IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_2f26e4b65edfc9809a16d7533fcfcfa7c28d99cc_852b229c_a5eb7142-210c-4d6b-8279-c7989e7021d7\Report.wer
data
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6153.tmp.dmp
Mini DuMP crash report, 15 streams, Sat Oct 12 23:29:13 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER62EA.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6339.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1868

URLs

Name
IP
Malicious
bathdoomgaz.store
malicious
studennotediw.store
malicious
clearancek.site
malicious
dissapoiznw.store
malicious
https://steamcommunity.com/profiles/76561199724331900
104.102.49.254
 malicious
spirittunek.store
malicious
licendfilteo.site
malicious
eaglepawnoy.store
malicious
https://steamcommunity.com/profiles/76561199724331900/inventory/
unknown
 malicious
mobbipenju.store
malicious
https://sergei-esenin.com/api
172.67.206.204
 malicious
https://steamcommunity.com/profiles/76561199724331900/badges
unknown
 malicious
https://steamcommunity.com/my/wishlist/
unknown
https://www.cloudflare.com/learning/access-management/phishing-attack/
unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
unknown
https://steamcommunity.com/?subsection=broadcasts
unknown
https://steamcommunity.com/linkfilter/?
unknown
https://help.steampowered.com/en/
unknown
https://steamcommunity.com/market/
unknown
https://store.steampowered.com/news/
unknown
https://sergei-esenin.com/
unknown
https://www.cloudflare.com/learning/access-m
unknown
https://store.steampowered.com/subscriber_agreement/
unknown
http://store.steampowered.com/subscriber_agreement/
unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
unknown
http://www.valvesoftware.com/legal.htm
unknown
https://steamcommunity.com/discussions/
unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
unknown
https://store.steampowered.com/stats/
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
unknown
https://store.steampowered.com/steam_refunds/
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
unknown
https://avatars.akamai.steamstaticb
unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=jGtzAgjYROne&l=e
unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=hgPi
unknown
https://steamcommunity.com/workshop/
unknown
https://store.steampowered.com/legal/
unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
unknown
http://store.steampowered.com/privacy_agreement/
unknown
https://store.steampowered.com/points/shop/
unknown
http://upx.sf.net
unknown
https://store.steampowered.com/
unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
unknown
https://store.steampowered.com/privacy_agreement/
unknown
https://www.cloudflare.com/5xx-error-landing
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
unknown
https://sergei-esenin.com/g
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a
unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=bz0kMfQA
unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
unknown
http://store.steampol
unknown
http://store.steampowered.com/account/cookiepreferences/
unknown
https://store.steampowered.com/mobile
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
unknown
https://steamcommunity.com/
unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
unknown
https://store.steampowered.com/about/
unknown
There are 69 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
steamcommunity.com
104.102.49.254
 malicious
sergei-esenin.com
172.67.206.204
 malicious
eaglepawnoy.store
unknown
 malicious
bathdoomgaz.store
unknown
 malicious
spirittunek.store
unknown
 malicious
licendfilteo.site
unknown
 malicious
studennotediw.store
unknown
 malicious
mobbipenju.store
unknown
 malicious
clearancek.site
unknown
 malicious
dissapoiznw.store
unknown
 malicious

