IOC Report
project plan.exe

loading gif

Files

File Path
Type
Category
Malicious
project plan.exe
PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_project plan.exe_feb5e1bf740ebfcc66821499cd5ec33f8925b97_c0f593ef_8deeed97-6c03-4b0a-a0b8-fcfe0b574727\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDE5D.tmp.dmp
Mini DuMP crash report, 16 streams, Wed Jul 3 07:27:59 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFA7.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE005.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\project plan.exe
"C:\Users\user\Desktop\project plan.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
 malicious
C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1536 -s 1028
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.telegram.org
unknown
 malicious
https://api.telegram.org/bot
unknown
 malicious
https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendDocument?chat_id=5361285164&caption=%20Pc%20Name:%20user%20%7C%20Snake%20Tracker%0D%0A%0D%0APW%20%7C%20user%20%7C%20Snake
149.154.167.220
http://upx.sf.net
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
132.226.247.73
http://checkip.dyndns.com
unknown
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendDocument?chat_id=5361
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
api.telegram.org
149.154.167.220
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
ProgramId
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
FileId
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
LowerCaseLongPath
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
LongPathHash
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
Name
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
OriginalFileName
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
Publisher
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
Version
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
BinFileVersion
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
BinaryType
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
ProductName
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
ProductVersion
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
LinkDate
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
BinProductVersion
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
AppxPackageFullName
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
AppxPackageRelativeId
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
Size
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
Language
 malicious
\REGISTRY\A\{de4f35b7-9f0d-60b5-d749-67475de06956}\Root\InventoryApplicationFile\project plan.exe|9b1014a02602cdb
Usn
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
FileDirectory
There are 24 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2D35000
trusted library allocation
page read and write
 malicious
2E30000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
167566CC000
trusted library allocation
page read and write
 malicious
2C71000
trusted library allocation
page read and write
 malicious
2E0A000
trusted library allocation
page read and write
 malicious
1676696F000
trusted library allocation
page read and write
 malicious
50D1000
trusted library allocation
page read and write
1676EFF0000
trusted library section
page read and write
16766698000
trusted library allocation
page read and write
1FE000
unkown
page read and write
2E1D000
trusted library allocation
page read and write
6F5000
heap
page read and write
51BD000
stack
page read and write
16754BB0000
heap
page read and write
6F0000
heap
page read and write
2DAE000
trusted library allocation
page read and write
16754BF0000
heap
page read and write
3D07000
trusted library allocation
page read and write
61BE000
stack
page read and write
7FF848E08000
trusted library allocation
page read and write
2E65000
trusted library allocation
page read and write
2DC2000
trusted library allocation
page read and write
7FF848EB0000
trusted library allocation
page execute and read and write
2B60000
heap
page execute and read and write
3CFB000
trusted library allocation
page read and write
45B0000
heap
page read and write
7FF848FA0000
trusted library allocation
page read and write
16754AD0000
heap
page read and write
6CF000
unkown
page read and write
16754CE6000
heap
page read and write
7FF848EA0000
trusted library allocation
page read and write
50D6000
trusted library allocation
page read and write
63A9FD000
stack
page read and write
F0D000
trusted library allocation
page execute and read and write
7FF848E00000
trusted library allocation
page read and write
2DCC000
trusted library allocation
page read and write
7FF848DF0000
trusted library allocation
page read and write
