Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
AyCnklzHb7.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
initial sample
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_AyC_fb9b92f43c102562343d31e4f5178f3e88763e23_bd768f29_1443d499-630d-49fa-b14c-9e2eb45ef996\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER83D.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sun Oct 27 06:56:04 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER919.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER948.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\loaddll64.exe
|
loaddll64.exe "C:\Users\user\Desktop\AyCnklzHb7.dll"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\AyCnklzHb7.dll",#1
|
||
|
C:\Windows\System32\regsvr32.exe
|
regsvr32.exe /s C:\Users\user\Desktop\AyCnklzHb7.dll
|
||
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\AyCnklzHb7.dll",#1
|
||
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\AyCnklzHb7.dll,DllCanUnloadNow
|
||
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\AyCnklzHb7.dll,DllGetClassObject
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 7448 -s 420
|
||
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\AyCnklzHb7.dll,DllRegisterServer
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://95.143.193.138/xxxx_3/6
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://95.143.193.138/xxxx_3/
|
unknown
|
||
|
http://get.fc-gosh.biz/launch_reb.php?
|
unknown
|
||
|
http://%s/dupe.php?q=%d.%d.%d.%d.%d.%s.1.%d
|
unknown
|
||
|
http://%s/dupe.php?q=%d.%d.%d.%d.%d.%s.1.%d#
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
198.187.3.20.in-addr.arpa
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
ProgramId
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
FileId
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
LongPathHash
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Name
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
OriginalFileName
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Publisher
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Version
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
BinFileVersion
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
BinaryType
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
ProductName
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
ProductVersion
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
LinkDate
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
BinProductVersion
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Size
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Language
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
IsOsComponent
|
||
|
\REGISTRY\A\{ca550311-6e4d-1cdd-73ad-ed6c0d396689}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Usn
|
There are 10 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
6BFC37E000
|
stack
|
page read and write
|
||
|
ABB18FE000
|
stack
|
page read and write
|
||
|
7FFDFB77D000
|
unkown
|
page readonly
|
||
|
7FFDFB78F000
|
unkown
|
page readonly
|
||
|
1F81F7E0000
|
heap
|
page read and write
|
||
|
6BFBFDC000
|
stack
|
page read and write
|
||
|
23C5FDE0000
|
heap
|
page read and write
|
||
|
7FFDFB799000
|
unkown
|
page readonly
|
||
|
C6F554C000
|
stack
|
page read and write
|
||
|
29D0000
|
heap
|
page read and write
|
||
|
1F81F488000
|
heap
|
page read and write
|
||
|
1F81F6F0000
|
heap
|
page read and write
|
||
|
C6F55CF000
|
stack
|
page read and write
|
||
|
AD26BDC000
|
stack
|
page read and write
|
||
|
25DC2CF0000
|
heap
|
page read and write
|
||
|
23C5FC10000
|
heap
|
page read and write
|
||
|
12A0000
|
heap
|
page read and write
|
||
|
25DC29AD000
|
heap
|
page read and write
|
||
|
187E87A0000
|
heap
