IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_5c35b761e7b2886414fdd9b14cedcc55e7ebf4_79a0e859_5203bd44-6de2-4e4f-aad8-78095cede41a\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_8ec75631d1328d44a8219509d535bd4f6799dd4_79a0e859_3912fa46-8569-4c49-a3ef-ca2a8cc690e1\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC87B.tmp.dmp
Mini DuMP crash report, 15 streams, Sun Apr 21 06:41:02 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC985.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9A6.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBB7.tmp.dmp
Mini DuMP crash report, 15 streams, Sun Apr 21 06:41:03 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD107.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD127.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 1468
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6244 -s 1688

URLs

Name
IP
Malicious
incredibleextedwj.shop
malicious
shortsvelventysjo.shop
malicious
tolerateilusidjukl.shop
malicious
liabilitynighstjsko.shop
malicious
shatterbreathepsw.shop
malicious
demonstationfukewko.shop
malicious
productivelookewr.shop
malicious
strollheavengwu.shop
malicious
alcojoldwograpciw.shop
malicious
https://duckduckgo.com/chrome_newtab
unknown
https://strollheavengwu.shop/9
unknown
https://duckduckgo.com/ac/?q=
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://strollheavengwu.shop/api
172.67.163.209
http://crl.rootca1.amazontrust.com/rootca1.crl0
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://strollheavengwu.shop/9my$
unknown
http://ocsp.rootca1.amazontrust.com0:
unknown
https://strollheavengwu.shop/o
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://strollheavengwu.shop/api/
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://strollheavengwu.shop/apiy
unknown
https://strollheavengwu.shop/hZyI
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://strollheavengwu.sh
unknown
https://strollheavengwu.shop/apiRO
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.microsof
unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?
unknown
https://strollheavengwu.shop/d
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
https://support.mozilla.org/products/firefoxgro.all
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://strollheavengwu.shop/
unknown
There are 32 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
strollheavengwu.shop
172.67.163.209
 malicious

IPs

IP
Domain
Country
Malicious
172.67.163.209
strollheavengwu.shop
United States
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProgramId
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
FileId
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LowerCaseLongPath
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LongPathHash
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Name
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
OriginalFileName
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Publisher
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Version
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinFileVersion
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinaryType
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductName
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductVersion
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LinkDate
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinProductVersion
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageFullName
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageRelativeId
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Size
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Language
\REGISTRY\A\{8b2b5152-f872-2fc3-3b27-a24b0939666f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page execute and read and write
 malicious
4275000
trusted library allocation
page read and write
4234000
trusted library allocation
page read and write
4226000
trusted library allocation
page read and write
425A000
trusted library allocation
page read and write
425C000
trusted library allocation
page read and write
426D000
trusted library allocation
page read and write
A1000
stack
page read and write
427D000
trusted library allocation
page read and write
424A000
trusted library allocation
page read and write
426C000
trusted library allocation
page read and write
425E000
trusted library allocation
page read and write
423C000
trusted library allocation
page read and write
1D10000
heap
page read and write
4229000
trusted library allocation
page read and write
1D80000
heap
page read and write
421F000
trusted library allocation
page read and write
422D000
trusted library allocation
page read and write
4256000
trusted library allocation
page read and write
1D8E000
heap
page read and write
1CF6000
heap
page read and write
4225000
trusted library allocation
page read and write
4266000
trusted library allocation
page read and write
4256000
trusted library allocation
