Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_e12877fd784066db4a7d50c47aa9ae87834a8bd8_ccf28a54_44b0b5b5-23f4-41d7-95d4-4bc25a2a619a\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4263.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 29 16:08:39 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER43DB.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER43FB.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 1532
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://185.215.113.206/6c4adf523b719729.php
|
|
||
|
http://185.215.113.206/
|
185.215.113.206
|
|
|
|
http://185.215.113.206
|
unknown
|
|
|
|
http://upx.sf.net
|
unknown
|
||
|
http://185.215.113.206JX
|
unknown
|
||
|
http://185.215.113.206/Y
|
unknown
|
||
|
http://185.215.113.206/%
|
unknown
|
||
|
https://docs.rs/getrandom#nodejs-es-module-support
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
185.215.113.206
|
unknown
|
Portugal
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
ProgramId
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
FileId
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
LowerCaseLongPath
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
LongPathHash
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
Name
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
OriginalFileName
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
Publisher
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
Version
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
BinFileVersion
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
BinaryType
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
ProductName
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
ProductVersion
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
LinkDate
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
BinProductVersion
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
AppxPackageFullName
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
AppxPackageRelativeId
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
Size
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
Language
|
|
|
|
\REGISTRY\A\{239972e5-fe85-7658-f1f6-09b1bf00d28a}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
|
Usn
|
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
531000
|
unkown
|
page execute and read and write
|
|
|
|
4EB0000
|
direct allocation
|
page read and write
|
|
|
|
656000
|
unkown
|
page execute and read and write
|
|
|
|
11DE000
|
heap
|
page read and write
|
|
|
|
48EE000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
AC0000
|
unkown
|
page execute and read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
39EE000
|
stack
|
page read and write
|
||
|
4EB0000
|
direct allocation
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
462F000
|
stack
|
page read and write
|
||
|
3DAE000
|
stack
|
page read and write
|
||
|
5020000
|
direct allocation
|
page execute and read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
34EE000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
1D32E000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
326E000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
D70000
|
heap
|
page read and write
|
||
|
4DC000
|
stack
|
page read and write
|
||
|
402E000
|
stack
|
page read and write
|
||
|
5030000
|
direct allocation
|
page execute and read and write
|
||
|
2C4C000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
2FEF000
|
stack
|
page read and write
|
||
|
35EF000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
3C6E000
|
stack
|
page read and write
|
||
|
4EDB000
|
direct allocation
|
page read and write
|
||
|
531000
|
unkown
|
page execute and write copy
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
3B2E000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
5060000
|
direct allocation
|
page execute and read and write
|
||
|
4FEF000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
616000
|
unkown
|
page execute and read and write
|
||
|
D6F000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
81A000
|
unkown
|
page execute and read and write
|
||
|
130E000
|
stack
|
page read and write
|
||
|
2CD0000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
2EEF000
|
stack
|
page read and write
|
||
|
5000000
|
direct allocation
|
page execute and read and write
|
||
|
1244000
|
heap
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
42AE000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
D65000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
3EAF000
|
stack
|
page read and write
|
||
|
1D5F0000
|
trusted library allocation
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A23000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
5040000
|
direct allocation
|
page execute and read and write
|
||
|
466E000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
1222000
|
heap
|
page read and write
|
||
|
2CEB000
|
heap
|
page read and write
|
||
|
476F000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
2CE7000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
2DEF000
|
stack
|
page read and write
|
||
|
426F000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
1D46D000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
3EEE000
|
stack
|
page read and write
|
||
|
43EE000
|
stack
|
page read and write
|
||
|
1CF3F000
|
stack
|
page read and write
|
||
|
DB5000
|
heap
|
page read and write
|
||
|
1D36D000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
C65000
|
unkown
|
page execute and write copy
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
DFE000
|
stack
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
49F0000
|
heap
|
page read and write
|
||
|
C64000
|
unkown
|
page execute and read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
2C8E000
|
stack
|
page read and write
|
||
|
4EEC000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
33AE000
|
stack
|
page read and write
|
||
|
1257000
|
heap
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
AB2000
|
unkown
|
page execute and read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
1D22D000
|
stack
|
page read and write
|
||
|
641000
|
unkown
|
page execute and read and write
|
||
|
322F000
|
stack
|
page read and write
|
||
|
5010000
|
direct allocation
|
page execute and read and write
|
||
|
2CE0000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
1CF7E000
|
stack
|
page read and write
|
||
|
4B20000
|
trusted library allocation
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
49EF000
|
stack
|
page read and write
|
||
|
336F000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
3D6F000
|
stack
|
page read and write
|
||
|
11D0000
|
heap
|
page read and write
|
||
|
44EF000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
39AF000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
AC1000
|
unkown
|
page execute and write copy
|
||
|
5030000
|
direct allocation
|
page execute and read and write
|
||
|
312E000
|
stack
|
page read and write
|
||
|
11CF000
|
stack
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
9A6000
|
unkown
|
page execute and read and write
|
||
|
4EB0000
|
direct allocation
|
page read and write
|
||
|
55C000
|
unkown
|
page execute and read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
376E000
|
stack
|
page read and write
|
||
|
3C2F000
|
stack
|
page read and write
|
||
|
2CCE000
|
stack
|
page read and write
|
||
|
386F000
|
stack
|
page read and write
|
||
|
412F000
|
stack
|
page read and write
|
||
|
5050000
|
direct allocation
|
page execute and read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
1D0EE000
|
stack
|
page read and write
|
||
|
140E000
|
stack
|
page read and write
|
||
|
38AE000
|
stack
|
page read and write
|
||
|
503E000
|
stack
|
page read and write
|
||
|
372F000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
362E000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
530000
|
unkown
|
page read and write
|
||
|
43AF000
|
stack
|
page read and write
|
||
|
1CE3E000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
34AF000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
416E000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
2C0E000
|
stack
|
page read and write
|
||
|
5030000
|
direct allocation
|
page execute and read and write
|
||
|
4A40000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
1CDFF000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
48AF000
|
stack
|
page read and write
|
||
|
530000
|
unkown
|
page readonly
|
||
|
47AE000
|
stack
|
page read and write
|
||
|
3AEF000
|
stack
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
A86000
|
unkown
|
page execute and read and write
|
||
|
AC0000
|
unkown
|
page execute and write copy
|
||
|
64B000
|
unkown
|
page execute and read and write
|
||
|
11DA000
|
heap
|
page read and write
|
||
|
4A20000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
1239000
|
heap
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
1D4D3000
|
heap
|
page read and write
|
||
|
452E000
|
stack
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
DB0000
|
heap
|
page read and write
|
||
|
3FEF000
|
stack
|
page read and write
|
||
|
644000
|
unkown
|
page execute and read and write
|
||
|
4A30000
|
heap
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
1D1EF000
|
stack
|
page read and write
|
||
|
4A10000
|
direct allocation
|
page read and write
|
||
|
61E000
|
unkown
|
page execute and read and write
|
||
|
1D07E000
|
stack
|
page read and write
|
||
|
AAA000
|
unkown
|
page execute and read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
30EF000
|
stack
|
page read and write
|
There are 202 hidden memdumps, click here to show them.