Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
xoRN6fxApwT8Kin.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
||
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xoRN6fxApwT8Kin.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe
|
"C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://r3.o.lencr.org0
|
unknown
|
||
http://mail.pu.edu.af
|
unknown
|
||
https://account.dyn.com/
|
unknown
|
||
http://x1.c.lencr.org/0
|
unknown
|
||
http://x1.i.lencr.org/0
|
unknown
|
||
http://r3.i.lencr.org/03
|
unknown
|
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
mail.pu.edu.af
|
103.132.98.224
|
||
fp2e7a.wpc.phicdn.net
|
192.229.211.108
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
103.132.98.224
|
mail.pu.edu.af
|
Afghanistan
|
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
444F000
|
trusted library allocation
|
page read and write
|
||
5020000
|
trusted library section
|
page read and write
|
||
28D9000
|
trusted library allocation
|
page read and write
|
||
2A5E000
|
trusted library allocation
|
page read and write
|
||
402000
|
remote allocation
|
page execute and read and write
|
||
3B2D000
|
trusted library allocation
|
page read and write
|
||
2861000
|
trusted library allocation
|
page read and write
|
||
27F1000
|
trusted library allocation
|
page read and write
|
||
D2A000
|
trusted library allocation
|
page execute and read and write
|
||
4882000
|
trusted library allocation
|
page read and write
|
||
D10000
|
trusted library allocation
|
page read and write
|
||
5B0000
|
heap
|
page read and write
|
||
2660000
|
trusted library allocation
|
page read and write
|
||
84EF000
|
stack
|
page read and write
|
||
527E000
|
stack
|
page read and write
|
||
D80000
|
trusted library allocation
|
page read and write
|
||
CB3000
|
trusted library allocation
|
page read and write
|
||
5FFD000
|
stack
|
page read and write
|
||
65C0000
|
trusted library allocation
|
page execute and read and write
|
||
5D5D000
|
stack
|
page read and write
|
||
5E3E000
|
stack
|
page read and write
|
||
523E000
|
stack
|
page read and write
|
||
5408000
|
trusted library allocation
|
page read and write
|
||
5400000
|
trusted library allocation
|
page read and write
|
||
3861000
|
trusted library allocation
|
page read and write
|
||
37F9000
|
trusted library allocation
|
page read and write
|
||
D20000
|
heap
|
page read and write
|
||
5AA000
|
stack
|
page read and write
|
||
5B70000
|
heap
|
page read and write
|
||
50D0000
|
trusted library allocation
|
page execute and read and write
|
||
E2E000
|
stack
|
page read and write
|
||
4CE0000
|
trusted library allocation
|
page read and write
|
||
D37000
|
trusted library allocation
|
page execute and read and write
|
||
A78000
|
heap
|
page read and write
|
||
5C80000
|
trusted library section
|
page read and write
|
||
4D06000
|
trusted library allocation
|
page read and write
|
||
A45000
|
heap
|
page read and write
|
||
4D50000
|
trusted library allocation
|
page read and write
|
||
D1D000
|
trusted library allocation
|
page execute and read and write
|
||
D26000
|
trusted library allocation
|
page execute and read and write
|
||
5BE0000
|
heap
|
page read and write
|
||
6790000
|
heap
|
page read and write
|
||
CE0000
|
heap
|
page read and write
|
||
CCA000
|
trusted library allocation
|
page execute and read and write
|
||
5C0000
|
heap
|
page read and write
|
||
38E3000
|
trusted library allocation
|
page read and write
|
||
26A0000
|
trusted library allocation
|
page read and write
|
||
39CE000
|
trusted library allocation
|
page read and write
|
||
6580000
|
trusted library allocation
|
page read and write
|
||
3889000
|
trusted library allocation
|
page read and write
|
||
8F9000
|
stack
|
page read and write
|
||
5D10000
|
trusted library allocation
|
page execute and read and write
|
||
BDD000
|
heap
|
page read and write
|
||
5E47000
|
trusted library allocation
|
page read and write
|
||
C47000
|
heap
|
page read and write
|
||
5010000
|
trusted library allocation
|
page execute and read and write
|
||
540E000
|
stack
|
page read and write
|
||
4E20000
|
trusted library section
|
page read and write
|
||
26C0000
|
trusted library allocation
|
page read and write
|
||
DA0000
|
trusted library allocation
|
page read and write
|
||
89AE000
|
stack
|
page read and write
|
||
4D60000
|
heap
|
page read and write
|
||
5CEC000
|
trusted library allocation
|
page read and write
|
||
C2F000
|
heap
|
page read and write
|
||
BC7000
|
heap
|
page read and write
|
||
C0F000
|
heap
|
page read and write
|
