Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
r9RH4Zmt7ycN6yWI.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_r9RH4Zmt7ycN6yWI_7077397d61485eeab725ed52e85b8f491a9067_a9578677_09806032-06dd-4c9d-b27a-df0e82bb2810\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEC4.tmp.dmp
|
Mini DuMP crash report, 15 streams, Tue Oct 8 02:01:57 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0AA.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0CA.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe
|
"C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 1472
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://upx.sf.net
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
206.23.85.13.in-addr.arpa
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
ProgramId
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
FileId
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
LongPathHash
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
Name
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
OriginalFileName
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
Publisher
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
Version
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
BinFileVersion
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
BinaryType
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
ProductName
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
ProductVersion
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
LinkDate
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
BinProductVersion
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
Size
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
Language
|
||
|
\REGISTRY\A\{fd9b9ece-f90e-8fe5-25f7-71e0eda30ee5}\Root\InventoryApplicationFile\r9rh4zmt7ycn6ywi|dfac480a882938c7
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
517E000
|
trusted library allocation
|
page read and write
|
||
|
9B2000
|
unkown
|
page readonly
|
||
|
11DF000
|
heap
|
page read and write
|
||
|
6FC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
6F80000
|
trusted library section
|
page read and write
|
||
|
DB0000
|
heap
|
page read and write
|
||
|
F6D000
|
trusted library allocation
|
page execute and read and write
|
||
|
11D5000
|
heap
|
page read and write
|
||
|
5230000
|
trusted library allocation
|
page read and write
|
||
|
716E000
|
stack
|
page read and write
|
||
|
7582000
|
trusted library allocation
|
page read and write
|
||
|
8BE0000
|
heap
|
page read and write
|
||
|
3C81000
|
trusted library allocation
|
page read and write
|
||
|
53A0000
|
heap
|
page read and write
|
||
|
726E000
|
stack
|
page read and write
|
||
|
10FA000
|
heap
|
page read and write
|
||
|
5220000
|
trusted library allocation
|
page execute and read and write
|
||
|
5212000
|
trusted library allocation
|
page read and write
|
||
|
518D000
|
trusted library allocation
|
page read and write
|
||
|
5360000
|
trusted library section
|
page readonly
|
||
|
2C81000
|
trusted library allocation
|
page read and write
|
||
|
1390000
|
heap
|
page read and write
|
||
|
702E000
|
stack
|
page read and write
|
||
|
6E80000
|
heap
|
page read and write
|
||
|
5200000
|
heap
|
page read and write
|
||
|
1380000
|
trusted library allocation
|
page read and write
|
||
|
516B000
|
trusted library allocation
|
page read and write
|
||
|
C5A000
|
stack
|
page read and write
|
||
|
4E1E000
|
stack
|
page read and write
|
||
|
F70000
|
heap
|
page read and write
|
||
|
10F0000
|
heap
|
page read and write
|
||
|
8BC0000
|
heap
|
page read and write
|
||
|
10AB000
|
trusted library allocation
|
page execute and read and write
|
||
|
5192000
|
trusted library allocation
|
page read and write
|
||
|
52F0000
|
trusted library allocation
|
page read and write
|
||
|
1096000
|
trusted library allocation
|
page execute and read and write
|
||
|
F1E000
|
stack
|
page read and write
|
||
|
10A2000
|
trusted library allocation
|
page read and write
|
||
|
11CF000
|
heap
|
page read and write
|
||
|
F64000
|
trusted library allocation
|
page read and write
|
||
|
11A2000
|
heap
|
page read and write
|
||
|
72AE000
|
stack
|
