IOC Report
20qMFnd9tO.exe

loading gif

Files

File Path
Type
Category
Malicious
20qMFnd9tO.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_20qMFnd9tO.exe_539efc4882d7e5893b644cdf6405ac0f098affe_1c3fac94_39bd28e0-c81e-42b0-9cd8-4a3d051f6be2\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15A5.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Mar 29 07:11:00 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1691.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER16D0.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\20qMFnd9tO.exe
"C:\Users\user\Desktop\20qMFnd9tO.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7556 -s 1556

URLs

Name
IP
Malicious
communicationgenerwo.shop
malicious
pillowbrocccolipe.shop
malicious
enthusiasimtitleow.shop
malicious
wagonglidemonkywo.shop
malicious
worryfillvolcawoi.shop
malicious
dismissalcylinderhostw.shop
malicious
diskretainvigorousiw.shop
malicious
cleartotalfisherwo.shop
malicious
affordcharmcropwo.shop
malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://wagonglidemonkywo.shop:443/api
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://wagonglidemonkywo.shop/j
unknown
https://wagonglidemonkywo.shop/
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://wagonglidemonkywo.shop/api2
unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://ocsp.rootca1.amazontrust.com0:
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://wagonglidemonkywo.shop/C
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://wagonglidemonkywo.shop/A
unknown
https://wagonglidemonkywo.shop/8
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://wagonglidemonkywo.shop/S
unknown
https://wagonglidemonkywo.shop/api
172.67.221.128
https://wagonglidemonkywo.shop/apiy
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.microsof
unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?
unknown
https://wagonglidemonkywo.shop/$
unknown
https://wagonglidemonkywo.shop/apiM
unknown
https://wagonglidemonkywo.shop/d
unknown
https://wagonglidemonkywo.shop/c
unknown
https://wagonglidemonkywo.shop/a
unknown
https://support.mozilla.org/products/firefoxgro.all
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://wagonglidemonkywo.shop/apiyi
unknown
https://wagonglidemonkywo.shop/apiH
unknown
There are 36 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
wagonglidemonkywo.shop
172.67.221.128
 malicious

