Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
z52PaymentSlip.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_z52PaymentSlip.e_81b304cbfbfc784529105c3cf58a7151c27630_2cbdbcef_43d185f2-cf9b-406c-8b79-ea305d7fae60\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EE2.tmp.dmp
|
Mini DuMP crash report, 15 streams, Tue Oct 8 02:32:00 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER204B.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER206B.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\z52PaymentSlip.exe
|
"C:\Users\user\Desktop\z52PaymentSlip.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 1472
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.apache.org/licenses/LICENSE-2.0
|
unknown
|
||
|
http://www.fontbureau.com
|
unknown
|
||
|
http://www.fontbureau.com/designersG
|
unknown
|
||
|
http://www.fontbureau.com/designers/?
|
unknown
|
||
|
http://www.founder.com.cn/cn/bThe
|
unknown
|
||
|
http://www.fontbureau.com/designers?
|
unknown
|
||
|
http://www.tiro.com
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://www.fontbureau.com/designers
|
unknown
|
||
|
http://www.goodfont.co.kr
|
unknown
|
||
|
http://www.carterandcone.coml
|
unknown
|
||
|
http://www.sajatypeworks.com
|
unknown
|
||
|
http://www.typography.netD
|
unknown
|
||
|
http://www.fontbureau.com/designers/cabarga.htmlN
|
unknown
|
||
|
http://www.founder.com.cn/cn/cThe
|
unknown
|
||
|
http://www.galapagosdesign.com/staff/dennis.htm
|
unknown
|
||
|
http://www.founder.com.cn/cn
|
unknown
|
||
|
http://www.fontbureau.com/designers/frere-user.html
|
unknown
|
||
|
http://www.jiyu-kobo.co.jp/
|
unknown
|
||
|
http://www.galapagosdesign.com/DPlease
|
unknown
|
||
|
http://www.fontbureau.com/designers8
|
unknown
|
||
|
http://www.fonts.com
|
unknown
|
||
|
http://www.sandoll.co.kr
|
unknown
|
||
|
http://www.urwpp.deDPlease
|
unknown
|
||
|
http://www.zhongyicts.com.cn
|
unknown
|
||
|
http://www.sakkal.com
|
unknown
|
There are 16 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
ProgramId
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
FileId
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
LongPathHash
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
Name
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
OriginalFileName
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
Publisher
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
Version
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
BinFileVersion
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
BinaryType
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
ProductName
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
ProductVersion
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
LinkDate
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
BinProductVersion
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
Size
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
Language
|
||
|
\REGISTRY\A\{a7a3b18c-074d-7fcc-746e-10356a5b258b}\Root\InventoryApplicationFile\z52paymentslip.e|b7ba51b7d22da71a
|
Usn
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
There are 11 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
F60000
|
heap
|
page read and write
|
||
|
3A69000
|
trusted library allocation
|
page read and write
|
||
|
4FB1000
|
trusted library allocation
|
page read and write
|
||
|
4FD0000
|
trusted library allocation
|
page read and write
|
||
|
71CC000
|
heap
|
page read and write
|
||
|
71C8000
|
heap
|
page read and write
|
||
|
10FF000
|
stack
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
736E000
|
stack
|
page read and write
|
||
|
1290000
|
trusted library allocation
|
page read and write
|
||
|
4F50000
|
trusted library allocation
|
page read and write
|
||
|
4F80000
|
heap
|
page read and write
|
||
|
73CE000
|
stack
|
page read and write
|
||
|
FC0000
|
trusted library allocation
|
page read and write
|
||
|
7170000
|
heap
|
page read and write
|
||
|
51D0000
|
heap
|
page read and write
|
||
|
5052000
|
trusted library allocation
|
page read and write
|
||
|
FD7000
|
trusted library allocation
|
page execute and read and write
|
||
|
4F90000
|
trusted library allocation
|
page read and write
|
||
|
2AEB000
|
trusted library allocation
|
page read and write
|
||
|
2A50000
|
heap
|
page read and write
|
||
|
5110000
|
trusted library allocation
|
page read and write
|
||
|
4FD5000
|
trusted library allocation
|
page read and write
|
||
|
12DE000
|
stack
|
page read and write
|
||
|
7070000
|
heap
|
page read and write
|
||
|
732000
|
unkown
|
page readonly
|
||
|
FAD000
|
trusted library allocation
|
page execute and read and write
|
||
|
DF9000
|
heap
|
page read and write
|
||
|
5000000
|
trusted library allocation
|
page read and write
|
||
|
2A61000
|
trusted library allocation
|
page read and write
|
||
|
4FB6000
|
trusted library allocation
