Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
rPROFORMAINVOICE-PO_ATS_1036.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\rPROFORMAINVOICE-PO_ATS_1036.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_msbuild.exe_c0d52432dfe3ceb750b4c6e7cd4c95a2e207481_11e7f0f4_f83a3f6a-ba45-452e-b37a-b98497531510\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER24F5.tmp.dmp
|
Mini DuMP crash report, 15 streams, Wed Sep 25 12:27:39 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER27E4.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2833.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\rPROFORMAINVOICE-PO_ATS_1036.exe
|
"C:\Users\user\Desktop\rPROFORMAINVOICE-PO_ATS_1036.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 1588
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
67.215.224.133
|
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
fp2e7a.wpc.phicdn.net
|
192.229.221.95
|
||
|
198.187.3.20.in-addr.arpa
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
67.215.224.133
|
unknown
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
ProgramId
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
FileId
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
LongPathHash
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
Name
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
OriginalFileName
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
Publisher
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
Version
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
BinFileVersion
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
BinaryType
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
ProductName
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
ProductVersion
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
LinkDate
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
BinProductVersion
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
Size
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
Language
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
IsOsComponent
|
||
|
\REGISTRY\A\{2aa0b950-49e9-9107-602a-5aebb984b09d}\Root\InventoryApplicationFile\msbuild.exe|94596b7cc5f070ff
|
Usn
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
There are 12 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2544BC00000
|
direct allocation
|
page read and write
|
|
|
|
402000
|
remote allocation
|
page execute and read and write
|
|
|
|
2544E000000
|
direct allocation
|
page read and write
|
|
|
|
2B51000
|
trusted library allocation
|
page read and write
|
|
|
|
67EC000
|
stack
|
page read and write
|
||
|
FFC80000
|
trusted library allocation
|
page execute and read and write
|
||
|
62D0000
|
heap
|
page read and write
|
||
|
294DF9D1000
|
heap
|
page read and write
|
||
|
294DF9C0000
|
heap
|
page read and write
|
||
|
540A000
|
stack
|
page read and write
|
||
|
EA6000
|
trusted library allocation
|
page execute and read and write
|
||
|
EA0000
|
trusted library allocation
|
page read and write
|
||
|
5300000
|
heap
|
page execute and read and write
|
||
|
FC7000
|
trusted library allocation
|
page execute and read and write
|
||
|
25447AD0000
|
heap
|
page read and write
|
||
|
2B4F000
|
stack
|
page read and write
|
||
|
EAA000
|
trusted library allocation
|
page execute and read and write
|
||
|
294DF9F2000
|
heap
|
page read and write
|
||
|
FCB000
|
trusted library allocation
|
page execute and read and write
|
||
|
294DDE30000
|
heap
|
page read and write
|
||
