Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_3524697aa2453b3e919c4615a9f9b77b6fec82a_95c5483c_7625f84b-010b-4c55-8b33-ee1b0c902343\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER32F8.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sun Nov 24 02:21:58 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER36F0.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3730.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 1460
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://upx.sf.net
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
ProgramId
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
FileId
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
LongPathHash
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Name
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
OriginalFileName
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Publisher
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Version
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
BinFileVersion
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
BinaryType
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
ProductName
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
ProductVersion
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
LinkDate
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
BinProductVersion
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Size
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Language
|
||
|
\REGISTRY\A\{13844ff6-70a0-9295-f2a7-5e107a1c561c}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
5BCE000
|
stack
|
page read and write
|
||
|
2CF4000
|
heap
|
page read and write
|
||
|
5C1000
|
unkown
|
page execute read
|
||
|
682000
|
unkown
|
page read and write
|
||
|
496B000
|
stack
|
page read and write
|
||
|
4860000
|
heap
|
page read and write
|
||
|
6133000
|
heap
|
page read and write
|
||
|
6193000
|
heap
|
page read and write
|
||
|
48AC000
|
stack
|
page read and write
|
||
|
6194000
|
heap
|
page read and write
|
||
|
60CF000
|
stack
|
page read and write
|
||
|
6160000
|
heap
|
page read and write
|
||
|
4980000
|
heap
|
page read and write
|
||
|
67D000
|
unkown
|
page write copy
|
||
|
5C0000
|
unkown
|
page readonly
|
||
|
2CF4000
|
heap
|
page read and write
|
||
|
68B000
|
unkown
|
page readonly
|
||
|
486A000
|
heap
|
page read and write
|
||
|
598D000
|
stack
|
page read and write
|
||
|
2CF4000
|
heap
|
page read and write
|
||
|
56D0000
|
heap
|
page read and write
|
||
|
59CE000
|
stack
|
page read and write
|
||
|
302E000
|
stack
|
page read and write
|
||
|
6146000
|
heap
|
page read and write
|
||
|
2F87000
|
heap
|
page read and write
|
||
|
614C000
|
heap
|
page read and write
|
||
|
5C0000
|
unkown
|
page readonly
|
||
|
5A11000
|
heap
|
page read and write
|
||
|
67B000
|
unkown
|
page read and write
|
||
|
2C38000
|
stack
|
page read and write
|
||
|
616E000
|
heap
|
page read and write
|
||
|
695000
|
unkown
|
page write copy
|
||
|
2CE0000
|
heap
|
page read and write
|
||
|
6172000
|
heap
|
page read and write
|
||
|
2F84000
|
heap
|
page read and write
|
||
|
6178000
|
heap
|
page read and write
|
||
|
5A0F000
|
stack
|
page read and write
|
||
|
613E000
|
heap
|
page read and write
|
||
|
6129000
|
heap
|
page read and write
|
||
|
60D0000
|
heap
|
page read and write
|
||
|
2ED9000
|
heap
|
page read and write
|
||
|
5D2F000
|
stack
|
page read and write
|
||
|
613B000
|
heap
|
page read and write
|
||
|
68B000
|
unkown
|
page readonly
|
||
|
594B000
|
stack
|
page read and write
|
||
|
799A000
|
heap
|
page read and write
|
||
|
5B8B000
|
stack
|
page read and write
|
||
|
2F48000
|
heap
|
page read and write
|
||
|
2E8E000
|
stack
|
page read and write
|
||
|
2C7C000
|
stack
|
page read and write
|
||
|
6125000
|
heap
|
page read and write
|
||
|
2E4D000
|
stack
|
page read and write
|
||
|
2FEE000
|
stack
|
page read and write
|
||
|
4866000
|
heap
|
page read and write
|
||
|
F334000
|
heap
|
page read and write
|
||
|
580B000
|
stack
|
page read and write
|
||
|
696000
|
unkown
|
page readonly
|
||
|
619C000
|
heap
|
page read and write
|
||
|
5A10000
|
heap
|
page read and write
|
||
|
5A11000
|
heap
|
page read and write
|
||
|
5B30000
|
heap
|
page read and write
|
||
|
48EF000
|
stack
|
page read and write
|
||
|
2EB0000
|
heap
|
page read and write
|
||
|
2E0E000
|
stack
|
page read and write
|
||
|
4900000
|
heap
|
page read and write
|
||
|
617E000
|
heap
|
page read and write
|
||
|
608E000
|
stack
|
page read and write
|
||
|
2CF4000
|
heap
|
page read and write
|
||
|
306F000
|
stack
|
page read and write
|
||
|
2CD0000
|
heap
|
page read and write
|
||
|
617F000
|
heap
|
page read and write
|
||
|
4910000
|
heap
|
page read and write
|
||
|
5A22000
|
heap
|
page read and write
|
||
|
2CF5000
|
heap
|
page read and write
|
||
|
58CB000
|
stack
|
page read and write
|
||
|
5CEE000
|
stack
|
page read and write
|
||
|
590F000
|
stack
|
page read and write
|
||
|
67B000
|
unkown
|
page write copy
|
||
|
2F98000
|
heap
|
page read and write
|
||
|
689000
|
unkown
|
page read and write
|
||
|
2CF0000
|
heap
|
page read and write
|
||
|
2EB8000
|
heap
|
page read and write
|
||
|
4984000
|
heap
|
page read and write
|
||
|
611E000
|
heap
|
page read and write
|
||
|
5C1000
|
unkown
|
page execute read
|
||
|
4E40000
|
trusted library allocation
|
page read and write
|
There are 76 hidden memdumps, click here to show them.