted library section
|
page read and write
|
|
|
|
2E11000
|
trusted library allocation
|
page read and write
|
|
|
|
10B2000
|
trusted library allocation
|
page execute and read and write
|
||
|
D0B000
|
heap
|
page read and write
|
||
|
56A0000
|
heap
|
page read and write
|
||
|
D3F000
|
heap
|
page read and write
|
||
|
D1F000
|
heap
|
page read and write
|
||
|
D03000
|
heap
|
page read and write
|
||
|
D3F000
|
heap
|
page read and write
|
||
|
51CD000
|
heap
|
page read and write
|
||
|
CD1000
|
heap
|
page read and write
|
||
|
688AA000
|
heap
|
page read and write
|
||
|
D23000
|
heap
|
page read and write
|
||
|
67B0000
|
heap
|
page read and write
|
||
|
D36000
|
heap
|
page read and write
|
||
|
D0A000
|
heap
|
page read and write
|
||
|
D81000
|
heap
|
page read and write
|
||
|
2EB2000
|
trusted library allocation
|
page read and write
|
||
|
18608000
|
heap
|
page read and write
|
||
|
5170000
|
unclassified section
|
page read and write
|
||
|
CC4000
|
heap
|
page read and write
|
||
|
1884C000
|
heap
|
page read and write
|
||
|
34923000
|
heap
|
page read and write
|
||
|
F30000
|
heap
|
page read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
D87000
|
heap
|
page read and write
|
||
|
CFA000
|
heap
|
page read and write
|
||
|
DA3000
|
heap
|
page read and write
|
||
|
D52000
|
heap
|
page read and write
|
||
|
504C000
|
stack
|
page read and write
|
||
|
D22000
|
heap
|
page read and write
|
||
|
D23000
|
heap
|
page read and write
|
||
|
D0B000
|
heap
|
page read and write
|
||
|
D35000
|
heap
|
page read and write
|
||
|
D34000
|
heap
|
page read and write
|
||
|
1070000
|
trusted library allocation
|
page read and write
|
||
|
59D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
B70000
|
unclassified section
|
page readonly
|
||
|
5000000
|
heap
|
page read and write
|
||
|
D3F000
|
heap
|
page read and write
|
||
|
D1D000
|
heap
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
34695000
|
heap
|
page read and write
|
||
|
D2C000
|
heap
|
page read and write
|
||
|
D3B000
|
heap
|
page read and write
|
||
|
595D000
|
stack
|
page read and write
|
||
|
DBE000
|
heap
|
page read and write
|
||
|
6C61000
|
heap
|
page read and write
|
||
|
5B2D000
|
stack
|
page read and write
|
||
|
55F0000
|
heap
|
page read and write
|
||
|
2E88000
|
trusted library allocation
|
page read and write
|
||
|
CFD000
|
heap
|
page read and write
|
||
|
D0A000
|
heap
|
page read and write
|
||
|
34868000
|
heap
|
page read and write
|
||
|
E2E000
|
stack
|
page read and write
|
||
|
D91000
|
heap
|
page read and write
|
||
|
D33000
|
heap
|
page read and write
|
||
|
D38000
|
heap
|
page read and write
|
||
|
51CD000
|
heap
|
page read and write
|
||
|
D35000
|
heap
|
page read and write
|
||
|
585B000
|
stack
|
page read and write
|
||
|
D52000
|
heap
|
page read and write
|
||
|
BC0000
|
heap
|
page read and write
|
||
|
189AF000
|
heap
|
page read and write
|
||
|
AEE000
|
unkown
|
page read and write
|
||
|
18814000
|
heap
|
page read and write
|
||
|
CB0000
|
heap
|
page read and write
|
||
|
CF0000
|
heap
|
page read and write
|
||
|
D06000
|
heap
|
page read and write
|
||
|
FF6000
|
heap
|
page read and write
|
||
|
CFF000
|
heap
|
page read and write
|
||
|
4AA0000
|
heap
|
page read and write
|
||
|
2E6A000
|
trusted library allocation
|
page read and write
|
||
|
B10000
|
heap
|
page read and write
|
||
|
1220000
|
heap
|
page read and write
|
||
|
1200000
|
trusted library allocation