|
294DFA11000
|
heap
|
page read and write
|
||
|
294DF9C6000
|
heap
|
page read and write
|
||
|
25447ACB000
|
heap
|
page read and write
|
||
|
294DFA36000
|
heap
|
page read and write
|
||
|
294DF9F2000
|
heap
|
page read and write
|
||
|
2544EA00000
|
direct allocation
|
page read and write
|
||
|
EB0000
|
heap
|
page read and write
|
||
|
294DF9F0000
|
heap
|
page read and write
|
||
|
25447AD2000
|
heap
|
page read and write
|
||
|
10E5000
|
heap
|
page read and write
|
||
|
2B88000
|
trusted library allocation
|
page read and write
|
||
|
1170000
|
heap
|
page read and write
|
||
|
990000
|
heap
|
page read and write
|
||
|
294DFA36000
|
heap
|
page read and write
|
||
|
294DF9F0000
|
heap
|
page read and write
|
||
|
558E000
|
stack
|
page read and write
|
||
|
E90000
|
trusted library allocation
|
page read and write
|
||
|
2B8A000
|
trusted library allocation
|
page read and write
|
||
|
294DF9F2000
|
heap
|
page read and write
|
||
|
1121000
|
heap
|
page read and write
|
||
|
52F0000
|
trusted library allocation
|
page read and write
|
||
|
68F0000
|
heap
|
page read and write
|
||
|
25447B39000
|
heap
|
page read and write
|
||
|
B6348FE000
|
stack
|
page read and write
|
||
|
254479F0000
|
heap
|
page read and write
|
||
|
294DF9D2000
|
heap
|
page read and write
|
||
|
9F0000
|
heap
|
page read and write
|
||
|
2945D32F000
|
direct allocation
|
page read and write
|
||
|
1167000
|
heap
|
page read and write
|
||
|
294DF9DF000
|
heap
|
page read and write
|
||
|
7FF78BAD1000
|
unkown
|
page read and write
|
||
|
7FF78BADF000
|
unkown
|
page readonly
|
||
|
EB5000
|
heap
|
page read and write
|
||
|
254479D0000
|
heap
|
page read and write
|
||
|
25447A10000
|
heap
|
page read and write
|
||
|
294DF9C0000
|
heap
|
page read and write
|
||
|
B6346F9000
|
stack
|
page read and write
|
||
|
294DDF1E000
|
heap
|
page read and write
|
||
|
B6349FE000
|
stack
|
page read and write
|
||
|
E30000
|
heap
|
page read and write
|
||
|
10DA000
|
heap
|
page read and write
|
||
|
294DFA33000
|
heap
|
page read and write
|
||
|
106E000
|
stack
|
page read and write
|
||
|
2BB2000
|
trusted library allocation
|
page read and write
|
||
|
294DF9C0000
|
heap
|
page read and write
|
||
|
656C000
|
stack
|
page read and write
|
||
|
5690000
|
heap
|
page read and write
|
||
|
2D67000
|
trusted library allocation
|
page read and write
|
||
|
25447AC3000
|
heap
|
page read and write
|
||
|
E20000
|
heap
|
page read and write
|
||
|
294DFA35000
|
heap
|
page read and write
|
||
|
294DF955000
|
heap
|
page read and write
|
||
|
25447A15000
|
heap
|
page read and write
|
||
|
112D000
|
heap
|
page read and write
|
||
|
64AE000
|
stack
|
page read and write
|
||
|
12AE000
|
stack
|
page read and write
|
||
|
E70000
|
trusted library allocation
|
page read and write
|
||
|
25447AFE000
|
heap
|
page read and write
|
||
|
52E0000
|
trusted library allocation
|
page read and write
|
||
|
294DF9C6000
|
heap
|
page read and write
|
||
|
294DFA33000
|
heap
|
page read and write
|
||
|
294DDF1C000
|
heap
|
page read and write
|
||
|
294DFA33000
|
heap
|
page read and write
|
||
|
E93000
|
trusted library allocation
|
page read and write
|
||
|
62C0000
|
heap
|
page read and write
|
||
|
7FF78B951000
|
unkown
|
page execute read
|
||
|
2D6E000
|
trusted library allocation
|
page read and write
|
||
|
51BC000
|
stack
|
page read and write
|
||
|
294DF9D2000
|
heap
|
page read and write
|
||
|
51C3000
|
heap
|
page read and write
|
||
|
50CC000
|
stack
|
page read and write
