Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
j8zJ5Jwja4.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_j8zJ5Jwja4.exe_1966512a4c1b30f6d3a54994d6808c78ed874d_fc5164de_5b9e6915-1166-4648-8a92-c0d7202a1d2c\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC0B.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 8 02:24:08 2024, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC79.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERECA9.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\j8zJ5Jwja4.exe
|
"C:\Users\user\Desktop\j8zJ5Jwja4.exe"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 272
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://steamcommunity.com/profiles/76561199724331900
|
104.102.49.254
|
||
https://sergei-esenin.com/apid
|
unknown
|
||
licendfilteo.site
|
|||
studennotediw.stor
|
|||
bathdoomgaz.stor
|
|||
https://sergei-esenin.com/ob
|
unknown
|
||
https://sergei-esenin.com/
|
unknown
|
||
trustterwowqm.shop
|
|||
eaglepawnoy.stor
|
|||
dissapoiznw.stor
|
|||
https://sergei-esenin.com/api
|
172.67.206.204
|
||
https://sergei-esenin.com/api:
|
unknown
|
||
https://steamcommunity.com/profiles/76561199724331900/inventory/
|
unknown
|
||
clearancek.site
|
|||
https://sergei-esenin.com:443/apifiles/76561199724331900
|
unknown
|
||
https://sergei-esenin.com/s
|
unknown
|
||
spirittunek.stor
|
|||
mobbipenju.stor
|
|||
https://steamcommunity.com/profiles/76561199724331900/badges
|
unknown
|
||
https://steamcommunity.com/profiles/76561199724331900Qx
|
unknown
|
||
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
|
unknown
|
||
http://upx.sf.net
|
unknown
|
||
https://steamcommunity.com/ay
|
unknown
|
||
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
|
unknown
|
There are 14 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
steamcommunity.com
|
104.102.49.254
|
||
sergei-esenin.com
|
172.67.206.204
|
||
trustterwowqm.shop
|
unknown
|
||
licendfilteo.site
|
unknown
|
||
clearancek.site
|
unknown
|
||
fp2e7a.wpc.phicdn.net
|
192.229.221.95
|
||
eaglepawnoy.store
|
unknown
|
||
bathdoomgaz.store
|
unknown
|
||
spirittunek.store
|
unknown
|
||
studennotediw.store
|
unknown
|
||
mobbipenju.store
|
unknown
|
||
dissapoiznw.store
|
unknown
|
There are 2 hidden domains, click here to show them.
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
104.102.49.254
|
steamcommunity.com
|
United States
|
||
172.67.206.204
|
sergei-esenin.com
|
United States
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
ProgramId
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
FileId
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
LowerCaseLongPath
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
LongPathHash
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
Name
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
OriginalFileName
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
Publisher
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
Version
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
BinFileVersion
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
BinaryType
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
ProductName
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
ProductVersion
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
LinkDate
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
BinProductVersion
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
AppxPackageFullName
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
AppxPackageRelativeId
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
Size
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
Language
|
||
\REGISTRY\A\{9a1fc528-18a6-36a8-a5cc-f49c9dabac43}\Root\InventoryApplicationFile\j8zj5jwja4.exe|f82fd7b005dfa960
|
Usn
|
There are 9 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
400000
|
remote allocation
|
page execute and read and write
|
||
743000
|
unkown
|
page readonly
|
||
348D000
|
stack
|
page read and write
|
||
1318000
|
heap
|
page read and write
|
||
74D000
|
unkown
|
page write copy
|
||
1355000
|
heap
|
page read and write
|
||
F2E000
|
stack
|
page read and write
|
||
300E000
|
stack
|
page read and write
|
||
2E30000
|
heap
|
page read and write
|
||
F5E000
|
heap
|
page read and write
|
||
1379000
|
heap
|
page read and write
|
||
721000
|
unkown
|
page execute read
|
||
12E0000
|
heap
|
page read and write
|
||
114F000
|
stack
|
page read and write
|
||
DB0000
|
heap
|
page read and write
|
||
F5A000
|
heap
|
page read and write
|
||
F9C000
|
stack
|
page read and write
|
||
7A8000
|
unkown
|
page readonly
|
||
720000
|
unkown
|
page readonly
|
||
F50000
|
heap
|
page read and write
|
||
133D000
|
heap
|
page read and write
|
||
358D000
|
stack
|
page read and write
|
||
F68000
|
heap
|
page read and write
|
||
1370000
|
heap
|
page read and write
|
||
2ECE000
|
stack
|
page read and write
|
||
13CF000
|
heap
|
page read and write
|
||
7A6000
|
unkown
|
page read and write
|
||
74D000
|
unkown
|
page read and write
|
||
2F00000
|
heap
|
page read and write
|
||
373E000
|
stack
|
page read and write
|
||
383F000
|
stack
|
page read and write
|
||
7A8000
|
unkown
|
page readonly
|
||
144E000
|
stack
|
page read and write
|
||
1200000
|
heap
|
page read and write
|
||
168F000
|
stack
|
page read and write
|
||
1352000
|
heap
|
page read and write
|
||
1338000
|
heap
|
page read and write
|
||
7A5000
|
unkown
|
page execute and read and write
|
||
DD0000
|
heap
|
page read and write
|
||
EEE000
|
stack
|
page read and write
|
||
132C000
|
heap
|
page read and write
|
||
E9C000
|
stack
|
page read and write
|
||
721000
|
unkown
|
page execute read
|
||
45F000
|
remote allocation
|
page execute and read and write
|
||
124F000
|
stack
|
page read and write
|
||
310D000
|
stack
|
page read and write
|
||
12F5000
|
heap
|
page read and write
|
||
743000
|
unkown
|
page readonly
|
||
158E000
|
stack
|
page read and write
|
||
12F0000
|
heap
|
page read and write
|
||
1375000
|
heap
|
page read and write
|
||
720000
|
unkown
|
page readonly
|
||
13AC000
|
heap
|
page read and write
|
||
C5C000
|
stack
|
page read and write
|
||
36CE000
|
stack
|
page read and write
|
||
154F000
|
stack
|
page read and write
|
||
35CE000
|
stack
|
page read and write
|
||
DA0000
|
heap
|
page read and write
|
||
2E8D000
|
stack
|
page read and write
|
||
1310000
|
heap
|
page read and write
|
||
D5D000
|
stack
|
page read and write
|
There are 51 hidden memdumps, click here to show them.