Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Scvi1cE64H.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Scvi1cE64H.exe_537799a119593c51a7c98839cb49112e54d5a1_25581918_587c2259-09a0-462d-a0b2-15feb988b233\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\SystemBootComponent.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE1A.tmp.dmp
|
Mini DuMP crash report, 16 streams, Sat Nov 23 20:03:21 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF05D.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF09D.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Log.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemBootComponent.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Nov 23 19:02:00
2024, mtime=Sat Nov 23 19:02:00 2024, atime=Sat Nov 23 19:02:00 2024, length=71680, window=hide
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Scvi1cE64H.exe
|
"C:\Users\user\Desktop\Scvi1cE64H.exe"
|
|
|
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 5016 -s 1936
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
81.161.238.249
|
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
81.161.238.249
|
unknown
|
Germany
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
ProgramId
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
FileId
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
LongPathHash
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
Name
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
OriginalFileName
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
Publisher
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
Version
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
BinFileVersion
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
BinaryType
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
ProductName
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
ProductVersion
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
LinkDate
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
BinProductVersion
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
Size
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
Language
|
||
|
\REGISTRY\A\{d604110f-aae4-378b-0fa4-b859d89c22b0}\Root\InventoryApplicationFile\scvi1ce64h.exe|b552ae84ea5a6a9c
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
5E2000
|
unkown
|
page readonly
|
|
|
|
28B1000
|
trusted library allocation
|
page read and write
|
|
|
|
1BB4B000
|
stack
|
page read and write
|
||
|
2753000
|
heap
|
page read and write
|
||
|
1C41A000
|
stack
|
page read and write
|
||
|
5E0000
|
unkown
|
page readonly
|
||
|
1BDE0000
|
heap
|
page read and write
|
||
|
9FE000
|
heap
|
page read and write
|
||
|
A59000
|
heap
|
page read and write
|
||
|
1B3CE000
|
stack
|
page read and write
|
||
|
7FFD34846000
|
trusted library allocation
|
page read and write
|
||
|
128C2000
|
trusted library allocation
|
page read and write
|
||
|
7FFD347A0000
|
trusted library allocation
|
page read and write
|
||
|
99C000
|
heap
|
page read and write
|
||
|
1BA05000
|
stack
|
page read and write
|
||
|
A08000
|
heap
|
page read and write
|
||
|
128B8000
|
trusted library allocation
|
page read and write
|
||
|
E20000
|
heap
|
page read and write
|
||
|
7FFD347B4000
|
trusted library allocation
|
page read and write
|
||
|
28A0000
|
heap
|
page read and write
|
||
|
BA5000
|
heap
|
page read and write
|
||
|
1B789000
|
heap
|
page read and write
|
||
|
BA0000
|
heap
|
page read and write
|
||
|
E25000
|
heap
|
page read and write
|
||
|
9C1000
|
heap
|
page read and write
|
||
|
1B6CD000
|
stack
|
page read and write
|
||
|
9D4000
|
heap
|
page read and write
|
||
|
B60000
|
heap
|
page read and write
|
||
|
990000
|
heap
|
page read and write
|
||
|
1B730000
|
heap
|
page read and write
|
||
|
2760000
|
heap
|
page execute and read and write
|
||
|
26E0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34876000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B793000
|
heap
|
page read and write
|
||
|
7FFD34793000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C31B000
|
stack
|
page read and write
|
||
|
1C1DD000
|
stack
|
page read and write
|
||
|
1A8E0000
|
trusted library allocation
|
page read and write
|
||
|
7FF45E0A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
9BB000
|
heap
|
page read and write
|
||
|
7FFD34850000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C61C000
|
stack
|
page read and write
|
||
|
1AE3C000
|
stack
|
page read and write
|
||
|
7FFD347EC000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD348B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B2C0000
|
heap
|
page execute and read and write
|
||
|
931000
|
stack
|
page read and write
|
||
|
E00000
|
trusted library allocation
|
page read and write
|
||
|
1AC3C000
|
heap
|
page read and write
|
||
|
7FFD34840000
|
trusted library allocation
|
page read and write
|
||
|
1B4CE000
|
stack
|
page read and write
|
||
|
1BA10000
|
heap
|
page read and write
|
||
|
1B8CE000
|
stack
|
page read and write
|
||
|
7FFD34940000
|
trusted library allocation
|
page read and write
|
||
|
9D1000
|
heap
|
page read and write
|
||
|
1BD44000
|
stack
|
page read and write
|
||
|
1B8FF000
|
stack
|
page read and write
|
||
|
7FFD347BD000
|
trusted library allocation
|
page execute and read and write
|
||
|
980000
|
heap
|
page read and write
|
||
|
286F000
|
stack
|
page read and write
|
||
|
7FFD34794000
|
trusted library allocation
|
page read and write
|
||
|
7FFD3484C000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD34950000
|
trusted library allocation
|
page execute and read and write
|
||
|
9C3000
|
heap
|
page read and write
|
||
|
DB0000
|
heap
|
page read and write
|
||
|
26D0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD34932000
|
trusted library allocation
|
page read and write
|
||
|
1B732000
|
heap
|
page read and write
|
||
|
7FFD347B0000
|
trusted library allocation
|
page read and write
|
||
|
26E3000
|
trusted library allocation
|
page read and write
|
||
|
1BC48000
|
stack
|
page read and write
|
||
|
7FFD34790000
|
trusted library allocation
|
page read and write
|
||
|
DAC000
|
stack
|
page read and write
|
||
|
1B5CE000
|
stack
|
page read and write
|
||
|
CAC000
|
stack
|
page read and write
|
||
|
1C21F000
|
stack
|
page read and write
|
||
|
2750000
|
heap
|
page read and write
|
||
|
1B6D0000
|
heap
|
page read and write
|
||
|
996000
|
heap
|
page read and write
|
||
|
1B790000
|
heap
|
page read and write
|
||
|
5F4000
|
unkown
|
page readonly
|
||
|
B80000
|
heap
|
page read and write
|
||
|
7FFD347A3000
|
trusted library allocation
|
page read and write
|
||
|
128B1000
|
trusted library allocation
|
page read and write
|
||
|
7FFD347AD000
|
trusted library allocation
|
page execute and read and write
|
||
|
F2E000
|
stack
|
page read and write
|
||
|
1BDAF000
|
stack
|
page read and write
|
||
|
5E0000
|
unkown
|
page readonly
|
||
|
7FFD3479D000
|
trusted library allocation
|
page execute and read and write
|
There are 79 hidden memdumps, click here to show them.