IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_149bdbcb2b38e07e554380fb755b1b1bce76e78d_852b229c_596c42fa-5800-486c-bab8-15fb56f4bf58\Report.wer
data
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5656.tmp.dmp
Mini DuMP crash report, 15 streams, Sun Oct 13 09:54:06 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5780.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER57A0.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6284 -s 1960

URLs

Name
IP
Malicious
https://steamcommunity.com/profiles/76561199724331900/inventoryc
unknown
 malicious
https://sergei-esenin.com/
unknown
 malicious
bathdoomgaz.store
malicious
https://sergei-esenin.com:443/apis
unknown
 malicious
studennotediw.store
malicious
clearancek.site
malicious
https://sergei-esenin.com/api5
unknown
 malicious
dissapoiznw.store
malicious
https://steamcommunity.com/profiles/76561199724331900
104.102.49.254
 malicious
spirittunek.store
malicious
licendfilteo.site
malicious
eaglepawnoy.store
malicious
https://steamcommunity.com/profiles/76561199724331900/inventory/
unknown
 malicious
mobbipenju.store
malicious
https://sergei-esenin.com/api
104.21.53.8
 malicious
https://steamcommunity.com/profiles/76561199724331900/badges
unknown
 malicious
https://steamcommunity.com/my/wishlist/
unknown
https://www.cloudflare.com/learning/access-management/phishing-attack/
unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
unknown
https://steamcommunity.com/?subsection=broadcasts
unknown
https://help.steampowered.com/en/
unknown
https://steamcommunity.com/market/
unknown
https://store.steampowered.com/news/
unknown
https://store.steampowered.com/subscriber_agreement/
unknown
http://store.steampowered.com/subscriber_agreement/
unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
unknown
http://www.valvesoftware.com/legal.htm
unknown
https://steamcommunity.com/discussions/
unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
unknown
https://store.steampowered.com/stats/
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
unknown
https://store.steampowered.com/steam_refunds/
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=jGtzAgjYROne&l=e
unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=hgPi
unknown
https://steamcommunity.com/workshop/
unknown
https://www.cloudflare.com/5xx-erro
unknown
https://store.steampowered.com/legal/
unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
unknown
https://www.cloudflare.com/5xx-error-lanY
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
unknown
https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
unknown
http://store.steampowered.com/privacy_agreement/
unknown
https://store.steampowered.com/points/shop/
unknown
http://upx.sf.net
unknown
https://store.steampowered.com/
unknown
https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
unknown
https://www.cloudflare.com/learning/access-man
unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
unknown
https://store.steampowered.com/privacy_agreement/
unknown
https://studennotediw.store/api
unknown
https://www.cloudflare.com/5xx-error-landing
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=2Ih2WOq7ErXY&a
unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=bz0kMfQA
unknown
https://community.akamai.steamstatic.com/pub
unknown
https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
unknown
http://store.steampowered.com/account/cookiepreferences/
unknown
https://store.steampowered.com/mobile
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
unknown
https://avatars.akamai.steamstatic
unknown
https://steamcommunity.com/
unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=f3vWO7swdDqp&l=english
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
unknown
https://store.steampowered.com/about/
unknown
There are 73 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
steamcommunity.com
104.102.49.254
 malicious
sergei-esenin.com
104.21.53.8
 malicious
eaglepawnoy.store
unknown
 malicious
bathdoomgaz.store
unknown
 malicious
spirittunek.store
unknown
 malicious
licendfilteo.site
unknown
 malicious
studennotediw.store
unknown
 malicious
mobbipenju.store
unknown
 malicious
clearancek.site
unknown
 malicious
dissapoiznw.store
unknown
 malicious

