IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_23ac2d3598194099bfea53d8620e685cbd9df63_2fa1aaae_46522aeb-fbd2-4ad7-8707-f1f3c121c621\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F85.tmp.dmp
Mini DuMP crash report, 15 streams, Wed Jul 3 14:50:15 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6283.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER62B3.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 2068

URLs

Name
IP
Malicious
https://t.me/
unknown
 malicious
https://steamcommunity.com/profiles/76561199730044335
malicious
https://t.me/bu77un
149.154.167.99
 malicious
https://116.202.180.70:5432/sqlt.dll4
unknown
https://nydus.battle.net/App/%s/setup/app
unknown
https://telemetry-in.battlenet.com.cn/datahttps://telemetry-in.battle.net/data
unknown
https://116.202.180.70:5432/
unknown
http://nydus.battle.net/App/%s/setup/error/%s
unknown
https://www.openssl.org/docs/faq.html
unknown
http://www.google.com/get/noto/
unknown
https://web.telegram.org
unknown
http://nydus.battle.net/geoip
unknown
https://116.202.180.70:5432/2
unknown
https://116.202.180.70:5432/dows
unknown
https://116.202.180.70:5432/1
unknown
https://116.202.180.70:5432/talV
unknown
https://bitwarden.com
unknown
http://upx.sf.net
unknown
https://116.202.180.70:5432
unknown
https://116.202.180.70:5432rss.exe
unknown
https://116.202.180.70:5432/sqlt.dllnamK.exe
unknown
https://curl.haxx.se/docs/http-cookies.html
unknown
https://t.me/bu77unguf_hMozilla/5.0
unknown
http://iir.blizzard.com:3724/submit/BNET_APP
unknown
https://telemetry-in.battlenet.com.cn/data
unknown
https://telemetry-in.battle.net/data
unknown
https://116.202.180.70:5432/T
unknown
https://steamcommunity.com/profiles/76561199730044335hellosqlt.dllsqlite3.dll
unknown
http:///1.18.10.3141/Apps/Battle.net.agent.db
unknown
https://116.202.180.70:5432/ps;PATHEXT=.CO
unknown
http://iir.blizzard.com:3724/submit/BNET_APPUnknown
unknown
https://116.202.180.70:5432Content-Disposition:
unknown
http://scripts.sil.org/OFL
unknown
https://116.202.180.70:5432/sqlt.dll
unknown
http://nydus.battle.net/geoipX-Geoip-RegionX-Geoip-CountryUSCNSEASGGETd:
unknown
https://nydus.battle.net/App/%s/setup/appSelected
unknown
https://116.202.180.70/
unknown
https://116.202.180.70:5432/Y/h
unknown
There are 28 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
t.me
149.154.167.99
 malicious
198.187.3.20.in-addr.arpa
unknown
 malicious

IPs

IP
Domain
Country
Malicious
149.154.167.99
t.me
United Kingdom
malicious
116.202.180.70
unknown
Germany

