Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
GPgMeqI8Gy.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_GPgMeqI8Gy.exe_de8d58464aa976eaa2d71339736e9f1ea83188_862451b2_447a96d9-4583-4615-85b3-a704a995c147\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E03.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sun Apr 21 19:09:20 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F0E.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8F2E.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\~DF1873810ED438744D.TMP
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\GPgMeqI8Gy.exe
|
"C:\Users\user\Desktop\GPgMeqI8Gy.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 2040
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
fuckurfeelins.anondns.net
|
|
||
|
https://www.google.com
|
unknown
|
||
|
https://paste.ee/r/tC4AKy
|
unknown
|
||
|
https://paste.ee/r/tC4AKs
|
unknown
|
||
|
https://paste.ee/r/tC4AKZd
|
unknown
|
||
|
https://paste.ee/r/tC4AKpns
|
unknown
|
||
|
https://www.google.com;
|
unknown
|
||
|
https://paste.ee/
|
unknown
|
||
|
https://analytics.paste.ee;
|
unknown
|
||
|
https://analytics.paste.ee
|
unknown
|
||
|
https://paste.ee/r/tC4AK)
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
https://cdnjs.cloudflare.com
|
unknown
|
||
|
https://cdnjs.cloudflare.com;
|
unknown
|
||
|
https://paste.ee/r/tC4AK
|
104.21.84.67
|
||
|
https://secure.gravatar.com
|
unknown
|
||
|
https://themes.googleusercontent.com
|
unknown
|
||
|
https://paste.ee/r/tC4AK_
|
unknown
|
There are 8 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
paste.ee
|
104.21.84.67
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
104.21.84.67
|
paste.ee
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
ProgramId
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
FileId
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
LongPathHash
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
Name
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
OriginalFileName
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
Publisher
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
Version
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
BinFileVersion
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
BinaryType
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
ProductName
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
ProductVersion
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
LinkDate
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
BinProductVersion
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
Size
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
Language
|
||
|
\REGISTRY\A\{385dc7bb-61e5-e78f-d44f-6eede873110c}\Root\InventoryApplicationFile\gpgmeqi8gy.exe|ac480bc19874cbd8
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
890000
|
heap
|
page read and write
|
|
|
|
24A0000
|
heap
|
page read and write
|
||
|
17DE0000
|
remote allocation
|
page read and write
|
||
|
2410000
|
heap
|
page read and write
|
||
|
3117000
|
unkown
|
page read and write
|
||
|
68E000
|
unkown
|
page readonly
|
||
|
8B3000
|
heap
|
page read and write
|
||
|
17DE0000
|
remote allocation
|
page read and write
|
||
|
66B000
|
unkown
|
page read and write
|
||
|
428000
|
unkown
|
page execute read
|
||
|
160C7000
|
heap
|
page read and write
|
||
|
314D000
|
unkown
|
page read and write
|
||
|
317D000
|
unkown
|
page read and write
|
||
|
412000
|
unkown
|
page execute read
|
||
|
2450000
|
heap
|
page read and write
|
||
|
16413000
|
heap
|
page read and write
|
||
|
17F1F000
|
stack
|
page read and write
|
||
|
16493000
|
heap
|
page read and write
|
||
|
44B000
|
unkown
|
