Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
xin.exe
|
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xin.exe.log
|
CSV text
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\xin.exe
|
"C:\Users\user\Desktop\xin.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
CAD000
|
trusted library allocation
|
page execute and read and write
|
||
|
FB7000
|
heap
|
page read and write
|
||
|
125E000
|
stack
|
page read and write
|
||
|
5869000
|
stack
|
page read and write
|
||
|
3E31000
|
trusted library allocation
|
page read and write
|
||
|
5240000
|
trusted library allocation
|
page read and write
|
||
|
4C6D000
|
stack
|
page read and write
|
||
|
FC0000
|
trusted library allocation
|
page read and write
|
||
|
FD0000
|
heap
|
page read and write
|
||
|
5082000
|
trusted library allocation
|
page read and write
|
||
|
2AD1000
|
trusted library allocation
|
page read and write
|
||
|
5070000
|
trusted library allocation
|
page execute and read and write
|
||
|
1080000
|
heap
|
page read and write
|
||
|
5620000
|
heap
|
page read and write
|
||
|
296E000
|
stack
|
page read and write
|
||
|
C8D000
|
trusted library allocation
|
page execute and read and write
|
||
|
5060000
|
heap
|
page read and write
|
||
|
2D8E000
|
stack
|
page read and write
|
||
|
D04000
|
heap
|
page read and write
|
||
|
B67000
|
stack
|
page read and write
|
||
|
CA3000
|
trusted library allocation
|
page read and write
|
||
|
551E000
|
stack
|
page read and write
|
||
|
4FBE000
|
trusted library allocation
|
page read and write
|
||
|
5A2E000
|
stack
|
page read and write
|
||
|
12DD000
|
trusted library allocation
|
page execute and read and write
|
||
|
4FBB000
|
trusted library allocation
|
page read and write
|
||
|
5150000
|
trusted library allocation
|
page execute and read and write
|
||
|
C4E000
|
stack
|
page read and write
|
||
|
DAF000
|
heap
|
page read and write
|
||
|
58AE000
|
stack
|
page read and write
|
||
|
5000000
|
trusted library allocation
|
page read and write
|
||
|
12D4000
|
trusted library allocation
|
page read and write
|
||
|
F9F000
|
stack
|
page read and write
|
||
|
DAB000
|
heap
|
page read and write
|
||
|
402000
|
remote allocation
|
page execute and read and write
|
||
|
5210000
|
trusted library allocation
|
page read and write
|
||
|
2E20000
|
heap
|
page read and write
|
||
|
5020000
|
trusted library allocation
|
page read and write
|
||
|
1030000
|
trusted library allocation
|
page read and write
|
||
|
14E0000
|
heap
|
page read and write
|
||
|
51D0000
|
heap
|
page read and write
|
||
|
4FE2000
|
trusted library allocation
|
page read and write
|
||
|
CFD000
|
heap
|
page read and write
|
||
|
CD0000
|
heap
|
page read and write
|
||
|
F3C000
|
heap
|
page read and write
|
||
|
C70000
|
trusted library allocation
|
page read and write
|
||
|
C80000
|
trusted library allocation
|
page read and write
|
||
|
C83000
|
trusted library allocation
|
page execute and read and write
|
||
|
BD0000
|
heap
|
page read and write
|
||
|
14D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1010000
|
heap
|
page read and write
|
||
|
EFB000
|
stack
|
page read and write
|
||
|
CB6000
|
trusted library allocation
|
page execute and read and write
|
||
|
1000000
|
heap
|
page read and write
|
||
|
540E000
|
stack
|
page read and write
|
||
|
4FCE000
|
stack
|
page read and write
|
||
|
54B0000
|
heap
|
page read and write
|
||
|
1417000
|
trusted library allocation
|
page execute and read and write
|
||
|
3AD1000
|
trusted library allocation
|
page read and write
|
||
|
F7E000
|
heap
|
page read and write
|
||
|
DA3000
|
heap
|
page read and write
|
||
|
5130000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
70DE000
|
stack
|
page read and write
|
||
|
2E31000
|
trusted library allocation
|
page execute and read and write
|
||
|
538E000
|
stack
|
page read and write
|
||
|
F72000
|
heap
|
page read and write
|
||
|
4FF0000
|
trusted library allocation
|
page read and write
|
||
|
A6A000
|
stack
|
page read and write
|
||
|
53CE000
|
stack
|
page read and write
|
||
|
29AC000
|
stack
|
page read and write
|
||
|
CB0000
|
trusted library allocation
|
page read and write
|
||
|
2D90000
|
heap
|
page read and write
|
||
|
C90000
|
heap
|
page read and write
|
||
|
1480000
|
heap
|
page execute and read and write
|
||
|
3AD5000
|
trusted library allocation
|
page read and write
|
||
|
C84000
|
trusted library allocation
|
page read and write
|
||
|
709F000
|
stack
|
page read and write
|
||
|
14CC000
|
stack
|
page read and write
|
||
|
147E000
|
stack
|
page read and write
|
||
|
1085000
|
heap
|
page read and write
|
||
|
D11000
|
heap
|
page read and write
|
||
|
