Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Po110-11#U3000Or_74ab44bf1d935e2ca69145489c2f99ce846e82_fcc1023b_eb5b3316-d1e5-429a-abff-e47306e8f50f\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC72A.tmp.dmp
|
Mini DuMP crash report, 15 streams, Mon Oct 21 05:35:51 2024, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC825.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC855.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe
|
"C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe"
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 780
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://upx.sf.net
|
unknown
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
ProgramId
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
FileId
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
LowerCaseLongPath
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
LongPathHash
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
Name
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
OriginalFileName
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
Publisher
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
Version
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
BinFileVersion
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
BinaryType
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
ProductName
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
ProductVersion
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
LinkDate
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
BinProductVersion
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
AppxPackageFullName
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
AppxPackageRelativeId
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
Size
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
Language
|
||
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
|
Usn
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
There are 11 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
1030000
|
heap
|
page read and write
|
||
2E10000
|
heap
|
page read and write
|
||
FD0000
|
trusted library allocation
|
page read and write
|
||
122F000
|
stack
|
page read and write
|
||
EBE000
|
stack
|
page read and write
|
||
554E000
|
stack
|
page read and write
|
||
103E000
|
heap
|
page read and write
|
||
2D7E000
|
stack
|
page read and write
|
||
E20000
|
heap
|
page read and write
|
||
14D0000
|
heap
|
page read and write
|
||
FE3000
|
trusted library allocation
|
page execute and read and write
|
||
BCC000
|
stack
|
page read and write
|
||
550E000
|
stack
|
page read and write
|
||
2DA0000
|
heap
|
page execute and read and write
|
||
1066000
|
heap
|
page read and write
|
||
2DEE000
|
stack
|
page read and write
|
||
1058000
|
heap
|
page read and write
|
||
EE0000
|
heap
|
page read and write
|
||
1017000
|
trusted library allocation
|
page execute and read and write
|
||
2E21000
|
trusted library allocation
|
page read and write
|
||
103B000
|
heap
|
page read and write
|
||
9A2000
|
unkown
|
page readonly
|
||
ACB000
|
stack
|
page read and write
|
||
13EE000
|
stack
|
page read and write
|
||
1230000
|
trusted library allocation
|
page read and write
|
||
127E000
|
stack
|
page read and write
|
||
12BD000
|
stack
|
page read and write
|
||
564E000
|
stack
|
page read and write
|
||
1490000
|
trusted library allocation
|
page execute and read and write
|
||
E30000
|
heap
|
page read and write
|
||
12E0000
|
heap
|
page read and write
|
||
1074000
|
heap
|
page read and write
|
||
101B000
|
trusted library allocation
|
page execute and read and write
|
||
4F1E000
|
stack
|
page read and write
|
||
E7E000
|
stack
|
page read and write
|
||
9A0000
|
unkown
|
page readonly
|
||
FE4000
|
trusted library allocation
|
page read and write
|
||
A2E000
|
unkown
|
page readonly
|
||
105D000
|
heap
|
page read and write
|
||
3E21000
|
trusted library allocation
|
page read and write
|
||
108F000
|
heap
|
page read and write
|
||
14B0000
|
heap
|
page read and write
|
||
12C0000
|
heap
|
page read and write
|
||
EE6000
|
heap
|
page read and write
|
There are 34 hidden memdumps, click here to show them.