Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_d6eca444034557dbadee3a9b8c12d3885e1caed_6983241a_16bd15ca-eeb6-4121-8ba8-a24a92496132\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\IJECAEHJJJKJKFIDGCBGIJJJEH
|
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8,
version-valid-for 4
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CDF.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sun Sep 1 18:54:59 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E47.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E87.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 1600
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://185.215.113.100/e2b1563c6670f193.phpUser
|
unknown
|
|
|
|
http://185.215.113.100/e2b1563c6670f193.php
|
185.215.113.100
|
|
|
|
http://185.215.113.1000d60be0de163924d/sqlite3.dllY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZG
|
unknown
|
|
|
|
http://185.215.113.100/0d60be0de163924d/sqlite3.dll
|
185.215.113.100
|
|
|
|
http://185.215.113.100/e2b1563c6670f193.phpion:
|
unknown
|
|
|
|
http://185.215.113.100
|
unknown
|
|
|
|
http://185.215.113.100/0d60be0de163924d/sqlite3.dllq
|
unknown
|
|
|
|
http://185.215.113.100/e2b1563c6670f193.phpWm
|
unknown
|
|
|
|
http://185.215.113.100/e2b1563c6670f193.phpZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZ
|
unknown
|
|
|
|
http://185.215.113.100/e2b1563c6670f193.phpx
|
unknown
|
|
|
|
http://185.215.113.100/e2b1563c6670f193.phpinit.exe
|
unknown
|
|
|
|
http://185.215.113.100GIJ
|
unknown
|
|
|
|
http://185.215.113.100:
|
unknown
|
|
|
|
http://185.215.113.100/
|
185.215.113.100
|
|
|
|
http://185.215.113.100s.exe
|
unknown
|
|
|
|
http://185.215.113.100/e2b1563c6670f193.php7mH
|
unknown
|
|
|
|
http://185.215.113.100/0d60be0de163924d/sqlite3.dllc
|
unknown
|
|
|
|
http://upx.sf.net
|
unknown
|
||
|
http://www.sqlite.org/copyright.html.
|
unknown
|
There are 9 hidden URLs, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
185.215.113.100
|
unknown
|
Portugal
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
ProgramId
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
FileId
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
LowerCaseLongPath
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
LongPathHash
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Name
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
OriginalFileName
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Publisher
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Version
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
BinFileVersion
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
BinaryType
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
ProductName
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
ProductVersion
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
LinkDate
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
BinProductVersion
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
AppxPackageFullName
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
AppxPackageRelativeId
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Size
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Language
|
|
|
|
\REGISTRY\A\{df3247ab-d77f-6d22-8e35-e26e2549d3a2}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Usn
|
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
38A000
|
unkown
|
page execute and read and write
|
|
|
|
119E000
|
heap
|
page read and write
|
|
|
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
1D2FF000
|
stack
|
page read and write
|
||
|
41D000
|
unkown
|
page execute and read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
7BD000
|
unkown
|
page execute and read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4FE0000
|
direct allocation
|
page read and write
|
||
|
4B70000
|
heap
|
page read and write
|
||
|
1D72E000
|
stack
|
page read and write
|
||
|
560000
|
unkown
|
page execute and read and write
|
||
|
61E00000
|
direct allocation
|
page execute and read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
DB0000
|
heap
|
page read and write
|
||
|
7F7000
|
unkown
|
page execute and write copy
|
||
|
3B1E000
|
stack
|
page read and write
|
||
|
3F1000
|
unkown
|
page execute and read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
2ED7000
|
heap
|
page read and write
|
||
|
1D62E000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
61ECD000
|
direct allocation
|
page execute and read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
D4C000
|
stack
|
page read and write
|
||
|
30DF000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
98B000
|
unkown
|
page execute and read and write
|
||
|
3BF000
|
unkown
|
page execute and read and write
|
||
|
13B6000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B60000
|
heap
|
page read and write
|
||
|
1D48E000
|
stack
|
page read and write
|
||
|
4B1F000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
511F000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
311E000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
5160000
|
direct allocation
|
page execute and read and write
|
||
|
1190000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
2ECE000
|
stack
|
page read and write
|
||
|
4A1E000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
43DE000
|
stack
|
page read and write
|
||
|
3B3000
|
unkown
|
page execute and read and write
|
||
|
4FE0000
|
direct allocation
|
page read and write
|
||
|
6E5000
|
unkown
|
page execute and read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
10FD000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
7F6000
|
unkown
|
page execute and write copy
|
||
|
12D0000
