IOC Report
qrLdMv1QXG.exe

loading gif

Files

File Path
Type
Category
Malicious
qrLdMv1QXG.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_qrLdMv1QXG.exe_6f2fc2e5454b6ca343fbd4712c4948319d291f0_4915b7ca_140b9d2d-4e76-46c7-ad79-3a5aba1822de\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_qrLdMv1QXG.exe_dab42b4fbe31c195557b22d8807203fa4c45350_4915b7ca_5670d64c-ae8b-4d92-80a6-a5bc086660b9\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1F1.tmp.dmp
Mini DuMP crash report, 15 streams, Sun Apr 21 08:03:08 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2DC.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE31C.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE637.tmp.dmp
Mini DuMP crash report, 15 streams, Sun Apr 21 08:03:10 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF328.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF358.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\qrLdMv1QXG.exe
"C:\Users\user\Desktop\qrLdMv1QXG.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1520
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1656

URLs

Name
IP
Malicious
incredibleextedwj.shop
malicious
shortsvelventysjo.shop
malicious
tolerateilusidjukl.shop
malicious
liabilitynighstjsko.shop
malicious
shatterbreathepsw.shop
malicious
demonstationfukewko.shop
malicious
productivelookewr.shop
malicious
strollheavengwu.shop
malicious
alcojoldwograpciw.shop
malicious
https://duckduckgo.com/chrome_newtab
unknown
https://strollheavengwu.shop/9
unknown
https://duckduckgo.com/ac/?q=
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://strollheavengwu.shop/E
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://strollheavengwu.shop/api
104.21.15.198
http://crl.rootca1.amazontrust.com/rootca1.crl0
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://ocsp.rootca1.amazontrust.com0:
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?
unknown
https://strollheavengwu.shop/apies:
unknown
https://strollheavengwu.shop/C1
unknown
https://support.mozilla.org/products/firefoxgro.all
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://strollheavengwu.shop/
unknown
There are 22 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
strollheavengwu.shop
104.21.15.198
 malicious

