Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
XClient.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_XClient.exe_6effdd05a2974476353f94223a92dcbdb64af0_81528a0c_cef53090-dc85-43c7-a262-2065c3599dc2\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA038.tmp.dmp
|
Mini DuMP crash report, 16 streams, Tue Sep 24 19:03:14 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA190.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA1D0.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\XClient.exe
|
"C:\Users\user\Desktop\XClient.exe"
|
|
|
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 4252 -s 1660
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
vecotr.viewdns.net
|
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
vecotr.viewdns.net
|
191.96.207.180
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
191.96.207.180
|
vecotr.viewdns.net
|
Chile
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
ProgramId
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
FileId
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
LongPathHash
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
Name
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
OriginalFileName
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
Publisher
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
Version
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
BinFileVersion
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
BinaryType
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
ProductName
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
ProductVersion
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
LinkDate
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
BinProductVersion
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
Size
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
Language
|
||
|
\REGISTRY\A\{dd66ccad-6846-4f90-3519-bb6095a21ebf}\Root\InventoryApplicationFile\xclient.exe|926aab8a72fcbd7f
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
812000
|
unkown
|
page readonly
|
|
|
|
2B91000
|
trusted library allocation
|
page read and write
|
|
|
|
10C5000
|
heap
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
C73000
|
trusted library allocation
|
page read and write
|
||
|
1B6B4000
|
stack
|
page read and write
|
||
|
7FFAACBAD000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFAACCC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B11D000
|
stack
|
page read and write
|
||
|
2BD9000
|
trusted library allocation
|
page read and write
|
||
|
7FFB16791000
|
unkown
|
page execute read
|
||
|
1BA94000
|
heap
|
page read and write
|
||
|
301A000
|
trusted library allocation
|
page read and write
|
||
|
1B93E000
|
stack
|
page read and write
|
||
|
105F000
|
stack
|
page read and write
|
||
|
3133000
|
trusted library allocation
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
12B9E000
|
trusted library allocation
|
page read and write
|
||
|
CCC000
|
heap
|
page read and write
|
||
|
CFE000
|
heap
|
page read and write
|
||
|
7FFB167B2000
|
unkown
|
page readonly
|
||
|
7FFAACC5C000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFAACD60000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFAACBC0000
|
trusted library allocation
|
page read and write
|
||
|
D00000
|
heap
|
page read and write
|
||
|
1BA4A000
|
heap
|
page read and write
|
||
|
109E000
|
stack
|
page read and write
|
||
|
1B730000
|
heap
|
page execute and read and write
|
||
|
12B98000
|
trusted library allocation
|
page read and write
|
||
|
7FFAACBBD000
|
trusted library allocation
|
page execute and read and write
|
||
|
C00000
|
heap
|
page read and write
|
||
|
7FFB16790000
|
unkown
|
page readonly
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
1B5B3000
|
heap
|
page read and write
|
||
|
C60000
|
trusted library allocation
|
page read and write
|
||
|
7FFAACD51000
|
trusted library allocation
|
page read and write
|
||
|
1B558000
|
stack
|
page read and write
|
||
|
2A60000
|
heap
|
page execute and read and write
|
||
|
10C0000
|
heap
|
page read and write
|
||
|
FF5000
|
heap
|
page read and write
|
||
|
1BA40000
|
heap
|
page read and write
|
||
|
7FFAACBA0000
|
trusted library allocation
|
page read and write
|
||
|
D33000
|
heap
|
page read and write
|
||
|
12B91000
|
trusted library allocation
|
page read and write
|
||
|
D7F000
|
heap
|
page read and write
|
||
|
1B83E000
|
stack
|
page read and write
|
||
|
7FFAACBA3000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFAACC86000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFB167B5000
|
unkown
|
page readonly
|
||
|
D82000
|
heap
|
page read and write
|
||
|
F8C000
|
stack
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
1BA3E000
|
stack
|
page read and write
|
||
|
7FFAACC50000
|
trusted library allocation
|
page read and write
|
||
|
FC0000
|
heap
|
page read and write
|
||
|
1C03A000
|
stack
|
page read and write
|
||
|
7FFAACBFC000
|
trusted library allocation
|
page execute and read and write
|
||
|
C70000
|
trusted library allocation
|
page read and write
|
||
|
9A0000
|
heap
|
page read and write
|
||
|
1BA89000
|
heap
|
page read and write
|
||
|
7FFAACC56000
|
trusted library allocation
|
page read and write
|
||
|
1B5B0000
|
heap
|
page read and write
|
||
|
7FFAACBCD000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFAACD40000
|
trusted library allocation
|
page read and write
|
||
|
7FFAACC60000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C33C000
|
stack
|
page read and write
|
||
|
954000
|
stack
|
page read and write
|
||
|
1BAAF000
|
heap
|
page read and write
|
||
|
1BF3B000
|
stack
|
page read and write
|
||
|
7FFAACBA4000
|
trusted library allocation
|
page read and write
|
||
|
7FFAACBC4000
|
trusted library allocation
|
page read and write
|
||
|
3137000
|
trusted library allocation
|
page read and write
|
||
|
10A0000
|
heap
|
page read and write
|
||
|
7FFAACBB0000
|
trusted library allocation
|
page read and write
|
||
|
1AF19000
|
heap
|
page read and write
|
||
|
CEF000
|
heap
|
page read and write
|
||
|
D03000
|
heap
|
page read and write
|
||
|
7FFB167B0000
|
unkown
|
page read and write
|
||
|
7FFAACBB2000
|
trusted library allocation
|
page read and write
|
||
|
7FF4BE950000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFB167A6000
|
unkown
|
page readonly
|
||
|
2B8F000
|
stack
|
page read and write
|
||
|
1BA50000
|
heap
|
page read and write
|
||
|
C40000
|
trusted library allocation
|
page read and write
|
||
|
D2C000
|
heap
|
page read and write
|
||
|
1ABC0000
|
trusted library allocation
|
page read and write
|
||
|
2A80000
|
heap
|
page read and write
|
||
|
1BE3D000
|
stack
|
page read and write
|
||
|
810000
|
unkown
|
page readonly
|
||
|
1BA9B000
|
heap
|
page read and write
|
||
|
1BA90000
|
heap
|
page read and write
|
||
|
11CC000
|
stack
|
page read and write
|
||
|
810000
|
unkown
|
page readonly
|
||
|
1BA7C000
|
heap
|
page read and write
|
There are 84 hidden memdumps, click here to show them.