IOC Report
windxcmd.exe

loading gif

Files

File Path
Type
Category
Malicious
windxcmd.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\windxcmd.exe.log
CSV text
dropped
 malicious
C:\Users\user\AppData\Roaming\svchost.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\wind.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\windxcmd.exe
"C:\Users\user\Desktop\windxcmd.exe"
 malicious
C:\Users\user\AppData\Roaming\svchost.exe
"C:\Users\user\AppData\Roaming\svchost.exe"
malicious
C:\Users\user\AppData\Roaming\wind.exe
"C:\Users\user\AppData\Roaming\wind.exe"
malicious
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\user\AppData\Roaming\svchost.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
45.141.26.134
malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
https://discord.gg/arzenshop%click
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
https://github.com/stark11231/spoof/raw/main/WindXTen.exeAC:
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
There are 20 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
45.141.26.134
unknown
Netherlands
malicious
208.95.112.1
ip-api.com
United States

Memdumps

Base Address
Regiontype
Protect
Malicious
302000
unkown
page readonly
 malicious
3541000
trusted library allocation
page read and write
 malicious
27A1000
trusted library allocation
page read and write
 malicious
1D90C000
stack
page read and write
1C1AE000
stack
page read and write
1CDA79C3000
heap
page read and write
1CD8D330000
heap
page read and write
1CDA7FA0000
trusted library allocation
page read and write
848000
heap
page read and write
7FFD9B504000
trusted library allocation
page read and write
29C6E880000
heap
page read and write
913000
heap
page read and write
13541000
trusted library allocation
page read and write
7FFD9B5CC000
trusted library allocation
page execute and read and write
1C1B0000
heap
page read and write
1CD8CFB8000
heap
page read and write
198C3FE000
stack
page read and write
7FFD9B53B000
trusted library allocation
page execute and read and write
7FFD9B52D000
trusted library allocation
page execute and read and write
80B000
heap
page read and write
AC8C95E000
unkown
page read and write
AC8C8D9000
stack
page read and write
1CD8CFC3000
heap
page read and write
1CD8D0A0000
heap
page read and write
1C891000
heap
page read and write
13F0000
heap
page read and write
1C5AE000
stack
page read and write
198D3FC000
stack
page read and write
13A4000
stack
page read and write
1CD8D230000
trusted library allocation
page read and write
7FFD9B56C000
trusted library allocation
page execute and read and write
7FFD9B600000
trusted library allocation
page execute and read and write
1C0AD000
stack
page read and write
1CDA86F5000
trusted library allocation
page read and write
1CDA7509000
heap
page read and write
1CD8D07D000
heap
page read and write
1C902000
heap
page read and write
AC8C9DF000
stack
page read and write
1D0D5000
stack
page read and write
7FFD9B5A0000
trusted library allocation
page execute and read and write
7FFD9B5C6000
trusted library allocation
page execute and read and write
1CDA76C0000
heap
page read and write
1970000
trusted library allocation
page read and write
840000
heap
page read and write
1CDA7460000
heap
page execute and read and write
7FFD9B4E0000
trusted library allocation
page read and write
1C3AF000
stack
page read and write
1CDA74B1000
heap
page read and write
3B0000
heap
page read and write
1CD8CE90000
heap
page read and write
16F0000
heap
page read and write
1CD8D1A5000
heap
page read and write
1CDA74A0000
heap
page read and write
1CDA76E1000
heap
page read and write
6F1000
stack
page read and write
C02000
heap
page read and write
1CD8D0C0000
heap
page read and write
1CDA8701000
trusted library allocation
page read and write
1D80F000
stack
page read and write
1CD8CF86000
heap
page read and write
3C0000
heap
page read and write
8D5000
heap
page read and write
17EC000
heap
page read and write
1CD8D2D0000
heap
page read and write
1760000
heap
page read and write
7FFD9B502000
trusted library allocation
page read and write
1CD8ECA0000
heap
page read and write
127AE000
trusted library allocation
page read and write
82D000
heap
page read and write
1995000
heap
page read and write
1CDA9770000
trusted library allocation
page read and write
813000
heap
page read and write
AFC000
stack
page read and write
1CD8CFF2000
heap
page read and write
1CDA8744000
trusted library allocation
page read and write
1AC1D000
stack
page read and write
7FFD9B5A0000
trusted library allocation
page read and write
1CDA8706000
trusted library allocation
page read and write
7FFD9B4E3000