IPs

IP
Domain
Country
Malicious
104.21.15.198
strollheavengwu.shop
United States
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
ProgramId
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
FileId
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
LowerCaseLongPath
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
LongPathHash
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
Name
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
OriginalFileName
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
Publisher
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
Version
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
BinFileVersion
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
BinaryType
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
ProductName
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
ProductVersion
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
LinkDate
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
BinProductVersion
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
AppxPackageFullName
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
AppxPackageRelativeId
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
Size
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
Language
\REGISTRY\A\{95736e5c-def7-c70d-4b06-ba2ab6796163}\Root\InventoryApplicationFile\qrldmv1qxg.exe|b6ca8a5efc987b74
Usn
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page execute and read and write
 malicious
1CC0000
heap
page read and write
423A000
trusted library allocation
page read and write
442A000
trusted library allocation
page read and write
4439000
trusted library allocation
page read and write
42A4000
trusted library allocation
page read and write
4294000
trusted library allocation
page read and write
423B000
trusted library allocation
page read and write
1DB6000
heap
page read and write
1DAF000
heap
page read and write
4236000
trusted library allocation
page read and write
374E000
stack
page read and write
465E000
stack
page read and write
4237000
trusted library allocation
page read and write
51C7000
trusted library allocation
page read and write
1CCE000
heap
page read and write
1DAB000
heap
page read and write
1D8F000
heap
page read and write
4200000
trusted library allocation
page read and write
1DA8000
heap
page read and write
4478000
trusted library allocation
page read and write
400000
unkown
page readonly
3760000
remote allocation
page read and write
1DB2000
heap
page read and write
1DB6000
heap
page read and write
43D8000
trusted library allocation
page read and write
1DB4000
heap
page read and write
4250000
trusted library allocation
page read and write
4236000
trusted library allocation
page read and write
1B55000
heap
page read and write
421B000
trusted library allocation
page read and write
429B000
trusted library allocation
page read and write
420B000
trusted library allocation
page read and write
4236000
trusted library allocation
page read and write
1DA5000
heap
page read and write
42C6000
trusted library allocation
page read and write
42DC000
trusted library allocation
page read and write
1A13000
unkown
page readonly
3FAE000
stack
page read and write
1DB8000
heap
page read and write
427F000
trusted library allocation
page read and write
42A4000
trusted library allocation
page read and write
4CB1000
trusted library allocation
page read and write
425F000
trusted library allocation
page read and write
42BD000
trusted library allocation
page read and write
47BA000
trusted library allocation
page read and write
1CDE000
heap
page execute and read and write
4425000
trusted library allocation
page read and write
42D5000
trusted library allocation
page read and write
1B57000
heap
page read and write
3760000
remote allocation
page read and write
429D000
trusted library allocation
page read and write
43AA000
trusted library allocation
page read and write
4401000
trusted library allocation
page read and write
37CE000
stack
page read and write
4408000
trusted library allocation
page read and write
1DAF000
heap
page read and write
4429000
trusted library allocation
page read and write
40AF000
stack
page read and write
3C2F000
stack
page read and write
A1000
stack
page read and write
4205000
trusted library allocation
page read and write
1DB0000
heap
page read and write
4298000
trusted library allocation
page read and write
4233000
trusted library allocation
page read and write
423B000
trusted library allocation
page read and write
42B9000
trusted library allocation
page read and write
4295000
trusted library allocation
page read and write
4235000
trusted library allocation
page read and write
421B000
trusted library allocation
page read and write
442F000
trusted library allocation
page read and write
422A000
trusted library allocation
page read and write
42C9000
trusted library allocation
page read and write
42A4000
trusted library allocation
page read and write
4224000
trusted library allocation
page read and write
42A4000
trusted library allocation
page read and write
1DA8000
heap
page read and write
1DAB000
heap
page read and write
42B5000
trusted library allocation
page read and write
47A0000
heap
page read and write
4300000
heap
page read and write
42A5000
trusted library allocation
page read and write
36B0000
heap
page read and write
42C2000
trusted library allocation
page read and write
4296000
trusted library allocation
page read and write
370D000
stack
page read and write
1DAD000
heap
page read and write
4222000
trusted library allocation
page read and write
417000
unkown
page write copy
1D95000
heap
page read and write
4235000
trusted library allocation
page read and write
4294000
trusted library allocation
page read and write
1D39000
heap
page read and write
427D000
trusted library allocation
page read and write
1DA8000
heap
page read and write
1DB8000
heap
page read and write
42C6000
trusted library allocation
page read and write
4309000
trusted library allocation
page read and write
421B000
trusted library allocation
page read and write
4295000
trusted library allocation
page read and write
42BC000
trusted library allocation
page read and write
42A3000
trusted library allocation
page read and write
1DAB000
heap
page read and write
4203000
trusted library allocation
page read and write
4328000
trusted library allocation
page read and write
1D96000
heap
page read and write
42A4000
trusted library allocation
page read and write
1DAB000
heap
page read and write
42D3000
trusted library allocation
page read and write
42A6000
trusted library allocation
page read and write
4360000
trusted library allocation
page read and write
42A4000
trusted library allocation
page read and write
1DB6000
heap
page read and write
42CC000
trusted library allocation
page read and write
3760000
remote allocation
page read and write
1DB8000
heap
page read and write
42C4000
trusted library allocation
page read and write
1DAA000
heap
page read and write
1A13000
unkown
page readonly
42B4000
trusted library allocation
page read and write
401000
unkown
page execute read
1A11000
unkown
page read and write
1DAD000
heap
page read and write
4258000
trusted library allocation
page read and write
420F000
trusted library allocation
page read and write
4227000
trusted library allocation
page read and write
4203000
trusted library allocation
page read and write
422B000
trusted library allocation
page read and write
4419000
trusted library allocation
page read and write
4294000
trusted library allocation
page read and write
42B0000
trusted library allocation
page read and write
42D3000
trusted library allocation