page execute read
|
||
|
160B1000
|
heap
|
page read and write
|
||
|
1645D000
|
heap
|
page read and write
|
||
|
249C000
|
stack
|
page read and write
|
||
|
6D9000
|
unkown
|
page readonly
|
||
|
8A2000
|
heap
|
page read and write
|
||
|
412000
|
unkown
|
page execute read
|
||
|
160F9000
|
heap
|
page read and write
|
||
|
164F6000
|
heap
|
page read and write
|
||
|
164A1000
|
heap
|
page read and write
|
||
|
161D6000
|
heap
|
page read and write
|
||
|
165EE000
|
stack
|
page read and write
|
||
|
A4F000
|
stack
|
page read and write
|
||
|
2BF0000
|
heap
|
page read and write
|
||
|
695000
|
unkown
|
page readonly
|
||
|
16457000
|
heap
|
page read and write
|
||
|
68E000
|
unkown
|
page readonly
|
||
|
163C8000
|
heap
|
page read and write
|
||
|
24A3000
|
heap
|
page read and write
|
||
|
16445000
|
heap
|
page read and write
|
||
|
1646C000
|
heap
|
page read and write
|
||
|
163FC000
|
heap
|
page read and write
|
||
|
160D6000
|
heap
|
page read and write
|
||
|
161C7000
|
heap
|
page read and write
|
||
|
2454000
|
heap
|
page read and write
|
||
|
1640D000
|
heap
|
page read and write
|
||
|
45E000
|
unkown
|
page execute read
|
||
|
1612D000
|
heap
|
page read and write
|
||
|
16470000
|
heap
|
page read and write
|
||
|
16541000
|
heap
|
page read and write
|
||
|
16172000
|
heap
|
page read and write
|
||
|
160B0000
|
heap
|
page read and write
|
||
|
16127000
|
heap
|
page read and write
|
||
|
8A2000
|
heap
|
page read and write
|
||
|
85E000
|
heap
|
page read and write
|
||
|
1D5000
|
heap
|
page read and write
|
||
|
2CF5000
|
trusted library section
|
page read and write
|
||
|
16400000
|
heap
|
page read and write
|
||
|
6C7000
|
unkown
|
page readonly
|
||
|
17E1E000
|
stack
|
page read and write
|
||
|
16456000
|
heap
|
page read and write
|
||
|
161C1000
|
heap
|
page read and write
|
||
|
16157000
|
heap
|
page read and write
|
||
|
1611F000
|
heap
|
page read and write
|
||
|
160B1000
|
heap
|
page read and write
|
||
|
44B000
|
unkown
|
page execute read
|
||
|
163D9000
|
heap
|
page read and write
|
||
|
428000
|
unkown
|
page execute read
|
||
|
45E000
|
unkown
|
page execute read
|
||
|
419000
|
unkown
|
page execute read
|
||
|
160F9000
|
heap
|
page read and write
|
||
|
17D5F000
|
stack
|
page read and write
|
||
|
163C8000
|
heap
|
page read and write
|
||
|
2370000
|
heap
|
page read and write
|
||
|
164A2000
|
heap
|
page read and write
|
||
|
673000
|
unkown
|
page readonly
|
||
|
163D7000
|
heap
|
page read and write
|
||
|
2379000
|
heap
|
page read and write
|
||
|
6A4000
|
unkown
|
page readonly
|
||
|
673000
|
unkown
|
page readonly
|
||
|
1648E000
|
heap
|
page read and write
|
||
|
1650B000
|
heap
|
page read and write
|
||
|
160D6000
|
heap
|
page read and write
|
||
|
670000
|
unkown
|
page read and write
|
||
|
709000
|
unkown
|
page readonly
|
||
|
1646B000
|
heap
|
page read and write
|
||
|
3108000
|
unkown
|
page read and write
|
||
|
83E000
|
stack
|
page read and write
|
||
|
8A0000
|
heap
|
page read and write
|
||
|
850000
|
heap
|
page read and write
|
||
|
164A6000
|
heap
|
page read and write
|
||
|
24B0000
|
trusted library allocation
|
page read and write
|
||
|
16125000
|
heap
|
page read and write
|
||
|
1D0000
|
heap
|
page read and write
|
||
|
17C5E000
|
stack
|
page read and write
|
||
|
8D8000
|
heap
|
page read and write
|
||
|
48D000
|
unkown
|
page execute read
|
||
|
1676E000
|
stack
|
page read and write
|
||
|
8F2000
|
heap
|
page read and write
|
||
|
163CE000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2350000
|
trusted library allocation
|
page execute read
|
||
|
1641A000
|
heap
|
page read and write
|
||
|
163B7000
|
heap