IPs

IP
Domain
Country
Malicious
172.67.221.128
wagonglidemonkywo.shop
United States
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
ProgramId
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
FileId
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
LowerCaseLongPath
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
LongPathHash
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
Name
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
OriginalFileName
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
Publisher
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
Version
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
BinFileVersion
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
BinaryType
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
ProductName
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
ProductVersion
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
LinkDate
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
BinProductVersion
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
AppxPackageFullName
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
AppxPackageRelativeId
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
Size
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
Language
\REGISTRY\A\{0e101e76-dad8-00ca-47bb-7a2de2971092}\Root\InventoryApplicationFile\20qmfnd9to.exe|f1f879ba6c8b96d4
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
6E0000
direct allocation
page execute and read and write
 malicious
2DC0000
trusted library allocation
page read and write
1F0000
heap
page read and write
2D81000
trusted library allocation
page read and write
2DCA000
trusted library allocation
page read and write
89E000
heap
page read and write
2DDF000
trusted library allocation
page read and write
2E16000
trusted library allocation
page read and write
2D7B000
trusted library allocation
page read and write
6C7000
heap
page read and write
2DA7000
trusted library allocation
page read and write
8BD000
heap
page read and write
80B000
heap
page read and write
8BB000
heap
page read and write
2D8E000
trusted library allocation
page read and write
2DE1000
trusted library allocation
page read and write
2DCD000
trusted library allocation
page read and write
400000
unkown
page readonly
2D7E000
trusted library allocation
page read and write
89D000
heap
page read and write
6C5000
heap
page read and write
8BC000
heap
page read and write
2D73000
trusted library allocation
page read and write
6C0000
heap
page read and write
2DBE000
trusted library allocation
page read and write
25BE000
stack
page read and write
282F000
stack
page read and write
8B2000
heap
page read and write
2DA7000
trusted library allocation
page read and write
2DE2000
trusted library allocation
page read and write
2DAF000
trusted library allocation
page read and write
8B7000
heap
page read and write
32F4000
trusted library allocation
page read and write
2D78000
trusted library allocation
page read and write
80A000
heap
page read and write
2DCE000
trusted library allocation
page read and write
2DCD000
trusted library allocation
page read and write
6BE000
stack
page read and write
2D7B000
trusted library allocation
page read and write
2DC0000
trusted library allocation
page read and write
2DA3000
trusted library allocation
page read and write
78D000
stack
page read and write
2DA0000
trusted library allocation
page read and write
23DE000
stack
page read and write
8B4000
heap
page read and write
2E30000
trusted library allocation
page read and write
8B2000
heap
page read and write
2DDF000
trusted library allocation
page read and write
2D78000
trusted library allocation
page read and write
730000
heap
page read and write
2E2F000
trusted library allocation
page read and write
67E000
stack
page read and write
8BD000
heap
page read and write
2D6E000
stack
page read and write
2D8F000
trusted library allocation
page read and write
2DC0000
trusted library allocation
page read and write
2D7D000
trusted library allocation
page read and write
839000
heap
page read and write
2DE2000
trusted library allocation
page read and write
2DA4000
trusted library allocation
page read and write
7DF000
heap
page execute and read and write
2D77000
trusted library allocation
page read and write
8B6000
heap
page read and write
2DA4000
trusted library allocation
page read and write
2D88000
trusted library allocation
page read and write
8B8000
heap
page read and write
7B0000
remote allocation
page read and write
2D87000
trusted library allocation
page read and write
2DB8000
trusted library allocation
page read and write
854000
heap
page read and write
2E70000
heap
page read and write
8B8000
heap
page read and write
8B6000
heap
page read and write
858000
heap
page read and write
8B5000
heap
page read and write
9B000
stack
page read and write
2D8F000
trusted library allocation
page read and write
2ED3000
trusted library allocation
page read and write
2DE1000
trusted library allocation
page read and write
2D8F000
trusted library allocation
page read and write
84E000
heap
page read and write
2DA8000
trusted library allocation
page read and write
2DC2000
trusted library allocation
page read and write
2D7B000
trusted library allocation
page read and write
2D95000
trusted library allocation
page read and write
2D94000
trusted library allocation
page read and write
3111000
trusted library allocation
page read and write
2D9A000
trusted library allocation
page read and write
2DD3000
trusted library allocation
page read and write
8B6000
heap
page read and write
8B6000
heap
page read and write
2D78000
trusted library allocation
page read and write
257E000
stack
page read and write
2DCC000
trusted library allocation
page read and write
7B0000
remote allocation
page read and write
2D90000
trusted library allocation
