Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
jicQJ2cdlM.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ScreenUpdateSync[1].exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\A8A9.tmp.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_A8A9.tmp.exe_3d5dfce8cbb349ab566cb0d21cc9f0676852a9d_1a91c480_0c8ad302-763a-4e17-a97b-0dc6c15c2859\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAACC.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sat Oct 26 16:58:28 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE58.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEB6.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\jicQJ2cdlM.exe
|
"C:\Users\user\Desktop\jicQJ2cdlM.exe"
|
|
|
|
C:\Users\user\AppData\Local\Temp\A8A9.tmp.exe
|
"C:\Users\user\AppData\Local\Temp\A8A9.tmp.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7404 -s 1132
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://62.204.41.177/edd20096ecef326d.php
|
62.204.41.177
|
|
|
|
http://62.204.41.177/
|
62.204.41.177
|
|
|
|
http://62.204.41.177
|
unknown
|
|
|
|
http://62.204.41.177/edd20096ecef326d.phpL
|
unknown
|
||
|
https://post-to-me.com/track_prt.php?sub=&cc=DE
|
unknown
|
||
|
https://post-to-me.com/track_prt.php?sub=
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exeP
|
unknown
|
||
|
http://62.204.41.177/K
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.phpJ
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exek4
|
unknown
|
||
|
http://62.204.41.177/$c
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.php6
|
unknown
|
||
|
https://post-to-me.com/track_prt.php?sub=0&cc=DE
|
104.21.56.70
|
||
|
https://post-to-me.com/track_prt.php?sub=0&cc=DET
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exe48rt8k8rt4rwe5rbSOFTWARE
|
unknown
|
||
|
https://post-to-me.com/
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
https://post-to-me.com/v
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exea
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.phpIc
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exe
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.phpGc:
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.phpb
|
unknown
|
||
|
http://62.204.41.177S
|
unknown
|
There are 14 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
post-to-me.com
|
104.21.56.70
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
62.204.41.177
|
unknown
|
United Kingdom
|
|
|
|
176.113.115.37
|
unknown
|
Russian Federation
|
||
|
104.21.56.70
|
post-to-me.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\prtscreen
|
Enabled
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
ProgramId
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
FileId
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
LongPathHash
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
Name
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
OriginalFileName
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
Publisher
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
Version
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
BinFileVersion
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
BinaryType
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
ProductName
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
ProductVersion
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
LinkDate
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
BinProductVersion
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
Size
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
Language
|
||
|
\REGISTRY\A\{09435240-3365-7182-ceb5-6a330624b9ef}\Root\InventoryApplicationFile\a8a9.tmp.exe|764abec2f79a8b5
|
Usn
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
There are 12 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2E39000
|
heap
|
page read and write
|
|
|
|
2D60000
|
direct allocation
|
page read and write
|
|
|
|
2D10000
|
direct allocation
|
page execute and read and write
|
|
|
|
400000
|
unkown
|
page execute and read and write
|
|
|
|
9B000
|
stack
|
page read and write
|
||
|
560000
|
heap
|
page read and write
|
||
|
878000
|
heap
|
page read and write
|
||
|
886000
|
heap
|
page read and write
|
||
|
1D15F000
|
stack
|
page read and write
|
||
|
452000
|
unkown
|
page write copy
|
||
|
4B1000
|
unkown
|
page execute and read and write
|
||
|
4A80000
|
heap
|
page read and write
|
||
|
886000
|
heap
|
page read and write
|
||
|
2DA0000
|
heap
|
page read and write
|
||
|
7E0000
|
heap
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
2DD0000
|
remote allocation
|
page read and write
|
||
|
4A83000
|
heap
|
page read and write
|
||
|
2B70000
|
heap
|
page read and write
