Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Consignment Notification-#U00a0 705643291003.exe
|
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Z41QITVYKG3MWRU2_fff8e7713b237785d6d2e96798ea6c3bdf278cf_edc92401_74992dc1-8f4a-4215-8275-04b399b7db1e\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER399D.tmp.dmp
|
Mini DuMP crash report, 16 streams, Thu Jul 4 18:54:54 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AD6.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B06.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Consignment Notification-#U00a0 705643291003.exe
|
"C:\Users\user\Desktop\Consignment Notification-#U00a0 705643291003.exe"
|
|
|
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 6512 -s 1104
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.apache.org/licenses/LICENSE-2.0
|
unknown
|
||
|
http://www.fontbureau.com
|
unknown
|
||
|
http://www.fontbureau.com/designersG
|
unknown
|
||
|
http://www.fontbureau.com/designers/?
|
unknown
|
||
|
http://www.founder.com.cn/cn/bThe
|
unknown
|
||
|
http://www.fontbureau.com/designers?
|
unknown
|
||
|
http://www.tiro.com
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://tempuri.org/AukcionDBDataSet.xsd
|
unknown
|
||
|
http://www.fontbureau.com/designers
|
unknown
|
||
|
http://www.goodfont.co.kr
|
unknown
|
||
|
http://www.carterandcone.coml
|
unknown
|
||
|
http://www.sajatypeworks.com
|
unknown
|
||
|
http://www.typography.netD
|
unknown
|
||
|
http://www.fontbureau.com/designers/cabarga.htmlN
|
unknown
|
||
|
http://www.founder.com.cn/cn/cThe
|
unknown
|
||
|
http://www.galapagosdesign.com/staff/dennis.htm
|
unknown
|
||
|
http://www.founder.com.cn/cn
|
unknown
|
||
|
http://www.fontbureau.com/designers/frere-user.html
|
unknown
|
||
|
http://www.jiyu-kobo.co.jp/
|
unknown
|
||
|
http://www.galapagosdesign.com/DPlease
|
unknown
|
||
|
http://www.fontbureau.com/designers8
|
unknown
|
||
|
http://www.fonts.com
|
unknown
|
||
|
http://www.sandoll.co.kr
|
unknown
|
||
|
http://www.urwpp.deDPlease
|
unknown
|
||
|
http://www.zhongyicts.com.cn
|
unknown
|
||
|
http://www.sakkal.com
|
unknown
|
There are 17 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
ProgramId
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
FileId
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
LongPathHash
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
Name
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
OriginalFileName
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
Publisher
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
Version
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
BinFileVersion
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
BinaryType
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
ProductName
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
ProductVersion
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
LinkDate
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
BinProductVersion
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
Size
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
Language
|
||
|
\REGISTRY\A\{c6dcb676-0b5c-e144-8d5a-78f912f6d2f1}\Root\InventoryApplicationFile\consignment noti|edbe28c662109bb9
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
119C000
|
heap
|
page read and write
|
||
|
1F11E000
|
stack
|
page read and write
|
||
|
1150000
|
trusted library allocation
|
page read and write
|
||
|
3D6E000
|
stack
|
page read and write
|
||
|
7FFD9B79B000
|
trusted library allocation
|
page execute and read and write
|
||
|
1F51E000
|
stack
|
page read and write
|
||
|
1170000
|
heap
|
page read and write
|
||
|
1F600000
|
heap
|
page read and write
|
||
|
3D71000
|
trusted library allocation
|
page read and write
|
||
|
1F61D000
|
heap
|
page read and write
|
||
|
1C4ED000
|
stack
|
page read and write
|
||
|
1CB15000
|
heap
|
page read and write
|
||
|
203E000
|
stack
|
page read and write
|
||
|
7FFD9B794000
|
trusted library allocation
|
page read and write
|
||
|
3960000
|
heap
|
page read and write
|
||
|
7FFD9B774000
|
trusted library allocation
|
page read and write
|
||
|
13D73000
|
trusted library allocation
|
page read and write
|
||
|
1283000
|
