IOC Report
LwnI84BBtb.exe

loading gif

Files

File Path
Type
Category
Malicious
LwnI84BBtb.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LwnI84BBtb.exe_1ea81470fde93d5ba9982c97d6c51c12dc70cc0_19912bd0_209de206-4fdf-4734-8956-4504ba2af95f\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LwnI84BBtb.exe_e664834b6db86c663fd972c4efd7b7dd6c8b6a_19912bd0_6bfa8470-f327-4b11-9581-4a8c6cf91f20\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC40.tmp.dmp
Mini DuMP crash report, 15 streams, Sat Apr 20 20:07:05 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBCFC.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD1C.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF2E.tmp.dmp
Mini DuMP crash report, 15 streams, Sat Apr 20 20:07:06 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC394.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3B4.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\LwnI84BBtb.exe
"C:\Users\user\Desktop\LwnI84BBtb.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 1568
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 1644

URLs

Name
IP
Malicious
incredibleextedwj.shop
malicious
shortsvelventysjo.shop
malicious
tolerateilusidjukl.shop
malicious
liabilitynighstjsko.shop
malicious
shatterbreathepsw.shop
malicious
demonstationfukewko.shop
malicious
productivelookewr.shop
malicious
strollheavengwu.shop
malicious
alcojoldwograpciw.shop
malicious
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8z
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://strollheavengwu.shop/9
unknown
https://duckduckgo.com/ac/?q=
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://strollheavengwu.shop/api
104.21.15.198
http://crl.rootca1.amazontrust.com/rootca1.crl0
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://ocsp.rootca1.amazontrust.com0:
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.microsof
unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?
unknown
https://support.mozilla.org/products/firefoxgro.all
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://strollheavengwu.shop:443/api
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
https://strollheavengwu.shop/
unknown
There are 27 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
strollheavengwu.shop
104.21.15.198
 malicious