Registry

Path
Value
Malicious
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
ProgramId
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
FileId
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
LowerCaseLongPath
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
LongPathHash
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Name
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
OriginalFileName
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Publisher
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Version
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
BinFileVersion
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
BinaryType
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
ProductName
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
ProductVersion
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
LinkDate
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
BinProductVersion
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
AppxPackageFullName
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
AppxPackageRelativeId
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Size
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Language
\REGISTRY\A\{13d32804-6ec7-9827-09cf-4ff8cf9a5129}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018000DDABBE6B3
There are 13 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2DF0000
direct allocation
page read and write
 malicious
2FA5000
unclassified section
page readonly
 malicious
940000
direct allocation
page execute and read and write
 malicious
5D0000
heap
page read and write
E00000
unkown
page readonly
564000
heap
page read and write
2A61000
heap
page read and write
2A61000
heap
page read and write
2A61000
heap
page read and write
A080000
heap
page read and write
2EAE000
stack
page read and write
2A61000
heap
page read and write
A24000
heap
page read and write
A097000
heap
page read and write
2A61000
heap
page read and write
2DE2000
stack
page read and write
564000
heap
page read and write
2A61000
heap
page read and write
564000
heap
page read and write
9C0E000
stack
page read and write
2CEF000
stack
page read and write
A074000
heap
page read and write
2A61000
heap
page read and write
3026000
unclassified section
page read and write
2A80000
heap
page read and write
2A61000
heap
page read and write
A43E000
heap
page read and write
564000
heap
page read and write
A1A4000
heap
page read and write
2A61000
heap
page read and write
9D8D000
stack
page read and write
A3FE000
heap
page read and write
A64000
heap
page read and write
564000
heap
page read and write
A0AB000
heap
page read and write
2A61000
heap
page read and write
A3D0000
heap
page read and write
A130000
heap
page read and write
2DEB000
stack
page read and write
10CD000
unkown
page readonly
580000
heap
page read and write
2A61000
heap
page read and write
2A61000
heap
page read and write
A3CD000
stack
page read and write
8FC000
stack
page read and write
2A61000
heap
page read and write
1263000
unkown
page readonly
E00000
unkown
page readonly
11EC000
unkown
page write copy
564000
heap
page read and write
564000
heap
page read and write
3051000
unclassified section
page read and write
2F81000
unclassified section
page execute read
A057000
heap
page read and write
564000
heap
page read and write
564000
heap
page read and write
93E000
stack
page read and write
2A61000
heap
page read and write
2A61000
heap
page read and write
9B0C000
stack
page read and write
2E50000
heap
page read and write
11F5000
unkown
page write copy
A2CD000
stack
page read and write
9EE0000
remote allocation
page read and write
30AD000
unclassified section
page read and write
A19C000
heap
page read and write
2BDC000
stack
page read and write
976000
direct allocation
page execute and read and write
564000
heap
page read and write
A14C000
heap
page read and write
564000
heap
page read and write
1263000
unkown
page readonly
564000
heap
page read and write
305D000
unclassified section
page read and write
9A8000
heap
page read and write
2FAE000
unclassified section
page write copy
11F5000
unkown
page write copy
564000
heap
page read and write
1262000
unkown
page read and write
2A61000
heap
page read and write
564000
heap
page read and write
1344000
unkown
page readonly
2A61000
heap
page read and write
9A0E000
stack
page read and write
A15D000
heap
page read and write
2A61000
heap
page read and write
A70D000
stack
page read and write
11EC000
unkown
page read and write
2A5F000
stack
page read and write
564000
heap
page read and write
A94E000
stack
page read and write
2A61000
heap
page read and write
A0EB000
heap
page read and write
9EE0000
remote allocation
page read and write
9A0000
heap
page read and write
2DED000
stack
page read and write
2BE0000
heap
page read and write
2A66000
heap
page read and write
9F4000
heap
page read and write
564000
heap
page read and write
A1AD000
heap
page read and write
A060000
heap
page read and write
A031000
heap
page read and write
2A61000
heap
page read and write
2A61000
heap
page read and write
A06D000
heap
page read and write
2A61000
heap
page read and write
2A61000
heap
page read and write
2BE7000
heap
page read and write
A076000
heap
page read and write
2A61000
heap
page read and write
2A61000
heap
page read and write
2A61000
heap
page read and write
A710000
trusted library allocation
page read and write
2A61000
heap
page read and write
564000
heap
page read and write
A080000
heap
page read and write
2E30000
trusted library allocation
page read and write
2A70000
heap
page read and write
2A61000
heap
page read and write
3148000
unclassified section
page read and write
564000
heap
page read and write
2FB0000
unclassified section
page read and write
2A60000
heap
page read and write
564000
heap
page read and write
E01000
unkown
page execute read
A085000
heap
page read and write
A0AB000
heap
page read and write
564000
heap
page read and write
A3D1000
heap
page read and write
2A61000
heap
page read and write
A080000
heap
page read and write
A031000
heap
page read and write
A084000
heap
page read and write
A080000
heap
page read and write
2A61000
heap
page read and write
564000
heap
page read and write
2A61000
heap
page read and write
2A61000
heap
page read and write
A065000
heap
page read and write
A030000
heap
page read and write
A9E000
heap
page read and write
A60C000
stack
page read and write
30B9000
unclassified section
page read and write
2A61000
heap
page read and write
564000
heap
page read and write
564000
heap
page read and write
3029000
unclassified section
page read and write
2B9E000
stack
page read and write
2A61000
heap
page read and write
A07D000
heap
page read and write
2A61000
heap
page read and write
A3FD000
heap
page read and write
A09A000
heap
page read and write
A06D000
heap
page read and write
9E8E000
stack
page read and write
564000
heap
page read and write
2F2D000
stack
page read and write
A452000
heap
page read and write
11ED000
unkown
page write copy
2A61000
heap
page read and write
C6F000
stack
page read and write
50C000
stack
page read and write
2FB9000
unclassified section
page read and write
A195000
heap
page read and write
A0F000
heap
page read and write
564000
heap
page read and write
3082000
unclassified section
page read and write
1344000
unkown
page readonly
2A61000
heap
page read and write
2A61000
heap
page read and write
A8D000
heap
page read and write
A0D8000
heap
page read and write
564000
heap
page read and write
2A61000
heap
page read and write
A08F000
heap
page read and write
2A61000
heap
page read and write
A16D000
heap
page read and write
560000
heap
page read and write
A140000
heap
page read and write
2A61000
heap
page read and write
2A61000
heap
page read and write
A65000
heap
page read and write
31D0000
unclassified section
page read and write
564000
heap
page read and write
9C4E000
stack
page read and write
2EEE000
stack
page read and write
3031000
unclassified section
page read and write
5CE000
stack
page read and write
A410000
heap
page read and write
564000
heap
page read and write
A085000
heap
page read and write
10CD000
unkown
page readonly
564000
heap
page read and write
2A61000
heap
page read and write
564000
heap
page read and write
9EE0000
remote allocation
page read and write
2FBF000
unclassified section
page read and write
31C3000
unclassified section
page readonly
A08F000
heap
page read and write
564000
heap
page read and write
564000
heap
page read and write
564000
heap
page read and write
2A61000
heap
page read and write
1206000
unkown
page read and write
2A61000
heap
page read and write
E01000
unkown
page execute read
9D4F000
stack
page read and write
2A61000
heap
page read and write
31C1000
unclassified section
page read and write
2A61000
heap
page read and write
564000
heap
page read and write
A199000
heap
page read and write
2A61000
heap
page read and write
9F1E000
stack
page read and write
A27000
heap
page read and write
564000
heap
page read and write
A197000
heap
page read and write
2A61000
heap
page read and write
A840000
heap
page read and write
2F70000
heap
page read and write
2A61000
heap
page read and write
A74E000
stack
page read and write
A088000
heap
page read and write
2A61000
heap
page read and write
2FC5000
unclassified section
page read and write
2A61000
heap
page read and write
A18F000
heap
page read and write
564000
heap
page read and write
308E000
unclassified section
page read and write
2A61000
heap
page read and write
A080000
heap
page read and write
A01F000
stack
page read and write
A065000
heap
page read and write
564000
heap
page read and write
2B60000
trusted library allocation
page read and write
2A61000
heap
page read and write
There are 227 hidden memdumps, click here to show them.