Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
V6363OW8Rh.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\V6363OW8Rh.exe.log
|
CSV text
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\XClient.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log
|
CSV text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\tmpAD99.tmp.bat
|
DOS batch file, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Jul 1 13:32:56
2024, mtime=Mon Jul 1 13:32:56 2024, atime=Mon Jul 1 13:32:56 2024, length=74240, window=hide
|
dropped
|
||
|
\Device\Null
|
ASCII text, with CRLF line terminators, with overstriking
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\V6363OW8Rh.exe
|
"C:\Users\user\Desktop\V6363OW8Rh.exe"
|
|
|
|
C:\Users\user\AppData\Roaming\XClient.exe
|
"C:\Users\user\AppData\Roaming\XClient.exe"
|
|
|
|
C:\Users\user\AppData\Roaming\XClient.exe
|
"C:\Users\user\AppData\Roaming\XClient.exe"
|
|
|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpAD99.tmp.bat""
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\timeout.exe
|
timeout 3
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
price-slow.gl.at.ply.gg
|
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
price-slow.gl.at.ply.gg
|
147.185.221.18
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
147.185.221.18
|
price-slow.gl.at.ply.gg
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
XClient
|
||
|
HKEY_CURRENT_USER\SOFTWARE\F89E52B49AA08D9BF38E
|
CC52384910CEE944DDBCC575A8E0177BFA6B16E3032438B207797164D5C94B34
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
31D1000
|
trusted library allocation
|
page read and write
|
|
|
|
E62000
|
unkown
|
page readonly
|
|
|
|
1480000
|
trusted library allocation
|
page read and write
|
||
|
7FFD3485C000
|
trusted library allocation
|
page execute and read and write
|
||
|
1790000
|
heap
|
page read and write
|
||
|
7FFD34856000
|
trusted library allocation
|
page read and write
|
||
|
9C1000
|
heap
|
page read and write
|
||
|
1450000
|
heap
|
page read and write
|
||
|
249C000
|
trusted library allocation
|
page read and write
|
||
|
940000
|
heap
|
page read and write
|
||
|
1C135000
|
heap
|
page read and write
|
||
|
15CA000
|
stack
|
page read and write
|
||
|
335F000
|
trusted library allocation
|
page read and write
|
||
|
1444FEE1000
|
heap
|
page read and write
|
||
|
1AA2D000
|
stack
|
page read and write
|
||
|
7FFD34880000
|
trusted library allocation
|
page execute and read and write
|
||
|
1BBF0000
|
heap
|
page read and write
|
||
|
1C4F4000
|
stack
|
page read and write
|
||
|
1794000
|
heap
|
page read and write
|
||
|
135B000
|
heap
|
page read and write
|
||
|
7FFD34770000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34960000
|
trusted library allocation
|
page read and write
|
||
|
1E844FF000
|
unkown
|
page read and write
|
||
|
1B24F000
|
stack
|
page read and write
|
||
|
7FFD34764000
|
trusted library allocation
|
page read and write
|
||
|
990000
|
heap
|
page read and write
|
||
|
7FFD34902000
|
trusted library allocation
|
page read and write
|
||
|
32AD000
|
trusted library allocation
|
page read and write
|
||
|
743000
|
heap
|
page read and write
|
||
|
7FFD347CB000
|
trusted library allocation
|
page execute and read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
D4E000
|
stack
|
page read and write
|
||
|
3349000
|
trusted library allocation
|
page read and write
|
||
|
A5A000
|
heap
|
page read and write
|
||
|
7FFD34980000
|
trusted library allocation
|
page read and write
|
||
|
7FFD348C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
26EE000
|
stack
|
page read and write
|
||
|
1B34E000
|
stack
|
page read and write
|
||
|
7A38B6E000
|
stack
|
page read and write
|
||
|
23752970000
|
heap
|
page read and write
|
||
|
1C1DF000
|
heap
|
page read and write
|
||
|
7FFD347BC000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C100000
|
heap
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
2480000
|
heap
|
page read and write
|
||
|
127C1000
