IOC Report
1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe

loading gif

Files

File Path
Type
Category
Malicious
1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2SSM3MSIR0DTTRQ2_504a3634ea5f948835717bb7b0f19bfc2412817f_35627730_24d8b2c5-b163-42cf-9ebb-b8dff9900c0d\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1929.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Sep 27 08:47:43 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EB8.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EF7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe
"C:\Users\user\Desktop\1727426286cf469675e3a7fae43b5e2efcc15639ae08e5067de36f3129e2eb678168920527172.dat-decoded.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6764 -s 2620

URLs

Name
IP
Malicious
http://aborters.duckdns.org:8081
unknown
 malicious
http://anotherarmy.dns.army:8081
unknown
 malicious
https://www.office.com/
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:642294%0D%0ADate%20a
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://api.telegram.org
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://api.telegram.org/bot
unknown
https://chrome.google.com/webstore?hl=enXL
unknown
https://www.office.com/lB
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
http://checkip.dyndns.org
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
https://api.telegram.org/bot/sendMessage?chat_id=&text=
unknown
https://chrome.google.com/webstore?hl=en
unknown
https://www.ecosia.org/newtab/
unknown
http://varders.kozow.com:8081
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:642294%0D%0ADate%20and%20Time:%2027/09/2024%20/%2015:33:28%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20642294%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
https://ac.ecosia.org/autocomplete?q=
unknown
http://checkip.dyndns.org/
158.101.44.242
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://checkip.dyndns.org/q
unknown
https://chrome.google.com/webstore?hl=enlB
unknown
https://reallyfreegeoip.org
unknown
https://www.office.com/XL
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 23 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
api.telegram.org
149.154.167.220
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
158.101.44.242