page read and write
423E000
trusted library allocation
page read and write
423E000
trusted library allocation
page read and write
1D18000
heap
page read and write
4211000
trusted library allocation
page read and write
422D000
trusted library allocation
page read and write
422C000
trusted library allocation
page read and write
421A000
trusted library allocation
page read and write
421C000
trusted library allocation
page read and write
1D90000
heap
page read and write
427A000
trusted library allocation
page read and write
46F0000
heap
page read and write
42A6000
trusted library allocation
page read and write
1D04000
heap
page read and write
1D8B000
heap
page read and write
4266000
trusted library allocation
page read and write
3780000
remote allocation
page read and write
1D18000
heap
page read and write
1D04000
heap
page read and write
422F000
trusted library allocation
page read and write
4266000
trusted library allocation
page read and write
43BE000
trusted library allocation
page read and write
434E000
trusted library allocation
page read and write
1D93000
heap
page read and write
4229000
trusted library allocation
page read and write
4257000
trusted library allocation
page read and write
1D92000
heap
page read and write
421E000
trusted library allocation
page read and write
424C000
trusted library allocation
page read and write
4273000
trusted library allocation
page read and write
4229000
trusted library allocation
page read and write
4231000
trusted library allocation
page read and write
4234000
trusted library allocation
page read and write
1B85000
heap
page read and write
1D1D000
heap
page read and write
45AB000
trusted library allocation
page read and write
4257000
trusted library allocation
page read and write
41E000
unkown
page write copy
4220000
trusted library allocation
page read and write
4251000
trusted library allocation
page read and write
1D76000
heap
page read and write
42C2000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
422D000
trusted library allocation
page read and write
4317000
trusted library allocation
page read and write
411000
unkown
page readonly
1CBE000
heap
page execute and read and write
4C02000
trusted library allocation
page read and write
1D3D000
heap
page read and write
4257000
trusted library allocation
page read and write
4263000
trusted library allocation
page read and write
4265000
trusted library allocation
page read and write
4229000
trusted library allocation
page read and write
4211000
trusted library allocation
page read and write
1D3E000
heap
page read and write
4220000
trusted library allocation
page read and write
423F000
trusted library allocation
page read and write
4263000
trusted library allocation
page read and write
422C000
trusted library allocation
page read and write
4220000
trusted library allocation
page read and write
1F0000
heap
page read and write
1D81000
heap
page read and write
1D95000
heap
page read and write
422C000
trusted library allocation
page read and write
1D8E000
heap
page read and write
4257000
trusted library allocation
page read and write
400000
unkown
page readonly
4225000
trusted library allocation
page read and write
4295000
trusted library allocation
page read and write
4295000
trusted library allocation
page read and write
1C8F000
stack
page read and write
4244000
trusted library allocation
page read and write
45AD000
trusted library allocation
page read and write
4275000
trusted library allocation
page read and write
426C000
trusted library allocation
page read and write
4226000
trusted library allocation
page read and write
422C000
trusted library allocation
page read and write
42C2000
trusted library allocation
page read and write
1D8A000
heap
page read and write
422D000
trusted library allocation
page read and write
4310000
heap
page read and write
1D2A000
heap
page read and write
1D76000
heap
page read and write
4212000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
1D98000
heap
page read and write
4266000
trusted library allocation
page read and write
367F000
stack
page read and write
4259000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
4211000
trusted library allocation
page read and write
4246000
trusted library allocation
page read and write
4267000
trusted library allocation
page read and write
427F000
trusted library allocation
page read and write
1D76000
heap
page read and write
422D000
trusted library allocation
page read and write
423F000
trusted library allocation
page read and write
1D18000
heap
page read and write
4211000
trusted library allocation
page read and write
1D95000
heap
page read and write
357E000
stack
page read and write
470B000
trusted library allocation
page read and write
1D2A000
heap
page read and write
418000
unkown
page write copy
4244000
trusted library allocation
page read and write
4264000
trusted library allocation
page read and write
4296000
trusted library allocation
page read and write
4237000
trusted library allocation