page read and write
2DC0000
trusted library allocation
page read and write
81E000
heap
page read and write
2D88000
trusted library allocation
page read and write
2D8F000
trusted library allocation
page read and write
2DB5000
trusted library allocation
page read and write
7C0000
heap
page read and write
854000
heap
page read and write
824000
heap
page read and write
2D8F000
trusted library allocation
page read and write
2DB1000
trusted library allocation
page read and write
2F53000
trusted library allocation
page read and write
2D8F000
trusted library allocation
page read and write
2E03000
trusted library allocation
page read and write
2D88000
trusted library allocation
page read and write
2D7A000
trusted library allocation
page read and write
2DBB000
trusted library allocation
page read and write
2DBE000
trusted library allocation
page read and write
2DAA000
trusted library allocation
page read and write
2DA8000
trusted library allocation
page read and write
2DC8000
trusted library allocation
page read and write
837000
heap
page read and write
2E03000
trusted library allocation
page read and write
2DFC000
trusted library allocation
page read and write
2E15000
trusted library allocation
page read and write
2D8D000
trusted library allocation
page read and write
2DDF000
trusted library allocation
page read and write
2DC7000
trusted library allocation
page read and write
2D8F000
trusted library allocation
page read and write
2DDF000
trusted library allocation
page read and write
30E0000
heap
page read and write
89D000
heap
page read and write
2DBE000
trusted library allocation
page read and write
8B8000
heap
page read and write
8B2000
heap
page read and write
8BB000
heap
page read and write
2DB7000
trusted library allocation
page read and write
8B4000
heap
page read and write
2DA1000
trusted library allocation
page read and write
41A000
unkown
page readonly
30F1000
trusted library allocation
page read and write
9BF000
stack
page read and write
2DD8000
trusted library allocation
page read and write
837000
heap
page read and write
811000
heap
page read and write
89D000
heap
page read and write
446000
unkown
page write copy
2DA1000
trusted library allocation
page read and write
2DDF000
trusted library allocation
page read and write
2DE1000
trusted library allocation
page read and write
2DDF000
trusted library allocation
page read and write
8A0000
heap
page read and write
2D8F000
trusted library allocation
page read and write
8B2000
heap
page read and write
2E16000
trusted library allocation
page read and write
2DAC000
trusted library allocation
page read and write
8B6000
heap
page read and write
2DB1000
trusted library allocation
page read and write
2DA7000
trusted library allocation
page read and write
2DC1000
trusted library allocation
page read and write
2DD5000
trusted library allocation
page read and write
2D8F000
trusted library allocation
page read and write
833000
heap
page read and write
2DA7000
trusted library allocation
page read and write
2D70000
trusted library allocation
page read and write
2DE8000
trusted library allocation
page read and write
2D8F000
trusted library allocation
page read and write
2D7F000
trusted library allocation
page read and write
8B4000
heap
page read and write
2D79000
trusted library allocation
page read and write
2D87000
trusted library allocation
page read and write
2D88000
trusted library allocation
page read and write
2D87000
trusted library allocation
page read and write
2E03000
trusted library allocation
page read and write
2DE4000
trusted library allocation
page read and write
2DCA000
trusted library allocation
page read and write
2D87000
trusted library allocation
page read and write
2DD3000
trusted library allocation
page read and write
2DCF000
trusted library allocation
page read and write
2E08000
trusted library allocation
page read and write
2E16000
trusted library allocation
page read and write
8B7000
heap
page read and write
2DDF000
trusted library allocation
page read and write
2620000
heap
page read and write
89F000
heap
page read and write
2DB8000
trusted library allocation
page read and write
2DB6000
trusted library allocation
page read and write
8A5000
heap
page read and write
824000
heap
page read and write
2DDF000
trusted library allocation
page read and write
2DD5000
trusted library allocation
page read and write
730000
direct allocation
page read and write
8B2000
heap
page read and write
2FEB000
trusted library allocation
page read and write
8B6000
heap
page read and write
35FE000
trusted library allocation
page read and write
2DDA000
trusted library allocation
page read and write
8A8000
heap
page read and write
2C6F000
stack
page read and write
858000
heap
page read and write
2D88000
trusted library allocation
page read and write
2DAC000
trusted library allocation
page read and write
2D88000
trusted library allocation
page read and write
2DB5000
trusted library allocation
page read and write
2D88000
trusted library allocation
page read and write
2D8F000
trusted library allocation
page read and write
2DBE000
trusted library allocation
page read and write
824000
heap
page read and write
2D7B000
trusted library allocation
page read and write
2E04000
trusted library allocation
page read and write
81B000
heap
page read and write
30F0000
trusted library allocation
page read and write
401000
unkown
page execute read
447000
unkown
page execute and read and write
54B000
unkown
page readonly
2D99000
trusted library allocation
page read and write
818000
heap
page read and write
2E16000
trusted library allocation
page read and write
2E01000
trusted library allocation
page read and write
2E03000
trusted library allocation
page read and write
2DE2000
trusted library allocation
page read and write
2DE1000
trusted library allocation
page read and write
30F1000