|
page read and write
|
||
|
34491000
|
heap
|
page read and write
|
||
|
10C0000
|
trusted library allocation
|
page read and write
|
||
|
51CA000
|
heap
|
page read and write
|
||
|
DAE000
|
heap
|
page read and write
|
||
|
D2E000
|
heap
|
page read and write
|
||
|
188D7000
|
heap
|
page read and write
|
||
|
185C0000
|
heap
|
page read and write
|
||
|
C60000
|
heap
|
page read and write
|
||
|
1210000
|
trusted library allocation
|
page execute and read and write
|
||
|
1140000
|
heap
|
page read and write
|
||
|
51CF000
|
heap
|
page read and write
|
||
|
119C000
|
stack
|
page read and write
|
||
|
BA0000
|
heap
|
page read and write
|
||
|
2EBF000
|
trusted library allocation
|
page read and write
|
||
|
51CD000
|
heap
|
page read and write
|
||
|
D61000
|
heap
|
page read and write
|
||
|
B36000
|
stack
|
page read and write
|
||
|
EAE000
|
stack
|
page read and write
|
||
|
CFE000
|
heap
|
page read and write
|
||
|
51D9000
|
heap
|
page read and write
|
||
|
CF7000
|
heap
|
page read and write
|
||
|
964000
|
stack
|
page read and write
|
||
|
5A27000
|
heap
|
page read and write
|
||
|
18690000
|
heap
|
page read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
51D5000
|
heap
|
page read and write
|
||
|
1870A000
|
heap
|
page read and write
|
||
|
3469C000
|
heap
|
page read and write
|
||
|
7B0000
|
unclassified section
|
page readonly
|
||
|
10AA000
|
trusted library allocation
|
page execute and read and write
|
||
|
2ACE000
|
stack
|
page read and write
|
||
|
DAC000
|
heap
|
page read and write
|
||
|
67D7000
|
heap
|
page read and write
|
||
|
1090000
|
trusted library allocation
|
page read and write
|
||
|
D21000
|
heap
|
page read and write
|
||
|
D3B000
|
heap
|
page read and write
|
||
|
528E000
|
unkown
|
page read and write
|
||
|
344BF000
|
heap
|
page read and write
|
||
|
D37000
|
heap
|
page read and write
|
||
|
108A000
|
trusted library allocation
|
page execute and read and write
|
||
|
DA1000
|
heap
|
page read and write
|
||
|
D36000
|
heap
|
page read and write
|
||
|
34407000
|
heap
|
page read and write
|
||
|
D52000
|
heap
|
page read and write
|
||
|
D25000
|
heap
|
page read and write
|
||
|
5A20000
|
heap
|
page read and write
|
||
|
AF0000
|
heap
|
page read and write
|
||
|
D36000
|
heap
|
page read and write
|
||
|
10C2000
|
trusted library allocation
|
page read and write
|
||
|
D32000
|
heap
|
page read and write
|
||
|
62B0000
|
heap
|
page read and write
|
||
|
188F5000
|
heap
|
page read and write
|
||
|
CFB000
|
heap
|
page read and write
|
||
|
D61000
|
heap
|
page read and write
|
||
|
10CB000
|
trusted library allocation
|
page execute and read and write
|
||
|
10A0000
|
trusted library allocation
|
page read and write
|
||
|
D3B000
|
heap
|
page read and write
|
||
|
D3D000
|
heap
|
page read and write
|
||
|
D01000
|
heap
|
page read and write
|
||
|
51DB000
|
heap
|
page read and write
|
||
|
59AB000
|
stack
|
page read and write
|
||
|
95E000
|
stack
|
page read and write
|
||
|
5003000
|
heap
|
page read and write
|
||
|
189B8000
|
heap
|
page read and write
|
||
|
1077000
|
trusted library allocation
|
page read and write
|
||
|
3460C000
|
heap
|
page read and write
|
||
|
6899000
|
heap
|
page read and write
|
||
|
BF5000
|
heap
|
page read and write
|
||
|
51CE000
|
heap
|
page read and write
|
||
|
D22000
|
heap
|
page read and write
|
||
|
11B0000
|
trusted library allocation
|
page read and write
|
||
|
CDD000
|
heap
|
page read and write
|