|
heap
|
page read and write
|
||
|
3ADF000
|
stack
|
page read and write
|
||
|
3D5F000
|
stack
|
page read and write
|
||
|
145B000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
1D730000
|
heap
|
page read and write
|
||
|
335F000
|
stack
|
page read and write
|
||
|
321F000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
501B000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
439F000
|
stack
|
page read and write
|
||
|
1D34D000
|
stack
|
page read and write
|
||
|
389E000
|
stack
|
page read and write
|
||
|
385F000
|
stack
|
page read and write
|
||
|
1D736000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
48DE000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
2E8C000
|
stack
|
page read and write
|
||
|
321000
|
unkown
|
page execute and read and write
|
||
|
1D09E000
|
stack
|
page read and write
|
||
|
320000
|
unkown
|
page readonly
|
||
|
10F5000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
49DF000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
61ED3000
|
direct allocation
|
page execute and read and write
|
||
|
35C000
|
unkown
|
page execute and read and write
|
||
|
12CE000
|
stack
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
3C1F000
|
stack
|
page read and write
|
||
|
349F000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
98C000
|
unkown
|
page execute and write copy
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
411000
|
unkown
|
page execute and read and write
|
||
|
2ED0000
|
heap
|
page read and write
|
||
|
3E9F000
|
stack
|
page read and write
|
||
|
3C5E000
|
stack
|
page read and write
|
||
|
320000
|
unkown
|
page read and write
|
||
|
238CF000
|
stack
|
page read and write
|
||
|
2FDF000
|
stack
|
page read and write
|
||
|
411F000
|
stack
|
page read and write
|
||
|
5150000
|
direct allocation
|
page execute and read and write
|
||
|
1227000
|
heap
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
479E000
|
stack
|
page read and write
|
||
|
4C7000
|
unkown
|
page execute and read and write
|
||
|
34DE000
|
stack
|
page read and write
|
||
|
1D58C000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B20000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
361E000
|
stack
|
page read and write
|
||
|
371F000
|
stack
|
page read and write
|
||
|
489F000
|
stack
|
page read and write
|
||
|
11F6000
|
heap
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
44DF000
|
stack
|
page read and write
|
||
|
7F6000
|
unkown
|
page execute and read and write
|
||
|
4CD000
|
unkown
|
page execute and read and write
|
||
|
DA0000
|
heap
|
page read and write
|
||
|
54C000
|
unkown
|
page execute and read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
415E000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4FE0000
|
direct allocation
|
page read and write
|
||
|
3EDE000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
11E1000
|
heap
|
page read and write
|
||
|
321000
|
unkown
|
page execute and write copy
|
||
|
475F000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
1D853000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
39DE000
|
stack
|
page read and write
|
||
|
4B50000
|
heap
|
page read and write
|
||
|
461F000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
1D44D000
|
stack
|
page read and write
|
||
|
4A7000
|
unkown
|
page execute and read and write
|
||
|
4C50000
|
trusted library allocation
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
3E4000
|
unkown
|
page execute and read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
1CF5E000
|
stack
|
page read and write
|
||
|
2E4F000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
113E000
|
stack
|
page read and write
|
||
|
119A000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
325E000
|
stack
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
465E000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
5160000
|
direct allocation
|
page execute and read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
375E000
|
stack
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
2EDB000
|
heap
|
page read and write
|
||
|
339E000
|
stack
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
1D19F000
|
stack
|
page read and write
|
||
|
3D9E000
|
stack
|
page read and write
|
||
|
7DF000
|
unkown
|
page execute and read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
401E000
|
stack
|
page read and write
|
||
|
451E000
|
stack
|
page read and write
|
||
|
399F000
|
stack
|
page read and write
|
||
|
425E000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
5170000
|
direct allocation
|
page execute and read and write
|
||
|
1CF1F000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
1180000
|
heap
|
page read and write
|
||
|
1D850000
|
trusted library allocation
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
1D05F000
|
stack
|
page read and write
|
||
|
5180000
|
direct allocation
|
page execute and read and write
|
||
|
3FDF000
|
stack
|
page read and write
|
||
|
4B65000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
12D5000
|
heap
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
1212000
|
heap
|
page read and write
|
||
|
1D1FE000
|
stack
|
page read and write
|
||
|
7E7000
|
unkown
|
page execute and read and write
|
||
|
429E000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
35DF000
|
stack
|
page read and write
|
||
|
516E000
|
stack
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
5130000
|
direct allocation
|
page execute and read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
4B51000
|
heap
|
page read and write
|
||
|
11E3000
|
heap
|
page read and write
|
There are 209 hidden memdumps, click here to show them.