IPs

IP
Domain
Country
Malicious
104.21.15.198
strollheavengwu.shop
United States
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
ProgramId
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
FileId
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
LowerCaseLongPath
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
LongPathHash
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
Name
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
OriginalFileName
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
Publisher
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
Version
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
BinFileVersion
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
BinaryType
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
ProductName
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
ProductVersion
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
LinkDate
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
BinProductVersion
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
AppxPackageFullName
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
AppxPackageRelativeId
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
Size
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
Language
\REGISTRY\A\{9250f6c4-8e94-0f7c-3bec-201f834647f6}\Root\InventoryApplicationFile\lwni84bbtb.exe|97ef29a517dcf024
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page execute and read and write
 malicious
41EE000
stack
page read and write
1B1D000
heap
page read and write
3ACF000
stack
page read and write
420D000
trusted library allocation
page read and write
4218000
trusted library allocation
page read and write
4214000
trusted library allocation
page read and write
4202000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
431E000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
425D000
trusted library allocation
page read and write
422B000
trusted library allocation
page read and write
1B30000
heap
page read and write
401000
unkown
page execute read
4207000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
428F000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
4339000
trusted library allocation
page read and write
4308000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
1B1C000
heap
page read and write
424E000
trusted library allocation
page read and write
4297000
trusted library allocation
page read and write
4237000
trusted library allocation
page read and write
4673000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
4201000
trusted library allocation
page read and write
422B000
trusted library allocation
page read and write
1A4E000
heap
page execute and read and write
4212000
trusted library allocation
page read and write
36A0000
heap
page read and write
421E000
trusted library allocation
page read and write
4878000
trusted library allocation
page read and write
4339000
trusted library allocation
page read and write
4319000
trusted library allocation
page read and write
4207000
trusted library allocation
page read and write
475F000
stack
page read and write
4308000
trusted library allocation
page read and write
425C000
trusted library allocation
page read and write
4301000
trusted library allocation
page read and write
429D000
trusted library allocation
page read and write
420D000
trusted library allocation
page read and write
4297000
trusted library allocation
page read and write
4265000
trusted library allocation
page read and write
411000
unkown
page readonly
1AAB000
heap
page read and write
4234000
trusted library allocation
page read and write
38C0000
heap
page read and write
424E000
trusted library allocation
page read and write
4209000
trusted library allocation
page read and write
450A000
trusted library allocation
page read and write
42B0000
trusted library allocation
page read and write
427C000
trusted library allocation
page read and write
1A3A000
heap
page read and write
4308000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
4215000
trusted library allocation
page read and write
4265000
trusted library allocation
page read and write
4208000
trusted library allocation
page read and write
388E000
stack
page read and write
4793000
trusted library allocation
page read and write
4339000
trusted library allocation
page read and write
4300000
trusted library allocation
page read and write
4339000
trusted library allocation
page read and write
4207000
trusted library allocation
page read and write
434E000
trusted library allocation
page read and write
424D000
trusted library allocation
page read and write
420C000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
4204000
trusted library allocation
page read and write
420C000
trusted library allocation
page read and write
421F000
trusted library allocation
page read and write
4329000
trusted library allocation
page read and write
421A000
trusted library allocation
page read and write
4319000
trusted library allocation
page read and write
4219000
trusted library allocation
page read and write
4207000
trusted library allocation
page read and write
4248000
trusted library allocation
page read and write
429F000
trusted library allocation
page read and write
1DAF000
stack
page read and write
4212000
trusted library allocation
page read and write
4308000
trusted library allocation
page read and write
1BD7000
heap
page read and write
4201000
trusted library allocation
page read and write
422B000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
5284000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
434E000
trusted library allocation
page read and write
434D000
trusted library allocation
page read and write
42D0000
trusted library allocation
page read and write
1A3E000
heap
page read and write
1BD0000
heap
page read and write
4319000
trusted library allocation
page read and write
420D000
trusted library allocation
page read and write
40AF000
stack
page read and write
4319000
trusted library allocation
page read and write
4228000
trusted library allocation
page read and write
4238000
trusted library allocation
page read and write
4201000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
421A000
trusted library allocation
page read and write
42B0000
trusted library allocation
page read and write
1F0000
heap
page read and write
425D000
trusted library allocation
page read and write
4210000
trusted library allocation
page read and write
421F000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
45D3000
trusted library allocation
page read and write
428F000
trusted library allocation
page read and write
4299000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
4308000
trusted library allocation
page read and write
4284000
trusted library allocation
page read and write
465E000
stack
page read and write
4298000
trusted library allocation
page read and write
425E000
trusted library allocation
page read and write
434E000
trusted library allocation
page read and write
424D000
trusted library allocation
page read and write
1B1F000
heap
page read and write
373D000
stack
page read and write
38B0000
remote allocation
page read and write
434E000
trusted library allocation
page read and write
4316000
trusted library allocation
page read and write
4301000
trusted library allocation
page read and write
4284000
trusted library allocation
page read and write
4208000
trusted library allocation
page read and write
427C000
trusted library allocation
page read and write
42D0000
trusted library allocation
page read and write
1B05000
heap
page read and write
4218000
trusted library allocation
page read and write
1B0B000
heap
page read and write
427C000
trusted library allocation
page read and write
4208000
trusted library allocation
page read and write
1A7C000
heap
page read and write
4214000
trusted library allocation
page read and write
4215000
trusted library allocation
page read and write
453B000
trusted library allocation
page read and write
420B000
trusted library allocation
page read and write
4263000
trusted library allocation
page read and write
4233000
trusted library allocation