||
4E50000
|
heap
|
page read and write
|
||
267E000
|
trusted library allocation
|
page read and write
|
||
CA4000
|
trusted library allocation
|
page read and write
|
||
2681000
|
trusted library allocation
|
page read and write
|
||
D22000
|
trusted library allocation
|
page read and write
|
||
28E1000
|
trusted library allocation
|
page read and write
|
||
5CF0000
|
trusted library allocation
|
page read and write
|
||
2888000
|
trusted library allocation
|
page read and write
|
||
4CE4000
|
trusted library allocation
|
page read and write
|
||
2650000
|
heap
|
page execute and read and write
|
||
4D30000
|
trusted library allocation
|
page read and write
|
||
6D11000
|
trusted library allocation
|
page read and write
|
||
A05000
|
heap
|
page read and write
|
||
CA3000
|
trusted library allocation
|
page execute and read and write
|
||
83EE000
|
stack
|
page read and write
|
||
4D40000
|
trusted library allocation
|
page execute and read and write
|
||
5D60000
|
trusted library allocation
|
page execute and read and write
|
||
910000
|
heap
|
page read and write
|
||
5E0000
|
heap
|
page read and write
|
||
896E000
|
stack
|
page read and write
|
||
482E000
|
stack
|
page read and write
|
||
872D000
|
stack
|
page read and write
|
||
38C6000
|
trusted library allocation
|
page read and write
|
||
400000
|
remote allocation
|
page execute and read and write
|
||
D00000
|
trusted library allocation
|
page read and write
|
||
412000
|
unkown
|
page readonly
|
||
D00000
|
trusted library allocation
|
page execute and read and write
|
||
4F90000
|
heap
|
page execute and read and write
|
||
93E000
|
stack
|
page read and write
|
||
4CE0000
|
trusted library allocation
|
page read and write
|
||
B88000
|
heap
|
page read and write
|
||
CF0000
|
trusted library allocation
|
page read and write
|
||
4CFA000
|
trusted library allocation
|
page read and write
|
||
B58000
|
heap
|
page read and write
|
||
2664000
|
trusted library allocation
|
page read and write
|
||
CB0000
|
trusted library allocation
|
page read and write
|
||
4CE6000
|
trusted library allocation
|
page read and write
|
||
5030000
|
trusted library allocation
|
page read and write
|
||
4E30000
|
trusted library allocation
|
page execute and read and write
|
||
A08000
|
heap
|
page read and write
|
||
27EF000
|
stack
|
page read and write
|
||
5D00000
|
trusted library allocation
|
page read and write
|
||
9CE000
|
heap
|
page read and write
|
||
D04000
|
trusted library allocation
|
page read and write
|
||
4BA000
|
unkown
|
page readonly
|
||
4EBC000
|
stack
|
page read and write
|
||
268D000
|
trusted library allocation
|
page read and write
|
||
4D20000
|
heap
|
page read and write
|
||
4E70000
|
heap
|
page read and write
|
||
50FE000
|
stack
|
page read and write
|
||
498C000
|
stack
|
page read and write
|
||
3AF0000
|
trusted library allocation
|
page read and write
|
||
A4E000
|
heap
|
page read and write
|
||
260E000
|
stack
|
page read and write
|
||
DA4000
|
trusted library allocation
|
page read and write
|
||
C90000
|
trusted library allocation
|
page read and write
|
||
4FBC000
|
stack
|
page read and write
|
||
28D5000
|
trusted library allocation
|
page read and write
|
||
26B0000
|
trusted library allocation
|
page read and write
|
||
CA0000
|
trusted library allocation
|
page read and write
|
||
537F000
|
stack
|
page read and write
|
||
6F3E000
|
stack
|
page read and write
|
||
4880000
|
trusted library allocation
|
page read and write
|
||
508B000
|
stack
|
page read and write
|
||
3895000
|
trusted library allocation
|
page read and write
|
||
CA0000
|
heap
|
page read and write
|
||
D35000
|
trusted library allocation
|
page execute and read and write
|
||
8F7000
|
stack
|
page read and write
|
||
CF0000
|
trusted library allocation
|
page read and write
|
||
54A000
|
stack
|
page read and write
|
||
26E0000
|
heap
|
page read and write
|
||
8730000
|
heap
|
page read and write
|
||
4CEE000
|
trusted library allocation
|
page read and write
|
||
BD1000
|
heap
|
page read and write
|
||
980000
|
heap
|
page read and write
|
||
26D0000
|
trusted library allocation
|
page read and write
|
||
410000
|
unkown
|
page readonly
|
||
487E000
|
stack
|
page read and write
|
||
B7B000
|
heap
|
page read and write
|
||
BE1000
|
heap
|
page read and write
|
||
CC0000
|
trusted library allocation
|
page read and write
|
||
D0D000
|
trusted library allocation
|
page execute and read and write
|
||
5D5000
|
heap
|
page read and write
|
||
D60000
|
trusted library allocation
|
page execute and read and write