14B000
stack
page read and write
603E000
stack
page read and write
16756691000
trusted library allocation
page read and write
4FF000
stack
page read and write
16754D40000
trusted library allocation
page read and write
6045000
heap
page read and write
F70000
trusted library allocation
page read and write
7FF848FD0000
trusted library allocation
page read and write
3C99000
trusted library allocation
page read and write
7FF848F10000
trusted library allocation
page execute and read and write
F00000
trusted library allocation
page read and write
7FF848E14000
trusted library allocation
page read and write
50BE000
trusted library allocation
page read and write
4AEF000
stack
page read and write
7FF848DF2000
trusted library allocation
page read and write
6040000
heap
page read and write
62E7000
trusted library allocation
page read and write
6160000
trusted library allocation
page execute and read and write
F3B000
trusted library allocation
page execute and read and write
85F000
heap
page read and write
1676F2C0000
heap
page read and write
50E2000
trusted library allocation
page read and write
DE0000
heap
page read and write
63ABFE000
stack
page read and write
AF0000
heap
page read and write
62E0000
trusted library allocation
page read and write
55BE000
stack
page read and write
85F000
heap
page read and write
6048000
heap
page read and write
5780000
trusted library allocation
page read and write
1000000
heap
page read and write
578B000
trusted library allocation
page read and write
16754C66000
heap
page read and write
7FF848DF3000
trusted library allocation
page execute and read and write
7FF848FC0000
trusted library allocation
page read and write
16754D60000
trusted library allocation
page read and write
50CE000
trusted library allocation
page read and write
F1D000
trusted library allocation
page execute and read and write
EF0000
trusted library allocation
page read and write
16766E85000
trusted library allocation
page read and write
16754C33000
heap
page read and write
6700000
heap
page read and write
4ED000
stack
page read and write
16754BD0000
heap
page read and write
3C71000
trusted library allocation
page read and write
F04000
trusted library allocation
page read and write
50F0000
trusted library allocation
page read and write
F8B000
heap
page read and write
F22000
trusted library allocation
page read and write
56BE000
stack
page read and write
7FF848FE2000
trusted library allocation
page read and write
A90000
heap
page read and write
4D6D000
stack
page read and write
F03000
trusted library allocation
page execute and read and write
DE5000
heap
page read and write
16755070000
heap
page read and write
2E57000
trusted library allocation
page read and write
F35000
trusted library allocation
page execute and read and write
56FE000
stack
page read and write
63A4F3000
stack
page read and write
2E2A000
trusted library allocation
page read and write
7FF848F90000
trusted library allocation
page read and write
51C0000
heap
page execute and read and write
E90000
heap
page read and write
62F0000
trusted library allocation
page read and write
63AAFE000
stack
page read and write
2AA0000
heap
page read and write
7FF848E1D000
trusted library allocation
page execute and read and write
63A7FF000
stack
page read and write
F80000
heap
page read and write
16754E85000
heap
page read and write
50B0000
trusted library allocation
page read and write
CF7000
stack
page read and write
73E000
stack
page read and write
50B6000
trusted library allocation
page read and write
16754A40000
unkown
page readonly
1009000
heap
page read and write
DD0000
heap
page read and write
740000
heap
page read and write
63ADFE000
stack
page read and write
7FF848EAC000
trusted library allocation
page execute and read and write
841000
heap
page read and write
841000
heap
page read and write
9F0000
heap
page read and write
F2A000
trusted library allocation
page execute and read and write
50CA000
trusted library allocation
page read and write
16754C62000
heap
page read and write
577E000
stack
page read and write
841000
heap
page read and write
FC1000
heap
page read and write
7FF848DFD000
trusted library allocation
page execute and read and write
7FF848E02000
trusted library allocation
page read and write
7FF848FAC000
trusted library allocation
page read and write
5E3E000
stack
page read and write
16766B43000
trusted library allocation
page read and write
167569E0000
trusted library allocation
page read and write
7FF848E4C000
trusted library allocation
page execute and read and write
EC0000
heap
page read and write
578D000
trusted library allocation
page read and write
16754D70000
trusted library allocation
page read and write
16754E80000
heap
page read and write
400000
