IOC Report
5Dw2hTQmiB.exe

loading gif

Files

File Path
Type
Category
Malicious
5Dw2hTQmiB.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5Dw2hTQmiB.exe_f9589b50e1a4a5348722d7f4bf92a1dd5f324c_ae7bb326_5ec02e5e-f042-4993-94d7-6d268217831f\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA8B4.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:32:17 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA5A.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA8A.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\5Dw2hTQmiB.exe
"C:\Users\user\Desktop\5Dw2hTQmiB.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6988 -s 1624

URLs

Name
IP
Malicious
pushjellysingeywus.shop
malicious
bordersoarmanusjuw.shop
malicious
economicscreateojsu.shop
malicious
wifeplasterbakewis.shop
malicious
exceptionwillapews.shop
malicious
suitcaseacanehalk.shop
malicious
entitlementappwo.shop
malicious
https://exceptionwillapews.shop/api
104.21.44.10
 malicious
mealplayerpreceodsju.shop
malicious
absentconvicsjawun.shop
malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://exceptionwillapews.shop/sm
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://exceptionwillapews.shop/apiM
unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://ocsp.rootca1.amazontrust.com0:
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://exceptionwillapews.shop/kdh
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://exceptionwillapews.shop/2
unknown
https://exceptionwillapews.shop/RR
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.microsof
unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?
unknown
https://exceptionwillapews.shop/s
unknown
https://exceptionwillapews.shop/apiO
unknown
https://exceptionwillapews.shop/
unknown
https://support.mozilla.org/products/firefoxgro.all
unknown
https://exceptionwillapews.shop/api%
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 33 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
exceptionwillapews.shop
104.21.44.10
 malicious