IPs

IP
Domain
Country
Malicious
104.102.49.254
steamcommunity.com
United States
malicious
172.67.206.204
sergei-esenin.com
United States
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProgramId
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
FileId
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LowerCaseLongPath
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LongPathHash
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Name
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
OriginalFileName
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Publisher
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Version
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinFileVersion
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinaryType
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductName
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductVersion
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LinkDate
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinProductVersion
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
AppxPackageFullName
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
AppxPackageRelativeId
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Size
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Language
 malicious
\REGISTRY\A\{fcffdc16-1cad-62a4-cf7f-eef39afc1170}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Usn
 malicious
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
7F1000
unkown
page execute and read and write
 malicious
D40000
direct allocation
page read and write
4CFE000
stack
page read and write
4591000
heap
page read and write
31CE000
stack
page read and write
6B4000
heap
page read and write
6B4000
heap
page read and write
B00000
unkown
page execute and write copy
6B4000
heap
page read and write
7F0000
unkown
page readonly
3BCE000
stack
page read and write
7E0000
heap
page read and write
DDC000
heap
page read and write
2C8F000
stack
page read and write
4B80000
direct allocation
page execute and read and write
DB2000
heap
page read and write
6B4000
heap
page read and write
522D000
stack
page read and write
340F000
stack
page read and write
4A00000
remote allocation
page read and write
2A4E000
stack
page read and write
344E000
stack
page read and write
D40000
direct allocation
page read and write
6B4000
heap
page read and write
2CCE000
stack
page read and write
37CF000
stack
page read and write
D40000
direct allocation
page read and write
D40000
direct allocation
page read and write
AF2000
unkown
page execute and read and write
B01000
unkown
page execute and write copy
6B4000
heap
page read and write
2F0F000
stack
page read and write
45A0000
heap
page read and write
2DCF000
stack
page read and write
F6E000
stack
page read and write
354F000
stack
page read and write
3F8E000
stack
page read and write
DD0000
heap
page read and write
4B80000
direct allocation
page execute and read and write
444F000
stack
page read and write
6B4000
heap
page read and write
6B4000
heap
page read and write
4591000
heap
page read and write
E42000
heap
page read and write
4591000
heap
page read and write
6B4000
heap
page read and write
6B0000
heap
page read and write
4591000
heap
page read and write
69E000
stack
page read and write
448E000
stack
page read and write
4B80000
direct allocation
page execute and read and write
4B4F000
stack
page read and write
4B80000
direct allocation
page execute and read and write
6B4000
heap
page read and write
6B4000
heap
page read and write
4690000
trusted library allocation
page read and write
4591000
heap
page read and write
D3D000
heap
page read and write
2E0E000
stack
page read and write
3CB000
stack
page read and write
3A8E000
stack
page read and write
532E000
stack
page read and write
49D0000
heap
page read and write
6B4000
heap
page read and write
394E000
stack
page read and write
6B4000
heap
page read and write
D40000
direct allocation
page read and write
4B90000
direct allocation
page execute and read and write
D70000
heap
page read and write
290F000
stack
page read and write
D37000
heap
page read and write
D30000
heap
page read and write
4B80000
direct allocation
page execute and read and write
7F1000
unkown
page execute and write copy
4A10000
direct allocation
page read and write
6B4000
heap
page read and write
318F000
stack
page read and write
D7E000
heap
page read and write
390F000
stack
page read and write
D40000
direct allocation
page read and write
4F7E000
stack
page read and write
C9F000
unkown
page execute and read and write
CEE000
stack
page read and write
368F000
stack
page read and write
4590000
heap
page read and write
3B8F000
stack
page read and write
4B60000
direct allocation
page execute and read and write
9D7000
unkown
page execute and read and write
380E000
stack
page read and write
D40000
direct allocation
page read and write
7F0000
unkown
page read and write
40CE000
stack
page read and write
DFD000
heap
page read and write
E34000
heap
page read and write
2B4F000
stack
page read and write
4591000
heap
page read and write
DBE000
heap
page read and write
6B4000
heap
page read and write
2A0E000
stack
page read and write
D40000
direct allocation
page read and write
4BA0000
direct allocation
page execute and read and write
6B4000
heap
page read and write
DAF000
heap
page read and write
D40000
direct allocation
page read and write
D40000
direct allocation
page read and write
D40000
direct allocation
page read and write
41CF000
stack
page read and write
DA8000
heap
page read and write
434E000
stack
page read and write
6B4000
heap
page read and write
51BE000
stack
page read and write
4CBD000
stack
page read and write
D7A000
heap
page read and write
6B4000
heap
page read and write
ABE000
unkown
page execute and read and write
358E000
stack
page read and write
6B4000
heap
page read and write
3A4F000
stack
page read and write
2F4E000
stack
page read and write
4B70000
direct allocation
page execute and read and write
3E4E000
stack
page read and write
50BD000
stack
page read and write
3D0E000
stack
page read and write
6B4000
heap
page read and write
4B50000
direct allocation
page execute and read and write
32CF000
stack
page read and write
620000
heap
page read and write
4A00000
remote allocation
page read and write
850000
unkown
page execute and read and write
D2B000
stack
page read and write
4B8D000
stack
page read and write
CA0000
unkown
page execute and write copy
4BB0000
direct allocation
page execute and read and write
7CE000
stack
page read and write
3E0E000
stack
page read and write
E32000
heap
page read and write
6B4000
heap
page read and write
538E000
stack
page read and write
4591000
heap
page read and write
54CF000
stack
page read and write
330E000
stack
page read and write
6B4000
heap
page read and write
D40000
direct allocation
page read and write
3CCF000
stack
page read and write
4B80000
direct allocation
page execute and read and write
4A4B000
stack
page read and write
4591000
heap
page read and write
36CE000
stack
page read and write
4591000
heap
page read and write
430F000
stack
page read and write
3F4F000
stack
page read and write
507F000
stack
page read and write
6B4000
heap
page read and write
4F3F000
stack
page read and write
53C0000
heap
page read and write
D40000
direct allocation
page read and write
AE9000
unkown
page execute and read and write
D60000
direct allocation
page read and write
4BCC000
trusted library allocation
page read and write
308E000
stack
page read and write
458F000
stack
page read and write
B00000
unkown
page execute and read and write
106F000
stack
page read and write
630000
heap
page read and write
6B4000
heap
page read and write
408F000
stack
page read and write
E37000
heap
page read and write
2CB000
stack
page read and write
4A00000
remote allocation
page read and write
D60000
direct allocation
page read and write
6B4000
heap
page read and write
D40000
direct allocation
page read and write
420E000
stack
page read and write
4E3D000
stack
page read and write
2B8E000
stack
page read and write
304F000
stack
page read and write
4591000
heap
page read and write
4DFD000
stack
page read and write
There are 168 hidden memdumps, click here to show them.