Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
UmJMWJPQ9h.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UmJMWJPQ9h.exe_8c7d42cea5357129cc03c9ecb622c79ad25e318_286f4e9b_64a9bd90-967b-40d1-9fa7-3242816991fd\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B8B.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sun Apr 21 19:13:17 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA06E.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0CC.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\~DF202E41C03DBD0444.TMP
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\UmJMWJPQ9h.exe
|
"C:\Users\user\Desktop\UmJMWJPQ9h.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 1200
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
trusted420.anondns.net
|
|
||
|
https://www.google.com
|
unknown
|
||
|
https://paste.ee/r/tC4AKNU6
|
unknown
|
||
|
https://paste.ee/5
|
unknown
|
||
|
https://paste.ee/r/tC4AKns
|
unknown
|
||
|
https://www.google.com;
|
unknown
|
||
|
https://paste.ee/
|
unknown
|
||
|
https://analytics.paste.ee;
|
unknown
|
||
|
https://paste.ee/r/tC4AK&UN
|
unknown
|
||
|
https://analytics.paste.ee
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
https://cdnjs.cloudflare.com
|
unknown
|
||
|
https://paste.ee/r/tC4AKntAD
|
unknown
|
||
|
https://cdnjs.cloudflare.com;
|
unknown
|
||
|
https://paste.ee/r/tC4AK
|
104.21.84.67
|
||
|
https://secure.gravatar.com
|
unknown
|
||
|
https://themes.googleusercontent.com
|
unknown
|
There are 7 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
paste.ee
|
104.21.84.67
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
104.21.84.67
|
paste.ee
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
ProgramId
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
FileId
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
LongPathHash
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
Name
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
OriginalFileName
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
Publisher
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
Version
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
BinFileVersion
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
BinaryType
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
ProductName
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
ProductVersion
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
LinkDate
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
BinProductVersion
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
Size
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
Language
|
||
|
\REGISTRY\A\{d54e1541-23e8-818d-e7b1-5bce4469a0e5}\Root\InventoryApplicationFile\umjmwjpq9h.exe|b4c8d60990889ec4
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
850000
|
heap
|
page read and write
|
|
|
|
16231000
|
heap
|
page read and write
|
||
|
16221000
|
heap
|
page read and write
|
||
|
695000
|
unkown
|
page readonly
|
||
|
2DE0000
|
trusted library section
|
page read and write
|
||
|
1648B000
|
heap
|
page read and write
|
||
|
87D000
|
heap
|
page read and write
|
||
|
412000
|
unkown
|
page execute read
|
||
|
161AC000
|
heap
|
page read and write
|
||
|
44B000
|
unkown
|
page execute read
|
||
|
19A000
|
stack
|
page read and write
|
||
|
1642F000
|
heap
|
page read and write
|
||
|
16430000
|
remote allocation
|
page read and write
|
||
|
2510000
|
heap
|
page read and write
|
||
|
861000
|
heap
|
page read and write
|
||
|
31F8000
|
unkown
|
page read and write
|
||
|
1642E000
|
heap
|
page read and write
|
||
|
16220000
|
heap
|
page read and write
|
||
|
1646C000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
8A0000
|
