Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
fg}.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Roaming\XClient.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Jul 1 21:32:03
2024, mtime=Mon Jul 1 21:32:03 2024, atime=Mon Jul 1 21:32:03 2024, length=59392, window=hide
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\fg}.exe
|
"C:\Users\user\Desktop\fg}.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
people-climbing.gl.at.ply.gg
|
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
people-climbing.gl.at.ply.gg
|
147.185.221.20
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
147.185.221.20
|
people-climbing.gl.at.ply.gg
|
United States
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4D2000
|
unkown
|
page readonly
|
|
|
|
AEF000
|
heap
|
page read and write
|
||
|
1AE6D000
|
stack
|
page read and write
|
||
|
7FF886D24000
|
trusted library allocation
|
page read and write
|
||
|
A63000
|
heap
|
page read and write
|
||
|
4D0000
|
unkown
|
page readonly
|
||
|
7FF886D1D000
|
trusted library allocation
|
page execute and read and write
|
||
|
9F0000
|
trusted library allocation
|
page read and write
|
||
|
7FF886D20000
|
trusted library allocation
|
page read and write
|
||
|
A20000
|
trusted library allocation
|
page read and write
|
||
|
B43000
|
heap
|
page read and write
|
||
|
1B67F000
|
stack
|
page read and write
|
||
|
27B0000
|
heap
|
page read and write
|
||
|
7FF886DBC000
|
trusted library allocation
|
page execute and read and write
|
||
|
29E0000
|
heap
|
page execute and read and write
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
A80000
|
heap
|
page read and write
|
||
|
B7C000
|
heap
|
page read and write
|
||
|
7FF886D10000
|
trusted library allocation
|
page read and write
|
||
|
1B47F000
|
stack
|
page read and write
|
||
|
570000
|
heap
|
page read and write
|
||
|
B3D000
|
heap
|
page read and write
|
||
|
1B8CC000
|
heap
|
page read and write
|
||
|
29AE000
|
stack
|
page read and write
|
||
|
1C16A000
|
stack
|
page read and write
|
||
|
7FF886D03000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FF886DB6000
|
trusted library allocation
|
page read and write
|
||
|
4D0000
|
unkown
|
page readonly
|
||
|
7FF886D04000
|
trusted library allocation
|
page read and write
|
||
|
1B8DD000
|
heap
|
page read and write
|
||
|
DF0000
|
heap
|
page read and write
|
||
|
E05000
|
heap
|
page read and write
|
||
|
129F1000
|
trusted library allocation
|
page read and write
|
||
|
7FF886DE6000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B901000
|
heap
|
page read and write
|
||
|
7FF886EA2000
|
trusted library allocation
|
page read and write
|
||
|
AF7000
|
heap
|
page read and write
|
||
|
1BB74000
|
stack
|
page read and write
|
||
|
7FF886D2D000
|
trusted library allocation
|
page execute and read and write
|
||
|
AC1000
|
heap
|
page read and write
|
||
|
B6B000
|
heap
|
page read and write
|
||
|
27AE000
|
stack
|
page read and write
|
||
|
7FF886E20000
|
trusted library allocation
|
page execute and read and write
|
||
|
A10000
|
trusted library allocation
|
page read and write
|
||
|
7FF886DC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
E00000
|
heap
|
page read and write
|
||
|
AAF000
|
heap
|
page read and write
|
||
|
A23000
|
trusted library allocation
|
page read and write
|
||
|
8F4000
|
stack
|
page read and write
|
||
|
1B880000
|
heap
|
page read and write
|
||
|
7FF886DB0000
|
trusted library allocation
|
page read and write
|
||
|
A86000
|
heap
|
page read and write
|
||
|
1C06B000
|
stack
|
page read and write
|
||
|
5A5000
|
heap
|
page read and write
|
||
|
303E000
|
trusted library allocation
|
page read and write
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
1AA20000
|
trusted library allocation
|
page read and write
|
||
|
7FF4C9090000
|
trusted library allocation
|
page execute and read and write
|
||
|
F0C000
|
stack
|
page read and write
|
||
|
1B57E000
|
stack
|
page read and write
|
||
|
129F8000
|
trusted library allocation
|
page read and write
|
||
|
29F1000
|
trusted library allocation
|
page read and write
|
||
|
1BF6C000
|
stack
|
page read and write
|
||
|
AAB000
|
heap
|
page read and write
|
||
|
7FF886D13000
|
trusted library allocation
|
page read and write
|
||
|
7FF886EB0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2CE5000
|
trusted library allocation
|
page read and write
|
||
|
C7E000
|
stack
|
page read and write
|
||
|
1B370000
|
heap
|
page execute and read and write
|
||
|
7FF886D0D000
|
trusted library allocation
|
page execute and read and write
|
||
|
D7E000
|
stack
|
page read and write
|
||
|
7FF886D00000
|
trusted library allocation
|
page read and write
|
||
|
1B8CE000
|
heap
|
page read and write
|
||
|
A9E000
|
heap
|
page read and write
|
||
|
A8C000
|
heap
|
page read and write
|
||
|
5B0000
|
heap
|
page read and write
|
||
|
AC4000
|
heap
|
page read and write
|
||
|
7FF886D5C000
|
trusted library allocation
|
page execute and read and write
|
||
|
580000
|
heap
|
page read and write
|
||
|
2810000
|
heap
|
page read and write
|
||
|
296F000
|
stack
|
page read and write
|
||
|
1BA7A000
|
stack
|
page read and write
|
||
|
A60000
|
heap
|
page read and write
|
There are 73 hidden memdumps, click here to show them.