IPs

IP
Domain
Country
Malicious
104.21.44.10
exceptionwillapews.shop
United States
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
ProgramId
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
FileId
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
LowerCaseLongPath
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
LongPathHash
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
Name
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
OriginalFileName
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
Publisher
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
Version
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
BinFileVersion
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
BinaryType
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
ProductName
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
ProductVersion
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
LinkDate
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
BinProductVersion
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
AppxPackageFullName
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
AppxPackageRelativeId
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
Size
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
Language
\REGISTRY\A\{1f0d207f-f1d0-b3b5-2ee1-a87cada69bff}\Root\InventoryApplicationFile\5dw2htqmib.exe|f312f02e8a527263
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4930000
direct allocation
page read and write
 malicious
5483000
trusted library allocation
page read and write
5432000
trusted library allocation
page read and write
5531000
trusted library allocation
page read and write
542D000
trusted library allocation
page read and write
308C000
heap
page read and write
2E9F000
stack
page read and write
55FA000
trusted library allocation
page read and write
5432000
trusted library allocation
page read and write
5427000
trusted library allocation
page read and write
5421000
trusted library allocation
page read and write
5466000
trusted library allocation
page read and write
5455000
trusted library allocation
page read and write
496E000
stack
page read and write
308E000
heap
page read and write
5432000
trusted library allocation
page read and write
5461000
trusted library allocation
page read and write
5461000
trusted library allocation
page read and write
2C2F000
unkown
page readonly
2F50000
remote allocation
page read and write
5432000
trusted library allocation
page read and write
306C000
heap
page read and write
5430000
trusted library allocation
page read and write
542F000
trusted library allocation
page read and write
5439000
trusted library allocation
page read and write
5428000
trusted library allocation
page read and write
5483000
trusted library allocation
page read and write
546F000
trusted library allocation
page read and write
54F0000
trusted library allocation
page read and write
543F000
trusted library allocation
page read and write
5485000
trusted library allocation
page read and write
542A000
trusted library allocation
page read and write
5457000
trusted library allocation
page read and write
2FFC000
heap
page read and write
577F000
stack
page read and write
3083000
heap
page read and write
54F0000
trusted library allocation
page read and write
5427000
trusted library allocation
page read and write
5425000
trusted library allocation
page read and write
543A000
trusted library allocation
page read and write
400000
unkown
page readonly
5521000
heap
page read and write
542C000
trusted library allocation
page read and write
5460000
trusted library allocation
page read and write
400000
unkown
page execute and read and write
308E000
heap
page read and write
4E3F000
stack
page read and write
5478000
trusted library allocation
page read and write
5464000
trusted library allocation
page read and write
54B4000
trusted library allocation
page read and write
3084000
heap
page read and write
543F000
trusted library allocation
page read and write
5421000
trusted library allocation
page read and write
5436000
trusted library allocation
page read and write
5421000
trusted library allocation
page read and write
546E000
trusted library allocation
page read and write
5430000
trusted library allocation
page read and write
3083000
heap
page read and write
4BFE000
stack
page read and write
5427000
trusted library allocation
page read and write
5430000
trusted library allocation
page read and write
3088000
heap
page read and write
54A2000
trusted library allocation
page read and write
40C000
unkown
page readonly
4D3E000
stack
page read and write
5457000
trusted library allocation
page read and write
547C000
trusted library allocation
page read and write
5468000
trusted library allocation
page read and write
5476000
trusted library allocation
page read and write
5426000
trusted library allocation
page read and write
5420000
trusted library allocation
page read and write
5452000
trusted library allocation
page read and write
5450000
trusted library allocation
page read and write
2FE0000
heap
page read and write
5485000
trusted library allocation
page read and write
547C000
trusted library allocation
page read and write
5421000
trusted library allocation
page read and write
3075000
heap
page read and write
318F000
stack
page read and write
5441000
trusted library allocation
page read and write
5431000
trusted library allocation
page read and write
3006000
heap
page read and write
547B000
trusted library allocation
page read and write
5462000
trusted library allocation
page read and write
197000
stack
page read and write
401000
unkown
page execute read
4BBE000
stack
page read and write
5479000
trusted library allocation
page read and write
54A3000
trusted library allocation
page read and write
301D000
heap
page read and write
547D000
trusted library allocation
page read and write
2C2F000
unkown
page readonly
5432000
trusted library allocation
page read and write
554A000
trusted library allocation
page read and write
543F000
trusted library allocation
page read and write
544F000
trusted library allocation
page read and write
2EDE000
stack
page read and write
5461000
trusted library allocation
page read and write
2D10000
heap
page read and write
5455000
trusted library allocation
page read and write
5430000
trusted library allocation
page read and write
5478000
trusted library allocation
page read and write
5453000
trusted library allocation
page read and write
5431000
trusted library allocation
page read and write
2F50000
remote allocation
page read and write
2F60000
heap
page read and write
5427000
trusted library allocation
page read and write
5465000
trusted library allocation
page read and write
5520000
heap
page read and write
543F000
trusted library allocation
page read and write
54F0000
trusted library allocation
page read and write
5425000
trusted library allocation
page read and write
51CE000
stack
page read and write
44A000
unkown
page execute and read and write
5428000
trusted library allocation
page read and write
52CF000
stack
page read and write
308E000
heap
page read and write
2D95000
heap
page read and write
5459000
trusted library allocation
page read and write
3083000
heap
page read and write
4AAD000
stack
page read and write
308C000
heap
page read and write
547D000
trusted library allocation
page read and write
542D000
trusted library allocation
