Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
PFW1cgN8EK.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PFW1cgN8EK.exe_24c51d7e9c7cc263e148c8bd21fb26a70761fdd_bb6d8bc3_70f64a5d-1e3c-4de4-ade7-ef42e76c9336\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B73.tmp.dmp
|
Mini DuMP crash report, 14 streams, Mon Oct 7 21:29:56 2024, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BF1.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C21.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\PFW1cgN8EK.exe
|
"C:\Users\user\Desktop\PFW1cgN8EK.exe"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 280
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
studennotediw.stor
|
|||
spirittunek.stor
|
|||
trustterwowqm.shop
|
|||
eaglepawnoy.stor
|
|||
clearancek.site
|
|||
https://steamcommunity.com/profiles/76561199724331900r
|
unknown
|
||
mobbipenju.stor
|
|||
https://steamcommunity.com/profiles/76561199724331900
|
104.102.49.254
|
||
licendfilteo.site
|
|||
https://steamcommunity.com/profiles/76561199724331900/inventory/
|
unknown
|
||
bathdoomgaz.stor
|
|||
dissapoiznw.stor
|
|||
https://sergei-esenin.com/api
|
172.67.206.204
|
||
https://steamcommunity.com/profiles/76561199724331900/badges
|
unknown
|
||
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm
|
unknown
|
||
https://sergei-esenin.com/apik
|
unknown
|
||
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
|
unknown
|
||
https://community.akamai.steamstatic.com/
|
unknown
|
||
https://sergei-esenin.com/
|
unknown
|
||
https://www.gstatic.cn/recaptcha/
|
unknown
|
||
http://store.steampowered.com/subscriber_agreement/
|
unknown
|
||
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
|
unknown
|
||
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
|
unknown
|
||
https://recaptcha.net/recaptcha/;
|
unknown
|
||
https://store.steampowered.com
|
unknown
|
||
https://www.youtube.com
|
unknown
|
||
https://www.google.com
|
unknown
|
||
https://medal.tv
|
unknown
|
||
https://broadcast.st.dl.eccdnx.com
|
unknown
|
||
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
|
unknown
|
||
http://crl.m;
|
unknown
|
||
https://s.ytimg.com;
|
unknown
|
||
https://login.steampowered.com/
|
unknown
|
||
https://store.steampowered.com/legal/
|
unknown
|
||
https://steam.tv/
|
unknown
|
||
https://store.steampower
|
unknown
|
||
https://store.steampowered.com/dj
|
unknown
|
||
http://store.steampowered.com/privacy_agreement/
|
unknown
|
||
https://recaptcha.net
|
unknown
|
||
http://upx.sf.net
|
unknown
|
||
https://sketchfab.com
|
unknown
|
||
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
|
unknown
|
||
http://127.0.0.1:27060
|
unknown
|
||
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
|
unknown
|
||
https://sergei-esenin.com:443/apifiles/76561199724331900
|
unknown
|
||
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
|
unknown
|
||
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
|
unknown
|
||
https://bathdoomgaz.store/api
|
unknown
|
||
https://www.google.com/recaptcha/
|
unknown
|
||
https://help.steampowered.com/
|
unknown
|
||
http://store.steampowered.com/account/cookiepreferences/
|
unknown
|
||
https://steamcommunity.com/
|
unknown
|
There are 42 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
steamcommunity.com
|
104.102.49.254
|
||
sergei-esenin.com
|
172.67.206.204
|
||
trustterwowqm.shop
|
unknown
|
||
licendfilteo.site
|
unknown
|
||
clearancek.site
|
unknown
|
||
s-part-0017.t-0009.t-msedge.net
|
13.107.246.45
|
||
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
|
217.20.57.18
|
||
fp2e7a.wpc.phicdn.net
|
192.229.221.95
|
||
eaglepawnoy.store
|
unknown
|
||
bathdoomgaz.store
|
unknown
|
||
spirittunek.store
|
unknown
|
||
studennotediw.store
|
unknown
|
||
mobbipenju.store
|
unknown
|
||
dissapoiznw.store
|
unknown
|
There are 4 hidden domains, click here to show them.