page read and write
3780000
remote allocation
page read and write
3700000
direct allocation
page read and write
1CEC000
heap
page read and write
1D8E000
heap
page read and write
40FE000
stack
page read and write
3790000
heap
page read and write
373E000
stack
page read and write
1D95000
heap
page read and write
422C000
trusted library allocation
page read and write
4217000
trusted library allocation
page read and write
1CFE000
heap
page read and write
1D78000
heap
page read and write
43F6000
trusted library allocation
page read and write
41FE000
stack
page read and write
427B000
trusted library allocation
page read and write
425D000
trusted library allocation
page read and write
446E000
stack
page read and write
4234000
trusted library allocation
page read and write
1CA8000
heap
page read and write
4249000
trusted library allocation
page read and write
4258000
trusted library allocation
page read and write
1D1C000
heap
page read and write
42C2000
trusted library allocation
page read and write
4258000
trusted library allocation
page read and write
4234000
trusted library allocation
page read and write
3780000
remote allocation
page read and write
4261000
trusted library allocation
page read and write
1B80000
heap
page read and write
1D1B000
heap
page read and write
4253000
trusted library allocation
page read and write
425E000
trusted library allocation
page read and write
1D94000
heap
page read and write
4254000
trusted library allocation
page read and write
1A12000
unkown
page read and write
4256000
trusted library allocation
page read and write
3FBE000
stack
page read and write
421E000
trusted library allocation
page read and write
4258000
trusted library allocation
page read and write
1D00000
heap
page read and write
422F000
trusted library allocation
page read and write
422D000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
3ADF000
stack
page read and write
1D7B000
heap
page read and write
422D000
trusted library allocation
page read and write
39DE000
stack
page read and write
1D76000
heap
page read and write
422D000
trusted library allocation
page read and write
422D000
trusted library allocation
page read and write
4264000
trusted library allocation
page read and write
1D8B000
heap
page read and write
1D2A000
heap
page read and write
1D76000
heap
page read and write
4256000
trusted library allocation
page read and write
4271000
trusted library allocation
page read and write
4336000
trusted library allocation
page read and write
436E000
trusted library allocation
page read and write
1D93000
heap
page read and write
422C000
trusted library allocation
page read and write
422D000
trusted library allocation
page read and write
4218000
trusted library allocation
page read and write
4285000
trusted library allocation
page read and write
44B000
unkown
page execute and read and write
1CFC000
heap
page read and write
422D000
trusted library allocation
page read and write
429E000
trusted library allocation
page read and write
4264000
trusted library allocation
page read and write
4215000
trusted library allocation
page read and write
425C000
trusted library allocation
page read and write
4247000
trusted library allocation
page read and write
427D000
trusted library allocation
page read and write
426D000
trusted library allocation
page read and write
40BF000
stack
page read and write
1D2A000
heap
page read and write
1D92000
heap
page read and write
3B1E000
stack
page read and write
4266000
trusted library allocation
page read and write
4251000
trusted library allocation
page read and write
4258000
trusted library allocation
page read and write
4258000
trusted library allocation
page read and write
4234000
trusted library allocation
page read and write
1D96000
heap
page read and write
4268000
trusted library allocation
page read and write
4259000
trusted library allocation
page read and write
4234000
trusted library allocation
page read and write
1B5E000
stack
page read and write
3680000
direct allocation
page execute and read and write
1A14000
unkown
page readonly
4245000
trusted library allocation
page read and write
422C000
trusted library allocation
page read and write
1CAE000
heap
page read and write
43EE000
trusted library allocation
page read and write
9B000
stack
page read and write
421F000
trusted library allocation
page read and write
4244000
trusted library allocation
page read and write
4247000
trusted library allocation
page read and write
4486000
trusted library allocation
page read and write
377D000
stack
page read and write
399E000
stack
page read and write
1D04000
heap
page read and write
42AB000
trusted library allocation
page read and write
1D1A000
heap
page read and write
1D76000
heap
page read and write
422C000
trusted library allocation
page read and write
4276000
trusted library allocation
page read and write
1D8E000
heap
page read and write
4246000
trusted library allocation
page read and write
4244000
trusted library allocation
