Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Xeno.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Xeno.exe_765950b87e97d5d342af7e889eddc96b622feb_0aaebb4a_1d0fc2cc-6029-426a-b8fa-93dceb3eb239\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD33A.tmp.dmp
|
Mini DuMP crash report, 15 streams, Wed Jan 15 15:16:06 2025, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3E7.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD417.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Xeno.exe
|
"C:\Users\user\Desktop\Xeno.exe"
|
|
|
|
C:\Users\user\Desktop\Xeno.exe
|
"C:\Users\user\Desktop\Xeno.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 924
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
jarry-deatile.bond
|
|
||
|
immolatechallen.bond
|
|
||
|
stripedre-lot.bond
|
|
||
|
jarry-fixxer.bond
|
|
||
|
sobrattyeu.bond
|
|
||
|
pain-temper.bond
|
|
||
|
crookedfoshe.bond
|
|
||
|
growthselec.bond
|
|
||
|
https://sobrattyeu.bond/api
|
104.21.96.1
|
|
|
|
strivehelpeu.bond
|
|
||
|
https://sobrattyeu.bond/api7
|
unknown
|
||
|
https://sobrattyeu.bond/
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
https://sobrattyeu.bond/TEQN7c
|
unknown
|
||
|
https://sobrattyeu.bond/C
|
unknown
|
There are 5 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
sobrattyeu.bond
|
104.21.96.1
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
104.21.96.1
|
sobrattyeu.bond
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
ProgramId
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
FileId
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
LongPathHash
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
Name
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
OriginalFileName
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
Publisher
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
Version
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
BinFileVersion
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
BinaryType
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
ProductName
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
ProductVersion
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
LinkDate
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
BinProductVersion
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
Size
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
Language
|
||
|
\REGISTRY\A\{17299adb-d96f-9cc5-08d3-08c8a6f434ec}\Root\InventoryApplicationFile\xeno.exe|1597b79d86ac4730
|
Usn
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
There are 11 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3F99000
|
trusted library allocation
|
page read and write
|
|
|
|
B92000
|
unkown
|
page readonly
|
|
|
|
5620000
|
heap
|
page execute and read and write
|
||
|
D60000
|
heap
|
page read and write
|
||
|
3F91000
|
trusted library allocation
|
page read and write
|
||
|
2F7E000
|
stack
|
page read and write
|
||
|
3560000
|
trusted library allocation
|
page read and write
|
||
|
B7B000
|
stack
|
page read and write
|
||
|
1240000
|
trusted library allocation
|
page read and write
|
||
|
D22000
|
heap
|
page read and write
|
||
|
2E6E000
|
stack
|
page read and write
|
||
|
1185000
|
heap
|
page read and write
|
||
|
3270000
|
trusted library allocation
|
page readonly
|
||
|
11E0000
|
trusted library allocation
|
page read and write
|
||
|
53F6000
|
trusted library allocation
|
page read and write
|
||
|
452000
|
remote allocation
|
page execute and read and write
|
||
|
C92000
|
heap
|
page read and write
|
||
|
B90000
|
unkown
|
page readonly
|
||
|
345E000
|
stack
|
page read and write
|
||
|
3562000
|
trusted library allocation
|
page read and write
|
||
|
1220000
|
trusted library allocation
|
page read and write
|
||
|
D20000
|
heap
|
page read and write
|
||
|
1230000
|
trusted library allocation
|
page execute and read and write
|
||
|
CCA000
|
heap
|
page read and write
|
||
|
10E0000
|
heap
|
page read and write
|
||
|
1200000
|
trusted library allocation
|
page read and write
|
||
|
3565000
|
trusted library allocation
|
page read and write
|
||
|
311E000
|
stack
|
page read and write
|
||
|
125E000
|
heap
|
page read and write
|
||
|
321F000
|
stack
|
page read and write
|
||
|
3271000
|
trusted library allocation
|
page execute read
|
||
|
D99000
|
stack
|
page read and write
|
||
|
287D000
|
stack
|
page read and write
|
||
|
C8B000
|
heap
|
page read and write
|
||
|
53E4000
|
trusted library allocation
|
