IOC Report
Scan_PDF_3269252267.exe

loading gif

Files

File Path
Type
Category
Malicious
Scan_PDF_3269252267.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Scan_PDF_3269252_fa341ae57d71ae7e7b2778d1ef9fa7b6b7bc40_f83fe985_9d33202f-831e-4896-b8ed-87978e5387c5\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DE9.tmp.dmp
Mini DuMP crash report, 14 streams, Wed Oct 2 04:13:09 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F80.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FCF.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZRZDXR93\AD7YJBRP.log
Unicode text, UTF-16, little-endian text, with very long lines (653), with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Scan_PDF_3269252267.exe
"C:\Users\user\Desktop\Scan_PDF_3269252267.exe"
 malicious
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 756

URLs

Name
IP
Malicious
http://upx.sf.net
unknown
https://app.cloudfiles-secure.io/Bin/ScreenConnect.Client.application?e=Support&y=Guest&h=kkl22.ddns
unknown
https://app.cloudfiles-secure.io
unknown
https://app.cloudfiles-secure.io/Bin/ScreenConnect.Client.application?e=Support&y=
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
app.cloudfiles-secure.io
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C
Blob
HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579
Blob
HKEY_CURRENT_USER_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
ComponentStore_RandomString
HKEY_CURRENT_USER_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
ComponentStore_RandomString
HKEY_CURRENT_USER_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager
StateStore_RandomString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASMANCS
FileDirectory
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
ProgramId
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
FileId
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
LowerCaseLongPath
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
LongPathHash
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
Name
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
OriginalFileName
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
Publisher
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
Version
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
BinFileVersion
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
BinaryType
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
ProductName
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
ProductVersion
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
LinkDate
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
BinProductVersion
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
AppxPackageFullName
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
AppxPackageRelativeId
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
Size
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
Language
\REGISTRY\A\{bf878eed-e917-d7ed-946d-a598a4ac4835}\Root\InventoryApplicationFile\scan_pdf_3269252|c5d44cd8b29cb3d4
Usn
There are 28 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
7FFE16502000
trusted library allocation
page read and write
2DCE000
stack
page read and write
7FFE165E6000
trusted library allocation
page execute and read and write
28868FE000
stack
page read and write
1DAB7E26000
heap
page read and write
1DA9F6A6000
trusted library allocation
page read and write
288723D000
stack
page read and write
1DA9F90C000
trusted library allocation
page read and write
1DA9F74D000
trusted library allocation
page read and write
1DA9F681000
trusted library allocation
page read and write
7A0000
heap
page read and write
FAE000
stack
page read and write
1DA9F79A000
trusted library allocation
page read and write
7B0000
heap
page read and write
1DA9DC10000
heap
page read and write
1DAB7D61000
heap
page read and write
7FFE165C0000
trusted library allocation
page execute and read and write
28864F3000
stack
page read and write
DB0000
heap
page read and write
7FFE166D0000
trusted library allocation
page read and write
1DAB7DFB000
heap
page read and write
7FFE1651D000
trusted library allocation
page execute and read and write
1DA9DA9B000
heap
page read and write
288733E000
stack
page read and write
D9E000
stack
page read and write
1DAB81F0000
heap
page read and write
2F0E000
stack
page read and write
1DA9F757000
trusted library allocation
page read and write
1DA9DCD0000
trusted library allocation
page read and write
C50000
heap
page read and write
1DA9F530000
heap
page execute and read and write
1DA9DC80000
trusted library allocation
page read and write
1DAB8395000
heap
page read and write
7FFE16500000
trusted library allocation
page read and write
1DA9F4E0000
heap
page read and write
1DAB9810000
heap
page read and write
1DA9F900000
trusted library allocation
page read and write
D5F000
stack
page read and write
1DAB7E24000
heap
page read and write
1DA9DC50000
trusted library allocation
page read and write
7FFE166A0000
trusted library allocation
page read and write
7FFE165BC000
trusted library allocation
page execute and read and write
2886E3E000
stack
page read and write
1DA9DAC4000
heap
page read and write
1DAB8505000
heap
page read and write
1DAB8393000
heap
page read and write
28861CE000
stack
page read and write
1DAB8500000
heap
page read and write
E4C000
heap
page read and write
1DAB9548000
heap
page read and write
7FFE16700000
trusted library allocation
page execute and read and write
1DA9DA60000
heap
page read and write
1DAB8350000
heap
page read and write
E0C000
heap
page read and write
7FFE16510000
trusted library allocation
