Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_msedge.exe_4141afb346d51f202ef326a3bf650244e2e58b2_75709460_597e72f2-2d68-41ea-b9f9-1d952267e7f1\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C35.tmp.dmp
|
Mini DuMP crash report, 16 streams, Mon Sep 30 05:16:41 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8CD2.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D02.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd /C ""C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService
--lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=yes --field-trial-handle=2420,i,11779009155098719741,8172115586603878713,262144
--variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
|
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService
--lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=yes --field-trial-handle=2420,i,11779009155098719741,8172115586603878713,262144
--variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 7324 -s 428
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://upx.sf.net
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4E4C0025C000
|
unkown
|
page read and write
|
||
|
F5493FE000
|
unkown
|
page readonly
|
||
|
1384002FC000
|
unkown
|
page read and write
|
||
|
4AF4002B0000
|
unkown
|
page read and write
|
||
|
4E4C0029C000
|
unkown
|
page read and write
|
||
|
4AF400270000
|
unkown
|
page read and write
|
||
|
1384002BC000
|
unkown
|
page read and write
|
||
|
13840020C000
|
unkown
|
page read and write
|
||
|
F5473FE000
|
unkown
|
page readonly
|
||
|
4E4C0028C000
|
unkown
|
page read and write
|
||
|
4E4C00248000
|
unkown
|
page read and write
|
||
|
256F5300000
|
unkown
|
page readonly
|
||
|
25682D61000
|
unkown
|
page readonly
|
||
|
1384002D8000
|
unkown
|
page read and write
|
||
|
256F5310000
|
heap
|
page read and write
|
||
|
4E4C00210000
|
unkown
|
page read and write
|
||
|
4E4C002B8000
|
unkown
|
page read and write
|
||
|
4AF400248000
|
unkown
|
page read and write
|
||
|
4E4C00280000
|
unkown
|
page read and write
|
||
|
4AF400258000
|
unkown
|
page read and write
|
||
|
256F52F0000
|
heap
|
page read and write
|
||
|
13840026C000
|
unkown
|
page read and write
|
||
|
4E4C0026C000
|
unkown
|
page read and write
|
||
|
1384002CC000
|
unkown
|
page read and write
|
||
|
256F5400000
|
unkown
|
page read and write
|
||
|
4AF400268000
|
unkown
|
page read and write
|
||
|
F546BFE000
|
unkown
|
page read and write
|
||
|
256F5411000
|
unkown
|
page read and write
|
||
|
F545BFC000
|
stack
|
page read and write
|
||
|
1384002AC000
|
unkown
|
page read and write
|
||
|
4AF4002A4000
|
unkown
|
page read and write
|
||
|
F547BFE000
|
unkown
|
page read and write
|
||
|
1384002EC000
|
unkown
|
page read and write
|
||
|
138400230000
|
unkown
|
page read and write
|
||
|
138400258000
|
unkown
|
page read and write
|
||
|
4E4C00234000
|
unkown
|
page read and write
|
||
|
256F542B000
|
unkown
|
page read and write
|
||
|
4E4C00258000
|
unkown
|
page read and write
|
||
|
138400220000
|
unkown
|
page read and write
|
||
|
138400404000
|
unkown
|
page read and write
|
||
|
13840025C000
|
unkown
|
page read and write
|
||
|
4AF40025C000
|
unkown
|
page read and write
|
||
|
138400280000
|
unkown
|
page read and write
|
||
|
256F5402000
|
unkown
|
page read and write
|
||
|
4E4C0027C000
|
unkown
|
page read and write
|
||
|
256F5970000
|
unkown
|
page read and write
|
||
|
4AF400220000
|
unkown
|
page read and write
|
||
|
4E4C00220000
|
unkown
|
page read and write
|
||
|
4E4C00201000
|
unkown
|
page read and write
|
||
|
256F53F0000
|
unkown
|
page readonly
|
||
|
256F5600000
|
unkown
|
page readonly
|
||
|
256F5502000
|
unkown
|
page read and write
|
||
|
F548BFE000
|
unkown
|
page read and write
|
||
|
138400290000
|
unkown
|
page read and write
|
||
|
138400318000
|
unkown
|
page read and write
|
||
|
138400248000
|
unkown
|
page read and write
|
||
|
4AF4002B8000
|
unkown
|
page read and write
|
||
|
4E4C00290000
|
unkown
|
page read and write
|
||
|
4AF400201000
|
unkown
|
page read and write
|
||
|
4E4C002E0000
|
unkown
|
page read and write
|
||
|
4E4C00230000
|
unkown
|
page read and write
|
||
|
256F5610000
|
heap
|
page read and write
|
||
|
4E4C002D8000
|
unkown
|
page read and write
|
||
|
1384002E4000
|
unkown
|
page read and write
|
||
|
4AF400290000
|
unkown
|
page read and write
|
||
|
4AF400230000
|
unkown
|
page read and write
|
||
|
138400270000
|
unkown
|
page read and write
|
||
|
138400268000
|
unkown
|
page read and write
|
||
|
13840032C000
|
unkown
|
page read and write
|
||
|
4E4C002B4000
|
unkown
|
page read and write
|
||
|
138400201000
|
unkown
|
page read and write
|
||
|
1384002B0000
|
unkown
|
page read and write
|
||
|
256F5413000
|
unkown
|
page read and write
|
||
|
F5483FE000
|
unkown
|
page readonly
|
||
|
4AF400210000
|
unkown
|
page read and write
|
||
|
4AF400238000
|
unkown
|
page read and write
|
||
|
4AF40026C000
|
unkown
|
page read and write
|
||
|
1384002A4000
|
unkown
|
page read and write
|
||
|
4E4C002A0000
|
unkown
|
page read and write
|
||
|
25680000000
|
unkown
|
page readonly
|
||
|
138400210000
|
unkown
|
page read and write
|
||
|
138400238000
|
unkown
|
page read and write
|
||
|
4AF400280000
|
unkown
|
page read and write
|
||
|
4AF4002D0000
|
unkown
|
page read and write
|
||
|
138400408000
|
unkown
|
page read and write
|
There are 75 hidden memdumps, click here to show them.