||
|
D2C000
|
heap
|
page read and write
|
||
|
DAD000
|
heap
|
page read and write
|
||
|
5108000
|
stack
|
page read and write
|
||
|
DC7000
|
heap
|
page read and write
|
||
|
DA1000
|
heap
|
page read and write
|
||
|
DA1000
|
heap
|
page read and write
|
||
|
D06000
|
heap
|
page read and write
|
||
|
68660000
|
heap
|
page read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
68AE000
|
heap
|
page read and write
|
||
|
6811000
|
heap
|
page read and write
|
||
|
1082000
|
trusted library allocation
|
page execute and read and write
|
||
|
493E000
|
stack
|
page read and write
|
||
|
688A1000
|
heap
|
page read and write
|
||
|
D33000
|
heap
|
page read and write
|
||
|
5A2A000
|
heap
|
page read and write
|
||
|
CE8000
|
heap
|
page read and write
|
||
|
34230000
|
heap
|
page read and write
|
||
|
D84000
|
heap
|
page read and write
|
||
|
96B000
|
stack
|
page read and write
|
||
|
68910000
|
heap
|
page read and write
|
||
|
508B000
|
stack
|
page read and write
|
||
|
51C2000
|
heap
|
page read and write
|
||
|
113E000
|
stack
|
page read and write
|
||
|
DA9000
|
heap
|
page read and write
|
||
|
34888000
|
heap
|
page read and write
|
||
|
34977000
|
heap
|
page read and write
|
||
|
10F0000
|
heap
|
page read and write
|
||
|
D1D000
|
heap
|
page read and write
|
||
|
DA2000
|
heap
|
page read and write
|
||
|
D3F000
|
heap
|
page read and write
|
||
|
D2C000
|
heap
|
page read and write
|
||
|
D52000
|
heap
|
page read and write
|
||
|
CD1000
|
heap
|
page read and write
|
||
|
D0A000
|
heap
|
page read and write
|
||
|
D35000
|
heap
|
page read and write
|
||
|
6BDB000
|
heap
|
page read and write
|
||
|
DA3000
|
heap
|
page read and write
|
||
|
4E18000
|
trusted library allocation
|
page read and write
|
||
|
D08000
|
heap
|
page read and write
|
||
|
50CC000
|
stack
|
page read and write
|
||
|
D61000
|
heap
|
page read and write
|
||
|
D1F000
|
heap
|
page read and write
|
||
|
D2F000
|
heap
|
page read and write
|
||
|
D87000
|
heap
|
page read and write
|
||
|
D0B000
|
heap
|
page read and write
|
||
|
68A6000
|
heap
|
page read and write
|
||
|
D87000
|
heap
|
page read and write
|
||
|
5F0000
|
unclassified section
|
page readonly
|
||
|
CDD000
|
heap
|
page read and write
|
||
|
D62000
|
heap
|
page read and write
|
||
|
D08000
|
heap
|
page read and write
|
||
|
DA9000
|
heap
|
page read and write
|
||
|
7F4E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
86B000
|
stack
|
page read and write
|
||
|
51A0000
|
heap
|
page read and write
|
||
|
519F000
|
stack
|
page read and write
|
||
|
D87000
|
heap
|
page read and write
|
||
|
51CE000
|
heap
|
page read and write
|
||
|
2ED6000
|
trusted library allocation
|
page read and write
|
||
|
D2F000
|
heap
|
page read and write
|
||
|
1E007000
|
heap
|
page read and write
|
||
|
D36000
|
heap
|
page read and write
|
||
|
68829000
|
heap
|
page read and write
|
||
|
D87000
|
heap
|
page read and write
|
||
|
6871D000
|
heap
|
page read and write
|
||
|
51DA000
|
heap
|
page read and write
|
||
|
D61000
|
heap
|
page read and write
|
||
|
CC1000
|
heap
|
page read and write
|
||
|
11C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
62C0000
|
heap
|
page read and write
|
||
|
D0B000
|
heap
|
page read and write
|
||
|
D23000
|
heap
|
page read and write
|
||
|
5560000
|
trusted library allocation
|
page execute and read and write
|
||
|
CF7000
|
heap
|
page read and write
|
||
|
3E11000
|
trusted library allocation
|
page read and write