page read and write
|
||
|
16C6000
|
trusted library allocation
|
page read and write
|
||
|
3272000
|
trusted library allocation
|
page readonly
|
||
|
333C000
|
stack
|
page read and write
|
||
|
2F97000
|
trusted library allocation
|
page execute and read and write
|
||
|
CA0000
|
heap
|
page read and write
|
||
|
C9C000
|
stack
|
page read and write
|
||
|
3350000
|
heap
|
page read and write
|
||
|
127C000
|
heap
|
page read and write
|
||
|
D69000
|
heap
|
page read and write
|
||
|
29BD000
|
stack
|
page read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
326E000
|
stack
|
page read and write
|
||
|
2F99000
|
trusted library allocation
|
page read and write
|
||
|
1170000
|
trusted library allocation
|
page read and write
|
||
|
2E2D000
|
stack
|
page read and write
|
||
|
2F6F000
|
stack
|
page read and write
|
||
|
CBC000
|
heap
|
page read and write
|
||
|
D34000
|
heap
|
page read and write
|
||
|
35C9000
|
trusted library allocation
|
page read and write
|
||
|
C68000
|
heap
|
page read and write
|
||
|
11FA000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F80000
|
heap
|
page execute and read and write
|
||
|
D16000
|
heap
|
page read and write
|
||
|
11E4000
|
trusted library allocation
|
page read and write
|
||
|
11D3000
|
trusted library allocation
|
page execute and read and write
|
||
|
C60000
|
heap
|
page read and write
|
||
|
3F95000
|
trusted library allocation
|
page read and write
|
||
|
1690000
|
heap
|
page read and write
|
||
|
C9E000
|
heap
|
page read and write
|
||
|
168D000
|
stack
|
page read and write
|
||
|
1180000
|
heap
|
page read and write
|
||
|
C30000
|
heap
|
page read and write
|
||
|
11CD000
|
stack
|
page read and write
|
||
|
32CE000
|
stack
|
page read and write
|
||
|
1640000
|
heap
|
page read and write
|
||
|
120B000
|
trusted library allocation
|
page execute and read and write
|
||
|
30AF000
|
stack
|
page read and write
|
||
|
508E000
|
stack
|
page read and write
|
||
|
35A9000
|
trusted library allocation
|
page read and write
|
||
|
C95000
|
heap
|
page read and write
|
||
|
1630000
|
trusted library allocation
|
page read and write
|
||
|
D2F000
|
heap
|
page read and write
|
||
|
A7B000
|
stack
|
page read and write
|
||
|
11D4000
|
trusted library allocation
|
page read and write
|
||
|
D06000
|
heap
|
page read and write
|
||
|
BB6000
|
unkown
|
page readonly
|
||
|
16D0000
|
heap
|
page read and write
|
||
|
3568000
|
trusted library allocation
|
page read and write
|
||
|
2F91000
|
trusted library allocation
|
page read and write
|
||
|
11F0000
|
trusted library allocation
|
page read and write
|
||
|
2FAE000
|
stack
|
page read and write
|
||
|
39FE000
|
stack
|
page read and write
|
||
|
3660000
|
heap
|
page read and write
|
||
|
2820000
|
heap
|
page read and write
|
||
|
BE0000
|
heap
|
page read and write
|
||
|
16C0000
|
trusted library allocation
|
page read and write
|
||
|
1277000
|
heap
|
page read and write
|
||
|
356D000
|
trusted library allocation
|
page read and write
|
||
|
C7C000
|
heap
|
page read and write
|
||
|
D65000
|
heap
|
page read and write
|
||
|
1120000
|
heap
|
page read and write
|
||
|
1207000
|
trusted library allocation
|
page execute and read and write
|
||
|
5410000
|
trusted library allocation
|
page read and write
|
||
|
CAA000
|
heap
|
page read and write
|
||
|
1000000
|
heap
|
page read and write
|
||
|
53F9000
|
trusted library allocation
|
page read and write
|
||
|
35FD000
|
trusted library allocation
|
page read and write
|
||
|
53D4000
|
trusted library allocation
|
page read and write
|
||
|
297E000
|
stack
|
page read and write
|
||
|
144F000
|
stack
|
page read and write
|
||
|
5405000
|
trusted library allocation
|
page read and write
|
||
|
1298000
|
heap
|
page read and write
|
||
|
154E000
|
stack
|
page read and write
|
||
|
158E000
|
stack
|
page read and write
|
||
|
1258000
|
heap
|
page read and write
|
||
|
D11000
|
heap
|
page read and write
|
||
|
29E0000
|
heap
|
page read and write
|
||
|
116E000
|
stack
|
page read and write
|
||
|
357E000
|
trusted library allocation
|
page read and write
|
||
|
356A000
|
trusted library allocation
|
page read and write
|
||
|
357A000
|
trusted library allocation
|
page read and write
|
||
|
1284000
|
heap
|
page read and write
|
||
|
1250000
|
heap
|
page read and write
|
||
|
37F8000
|
trusted library allocation
|
page read and write
|
||
|
355F000
|
stack
|
page read and write
|
There are 110 hidden memdumps, click here to show them.