IOC Report
q86onx3LvU.exe

loading gif

Files

File Path
Type
Category
Malicious
q86onx3LvU.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_q86onx3LvU.exe_735e19e9cc503aa4d8b24e5bfe4db6f9da4f38_290d446c_3a49521a-32b8-4d8e-92a6-47e870a182c5\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D67.tmp.dmp
Mini DuMP crash report, 15 streams, Wed Jul 3 14:17:04 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F3D.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F8C.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\q86onx3LvU.exe
"C:\Users\user\Desktop\q86onx3LvU.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 2400

URLs

Name
IP
Malicious
http://upx.sf.net
unknown
http://nexoproducciones.cld
unknown
https://nexoproducciones.cl/Fgaxcapme.mp3
104.21.10.178
https://nexoproducciones.cl/Fgaxcapme.mp3#EnableInitializer1jd5Ef2ZS9fTVqPfeqDQhpg==
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://nexoproducciones.cl
unknown
https://nexoproducciones.cl
unknown

Domains

Name
IP
Malicious
nexoproducciones.cl
104.21.10.178

IPs

IP
Domain
Country
Malicious
104.21.10.178
nexoproducciones.cl
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\q86onx3LvU_RASMANCS
FileDirectory
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
ProgramId
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
FileId
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
LowerCaseLongPath
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
LongPathHash
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
Name
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
OriginalFileName
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
Publisher
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
Version
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
BinFileVersion
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
BinaryType
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
ProductName
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
ProductVersion
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
LinkDate
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
BinProductVersion
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
AppxPackageFullName
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
AppxPackageRelativeId
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
Size
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
Language
\REGISTRY\A\{02a1bdf0-6701-e9b7-b560-acd82ecde2c8}\Root\InventoryApplicationFile\q86onx3lvu.exe|657b697ee80f2ac8
Usn
There are 24 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4F80000
trusted library allocation
page read and write
 malicious
4D54000
trusted library allocation
page read and write
 malicious
12AE000
stack
page read and write
135A000
heap
page read and write
12D7000
heap
page read and write
1333000
heap
page read and write
582E000
stack
page read and write
5C8D000
stack
page read and write
DA2000
unkown
page readonly
5F1E000
stack
page read and write
2F83000
trusted library allocation
page execute and read and write
1225000
heap
page read and write
6A10000
heap
page read and write
11B0000
heap
page read and write
3260000
heap
page execute and read and write
32D1000
trusted library allocation
page read and write
32A1000
trusted library allocation
page read and write
157F000
stack
page read and write
2FB7000
trusted library allocation
page execute and read and write
44A5000
trusted library allocation
page read and write
679D000
stack
page read and write
32DA000
trusted library allocation
page read and write
3271000
trusted library allocation
page read and write
2FBB000
trusted library allocation
page execute and read and write
2FD0000
trusted library allocation
page read and write
2FB2000
trusted library allocation
page read and write
32BF000
trusted library allocation
page read and write
601E000
stack
page read and write
137B000
heap
page read and write
2FA0000
trusted library allocation
page read and write
69DE000
stack
page read and write
DA4000
unkown
page readonly
126E000
stack
page read and write
1200000
heap
page read and write
6C4F000
stack
page read and write
3307000
trusted library allocation
page read and write
16D9000
heap
page read and write
6B4E000
stack
page read and write
12B0000
heap
page read and write
2FA7000
trusted library allocation
page execute and read and write
6370000
trusted library allocation
page read and write
2F84000
trusted library allocation
page read and write
3060000
trusted library allocation
page execute and read and write
318E000
stack
page read and write
4271000
trusted library allocation
page read and write
3198000
trusted library allocation
page read and write
16D7000
heap
page read and write
2F8D000
trusted library allocation
page execute and read and write
63BE000
stack
page read and write
32F2000
trusted library allocation
page read and write
12F2000
heap
page read and write
626E000
stack
page read and write
4B28000
trusted library allocation
page read and write
5DCE000
stack
page read and write
5870000
trusted library allocation
page read and write
32EA000
trusted library allocation
page read and write
2FAA000
trusted library allocation
page execute and read and write
1138000
stack
page read and write
32E6000
trusted library allocation
page read and write
4279000
trusted library allocation
page read and write
17DF000
stack
page read and write
5ECE000
stack
page read and write
132E000
heap
page read and write
60AE000
stack
page read and write
5D8E000
stack
page read and write
12EF000
heap
page read and write
11A0000
heap
page read and write
32D7000
trusted library allocation
page read and write
48FC000
trusted library allocation
page read and write
11FE000
stack
page read and write
3070000
trusted library allocation
page read and write
689D000
stack
page read and write
32EE000
trusted library allocation
page read and write
5B4E000
stack
page read and write
68DE000
stack
page read and write
5C4E000
stack
page read and write
1680000
heap
page read and write
46D1000
trusted library allocation
page read and write
61AC000
stack
page read and write
636E000
stack
page read and write
32AD000
trusted library allocation
page read and write
57EF000
stack
page read and write
69E0000
heap
page read and write
167E000
stack
page read and write
DA0000
unkown
page readonly
1366000
heap
page read and write
1207000
heap
page read and write
136A000
heap
page read and write
64BE000
stack
page read and write
331A000
trusted library allocation
page read and write
3368000
trusted library allocation
page read and write
1220000
heap
page read and write
2F80000
trusted library allocation
page read and write
301E000
stack
page read and write
586D000
stack
page read and write
56EE000
stack
page read and write
16C0000
trusted library allocation
page read and write
5880000
heap
page execute and read and write
12BE000
heap
page read and write
69F0000
heap
page read and write
12B8000
heap
page read and write
2F90000
trusted library allocation
page read and write
598E000
stack
page read and write
2FA2000
trusted library allocation
page read and write
536E000
stack
page read and write
16D0000
heap
page read and write
305C000
stack
page read and write
59CF000
stack
page read and write
32C7000
trusted library allocation
page read and write
1384000
heap
page read and write
32CF000
trusted library allocation
page read and write
2FB0000
trusted library allocation
page read and write
3080000
heap
page read and write
103C000
stack
page read and write
There are 104 hidden memdumps, click here to show them.