|
page read and write
|
||
|
7FFDFB721000
|
unkown
|
page execute read
|
||
|
7FFDFB720000
|
unkown
|
page readonly
|
||
|
23C5FD90000
|
heap
|
page read and write
|
||
|
6BFC2FF000
|
stack
|
page read and write
|
||
|
7FFDFB7B0000
|
unkown
|
page readonly
|
||
|
187E6D38000
|
heap
|
page read and write
|
||
|
ABB16FC000
|
stack
|
page read and write
|
||
|
50471DF000
|
stack
|
page read and write
|
||
|
25DC2B70000
|
heap
|
page read and write
|
||
|
200D35B0000
|
heap
|
page read and write
|
||
|
23C5FD95000
|
heap
|
page read and write
|
||
|
7FFDFB7BC000
|
unkown
|
page readonly
|
||
|
187E6D30000
|
heap
|
page read and write
|
||
|
7FFDFB8C9000
|
unkown
|
page readonly
|
||
|
7FFDFB8C5000
|
unkown
|
page readonly
|
||
|
BC0000
|
heap
|
page read and write
|
||
|
7FFDFB92B000
|
unkown
|
page readonly
|
||
|
7FFDFB79B000
|
unkown
|
page readonly
|
||
|
187E6CF0000
|
heap
|
page read and write
|
||
|
101F000
|
heap
|
page read and write
|
||
|
187E6CD0000
|
heap
|
page read and write
|
||
|
FF9000
|
heap
|
page read and write
|
||
|
293F000
|
stack
|
page read and write
|
||
|
6BFC27E000
|
stack
|
page read and write
|
||
|
25DC2B90000
|
heap
|
page read and write
|
||
|
23C5FDE8000
|
heap
|
page read and write
|
||
|
ABB17FE000
|
stack
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
200D3570000
|
heap
|
page read and write
|
||
|
7FFDFB77B000
|
unkown
|
page read and write
|
||
|
1F81F670000
|
heap
|
page read and write
|
||
|
187E6CC0000
|
heap
|
page read and write
|
||
|
7FFDFB79D000
|
unkown
|
page readonly
|
||
|
7FFDFB84F000
|
unkown
|
page readonly
|
||
|
200D35B8000
|
heap
|
page read and write
|
||
|
187E6D3E000
|
heap
|
page read and write
|
||
|
1007000
|
heap
|
page read and write
|
||
|
25DC2960000
|
heap
|
page read and write
|
||
|
200D3490000
|
heap
|
page read and write
|
||
|
7FFDFB7A2000
|
unkown
|
page readonly
|
||
|
7FFDFB82A000
|
unkown
|
page readonly
|
||
|
200D37A0000
|
heap
|
page read and write
|
||
|
ED0000
|
heap
|
page read and write
|
||
|
23C5FCF0000
|
heap
|
page read and write
|
||
|
7FFDFB8FC000
|
unkown
|
page readonly
|
||
|
1F81F480000
|
heap
|
page read and write
|
||
|
7FFDFB7AA000
|
unkown
|
page readonly
|
||
|
504715C000
|
stack
|
page read and write
|
||
|
23C617C0000
|
heap
|
page read and write
|
||
|
BD0000
|
heap
|
page read and write
|
||
|
23C5FD10000
|
heap
|
page read and write
|
||
|
FFB000
|
heap
|
page read and write
|
||
|
187E6F85000
|
heap
|
page read and write
|
||
|
1F81F460000
|
heap
|
page read and write
|
||
|
F8E000
|
stack
|
page read and write
|
||
|
25DC2B70000
|
heap
|
page read and write
|
||
|
200D5130000
|
heap
|
page read and write
|
||
|
7FFDFB874000
|
unkown
|
page readonly
|
||
|
1F81F7E5000
|
heap
|
page read and write
|
||
|
504747F000
|
stack
|
page read and write
|
||
|
200D3590000
|
heap
|
page read and write
|
||
|
AD26EFE000
|
stack
|
page read and write
|
||
|
7FFDFB767000
|
unkown
|
page readonly
|
||
|
25DC45F0000
|
heap
|
page read and write
|
||
|
7FFDFB7B4000
|
unkown
|
page readonly
|
||
|
7FFDFB90B000
|
unkown
|
page readonly
|
||
|
7FFDFB84C000
|
unkown
|
page readonly
|
||
|
7FFDFB923000
|
unkown
|
page readonly
|
||
|
1F81F650000
|
heap
|
page read and write
|
||
|
187E6F80000
|
heap
|
page read and write
|
||
|
25DC2970000
|
heap
|
page read and write
|
||
|
AD26E7E000
|
stack
|
page read and write
|
||
|
12A5000
|
heap
|
page read and write
|
||
|
25DC29A0000
|
heap
|
page read and write
|
||
|
7FFDFB7C1000
|
unkown
|
page readonly
|
||
|
C6F587E000
|
stack
|
page read and write
|
||
|
7FFDFB7EF000
|
unkown
|
page readonly
|
||
|
200D37A5000
|
heap
|
page read and write
|
||
|
B7B000
|
stack
|
page read and write
|
There are 88 hidden memdumps, click here to show them.