|
trusted library allocation
|
page read and write
|
||
|
1444FEF2000
|
heap
|
page read and write
|
||
|
7FFD347B3000
|
trusted library allocation
|
page read and write
|
||
|
C40000
|
heap
|
page read and write
|
||
|
1D273000
|
heap
|
page read and write
|
||
|
1E8412C000
|
stack
|
page read and write
|
||
|
139F000
|
heap
|
page read and write
|
||
|
131D1000
|
trusted library allocation
|
page read and write
|
||
|
1C7ED000
|
stack
|
page read and write
|
||
|
7FFD34983000
|
trusted library allocation
|
page read and write
|
||
|
1C161000
|
heap
|
page read and write
|
||
|
127C8000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34856000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD347A2000
|
trusted library allocation
|
page read and write
|
||
|
1D585000
|
heap
|
page read and write
|
||
|
1C96E000
|
stack
|
page read and write
|
||
|
7FFD34820000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34773000
|
trusted library allocation
|
page execute and read and write
|
||
|
1BFFD000
|
stack
|
page read and write
|
||
|
7FFD34860000
|
trusted library allocation
|
page execute and read and write
|
||
|
1E845FE000
|
stack
|
page read and write
|
||
|
30C0000
|
heap
|
page read and write
|
||
|
7FFD347AD000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34790000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34780000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34774000
|
trusted library allocation
|
page read and write
|
||
|
1444FFB0000
|
heap
|
page read and write
|
||
|
1C19D000
|
heap
|
page read and write
|
||
|
127C3000
|
trusted library allocation
|
page read and write
|
||
|
179E000
|
heap
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
7FFD34970000
|
trusted library allocation
|
page read and write
|
||
|
B25000
|
heap
|
page read and write
|
||
|
1444FEBB000
|
heap
|
page read and write
|
||
|
23752A50000
|
heap
|
page read and write
|
||
|
7A38BEE000
|
stack
|
page read and write
|
||
|
706000
|
heap
|
page read and write
|
||
|
1BCFE000
|
stack
|
page read and write
|
||
|
1C0FE000
|
stack
|
page read and write
|
||
|
7FFD34850000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34886000
|
trusted library allocation
|
page execute and read and write
|
||
|
3000000
|
heap
|
page execute and read and write
|
||
|
14C0000
|
heap
|
page read and write
|
||
|
3468000
|
trusted library allocation
|
page read and write
|
||
|
7FFD3476D000
|
trusted library allocation
|
page execute and read and write
|
||
|
3430000
|
trusted library allocation
|
page read and write
|
||
|
1C3FA000
|
stack
|
page read and write
|
||
|
7FFD347CC000
|
trusted library allocation
|
page execute and read and write
|
||
|
131E2000
|
trusted library allocation
|
page read and write
|
||
|
E4F000
|
stack
|
page read and write
|
||
|
3070000
|
heap
|
page read and write
|
||
|
7FFD34784000
|
trusted library allocation
|
page read and write
|
||
|
5F5000
|
heap
|
page read and write
|
||
|
13F6000
|
heap
|
page read and write
|
||
|
9F8000
|
heap
|
page read and write
|
||
|
14450105000
|
heap
|
page read and write
|
||
|
3277000
|
trusted library allocation
|
page read and write
|
||
|
23754485000
|
heap
|
page read and write
|
||
|
1440000
|
heap
|
page read and write
|
||
|
735000
|
heap
|
page read and write
|
||
|
B20000
|
heap
|
page read and write
|
||
|
23754480000
|
heap
|
page read and write
|
||
|
1AE40000
|
heap
|
page read and write
|
||
|
27CF000
|
trusted library allocation
|
page read and write
|
||
|
12498000
|
trusted library allocation
|
page read and write
|
||
|
6D0000
|
heap
|
page read and write
|
||
|
12E0000
|
heap
|
page read and write
|
||
|
5F0000
|
heap
|
page read and write
|
||
|
7A38AEC000
|
stack
|
page read and write
|
||
|
1B54E000
|
stack
|
page read and write
|
||
|
3350000
|
trusted library allocation
|
page read and write
|
||
|
1D570000
|
heap
|
page read and write
|
||
|
945000
|
heap
|
page read and write
|
||
|
7FF47B7B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