IPs

IP
Domain
Country
Malicious
104.21.53.8
sergei-esenin.com
United States
malicious
104.102.49.254
steamcommunity.com
United States
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProgramId
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
FileId
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LowerCaseLongPath
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LongPathHash
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Name
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
OriginalFileName
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Publisher
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Version
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinFileVersion
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinaryType
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductName
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductVersion
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LinkDate
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinProductVersion
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
AppxPackageFullName
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
AppxPackageRelativeId
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Size
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Language
 malicious
\REGISTRY\A\{475dd616-d810-bb22-7fb7-9b88f9c00b34}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Usn
 malicious
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2B1000
unkown
page execute and read and write
 malicious
5C3000
unkown
page execute and write copy
12EE000
heap
page read and write
12E2000
heap
page read and write
12CE000
heap
page read and write
57CF000
stack
page read and write
4A3F000
stack
page read and write
467F000
stack
page read and write
417F000
stack
page read and write
4CF1000
heap
page read and write
4CF1000
heap
page read and write
4CF1000
heap
page read and write
313F000
stack
page read and write
4CF1000
heap
page read and write
5300000
direct allocation
page execute and read and write
4CF1000
heap
page read and write
5300000
direct allocation
page execute and read and write
5C60000
trusted library allocation
page read and write
33FE000
stack
page read and write
16EF000
stack
page read and write
12FD000
heap
page read and write
4CF1000
heap
page read and write
130A000
heap
page read and write
4CF1000
heap
page read and write
12B8000
heap
page read and write
12E0000
heap
page read and write
457E000
stack
page read and write
3EFF000
stack
page read and write
1317000
heap
page read and write
12C8000
heap
page read and write
367E000
stack
page read and write
3C7F000
stack
page read and write
4CE0000
direct allocation
page read and write
4CE0000
direct allocation
page read and write
1326000
heap
page read and write
12E0000
heap
page read and write
5300000
direct allocation
page execute and read and write
4CE0000
direct allocation
page read and write
554D000
stack
page read and write
FEB000
stack
page read and write
12C1000
heap
page read and write
3CBE000
stack
page read and write
4CE0000
direct allocation
page read and write
12EE000
heap
page read and write
38FE000
stack
page read and write
56CE000
stack
page read and write
763000
unkown
page execute and read and write
38BF000
stack
page read and write
1280000
heap
page read and write
2B0000
unkown
page read and write
558E000
stack
page read and write
1250000
heap
page read and write
4BBE000
stack
page read and write
130E000
heap
page read and write
5AA000
unkown
page execute and read and write
3F3E000
stack
page read and write
EEB000
stack
page read and write
5300000
direct allocation
page execute and read and write
47BF000
stack
page read and write
15AF000
stack
page read and write
15EE000
stack
page read and write
4CF1000
heap
page read and write
46BE000
stack
page read and write
4CE0000
direct allocation
page read and write
516D000
stack
page read and write
39FF000
stack
page read and write
130C000
heap
page read and write
592D000
stack
page read and write
57E0000
remote allocation
page read and write
57E0000
remote allocation
page read and write
377F000
stack
page read and write
5C5F000
stack
page read and write
1369000
heap
page read and write
2FF7000
heap
page read and write
1317000
heap
page read and write
407E000
stack
page read and write
5330000
direct allocation
page execute and read and write
130E000
heap
page read and write
317E000
stack
page read and write
2B1000
unkown
page execute and write copy
12C4000
heap
page read and write
12EE000
heap
page read and write
135C000
heap
page read and write
4A7E000
stack
page read and write
57D000
unkown
page execute and read and write
4CF1000
heap
page read and write
12CE000
heap
page read and write
4CE0000
direct allocation
page read and write
52D0000
direct allocation
page execute and read and write
4D00000
heap
page read and write
4CF1000
heap
page read and write
5180000
direct allocation
page read and write
5300000
direct allocation
page execute and read and write
1306000
heap
page read and write
2FFD000
heap
page read and write
2FF0000
heap
page read and write
128E000
heap
page read and write
130E000
heap
page read and write
544E000
stack
page read and write
3DFE000
stack
page read and write
5130000
trusted library allocation
page read and write
41BE000
stack
page read and write
5C70000
trusted library allocation
page read and write
453F000
stack
page read and write
5C65000
trusted library allocation
page read and write
4CF0000
heap
page read and write
13D5000
heap
page read and write
4CF1000
heap
page read and write
530D000
stack
page read and write
4CE0000
direct allocation
page read and write
3B7E000
stack
page read and write
49D000
unkown
page execute and read and write
3DBF000
stack
page read and write
130E000
heap
page read and write
37BE000
stack
page read and write
599E000
stack
page read and write
3A3E000
stack
page read and write
13BE000
stack
page read and write
363F000
stack
page read and write
493E000
stack
page read and write
57E0000
remote allocation
page read and write
1317000
heap
page read and write
4CE0000
direct allocation
page read and write
3B3F000
stack
page read and write
4CF1000
heap
page read and write
5180000
direct allocation
page read and write
34FF000
stack
page read and write
4B7F000
stack
page read and write
2EDE000
stack
page read and write
130A000
heap
page read and write
535F000
trusted library allocation
page read and write
4CE0000
direct allocation
page read and write
5B50000
heap
page read and write
4CF1000
heap
page read and write
443E000
stack
page read and write
303C000
stack
page read and write
1306000
heap
page read and write
52BF000
stack
page read and write
4CF1000
heap
page read and write
130C000
heap
page read and write
764000
unkown
page execute and write copy
1326000
heap
page read and write
130C000
heap
page read and write
353E000
stack
page read and write
403F000
stack
page read and write
1326000
heap
page read and write
1326000
heap
page read and write
4CF1000
heap
page read and write
4CF1000
heap
page read and write
1306000
heap
page read and write
4CE0000
direct allocation
page read and write
5B3000
unkown
page execute and read and write
327F000
stack
page read and write
33BF000
stack
page read and write
5340000
direct allocation
page execute and read and write
130C000
heap
page read and write
5320000
direct allocation
page execute and read and write
4CF1000
heap
page read and write
568F000
stack
page read and write
582E000
stack
page read and write
52E0000
direct allocation
page execute and read and write
4CE0000
direct allocation
page read and write
130A000
heap
page read and write
5C2000
unkown
page execute and read and write
42FE000
stack
page read and write
310000
unkown
page execute and read and write
13D0000
heap
page read and write
4CC0000
heap
page read and write
51BC000
stack
page read and write
4CE0000
direct allocation
page read and write
2FDF000
stack
page read and write
42BF000
stack
page read and write
48FF000
stack
page read and write
5C2000
unkown
page execute and write copy
1306000
heap
page read and write
4CE0000
direct allocation
page read and write
4CF1000
heap
page read and write
4CF1000
heap
page read and write
5310000
direct allocation
page execute and read and write
4CE0000
direct allocation
page read and write
5A9F000
stack
page read and write
1301000
heap
page read and write
5300000
direct allocation
page execute and read and write
128A000
heap
page read and write
5180000
direct allocation
page read and write
1240000
heap
page read and write
4CBF000
stack
page read and write
32BE000
stack
page read and write
2B0000
unkown
page readonly
43FF000
stack
page read and write
47FE000
stack
page read and write
5AFE000
stack
page read and write
2FE0000
heap
page read and write
1317000
heap
page read and write
52F0000
direct allocation
page execute and read and write
There are 185 hidden memdumps, click here to show them.