Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_819e5e45b8a757e26ca9bd44e6d9284b79b3342d_a5cec3f2_4ab8625c-119a-4837-903c-777f0b7ed8e0\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF56B.tmp.dmp
|
Mini DuMP crash report, 14 streams, Fri Oct 25 19:52:30 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6B5.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6D5.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 1516
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://185.215.113.37/
|
185.215.113.37
|
|
|
|
http://185.215.113.37/A&
|
unknown
|
|
|
|
http://185.215.113.37
|
unknown
|
|
|
|
http://185.215.113.37/e2b1563c6670f193.php
|
|
||
|
http://185.215.113.37/7
|
unknown
|
|
|
|
http://185.215.113.37/I&
|
unknown
|
|
|
|
http://185.215.113.37/z
|
unknown
|
|
|
|
http://upx.sf.net
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
185.215.113.37
|
unknown
|
Portugal
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
ProgramId
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
FileId
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
LowerCaseLongPath
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
LongPathHash
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Name
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
OriginalFileName
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Publisher
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Version
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
BinFileVersion
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
BinaryType
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
ProductName
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
ProductVersion
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
LinkDate
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
BinProductVersion
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
AppxPackageFullName
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
AppxPackageRelativeId
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Size
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Language
|
|
|
|
\REGISTRY\A\{e5ebfc10-e8f2-793c-4802-6874f3781d8e}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Usn
|
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
26E000
|
heap
|
page read and write
|
|
|
|
49B0000
|
direct allocation
|
page read and write
|
|
|
|
41A000
|
unkown
|
page execute and read and write
|
|
|
|
381000
|
unkown
|
page execute and read and write
|
|
|
|
34EF000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
33AF000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
3DA000
|
unkown
|
page execute and read and write
|
||
|
4B30000
|
direct allocation
|
page execute and read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4B10000
|
direct allocation
|
page execute and read and write
|
||
|
1CFD3000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4990000
|
heap
|
page read and write
|
||
|
19E000
|
stack
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
2920000
|
heap
|
page read and write
|
||
|
4B20000
|
direct allocation
|
page execute and read and write
|
||
|
4B20000
|
direct allocation
|
page execute and read and write
|
||
|
381000
|
unkown
|
page execute and write copy
|
||
|
4531000
|
heap
|
page read and write
|
||
|
442E000
|
stack
|
page read and write
|
||
|
28DE000
|
stack
|
page read and write
|
||
|
326E000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
2C6E000
|
stack
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
1D0F0000
|
trusted library allocation
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
2DAE000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
3B2F000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
42EE000
|
stack
|
page read and write
|
||
|
2D6F000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
1CA9E000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
402F000
|
stack
|
page read and write
|
||
|
405000
|
unkown
|
page execute and read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
3C6F000
|
stack
|
page read and write
|
||
|
39EF000
|
stack
|
page read and write
|
||
|
316E000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
1CD2D000
|
stack
|
page read and write
|
||
|
240000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
29B000
|
heap
|
page read and write
|
||
|
1CB9F000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
86D000
|
unkown
|
page execute and write copy
|
||
|
26A000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
1CE6D000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
B9E000
|
stack
|
page read and write
|
||
|
408000
|
unkown
|
page execute and read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
3DAF000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
380000
|
unkown
|
page readonly
|
||
|
3CAE000
|
stack
|
page read and write
|
||
|
85E000
|
unkown
|
page execute and read and write
|
||
|
B1E000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
2EAF000
|
stack
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
1CCDF000
|
stack
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
4550000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
86C000
|
unkown
|
page execute and read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
37AE000
|
stack
|
page read and write
|
||
|
4AEF000
|
stack
|
page read and write
|
||
|
1C81E000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
82C000
|
unkown
|
page execute and read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
B5D000
|
stack
|
page read and write
|
||
|
1CF6D000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
2E1000
|
heap
|
page read and write
|
||
|
260000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
32AE000
|
stack
|
page read and write
|
||
|
4537000
|
heap
|
page read and write
|
||
|
3A2E000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
406E000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
BF0000
|
direct allocation
|
page read and write
|
||
|
9FD000
|
unkown
|
page execute and read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
2A2F000
|
stack
|
page read and write
|
||
|
2D5000
|
heap
|
page read and write
|
||
|
BF0000
|
direct allocation
|
page read and write
|
||
|
754000
|
unkown
|
page execute and read and write
|
||
|
40F000
|
unkown
|
page execute and read and write
|
||
|
86C000
|
unkown
|
page execute and write copy
|
||
|
195000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
42AF000
|
stack
|
page read and write
|
||
|
1C91F000
|
stack
|
page read and write
|
||
|
FFE000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
3DEE000
|
stack
|
page read and write
|
||
|
362F000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
851000
|
unkown
|
page execute and read and write
|
||
|
4AF0000
|
direct allocation
|
page execute and read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
2927000
|
heap
|
page read and write
|
||
|
4530000
|
heap
|
page read and write
|
||
|
9FE000
|
unkown
|
page execute and write copy
|
||
|
376F000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4970000
|
trusted library allocation
|
page read and write
|
||
|
1CE2D000
|
stack
|
page read and write
|
||
|
3F2E000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
5CA000
|
unkown
|
page execute and read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
352E000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4540000
|
heap
|
page read and write
|
||
|
2B4000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
1C95D000
|
stack
|
page read and write
|
||
|
416F000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4B00000
|
direct allocation
|
page execute and read and write
|
||
|
5DE000
|
unkown
|
page execute and read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
2EEE000
|
stack
|
page read and write
|
||
|
292B000
|
heap
|
page read and write
|
||
|
33EE000
|
stack
|
page read and write
|
||
|
1CBDE000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
1CA5F000
|
stack
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
38AF000
|
stack
|
page read and write
|
||
|
3B6D000
|
stack
|
page read and write
|
||
|
302E000
|
stack
|
page read and write
|
||
|
2FEF000
|
stack
|
page read and write
|
||
|
289F000
|
stack
|
page read and write
|
||
|
366E000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
2B2F000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
291E000
|
stack
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
2AE000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
360000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page execute and read and write
|
||
|
38EE000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
3E2000
|
unkown
|
page execute and read and write
|
||
|
452F000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
BDB000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
370000
|
direct allocation
|
page read and write
|
||
|
2C7000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
EFF000
|
stack
|
page read and write
|
||
|
41AE000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
312F000
|
stack
|
page read and write
|
||
|
3EEF000
|
stack
|
page read and write
|
||
|
244000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
43EF000
|
stack
|
page read and write
|
||
|
4531000
|
heap
|
page read and write
|
||
|
380000
|
unkown
|
page read and write
|
||
|
49EB000
|
stack
|
page read and write
|
||
|
2C2F000
|
stack
|
page read and write
|
||
|
200000
|
heap
|
page read and write
|
There are 224 hidden memdumps, click here to show them.