trusted library allocation
page execute and read and write
893000
heap
page read and write
7FFD9B5D6000
trusted library allocation
page execute and read and write
1CDA871F000
trusted library allocation
page read and write
1CD8D06F000
heap
page read and write
7FFD9B4F3000
trusted library allocation
page execute and read and write
7FFD9B500000
trusted library allocation
page read and write
1CDA8715000
trusted library allocation
page read and write
1990000
heap
page read and write
1CD8D240000
trusted library section
page read and write
1AFF0000
heap
page read and write
1C804000
heap
page read and write
B00000
heap
page read and write
1CD8D270000
trusted library allocation
page read and write
1C102000
heap
page execute and read and write
1CDA77EF000
heap
page read and write
1C88E000
heap
page read and write
846000
heap
page read and write
7FFD9B680000
trusted library allocation
page read and write
1CD8ECB1000
trusted library allocation
page read and write
1CD9ECB1000
trusted library allocation
page read and write
7FFD9B514000
trusted library allocation
page read and write
7FF4542D0000
trusted library allocation
page execute and read and write
1DC0C000
stack
page read and write
171B000
heap
page read and write
7FFD9B5AC000
trusted library allocation
page execute and read and write
1264000
unkown
page readonly
1CD8CFAE000
heap
page read and write
13543000
trusted library allocation
page read and write
7FFD9B59C000
trusted library allocation
page execute and read and write
1CDA77D0000
heap
page read and write
800000
heap
page read and write
1D70C000
stack
page read and write
7FFD9B4FD000
trusted library allocation
page execute and read and write
7D0000
trusted library allocation
page read and write
1C84D000
heap
page read and write
7FFD9B51D000
trusted library allocation
page execute and read and write
7FFD9B590000
trusted library allocation
page read and write
1BF00000
heap
page execute and read and write
7FFD9B596000
trusted library allocation
page read and write
1CD8CF80000
heap
page read and write
1CD8D075000
heap
page read and write
29C6E7C0000
heap
page read and write
17F0000
heap
page read and write
1CDA86FF000
trusted library allocation
page read and write
7FFD9B4F0000
trusted library allocation
page read and write
127A1000
trusted library allocation
page read and write
1A9E000
stack
page read and write
7FFD9B690000
trusted library allocation
page execute and read and write
7FFD9B6B0000
trusted library allocation
page read and write
16FC000
heap
page read and write
3A0000
heap
page read and write
7FFD9B500000
trusted library allocation
page read and write
1C8BF000
heap
page read and write
1C7AE000
stack
page read and write
1CD8D080000
heap
page read and write
351E000
stack
page read and write
127B1000
trusted library allocation
page read and write
902000
heap
page read and write
7FFD9B50D000
trusted library allocation
page execute and read and write
175E000
heap
page read and write
7FFD9B54C000
trusted library allocation
page execute and read and write
1C6AB000
stack
page read and write
C13000
heap
page read and write
7F0000
trusted library allocation
page read and write
1CD8ED68000
trusted library allocation
page read and write
269E000
stack
page read and write
1CD8D100000
trusted library allocation
page read and write
3530000
heap
page read and write
7FFD9B5C0000
trusted library allocation
page read and write
1CDA8717000
trusted library allocation
page read and write
7FFD9B50D000
trusted library allocation
page execute and read and write
1920000
heap
page read and write
1D2D6000
stack
page read and write
279D000
stack
page read and write
7FFD9B5F6000
trusted library allocation
page execute and read and write
1A7D0000
trusted library allocation
page read and write
198CFFD000
stack
page read and write
83E000
heap
page read and write
7FFD9B534000
trusted library allocation
page read and write
1C4AE000
stack
page read and write
851000
heap
page read and write
8B1000
heap
page read and write
7FFD9B50B000
trusted library allocation
page execute and read and write
7FFD9B6A0000
trusted library allocation
page execute and read and write
1D60F000
stack
page read and write
1C4FE000
stack
page read and write
7FFD9B4FD000
trusted library allocation
page execute and read and write
1C897000
heap
page read and write
1CDA76D0000
heap
page read and write
1C002000
heap
page read and write
F00000
unkown
page readonly
1725000
heap
page read and write
29C6E810000
heap
page read and write
825000
heap
page read and write
1CD8D1A0000
heap
page read and write
1BACC000
stack
page read and write
1DA0A000
stack
page read and write
1CD8D033000
heap
