Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
5XpKRbh2k7.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5XpKRbh2k7.exe_7c951b3511dd73c28dc917ef5d2d801ea4772771_6d508433_2edd89ab-d19c-4cd5-9845-e9eb5b195e2d\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F60.tmp.dmp
|
Mini DuMP crash report, 16 streams, Tue Oct 29 05:43:09 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER301C.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER304C.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\5XpKRbh2k7.exe
|
"C:\Users\user\Desktop\5XpKRbh2k7.exe"
|
|
|
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 7096 -s 760
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://upx.sf.net
|
unknown
|
||
|
http://corppki/crl/msintcrca.crl
|
unknown
|
||
|
http://www.asp.net/
|
unknown
|
||
|
http://corppki/aia/MSIT%20CA%20Z1(2).crt0E
|
unknown
|
||
|
http://corppki/crl/MSIT%20CA%20Z1(2).crl
|
unknown
|
||
|
https://support.office.com/oReplacing
|
unknown
|
||
|
http://corppki/aia/msintcrca.crt0=
|
unknown
|
||
|
http://sqlite.org/rescode.html
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
ProgramId
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
FileId
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
LongPathHash
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
Name
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
OriginalFileName
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
Publisher
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
Version
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
BinFileVersion
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
BinaryType
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
ProductName
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
ProductVersion
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
LinkDate
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
BinProductVersion
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
Size
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
Language
|
||
|
\REGISTRY\A\{792e7c9e-4aea-0431-9171-01abbd0bc15b}\Root\InventoryApplicationFile\5xpkrbh2k7.exe|ebb503534b781a60
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1EE037FA000
|
heap
|
page read and write
|
||
|
1EE037E8000
|
heap
|
page read and write
|
||
|
2D512FE000
|
stack
|
page read and write
|
||
|
1EE155B3000
|
trusted library allocation
|
page read and write
|
||
|
2D515FF000
|
stack
|
page read and write
|
||
|
1EE0358C000
|
unkown
|
page readonly
|
||
|
1EE03780000
|
heap
|
page read and write
|
||
|
1EE03462000
|
unkown
|
page readonly
|
||
|
2D519FF000
|
stack
|
page read and write
|
||
|
1EE03589000
|
unkown
|
page readonly
|
||
|
7FFD9B8F0000
|
trusted library allocation
|
page read and write
|
||
|
1EE037FC000
|
heap
|
page read and write
|
||
|
1EE037FE000
|
heap
|
page read and write
|
||
|
1EE03B75000
|
heap
|
page read and write
|
||
|
1EE035EB000
|
unkown
|
page readonly
|
||
|
1EE039B0000
|
heap
|
page read and write
|
||
|
1EE03AA0000
|
heap
|
page execute and read and write
|
||
|
1EE03460000
|
unkown
|
page readonly
|
||
|
1EE055A0000
|
heap
|
page execute and read and write
|
||
|
1EE03B15000
|
heap
|
page read and write
|
||
|
7FFD9B9C6000
|
trusted library allocation
|
page execute and read and write
|
||
|
1EE03829000
|
heap
|
page read and write
|
||
|
7FFD9B8ED000
|
trusted library allocation
|
page execute and read and write
|
||
|
1EE037C0000
|
heap
|
page read and write
|
||
|
1EE03A10000
|
trusted library allocation
|
page read and write
|
||
|
1EE03B70000
|
heap
|
page read and write
|
||
|
7FFD9B8E4000
|
trusted library allocation
|
page read and write
|
||
|
1EE03790000
|
heap
|
page read and write
|
||
|
1EE037F0000
|
heap
|
page read and write
|
||
|
1EE03990000
|
heap
|
page read and write
|
||
|
7FFD9B8E3000
|
trusted library allocation
|
page execute and read and write
|
||
|
1EE036E7000
|
unkown
|
page readonly
|
||
|
7FFD9BA00000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B9A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1EE055B1000
|
trusted library allocation
|
page read and write
|
||
|
2D50FE0000
|
stack
|
page read and write
|
||
|
2D516FD000
|
stack
|
page read and write
|
||
|
1EE03B10000
|
heap
|
page read and write
|
||
|
1EE155B1000
|
trusted library allocation
|
page read and write
|
||
|
2D513FE000
|
stack
|
page read and write
|
||
|
1EE03460000
|
unkown
|
page readonly
|
||
|
1EE1DE30000
|
heap
|
page read and write
|
||
|
2D517FE000
|
stack
|
page read and write
|
||
|
1EE0365F000
|
unkown
|
page readonly
|
||
|
1EE03840000
|
heap
|
page read and write
|
||
|
1EE03869000
|
heap
|
page read and write
|
||
|
1EE039F0000
|
trusted library allocation
|
page read and write
|
||
|
7FF475100000
|
trusted library allocation
|
page execute and read and write
|
||
|
2D518FE000
|
stack
|
page read and write
|
||
|
2D514FF000
|
stack
|
page read and write
|
||
|
1EE0385A000
|
heap
|
page read and write
|
||
|
1EE05440000
|
heap
|
page read and write
|
||
|
1EE037DB000
|
heap
|
page read and write
|
||
|
1EE037C9000
|
heap
|
page read and write
|
||
|
7FFD9B990000
|
trusted library allocation
|
page read and write
|
There are 45 hidden memdumps, click here to show them.