|
page read and write
|
||
|
5170000
|
heap
|
page read and write
|
||
|
51F0000
|
trusted library allocation
|
page read and write
|
||
|
BF5000
|
heap
|
page read and write
|
||
|
730000
|
unkown
|
page readonly
|
||
|
F5E000
|
stack
|
page read and write
|
||
|
7370000
|
trusted library allocation
|
page read and write
|
||
|
FA4000
|
trusted library allocation
|
page read and write
|
||
|
D20000
|
heap
|
page read and write
|
||
|
FB0000
|
trusted library allocation
|
page read and write
|
||
|
4F60000
|
trusted library allocation
|
page read and write
|
||
|
D2A000
|
heap
|
page read and write
|
||
|
FA0000
|
trusted library allocation
|
page read and write
|
||
|
5130000
|
trusted library allocation
|
page read and write
|
||
|
7190000
|
heap
|
page read and write
|
||
|
5150000
|
trusted library section
|
page readonly
|
||
|
4F94000
|
trusted library allocation
|
page read and write
|
||
|
4F83000
|
heap
|
page read and write
|
||
|
DF6000
|
heap
|
page read and write
|
||
|
FD2000
|
trusted library allocation
|
page read and write
|
||
|
4F40000
|
trusted library allocation
|
page execute and read and write
|
||
|
8B1E000
|
stack
|
page read and write
|
||
|
FA3000
|
trusted library allocation
|
page execute and read and write
|
||
|
4FAA000
|
trusted library allocation
|
page read and write
|
||
|
4FBD000
|
trusted library allocation
|
page read and write
|
||
|
2A3D000
|
stack
|
page read and write
|
||
|
511F000
|
trusted library allocation
|
page read and write
|
||
|
2AEE000
|
trusted library allocation
|
page read and write
|
||
|
FC6000
|
trusted library allocation
|
page execute and read and write
|
||
|
4F9B000
|
trusted library allocation
|
page read and write
|
||
|
5160000
|
heap
|
page read and write
|
||
|
2A40000
|
heap
|
page execute and read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
3A61000
|
trusted library allocation
|
page read and write
|
||
|
5060000
|
trusted library allocation
|
page execute and read and write
|
||
|
D2E000
|
heap
|
page read and write
|
||
|
5230000
|
trusted library section
|
page read and write
|
||
|
8B5E000
|
stack
|
page read and write
|
||
|
7F4F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
FBD000
|
trusted library allocation
|
page execute and read and write
|
||
|
D0E000
|
stack
|
page read and write
|
||
|
FC2000
|
trusted library allocation
|
page read and write
|
||
|
FDB000
|
trusted library allocation
|
page execute and read and write
|
||
|
5B37000
|
heap
|
page read and write
|
||
|
5B19000
|
heap
|
page read and write
|
||
|
D62000
|
heap
|
page read and write
|
||
|
6C92000
|
trusted library allocation
|
page read and write
|
||
|
752E000
|
stack
|
page read and write
|
||
|
5040000
|
heap
|
page read and write
|
||
|
4F7F000
|
trusted library allocation
|
page read and write
|
||
|
4BFE000
|
stack
|
page read and write
|
||
|
8C5E000
|
stack
|
page read and write
|
||
|
6C70000
|
trusted library allocation
|
page read and write
|
||
|
BD0000
|
heap
|
page read and write
|
||
|
8C60000
|
heap
|
page read and write
|
||
|
D55000
|
heap
|
page read and write
|
||
|
BC0000
|
heap
|
page read and write
|
||
|
51D5000
|
heap
|
page read and write
|
||
|
54ED000
|
stack
|
page read and write
|
||
|
51E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
766E000
|
stack
|
page read and write
|
||
|
DC8000
|
heap
|
page read and write
|
||
|
762F000
|
stack
|
page read and write
|
||
|
12E7000
|
heap
|
page read and write
|
||
|
2A5B000
|
heap
|
page read and write
|
||
|
5B00000
|
heap
|
page read and write
|
||
|
29FE000
|
stack
|
page read and write
|
||
|
F90000
|
trusted library allocation
|
page read and write
|
||
|
4FC2000
|
trusted library allocation
|
page read and write
|
||
|
5050000
|
trusted library allocation
|
page read and write
|
||
|
7380000
|
trusted library allocation
|
page execute and read and write
|
||
|
FCA000
|
trusted library allocation
|
page execute and read and write
|
||
|
5AF0000
|
heap
|
page read and write
|
||
|
5250000
|
heap
|
page read and write
|
||
|
B57000
|
stack
|
page read and write
|
||
|
552E000
|
stack
|
page read and write
|
||
|
12E0000
|
heap
|
page read and write
|
||
|
5180000
|
heap
|
page execute and read and write
|
||
|
DAB000
|
heap
|
page read and write
|
||
|
4FE0000
|
trusted library allocation
|
page read and write
|
||
|
4F70000
|
trusted library allocation
|
page read and write
|
||
|
4FAE000
|
trusted library allocation
|
page read and write
|
||
|
5531000
|
trusted library allocation
|
page read and write
|
||
|
F1E000
|
stack
|
page read and write
|
||
|
74CE000
|
stack
|
page read and write
|
||
|
A5A000
|
stack
|
page read and write
|
||
|
DC4000
|
heap
|
page read and write
|
||
|
74E0000
|
trusted library section
|
page read and write
|
||
|
51CB000
|
stack
|
page read and write
|
There are 109 hidden memdumps, click here to show them.