32FF000
|
trusted library allocation
|
page read and write
|
||
|
9CC000
|
heap
|
page read and write
|
||
|
1CF6E000
|
stack
|
page read and write
|
||
|
8FF000
|
stack
|
page read and write
|
||
|
7FFD34974000
|
trusted library allocation
|
page read and write
|
||
|
27C1000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34990000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C2FC000
|
stack
|
page read and write
|
||
|
7FFD34763000
|
trusted library allocation
|
page execute and read and write
|
||
|
960000
|
trusted library allocation
|
page read and write
|
||
|
1CB6C000
|
stack
|
page read and write
|
||
|
1CA6A000
|
stack
|
page read and write
|
||
|
3414000
|
trusted library allocation
|
page read and write
|
||
|
1AD4D000
|
stack
|
page read and write
|
||
|
1B14E000
|
stack
|
page read and write
|
||
|
3363000
|
trusted library allocation
|
page read and write
|
||
|
1B18E000
|
stack
|
page read and write
|
||
|
27A0000
|
heap
|
page execute and read and write
|
||
|
3412000
|
trusted library allocation
|
page read and write
|
||
|
14A0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD347C0000
|
trusted library allocation
|
page read and write
|
||
|
C45000
|
heap
|
page read and write
|
||
|
7FFD34830000
|
trusted library allocation
|
page execute and read and write
|
||
|
930000
|
trusted library allocation
|
page read and write
|
||
|
7FFD3497E000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34942000
|
trusted library allocation
|
page read and write
|
||
|
1C17B000
|
heap
|
page read and write
|
||
|
3361000
|
trusted library allocation
|
page read and write
|
||
|
748000
|
heap
|
page read and write
|
||
|
999000
|
heap
|
page read and write
|
||
|
1710000
|
trusted library allocation
|
page read and write
|
||
|
1444FFD0000
|
heap
|
page read and write
|
||
|
14450100000
|
heap
|
page read and write
|
||
|
1BEFF000
|
stack
|
page read and write
|
||
|
7FFD34846000
|
trusted library allocation
|
page execute and read and write
|
||
|
B90000
|
heap
|
page execute and read and write
|
||
|
1D270000
|
heap
|
page read and write
|
||
|
1B200000
|
trusted library allocation
|
page read and write
|
||
|
72D000
|
heap
|
page read and write
|
||
|
31CE000
|
stack
|
page read and write
|
||
|
23CE000
|
stack
|
page read and write
|
||
|
7FFD347A0000
|
trusted library allocation
|
page read and write
|
||
|
1C1BB000
|
heap
|
page read and write
|
||
|
1445000
|
heap
|
page read and write
|
||
|
27B0000
|
heap
|
page read and write
|
||
|
7FFD34950000
|
trusted library allocation
|
page execute and read and write
|
||
|
1200000
|
heap
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
131DE000
|
trusted library allocation
|
page read and write
|
||
|
7FFD347A4000
|
trusted library allocation
|
page read and write
|
||
|
1336000
|
heap
|
page read and write
|
||
|
1E171000
|
heap
|
page read and write
|
||
|
23752B30000
|
heap
|
page read and write
|
||
|
1CD6B000
|
stack
|
page read and write
|
||
|
1C82E000
|
stack
|
page read and write
|
||
|
72B000
|
heap
|
page read and write
|
||
|
1D291000
|
heap
|
page read and write
|
||
|
1444FDD0000
|
heap
|
page read and write
|
||
|
7FFD3494F000
|
trusted library allocation
|
page read and write
|
||
|
E60000
|
unkown
|
page readonly
|
||
|
8F4000
|
stack
|
page read and write
|
||
|
7FFD347BD000
|
trusted library allocation
|
page execute and read and write
|
||
|
3C0000
|
heap
|
page read and write
|
||
|
1AF4E000
|
stack
|
page read and write
|
||
|
1444FEE1000
|
heap
|
page read and write
|
||
|
2491000
|
trusted library allocation
|
page read and write
|
||
|
27D1000
|
trusted library allocation
|
page read and write
|
||
|
374000
|
stack
|
page read and write
|
||
|
7FFD3477D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B34E000
|
stack
|
page read and write
|
||
|
23752A90000
|
heap
|
page read and write
|
||
|
1444FFF0000
|
heap
|
page read and write
|
||
|
9F6000
|
heap
|
page read and write
|
||
|
