Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
TP77MvSzt2.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ScreenUpdateSync[1].exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\9B3F.tmp.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9B3F.tmp.exe_e95d69dd1c263f625dbdd8c1f29a502d88fbc8_bb09a85e_a5f03171-0ee3-41fc-b5fa-9883119bc31d\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA83F.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sat Oct 26 17:08:35 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAFF.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAB2F.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\TP77MvSzt2.exe
|
"C:\Users\user\Desktop\TP77MvSzt2.exe"
|
|
|
|
C:\Users\user\AppData\Local\Temp\9B3F.tmp.exe
|
"C:\Users\user\AppData\Local\Temp\9B3F.tmp.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 1076
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://62.204.41.177/edd20096ecef326d.php
|
62.204.41.177
|
|
|
|
http://62.204.41.177/
|
62.204.41.177
|
|
|
|
http://62.204.41.177
|
unknown
|
|
|
|
https://post-to-me.com/track_prt.php?sub=&cc=DE
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exen
|
unknown
|
||
|
https://post-to-me.com/track_prt.php?sub=
|
unknown
|
||
|
https://post-to-me.com/track_prt.php?sub=0&cc=DE#
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.php:Ic
|
unknown
|
||
|
https://post-to-me.com/track_prt.php?sub=0&cc=DE
|
104.21.56.70
|
||
|
http://176.113.115.37/ScreenUpdateSync.exeu
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.php~I
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exe48rt8k8rt4rwe5rbSOFTWARE
|
unknown
|
||
|
https://post-to-me.com/track_prt.php?sub=0&cc=DEO
|
unknown
|
||
|
https://post-to-me.com/
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.php_JP
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.phpBH
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.phpNH
|
unknown
|
||
|
http://62.204.41.177;ah
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exe
|
unknown
|
||
|
http://62.204.41.177/ows
|
unknown
|
||
|
http://62.204.41.177/%
|
unknown
|
There are 12 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
post-to-me.com
|
104.21.56.70
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
62.204.41.177
|
unknown
|
United Kingdom
|
|
|
|
176.113.115.37
|
unknown
|
Russian Federation
|
||
|
104.21.56.70
|
post-to-me.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\prtscreen
|
Enabled
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
ProgramId
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
FileId
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
LongPathHash
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
Name
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
OriginalFileName
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
Publisher
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
Version
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
BinFileVersion
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
BinaryType
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
ProductName
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
ProductVersion
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
LinkDate
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
BinProductVersion
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
Size
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
Language
|
||
|
\REGISTRY\A\{ab4b5a0d-408a-f076-6a96-0641de5f9438}\Root\InventoryApplicationFile\9b3f.tmp.exe|69ab3c5a47f545c0
|
Usn
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
There are 12 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
400000
|
unkown
|
page execute and read and write
|
|
|
|
2310000
|
direct allocation
|
page read and write
|
|
|
|
903000
|
heap
|
page read and write
|
|
|
|
B00000
|
direct allocation
|
page execute and read and write
|
|
|
|
49DF000
|
stack
|
page read and write
|
||
|
2C50000
|
heap
|
page read and write
|
||
|
1A63E000
|
stack
|
page read and write
|
||
|
5530000
|
remote allocation
|
page read and write
|
||
|
2E87000
|
heap
|
page read and write
|
||
|
2CFE000
|
stack
|
page read and write
|
||
|
1A87F000
|
stack
|
page read and write
|
||
|
511F000
|
stack
|
page read and write
|
||
|
8CA000
|
heap
|
page read and write
|
||
|
51F000
|
unkown
|
page readonly
|
||
|
750000
|
heap
|
page read and write
|
||
|
2E83000
|
heap
|
page read and write
|
||
|
2D90000
|
heap
|
page read and write
|
||
|
740000
|
heap
|
page read and write
|
||
|
5A6E000