page read and write
421D000
trusted library allocation
page read and write
4311000
heap
page read and write
4211000
trusted library allocation
page read and write
423C000
trusted library allocation
page read and write
4232000
trusted library allocation
page read and write
1D8B000
heap
page read and write
1D2A000
heap
page read and write
1A14000
unkown
page readonly
1D92000
heap
page read and write
4243000
trusted library allocation
page read and write
1CFF000
heap
page read and write
424A000
trusted library allocation
page read and write
4286000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
422C000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
4263000
trusted library allocation
page read and write
1D8E000
heap
page read and write
422C000
trusted library allocation
page read and write
4295000
trusted library allocation
page read and write
42C2000
trusted library allocation
page read and write
4240000
trusted library allocation
page read and write
422B000
trusted library allocation
page read and write
425C000
trusted library allocation
page read and write
4229000
trusted library allocation
page read and write
4268000
trusted library allocation
page read and write
1D7D000
heap
page read and write
422D000
trusted library allocation
page read and write
43E6000
trusted library allocation
page read and write
1D90000
heap
page read and write
1D90000
heap
page read and write
422F000
trusted library allocation
page read and write
424C000
trusted library allocation
page read and write
426E000
trusted library allocation
page read and write
4245000
trusted library allocation
page read and write
4231000
trusted library allocation
page read and write
42B6000
trusted library allocation
page read and write
422C000
trusted library allocation
page read and write
1D91000
heap
page read and write
4234000
trusted library allocation
page read and write
4218000
trusted library allocation
page read and write
4256000
trusted library allocation
page read and write
4266000
trusted library allocation
page read and write
4220000
trusted library allocation
page read and write
4244000
trusted library allocation
page read and write
1D8E000
heap
page read and write
4266000
trusted library allocation
page read and write
1D95000
heap
page read and write
4210000
trusted library allocation
page read and write
1D78000
heap
page read and write
4216000
trusted library allocation
page read and write
4225000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
421C000
trusted library allocation
page read and write
1D9E000
heap
page read and write
5114000
trusted library allocation
page read and write
4231000
trusted library allocation
page read and write
4212000
trusted library allocation
page read and write
389D000
stack
page read and write
1CA0000
heap
page read and write
1D76000
heap
page read and write
422D000
trusted library allocation
page read and write
1B87000
heap
page read and write
1D2A000
heap
page read and write
1D90000
heap
page read and write
4256000
trusted library allocation
page read and write
4227000
trusted library allocation
page read and write
4246000
trusted library allocation
page read and write
1D1A000
heap
page read and write
422C000
trusted library allocation
page read and write
4295000
trusted library allocation
page read and write
421A000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
4275000
trusted library allocation
page read and write
1D90000
heap
page read and write
421E000
trusted library allocation
page read and write
422D000
trusted library allocation
page read and write
4211000
trusted library allocation
page read and write
426C000
trusted library allocation
page read and write
4256000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
4244000
trusted library allocation
page read and write
4251000
trusted library allocation
page read and write
4214000
trusted library allocation
page read and write
425D000
trusted library allocation
page read and write
422D000
trusted library allocation
page read and write
1B10000
heap
page read and write
456F000
stack
page read and write
1D95000
heap
page read and write
431D000
trusted library allocation
page read and write
422D000
trusted library allocation
page read and write
424A000
trusted library allocation
page read and write
4242000
trusted library allocation
page read and write
427A000
trusted library allocation
page read and write
422A000
trusted library allocation
page read and write
4229000
trusted library allocation
page read and write
3C1F000
stack
page read and write
36D0000
heap
page read and write
422C000
trusted library allocation
page read and write
4276000
trusted library allocation
page read and write
423D000
trusted library allocation
page read and write
36F0000
heap
page read and write
423E000
trusted library allocation
page read and write
4229000
trusted library allocation
page read and write
401000
unkown
page execute read
There are 334 hidden memdumps, click here to show them.