3323000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34810000
|
trusted library allocation
|
page read and write
|
||
|
1300000
|
heap
|
page read and write
|
||
|
7FFD347C4000
|
trusted library allocation
|
page read and write
|
||
|
FB4000
|
stack
|
page read and write
|
||
|
7FFD34780000
|
trusted library allocation
|
page read and write
|
||
|
220000
|
unkown
|
page readonly
|
||
|
2FC0000
|
heap
|
page read and write
|
||
|
16CB000
|
stack
|
page read and write
|
||
|
7FFD34912000
|
trusted library allocation
|
page read and write
|
||
|
16D0000
|
trusted library section
|
page read and write
|
||
|
13A7000
|
heap
|
page read and write
|
||
|
700000
|
heap
|
page read and write
|
||
|
134F000
|
heap
|
page read and write
|
||
|
76E000
|
heap
|
page read and write
|
||
|
1371000
|
heap
|
page read and write
|
||
|
1B75C000
|
stack
|
page read and write
|
||
|
774000
|
heap
|
page read and write
|
||
|
27CC000
|
trusted library allocation
|
page read and write
|
||
|
7FFD347FC000
|
trusted library allocation
|
page execute and read and write
|
||
|
33B8000
|
trusted library allocation
|
page read and write
|
||
|
1BBF3000
|
heap
|
page read and write
|
||
|
33BA000
|
trusted library allocation
|
page read and write
|
||
|
23752B39000
|
heap
|
page read and write
|
||
|
B10000
|
heap
|
page execute and read and write
|
||
|
1444FEE1000
|
heap
|
page read and write
|
||
|
12493000
|
trusted library allocation
|
page read and write
|
||
|
70C000
|
heap
|
page read and write
|
||
|
1B240000
|
heap
|
page read and write
|
||
|
1CC6E000
|
stack
|
page read and write
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
590000
|
heap
|
page read and write
|
||
|
1C1BD000
|
heap
|
page read and write
|
||
|
32C1000
|
trusted library allocation
|
page read and write
|
||
|
7FFD347B0000
|
trusted library allocation
|
page read and write
|
||
|
13A4000
|
heap
|
page read and write
|
||
|
9B9000
|
heap
|
page read and write
|
||
|
1B040000
|
heap
|
page execute and read and write
|
||
|
1C92A000
|
stack
|
page read and write
|
||
|
1D26B000
|
stack
|
page read and write
|
||
|
7CE000
|
heap
|
page read and write
|
||
|
1330000
|
heap
|
page read and write
|
||
|
A60000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34820000
|
trusted library allocation
|
page read and write
|
||
|
7FFD3478D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD347A3000
|
trusted library allocation
|
page execute and read and write
|
||
|
A4E000
|
stack
|
page read and write
|
||
|
1BDFF000
|
stack
|
page read and write
|
||
|
1C185000
|
heap
|
page read and write
|
||
|
344A000
|
trusted library allocation
|
page read and write
|
||
|
1444FEF2000
|
heap
|
page read and write
|
||
|
1374000
|
heap
|
page read and write
|
||
|
741000
|
heap
|
page read and write
|
||
|
16F0000
|
heap
|
page read and write
|
||
|
1C177000
|
heap
|
page read and write
|
||
|
7FFD347CD000
|
trusted library allocation
|
page execute and read and write
|
||
|
7C3000
|
heap
|
page read and write
|
||
|
3392000
|
trusted library allocation
|
page read and write
|
||
|
940000
|
trusted library allocation
|
page read and write
|
||
|
7D5000
|
heap
|
page read and write
|
||
|
3D0000
|
heap
|
page read and write
|
||
|
9CA000
|
heap
|
page read and write
|
||
|
7FFD34979000
|
trusted library allocation
|
page read and write
|
||
|
14C5000
|
heap
|
page read and write
|
||
|
7FFD34890000
|
trusted library allocation
|
page execute and read and write
|
||
|
13CA000
|
heap
|
page read and write
|
||
|
1444FEF1000
|
heap
|
page read and write
|
||
|
1B44E000
|
stack
|
page read and write
|
||
|
12491000
|
trusted library allocation
|
page read and write
|
||
|
723000
|
heap
|
page read and write
|
||
|
7FFD34774000
|
trusted library allocation
|
page read and write
|
||
|
30B0000
|
heap
|
page execute and read and write
|
||
|
1444FEB0000
|
heap
|
page read and write
|
||
|
7FFD3477D000
|
trusted library allocation
|
page execute and read and write
|
There are 256 hidden memdumps, click here to show them.