IOC Report
h226x41CQ6

FilesProcessesURLsDomainsIPsRegistryMemdumps8642010010Label

Files

File Path
Type
Category
Malicious
Download
h226x41CQ6.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_h226x41CQ6.exe_12a32a8f2ffdc30a9ce8eac17313d375ec21d_64dcd1b7_16c56dfb-f1e8-4625-94b0-f8995fb42e50\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER55C.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Jan 27 13:54:13 2025, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7AF.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DF.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\h226x41CQ6.exe
"C:\Users\user\Desktop\h226x41CQ6.exe"
malicious
C:\Users\user\Desktop\h226x41CQ6.exe
"C:\Users\user\Desktop\h226x41CQ6.exe"
malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7260 -s 260

URLs

Name
IP
Malicious
qualifielgalt.sbs
malicious
pioneeruyj.sbs
malicious
fightyglobo.sbs
malicious
conceptionnyi.sbs
malicious
nervepianoyo.sbs
malicious
modellydivi.sbs
malicious
smashygally.sbs
malicious
platformcati.sbs
malicious
https://platformcati.sbs/api
104.21.112.1
malicious
https://www.cloudflare.com/learning/access-management/phishing-attack/
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://platformcati.sbs/apieI
unknown
http://ocsp.entrust.net03
unknown
http://ocsp.entrust.net02
unknown
https://platformcati.sbs/apip
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://platformcati.sbs/S
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://crl.entrust.net/ts1ca.crl0
unknown
https://itsrevolutionmagnus.xyz/
unknown
https://platformcati.sbs/api?
unknown
https://support.mozilla.org/products/firefoxgro.all
unknown
https://platformcati.sbs/api(w
unknown
https://itsrevolutionmagnus.xyz/Shnnfd.exe%
unknown
https://platformcati.sbs/#HX
unknown
https://itsrevolutionmagnus.xyz/a
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://www.entrust.net/rpa03
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdve
unknown
http://aia.entrust.net/ts1-chain256.cer01
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0
unknown
http://upx.sf.net
unknown
https://www.amazon.com/?tag=admarketus-20&r
unknown
http://ocsp.rootca1.amazontrust.com0:
unknown
https://www.ecosia.org/newtab/
unknown
https://itsrevolutionmagnus.xyz/Pa/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.cloudflare.com/5xx-error-landing
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
unknown
https://itsrevolutionmagnus.xyz/Shnnfd.exe
unknown
https://platformcati.sbs/apiz
unknown
https://platformcati.sbs/h
unknown
https://platformcati.sbs/
unknown
https://platformcati.sbs/api~
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://crl.entrust.net/2048ca.crl0
unknown
https://www.entrust.net/rpa0
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
unknown
There are 47 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
platformcati.sbs
104.21.112.1
malicious
itsrevolutionmagnus.xyz
unknown
malicious

