Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
q8C81ARGsr.exe
|
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
|
initial sample
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_q8C81ARGsr.exe_3ab94627e8482ec74ffbb8b095d5176e8982469e_e876f5bf_c9fd09fe-b55b-4e87-8480-8e78fcd81c63\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER239D.tmp.dmp
|
Mini DuMP crash report, 16 streams, Mon Dec 23 07:03:04 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2459.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER24C8.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\q8C81ARGsr.exe
|
"C:\Users\user\Desktop\q8C81ARGsr.exe"
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 1988 -s 768
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://upx.sf.net
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
ProgramId
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
FileId
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
LongPathHash
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
Name
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
OriginalFileName
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
Publisher
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
Version
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
BinFileVersion
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
BinaryType
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
ProductName
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
ProductVersion
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
LinkDate
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
BinProductVersion
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
Size
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
Language
|
||
|
\REGISTRY\A\{bf19013b-af8b-dbde-9609-92129c5fe7be}\Root\InventoryApplicationFile\q8c81argsr.exe|7ed6c8d5cf7359c5
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1C24DBD6000
|
heap
|
page read and write
|
||
|
1C24DC55000
|
heap
|
page read and write
|
||
|
1C24DC10000
|
heap
|
page read and write
|
||
|
1C24D9C0000
|
unkown
|
page readonly
|
||
|
1C24DC07000
|
heap
|
page read and write
|
||
|
1C24D9B9000
|
unkown
|
page readonly
|
||
|
1C24DBC0000
|
trusted library allocation
|
page read and write
|
||
|
1C24DBD0000
|
heap
|
page read and write
|
||
|
1C24DA50000
|
heap
|
page read and write
|
||
|
1C24D950000
|
unkown
|
page readonly
|
||
|
1C24DDA0000
|
heap
|
page read and write
|
||
|
7FF848EE6000
|
trusted library allocation
|
page execute and read and write
|
||
|
43193FE000
|
stack
|
page read and write
|
||
|
1C24DB70000
|
heap
|
page read and write
|
||
|
1C24DC7B000
|
heap
|
page read and write
|
||
|
7FF848E12000
|
trusted library allocation
|
page read and write
|
||
|
1C24DD50000
|
heap
|
page read and write
|
||
|
1C24D99D000
|
unkown
|
page readonly
|
||
|
1C24D952000
|
unkown
|
page readonly
|
||
|
1C24DC42000
|
heap
|
page read and write
|
||
|
1C24DCE0000
|
trusted library allocation
|
page read and write
|
||
|
7FF848F20000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FF455280000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C24DC13000
|
heap
|
page read and write
|
||
|
4318BFE000
|
stack
|
page read and write
|
||
|
7FF848E04000
|
trusted library allocation
|
page read and write
|
||
|
1C24DDA5000
|
heap
|
page read and write
|
||
|
43187ED000
|
stack
|
page read and write
|
||
|
1C25F735000
|
trusted library allocation
|
page read and write
|
||
|
1C24DE50000
|
heap
|
page read and write
|
||
|
1C25F731000
|
trusted library allocation
|
page read and write
|
||
|
4319BFD000
|
stack
|
page read and write
|
||
|
7FF848EC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C24DBFB000
|
heap
|
page read and write
|
||
|
1C24DC3E000
|
heap
|
page read and write
|
||
|
7FF848EB0000
|
trusted library allocation
|
page read and write
|
||
|
1C24DB30000
|
heap
|
page read and write
|
||
|
7FF848E0D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FF848E14000
|
trusted library allocation
|
page read and write
|
||
|
1C24DBDC000
|
heap
|
page read and write
|
||
|
1C24F731000
|
trusted library allocation
|
page read and write
|
||
|
1C24DB50000
|
heap
|
page read and write
|
||
|
1C24F720000
|
heap
|
page execute and read and write
|
||
|
43197FE000
|
stack
|
page read and write
|
||
|
1C24DC05000
|
heap
|
page read and write
|
||
|
1C267EA0000
|
heap
|
page read and write
|
||
|
4318FFE000
|
stack
|
page read and write
|
||
|
7FF848FA0000
|
trusted library allocation
|
page read and write
|
||
|
1C25F733000
|
trusted library allocation
|
page read and write
|
There are 39 hidden memdumps, click here to show them.