IOC Report
Ou0ZT4968y.exe

loading gif

Files

File Path
Type
Category
Malicious
Ou0ZT4968y.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Ou0ZT4968y.exe_6d94c01abebf2aab25e322aa91a877df2b8acdd6_dac8cab9_0497fefa\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFF8.tmp.dmp
Mini DuMP crash report, 14 streams, Fri Nov 25 03:47:14 2022, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1AF.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE24C.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
\Device\ConDrv
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Ou0ZT4968y.exe
C:\Users\user\Desktop\Ou0ZT4968y.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 144

URLs

Name
IP
Malicious
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
https://gcc.gnu.org/bugs/):
unknown
https://sectigo.com/CPS0
unknown
https://studio.youtube.comSAPISIDHASH
unknown
https://studio.youtube.comX-Originapplication/jsonContent-TypesessionTokenctx
unknown
http://ocsp.sectigo.com0
unknown
https://studio.youtube.com
unknown
https://studio.youtube.com/reauth
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
AmiHivePermissionsCorrect
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
AmiHiveOwnerCorrect
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
ProgramId
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
FileId
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
LowerCaseLongPath
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
LongPathHash
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
Name
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
Publisher
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
Version
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
BinFileVersion
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
BinaryType
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
ProductName
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
ProductVersion
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
LinkDate
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
BinProductVersion
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
Size
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
Language
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
IsPeFile
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
IsOsComponent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
ExceptionRecord
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
00184009DD6AB7DA
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
There are 14 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
11F0000
unkown
page readonly
115F000
unkown
page execute read
1F856858000
heap
page read and write
51F0000
heap
page read and write
790000
heap
page read and write
4CAE7FF000
stack
page read and write
516F000
remote allocation
page read and write
1151000
unkown
page execute read
244592CA000
heap
page read and write
21CAD902000
heap
page read and write
1F856849000
heap
page read and write
2331E402000
heap
page read and write
114C522A000
heap
page read and write
96F97F000
stack
page read and write
1150000
unkown
page readonly
7ACF71C000
stack
page read and write
C60000
remote allocation
page read and write
D00000
heap
page read and write
24459313000
heap
page read and write
115B000
unkown
page execute read
56D4000
trusted library allocation
page read and write
790000
unkown
page read and write
114C5790000
trusted library allocation
page read and write
1C11DE5D000
heap
page read and write
114C526F000
heap
page read and write
24459243000
heap
page read and write
14EF000
unkown
page read and write
114C5900000
heap
page read and write
2331EA02000
trusted library allocation
page read and write
21CAD800000
heap
page read and write
1C11DE70000
heap
page read and write
1F85682A000
heap
page read and write
1F8581C0000
trusted library allocation
page read and write
96FC7E000
stack
page read and write
E02277B000
stack
page read and write
115F000
unkown
page execute read
1C11DE59000
heap
page read and write
25DA987B000
heap
page read and write
114C5C30000
heap
page read and write
1C11DE47000
heap
page read and write
781237F000
stack
page read and write
2331E990000
trusted library allocation
page read and write
563F000
stack
page read and write
21CAD838000
heap
page read and write
56C6000
trusted library allocation
page read and write
24459050000
heap
page read and write
403B2FF000
stack
page read and write
403A57B000
stack
page read and write
781247E000
stack
page read and write
114C5258000
heap
page read and write
2331E452000
heap
page read and write
14F6000
unkown
page readonly
1C11DE41000
heap
page read and write
E0225FC000
stack
page read and write
14F6000
unkown
page readonly
114C5C23000
heap
page read and write
24459266000
heap
page read and write
11EA000
unkown
page execute read
114C5C00000
heap
page read and write
1063000
direct allocation
page execute and read and write
115B000
unkown
page execute read
1F856802000
heap
page read and write
E022B7E000
stack
page read and write
18CFB902000
heap
page read and write
25DA9902000
heap
page read and write
25DA97E0000
trusted library allocation
page read and write
21CAD802000
heap
page read and write
1C11DE61000
heap
page read and write
114C57B0000
trusted library allocation
page read and write
1F8566D0000
heap
page read and write
2331E1D0000
heap
page read and write
4CAE4FE000
stack
page read and write
244592B9000
heap
page read and write
D00000
heap
page read and write
5700000
trusted library allocation
page read and write
114C5213000
heap
page read and write
14EF000
unkown
page read and write