remote allocation
page execute and read and write
2D20000
trusted library allocation
page read and write
2DD0000
trusted library allocation
page read and write
AF6000
heap
page read and write
62BF000
stack
page read and write
7FF849000000
trusted library allocation
page read and write
98A000
stack
page read and write
1075000
heap
page read and write
50DD000
trusted library allocation
page read and write
1676F2BD000
trusted library section
page read and write
F37000
trusted library allocation
page execute and read and write
16754DB0000
heap
page read and write
1676EFE0000
heap
page execute and read and write
2A9D000
stack
page read and write
16766691000
trusted library allocation
page read and write
2D15000
trusted library allocation
page read and write
16754CF0000
heap
page read and write
7FF4BA030000
trusted library allocation
page execute and read and write
3CF1000
trusted library allocation
page read and write
50BB000
trusted library allocation
page read and write
2D32000
trusted library allocation
page read and write
16754E20000
heap
page execute and read and write
63A6FE000
stack
page read and write
FB4000
heap
page read and write
F32000
trusted library allocation
page read and write
6D0000
heap
page read and write
6520000
trusted library allocation
page read and write
6152000
trusted library allocation
page read and write
F60000
trusted library allocation
page execute and read and write
6140000
trusted library allocation
page execute and read and write
167666A1000
trusted library allocation
page read and write
422000
remote allocation
page execute and read and write
2E04000
trusted library allocation
page read and write
51D3000
heap
page read and write
1676E6C0000
trusted library allocation
page read and write
6510000
heap
page read and write
2A5E000
stack
page read and write
810000
heap
page read and write
3CD6000
trusted library allocation
page read and write
7FF848DF4000
trusted library allocation
page read and write
2E23000
trusted library allocation
page read and write
7FF848E0D000
trusted library allocation
page execute and read and write
F20000
trusted library allocation
page read and write
82A000
heap
page read and write
7FF848ED6000
trusted library allocation
page execute and read and write
2D29000
trusted library allocation
page read and write
6310000
trusted library allocation
page read and write
6170000
trusted library allocation
page read and write
F50000
trusted library allocation
page read and write
2D18000
trusted library allocation
page read and write
7FF848FB0000
trusted library allocation
page read and write
85F000
heap
page read and write
834000
heap
page read and write
7FF848FF0000
trusted library allocation
page execute and read and write
16754A42000
unkown
page readonly
63A8FE000
stack
page read and write
7FF848E1B000
trusted library allocation
page execute and read and write
63A5FE000
stack
page read and write
2E76000
trusted library allocation
page read and write
16754C30000
heap
page read and write
7FF848EA6000
trusted library allocation
page read and write
16754BFC000
heap
page read and write
1676669D000
trusted library allocation
page read and write
16754C1C000
heap
page read and write
820000
heap
page read and write
2D1D000
trusted library allocation
page read and write
7FF848F96000
trusted library allocation
page read and write
2DD5000
trusted library allocation
page read and write
F26000
trusted library allocation
page execute and read and write
7FF848E10000
trusted library allocation
page read and write
A1E000
stack
page read and write
103B000
heap
page read and write
EB0000
heap
page read and write
51D0000
heap
page read and write
167566B2000
trusted library allocation
page read and write
7FF848FA6000
trusted library allocation
page read and write
2D26000
trusted library allocation
page read and write
2C6E000
stack
page read and write
63ACFE000
stack
page read and write
2E72000
trusted library allocation
page read and write
5110000
trusted library allocation
page read and write
2DB9000
trusted library allocation
page read and write
2DB2000
trusted library allocation
page read and write
16755075000
heap
page read and write
517D000
stack
page read and write
104E000
stack
page read and write
1B0000
heap
page read and write
6300000
trusted library allocation
page execute and read and write
1676EE60000
trusted library section
page read and write
F10000
trusted library allocation
page read and write
5280000
heap
page read and write
16754C35000
heap
page read and write
2B50000
trusted library allocation
page read and write
16754D73000
trusted library allocation
page read and write
831000
heap
page read and write
4F5000
stack
page read and write
There are 225 hidden memdumps, click here to show them.