Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
PS-CollectionTool.exe
|
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
|
initial sample
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PS-CollectionToo_d7a32e9879581bafec6b32f9c47d3fdae71563_e01be375_7f308138-fdd4-4f72-84c7-562ec17810ce\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A3B.tmp.dmp
|
Mini DuMP crash report, 16 streams, Fri Apr 26 17:42:16 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B84.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BD4.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\PS-CollectionTool.exe
|
"C:\Users\user\Desktop\PS-CollectionTool.exe"
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 7152 -s 848
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://tempuri.org/CT_IService/GetDataResponse
|
unknown
|
||
|
http://tempuri.org/CT_IService/GetDataUsingDataContractT
|
unknown
|
||
|
http://tempuri.org/CT_IService/GetDataT
|
unknown
|
||
|
https://iceluc3.wixsite.com/smartoptimize
|
unknown
|
||
|
http://schemas.datacontract.org/2004/07/CT_WCF_WebRole
|
unknown
|
||
|
http://tempuri.org/CT_IService/IsHostBlockedT
|
unknown
|
||
|
http://tempuri.org/CT_IService/WriteFileDetailsResponse
|
unknown
|
||
|
http://tempuri.org/CT_IService/IsHostBlockedResponse
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://wpfanimatedgif.codeplex.com
|
unknown
|
||
|
http://tempuri.org/CT_IService/WriteInitialResponse
|
unknown
|
||
|
http://tempuri.org/CT_IService/GetDataUsingDataContractResponse
|
unknown
|
||
|
http://tempuri.org/CT_IService/WriteFileDetailsT
|
unknown
|
||
|
http://tempuri.org/CT_IService/WriteInitialT
|
unknown
|
There are 4 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
ProgramId
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
FileId
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
LongPathHash
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
Name
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
OriginalFileName
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
Publisher
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
Version
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
BinFileVersion
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
BinaryType
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
ProductName
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
ProductVersion
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
LinkDate
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
BinProductVersion
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
Size
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
Language
|
||
|
\REGISTRY\A\{af73bdd9-9da3-aca4-4ceb-91e58af9d613}\Root\InventoryApplicationFile\ps-collectiontoo|a50a16d745ff132a
|
Usn
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceId
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
ApplicationFlags
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000DDDFEBB86
|
There are 13 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
17DA0B61000
|
trusted library allocation
|
page read and write
|
||
|
7FFEC8354000
|
trusted library allocation
|
page read and write
|
||
|
7FFEC8410000
|
trusted library allocation
|
page execute and read and write
|
||
|
3EB0FFE000
|
stack
|
page read and write
|
||
|
7FFEC84F0000
|
trusted library allocation
|
page read and write
|
||
|
17D9EFCD000
|
heap
|
page read and write
|
||
|
17D9EB72000
|
unkown
|
page readonly
|
||
|
17D9F1B0000
|
heap
|
page read and write
|
||
|
17D9EF90000
|
heap
|
page read and write
|
||
|
17D9F02D000
|
heap
|
page read and write
|
||
|
7FFEC8400000
|
trusted library allocation
|
page read and write
|
||
|
17D9F220000
|
trusted library allocation
|
page read and write
|
||
|
3EB03FE000
|
stack
|
page read and write
|
||
|
7FFEC840C000
|
trusted library allocation
|
page execute and read and write
|
||
|
17D9F09B000
|
heap
|
page read and write
|
||
|
17DB0B61000
|
trusted library allocation
|
page read and write
|
||
|
7FFEC8436000
|
trusted library allocation
|
page execute and read and write
|
||
|
17DB0B71000
|
trusted library allocation
|
page read and write
|
||
|
17D9F00D000
|
heap
|
page read and write
|
||
|
3EB07FE000
|
stack
|
page read and write
|
||
|
17DB9390000
|
heap
|
page execute and read and write
|
||
|
17D9EFE9000
|
heap
|
page read and write
|
||
|
17D9EFE3000
|
heap
|
page read and write
|
||
|
7FFEC83AC000
|
trusted library allocation
|
page execute and read and write
|
||
|
17DB0B63000
|
trusted library allocation
|
page read and write
|
||
|
7FFEC8360000
|
trusted library allocation
|
page read and write
|
||
|
17D9EFCF000
|
heap
|
page read and write
|
||
|
17DB0B68000
|
trusted library allocation
|
page read and write
|
||
|
17D9F320000
|
heap
|
page execute and read and write
|
||
|
17D9F190000
|
heap
|
page read and write
|
||
|
17D9EFA0000
|
heap
|
page read and write
|
||
|
17D9F348000
|
heap
|
page read and write
|
||
|
3EB1FFF000
|
stack
|
page read and write
|
||
|
3EB1BFE000
|
stack
|
page read and write
|
||
|
7FFEC836A000
|
trusted library allocation
|
page read and write
|
||
|
7FFEC8353000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFEC8470000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFEC8363000
|
trusted library allocation
|
page read and write
|
||
|
17D9F230000
|
trusted library allocation
|
page read and write
|
||
|
7FFEC837D000
|
trusted library allocation
|
page execute and read and write
|
||
|
17D9EFD3000
|
heap
|
page read and write
|
||
|
17D9F240000
|
heap
|
page read and write
|
||
|
17D9F170000
|
heap
|
page read and write
|
||
|
17D9F233000
|
trusted library allocation
|
page read and write
|
||
|
7FFEC8352000
|
trusted library allocation
|
page read and write
|
||
|
17D9EFE1000
|
heap
|
page read and write
|
||
|
17D9EFAC000
|
heap
|
page read and write
|
||
|
3EB17FE000
|
stack
|
page read and write
|
||
|
17D9F037000
|
heap
|
page read and write
|
||
|
17D9EFA6000
|
heap
|
page read and write
|
||
|
17D9F285000
|
heap
|
page read and write
|
||
|
3EB13FC000
|
stack
|
page read and write
|
||
|
7FFEC835D000
|
trusted library allocation
|
page execute and read and write
|
||
|
17DB9400000
|
heap
|
page read and write
|
||
|
17D9EF06000
|
unkown
|
page readonly
|
||
|
17D9F033000
|
heap
|
page read and write
|
||
|
17DB0B6D000
|
trusted library allocation
|
page read and write
|
||
|
7FF4D91F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
17D9F3B5000
|
heap
|
page read and write
|
||
|
7FFEC8500000
|
trusted library allocation
|
page read and write
|
||
|
3EB0BFE000
|
stack
|
page read and write
|
||
|
17D9F3B0000
|
heap
|
page read and write
|
||
|
3EAFFF0000
|
stack
|
page read and write
|
||
|
17D9EB70000
|
unkown
|
page readonly
|
||
|
17D9EFD7000
|
heap
|
page read and write
|
||
|
17D9F200000
|
trusted library allocation
|
page read and write
|
||
|
17DB9550000
|
heap
|
page read and write
|
||
|
17D9F280000
|
heap
|
page read and write
|
||
|
17D9F340000
|
heap
|
page read and write
|
There are 59 hidden memdumps, click here to show them.