page read and write
42BF000
trusted library allocation
page read and write
1DB0000
heap
page read and write
1DB0000
heap
page read and write
1DAF000
heap
page read and write
429E000
trusted library allocation
page read and write
42D5000
trusted library allocation
page read and write
42C8000
trusted library allocation
page read and write
1D3C000
heap
page read and write
420B000
trusted library allocation
page read and write
4208000
trusted library allocation
page read and write
4203000
trusted library allocation
page read and write
4294000
trusted library allocation
page read and write
4400000
trusted library allocation
page read and write
43B0000
trusted library allocation
page read and write
42D1000
trusted library allocation
page read and write
1C5F000
stack
page read and write
42A4000
trusted library allocation
page read and write
4401000
trusted library allocation
page read and write
1DB9000
heap
page read and write
1DA4000
heap
page read and write
42D3000
trusted library allocation
page read and write
42D5000
trusted library allocation
page read and write
1DB2000
heap
page read and write
1DA7000
heap
page read and write
4295000
trusted library allocation
page read and write
1DB2000
heap
page read and write
42B4000
trusted library allocation
page read and write
4401000
trusted library allocation
page read and write
423B000
trusted library allocation
page read and write
420B000
trusted library allocation
page read and write
421B000
trusted library allocation
page read and write
4298000
trusted library allocation
page read and write
1B4E000
stack
page read and write
4220000
trusted library allocation
page read and write
392D000
stack
page read and write
4235000
trusted library allocation
page read and write
4309000
trusted library allocation
page read and write
1D93000
heap
page read and write
3780000
heap
page read and write
3820000
heap
page read and write
421B000
trusted library allocation
page read and write
42AA000
trusted library allocation
page read and write
422B000
trusted library allocation
page read and write
420B000
trusted library allocation
page read and write
4408000
trusted library allocation
page read and write
1D99000
heap
page read and write
4301000
heap
page read and write
1DAA000
heap
page read and write
41D000
unkown
page write copy
42D4000
trusted library allocation
page read and write
4253000
trusted library allocation
page read and write
42A5000
trusted library allocation
page read and write
4296000
trusted library allocation
page read and write
429B000
trusted library allocation
page read and write
4407000
trusted library allocation
page read and write
4220000
trusted library allocation
page read and write
42CF000
trusted library allocation
page read and write
42C6000
trusted library allocation
page read and write
4225000
trusted library allocation
page read and write
1DA6000
heap
page read and write
42AA000
trusted library allocation
page read and write
365F000
stack
page read and write
1D59000
heap
page read and write
4237000
trusted library allocation
page read and write
1B00000
heap
page read and write
42C7000
trusted library allocation
page read and write
43E8000
trusted library allocation
page read and write
42C7000
trusted library allocation
page read and write
42CC000
trusted library allocation
page read and write
41FE000
stack
page read and write
1B50000
heap
page read and write
1DAB000
heap
page read and write
4845000
trusted library allocation
page read and write
4239000
trusted library allocation
page read and write
42D5000
trusted library allocation
page read and write
42C6000
trusted library allocation
page read and write
1DAD000
heap
page read and write
42D3000
trusted library allocation
page read and write
42D3000
trusted library allocation
page read and write
4248000
trusted library allocation
page read and write
429D000
trusted library allocation
page read and write
36B0000
direct allocation
page read and write
495F000
trusted library allocation
page read and write
1DB0000
heap
page read and write
1DA3000
heap
page read and write
1D94000
heap
page read and write
420F000
trusted library allocation
page read and write
4241000
trusted library allocation
page read and write
4206000
trusted library allocation
page read and write
4225000
trusted library allocation
page read and write
1DB1000
heap
page read and write
1DAF000
heap
page read and write
380E000
stack
page read and write
1DA3000
heap
page read and write
44B000
unkown
page execute and read and write
4231000
trusted library allocation
page read and write
4221000
trusted library allocation
page read and write
4224000
trusted library allocation
page read and write
4297000
trusted library allocation
page read and write
1DAC000
heap
page read and write
42C6000
trusted library allocation
page read and write
4221000
trusted library allocation
page read and write
1DB7000
heap
page read and write
421B000
trusted library allocation
page read and write
4295000
trusted library allocation
page read and write
4237000
trusted library allocation
page read and write
4250000
trusted library allocation
page read and write
1CCA000
heap
page read and write
9B000
stack
page read and write
42D5000
trusted library allocation
page read and write
1D98000
heap
page read and write
40FE000
stack
page read and write
1DB2000
heap
page read and write
1DB9000
heap
page read and write
42A4000
trusted library allocation
page read and write
1DAB000
heap
page read and write
4439000
trusted library allocation
page read and write
42CF000
trusted library allocation
page read and write
1DB7000
heap
page read and write
4203000
trusted library allocation
page read and write
4294000
trusted library allocation
page read and write
1DB2000
heap
page read and write
4419000
trusted library allocation
page read and write
475F000
stack
page read and write
420F000
trusted library allocation
page read and write
3660000
direct allocation
page execute and read and write
4208000
trusted library allocation
page read and write
424E000
trusted library allocation
page read and write
1D0C000
heap
page read and write
1F0000
heap
page read and write
4293000
trusted library allocation
page read and write
430F000
trusted library allocation
page read and write
4340000
trusted library allocation
page read and write
1DB8000
heap
page read and write
429C000
trusted library allocation
page read and write
3A2D000
stack
page read and write
4295000
trusted library allocation
page read and write
3B2F000
stack
page read and write
1DB2000
heap
page read and write
1CAE000
stack
page read and write
410000
unkown
page readonly
429D000
trusted library allocation
page read and write
4206000
trusted library allocation
page read and write
429D000
trusted library allocation
page read and write
4435000
trusted library allocation
page read and write
42D5000
trusted library allocation
page read and write
420B000
trusted library allocation
page read and write
42D5000
trusted library allocation
page read and write
42C6000
trusted library allocation
page read and write
1D8F000
heap
page read and write
42D5000
trusted library allocation
page read and write
429D000
trusted library allocation
page read and write
4431000
trusted library allocation
page read and write
4238000
trusted library allocation
page read and write
4298000
trusted library allocation
page read and write
43E0000
trusted library allocation
page read and write
42B6000
trusted library allocation
page read and write
420A000
trusted library allocation
page read and write
1DA9000
heap
page read and write
There are 281 hidden memdumps, click here to show them.