Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
0eVxwphG1t.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_0eVxwphG1t.exe_95a65930a35ae566542ba72920c749d8fab6edd_085328c0_0326773b-bcb6-43e9-8356-2e517094e74f\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\WindowsUpdate.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC6DF.tmp.dmp
|
Mini DuMP crash report, 16 streams, Thu Oct 31 19:01:10 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC867.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC897.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Oct 31 17:57:58
2024, mtime=Thu Oct 31 17:57:58 2024, atime=Thu Oct 31 17:57:58 2024, length=57856, window=hide
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\0eVxwphG1t.exe
|
"C:\Users\user\Desktop\0eVxwphG1t.exe"
|
|
|
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 3552 -s 1836
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
join-ez.gl.at.ply.gg
|
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
join-ez.gl.at.ply.gg
|
147.185.221.23
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
147.185.221.23
|
join-ez.gl.at.ply.gg
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
ProgramId
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
FileId
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
LongPathHash
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
Name
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
OriginalFileName
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
Publisher
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
Version
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
BinFileVersion
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
BinaryType
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
ProductName
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
ProductVersion
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
LinkDate
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
BinProductVersion
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
Size
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
Language
|
||
|
\REGISTRY\A\{6eaaad6f-a808-9dce-4213-e7a87515d220}\Root\InventoryApplicationFile\0evxwphg1t.exe|4eb9d437e129952f
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
622000
|
unkown
|
page readonly
|
|
|
|
1B7B0000
|
heap
|
page read and write
|
||
|
1BBD4000
|
stack
|
page read and write
|
||
|
A63000
|
heap
|
page read and write
|
||
|
7FFD34660000
|
trusted library allocation
|
page read and write
|
||
|
620000
|
unkown
|
page readonly
|
||
|
1BF5C000
|
stack
|
page read and write
|
||
|
7FFD3467D000
|
trusted library allocation
|
page execute and read and write
|
||
|
D70000
|
trusted library allocation
|
page read and write
|
||
|
ECE000
|
stack
|
page read and write
|
||
|
2921000
|
trusted library allocation
|
page read and write
|
||
|
7FF4A6980000
|
trusted library allocation
|
page execute and read and write
|
||
|
28E0000
|
heap
|
page read and write
|
||
|
DC0000
|
heap
|
page read and write
|
||
|
AA2000
|
heap
|
page read and write
|
||
|
A30000
|
heap
|
page read and write
|
||
|
1C15A000
|
stack
|
page read and write
|
||
|
1ACAE000
|
heap
|
page read and write
|
||
|
1B73B000
|
heap
|
page read and write
|
||
|
7C0000
|
heap
|
page read and write
|
||
|
D40000
|
heap
|
page read and write
|
||
|
DA0000
|
heap
|
page execute and read and write
|
||
|
2910000
|
heap
|
page read and write
|
||
|
CFE000
|
stack
|
page read and write
|
||
|
FCE000
|
stack
|
page read and write
|
||
|
7FFD34700000
|
trusted library allocation
|
page read and write
|
||
|
2D8D000
|
trusted library allocation
|
page read and write
|
||
|
7D0000
|
heap
|
page read and write
|
||
|
12921000
|
trusted library allocation
|
page read and write
|
||
|
2EB1000
|
trusted library allocation
|
page read and write
|
||
|
1B4DE000
|
stack
|
page read and write
|
||
|
A5C000
|
heap
|
page read and write
|
||
|
1B79D000
|
heap
|
page read and write
|
||
|
7FFD34674000
|
trusted library allocation
|
page read and write
|
||
|
A00000
|
heap
|
page read and write
|
||
|
7FFD34800000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34710000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34670000
|
trusted library allocation
|
page read and write
|
||
|
1B390000
|
heap
|
page execute and read and write
|
||
|
A36000
|
heap
|
page read and write
|
||
|
7FFD346AC000
|
trusted library allocation
|
page execute and read and write
|
||
|
AF9000
|
heap
|
page read and write
|
||
|
1C35A000
|
stack
|
page read and write
|
||
|
286E000
|
stack
|
page read and write
|
||
|
1B718000
|
heap
|
page read and write
|
||
|
1B785000
|
heap
|
page read and write
|
||
|
7FFD34654000
|
trusted library allocation
|
page read and write
|
||
|
7FFD3466D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B3D3000
|
heap
|
page read and write
|
||
|
7FFD34650000
|
trusted library allocation
|
page read and write
|
||
|
1B799000
|
heap
|
page read and write
|
||
|
1B3D0000
|
heap
|
page read and write
|
||
|
D00000
|
heap
|
page read and write
|
||
|
1BAD9000
|
stack
|
page read and write
|
||
|
D30000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34736000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34663000
|
trusted library allocation
|
page read and write
|
||
|
D45000
|
heap
|
page read and write
|
||
|
7FFD347F2000
|
trusted library allocation
|
page read and write
|
||
|
A75000
|
heap
|
page read and write
|
||
|
D60000
|
trusted library allocation
|
page read and write
|
||
|
A72000
|
heap
|
page read and write
|
||
|
7FFD34770000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34706000
|
trusted library allocation
|
page read and write
|
||
|
D73000
|
trusted library allocation
|
page read and write
|
||
|
DC5000
|
heap
|
page read and write
|
||
|
1BC1F000
|
stack
|
page read and write
|
||
|
1B74F000
|
heap
|
page read and write
|
||
|
12928000
|
trusted library allocation
|
page read and write
|
||
|
620000
|
unkown
|
page readonly
|
||
|
1AEAD000
|
stack
|
page read and write
|
||
|
2969000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34653000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C25C000
|
stack
|
page read and write
|
||
|
7FFD3470C000
|
trusted library allocation
|
page execute and read and write
|
||
|
AA7000
|
heap
|
page read and write
|
||
|
1BC60000
|
heap
|
page read and write
|
||
|
1B38F000
|
stack
|
page read and write
|
||
|
7FFD3465D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B6E0000
|
heap
|
page read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
A3C000
|
heap
|
page read and write
|
||
|
774000
|
stack
|
page read and write
|
||
|
1B6DE000
|
stack
|
page read and write
|
There are 74 hidden memdumps, click here to show them.