IOC Report
SecuriteInfo.com.Win32.Trojan.PSE.1G80G6X.7216.15072.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win32.Trojan.PSE.1G80G6X.7216.15072.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_8b8aab2d3044b37bde8ae2665b0819910cdd8be_7335685e_095836a8\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER172A.tmp.dmp
Mini DuMP crash report, 14 streams, Wed Feb 8 03:47:54 2023, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER17F6.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1864.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.PSE.1G80G6X.7216.15072.exe
C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.PSE.1G80G6X.7216.15072.exe
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 212

URLs

Name
IP
Malicious
https://images-ext-1.discordapp.net:
unknown
https://5bcfae2f38d0e143c888d07ec9733d8c.s
unknown
https://www.dogfight360.com/blog
unknown
https://countess.twitch.tv:
unknown
https://eaassets-a.akam
unknown
https://c58c9f027b8d0739f6b6d94b831e1010.steam302.xyz
unknown
https://cvp.twitch.tv:
unknown
https://status.discordapp.com:
unknown
https://dev.twitch.tv:
unknown
https://passport.twitch.tv:
unknown
https://bd4a0c7567edeaa0401463857c28ead7.steam302.xyz
unknown
https://gds-vhs-drops-campaign-images.twitch.tv:
unknown
https://id-cdn.twitch.tv:
unknown
https://usher.ttvnw.net:
unknown
https://104.16.52.111
unknown
https://aa88a8ab3fabc0c5d90ca85c9442a948.steam302.xyz
unknown
https://discordapp.com:
unknown
https://steamuserimages-a.akamaihd.net
unknown
https://95df2ea9aba3e1cad7f8f4526047b63b.steam302.xyz
unknown
https://5a895ed07aed1b254ee21cd78958ae0b.steam302.xyz
unknown
https://c2491d9d37e95faee1c67e314ae9a4bb.steam302.xyz
unknown
https://vod-metro.twitch.tv:
unknown
https://api.twitch.tv:
unknown
http://www.clamav.net
unknown
https://origin-a.akamaihd.net:
unknown
https://steamcommunity-a.akamaihd.ne
unknown
https://link.twitch.
unknown
https://id.twitch.tv:
unknown
https://link.twitch.tv:
unknown
https://eaassets-a.akamaihd.net
unknown
https://104.16.54.111
unknown
https://clips.twitch.tv:
unknown
https://aws.amazon.com
unknown
https://104.17.2.37
unknown
https://2f16aa2ed3889461cd1076540300a6b3.steam302.xyz
unknown
https://pubsub-edge.twitch.tv:
unknown
https://6d7b94f6a3142075c6e14f949daff580.steam302.xyz
unknown
https://gql.twitc
unknown
https://06b67885560f95cbdf0ba34722e8d33c.steam302.xyz
unknown
https://us-west-2.uploads-regional.twitch.tv:
unknown
https://steamcn.com/t419530-1-1
unknown
https://1da58962a7dd53edd9775f6f74ff14e5.steam302.xyz
unknown
https://dl.discordapp.net:
unknown
http://usher.steam302.xyz
unknown
https://steamcdn-a.akamaihd.net:
unknown
https://music.twitch.tv:
unknown
https://steamstore-a.akamaihd.net
unknown
https://player.twitch.tv:
unknown
https://www.twitch.tv:
unknown
https://162.159.129.233
unknown
https://162.159.129.232
unknown
https://clips-media-assets2.twitch.tv:
unknown
https://m.twitch.tv:
unknown
https://gateway.discord.gg:
unknown
https://2973c6ca0e111662ed293b57dbae9fbf.steam302.xyz
unknown
https://6d859be7aa0440f65c8a940ef5218337.steam302.xyz
unknown
https://gateway.discord.gg
unknown
https://images-ext-2.discordapp.net:
unknown
https://vod-storyboards.twitch.tv:
unknown
http://vluki-a.akamaihd.net
unknown
https://steamcommunity-a.akam
unknown
https://irc-ws.chat.twitch.tv:
unknown
https://2f9e9e61f7236db30c1ce0bb9d53581b.steam302.xyz
unknown
https://app.twitch.tv:
unknown
https://steamcommunity-a.akamai
unknown
https://104.16.51.111
unknown
https://7106a273bf3bbce901b765718ecbe69b.steam302.xyz
unknown
https://platform.twitter.com:
unknown
https://890c88446f94f25bd32a3f1e0df6c120.steam302.xyz
unknown
https://blog.twitch.tv:
unknown
https://b3a0f6b6d20e3408d1725780186c54d3.steam302.xyz
unknown
https://gql.twitch.tv:
unknown
https://extension-files.twitch.tv:
unknown
https://eaassets-a.akamaihd
unknown
https://fb96613da2b5475079b93f4be2e94cd3.steam302.xyz
unknown
https://43658a3dbcfbc284a9030abbc3691c30.steam302.xyz
unknown
https://client-event-reporter.twitch.tv:
unknown
https://twitch.tv:
unknown
https://104.16.53.111
unknown
https://inspector.twitch.tv:
unknown
http://cctv4-lh.akamaihd.net
unknown
https://e320c9db4f90dd219ab379f6a5e50dbd.steam302.xyz
unknown
https://dbc180c27b3635f9e5b006f3a037b87e.steam302.xyz
unknown
https://static2.cdn.ubi.com