page read and write
29C6E889000
heap
page read and write
1C5FF000
stack
page read and write
7FFD9B513000
trusted library allocation
page execute and read and write
7FFD9B6B0000
trusted library allocation
page read and write
29C6E6E0000
heap
page read and write
1CD8CFC1000
heap
page read and write
7FFD9B53C000
trusted library allocation
page execute and read and write
1C8B7000
heap
page read and write
8F1000
heap
page read and write
84B000
heap
page read and write
B20000
heap
page read and write
7FFD9B5C6000
trusted library allocation
page read and write
1CD8D2C0000
trusted library section
page readonly
1CD8D180000
heap
page read and write
1732000
heap
page read and write
F02000
unkown
page readonly
7FFD9B53D000
trusted library allocation
page execute and read and write
198CBFE000
stack
page read and write
3410000
heap
page execute and read and write
7FFD9B4F2000
trusted library allocation
page read and write
1CD8D2A0000
trusted library allocation
page read and write
F00000
unkown
page readonly
1CD8D130000
trusted library allocation
page read and write
1CD8CF8C000
heap
page read and write
7FFD9B690000
trusted library allocation
page read and write
29C6E7E0000
heap
page read and write
300000
unkown
page readonly
29C6E815000
heap
page read and write
1B9E000
stack
page read and write
877000
heap
page read and write
1CD8CFED000
heap
page read and write
1C1C5000
heap
page read and write
1CD8CFEF000
heap
page read and write
380000
heap
page read and write
127A8000
trusted library allocation
page read and write
1CDA871D000
trusted library allocation
page read and write
1C8CB000
heap
page read and write
7FFD9B530000
trusted library allocation
page read and write
7FFD9B522000
trusted library allocation
page read and write
1CD9ECB7000
trusted library allocation
page read and write
1C7FE000
stack
page read and write
7FFD9B4E4000
trusted library allocation
page read and write
B33000
trusted library allocation
page read and write
33D0000
heap
page read and write
3340000
trusted library allocation
page read and write
7FFD9B5B0000
trusted library allocation
page execute and read and write
1CDA8722000
trusted library allocation
page read and write
1714000
heap
page read and write
1CDA9792000
trusted library allocation
page read and write
B40000
heap
page execute and read and write
1CDA76DC000
heap
page read and write
1C880000
heap
page read and write
1CDA75A0000
heap
page read and write
B10000
heap
page execute and read and write
1815000
heap
page read and write
1D1DA000
stack
page read and write
D02000
heap
page read and write
1C820000
heap
page read and write
1C800000
heap
page read and write
191F000
stack
page read and write
7FFD9B5D0000
trusted library allocation
page execute and read and write
29C6E88E000
heap
page read and write
7FFD9B6C0000
trusted library allocation
page execute and read and write
1C88A000
heap
page read and write
7FFD9B4F4000
trusted library allocation
page read and write
7FFD9B504000
trusted library allocation
page read and write
1CDA7490000
heap
page read and write
1CD8CAB2000
unkown
page readonly
1CD8D290000
heap
page execute and read and write
7FFD9B510000
trusted library allocation
page read and write
1CDA8729000
trusted library allocation
page read and write
1CD8D120000
trusted library allocation
page read and write
8A5000
heap
page read and write
1C3FE000
stack
page read and write
1734000
heap
page read and write
1CD8D335000
heap
page read and write
1B010000
heap
page read and write
1CDA8724000
trusted library allocation
page read and write
1CDA7493000
heap
page read and write
7FFD9B4ED000
trusted library allocation
page execute and read and write
1CD8CAB0000
unkown
page readonly
1C2FA000
stack
page read and write
1CDA76C8000
heap
page read and write
8FF000
heap
page read and write
B30000
trusted library allocation
page read and write
1CD9ECC1000
trusted library allocation
page read and write
16F6000
heap
page read and write
17B6000
heap
page read and write
1810000
heap
page read and write
1CDA76EB000
heap
page read and write
7FFD9B630000
trusted library allocation
page execute and read and write
1C844000
heap
page read and write
7FFD9B610000
trusted library allocation
page execute and read and write
16D0000
heap
page read and write
13548000
trusted library allocation
page read and write
198BFF4000
stack
page read and write
7FFD9B520000
trusted library allocation
page read and write
1CD8D133000
trusted library allocation
page read and write
1CDA8713000
trusted library allocation
page read and write
1CDA74E9000
heap
page read and write
1C8B5000
heap
page read and write
There are 268 hidden memdumps, click here to show them.