trusted library allocation
|
page read and write
|
||
|
FF3000
|
stack
|
page read and write
|
||
|
10D0000
|
heap
|
page read and write
|
||
|
1DF20000
|
trusted library allocation
|
page read and write
|
||
|
11DD000
|
heap
|
page read and write
|
||
|
9E0000
|
heap
|
page read and write
|
||
|
14012000
|
trusted library allocation
|
page read and write
|
||
|
13D78000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B77D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C3E000
|
stack
|
page read and write
|
||
|
1E4E0000
|
heap
|
page read and write
|
||
|
7FFD9B783000
|
trusted library allocation
|
page read and write
|
||
|
1270000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B82C000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B78D000
|
trusted library allocation
|
page execute and read and write
|
||
|
3969000
|
heap
|
page read and write
|
||
|
7FFD9B770000
|
trusted library allocation
|
page read and write
|
||
|
13A0000
|
heap
|
page read and write
|
||
|
11E7000
|
heap
|
page read and write
|
||
|
12D0000
|
heap
|
page read and write
|
||
|
13A5000
|
heap
|
page read and write
|
||
|
7FFD9B790000
|
trusted library allocation
|
page read and write
|
||
|
1350000
|
heap
|
page read and write
|
||
|
1ED1E000
|
stack
|
page read and write
|
||
|
7FFD9B7CC000
|
trusted library allocation
|
page execute and read and write
|
||
|
1280000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B820000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B970000
|
trusted library allocation
|
page read and write
|
||
|
7FF4813E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
812000
|
unkown
|
page readonly
|
||
|
1300000
|
trusted library section
|
page readonly
|
||
|
1E331000
|
heap
|
page read and write
|
||
|
1430000
|
heap
|
page read and write
|
||
|
1E320000
|
heap
|
page read and write
|
||
|
11B4000
|
heap
|
page read and write
|
||
|
7FFD9B950000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B920000
|
trusted library allocation
|
page read and write
|
||
|
1F614000
|
heap
|
page read and write
|
||
|
7FFD9B960000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B773000
|
trusted library allocation
|
page execute and read and write
|
||
|
1310000
|
heap
|
page read and write
|
||
|
1435000
|
heap
|
page read and write
|
||
|
7FFD9B97A000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B890000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B856000
|
trusted library allocation
|
page execute and read and write
|
||
|
1CF1D000
|
stack
|
page read and write
|
||
|
7FFD9B79D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B930000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B940000
|
trusted library allocation
|
page execute and read and write
|
||
|
810000
|
unkown
|
page readonly
|
||
|
13D81000
|
trusted library allocation
|
page read and write
|
||
|
1110000
|
heap
|
page read and write
|
||
|
183E000
|
stack
|
page read and write
|
||
|
1340000
|
heap
|
page execute and read and write
|
||
|
3DE1000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B980000
|
trusted library allocation
|
page read and write
|
||
|
1CA1B000
|
heap
|
page read and write
|
||
|
1266000
|
heap
|
page read and write
|
||
|
1C970000
|
heap
|
page read and write
|
||
|
1C9F0000
|
heap
|
page read and write
|
||
|
1370000
|
heap
|
page execute and read and write
|
||
|
117C000
|
heap
|
page read and write
|
||
|
10F0000
|
heap
|
page read and write
|
||
|
1DF42000
|
trusted library allocation
|
page read and write
|
||
|
1E420000
|
trusted library section
|
page read and write
|
||
|
7FFD9B830000
|
trusted library allocation
|
page execute and read and write
|
||
|
1CA2C000
|
heap
|
page read and write
|
||
|
7FFD9B910000
|
trusted library allocation
|
page read and write
|
||
|
1CA00000
|
heap
|
page read and write
|
||
|
13D71000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B826000
|
trusted library allocation
|
page read and write
|
||
|
1C9E0000
|
heap
|
page read and write
|
||
|
11B1000
|
heap
|
page read and write
|
||
|
1C9E3000
|
heap
|
page read and write
|
||
|
1CB10000
|
heap
|
page read and write
|
||
|
1CA16000
|
heap
|
page read and write
|
There are 83 hidden memdumps, click here to show them.