114C5243000
heap
page read and write
1F8567D0000
trusted library allocation
page read and write
14F4000
unkown
page readonly
1C11DE85000
heap
page read and write
11F0000
unkown
page readonly
56C0000
trusted library allocation
page read and write
25DAA002000
trusted library allocation
page read and write
D0A000
heap
page read and write
114C5313000
heap
page read and write
96F6FF000
stack
page read and write
120A000
unkown
page read and write
1150000
unkown
page readonly
5270000
heap
page read and write
D3C49FF000
stack
page read and write
56C1000
trusted library allocation
page read and write
18CFB800000
heap
page read and write
1C11DE30000
heap
page read and write
114C5274000
heap
page read and write
114C5922000
heap
page read and write
114C59B2000
heap
page read and write
24459268000
heap
page read and write
1C11DE7C000
heap
page read and write
18CFB770000
heap
page read and write
24459A02000
heap
page read and write
1F856859000
heap
page read and write
1C11DE00000
heap
page read and write
25DA9913000
heap
page read and write
1C11DE2A000
heap
page read and write
96F57A000
stack
page read and write
114C5C30000
heap
page read and write
24459B00000
heap
page read and write
2331E42F000
heap
page read and write
1F856800000
heap
page read and write
114C5C02000
heap
page read and write
18CFB829000
heap
page read and write
E0222FC000
stack
page read and write
7ACFCFF000
stack
page read and write
114C5995000
heap
page read and write
24459302000
heap
page read and write
1C11DE4D000
heap
page read and write
2331E445000
heap
page read and write
2331E43C000
heap
page read and write
56DB000
trusted library allocation
page read and write
1C11DE68000
heap
page read and write
14F6000
unkown
page readonly
114C5802000
heap
page read and write
114C5908000
heap
page read and write
96FA7A000
stack
page read and write
18CFB870000
heap
page read and write
7811C8B000
stack
page read and write
14F4000
unkown
page readonly
1C11DE7B000
heap
page read and write
18CFB760000
heap
page read and write
781257F000
stack
page read and write
21CAD82A000
heap
page read and write
1C11DF02000
heap
page read and write
115F000
unkown
page execute read
18CFB802000
heap
page read and write
B50000
trusted library allocation
page read and write
11EA000
unkown
page execute read
7AD00FC000
stack
page read and write
25DA9900000
heap
page read and write
24459229000
heap
page read and write
B50000
trusted library allocation
page read and write
4CAE5FE000
stack
page read and write
51E0000
trusted library allocation
page read and write
E021ECB000
stack
page read and write
1150000
unkown
page readonly
1151000
unkown
page execute read
4CAE27B000
stack
page read and write
1C11DE58000
heap
page read and write
1C11DE39000
heap
page read and write
114C5293000
heap
page read and write
1F856660000
heap
page read and write
7FC000
stack
page read and write
11EA000
unkown
page execute read
1C11DE6B000
heap
page read and write
96F16B000
stack
page read and write
4B60000
heap
page read and write
96F879000
stack
page read and write
D5B577E000
stack
page read and write
18CFB85B000
heap
page read and write
114C538E000
heap
page read and write
1C11DE57000
heap
page read and write
18CFC002000
trusted library allocation
page read and write
114C596F000
heap
page read and write
114C5276000
heap
page read and write
7ACFDFE000
stack
page read and write
56EA000
trusted library allocation
page read and write
56B6000
heap
page read and write
E02257F000
stack
page read and write
1F856900000
heap
page read and write
14EF000
unkown
page write copy
114C5902000
heap
page read and write
96FBFF000
stack
page read and write
B60000
heap
page read and write
56FF000
trusted library allocation
page read and write
114C5030000
heap
page read and write
114C5291000
heap
page read and write
115F000
unkown
page execute read
18CFB913000
heap
page read and write
523E000
stack
page read and write
56EA000
trusted library allocation
page read and write
AFD000
stack
page read and write
1F856872000
heap
page read and write
7ACFFFD000
stack
page read and write
E0226FD000
stack
page read and write
1F85688A000
heap
page read and write
114C5922000
heap
page read and write
B60000
heap
page read and write
24458FE0000
heap
page read and write
1C11DE5B000
heap
page read and write
25DA9800000
heap
page read and write
2331E42A000
heap
page read and write
AFD000
stack
page read and write
25DA9829000
heap
page read and write
D5B51FE000
stack
page read and write
120A000
unkown
page read and write
114C5255000
heap
page read and write
1F856902000
heap
page read and write
1C11DE6E000
heap
page read and write
114C5C36000
heap
page read and write
1C11DE56000
heap
page read and write
D3C43CB000
stack
page read and write
E02247E000
stack
page read and write
7ACFB7E000
stack
page read and write
25DA9802000
heap
page read and write
AFD000
stack
page read and write
25DA986B000
heap
page read and write
24459B12000
heap
page read and write
114C5C27000
heap
page read and write
5240000
trusted library allocation
page read and write
114C523C000
heap
page read and write
1C11E550000
trusted library allocation
page read and write
D3C47FE000
stack
page read and write
2331E502000
heap
page read and write
114C4FC0000
heap
page read and write
1C11DE28000
heap
page read and write
244592E2000
heap
page read and write
21CADD90000
remote allocation
page read and write
1F856813000
heap
page read and write
1F856864000
heap
page read and write
21CADD90000
remote allocation
page read and write
56BD000
heap
page read and write
7FC000
stack
page read and write
114C528B000
heap
page read and write
1151000
unkown