page read and write
7FFE166F0000
trusted library allocation
page execute and read and write
210000
unkown
page readonly
288753E000
stack
page read and write
1DA9DA49000
heap
page read and write
2886BFD000
stack
page read and write
159E000
stack
page read and write
7FFE165B6000
trusted library allocation
page read and write
7FE000
stack
page read and write
1DA9F74A000
trusted library allocation
page read and write
1DA9D9F0000
heap
page read and write
1DAB953C000
heap
page read and write
1DAB8375000
heap
page read and write
1DAB81F3000
heap
page read and write
7FFE16512000
trusted library allocation
page read and write
1DAAF681000
trusted library allocation
page read and write
7FFE16620000
trusted library allocation
page execute and read and write
1DAB7E2B000
heap
page read and write
7FFE166C0000
trusted library allocation
page read and write
1DA9F83A000
trusted library allocation
page read and write
1DA9F510000
heap
page execute and read and write
1DA9DA87000
heap
page read and write
DBA000
heap
page read and write
1DA9DAFF000
heap
page read and write
15A0000
heap
page read and write
1DAB838B000
heap
page read and write
1DA9F750000
trusted library allocation
page read and write
1DAB7E30000
heap
page read and write
221000
unkown
page write copy
1DA9F670000
heap
page read and write
7FFE165B0000
trusted library allocation
page read and write
1DA9DA7B000
heap
page read and write
1DAB837B000
heap
page read and write
1DA9DA85000
heap
page read and write
1DA9DC75000
heap
page read and write
1DA9F857000
trusted library allocation
page read and write
1DA9DC70000
heap
page read and write
1DA9F6A3000
trusted library allocation
page read and write
7FFE1652B000
trusted library allocation
page execute and read and write
1DA9DB20000
heap
page read and write
2886AFE000
stack
page read and write
13EF000
stack
page read and write
1DAAF68E000
trusted library allocation
page read and write
1DA9D9E0000
heap
page read and write
211000
unkown
page execute read
2886DEA000
stack
page read and write
1DA9DA5B000
heap
page read and write
223000
unkown
page readonly
1DAB83A1000
heap
page read and write
7FFE16504000
trusted library allocation
page read and write
1DAB8367000
heap
page read and write
28865FF000
stack
page read and write
1DAB9510000
heap
page read and write
7FFE1655C000
trusted library allocation
page execute and read and write
1DAB7D40000
heap
page read and write
300E000
stack
page read and write
1DAB7E1C000
heap
page read and write
1DA9F68A000
trusted library allocation
page read and write
1510000
heap
page read and write
7FFE1652D000
trusted library allocation
page execute and read and write
288713E000
stack
page read and write
73B000
stack
page read and write
7FF4C3280000
trusted library allocation
page execute and read and write
7FFE16520000
trusted library allocation
page read and write
211000
unkown
page execute read
14EF000
stack
page read and write
1DA9F7F6000
trusted library allocation
page read and write
1DAB9816000
heap
page read and write
1DAB7E80000
heap
page read and write
1DAB7DB1000
heap
page read and write
2D8E000
stack
page read and write
2886CF8000
stack
page read and write
28869FC000
stack
page read and write
1DAB7D75000
heap
page read and write
1DAB836B000
heap
page read and write
1DAAF691000
trusted library allocation
page read and write
21B000
unkown
page readonly
288763E000
stack
page read and write
1DA9F6AA000
trusted library allocation
page read and write
1DAB7EB0000
heap
page read and write
DBE000
heap
page read and write
1DAB7DB5000
heap
page read and write
1DAB9537000
heap
page read and write
223000
unkown
page readonly
288743D000
stack
page read and write
7FFE16503000
trusted library allocation
page execute and read and write
1DAB9521000
heap
page read and write
7FFE166B0000
trusted library allocation
page read and write
1DA9F650000
heap
page execute and read and write
1DA9F803000
trusted library allocation
page read and write
21B000
unkown
page readonly
1DA9DA66000
heap
page read and write
1DA9F741000
trusted library allocation
page read and write
1DA9F744000
trusted library allocation
page read and write
1DA9F75D000
trusted library allocation
page read and write
1DAB8340000
heap
page read and write
1DA9DCE0000
heap
page read and write
1DA9DACA000
heap
page read and write
1DAB7DE2000
heap
page read and write
C0E000
stack
page read and write
1DA9DA40000
heap
page read and write
310E000
stack
page read and write
1DA9F7FC000
trusted library allocation
page read and write
1DA9DCE5000
heap
page read and write
1DA9F729000
trusted library allocation
page read and write
2E00000
heap
page read and write
221000
unkown
page read and write
1DA9F500000
heap
page read and write
1DA9DAC6000
heap
page read and write
288793A000
stack
page read and write
AFC000
stack
page read and write
1550000
heap
page read and write
1DA9F747000
trusted library allocation
page read and write
1DAB9812000
heap
page read and write
1DAB954B000
heap
page read and write
1DAB7E60000
trusted library section
page readonly
210000
unkown
page readonly
7FFE16524000
trusted library allocation
page read and write
1DAB7DD3000
heap
page read and write
1DA9F513000
heap
page execute and read and write
2886F3E000
stack
page read and write
1DA9DA7D000
heap
page read and write
1DA9DA10000
heap
page read and write
C4E000
stack
page read and write
1DA9F850000
trusted library allocation
page read and write
7FFE1650D000
trusted library allocation
page execute and read and write
7FFE166E0000
trusted library allocation
page read and write
There are 171 hidden memdumps, click here to show them.