Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
mCe4hBfqCT.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\ScreenUpdateSync[1].exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\64A.tmp.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_64A.tmp.exe_33dbb5a6d938e48242e380f4b853a57f3a468_cc65f0ba_b0e79d25-d904-438b-88ac-c26ceb49f3b6\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2A.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sat Oct 26 06:56:18 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF44.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF74.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\mCe4hBfqCT.exe
|
"C:\Users\user\Desktop\mCe4hBfqCT.exe"
|
|
|
|
C:\Users\user\AppData\Local\Temp\64A.tmp.exe
|
"C:\Users\user\AppData\Local\Temp\64A.tmp.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 1044
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://62.204.41.177/edd20096ecef326d.php
|
62.204.41.177
|
|
|
|
http://62.204.41.177/
|
62.204.41.177
|
|
|
|
http://62.204.41.177
|
unknown
|
|
|
|
https://post-to-me.com/track_prt.php?sub=&cc=DE
|
unknown
|
||
|
http://62.204.41.177sLA
|
unknown
|
||
|
https://post-to-me.com/track_prt.php?sub=
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.phpunf
|
unknown
|
||
|
https://post-to-me.com/track_prt.php?sub=0&cc=DE
|
104.21.56.70
|
||
|
http://176.113.115.37/ScreenUpdateSync.exeY
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exe48rt8k8rt4rwe5rbSOFTWARE
|
unknown
|
||
|
https://post-to-me.com/
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.phpfj
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
https://post-to-me.com/6
|
unknown
|
||
|
https://post-to-me.com/track_prt.php?sub=0&cc=DEf
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exe
|
unknown
|
||
|
http://62.204.41.177/edd20096ecef326d.php1nZ
|
unknown
|
||
|
http://176.113.115.37/ScreenUpdateSync.exe)
|
unknown
|
There are 8 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
post-to-me.com
|
104.21.56.70
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
62.204.41.177
|
unknown
|
United Kingdom
|
|
|
|
176.113.115.37
|
unknown
|
Russian Federation
|
||
|
104.21.56.70
|
post-to-me.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\prtscreen
|
Enabled
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
ProgramId
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
FileId
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
LongPathHash
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
Name
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
OriginalFileName
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
Publisher
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
Version
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
BinFileVersion
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
BinaryType
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
ProductName
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
ProductVersion
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
LinkDate
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
BinProductVersion
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
Size
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
Language
|
||
|
\REGISTRY\A\{5a462e44-81c9-69cb-23af-2ad65d95798f}\Root\InventoryApplicationFile\64a.tmp.exe|2edf493cf9dfa33d
|
Usn
|
There are 10 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4820000
|
direct allocation
|
page read and write
|
|
|
|
400000
|
unkown
|
page execute and read and write
|
|
|
|
2D43000
|
heap
|
page read and write
|
|
|
|
2F00000
|
direct allocation
|
page execute and read and write
|
|
|
|
2D10000
|
heap
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
2DFE000
|
heap
|
page read and write
|
||
|
195000
|
stack
|
page read and write
|
||
|
438000
|
unkown
|
page readonly
|
||
|
5973000
|
heap
|
page read and write
|
||
|
53E0000
|
remote allocation
|
page read and write
|
||
|
4890000
|
direct allocation
|
page read and write
|
||
|
44F000
|
unkown
|
page write copy
|
||
|
1CDAE000
|
stack
|
page read and write
|
||
|
4BD000
|
unkown
|
page execute and read and write
|
||
|
48CE000
|
stack
|
page read and write
|
||
|
2D68000
|
heap
|
page read and write
|
||
|
1CD5F000
|
stack
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
1D05E000
|
stack
|
page read and write
|
||
|
5951000
|
heap
|
page read and write
|
||
|
4FEE000
|
stack
|