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
1672F000
|
stack
|
page read and write
|
||
|
1613C000
|
heap
|
page read and write
|
||
|
161B0000
|
heap
|
page read and write
|
||
|
8DF000
|
heap
|
page read and write
|
||
|
16570000
|
heap
|
page read and write
|
||
|
1616A000
|
heap
|
page read and write
|
||
|
1652E000
|
heap
|
page read and write
|
||
|
8B9000
|
heap
|
page read and write
|
||
|
24A7000
|
heap
|
page read and write
|
||
|
1686F000
|
stack
|
page read and write
|
||
|
2CF0000
|
trusted library section
|
page read and write
|
||
|
8BC000
|
heap
|
page read and write
|
||
|
163C2000
|
heap
|
page read and write
|
||
|
160C1000
|
heap
|
page read and write
|
||
|
1645C000
|
heap
|
page read and write
|
||
|
8A4000
|
heap
|
page read and write
|
||
|
709000
|
unkown
|
page readonly
|
||
|
19A000
|
stack
|
page read and write
|
||
|
16449000
|
heap
|
page read and write
|
||
|
164EE000
|
stack
|
page read and write
|
||
|
1610C000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
163B1000
|
heap
|
page read and write
|
||
|
695000
|
unkown
|
page readonly
|
||
|
164FC000
|
heap
|
page read and write
|
||
|
163CF000
|
heap
|
page read and write
|
||
|
164E5000
|
heap
|
page read and write
|
||
|
164AD000
|
stack
|
page read and write
|
||
|
313A000
|
unkown
|
page read and write
|
||
|
16461000
|
heap
|
page read and write
|
||
|
16446000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
1645B000
|
heap
|
page read and write
|
||
|
163E4000
|
heap
|
page read and write
|
||
|
1620C000
|
heap
|
page read and write
|
||
|
160C1000
|
heap
|
page read and write
|
||
|
89F000
|
heap
|
page read and write
|
||
|
16134000
|
heap
|
page read and write
|
||
|
873000
|
heap
|
page read and write
|
||
|
710000
|
heap
|
page read and write
|
||
|
17C0F000
|
stack
|
page read and write
|
||
|
168AE000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
8A4000
|
heap
|
page read and write
|
||
|
6C7000
|
unkown
|
page readonly
|
||
|
2340000
|
heap
|
page read and write
|
||
|
17DE0000
|
remote allocation
|
page read and write
|
||
|
30F0000
|
unkown
|
page read and write
|
||
|
61F000
|
unkown
|
page execute read
|
||
|
48D000
|
unkown
|
page execute read
|
||
|
163B3000
|
heap
|
page read and write
|
||
|
1610C000
|
heap
|
page read and write
|
||
|
161F9000
|
heap
|
page read and write
|
||
|
6A4000
|
unkown
|
page readonly
|
||
|
2390000
|
heap
|
page read and write
|
||
|
24A4000
|
heap
|
page read and write
|
||
|
A8E000
|
stack
|
page read and write
|
||
|
163D5000
|
heap
|
page read and write
|
||
|
161B1000
|
heap
|
page read and write
|
||
|
163DD000
|
heap
|
page read and write
|
||
|
163CA000
|
heap
|
page read and write
|
||
|
1648F000
|
heap
|
page read and write
|
||
|
419000
|
unkown
|
page execute read
|
||
|
6D9000
|
unkown
|
page readonly
|
||
|
23B0000
|
heap
|
page read and write
|
||
|
906000
|
heap
|
page read and write
|
||
|
3101000
|
unkown
|
page read and write
|
||
|
85A000
|
heap
|
page read and write
|
||
|
2420000
|
heap
|
page read and write
|
||
|
163FA000
|
heap
|
page read and write
|
||
|
1615F000
|
heap
|
page read and write
|
||
|
163BE000
|
heap
|
page read and write
|
||
|
1640F000
|
heap
|
page read and write
|
||
|
160C7000
|
heap
|
page read and write
|
||
|
61F000
|
unkown
|
page execute read
|
||
|
B8F000
|
stack
|
page read and write
|
||
|
1644A000
|
heap
|
page read and write
|
||
|
86F000
|
heap
|
page read and write
|
||
|
1662E000
|
stack
|
page read and write
|
||
|
163C4000
|
heap
|
page read and write
|
||
|
16407000
|
heap
|
page read and write
|
||
|
24A7000
|
heap
|
page read and write
|
||
|
7F0000
|
heap
|
page read and write
|
There are 176 hidden memdumps, click here to show them.