trusted library allocation
page read and write
2DB6000
trusted library allocation
page read and write
858000
heap
page read and write
8BD000
heap
page read and write
81E000
heap
page read and write
2DBC000
trusted library allocation
page read and write
824000
heap
page read and write
8BD000
heap
page read and write
858000
heap
page read and write
2F23000
trusted library allocation
page read and write
8B2000
heap
page read and write
2E71000
heap
page read and write
8B6000
heap
page read and write
2D90000
trusted library allocation
page read and write
30AF000
stack
page read and write
2DDF000
trusted library allocation
page read and write
235E000
stack
page read and write
854000
heap
page read and write
2DB3000
trusted library allocation
page read and write
2E82000
trusted library allocation
page read and write
3386000
trusted library allocation
page read and write
2D8D000
trusted library allocation
page read and write
2DC0000
trusted library allocation
page read and write
81F000
heap
page read and write
820000
heap
page read and write
2430000
heap
page read and write
2DD2000
trusted library allocation
page read and write
349B000
trusted library allocation
page read and write
812000
heap
page read and write
2EB3000
trusted library allocation
page read and write
2DA6000
trusted library allocation
page read and write
8BD000
heap
page read and write
2DD5000
trusted library allocation
page read and write
253D000
stack
page read and write
2E35000
trusted library allocation
page read and write
8BD000
heap
page read and write
8BB000
heap
page read and write
2390000
heap
page read and write
2D7E000
trusted library allocation
page read and write
89D000
heap
page read and write
7CE000
heap
page read and write
83A000
heap
page read and write
7B0000
remote allocation
page read and write
2E9B000
trusted library allocation
page read and write
2DBF000
trusted library allocation
page read and write
8B3000
heap
page read and write
2DC0000
trusted library allocation
page read and write
2DBD000
trusted library allocation
page read and write
400000
unkown
page execute and read and write
30F7000
trusted library allocation
page read and write
8B9000
heap
page read and write
2DD5000
trusted library allocation
page read and write
2E2D000
trusted library allocation
page read and write
2DE2000
trusted library allocation
page read and write
8B8000
heap
page read and write
8BD000
heap
page read and write
837000
heap
page read and write
2DDF000
trusted library allocation
page read and write
2DC7000
trusted library allocation
page read and write
ABE000
stack
page read and write
2D73000
trusted library allocation
page read and write
89E000
heap
page read and write
2D89000
trusted library allocation
page read and write
2DA7000
trusted library allocation
page read and write
2DB1000
trusted library allocation
page read and write
54B000
unkown
page readonly
8B6000
heap
page read and write
2D7B000
trusted library allocation
page read and write
2DA6000
trusted library allocation
page read and write
2DB3000
trusted library allocation
page read and write
2F4B000
trusted library allocation
page read and write
2D9F000
trusted library allocation
page read and write
2DC8000
trusted library allocation
page read and write
2DBF000
trusted library allocation
page read and write
2D90000
trusted library allocation
page read and write
411000
unkown
page readonly
2DB1000
trusted library allocation
page read and write
2DA5000
trusted library allocation
page read and write
2DD8000
trusted library allocation
page read and write
8B6000
heap
page read and write
2D78000
trusted library allocation
page read and write
84E000
heap
page read and write
2DD8000
trusted library allocation
page read and write
8BD000
heap
page read and write
241E000
stack
page read and write
2DB7000
trusted library allocation
page read and write
197000
stack
page read and write
8BD000
heap
page read and write
3B09000
trusted library allocation
page read and write
2DB1000
trusted library allocation
page read and write
2F5B000
trusted library allocation
page read and write
2DBC000
trusted library allocation
page read and write
2DDF000
trusted library allocation
page read and write
2D92000
trusted library allocation
page read and write
2D87000
trusted library allocation
page read and write
8B2000
heap
page read and write
858000
heap
page read and write
7CA000
heap
page read and write
2D9F000
trusted library allocation
page read and write
2D87000
trusted library allocation
page read and write
2DFC000
trusted library allocation
page read and write
8A1000
heap
page read and write
8B7000
heap
page read and write
839000
heap
page read and write
25FE000
stack
page read and write
2DB8000
trusted library allocation
page read and write
2DDF000
trusted library allocation
page read and write
837000
heap
page read and write
2E7C000
trusted library allocation
page read and write
2D79000
trusted library allocation
page read and write
2DA4000
trusted library allocation
page read and write
2DE2000
trusted library allocation
page read and write
2D80000
trusted library allocation
page read and write
89D000
heap
page read and write
8BD000
heap
page read and write
8BD000
heap
page read and write
2D8B000
trusted library allocation
page read and write
2DAF000
trusted library allocation
page read and write
272F000
stack
page read and write
2FAE000
stack
page read and write
2D8F000
trusted library allocation
page read and write
8BD000
heap
page read and write
2DDF000
trusted library allocation
page read and write
8B9000
heap
page read and write
8B2000
heap
page read and write
8B6000
heap
page read and write
2DB3000
trusted library allocation
page read and write
2D7B000
trusted library allocation
page read and write
630000
heap
page read and write
There are 336 hidden memdumps, click here to show them.