heap
|
page read and write
|
||
|
1643A000
|
heap
|
page read and write
|
||
|
BDF000
|
stack
|
page read and write
|
||
|
2DD0000
|
heap
|
page read and write
|
||
|
3207000
|
unkown
|
page read and write
|
||
|
16572000
|
heap
|
page read and write
|
||
|
834000
|
heap
|
page read and write
|
||
|
16169000
|
heap
|
page read and write
|
||
|
45E000
|
unkown
|
page execute read
|
||
|
16477000
|
heap
|
page read and write
|
||
|
16430000
|
remote allocation
|
page read and write
|
||
|
6C7000
|
unkown
|
page readonly
|
||
|
16563000
|
heap
|
page read and write
|
||
|
81A000
|
heap
|
page read and write
|
||
|
16137000
|
heap
|
page read and write
|
||
|
670000
|
unkown
|
page read and write
|
||
|
31F1000
|
unkown
|
page read and write
|
||
|
709000
|
unkown
|
page readonly
|
||
|
2517000
|
heap
|
page read and write
|
||
|
164CC000
|
heap
|
page read and write
|
||
|
326D000
|
unkown
|
page read and write
|
||
|
16440000
|
heap
|
page read and write
|
||
|
1627C000
|
heap
|
page read and write
|
||
|
1647F000
|
heap
|
page read and write
|
||
|
2D9E000
|
stack
|
page read and write
|
||
|
673000
|
unkown
|
page readonly
|
||
|
17FFF000
|
stack
|
page read and write
|
||
|
81E000
|
heap
|
page read and write
|
||
|
864000
|
heap
|
page read and write
|
||
|
16510000
|
heap
|
page read and write
|
||
|
755000
|
heap
|
page read and write
|
||
|
1654C000
|
heap
|
page read and write
|
||
|
16121000
|
heap
|
page read and write
|
||
|
7DE000
|
stack
|
page read and write
|
||
|
6A4000
|
unkown
|
page readonly
|
||
|
673000
|
unkown
|
page readonly
|
||
|
2520000
|
trusted library allocation
|
page read and write
|
||
|
31E0000
|
unkown
|
page read and write
|
||
|
24E0000
|
heap
|
page read and write
|
||
|
44B000
|
unkown
|
page execute read
|
||
|
401000
|
unkown
|
page execute read
|
||
|
161C7000
|
heap
|
page read and write
|
||
|
1646E000
|
stack
|
page read and write
|
||
|
6D9000
|
unkown
|
page readonly
|
||
|
428000
|
unkown
|
page execute read
|
||
|
16169000
|
heap
|
page read and write
|
||
|
16195000
|
heap
|
page read and write
|
||
|
16237000
|
heap
|
page read and write
|
||
|
48D000
|
unkown
|
page execute read
|
||
|
61F000
|
unkown
|
page execute read
|
||
|
16552000
|
heap
|
page read and write
|
||
|
164AE000
|
heap
|
page read and write
|
||
|
61F000
|
unkown
|
page execute read
|
||
|
428000
|
unkown
|
page execute read
|
||
|
400000
|
unkown
|
page readonly
|
||
|
164E3000
|
heap
|
page read and write
|
||
|
864000
|
heap
|
page read and write
|
||
|
164B5000
|
heap
|
page read and write
|
||
|
48D000
|
unkown
|
page execute read
|
||
|
2390000
|
heap
|
page read and write
|
||
|
750000
|
heap
|
page read and write
|
||
|
1617C000
|
heap
|
page read and write
|
||
|
16454000
|
heap
|
page read and write
|
||
|
8B2000
|
heap
|
page read and write
|
||
|
16455000
|
heap
|
page read and write
|
||
|
17EFE000
|
stack
|
page read and write
|
||
|
164ED000
|
heap
|
page read and write
|
||
|
1643F000
|
heap
|
page read and write
|
||
|
161A4000
|
heap
|
page read and write
|
||
|
68E000
|
unkown
|
page readonly
|
||
|
1646F000
|
heap
|
page read and write
|
||
|
16430000
|
remote allocation
|
page read and write
|
||
|
16120000
|
heap
|
page read and write
|
||
|
164F2000
|
heap
|
page read and write
|
||
|
740000
|
trusted library allocation
|
page execute read
|
||
|
ADF000
|
stack
|
page read and write
|
||
|
16434000
|
heap
|
page read and write
|
||
|
1643D000
|
heap
|
page read and write
|
||
|
17DBE000
|
stack
|
page read and write
|
||
|
79E000
|
stack
|
page read and write
|
||
|
2DD9000
|
heap
|
page read and write
|
||
|
164CC000
|
heap
|
page read and write
|
||
|
1813F000
|
stack
|
page read and write