|
||
|
10AC000
|
stack
|
page read and write
|
||
|
7FF78BAD1000
|
unkown
|
page write copy
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
1010000
|
heap
|
page execute and read and write
|
||
|
E28000
|
heap
|
page read and write
|
||
|
254478F0000
|
heap
|
page read and write
|
||
|
294DF9D1000
|
heap
|
page read and write
|
||
|
7FF78B951000
|
unkown
|
page execute read
|
||
|
25447A6C000
|
heap
|
page read and write
|
||
|
7FF78BA6A000
|
unkown
|
page readonly
|
||
|
25449400000
|
direct allocation
|
page read and write
|
||
|
25447AC0000
|
heap
|
page read and write
|
||
|
64EE000
|
stack
|
page read and write
|
||
|
294DF941000
|
heap
|
page read and write
|
||
|
1000000
|
trusted library allocation
|
page read and write
|
||
|
25447AF3000
|
heap
|
page read and write
|
||
|
25447AFE000
|
heap
|
page read and write
|
||
|
5510000
|
trusted library allocation
|
page read and write
|
||
|
10E8000
|
heap
|
page read and write
|
||
|
652E000
|
stack
|
page read and write
|
||
|
294DF9E2000
|
heap
|
page read and write
|
||
|
1163000
|
heap
|
page read and write
|
||
|
7FF78BA39000
|
unkown
|
page read and write
|
||
|
5961000
|
trusted library allocation
|
page read and write
|
||
|
25447AF5000
|
heap
|
page read and write
|
||
|
552E000
|
trusted library allocation
|
page read and write
|
||
|
5920000
|
trusted library allocation
|
page execute and read and write
|
||
|
E0C000
|
stack
|
page read and write
|
||
|
5536000
|
trusted library allocation
|
page read and write
|
||
|
E83000
|
trusted library allocation
|
page execute and read and write
|
||
|
5542000
|
trusted library allocation
|
page read and write
|
||
|
508A000
|
stack
|
page read and write
|
||
|
10B0000
|
heap
|
page read and write
|
||
|
294DF9C2000
|
heap
|
page read and write
|
||
|
294DFA33000
|
heap
|
page read and write
|
||
|
294DF9C2000
|
heap
|
page read and write
|
||
|
25447A60000
|
heap
|
page read and write
|
||
|
25447AF5000
|
heap
|
page read and write
|
||
|
294DF9E2000
|
heap
|
page read and write
|
||
|
29451309000
|
direct allocation
|
page read and write
|
||
|
7FF78B950000
|
unkown
|
page readonly
|
||
|
B634AFE000
|
stack
|
page read and write
|
||
|
666D000
|
stack
|
page read and write
|
||
|
25447AD2000
|
heap
|
page read and write
|
||
|
294DF940000
|
heap
|
page read and write
|
||
|
E9D000
|
trusted library allocation
|
page execute and read and write
|
||
|
294DF942000
|
heap
|
page read and write
|
||
|
294DF945000
|
heap
|
page read and write
|
||
|
2544BF88000
|
direct allocation
|
page read and write
|
||
|
68EE000
|
stack
|
page read and write
|
||
|
25447A30000
|
direct allocation
|
page read and write
|
||
|
294DF9C0000
|
heap
|
page read and write
|
||
|
294DF9F2000
|
heap
|
page read and write
|
||
|
25447AF2000
|
heap
|
page read and write
|
||
|
E80000
|
trusted library allocation
|
page read and write
|
||
|
294DF9E2000
|
heap
|
page read and write
|
||
|
294DF9DF000
|
heap
|
page read and write
|
||
|
294DF959000
|
heap
|
page read and write
|
||
|
3B51000
|
trusted library allocation
|
page read and write
|
||
|
25447B39000
|
heap
|
page read and write
|
||
|
25447A66000
|
heap
|
page read and write
|
||
|
25447ACC000
|
heap
|
page read and write
|
||
|
25447B39000
|
heap
|
page read and write
|
||
|
5040000
|
trusted library allocation
|
page read and write
|
||
|
52D0000
|
trusted library allocation
|
page read and write
|
||
|
7FF78B950000
|
unkown
|
page readonly
|
||
|
B6347FE000
|
stack
|
page read and write
|
||
