IOC Report
p9VvTmGme1.exe

loading gif

Files

File Path
Type
Category
Malicious
p9VvTmGme1.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_p9VvTmGme1.exe_db9b4fca6c7682ed189f2c322924767e2d83b5_03769bf0_3b7986bd-4838-47b9-bb6f-b0c37ba8efb7\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER84FA.tmp.dmp
Mini DuMP crash report, 16 streams, Sat Oct 26 20:49:25 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER85F5.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8625.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\p9VvTmGme1.exe
"C:\Users\user\Desktop\p9VvTmGme1.exe"
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 6176 -s 676

URLs

Name
IP
Malicious
https://ipinfo.io/country
unknown
http://xilloolli.com/api.phpEhttp://xilloolli.com/api-debug.php
unknown
http://upx.sf.net
unknown
https://rafadaiart.com
unknown
https://ipinfo.io/ip
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
ProgramId
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
FileId
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
LowerCaseLongPath
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
LongPathHash
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
Name
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
OriginalFileName
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
Publisher
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
Version
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
BinFileVersion
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
BinaryType
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
ProductName
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
ProductVersion
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
LinkDate
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
BinProductVersion
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
AppxPackageFullName
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
AppxPackageRelativeId
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
Size
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
Language
\REGISTRY\A\{58a6a3e4-8926-ec56-04db-92d0c07700ae}\Root\InventoryApplicationFile\p9vvtmgme1.exe|983e685f305649f
Usn
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
25C26E32000
unkown
page readonly
 malicious
25C27000000
heap
page read and write
25C26EE0000
heap
page read and write
7FF4051B0000
trusted library allocation
page execute and read and write
25C274B5000
heap
page read and write
7FF848FB0000
trusted library allocation
page read and write
7FF848E1D000
trusted library allocation
page execute and read and write
25C27060000
heap
page read and write
7FF848ED0000
trusted library allocation
page execute and read and write
25C2710A000
heap
page read and write
7FF848E14000
trusted library allocation
page read and write
7CBB9ED000
stack
page read and write
7CBBDFF000
stack
page read and write
25C2710F000
heap
page read and write
7CBCDFD000
stack
page read and write
25C26FE0000
heap
page read and write
25C27086000
heap
page read and write
25C26E54000
unkown
page readonly
25C2709C000
heap
page read and write
25C26FC0000
heap
page read and write
25C38C13000
trusted library allocation
page read and write
25C27101000
heap
page read and write
7FF848F30000
trusted library allocation
page execute and read and write
25C38C11000
trusted library allocation
page read and write
7CBC1FE000
stack
page read and write
25C272B0000
heap
page read and write
25C27180000
heap
page read and write
25C27088000
heap
page read and write
25C28C11000
trusted library allocation
page read and write
7FF848E24000
trusted library allocation
page read and write
25C270C9000
heap
page read and write
7FF848EC0000
trusted library allocation
page read and write
25C28C00000
heap
page execute and read and write
25C2709E000
heap
page read and write
25C27170000
trusted library allocation
page read and write
7CBC9FE000
stack
page read and write
25C274B0000
heap
page read and write
7CBC5FF000
stack
page read and write
25C26E44000
unkown
page readonly
25C27240000
heap
page read and write
7FF848EF6000
trusted library allocation
page execute and read and write
25C27069000
heap
page read and write
25C27050000
trusted library allocation
page read and write
7FF848E22000
trusted library allocation
page read and write
25C27090000
heap
page read and write
25C26E30000
unkown
page readonly
There are 36 hidden memdumps, click here to show them.