Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Ljrfk7uRvO.exe
|
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Ljrfk7uRvO.exe_46e1d5682d2aaed3ce5311f53ec99cd11ab55ee5_0a3509db_6478054e-9102-4016-9df3-992504b8e67a\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER74FD.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sat Oct 26 07:11:45 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER759A.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER75DA.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Ljrfk7uRvO.exe
|
"C:\Users\user\Desktop\Ljrfk7uRvO.exe"
|
|
|
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 5916 -s 1112
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://20.25.126.96/Sp6d
|
|
||
|
http://20.25.126.96:443/Sp6d
|
|
||
|
https://20.25.126.96/Sp6dbJ
|
unknown
|
||
|
https://20.25.126.96/Sp6d
|
unknown
|
||
|
https://20.25.126.96/Sp6d$
|
unknown
|
||
|
https://20.25.126.96/Sp6dSpace_G
|
unknown
|
||
|
https://20.25.126.96/
|
unknown
|
||
|
https://20.25.126.96/p
|
unknown
|
||
|
https://20.25.126.96/t
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
https://20.25.126.96/k
|
unknown
|
||
|
https://20.25.126.96/chedvmbusRFCOMM
|
unknown
|
||
|
https://20.25.126.96/p6d
|
unknown
|
||
|
https://20.25.126.96/f
|
unknown
|
There are 4 hidden URLs, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
20.25.126.96
|
unknown
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
ProgramId
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
FileId
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
LongPathHash
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
Name
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
OriginalFileName
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
Publisher
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
Version
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
BinFileVersion
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
BinaryType
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
ProductName
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
ProductVersion
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
LinkDate
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
BinProductVersion
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
Size
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
Language
|
||
|
\REGISTRY\A\{6d3e0678-456b-46f0-c44d-4d9760832e1d}\Root\InventoryApplicationFile\ljrfk7urvo.exe|320e7d98f9feaac0
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
D0000
|
direct allocation
|
page execute read
|
|
|
|
106000
|
heap
|
page read and write
|
||
|
9F5000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
405000
|
unkown
|
page readonly
|
||
|
9F0000
|
heap
|
page read and write
|
||
|
32DD000
|
stack
|
page read and write
|
||
|
18F000
|
heap
|
page read and write
|
||
|
18F000
|
heap
|
page read and write
|
||
|
18F000
|
heap
|
page read and write
|
||
|
18F000
|
heap
|
page read and write
|
||
|
17E000
|
heap
|
page read and write
|
||
|
157000
|
heap
|
page read and write
|
||
|
404000
|
unkown
|
page write copy
|
||
|
2EDE000
|
stack
|
page read and write
|
||
|
18F000
|
heap
|
page read and write
|
||
|
198000
|
heap
|
page read and write
|
||
|
DFA000
|
stack
|
page read and write
|
||
|
404000
|
unkown
|
page read and write
|
||
|
405000
|
unkown
|
page readonly
|
||
|
BFE000
|
stack
|
page read and write
|
||
|
9A0000
|
remote allocation
|
page read and write
|
||
|
60D000
|
stack
|
page read and write
|
||
|
80000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
409000
|
unkown
|
page read and write
|
||
|
30DF000
|
stack
|
page read and write
|
||
|
9A0000
|
remote allocation
|
page read and write
|
||
|
164000
|
heap
|
page read and write
|
||
|
10C000
|
heap
|
page read and write
|
||
|
9A0000
|
remote allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
90000
|
heap
|
page read and write
|
||
|
2ADF000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
18F000
|
heap
|
page read and write
|
||
|
34D8000
|
stack
|
page read and write
|
||
|
8DE000
|
stack
|
page read and write
|
||
|
B0000
|
heap
|
page read and write
|
||
|
15C000
|
heap
|
page read and write
|
||
|
198000
|
heap
|
page read and write
|
||
|
409000
|
unkown
|
page write copy
|
||
|
100000
|
heap
|
page read and write
|
||
|
198000
|
heap
|
page read and write
|
||
|
36DD000
|
stack
|
page read and write
|
||
|
2CDF000
|
stack
|
page read and write
|
There are 36 hidden memdumps, click here to show them.