IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_5c35b761e7b2886414fdd9b14cedcc55e7ebf4_79a0e859_e937197c-8d4c-4a9e-9e0b-35ae5b0d1770\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_f26ec913b0e96e6b4e4a1fab19facc1930b3e25_79a0e859_42dc5897-5fe7-48b0-9f37-20795f382a3b\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE01F.tmp.dmp
Mini DuMP crash report, 15 streams, Sat Apr 20 19:08:06 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE10A.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE12B.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE30D.tmp.dmp
Mini DuMP crash report, 15 streams, Sat Apr 20 19:08:07 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE773.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE793.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 488
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1552

URLs

Name
IP
Malicious
shortsvelventysjo.shop
malicious
tolerateilusidjukl.shop
malicious
shatterbreathepsw.shop
malicious
demonstationfukewko.shop
malicious
productivelookewr.shop
malicious
strollheavengwu.shop
malicious
alcojoldwograpciw.shop
malicious
incredibleextedwj.shop
malicious
liabilitynighstjsko.shop
malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://strollheavengwu.shop/api
104.21.15.198
https://strollheavengwu.shop/h
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://strollheavengwu.shop/n
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://strollheavengwu.shop/m
unknown
https://strollheavengwu.shop/s
unknown
https://strollheavengwu.shop/gC
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://strollheavengwu.shop/C%a
unknown
https://strollheavengwu.shop/c
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://strollheavengwu.shop/a
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://strollheavengwu.shop/d
unknown
https://strollheavengwu.shop/e
unknown
https://strollheavengwu.shop/7%
unknown
https://support.mozilla.org/products/firefoxgro.all
unknown
https://strollheavengwu.shop/Q
unknown
https://strollheavengwu.shop/3&
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
https://strollheavengwu.shop/9
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://strollheavengwu.shop/C
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
http://upx.sf.net
unknown
https://strollheavengwu.shop/:&
unknown
http://ocsp.rootca1.amazontrust.com0:
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://www.ecosia.org/newtab/
unknown
https://strollheavengwu.shop/%;
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://strollheavengwu.shop/#
unknown
https://strollheavengwu.shop/apiwxt
unknown
https://strollheavengwu.shop/%%;
unknown
https://support.microsof
unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://strollheavengwu.shop/
unknown
There are 47 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
strollheavengwu.shop
104.21.15.198
 malicious

IPs

IP
Domain
Country
Malicious
104.21.15.198
strollheavengwu.shop
United States
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProgramId
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
FileId
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LowerCaseLongPath
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LongPathHash
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Name
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
OriginalFileName
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Publisher
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Version
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinFileVersion
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinaryType
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductName
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductVersion
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LinkDate
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinProductVersion
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageFullName
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageRelativeId
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Size
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Language
\REGISTRY\A\{2fe2dc15-8ce8-c030-ca16-55417a51c80f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3680000
direct allocation
page execute and read and write
 malicious
4251000
trusted library allocation
page read and write
423F000
trusted library allocation
page read and write
1B90000
heap
page read and write
3830000
heap
page read and write
42A6000
trusted library allocation
page read and write
421D000
trusted library allocation
page read and write
420D000
trusted library allocation
page read and write
4265000
trusted library allocation
page read and write
1B45000
heap
page read and write
50C4000
trusted library allocation
page read and write
4204000
trusted library allocation
page read and write
423A000
trusted library allocation
page read and write
1B42000
heap
page read and write
1B31000
heap
page read and write
4271000
trusted library allocation
page read and write
4217000
trusted library allocation
page read and write
4270000
trusted library allocation
page read and write
4266000
trusted library allocation
page read and write
4234000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
4596000
trusted library allocation
page read and write
423B000
trusted library allocation
page read and write
4202000
trusted library allocation
page read and write
3C00000
remote allocation
page read and write
1B3B000
heap
page read and write
420F000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
43B4000
trusted library allocation
page read and write
4597000
trusted library allocation
page read and write
1ACB000
heap
page read and write
4208000
trusted library allocation
page read and write
43EC000
trusted library allocation
page read and write
4208000
trusted library allocation
page read and write
1B45000
heap
page read and write
420F000
trusted library allocation
page read and write
4208000
trusted library allocation
page read and write
422F000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
40EE000
stack
page read and write
422E000
trusted library allocation
page read and write
3C00000
remote allocation
page read and write
4209000
trusted library allocation
page read and write
420D000
trusted library allocation
page read and write
4209000
trusted library allocation
page read and write
4209000
trusted library allocation
page read and write
420C000
trusted library allocation
page read and write
1B45000
heap
page read and write
1A58000