page read and write
42B1000
trusted library allocation
page read and write
4202000
trusted library allocation
page read and write
4210000
trusted library allocation
page read and write
1A15000
unkown
page readonly
42CE000
trusted library allocation
page read and write
4301000
trusted library allocation
page read and write
3740000
heap
page read and write
4237000
trusted library allocation
page read and write
42B0000
trusted library allocation
page read and write
4208000
trusted library allocation
page read and write
4207000
trusted library allocation
page read and write
4504000
trusted library allocation
page read and write
4207000
trusted library allocation
page read and write
42C8000
trusted library allocation
page read and write
4237000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
434D000
trusted library allocation
page read and write
4201000
trusted library allocation
page read and write
4218000
trusted library allocation
page read and write
4206000
trusted library allocation
page read and write
4298000
trusted library allocation
page read and write
4248000
trusted library allocation
page read and write
4230000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
41F000
unkown
page write copy
3650000
direct allocation
page execute and read and write
434E000
trusted library allocation
page read and write
4205000
trusted library allocation
page read and write
420C000
trusted library allocation
page read and write
4258000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
455B000
trusted library allocation
page read and write
4211000
trusted library allocation
page read and write
4301000
trusted library allocation
page read and write
432B000
trusted library allocation
page read and write
4249000
trusted library allocation
page read and write
4860000
heap
page read and write
4207000
trusted library allocation
page read and write
4301000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
4209000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
421F000
trusted library allocation
page read and write
432B000
trusted library allocation
page read and write
45AB000
trusted library allocation
page read and write
42D7000
trusted library allocation
page read and write
45E3000
trusted library allocation
page read and write
4331000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
4248000
trusted library allocation
page read and write
1B20000
heap
page read and write
1AB7000
heap
page read and write
422B000
trusted library allocation
page read and write
420C000
trusted library allocation
page read and write
1B1D000
heap
page read and write
420C000
trusted library allocation
page read and write
434D000
trusted library allocation
page read and write
4237000
trusted library allocation
page read and write
4205000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
1B1C000
heap
page read and write
4201000
trusted library allocation
page read and write
4308000
trusted library allocation
page read and write
4211000
trusted library allocation
page read and write
420F000
trusted library allocation
page read and write
428B000
trusted library allocation
page read and write
45DB000
trusted library allocation
page read and write
36FE000
stack
page read and write
3C0F000
stack
page read and write
4212000
trusted library allocation
page read and write
4239000
trusted library allocation
page read and write
42CF000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
4205000
trusted library allocation
page read and write
384D000
stack
page read and write
4329000
trusted library allocation
page read and write
1A13000
unkown
page read and write
4501000
heap
page read and write
4285000
trusted library allocation
page read and write
4D71000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
4214000
trusted library allocation
page read and write
429F000
trusted library allocation
page read and write
4297000
trusted library allocation
page read and write
4308000
trusted library allocation
page read and write
420C000
trusted library allocation
page read and write
39CE000
stack
page read and write
4207000
trusted library allocation
page read and write
4215000
trusted library allocation
page read and write
4297000
trusted library allocation
page read and write
3FAE000
stack
page read and write
4214000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
4240000
trusted library allocation
page read and write
434E000
trusted library allocation
page read and write
1B20000
heap
page read and write
4207000
trusted library allocation
page read and write
4204000
trusted library allocation
page read and write
4500000
heap
page read and write
4204000
trusted library allocation
page read and write
36A0000
direct allocation
page read and write
4207000
trusted library allocation
page read and write
A1000
stack
page read and write
4209000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
3B0E000
stack
page read and write
42D0000
trusted library allocation
page read and write
432B000
trusted library allocation
page read and write
422B000
trusted library allocation
page read and write
1B08000
heap
page read and write
424E000
trusted library allocation
page read and write
9B000
stack
page read and write
4200000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
40EE000
stack
page read and write
424E000
trusted library allocation
page read and write
419000
unkown
page write copy
426F000
trusted library allocation
page read and write
428B000
trusted library allocation
page read and write
4319000
trusted library allocation
page read and write
4237000
trusted library allocation
page read and write
4202000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
364F000
stack
page read and write
434E000
trusted library allocation
page read and write
4523000
trusted library allocation
page read and write
429E000
trusted library allocation
page read and write
422B000
trusted library allocation
page read and write
4237000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
4234000
trusted library allocation
page read and write
422F000
trusted library allocation
page read and write
430A000
trusted library allocation
page read and write
4219000
trusted library allocation
page read and write
1BCE000
stack
page read and write
1A30000
heap
page read and write
420C000
trusted library allocation
page read and write
4201000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
429F000
trusted library allocation
page read and write
4215000
trusted library allocation
page read and write
434E000
trusted library allocation
page read and write
4263000
trusted library allocation
page read and write
4246000
trusted library allocation
page read and write
427C000
trusted library allocation
page read and write
400000
unkown
page readonly
424E000
trusted library allocation
page read and write
1B1C000
heap
page read and write
422C000
trusted library allocation
page read and write
4339000
trusted library allocation
page read and write
479E000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
420D000
trusted library allocation
page read and write
420D000
trusted library allocation
page read and write
4209000
trusted library allocation
page read and write
44B000
unkown
page execute and read and write
4298000
trusted library allocation
page read and write
1B1C000
heap
page read and write
38B0000
remote allocation
page read and write
420C000
trusted library allocation
page read and write
4202000
trusted library allocation
page read and write
1B7E000
stack
page read and write
4329000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
421F000
trusted library allocation
page read and write
420C000
trusted library allocation
page read and write
429F000
trusted library allocation
page read and write
420A000
trusted library allocation
page read and write
1A15000
unkown
page readonly
420C000
trusted library allocation
page read and write
1BD5000
heap
page read and write
4339000
trusted library allocation
page read and write
421F000
trusted library allocation
page read and write
38B0000
remote allocation
page read and write
There are 312 hidden memdumps, click here to show them.