page read and write
|
||
|
2C8E000
|
stack
|
page read and write
|
||
|
5950000
|
heap
|
page read and write
|
||
|
2D7C000
|
heap
|
page read and write
|
||
|
2EFF000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2D97000
|
heap
|
page read and write
|
||
|
2B42000
|
unkown
|
page readonly
|
||
|
2B60000
|
heap
|
page read and write
|
||
|
2D9B000
|
heap
|
page read and write
|
||
|
4927000
|
heap
|
page read and write
|
||
|
19A000
|
stack
|
page read and write
|
||
|
2E01000
|
heap
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
2D0A000
|
heap
|
page read and write
|
||
|
1CC5E000
|
stack
|
page read and write
|
||
|
4E2000
|
unkown
|
page execute and read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
1D2AE000
|
stack
|
page read and write
|
||
|
2D29000
|
heap
|
page execute and read and write
|
||
|
3010000
|
direct allocation
|
page execute and read and write
|
||
|
2B56000
|
unkown
|
page readonly
|
||
|
4FAF000
|
stack
|
page read and write
|
||
|
2DC9000
|
heap
|
page read and write
|
||
|
595E000
|
heap
|
page read and write
|
||
|
4910000
|
heap
|
page read and write
|
||
|
488E000
|
stack
|
page read and write
|
||
|
44C000
|
unkown
|
page readonly
|
||
|
1D15F000
|
stack
|
page read and write
|
||
|
53E0000
|
remote allocation
|
page read and write
|
||
|
4920000
|
heap
|
page read and write
|
||
|
598E000
|
heap
|
page read and write
|
||
|
2F70000
|
heap
|
page read and write
|
||
|
2CB0000
|
heap
|
page read and write
|
||
|
2D1A000
|
heap
|
page read and write
|
||
|
4B1000
|
unkown
|
page execute and read and write
|
||
|
2B42000
|
unkown
|
page readonly
|
||
|
2CB5000
|
heap
|
page read and write
|
||
|
4EAE000
|
stack
|
page read and write
|
||
|
64A000
|
unkown
|
page execute and read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
5974000
|
heap
|
page read and write
|
||
|
30C0000
|
heap
|
page read and write
|
||
|
65C000
|
unkown
|
page execute and read and write
|
||
|
4920000
|
heap
|
page read and write
|
||
|
307F000
|
stack
|
page read and write
|
||
|
4923000
|
heap
|
page read and write
|
||
|
2D00000
|
heap
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
2DCA000
|
heap
|
page read and write
|
||
|
30E0000
|
heap
|
page read and write
|
||
|
2B56000
|
unkown
|
page readonly
|
||
|
2C00000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page execute and read and write
|
||
|
2E09000
|
heap
|
page read and write
|
||
|
4D6F000
|
stack
|
page read and write
|
||
|
1C9FF000
|
stack
|
page read and write
|
||
|
53E0000
|
remote allocation
|
page read and write
|
||
|
551F000
|
stack
|
page read and write
|
||
|
57AF000
|
stack
|
page read and write
|
||
|
1D1AE000
|
stack
|
page read and write
|
||
|
5E60000
|
heap
|
page read and write
|
||
|
43B000
|
unkown
|
page read and write
|
||
|
2E09000
|
heap
|
page read and write
|
||
|
1CEAD000
|
stack
|
page read and write
|
||
|
4E6F000
|
stack
|
page read and write
|
||
|
490E000
|
stack
|
page read and write
|
||
|
1CEFE000
|
stack
|
page read and write
|
||
|
2D9B000
|
heap
|
page read and write
|
||
|
490E000
|
stack
|
page read and write
|
||
|
2BAE000
|
stack
|
page read and write
|
||
|
50EF000
|
stack
|
page read and write
|
||
|
541E000
|
stack
|
page read and write
|
||
|
2D1E000
|
heap
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
1CFFE000
|
stack
|
page read and write
|
||
|
56AC000
|
stack
|
page read and write
|
||
|
1CBFF000
|
stack
|
page read and write
|
||
|
2C05000
|
heap
|
page read and write
|
||
|
2D66000
|
heap
|
page read and write
|
||
|
2DB6000
|
heap
|
page read and write
|
||
|
2C40000
|
heap
|
page read and write
|
||
|
1CAFF000
|
stack
|
page read and write
|
||
|
3090000
|
heap
|
page read and write
|
||
|
2CFE000
|
stack
|
page read and write
|
||
|
48CE000
|
stack
|
page read and write
|
||
|
2DA6000
|
heap
|
page read and write
|
||
|
2D19000
|
heap
|
page execute and read and write
|
||
|
2BEE000
|
stack
|
page read and write
|
||
|
5940000
|
heap
|
page read and write
|
||
|
4830000
|
heap
|
page read and write
|
||
|
40E000
|
unkown
|
page execute read
|
||
|
43B000
|
unkown
|
page write copy
|
||
|
2D0E000
|
heap
|
page read and write
|
||
|
300F000
|
stack
|
page read and write
|
||
|
2F0F000
|
stack
|
page read and write
|
||
|
2D95000
|
heap
|
page read and write
|
||
|
40E000
|
unkown
|
page execute read
|
||
|
400000
|
unkown
|
page readonly
|
There are 110 hidden memdumps, click here to show them.