heap
page read and write
4210000
trusted library allocation
page read and write
4201000
trusted library allocation
page read and write
401000
unkown
page execute read
4266000
trusted library allocation
page read and write
1B49000
heap
page read and write
1B45000
heap
page read and write
422F000
trusted library allocation
page read and write
4204000
trusted library allocation
page read and write
4249000
trusted library allocation
page read and write
420F000
trusted library allocation
page read and write
4BAF000
trusted library allocation
page read and write
421C000
trusted library allocation
page read and write
4286000
trusted library allocation
page read and write
4263000
trusted library allocation
page read and write
1B37000
heap
page read and write
424C000
trusted library allocation
page read and write
4217000
trusted library allocation
page read and write
4252000
trusted library allocation
page read and write
445E000
stack
page read and write
4240000
trusted library allocation
page read and write
1B46000
heap
page read and write
4216000
trusted library allocation
page read and write
1B31000
heap
page read and write
420F000
trusted library allocation
page read and write
421A000
trusted library allocation
page read and write
4259000
trusted library allocation
page read and write
1A30000
heap
page read and write
422F000
trusted library allocation
page read and write
4209000
trusted library allocation
page read and write
4233000
trusted library allocation
page read and write
1B8E000
stack
page read and write
4276000
trusted library allocation
page read and write
42A2000
trusted library allocation
page read and write
4210000
trusted library allocation
page read and write
1B3E000
heap
page read and write
420D000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
4248000
trusted library allocation
page read and write
41F000
unkown
page write copy
397E000
stack
page read and write
423E000
trusted library allocation
page read and write
4268000
trusted library allocation
page read and write
4202000
trusted library allocation
page read and write
4203000
trusted library allocation
page read and write
421A000
trusted library allocation
page read and write
424D000
trusted library allocation
page read and write
1B3D000
heap
page read and write
4228000
trusted library allocation
page read and write
1B48000
heap
page read and write
A1000
stack
page read and write
1B46000
heap
page read and write
1B31000
heap
page read and write
4204000
trusted library allocation
page read and write
423D000
trusted library allocation
page read and write
424A000
trusted library allocation
page read and write
421D000
trusted library allocation
page read and write
4223000
trusted library allocation
page read and write
4271000
trusted library allocation
page read and write
4220000
trusted library allocation
page read and write
43E4000
trusted library allocation
page read and write
4204000
trusted library allocation
page read and write
4204000
trusted library allocation
page read and write
420F000
trusted library allocation
page read and write
4216000
trusted library allocation
page read and write
4216000
trusted library allocation
page read and write
1B22000
heap
page read and write
421B000
trusted library allocation
page read and write
1B3E000
heap
page read and write
4216000
trusted library allocation
page read and write
4275000
trusted library allocation
page read and write
4255000
trusted library allocation
page read and write
4255000
trusted library allocation
page read and write
1BC0000
heap
page read and write
4209000
trusted library allocation
page read and write
367F000
stack
page read and write
4301000
heap
page read and write
1B37000
heap
page read and write
1B24000
heap
page read and write
1B46000
heap
page read and write
1B3C000
heap
page read and write
4209000
trusted library allocation
page read and write
425D000
trusted library allocation
page read and write
4220000
trusted library allocation
page read and write
423E000
trusted library allocation
page read and write
4235000
trusted library allocation
page read and write
42A2000
trusted library allocation
page read and write
1B31000
heap
page read and write
1B25000
heap
page read and write
4216000
trusted library allocation
page read and write
420F000
trusted library allocation
page read and write
4207000
trusted library allocation
page read and write
421C000
trusted library allocation
page read and write
425D000
trusted library allocation
page read and write
3C00000
remote allocation
page read and write
4204000
trusted library allocation
page read and write
432C000
trusted library allocation
page read and write
424C000
trusted library allocation
page read and write
4204000
trusted library allocation
page read and write
4210000
trusted library allocation
page read and write
422F000
trusted library allocation
page read and write
425E000
trusted library allocation
page read and write
1F0000
heap
page read and write
4208000
trusted library allocation
page read and write
429E000
trusted library allocation
page read and write
4264000
trusted library allocation
page read and write
1BC7000
heap
page read and write
428E000
trusted library allocation
page read and write
4205000
trusted library allocation
page read and write
1B38000
heap
page read and write
4216000
trusted library allocation
page read and write
4205000
trusted library allocation
page read and write
4263000
trusted library allocation
page read and write
382D000
stack
page read and write
4235000
trusted library allocation
page read and write
4235000
trusted library allocation
page read and write
4240000
trusted library allocation
page read and write
4254000
trusted library allocation
page read and write
4255000
trusted library allocation
page read and write
4235000
trusted library allocation
page read and write
46AC000
trusted library allocation
page read and write
425D000
trusted library allocation
page read and write
3FAE000
stack
page read and write
424A000
trusted library allocation
page read and write
4201000
trusted library allocation
page read and write
1B36000
heap
page read and write
4245000
trusted library allocation
page read and write
42A2000
trusted library allocation
page read and write
1B45000
heap
page read and write
421D000
trusted library allocation
page read and write
1B37000
heap
page read and write
4204000
trusted library allocation
page read and write
424D000
trusted library allocation
page read and write
420F000
trusted library allocation
page read and write
44B000
unkown