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
104.102.49.254
|
steamcommunity.com
|
United States
|
||
172.67.206.204
|
sergei-esenin.com
|
United States
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
ProgramId
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
FileId
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
LowerCaseLongPath
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
LongPathHash
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
Name
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
OriginalFileName
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
Publisher
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
Version
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
BinFileVersion
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
BinaryType
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
ProductName
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
ProductVersion
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
LinkDate
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
BinProductVersion
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
AppxPackageFullName
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
AppxPackageRelativeId
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
Size
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
Language
|
||
\REGISTRY\A\{8e080fbe-b102-5bd2-02a5-c72b4793ee03}\Root\InventoryApplicationFile\pfw1cgn8ek.exe|3931be06a09b6194
|
Usn
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
There are 11 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
62D000
|
unkown
|
page read and write
|
||
3F0000
|
heap
|
page read and write
|
||
62D000
|
unkown
|
page write copy
|
||
CC0000
|
heap
|
page read and write
|
||
2E10000
|
heap
|
page read and write
|
||
30BE000
|
stack
|
page read and write
|
||
847000
|
heap
|
page read and write
|
||
83A000
|
heap
|
page read and write
|
||
685000
|
unkown
|
page execute and read and write
|
||
81E000
|
stack
|
page read and write
|
||
305E000
|
stack
|
page read and write
|
||
BA0000
|
heap
|
page read and write
|
||
600000
|
unkown
|
page readonly
|
||
D65000
|
heap
|
page read and write
|
||
400000
|
remote allocation
|
page execute and read and write
|
||
601000
|
unkown
|
page execute read
|
||
39C000
|
stack
|
page read and write
|
||
D30000
|
heap
|
page read and write
|
||
C5E000
|
heap
|
page read and write
|
||
688000
|
unkown
|
page readonly
|
||
600000
|
unkown
|
page readonly
|
||
45F000
|
remote allocation
|
page execute and read and write
|
||
C3F000
|
stack
|
page read and write
|
||
F3F000
|
stack
|
page read and write
|
||
C03000
|
heap
|
page read and write
|
||
AFF000
|
stack
|
page read and write
|
||
BCD000
|
heap
|
page read and write
|
||
31BF000
|
stack
|
page read and write
|
||
601000
|
unkown
|
page execute read
|
||
623000
|
unkown
|
page readonly
|
||
BE5000
|
heap
|
page read and write
|
||
686000
|
unkown
|
page read and write
|
||
688000
|
unkown
|
page readonly
|
||
29CE000
|
stack
|
page read and write
|
||
A5C000
|
stack
|
page read and write
|
||
2F5D000
|
stack
|
page read and write
|
||
BF0000
|
heap
|
page read and write
|
||
BA7000
|
heap
|
page read and write
|
||
D60000
|
heap
|
page read and write
|
||
281F000
|
stack
|
page read and write
|
||
B3E000
|
stack
|
page read and write
|
||
830000
|
heap
|
page read and write
|
||
7D0000
|
heap
|
page read and write
|
||
BBC000
|
heap
|
page read and write
|
||
298D000
|
stack
|
page read and write
|
||
D10000
|
heap
|
page read and write
|
||
623000
|
unkown
|
page readonly
|
||
288D000
|
stack
|
page read and write
|
||
BE2000
|
heap
|
page read and write
|
||
2840000
|
heap
|
page read and write
|
||
B5C000
|
stack
|
page read and write
|
||
271E000
|
stack
|
page read and write
|
||
BFE000
|
heap
|
page read and write
|
||
2ACD000
|
stack
|
page read and write
|
||
78D000
|
stack
|
page read and write
|
||
D0E000
|
stack
|
page read and write
|
||
83E000
|
heap
|
page read and write
|
||
790000
|
heap
|
page read and write
|
There are 48 hidden memdumps, click here to show them.