|
heap
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
501E000
|
stack
|
page read and write
|
||
|
2CB0000
|
heap
|
page read and write
|
||
|
2380000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
4A1E000
|
stack
|
page read and write
|
||
|
2B56000
|
unkown
|
page readonly
|
||
|
44F000
|
unkown
|
page write copy
|
||
|
AFF000
|
stack
|
page read and write
|
||
|
5530000
|
remote allocation
|
page read and write
|
||
|
2C9E000
|
stack
|
page read and write
|
||
|
2E4B000
|
heap
|
page read and write
|
||
|
954000
|
heap
|
page read and write
|
||
|
43C000
|
unkown
|
page readonly
|
||
|
64A000
|
unkown
|
page execute and read and write
|
||
|
58FF000
|
stack
|
page read and write
|
||
|
5530000
|
remote allocation
|
page read and write
|
||
|
2420000
|
heap
|
page read and write
|
||
|
2DE6000
|
heap
|
page read and write
|
||
|
2F8F000
|
stack
|
page read and write
|
||
|
8C0000
|
heap
|
page read and write
|
||
|
57FC000
|
stack
|
page read and write
|
||
|
19A000
|
stack
|
page read and write
|
||
|
2B56000
|
unkown
|
page readonly
|
||
|
2D20000
|
heap
|
page read and write
|
||
|
2E09000
|
heap
|
page read and write
|
||
|
2383000
|
heap
|
page read and write
|
||
|
1AAFF000
|
stack
|
page read and write
|
||
|
B60000
|
heap
|
page read and write
|
||
|
4A97000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page execute and read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2D9A000
|
heap
|
page read and write
|
||
|
40E000
|
unkown
|
page execute read
|
||
|
44C000
|
unkown
|
page readonly
|
||
|
2E52000
|
heap
|
page read and write
|
||
|
93A000
|
heap
|
page read and write
|
||
|
2E25000
|
heap
|
page read and write
|
||
|
1A8BE000
|
stack
|
page read and write
|
||
|
1AB5E000
|
stack
|
page read and write
|
||
|
8CE000
|
heap
|
page read and write
|
||
|
2DA9000
|
heap
|
page execute and read and write
|
||
|
5A76000
|
heap
|
page read and write
|
||
|
1A73F000
|
stack
|
page read and write
|
||
|
2E1E000
|
heap
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
48DE000
|
stack
|
page read and write
|
||
|
2D9E000
|
heap
|
page read and write
|
||
|
2E08000
|
heap
|
page read and write
|
||
|
745000
|
heap
|
page read and write
|
||
|
308F000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2E37000
|
heap
|
page read and write
|
||
|
89F000
|
stack
|
page read and write
|
||
|
2E4B000
|
heap
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
2E26000
|
heap
|
page read and write
|
||
|
1AC5D000
|
stack
|
page read and write
|
||
|
2E37000
|
heap
|
page read and write
|
||
|
2E52000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
240E000
|
stack
|
page read and write
|
||
|
79E000
|
stack
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
4E2000
|
unkown
|
page execute and read and write
|
||
|
2E1E000
|
heap
|
page read and write
|
||
|
5AA1000
|
heap
|
page read and write
|
||
|
2E4C000
|
heap
|
page read and write
|
||
|
8D9000
|
heap
|
page execute and read and write
|
||
|
23CE000
|
stack
|
page read and write
|
||
|
65C000
|
unkown
|
page execute and read and write
|
||
|
4EDF000
|
stack
|
page read and write
|
||
|
1A77E000
|
stack
|
page read and write
|
||
|
2D40000
|
heap
|
page read and write
|
||
|
195000
|
stack
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
5A60000
|
heap
|
page read and write
|
||
|
5A61000
|
heap
|
page read and write
|
||
|
556E000
|
stack
|
page read and write
|
||
|
2E4C000
|
heap
|
page read and write
|
||
|
43F000
|
unkown
|
page write copy
|
||
|
40E000
|
unkown
|
page execute read
|
||
|
48A0000
|
direct allocation
|
page read and write
|
||
|
4FDF000
|
stack
|
page read and write
|
||
|
4A90000
|
heap
|
page read and write
|
||
|
4830000
|
direct allocation
|
page execute and read and write
|
||
|
1A9FE000
|
stack
|
page read and write
|
||
|
4A20000
|
heap
|
page read and write
|
||
|
1A5FF000
|
stack
|
page read and write
|
||
|
1A9BE000
|
stack
|
page read and write
|
||
|
9FE000
|
stack
|
page read and write
|
||
|
4BD000
|
unkown
|
page execute and read and write
|
||
|
1A4FF000
|
stack
|
page read and write
|
||
|
2CB5000
|
heap
|
page read and write
|
||
|
5A00000
|
heap
|
page read and write
|
||
|
5FB0000
|
heap
|
page read and write
|
||
|
2340000
|
heap
|
page read and write
|
||
|
2E7F000
|
heap
|
page read and write
|
||
|
4B1000
|
unkown
|
page execute and read and write
|
||
|
4A6E000
|
stack
|
page read and write
|
||
|
2E4F000
|
heap
|
page read and write
|
||
|
566F000
|
stack
|
page read and write
|
There are 111 hidden memdumps, click here to show them.