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
158.101.44.242
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
FileDirectory
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
ProgramId
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
FileId
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
LowerCaseLongPath
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
LongPathHash
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
Name
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
OriginalFileName
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
Publisher
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
Version
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
BinFileVersion
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
BinaryType
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
ProductName
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
ProductVersion
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
LinkDate
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
BinProductVersion
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
AppxPackageFullName
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
AppxPackageRelativeId
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
Size
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
Language
\REGISTRY\A\{db2927db-b86b-efbd-8726-d0dbd88cbdd6}\Root\InventoryApplicationFile\1727426286cf4696|342a483a19cd6dd
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 26 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2A81000
trusted library allocation
page read and write
 malicious
702000
unkown
page readonly
 malicious
125E000
stack
page read and write
6700000
trusted library allocation
page execute and read and write
3AA9000
trusted library allocation
page read and write
3C5B000
trusted library allocation
page read and write
6248000
heap
page read and write
2AF8000
trusted library allocation
page read and write
2C04000
trusted library allocation
page read and write
2C36000
trusted library allocation
page read and write
2DCB000
trusted library allocation
page read and write
F1C000
stack
page read and write
AF7000
stack
page read and write
2C84000
trusted library allocation
page read and write
568E000
stack
page read and write
6740000
trusted library allocation
page execute and read and write
2C0A000
trusted library allocation
page read and write
2D7E000
trusted library allocation
page read and write
63BE000
stack
page read and write
2AE9000
trusted library allocation
page read and write
519E000
stack
page read and write
2B35000
trusted library allocation
page read and write
6246000
heap
page read and write
D4A000
trusted library allocation
page execute and read and write
3AEB000
trusted library allocation
page read and write
2D49000
trusted library allocation
page read and write
2DD5000
trusted library allocation
page read and write
61C0000
heap
page read and write
D70000
trusted library allocation
page read and write
2C3E000
trusted library allocation
page read and write
B40000
heap
page read and write
3D4D000
trusted library allocation
page read and write
3C21000
trusted library allocation
page read and write
2C44000
trusted library allocation
page read and write
6730000
trusted library allocation
page read and write
3C2F000
trusted library allocation
page read and write
653E000
stack
page read and write
3E2A000
trusted library allocation
page read and write
3A85000
trusted library allocation
page read and write
1264000
trusted library allocation
page read and write
61FF000
heap
page read and write
3C2A000
trusted library allocation
page read and write
D24000
trusted library allocation
page read and write
2B29000
trusted library allocation
page read and write
2CEE000
trusted library allocation
page read and write
3D06000
trusted library allocation
page read and write
3B90000
trusted library allocation
page read and write
D20000
trusted library allocation
page read and write
2B68000
trusted library allocation
page read and write
D55000
trusted library allocation
page execute and read and write
105E000
stack
page read and write
5250000
heap
page read and write
2C12000
trusted library allocation
page read and write
4FBE000
stack
page read and write
3C33000
trusted library allocation
page read and write
F30000
trusted library allocation
page read and write
BE0000
heap
page read and write
521E000
stack
page read and write
63FF000
stack
page read and write
2AF4000
trusted library allocation
page read and write
2C9E000
trusted library allocation
page read and write
5140000
trusted library allocation
page read and write
D23000
trusted library allocation
page execute and read and write
F50000
heap
page read and write
3DD3000
trusted library allocation
page read and write
2DD3000
trusted library allocation
page read and write
2B8A000
trusted library allocation
page read and write
67F0000
trusted library allocation
page execute and read and write
F20000
trusted library allocation
page read and write
2AD2000
trusted library allocation
page read and write
2CEC000
trusted library allocation
page read and write
EBE000
stack
page read and write
D5B000
trusted library allocation
page execute and read and write
F40000
trusted library allocation
page read and write
4FFE000
stack
page read and write
3A9B000
trusted library allocation
page read and write
2CC5000
trusted library allocation
page read and write
D46000
trusted library allocation
page execute and read and write
2CA3000
trusted library allocation
page read and write
D57000
trusted library allocation
page execute and read and write
2C17000
trusted library allocation
page read and write
6244000
heap
page read and write
2D4D000
trusted library allocation
page read and write
2CB2000
trusted library allocation
page read and write
61DE000
heap
page read and write
558E000
stack
page read and write
657E000
stack
page read and write
3E26000
trusted library allocation
page read and write
50DD000
stack
page read and write
2DD1000
trusted library allocation
page read and write
2C0C000
trusted library allocation
page read and write
3CBB000
trusted library allocation
page read and write
6750000
trusted library allocation
page execute and read and write
2D43000
trusted library allocation
page read and write
1295000
trusted library allocation
page read and write
5230000
trusted library allocation
page read and write
2CA9000
trusted library allocation
page read and write
4C1E000
stack
page read and write
2C08000
trusted library allocation
page read and write
2D3E000
trusted library allocation
page read and write
D2D000
trusted library allocation
page execute and read and write
CD0000
heap
page read and write
D30000
trusted library allocation
page read and write
2DAB000
trusted library allocation
page read and write
EC0000
trusted library allocation
page execute and read and write
3BB0000
trusted library allocation
page read and write
B9E000
stack
page read and write
2AEC000
trusted library allocation
page read and write
12D0000
heap
page read and write
511E000
stack
page read and write
2C3C000
trusted library allocation
page read and write
3CDA000
trusted library allocation
page read and write
D42000
trusted library allocation
page read and write
3A8F000
trusted library allocation
page read and write
2D46000
trusted library allocation
page read and write
2B2D000
trusted library allocation
page read and write
3B3B000
trusted library allocation
page read and write
3DEB000
trusted library allocation
page read and write
2CC1000
trusted library allocation
page read and write
2AFC000
trusted library allocation
page read and write
3BC6000
trusted library allocation
page read and write
625D000
heap
page read and write
2B21000
trusted library allocation
page read and write
2C49000
trusted library allocation
page read and write
2DDA000
trusted library allocation
page read and write
3B64000
trusted library allocation
page read and write
B50000
heap
page read and write
D40000
trusted library allocation
page read and write
51DE000
stack
page read and write
2B31000
trusted library allocation
page read and write
2C3A000
trusted library allocation
page read and write
3B51000
trusted library allocation
page read and write
4A88000
trusted library allocation
page read and write
2CF9000
trusted library allocation
page read and write
2DDE000
trusted library allocation
page read and write
3DFB000
trusted library allocation
page read and write
700000
unkown
page readonly
D80000
heap
page read and write
ED0000
heap
page read and write
61BE000
stack
page read and write
3C49000
trusted library allocation
page read and write
6211000
heap
page read and write
3D3C000
trusted library allocation
page read and write
56CE000
stack
page read and write
DC3000
heap
page read and write
12A0000
heap
page execute and read and write
67D0000
trusted library allocation
page read and write
BE6000
heap
page read and write
2B41000
trusted library allocation
page read and write
3C86000
trusted library allocation
page read and write
3CA5000
trusted library allocation
page read and write
3A94000
trusted library allocation
page read and write
65BF000
stack
page read and write
D52000
trusted library allocation
page read and write
E39000
heap
page read and write
5240000
heap
page execute and read and write
746000
unkown
page readonly
5150000
heap
page read and write
D8E000
heap
page read and write
2B8C000
trusted library allocation
page read and write
570D000
stack
page read and write
12B0000
trusted library allocation
page read and write
5226000
trusted library allocation
page read and write
5EBF000
stack
page read and write
2ADE000
trusted library allocation
page read and write
2D3A000
trusted library allocation
page read and write
D10000
trusted library allocation
page read and write
2B39000
trusted library allocation
page read and write
2B3D000
trusted library allocation
page read and write
D8B000
heap
page read and write
66FF000
stack
page read and write
523D000
trusted library allocation
page read and write
E6F000
heap
page read and write
6770000
trusted library allocation
page execute and read and write
3DE9000
trusted library allocation
page read and write
F37000
trusted library allocation
page read and write
643E000
stack
page read and write
2CE6000
trusted library allocation
page read and write
2CF3000
trusted library allocation
page read and write
5224000
trusted library allocation
page read and write
6760000
trusted library allocation
page execute and read and write
3A81000
trusted library allocation
page read and write
522A000
trusted library allocation
page read and write
65FE000
stack
page read and write
3AA1000
trusted library allocation
page read and write
5DBE000
stack
page read and write
6720000
trusted library allocation
page execute and read and write
3C8A000
trusted library allocation
page read and write
6710000
trusted library allocation
page read and write
115E000
stack
page read and write
7DB000
stack
page read and write
DC0000
heap
page read and write
6269000
heap
page read and write
3D26000
trusted library allocation
page read and write
60BF000
stack
page read and write
5FBE000
stack
page read and write
BDE000
stack
page read and write
2CBC000
trusted library allocation
page read and write
E49000
heap
page read and write
2B25000
trusted library allocation
page read and write
There are 190 hidden memdumps, click here to show them.