page execute and read and write
4216000
trusted library allocation
page read and write
1A50000
heap
page read and write
1A6F000
heap
page execute and read and write
4271000
trusted library allocation
page read and write
4240000
trusted library allocation
page read and write
4209000
trusted library allocation
page read and write
422E000
trusted library allocation
page read and write
1A5E000
heap
page read and write
400000
unkown
page readonly
421E000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
1B22000
heap
page read and write
420F000
trusted library allocation
page read and write
4238000
trusted library allocation
page read and write
1B28000
heap
page read and write
4209000
trusted library allocation
page read and write
421D000
trusted library allocation
page read and write
423F000
trusted library allocation
page read and write
1B3B000
heap
page read and write
400000
unkown
page execute and read and write
423D000
trusted library allocation
page read and write
425F000
trusted library allocation
page read and write
4236000
trusted library allocation
page read and write
4231000
trusted library allocation
page read and write
4240000
trusted library allocation
page read and write
4206000
trusted library allocation
page read and write
4264000
trusted library allocation
page read and write
4205000
trusted library allocation
page read and write
4205000
trusted library allocation
page read and write
372E000
stack
page read and write
421C000
trusted library allocation
page read and write
1B45000
heap
page read and write
4209000
trusted library allocation
page read and write
420F000
trusted library allocation
page read and write
4242000
trusted library allocation
page read and write
1B45000
heap
page read and write
4249000
trusted library allocation
page read and write
4201000
trusted library allocation
page read and write
3BFF000
stack
page read and write
4364000
trusted library allocation
page read and write
421B000
trusted library allocation
page read and write
1A15000
unkown
page readonly
4209000
trusted library allocation
page read and write
4204000
trusted library allocation
page read and write
425D000
trusted library allocation
page read and write
1B42000
heap
page read and write
420F000
trusted library allocation
page read and write
1AC9000
heap
page read and write
1B3E000
heap
page read and write
1B45000
heap
page read and write
1B3F000
heap
page read and write
42A2000
trusted library allocation
page read and write
4344000
trusted library allocation
page read and write
1B3B000
heap
page read and write
420F000
trusted library allocation
page read and write
4204000
trusted library allocation
page read and write
447C000
trusted library allocation
page read and write
420B000
trusted library allocation
page read and write
420B000
trusted library allocation
page read and write
1B31000
heap
page read and write
1BC5000
heap
page read and write
4204000
trusted library allocation
page read and write
455F000
stack
page read and write
4264000
trusted library allocation
page read and write
421D000
trusted library allocation
page read and write
4300000
heap
page read and write
41EE000
stack
page read and write
420B000
trusted library allocation
page read and write
420A000
trusted library allocation
page read and write
4238000
trusted library allocation
page read and write
4271000
trusted library allocation
page read and write
4201000
trusted library allocation
page read and write
420F000
trusted library allocation
page read and write
4209000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
1A13000
unkown
page read and write
4313000
trusted library allocation
page read and write
424C000
trusted library allocation
page read and write
4200000
trusted library allocation
page read and write
4238000
trusted library allocation
page read and write
4207000
trusted library allocation
page read and write
421D000
trusted library allocation
page read and write
9B000
stack
page read and write
4231000
trusted library allocation
page read and write
411000
unkown
page readonly
40AF000
stack
page read and write
421D000
trusted library allocation
page read and write
4255000
trusted library allocation
page read and write
426D000
trusted library allocation
page read and write
4296000
trusted library allocation
page read and write
1B45000
heap
page read and write
421D000
trusted library allocation
page read and write
421D000
trusted library allocation
page read and write
4220000
trusted library allocation
page read and write
420F000
trusted library allocation
page read and write
1A15000
unkown
page readonly
1A9D000
heap
page read and write
420F000
trusted library allocation
page read and write
357E000
stack
page read and write
4690000
heap
page read and write
4238000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
4255000
trusted library allocation
page read and write
4235000
trusted library allocation
page read and write
4247000
trusted library allocation
page read and write
420F000
trusted library allocation
page read and write
421C000
trusted library allocation
page read and write
1B38000
heap
page read and write
4266000
trusted library allocation
page read and write
4240000
trusted library allocation
page read and write
4266000
trusted library allocation
page read and write
421A000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
3ABF000
stack
page read and write
4230000
trusted library allocation
page read and write
430D000
trusted library allocation
page read and write
419000
unkown
page write copy
424E000
trusted library allocation
page read and write
420B000
trusted library allocation
page read and write
3AFE000
stack
page read and write
4246000
trusted library allocation
page read and write
1B45000
heap
page read and write
36E0000
heap
page read and write
43DC000
trusted library allocation
page read and write
36F0000
direct allocation
page read and write
4299000
trusted library allocation
page read and write
39BE000
stack
page read and write
420F000
trusted library allocation
page read and write
4222000
trusted library allocation
page read and write
421F000
trusted library allocation
page read and write
1D9F000
stack
page read and write
4230000
trusted library allocation
page read and write
422E000
trusted library allocation
page read and write
422E000
trusted library allocation
page read and write
4216000
trusted library allocation
page read and write
387D000
stack
page read and write
425E000
trusted library allocation
page read and write
There are 311 hidden memdumps, click here to show them.