unknown
https://steampipe.ak
unknown
http://toots-a.akamaihd.net
unknown
https://spade.twitch.tv:
unknown
https://media.discordapp.net:
unknown
http://hgtv-i.akamaihd.net
unknown
https://support.discordapp.com:
unknown
https://trowel.twitch.tv:
unknown
https://985a89155dd090eacda1b82388e334ed.steam302.xyz
unknown
https://store.steampowered.com:
unknown
https://104.16.55.111
unknown
https://help.twitch.tv:
unknown
http://upx.sf.net
unknown
https://5dd1e18eb1a29671b73c32e518b37111.steam302.xyz
unknown
https://91b1eb7256ac2992f03fe0c7e7ef998d.steam302.xyz
unknown
https://e8304b1598fbfa673d2055f0a3342d7a.steam302.xyz
unknown
https://1d23669ea58a590fd66d9204d4301563.steam302.xyz
unknown
There are 90 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
AmiHivePermissionsCorrect
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
AmiHiveOwnerCorrect
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
ProgramId
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
FileId
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
LowerCaseLongPath
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
LongPathHash
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
Name
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
Publisher
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
Version
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
BinFileVersion
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
BinaryType
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
ProductName
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
ProductVersion
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
LinkDate
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
BinProductVersion
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
Size
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
Language
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
IsPeFile
\REGISTRY\A\{d0002fcf-02a9-b331-d719-93ce42d98bee}\Root\InventoryApplicationFile\securiteinfo.com|74c31352
IsOsComponent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
ExceptionRecord
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
001880093E844BFD
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
There are 14 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
21324657000
heap
page read and write
25C6A0C0000
heap
page read and write
16E74C7A000
heap
page read and write
13E80829000
heap
page read and write
16E74C67000
heap
page read and write
1DDEEF10000
heap
page read and write
84F7E79000
stack
page read and write
1DDEF1E6000
heap
page read and write
1C229A02000
trusted library allocation
page read and write
A08FFFC000
stack
page read and write
1DDEF943000
heap
page read and write
50B000
unkown
page execute and read and write
13E80700000
heap
page read and write
22B80960000
heap
page read and write
16E74C63000
heap
page read and write
22B81202000
heap
page read and write
25C6AA02000
trusted library allocation
page read and write
21326610000
remote allocation
page read and write
25C6A213000
heap
page read and write
1E167E3D000
heap
page read and write
213244B0000
heap
page read and write
84F77BB000
stack
page read and write
84F807F000
stack
page read and write
16E74C3B000
heap
page read and write
1DDEF000000
heap
page read and write
16E74C32000
heap
page read and write
1C229302000
heap
page read and write
33E2FE000
stack
page read and write
1E167DB0000
trusted library allocation
page read and write
22B81312000
heap
page read and write
1C2291C0000
trusted library allocation
page read and write
16E74C46000
heap
page read and write
1DDEF058000
heap
page read and write
1DDEFA02000
heap
page read and write
1DDEF02F000
heap
page read and write
33E3FD000
stack
page read and write
1C229313000
heap
page read and write
13CAB4B000
stack
page read and write
84F7F7A000
stack
page read and write
1DDEEF20000
heap
page read and write
1E167D20000
heap
page read and write
21326210000
trusted library allocation
page read and write
84F7B7E000
stack
page read and write
4E3CAAC000
stack
page read and write
16E74BD0000
heap
page read and write
1DDEF802000
heap
page read and write
1DDEFA23000
heap
page read and write
1C229213000
heap
page read and write
25C6A202000
heap
page read and write
A09067E000
stack
page read and write
21324658000
heap
page read and write