page read and write
|
||
|
1560000
|
heap
|
page read and write
|
||
|
1132000
|
heap
|
page read and write
|
||
|
5164000
|
trusted library allocation
|
page read and write
|
||
|
10A0000
|
trusted library allocation
|
page read and write
|
||
|
5313000
|
heap
|
page read and write
|
||
|
7FA30000
|
trusted library allocation
|
page execute and read and write
|
||
|
902000
|
unkown
|
page readonly
|
||
|
107E000
|
stack
|
page read and write
|
||
|
5181000
|
trusted library allocation
|
page read and write
|
||
|
1330000
|
heap
|
page read and write
|
||
|
133B000
|
heap
|
page read and write
|
||
|
5770000
|
heap
|
page read and write
|
||
|
1555000
|
trusted library allocation
|
page read and write
|
||
|
5210000
|
trusted library allocation
|
page read and write
|
||
|
E90000
|
heap
|
page read and write
|
||
|
D57000
|
stack
|
page read and write
|
||
|
10D0000
|
heap
|
page execute and read and write
|
||
|
1092000
|
trusted library allocation
|
page read and write
|
||
|
73B0000
|
heap
|
page read and write
|
||
|
108D000
|
trusted library allocation
|
page execute and read and write
|
||
|
51A0000
|
trusted library allocation
|
page read and write
|
||
|
11A6000
|
heap
|
page read and write
|
||
|
F63000
|
trusted library allocation
|
page execute and read and write
|
||
|
53B0000
|
heap
|
page execute and read and write
|
||
|
5186000
|
trusted library allocation
|
page read and write
|
||
|
1166000
|
heap
|
page read and write
|
||
|
10C0000
|
trusted library allocation
|
page read and write
|
||
|
6FE0000
|
trusted library section
|
page read and write
|
||
|
1080000
|
trusted library allocation
|
page read and write
|
||
|
1530000
|
trusted library allocation
|
page read and write
|
||
|
10FE000
|
heap
|
page read and write
|
||
|
6FA1000
|
trusted library allocation
|
page read and write
|
||
|
11AA000
|
heap
|
page read and write
|
||
|
1090000
|
trusted library allocation
|
page read and write
|
||
|
10E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
900000
|
unkown
|
page readonly
|
||
|
57A0000
|
heap
|
page read and write
|
||
|
1567000
|
heap
|
page read and write
|
||
|
523F000
|
trusted library allocation
|
page read and write
|
||
|
6FB0000
|
trusted library allocation
|
page read and write
|
||
|
12EE000
|
stack
|
page read and write
|
||
|
8C28000
|
heap
|
page read and write
|
||
|
5780000
|
heap
|
page read and write
|
||
|
3C89000
|
trusted library allocation
|
page read and write
|
||
|
EDE000
|
stack
|
page read and write
|
||
|
5160000
|
trusted library allocation
|
page read and write
|
||
|
58CE000
|
stack
|
page read and write
|
||
|
1125000
|
heap
|
page read and write
|
||
|
535B000
|
stack
|
page read and write
|
||
|
5530000
|
trusted library allocation
|
page read and write
|
||
|
2D0B000
|
trusted library allocation
|
page read and write
|
||
|
5390000
|
trusted library allocation
|
page execute and read and write
|
||
|
5760000
|
heap
|
page read and write
|
||
|
51C0000
|
trusted library allocation
|
page read and write
|
||
|
73AE000
|
stack
|
page read and write
|
||
|
F50000
|
trusted library allocation
|
page read and write
|
||
|
154F000
|
trusted library allocation
|
page read and write
|
||
|
5380000
|
heap
|
page read and write
|
||
|
2C7E000
|
stack
|
page read and write
|
||
|
F60000
|
trusted library allocation
|
page read and write
|
||
|
109A000
|
trusted library allocation
|
page execute and read and write
|
||
|
2D0E000
|
trusted library allocation
|
page read and write
|
||
|
712E000
|
stack
|
page read and write
|
||
|
57A4000
|
heap
|
page read and write
|
||
|
1550000
|
trusted library allocation
|
page read and write
|
||
|
56ED000
|
stack
|
page read and write
|
||
|
10A7000
|
trusted library allocation
|
page execute and read and write
|
||
|
5765000
|
heap
|
page read and write
|
||
|
1540000
|
trusted library allocation
|
page read and write
|
||
|
5370000
|
heap
|
page read and write
|
||
|
137E000
|
stack
|
page read and write
|
||
|
8DBE000
|
stack
|
page read and write
|
||
|
132E000
|
stack
|
page read and write
|
||
|
5310000
|
heap
|
page read and write
|
There are 106 hidden memdumps, click here to show them.