|
||
5100000
|
heap
|
page read and write
|
||
513E000
|
stack
|
page read and write
|
||
A5A000
|
heap
|
page read and write
|
||
4D50000
|
heap
|
page execute and read and write
|
||
85EE000
|
stack
|
page read and write
|
||
264B000
|
stack
|
page read and write
|
||
4D01000
|
trusted library allocation
|
page read and write
|
||
520F000
|
stack
|
page read and write
|
||
8AAE000
|
stack
|
page read and write
|
||
A30000
|
heap
|
page read and write
|
||
B86000
|
heap
|
page read and write
|
||
D32000
|
trusted library allocation
|
page read and write
|
||
CD2000
|
trusted library allocation
|
page read and write
|
||
5090000
|
trusted library allocation
|
page read and write
|
||
2686000
|
trusted library allocation
|
page read and write
|
||
26BF000
|
trusted library allocation
|
page read and write
|
||
D50000
|
trusted library allocation
|
page read and write
|
||
2692000
|
trusted library allocation
|
page read and write
|
||
CC2000
|
trusted library allocation
|
page read and write
|
||
279E000
|
stack
|
page read and write
|
||
A4B000
|
heap
|
page read and write
|
||
27A8000
|
trusted library allocation
|
page read and write
|
||
B6F000
|
heap
|
page read and write
|
||
2840000
|
trusted library allocation
|
page read and write
|
||
4FFE000
|
stack
|
page read and write
|
||
FFC20000
|
trusted library allocation
|
page execute and read and write
|
||
4D0D000
|
trusted library allocation
|
page read and write
|
||
26C5000
|
trusted library allocation
|
page read and write
|
||
5C27000
|
heap
|
page read and write
|
||
50E0000
|
trusted library allocation
|
page read and write
|
||
97D000
|
stack
|
page read and write
|
||
4D12000
|
trusted library allocation
|
page read and write
|
||
4D32000
|
trusted library allocation
|
page read and write
|
||
4E40000
|
trusted library allocation
|
page read and write
|
||
B50000
|
heap
|
page read and write
|
||
CC6000
|
trusted library allocation
|
page execute and read and write
|
||
5CE0000
|
trusted library allocation
|
page read and write
|
||
D03000
|
trusted library allocation
|
page execute and read and write
|
||
657E000
|
stack
|
page read and write
|
||
5E40000
|
trusted library allocation
|
page read and write
|
||
5D0000
|
heap
|
page read and write
|
||
28C7000
|
trusted library allocation
|
page read and write
|
||
269E000
|
stack
|
page read and write
|
||
CAD000
|
trusted library allocation
|
page execute and read and write
|
||
499D000
|
stack
|
page read and write
|
||
886D000
|
stack
|
page read and write
|
||
4830000
|
trusted library allocation
|
page read and write
|
||
65B0000
|
heap
|
page read and write
|
||
28D5000
|
trusted library allocation
|
page read and write
|
||
4CF2000
|
trusted library allocation
|
page read and write
|
||
489C000
|
stack
|
page read and write
|
||
5210000
|
heap
|
page read and write
|
||
5E50000
|
trusted library allocation
|
page read and write
|
||
647E000
|
stack
|
page read and write
|
||
A51000
|
heap
|
page read and write
|
||
4E53000
|
heap
|
page read and write
|
||
A40000
|
heap
|
page read and write
|
||
D3B000
|
trusted library allocation
|
page execute and read and write
|
||
D70000
|
trusted library allocation
|
page read and write
|
||
CDB000
|
trusted library allocation
|
page execute and read and write
|
||
4CEB000
|
trusted library allocation
|
page read and write
|
||
4CFE000
|
trusted library allocation
|
page read and write
|
||
4F8E000
|
stack
|
page read and write
|
||
3847000
|
trusted library allocation
|
page read and write
|
||
DB0000
|
heap
|
page read and write
|
||
37F1000
|
trusted library allocation
|
page read and write
|
||
C8F000
|
stack
|
page read and write
|
||
81EE000
|
stack
|
page read and write
|
||
266B000
|
trusted library allocation
|
page read and write
|
||
D10000
|
trusted library allocation
|
page read and write
|
||
D20000
|
trusted library allocation
|
page read and write
|
||
5D06000
|
trusted library allocation
|
page read and write
|
||
822E000
|
stack
|
page read and write
|
||
9F5000
|
heap
|
page read and write
|
||
2850000
|
heap
|
page read and write
|
||
CD7000
|
trusted library allocation
|
page execute and read and write
|
||
C31000
|
heap
|
page read and write
|
||
D90000
|
heap
|
page execute and read and write
|
||
5DFF000
|
stack
|
page read and write
|
||
862D000
|
stack
|
page read and write
|
||
9C0000
|
heap
|
page read and write
|
||
4E73000
|
heap
|
page read and write
|
||
CBD000
|
trusted library allocation
|
page execute and read and write
|
There are 223 hidden memdumps, click here to show them.