1DDEF013000
heap
page read and write
16E74C6B000
heap
page read and write
1DDEF029000
heap
page read and write
16E74C62000
heap
page read and write
16E74C42000
heap
page read and write
1DDEF1BA000
heap
page read and write
16E74C64000
heap
page read and write
2132462A000
heap
page read and write
19E000
stack
page read and write
1DDEEFD0000
trusted library allocation
page read and write
8E29DFF000
stack
page read and write
1E167E13000
heap
page read and write
22B81300000
heap
page read and write
4E3D07F000
stack
page read and write
7CDE0FB000
stack
page read and write
22B80B13000
heap
page read and write
1E167E29000
heap
page read and write
50B000
unkown
page execute and read and write
1DDEF093000
heap
page read and write
33E27D000
stack
page read and write
1C229060000
heap
page read and write
1C229267000
heap
page read and write
13E80852000
heap
page read and write
21324600000
heap
page read and write
1DDEF087000
heap
page read and write
1DDEF954000
heap
page read and write
21324647000
heap
page read and write
13E8083C000
heap
page read and write
84F817E000
stack
page read and write
21324658000
heap
page read and write
4E3CBAE000
stack
page read and write
16E74C40000
heap
page read and write
1DDEF96D000
heap
page read and write
22B80A44000
heap
page read and write
A09027F000
stack
page read and write
21324520000
heap
page read and write
13E80800000
heap
page read and write
25C6A1C0000
trusted library allocation
page read and write
16E74C5A000
heap
page read and write
13E80813000
heap
page read and write
84F7DFB000
stack
page read and write
16E74C5E000
heap
page read and write
22B80B02000
heap
page read and write
1DDEF9D1000
heap
page read and write
21324689000
heap
page read and write
13CB17E000
stack
page read and write
1E167E57000
heap
page read and write
1DDEF9BC000
heap
page read and write
A09057D000
stack
page read and write
25C6A300000
heap
page read and write
21324700000
heap
page read and write
1C22923D000
heap
page read and write
22B80A00000
heap
page read and write
21326610000
remote allocation
page read and write
1E167DE0000
remote allocation
page read and write
33E07E000
stack
page read and write
22B8133A000
heap
page read and write
21324662000
heap
page read and write
25C6A258000
heap
page read and write
16E74B60000
heap
page read and write
16E74C79000
heap
page read and write
25C6A266000
heap
page read and write
517000
unkown
page execute and read and write
1C229050000
heap
page read and write
25C6A262000
heap
page read and write
22B80ACA000
heap
page read and write
1C229202000
heap
page read and write
21324648000
heap
page read and write
1DDEF03D000
heap
page read and write
401000
unkown
page execute and read and write
25C6A27E000
heap
page read and write
7CDE1FE000
stack
page read and write
A09047B000
stack
page read and write
16E74C5F000
heap
page read and write
16E74C3D000
heap
page read and write
4E3CB2E000
stack
page read and write
30000
heap
page read and write
21326002000
trusted library allocation
page read and write
33DB2B000
stack
page read and write
16E74C13000
heap
page read and write
22B80AC7000
heap
page read and write
1E167DE0000
remote allocation
page read and write
16E74C41000
heap
page read and write
22B80AE3000
heap
page read and write
A08FBCB000
stack
page read and write
9D000
stack
page read and write
16E74C48000
heap
page read and write
213244C0000
heap
page read and write
8E29EFE000
stack
page read and write
21325FC0000
trusted library allocation
page read and write
84F827B000
stack
page read and write
33E4FD000
stack
page read and write
16E74C45000
heap
page read and write
1DDEEF80000
heap
page read and write
2132467E000
heap
page read and write
21324702000
heap
page read and write
1DDEF08D000
heap
page read and write
400000
unkown
page readonly
1DDEF05A000
heap
page read and write
13E806B0000
heap
page read and write
517000
unkown
page execute and read and write
A09087E000
stack
page read and write
21324613000
heap
page read and write
25C6A23D000
heap
page read and write
8E29BFF000
stack
page read and write
E10FE7E000
stack
page read and write
33E57F000
stack
page read and write
8E29FFF000
stack
page read and write
1E168602000
trusted library allocation
page read and write
21326250000
trusted library allocation
page read and write
16E74C73000
heap
page read and write
1DDEFA28000
heap