2E33000
|
trusted library allocation
|
page read and write
|
||
|
C95000
|
heap
|
page read and write
|
||
|
282E000
|
stack
|
page read and write
|
||
|
13EF000
|
stack
|
page read and write
|
||
|
6D1E000
|
stack
|
page read and write
|
||
|
BAC000
|
stack
|
page read and write
|
||
|
1410000
|
trusted library allocation
|
page read and write
|
||
|
592D000
|
stack
|
page read and write
|
||
|
4FCE000
|
trusted library allocation
|
page read and write
|
||
|
12C0000
|
trusted library allocation
|
page read and write
|
||
|
4FDD000
|
trusted library allocation
|
page read and write
|
||
|
1430000
|
trusted library allocation
|
page read and write
|
||
|
1020000
|
trusted library allocation
|
page read and write
|
||
|
3E35000
|
trusted library allocation
|
page read and write
|
||
|
549D000
|
stack
|
page read and write
|
||
|
106E000
|
stack
|
page read and write
|
||
|
54D4000
|
heap
|
page read and write
|
||
|
12D0000
|
trusted library allocation
|
page read and write
|
||
|
BE0000
|
heap
|
page read and write
|
||
|
1400000
|
trusted library allocation
|
page read and write
|
||
|
5205000
|
heap
|
page read and write
|
||
|
12E0000
|
heap
|
page read and write
|
||
|
29B0000
|
trusted library allocation
|
page read and write
|
||
|
51C0000
|
trusted library section
|
page readonly
|
||
|
129E000
|
stack
|
page read and write
|
||
|
54A0000
|
heap
|
page read and write
|
||
|
141B000
|
trusted library allocation
|
page execute and read and write
|
||
|
4FF5000
|
trusted library allocation
|
page read and write
|
||
|
6F9E000
|
stack
|
page read and write
|
||
|
5250000
|
heap
|
page read and write
|
||
|
5260000
|
trusted library allocation
|
page execute and read and write
|
||
|
2DB0000
|
trusted library allocation
|
page read and write
|
||
|
534E000
|
stack
|
page read and write
|
||
|
CBA000
|
trusted library allocation
|
page execute and read and write
|
||
|
F52000
|
heap
|
page read and write
|
||
|
4FB4000
|
trusted library allocation
|
page read and write
|
||
|
D81000
|
heap
|
page read and write
|
||
|
AA2000
|
unkown
|
page readonly
|
||
|
140A000
|
trusted library allocation
|
page execute and read and write
|
||
|
2ACE000
|
stack
|
page read and write
|
||
|
F8A000
|
heap
|
page read and write
|
||
|
F10000
|
heap
|
page read and write
|
||
|
6E5E000
|
stack
|
page read and write
|
||
|
5200000
|
heap
|
page read and write
|
||
|
450000
|
remote allocation
|
page execute and read and write
|
||
|
F1A000
|
heap
|
page read and write
|
||
|
4FD6000
|
trusted library allocation
|
page read and write
|
||
|
CCB000
|
trusted library allocation
|
page execute and read and write
|
||
|
AA0000
|
unkown
|
page readonly
|
||
|
292E000
|
stack
|
page read and write
|
||
|
561E000
|
stack
|
page read and write
|
||
|
5173000
|
heap
|
page read and write
|
||
|
29C0000
|
heap
|
page execute and read and write
|
||
|
1040000
|
heap
|
page read and write
|
||
|
CC2000
|
trusted library allocation
|
page read and write
|
||
|
F85000
|
heap
|
page read and write
|
||
|
29BF000
|
trusted library allocation
|
page read and write
|
||
|
71DE000
|
stack
|
page read and write
|
||
|
1010000
|
trusted library allocation
|
page read and write
|
||
|
F1E000
|
heap
|
page read and write
|
||
|
5170000
|
heap
|
page read and write
|
||
|
CC7000
|
trusted library allocation
|
page execute and read and write
|
||
|
58EE000
|
stack
|
page read and write
|
||
|
FB0000
|
heap
|
page read and write
|
||
|
D71000
|
heap
|
page read and write
|
||
|
571E000
|
stack
|
page read and write
|
||
|
51BB000
|
stack
|
page read and write
|
||
|
51E0000
|
heap
|
page read and write
|
||
|
12D3000
|
trusted library allocation
|
page execute and read and write
|
||
|
F44000
|
heap
|
page read and write
|
||
|
72E2000
|
trusted library allocation
|
page read and write
|
||
|
2DD0000
|
trusted library allocation
|
page read and write
|
||
|
5080000
|
trusted library allocation
|
page read and write
|
||
|
4FB0000
|
trusted library allocation
|
page read and write
|
||
|
13F4000
|
trusted library allocation
|
page read and write
|
||
|
4FD1000
|
trusted library allocation
|
page read and write
|
||
|
2B2E000
|
trusted library allocation
|
page read and write
|
||
|
1020000
|
heap
|
page read and write
|
||
|
5410000
|
heap
|
page execute and read and write
|
||
|
FF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
6F5E000
|
stack
|
page read and write
|
||
|
CDB000
|
heap
|
page read and write
|
||
|
52A0000
|
heap
|
page execute and read and write
|
||
|
6E1E000
|
stack
|
page read and write
|
||
|
13F0000
|
trusted library allocation
|
page read and write
|
There are 157 hidden memdumps, click here to show them.