page read and write
569A000
trusted library allocation
page read and write
542B000
trusted library allocation
page read and write
5429000
trusted library allocation
page read and write
5495000
trusted library allocation
page read and write
549E000
trusted library allocation
page read and write
3083000
heap
page read and write
544F000
trusted library allocation
page read and write
3083000
heap
page read and write
567E000
stack
page read and write
2D5E000
stack
page read and write
542D000
trusted library allocation
page read and write
3088000
heap
page read and write
547D000
trusted library allocation
page read and write
5469000
trusted library allocation
page read and write
5454000
trusted library allocation
page read and write
54BF000
trusted library allocation
page read and write
530E000
stack
page read and write
543D000
trusted library allocation
page read and write
9B000
stack
page read and write
54BF000
trusted library allocation
page read and write
5454000
trusted library allocation
page read and write
5424000
trusted library allocation
page read and write
5466000
trusted library allocation
page read and write
3088000
heap
page read and write
5444000
trusted library allocation
page read and write
542D000
trusted library allocation
page read and write
5457000
trusted library allocation
page read and write
5427000
trusted library allocation
page read and write
2F70000
heap
page read and write
5429000
trusted library allocation
page read and write
2D90000
heap
page read and write
548F000
trusted library allocation
page read and write
62F2000
trusted library allocation
page read and write
54AD000
trusted library allocation
page read and write
2FA3000
heap
page execute and read and write
5432000
trusted library allocation
page read and write
54AA000
trusted library allocation
page read and write
547E000
trusted library allocation
page read and write
5429000
trusted library allocation
page read and write
543F000
trusted library allocation
page read and write
5431000
trusted library allocation
page read and write
547F000
trusted library allocation
page read and write
308E000
heap
page read and write
1F0000
heap
page read and write
5469000
trusted library allocation
page read and write
5428000
trusted library allocation
page read and write
5429000
trusted library allocation
page read and write
542F000
trusted library allocation
page read and write
5427000
trusted library allocation
page read and write
5438000
trusted library allocation
page read and write
5483000
trusted library allocation
page read and write
2FCF000
heap
page read and write
543F000
trusted library allocation
page read and write
58ED000
trusted library allocation
page read and write
5468000
trusted library allocation
page read and write
3084000
heap
page read and write
2F90000
heap
page read and write
3088000
heap
page read and write
5471000
trusted library allocation
page read and write
2F9E000
heap
page read and write
542D000
trusted library allocation
page read and write
2F50000
remote allocation
page read and write
5421000
trusted library allocation
page read and write
3084000
heap
page read and write
5457000
trusted library allocation
page read and write
4CFF000
stack
page read and write
5428000
trusted library allocation
page read and write
54BF000
trusted library allocation
page read and write
54A9000
trusted library allocation
page read and write
5456000
trusted library allocation
page read and write
41F000
unkown
page readonly
546D000
trusted library allocation
page read and write
5457000
trusted library allocation
page read and write
4AB0000
heap
page read and write
547E000
trusted library allocation
page read and write
5458000
trusted library allocation
page read and write
5430000
trusted library allocation
page read and write
5582000
trusted library allocation
page read and write
5469000
trusted library allocation
page read and write
548A000
trusted library allocation
page read and write
5430000
trusted library allocation
page read and write
2D97000
heap
page read and write
545D000
trusted library allocation
page read and write
3084000
heap
page read and write
5465000
trusted library allocation
page read and write
3088000
heap
page read and write
54CB000
trusted library allocation
page read and write
5435000
trusted library allocation
page read and write
2D70000
heap
page read and write
3088000
heap
page read and write
5468000
trusted library allocation
page read and write
5427000
trusted library allocation
page read and write
5456000
trusted library allocation
page read and write
5471000
trusted library allocation
page read and write
5460000
trusted library allocation
page read and write
2EE0000
direct allocation
page execute and read and write
549B000
trusted library allocation
page read and write
5435000
trusted library allocation
page read and write
5463000
trusted library allocation
page read and write
5427000
trusted library allocation
page read and write
3088000
heap
page read and write
5426000
trusted library allocation
page read and write
542D000
trusted library allocation
page read and write
540E000
stack
page read and write
5DE8000
trusted library allocation
page read and write
57B9000
trusted library allocation
page read and write
5455000
trusted library allocation
page read and write
55D2000
trusted library allocation
page read and write
5445000
trusted library allocation
page read and write
547A000
trusted library allocation
page read and write
548E000
trusted library allocation
page read and write
5562000
trusted library allocation
page read and write
58D0000
heap
page read and write
542D000
trusted library allocation
page read and write
5454000
trusted library allocation
page read and write
4A6D000
stack
page read and write
545D000
trusted library allocation
page read and write
5447000
trusted library allocation
page read and write
542D000
trusted library allocation
page read and write
3088000
heap
page read and write
44C000
unkown
page write copy
542D000
trusted library allocation
page read and write
3080000
heap
page read and write
5454000
trusted library allocation
page read and write
2FF1000
heap
page read and write
5431000
trusted library allocation
page read and write
5462000
trusted library allocation
page read and write
308E000
heap
page read and write
560A000
trusted library allocation
page read and write
5426000
trusted library allocation
page read and write
547E000
trusted library allocation
page read and write
542B000
trusted library allocation
page read and write
552B000
trusted library allocation
page read and write
5602000
trusted library allocation
page read and write
543A000
trusted library allocation
page read and write
5464000
trusted library allocation
page read and write
5448000
trusted library allocation
page read and write
542A000
trusted library allocation
page read and write
3087000
heap
page read and write
54A4000
trusted library allocation
page read and write
5452000
trusted library allocation
page read and write
57B7000
trusted library allocation
page read and write
5455000
trusted library allocation
page read and write
5457000
trusted library allocation
page read and write
5427000
trusted library allocation
page read and write
308E000
heap
page read and write
5424000
trusted library allocation
page read and write
2F9A000
heap
page read and write
There are 262 hidden memdumps, click here to show them.