page execute read
2331E443000
heap
page read and write
1C11DE3C000
heap
page read and write
11F0000
unkown
page readonly
1F858202000
trusted library allocation
page read and write
1473000
unkown
page execute and read and write
403A97B000
stack
page read and write
18CFB7D0000
heap
page read and write
D5B55FD000
stack
page read and write
5700000
trusted library allocation
page read and write
1C11DE7F000
heap
page read and write
25DA97B0000
heap
page read and write
25DA9879000
heap
page read and write
14F6000
unkown
page readonly
25DA9740000
heap
page read and write
D5B4D0C000
stack
page read and write
4CAE37E000
stack
page read and write
403AFFE000
stack
page read and write
96F7FB000
stack
page read and write
1C11DDF0000
heap
page read and write
103F000
direct allocation
page execute and read and write
114C4FD0000
heap
page read and write
4EF9000
stack
page read and write
403B1FF000
stack
page read and write
C60000
remote allocation
page read and write
E022A7C000
stack
page read and write
D3C48F9000
stack
page read and write
56B9000
heap
page read and write
D5B547D000
stack
page read and write
567E000
stack
page read and write
56C1000
trusted library allocation
page read and write
114C5C13000
heap
page read and write
1C11DE60000
heap
page read and write
1473000
unkown
page execute and read and write
25DA9853000
heap
page read and write
24459213000
heap
page read and write
21CAD590000
heap
page read and write
114C5265000
heap
page read and write
59BF000
stack
page read and write
7AD01FE000
stack
page read and write
1C11DE13000
heap
page read and write
18CFB877000
heap
page read and write
1F856670000
heap
page read and write
D00000
heap
page read and write
1F8587C0000
remote allocation
page read and write
1473000
unkown
page execute and read and write
781227B000
stack
page read and write
7AD02FC000
stack
page read and write
114C5200000
heap
page read and write
56DB000
trusted library allocation
page read and write
403AEFE000
stack
page read and write
516D000
remote allocation
page read and write
14F4000
unkown
page readonly
1F856849000
heap
page read and write
18CFBF30000
trusted library allocation
page read and write
56B0000
heap
page read and write
1F8567F0000
trusted library allocation
page read and write
E02297E000
stack
page read and write
120A000
unkown
page write copy
244592E6000
heap
page read and write
244592BC000
heap
page read and write
18CFB813000
heap
page read and write
4CAE2FE000
stack
page read and write
7FC000
stack
page read and write
21CAD5A0000
heap
page read and write
25DA9813000
heap
page read and write
1C11DD80000
heap
page read and write
1F85683D000
heap
page read and write
1C11E602000
trusted library allocation
page read and write
1C11DE78000
heap
page read and write
E00000
direct allocation
page execute and read and write
114C53B9000
heap
page read and write
1F858400000
trusted library allocation
page read and write
D0A000
heap
page read and write
56EA000
trusted library allocation
page read and write
4BDD000
stack
page read and write
96FB7E000
stack
page read and write
25DA983C000
heap
page read and write
D3C4AFF000
stack
page read and write
1C11DD90000
heap
page read and write
1F856859000
heap
page read and write
1F8587C0000
remote allocation
page read and write
56BC000
heap
page read and write
E02287F000
stack
page read and write
114C5288000
heap
page read and write
D5B54FF000
stack
page read and write
24458FF0000
heap
page read and write
4B70000
trusted library allocation
page readonly
14EF000
unkown
page read and write
114C5943000
heap
page read and write
1F856848000
heap
page read and write
14F4000
unkown
page readonly
4CAE6FE000
stack
page read and write
1151000
unkown
page execute read
1C11DE63000
heap
page read and write
18CFB841000
heap
page read and write
114C53E5000
heap
page read and write
115B000
unkown
page execute read
1150000
unkown
page readonly
B60000
heap
page read and write
120A000
unkown
page read and write
D5B527E000
stack
page read and write
115B000
unkown
page execute read
11F0000
unkown
page readonly
114C5954000
heap
page read and write
21CADE02000
trusted library allocation
page read and write
18CFB862000
heap
page read and write
1F856918000
heap
page read and write
114C5917000
heap
page read and write
1C11DE43000
heap
page read and write
514C000
remote allocation
page read and write
403ACFF000
stack
page read and write
24459270000
heap
page read and write
B50000
trusted library allocation
page read and write
1F8587C0000
remote allocation
page read and write
2331E230000
heap
page read and write
21CAD7D0000
trusted library allocation
page read and write
2331E1E0000
heap
page read and write
7ACFEFF000
stack
page read and write
403AAFB000
stack
page read and write
403ADFD000
stack
page read and write
21CAD840000
heap
page read and write
2331E400000
heap
page read and write
D0A000
heap
page read and write
24459150000
trusted library allocation
page read and write
21CAD859000
heap
page read and write
21CAD813000
heap
page read and write
5278000
heap
page read and write
2331E413000
heap
page read and write
25DA9750000
heap
page read and write
24459200000
heap
page read and write
790000
unkown
page read and write
11EA000
unkown
page execute read
D5B56FD000
stack
page read and write
D5B537E000
stack
page read and write
403ABFE000
stack
page read and write
105F000
direct allocation
page execute and read and write
21CAD600000
heap
page read and write
403B0FE000
stack
page read and write
21CADD90000
remote allocation
page read and write
1F856913000
heap
page read and write
There are 354 hidden memdumps, click here to show them.