|
||
|
16269000
|
heap
|
page read and write
|
||
|
8C7000
|
heap
|
page read and write
|
||
|
164C7000
|
heap
|
page read and write
|
||
|
800000
|
heap
|
page read and write
|
||
|
323D000
|
unkown
|
page read and write
|
||
|
164C6000
|
heap
|
page read and write
|
||
|
17EBF000
|
stack
|
page read and write
|
||
|
16511000
|
heap
|
page read and write
|
||
|
16246000
|
heap
|
page read and write
|
||
|
6C7000
|
unkown
|
page readonly
|
||
|
16437000
|
heap
|
page read and write
|
||
|
16131000
|
heap
|
page read and write
|
||
|
412000
|
unkown
|
page execute read
|
||
|
810000
|
heap
|
page read and write
|
||
|
16528000
|
heap
|
page read and write
|
||
|
695000
|
unkown
|
page readonly
|
||
|
23D0000
|
heap
|
page read and write
|
||
|
2514000
|
heap
|
page read and write
|
||
|
16523000
|
heap
|
page read and write
|
||
|
16137000
|
heap
|
page read and write
|
||
|
1803E000
|
stack
|
page read and write
|
||
|
16423000
|
heap
|
page read and write
|
||
|
16478000
|
heap
|
page read and write
|
||
|
1656F000
|
stack
|
page read and write
|
||
|
2C60000
|
heap
|
page read and write
|
||
|
85F000
|
heap
|
page read and write
|
||
|
419000
|
unkown
|
page execute read
|
||
|
161DA000
|
heap
|
page read and write
|
||
|
2DE5000
|
trusted library section
|
page read and write
|
||
|
16445000
|
heap
|
page read and write
|
||
|
16146000
|
heap
|
page read and write
|
||
|
1619D000
|
heap
|
page read and write
|
||
|
709000
|
unkown
|
page readonly
|
||
|
16197000
|
heap
|
page read and write
|
||
|
161E2000
|
heap
|
page read and write
|
||
|
45E000
|
unkown
|
page execute read
|
||
|
17D7E000
|
stack
|
page read and write
|
||
|
1648A000
|
heap
|
page read and write
|
||
|
419000
|
unkown
|
page execute read
|
||
|
164D8000
|
heap
|
page read and write
|
||
|
16515000
|
heap
|
page read and write
|
||
|
85E000
|
heap
|
page read and write
|
||
|
6D9000
|
unkown
|
page readonly
|
||
|
16482000
|
heap
|
page read and write
|
||
|
1644C000
|
heap
|
page read and write
|
||
|
2490000
|
heap
|
page read and write
|
||
|
1617C000
|
heap
|
page read and write
|
||
|
2500000
|
heap
|
page read and write
|
||
|
17C7D000
|
stack
|
page read and write
|
||
|
710000
|
heap
|
page read and write
|
||
|
164DE000
|
heap
|
page read and write
|
||
|
898000
|
heap
|
page read and write
|
||
|
1817E000
|
stack
|
page read and write
|
||
|
830000
|
heap
|
page read and write
|
||
|
2513000
|
heap
|
page read and write
|
||
|
872000
|
heap
|
page read and write
|
||
|
16446000
|
heap
|
page read and write
|
||
|
16146000
|
heap
|
page read and write
|
||
|
1618F000
|
heap
|
page read and write
|
||
|
161CF000
|
heap
|
page read and write
|
||
|
164FE000
|
heap
|
page read and write
|
||
|
66B000
|
unkown
|
page read and write
|
||
|
16121000
|
heap
|
page read and write
|
||
|
2517000
|
heap
|
page read and write
|
||
|
16449000
|
heap
|
page read and write
|
||
|
16595000
|
heap
|
page read and write
|
||
|
68E000
|
unkown
|
page readonly
|
||
|
164DB000
|
heap
|
page read and write
|
||
|
165A8000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
16131000
|
heap
|
page read and write
|
||
|
24DC000
|
stack
|
page read and write
|
||
|
864000
|
heap
|
page read and write
|
||
|
2504000
|
heap
|
page read and write
|
||
|
861000
|
heap
|
page read and write
|
||
|
164DD000
|
heap
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
1655D000
|
heap
|
page read and write
|
||
|
1827F000
|
stack
|
page read and write
|
||
|
322A000
|
unkown
|
page read and write
|
||
|
6A4000
|
unkown
|
page readonly
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
16426000
|
heap
|
page read and write
|
There are 176 hidden memdumps, click here to show them.