Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Setup_v1.29.exe
|
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Setup_v1.29.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\msvcp110.dll
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aspnet_regiis.ex_c7496913b9c4ddf6a8ea5944b8f620d91bfba12_edfe2fff_09f1d501-70d8-4950-b861-5593f5fb2d0e\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE3B8.tmp.dmp
|
Mini DuMP crash report, 14 streams, Thu Oct 24 19:45:21 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5CD.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE699.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Setup_v1.29.exe
|
"C:\Users\user\Desktop\Setup_v1.29.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 1280
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://95.217.125.57
|
unknown
|
|
|
|
http://95.217.125.57/
|
95.217.125.57
|
|
|
|
http://95.217.125.57/2f571d994666c8cb.php
|
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://95.217.125.57/4Q
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
15.164.165.52.in-addr.arpa
|
unknown
|
||
|
200.163.202.172.in-addr.arpa
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
95.217.125.57
|
unknown
|
Germany
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
ProgramId
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
FileId
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
LongPathHash
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
Name
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
OriginalFileName
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
Publisher
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
Version
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
BinFileVersion
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
BinaryType
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
ProductName
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
ProductVersion
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
LinkDate
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
BinProductVersion
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
Size
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
Language
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
IsOsComponent
|
||
|
\REGISTRY\A\{23b96b2f-6842-eac7-7dd4-255305e58a5b}\Root\InventoryApplicationFile\aspnet_regiis.ex|9ffa85ecfdd8c5d0
|
Usn
|
There are 10 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3100000
|
remote allocation
|
page execute and read and write
|
|
|
|
35F7000
|
heap
|
page read and write
|
|
|
|
6CFC5000
|
unkown
|
page read and write
|
|
|
|
319A000
|
remote allocation
|
page execute and read and write
|
|
|
|
1600000
|
trusted library allocation
|
page read and write
|
||
|
1D701000
|
heap
|
page read and write
|
||
|
18A0000
|
heap
|
page execute and read and write
|
||
|
4B04000
|
trusted library allocation
|
page read and write
|
||
|
49B5000
|
trusted library allocation
|
page read and write
|
||
|
18EE000
|
stack
|
page read and write
|
||
|
31C7000
|
trusted library allocation
|
page read and write
|
||
|
1D4FF000
|
stack
|
page read and write
|
||
|
3450000
|
heap
|
page readonly
|
||
|
16B7000
|
heap
|
page read and write
|
||
|
3830000
|
heap
|
page read and write
|
||
|
1D0FF000
|
stack
|
page read and write
|
||
|
7CEE000
|
stack
|
page read and write
|
||
|
3637000
|
heap
|
page read and write
|
||
|
3185000
|
remote allocation
|
page execute and read and write
|
||
|
EFC000
|
unkown
|
page readonly
|
||
|
3497000
|
heap
|
page read and write
|
||
|
EF2000
|
unkown
|
page execute and read and write
|
||
|
1688000
|
heap
|
page read and write
|
||
|
35DE000
|
stack
|
page read and write
|
||
|
1610000
|
trusted library allocation
|
page read and write
|
||
|
1D67C000
|
stack
|
page read and write
|
||
|
382F000
|
stack
|
page read and write
|
||
|
15B0000
|
heap
|
page read and write
|
||
|
538E000
|
stack
|
page read and write
|
||
|
1840000
|
trusted library allocation
|
page read and write
|
||
|
572E000
|
stack
|
page read and write
|
||
|
1860000
|
trusted library allocation
|
page read and write
|
||
|
45DC000
|
trusted library allocation
|
page read and write
|
||
|
1880000
|
trusted library allocation
|
page read and write
|
||
|
334A000
|
remote allocation
|
page execute and read and write
|
||
|
1D700000
|
heap
|
page read and write
|
||
|
372E000
|
stack
|
page read and write
|
||
|
1D57E000
|
stack
|
page read and write
|
||
|
12FB000
|
stack
|
page read and write
|
||
|
41B5000
|
trusted library allocation
|
page read and write
|
||
|
1668000
|
heap
|
page read and write
|
||
|
16F2000
|
heap
|
page read and write
|
||
|
3652000
|
heap
|