|
||
|
4FAE000
|
stack
|
page read and write
|
||
|
D3F000
|
heap
|
page read and write
|
||
|
D38000
|
heap
|
page read and write
|
||
|
B15000
|
heap
|
page read and write
|
||
|
10C7000
|
trusted library allocation
|
page execute and read and write
|
||
|
D2F000
|
heap
|
page read and write
|
||
|
D35000
|
heap
|
page read and write
|
||
|
96E000
|
stack
|
page read and write
|
||
|
D3D000
|
heap
|
page read and write
|
||
|
D0C000
|
heap
|
page read and write
|
||
|
A39000
|
stack
|
page read and write
|
||
|
C5E000
|
stack
|
page read and write
|
||
|
D2C000
|
heap
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
D0A000
|
heap
|
page read and write
|
||
|
3437A000
|
heap
|
page read and write
|
||
|
D33000
|
heap
|
page read and write
|
||
|
F9D000
|
stack
|
page read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
51D4000
|
heap
|
page read and write
|
||
|
6120000
|
heap
|
page read and write
|
||
|
CF7000
|
heap
|
page read and write
|
||
|
9A0000
|
unclassified section
|
page readonly
|
||
|
D1D000
|
heap
|
page read and write
|
||
|
C1E000
|
unkown
|
page read and write
|
||
|
D33000
|
heap
|
page read and write
|
||
|
D32000
|
heap
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
DAC000
|
heap
|
page read and write
|
||
|
D2D000
|
heap
|
page read and write
|
||
|
345D7000
|
heap
|
page read and write
|
||
|
5A2E000
|
heap
|
page read and write
|
||
|
DA5000
|
heap
|
page read and write
|
||
|
D29000
|
heap
|
page read and write
|
||
|
DA1000
|
heap
|
page read and write
|
||
|
688D4000
|
heap
|
page read and write
|
||
|
CD1000
|
heap
|
page read and write
|
||
|
6B90000
|
heap
|
page read and write
|
||
|
D38000
|
heap
|
page read and write
|
||
|
51D4000
|
heap
|
page read and write
|
||
|
34275000
|
heap
|
page read and write
|
||
|
5E0000
|
unclassified section
|
page readonly
|
||
|
51CD000
|
heap
|
page read and write
|
||
|
189BE000
|
heap
|
page read and write
|
||
|
4A7E000
|
stack
|
page read and write
|
||
|
D3A000
|
heap
|
page read and write
|
||
|
D08000
|
heap
|
page read and write
|
||
|
D25000
|
heap
|
page read and write
|
||
|
D3B000
|
heap
|
page read and write
|
||
|
CBB000
|
heap
|
page read and write
|
||
|
CFE000
|
heap
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
11F0000
|
heap
|
page execute and read and write
|
||
|
D33000
|
heap
|
page read and write
|
||
|
10A7000
|
trusted library allocation
|
page execute and read and write
|
||
|
CFB000
|
heap
|
page read and write
|
||
|
4C50000
|
heap
|
page read and write
|
||
|
D03000
|
heap
|
page read and write
|
||
|
10B0000
|
trusted library allocation
|
page read and write
|
||
|
11E0000
|
trusted library allocation
|
page read and write
|
||
|
CF1000
|
heap
|
page read and write
|
||
|
CE5000
|
heap
|
page read and write
|
||
|
DA9000
|
heap
|
page read and write
|
||
|
1226000
|
heap
|
page read and write
|
||
|
BB0000
|
heap
|
page read and write
|
||
|
51C2000
|
heap
|
page read and write
|
||
|
7A0000
|
unkown
|
page readonly
|
||
|
D2C000
|
heap
|
page read and write
|
||
|
CEF000
|
heap
|
page read and write
|
||
|
D25000
|
heap
|
page read and write
|
||
|
1092000
|
trusted library allocation
|
page execute and read and write
|
||
|
10BA000
|
trusted library allocation
|
page execute and read and write
|
||
|
55E0000
|
heap
|
page read and write
|
||
|
4C60000
|
heap
|
page read and write
|
||
|
DA1000
|
heap
|
page read and write
|
There are 290 hidden memdumps, click here to show them.