|
52C8000
|
stack
|
page read and write
|
||
|
FC2000
|
trusted library allocation
|
page read and write
|
||
|
9F7000
|
heap
|
page read and write
|
||
|
9E0000
|
heap
|
page read and write
|
||
|
92B000
|
stack
|
page read and write
|
||
|
25447B39000
|
heap
|
page read and write
|
||
|
50D9000
|
trusted library allocation
|
page read and write
|
||
|
5950000
|
heap
|
page read and write
|
||
|
2544F400000
|
direct allocation
|
page read and write
|
||
|
FF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
25447AF6000
|
heap
|
page read and write
|
||
|
29451304000
|
direct allocation
|
page read and write
|
||
|
50D0000
|
trusted library allocation
|
page read and write
|
||
|
25447AF5000
|
heap
|
page read and write
|
||
|
25447AE1000
|
heap
|
page read and write
|
||
|
E84000
|
trusted library allocation
|
page read and write
|
||
|
7FF78BADF000
|
unkown
|
page readonly
|
||
|
66AC000
|
stack
|
page read and write
|
||
|
2544B802000
|
direct allocation
|
page read and write
|
||
|
2BAE000
|
trusted library allocation
|
page read and write
|
||
|
294DF9EB000
|
heap
|
page read and write
|
||
|
568E000
|
stack
|
page read and write
|
||
|
7FF78BA6A000
|
unkown
|
page readonly
|
||
|
2544B800000
|
direct allocation
|
page read and write
|
||
|
294DFA36000
|
heap
|
page read and write
|
||
|
294DF9E2000
|
heap
|
page read and write
|
||
|
1020000
|
heap
|
page read and write
|
||
|
294DFA33000
|
heap
|
page read and write
|
||
|
5531000
|
trusted library allocation
|
page read and write
|
||
|
294DF9C6000
|
heap
|
page read and write
|
||
|
551B000
|
trusted library allocation
|
page read and write
|
||
|
51C0000
|
heap
|
page read and write
|
||
|
294DF9E2000
|
heap
|
page read and write
|
||
|
294DF9F0000
|
heap
|
page read and write
|
||
|
4CEE000
|
stack
|
page read and write
|
||
|
553D000
|
trusted library allocation
|
page read and write
|
||
|
25447A50000
|
direct allocation
|
page read and write
|
||
|
551E000
|
trusted library allocation
|
page read and write
|
||
|
294DF9EE000
|
heap
|
page read and write
|
||
|
7FF78BAD7000
|
unkown
|
page read and write
|
||
|
3B79000
|
trusted library allocation
|
page read and write
|
||
|
294DFA36000
|
heap
|
page read and write
|
||
|
FBE000
|
stack
|
page read and write
|
||
|
25447AF5000
|
heap
|
page read and write
|
||
|
5522000
|
trusted library allocation
|
page read and write
|
||
|
25447AF5000
|
heap
|
page read and write
|
||
|
10B8000
|
heap
|
page read and write
|
||
|
294DFA33000
|
heap
|
page read and write
|
||
|
294DF9E2000
|
heap
|
page read and write
|
||
|
E8D000
|
trusted library allocation
|
page execute and read and write
|
||
|
294DF9DF000
|
heap
|
page read and write
|
||
|
5509000
|
stack
|
page read and write
|
||
|
CF7000
|
stack
|
page read and write
|
||
|
67AD000
|
stack
|
page read and write
|
||
|
294DF9D0000
|
heap
|
page read and write
|
||
|
3BB8000
|
trusted library allocation
|
page read and write
|
||
|
7FF78BADC000
|
unkown
|
page read and write
|
||
|
9DE000
|
stack
|
page read and write
|
||
|
62E0000
|
heap
|
page read and write
|
||
|
5516000
|
trusted library allocation
|
page read and write
|
||
|
646D000
|
stack
|
page read and write
|
||
|
552A000
|
trusted library allocation
|
page read and write
|
||
|
5030000
|
trusted library allocation
|
page read and write
|
||
|
59B0000
|
trusted library allocation
|
page read and write
|
||
|
FE0000
|
trusted library allocation
|
page read and write
|
There are 213 hidden memdumps, click here to show them.