page read and write
400000
unkown
page readonly
21326610000
remote allocation
page read and write
1C229200000
heap
page read and write
7CDDACB000
stack
page read and write
16E75330000
trusted library allocation
page read and write
1E167D10000
heap
page read and write
13E80902000
heap
page read and write
33DFFE000
stack
page read and write
25C6A302000
heap
page read and write
1DDEF113000
heap
page read and write
16E74C58000
heap
page read and write
1DDEF9C6000
heap
page read and write
84F7BFF000
stack
page read and write
1DDEF9AE000
heap
page read and write
1C229229000
heap
page read and write
1E167E02000
heap
page read and write
8E2A1FE000
stack
page read and write
E11047C000
stack
page read and write
E11037E000
stack
page read and write
13CB27F000
stack
page read and write
4E3CF7E000
stack
page read and write
1E167DE0000
remote allocation
page read and write
1E167F02000
heap
page read and write
16E74C57000
heap
page read and write
16E74C44000
heap
page read and write
16E74C4E000
heap
page read and write
7CDE2FE000
stack
page read and write
1C2290C0000
heap
page read and write
1E167E00000
heap
page read and write
A09077C000
stack
page read and write
16E74C76000
heap
page read and write
8E2967B000
stack
page read and write
22B80AB9000
heap
page read and write
1DDEF18F000
heap
page read and write
25C6A060000
heap
page read and write
E11007F000
stack
page read and write
21324718000
heap
page read and write
21324648000
heap
page read and write
16E74C61000
heap
page read and write
1E167D80000
heap
page read and write
E11017D000
stack
page read and write
25C6A200000
heap
page read and write
16E74C82000
heap
page read and write
1DDEEFB0000
trusted library allocation
page read and write
16E74B70000
heap
page read and write
1DDEF07F000
heap
page read and write
7CDDFFB000
stack
page read and write
21325FE0000
trusted library allocation
page read and write
1C22924E000
heap
page read and write
1DDEF922000
heap
page read and write
22B80A29000
heap
page read and write
21324602000
heap
page read and write
8E2987B000
stack
page read and write
E10FCFC000
stack
page read and write
A09017F000
stack
page read and write
1DDEFA13000
heap
page read and write
16E74C7C000
heap
page read and write
1DDEFA31000
heap
page read and write
8E2A0FE000
stack
page read and write
13E81002000
trusted library allocation
page read and write
13E80844000
heap
page read and write
13CB079000
stack
page read and write
8E299FE000
stack
page read and write
6E0000
heap
page read and write
1C229275000
heap
page read and write
16E75402000
trusted library allocation
page read and write
E10FF7F000
stack
page read and write
21324640000
heap
page read and write
4E3D27E000
stack
page read and write
21324713000
heap
page read and write
16E74C5C000
heap
page read and write
850000
heap
page read and write
16E74C29000
heap
page read and write
4E3D17E000
stack
page read and write
16E74C74000
heap
page read and write
22B80A13000
heap
page read and write
13E80802000
heap
page read and write
13E806A0000
heap
page read and write
16E74C59000
heap
page read and write
A0903FD000
stack
page read and write
401000
unkown
page execute and read and write
1DDEF043000
heap
page read and write
25C6A050000
heap
page read and write
22B80970000
heap
page read and write
8E29CFD000
stack
page read and write
1DDEFA00000
heap
page read and write
22B81130000
trusted library allocation
page read and write
25C6A313000
heap
page read and write
1DDEF076000
heap
page read and write
A0902FC000
stack
page read and write
13E80E60000
trusted library allocation
page read and write
1DDEF900000
heap
page read and write
16E74D02000
heap
page read and write
1DDEF990000
heap
page read and write
84F7CFF000
stack
page read and write
E10F8FC000
stack
page read and write
8E29AFC000
stack
page read and write
13E8082E000
heap
page read and write
16E74C60000
heap
page read and write
E11027C000
stack
page read and write
33E17E000
stack
page read and write
1DDEF093000
heap
page read and write
16E74C00000
heap
page read and write
22B80A67000
heap
page read and write
22B80A6E000
heap
page read and write
22B809D0000
heap
page read and write
1DDEF902000
heap
page read and write
25C6A229000
heap
page read and write
1DDEF922000
heap
page read and write
13E80848000
heap
page read and write
There are 263 hidden memdumps, click here to show them.