page read and write
|
||
|
164E000
|
heap
|
page read and write
|
||
|
30F5000
|
stack
|
page read and write
|
||
|
3490000
|
heap
|
page read and write
|
||
|
1D27E000
|
stack
|
page read and write
|
||
|
41B1000
|
trusted library allocation
|
page read and write
|
||
|
142E000
|
stack
|
page read and write
|
||
|
451C000
|
trusted library allocation
|
page read and write
|
||
|
51EE000
|
stack
|
page read and write
|
||
|
7BEE000
|
stack
|
page read and write
|
||
|
363C000
|
heap
|
page read and write
|
||
|
44DC000
|
trusted library allocation
|
page read and write
|
||
|
EA2000
|
unkown
|
page execute and read and write
|
||
|
6CF80000
|
unkown
|
page readonly
|
||
|
35F0000
|
heap
|
page read and write
|
||
|
1D3FE000
|
stack
|
page read and write
|
||
|
1900000
|
heap
|
page read and write
|
||
|
1430000
|
heap
|
page read and write
|
||
|
1D13D000
|
stack
|
page read and write
|
||
|
EA0000
|
unkown
|
page readonly
|
||
|
31B1000
|
trusted library allocation
|
page read and write
|
||
|
15F3000
|
trusted library allocation
|
page execute and read and write
|
||
|
16A4000
|
heap
|
page read and write
|
||
|
1460000
|
heap
|
page read and write
|
||
|
16AF000
|
heap
|
page read and write
|
||
|
1850000
|
trusted library allocation
|
page execute and read and write
|
||
|
318F000
|
remote allocation
|
page execute and read and write
|
||
|
1604000
|
trusted library allocation
|
page read and write
|
||
|
4C89000
|
trusted library allocation
|
page read and write
|
||
|
1465000
|
heap
|
page read and write
|
||
|
3625000
|
heap
|
page read and write
|
||
|
2D9C000
|
stack
|
page read and write
|
||
|
311E000
|
remote allocation
|
page readonly
|
||
|
183F000
|
stack
|
page read and write
|
||
|
4760000
|
trusted library allocation
|
page read and write
|
||
|
161A000
|
trusted library allocation
|
page execute and read and write
|
||
|
522E000
|
stack
|
page read and write
|
||
|
1870000
|
heap
|
page read and write
|
||
|
31BB000
|
trusted library allocation
|
page read and write
|
||
|
6CF81000
|
unkown
|
page execute read
|
||
|
6D011000
|
unkown
|
page read and write
|
||
|
31BE000
|
trusted library allocation
|
page read and write
|
||
|
164A000
|
heap
|
page read and write
|
||
|
EA0000
|
unkown
|
page execute and read and write
|
||
|
582E000
|
stack
|
page read and write
|
||
|
30FE000
|
stack
|
page read and write
|
||
|
7980000
|
trusted library allocation
|
page read and write
|
||
|
1D510000
|
heap
|
page read and write
|
||
|
9EEF000
|
stack
|
page read and write
|
||
|
15F4000
|
trusted library allocation
|
page read and write
|
||
|
312B000
|
remote allocation
|
page execute and read and write
|
||
|
3188000
|
remote allocation
|
page execute and read and write
|
||
|
18F0000
|
trusted library section
|
page read and write
|
||
|
13E0000
|
heap
|
page read and write
|
||
|
1675000
|
heap
|
page read and write
|
||
|
6CFBD000
|
unkown
|
page readonly
|
||
|
6D014000
|
unkown
|
page readonly
|
||
|
31C3000
|
trusted library allocation
|
page read and write
|
||
|
3833000
|
heap
|
page read and write
|
||
|
3370000
|
heap
|
page read and write
|
||
|
3495000
|
heap
|
page read and write
|
||
|
1D37F000
|
stack
|
page read and write
|
||
|
34DE000
|
stack
|
page read and write
|
||
|
15E0000
|
trusted library allocation
|
page read and write
|
||
|
1627000
|
trusted library allocation
|
page execute and read and write
|
||
|
EF2000
|
unkown
|
page readonly
|
||
|
4335000
|
trusted library allocation
|
page read and write
|
||
|
162B000
|
trusted library allocation
|
page execute and read and write
|
||
|
1D23E000
|
stack
|
page read and write
|
||
|
31AE000
|
stack
|
page read and write
|
||
|
315A000
|
remote allocation
|
page execute and read and write
|
||
|
1300000
|
heap
|
page read and write
|
||
|
1D800000
|
trusted library allocation
|
page read and write
|
||
|
528E000
|
stack
|
page read and write
|
||
|
3460000
|
heap
|
page read and write
|
||
|
1CFFE000
|
stack
|
page read and write
|
||
|
1684000
|
heap
|
page read and write
|
||
|
3162000
|
remote allocation
|
page execute and read and write
|
||
|
166D000
|
heap
|
page read and write
|
||
|
F9C000
|
stack
|
page read and write
|
||
|
15AE000
|
stack
|
page read and write
|
||
|
56E0000
|
heap
|
page execute and read and write
|
||
|
1640000
|
heap
|
page read and write
|
||
|
1620000
|
trusted library allocation
|
page read and write
|
||
|
335C000
|
remote allocation
|
page readonly
|
||
|
156E000
|
stack
|
page read and write
|
||
|
EA2000
|
unkown
|
page readonly
|
||
|
43CC000
|
trusted library allocation
|
page read and write
|
||
|
9DED000
|
stack
|
page read and write
|
There are 121 hidden memdumps, click here to show them.