|
||
|
1CB5F000
|
stack
|
page read and write
|
||
|
297F000
|
stack
|
page read and write
|
||
|
859000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
7DF000
|
stack
|
page read and write
|
||
|
8A3000
|
heap
|
page read and write
|
||
|
2F23000
|
heap
|
page read and write
|
||
|
283F000
|
stack
|
page read and write
|
||
|
273F000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
89D000
|
heap
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
1CF1E000
|
stack
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
878000
|
heap
|
page read and write
|
||
|
4A3E000
|
stack
|
page read and write
|
||
|
8A4000
|
heap
|
page read and write
|
||
|
29CE000
|
stack
|
page read and write
|
||
|
2BBE000
|
stack
|
page read and write
|
||
|
5EE000
|
stack
|
page read and write
|
||
|
2C30000
|
heap
|
page read and write
|
||
|
19A000
|
stack
|
page read and write
|
||
|
2F20000
|
heap
|
page read and write
|
||
|
40E000
|
unkown
|
page execute read
|
||
|
532000
|
unkown
|
page readonly
|
||
|
1CC5F000
|
stack
|
page read and write
|
||
|
8A4000
|
heap
|
page read and write
|
||
|
2F24000
|
heap
|
page read and write
|
||
|
2E33000
|
heap
|
page read and write
|
||
|
2DF0000
|
heap
|
page read and write
|
||
|
2B46000
|
unkown
|
page readonly
|
||
|
2BD0000
|
heap
|
page read and write
|
||
|
7EE000
|
heap
|
page read and write
|
||
|
9DF000
|
stack
|
page read and write
|
||
|
2DD0000
|
remote allocation
|
page read and write
|
||
|
2DD0000
|
remote allocation
|
page read and write
|
||
|
1D01D000
|
stack
|
page read and write
|
||
|
65C000
|
unkown
|
page execute and read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
3310000
|
heap
|
page read and write
|
||
|
195000
|
stack
|
page read and write
|
||
|
2FEF000
|
stack
|
page read and write
|
||
|
43F000
|
unkown
|
page read and write
|
||
|
400000
|
unkown
|
page execute and read and write
|
||
|
1CC9E000
|
stack
|
page read and write
|
||
|
44F000
|
unkown
|
page readonly
|
||
|
2E87000
|
heap
|
page read and write
|
||
|
2B46000
|
unkown
|
page readonly
|
||
|
43F000
|
unkown
|
page write copy
|
||
|
5AE000
|
stack
|
page read and write
|
||
|
A77000
|
heap
|
page read and write
|
||
|
2E6A000
|
heap
|
page read and write
|
||
|
86F000
|
heap
|
page read and write
|
||
|
2F0F000
|
stack
|
page read and write
|
||
|
532000
|
unkown
|
page readonly
|
||
|
896000
|
heap
|
page read and write
|
||
|
1CDDE000
|
stack
|
page read and write
|
||
|
2F64000
|
heap
|
page read and write
|
||
|
A50000
|
direct allocation
|
page read and write
|
||
|
4E2000
|
unkown
|
page execute and read and write
|
||
|
329F000
|
stack
|
page read and write
|
||
|
9E0000
|
direct allocation
|
page execute and read and write
|
||
|
2ACF000
|
stack
|
page read and write
|
||
|
AC0000
|
heap
|
page read and write
|
||
|
4A7E000
|
stack
|
page read and write
|
||
|
2C1E000
|
stack
|
page read and write
|
||
|
85A000
|
heap
|
page read and write
|
||
|
43C000
|
unkown
|
page readonly
|
||
|
30EF000
|
stack
|
page read and write
|
||
|
1D05E000
|
stack
|
page read and write
|
||
|
2E0E000
|
stack
|
page read and write
|
||
|
8A1000
|
heap
|
page read and write
|
||
|
2C35000
|
heap
|
page read and write
|
||
|
3990000
|
heap
|
page read and write
|
||
|
48CE000
|
stack
|
page read and write
|
||
|
49F0000
|
heap
|
page read and write
|
||
|
64A000
|
unkown
|
page execute and read and write
|
||
|
8D4000
|
heap
|
page read and write
|
||
|
287E000
|
stack
|
page read and write
|
||
|
A90000
|
heap
|
page read and write
|
||
|
1CD9F000
|
stack
|
page read and write
|
||
|
2F30000
|
heap
|
page read and write
|
||
|
2DFE000
|
heap
|
page read and write
|
||
|
836000
|
heap
|
page read and write
|
||
|
319C000
|
stack
|
page read and write
|
||
|
7F9000
|
heap
|
page execute and read and write
|
||
|
B4E000
|
stack
|
page read and write
|
||
|
8D7000
|
heap
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
7EA000
|
heap
|
page read and write
|
||
|
2F21000
|
heap
|
page read and write
|
||
|
605000
|
heap
|
page read and write
|
||
|
1CEDE000
|
stack
|
page read and write
|
||
|
49CF000
|
stack
|
page read and write
|
||
|
89D000
|
heap
|
page read and write
|
||
|
2F25000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
B50000
|
heap
|
page read and write
|
||
|
600000
|
heap
|
page read and write
|
||
|
40E000
|
unkown
|
page execute read
|
||
|
4BD000
|
unkown
|
page execute and read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
B0E000
|
stack
|
page read and write
|
||
|
2E09000
|
heap
|
page execute and read and write
|
||
|
86F000
|
heap
|
page read and write
|
||
|
8A4000
|
heap
|
page read and write
|
There are 116 hidden memdumps, click here to show them.