IPs

IP
Domain
Country
Malicious
104.21.112.1
platformcati.sbs
United States
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
ProgramId
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
FileId
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
LowerCaseLongPath
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
LongPathHash
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
Name
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
OriginalFileName
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
Publisher
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
Version
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
BinFileVersion
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
BinaryType
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
ProductName
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
ProductVersion
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
LinkDate
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
BinProductVersion
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
AppxPackageFullName
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
AppxPackageRelativeId
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
Size
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
Language
\REGISTRY\A\{43f97bb7-e17d-e322-adb2-ba8f743de128}\Root\InventoryApplicationFile\h226x41cq6.exe|285b0bcc8c70456b
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
12E6000
heap
page read and write
3C48000
trusted library allocation
page read and write
3E40000
heap
page read and write
3B50000
trusted library allocation
page read and write
3B4D000
trusted library allocation
page read and write
3EE7000
trusted library allocation
page read and write
3B8B000
trusted library allocation
page read and write
12BC000
heap
page read and write
3B4A000
trusted library allocation
page read and write
3BD0000
trusted library allocation
page read and write
3B76000
trusted library allocation
page read and write
3B4A000
trusted library allocation
page read and write
3B4A000
trusted library allocation
page read and write
E70000
unkown
page readonly
EE5000
unkown
page write copy
3B53000
trusted library allocation
page read and write
3B5C000
trusted library allocation
page read and write
3E97000
trusted library allocation
page read and write
3C61000
trusted library allocation
page read and write
E84000
unkown
page readonly
3C67000
trusted library allocation
page read and write
302D000
stack
page read and write
3B4C000
trusted library allocation
page read and write
3C50000
trusted library allocation
page read and write
3C56000
trusted library allocation
page read and write
2FEE000
stack
page read and write
3C41000
trusted library allocation
page read and write
3B7C000
trusted library allocation
page read and write
3B5B000
trusted library allocation
page read and write
3C50000
trusted library allocation
page read and write
3B63000
trusted library allocation
page read and write
1293000
heap
page read and write
126C000
heap
page read and write
EE8000
unkown
page write copy
3E46000
trusted library allocation
page read and write
45C000
remote allocation
page execute and read and write
12D0000
heap
page read and write
12E4000
heap
page read and write
12A6000
heap
page read and write
13D0000
heap
page read and write
E71000
unkown
page execute read
3B4D000
trusted library allocation
page read and write
3B78000
trusted library allocation
page read and write
3B7B000
trusted library allocation
page read and write
12BD000
heap
page read and write
3B55000
trusted library allocation
page read and write
13DE000
heap
page read and write
3BA9000
trusted library allocation
page read and write
3B53000
trusted library allocation
page read and write
122D000
heap
page read and write
12F5000
heap
page read and write
3C61000
trusted library allocation
page read and write
12B7000
heap
page read and write
3B68000
trusted library allocation
page read and write
3C61000
trusted library allocation
page read and write
3B94000
trusted library allocation
page read and write
E8B000
unkown
page read and write
3BB0000
trusted library allocation
page read and write
3B88000
trusted library allocation
page read and write
12E5000
heap
page read and write
1229000
heap
page read and write
3BA9000
trusted library allocation
page read and write
3C59000
trusted library allocation
page read and write
3B74000
trusted library allocation
page read and write
3B58000
trusted library allocation
page read and write
3E41000
heap
page read and write
3C61000
trusted library allocation
page read and write
E8B000
unkown
page write copy
39D0000
heap
page read and write
12F5000
heap
page read and write
EE2000
unkown
page readonly
1253000
heap
page read and write
388D000
stack
page read and write
126B000
heap
page read and write
12ED000
heap
page read and write
3B5C000
trusted library allocation
page read and write
3B74000
trusted library allocation
page read and write
3F0F000
trusted library allocation
page read and write
12D0000
heap
page read and write
12C1000
heap
page read and write
3B55000
trusted library allocation
page read and write
3BA7000
trusted library allocation
page read and write
12EE000
heap
page read and write
3F40000
trusted library allocation
page read and write
3C50000
trusted library allocation
page read and write
3B88000
trusted library allocation
page read and write
3C50000
trusted library allocation
page read and write
12BB000
heap
page read and write
12BB000
heap
page read and write
374E000
stack
page read and write
12DE000
heap
page read and write
EE2000
unkown
page readonly
122D000
heap
page read and write
E70000
unkown
page readonly
3B71000
trusted library allocation
page read and write
12F3000
heap
page read and write
3B64000
trusted library allocation
page read and write
3BA3000
trusted library allocation
page read and write
1227000
heap
page read and write
3B4A000
trusted library allocation
page read and write
EE5000
unkown
page write copy
3C61000
trusted library allocation
page read and write
12CA000
heap
page read and write
3B5A000
trusted library allocation
page read and write
3050000
remote allocation
page read and write
3A1E000
stack
page read and write
E70000
unkown
page readonly
12CE000
heap
page read and write
12BC000
heap
page read and write
3B92000
trusted library allocation
page read and write
3BAC000
trusted library allocation
page read and write
12DE000
heap
page read and write
3B89000
trusted library allocation
page read and write
3E5F000
trusted library allocation
page read and write
12BC000
heap
page read and write
3C50000
trusted library allocation
page read and write
73CA1000
unkown
page execute read
16CF000
stack
page read and write
12DE000
heap
page read and write
12DB000
heap
page read and write
3B74000
trusted library allocation
page read and write
3B90000
trusted library allocation
page read and write
3B78000
trusted library allocation
page read and write
E70000
unkown
page readonly
12BE000
heap
page read and write
1245000
heap
page read and write
12DE000
heap
page read and write
3B74000
trusted library allocation
page read and write
3B74000
trusted library allocation
page read and write
3B5A000
trusted library allocation
page read and write
12E3000
heap
page read and write
12DB000
heap
page read and write
136E000
stack
page read and write
12C7000
heap
page read and write
EE8000
unkown
page write copy
12E2000
heap
page read and write
E8B000
unkown
page write copy
E3B000
stack
page read and write
E84000
unkown
page readonly
3B62000
trusted library allocation
page read and write
3B83000
trusted library allocation
page read and write
12AB000
heap
page read and write
12C9000
heap
page read and write
3E77000
trusted library allocation
page read and write
3C61000
trusted library allocation
page read and write
3B5F000
trusted library allocation
page read and write
123C000
stack
page read and write
12C7000
heap
page read and write
3B75000
trusted library allocation
page read and write
3B8D000
trusted library allocation
page read and write
2FAD000
stack
page read and write
12DB000
heap
page read and write
3B7B000
trusted library allocation
page read and write
3B50000
trusted library allocation
page read and write
12E7000
heap
page read and write
13C0000
heap
page read and write
3B89000
trusted library allocation
page read and write
12DB000
heap
page read and write
3C61000
trusted library allocation
page read and write
3BA7000
trusted library allocation
page read and write
3B5C000
trusted library allocation
page read and write
12BC000
heap
page read and write
1370000
heap
page read and write
12DB000
heap
page read and write
3C61000
trusted library allocation
page read and write
121E000
heap
page read and write
3B41000
trusted library allocation
page read and write
12E6000
heap
page read and write
3C4D000
trusted library allocation
page read and write
13B0000
heap
page read and write
3B49000
trusted library allocation
page read and write
398E000
stack
page read and write
3C61000
trusted library allocation
page read and write
3C50000
trusted library allocation
page read and write
3C41000
trusted library allocation
page read and write
3B74000
trusted library allocation
page read and write
12BD000
heap
page read and write
3B99000
trusted library allocation
page read and write
3F4E000
trusted library allocation
page read and write
4955000
trusted library allocation
page read and write
12E5000
heap
page read and write
3F17000
trusted library allocation
page read and write
384F000
stack
page read and write
3B78000
trusted library allocation
page read and write
1320000
heap
page read and write
126C000
heap
page read and write
3C5F000
trusted library allocation
page read and write
12DB000
heap
page read and write
3B92000
trusted library allocation
page read and write
12C1000
heap
page read and write
12F5000
heap
page read and write
12A9000
heap
page read and write
3C50000
trusted library allocation
page read and write
3B5D000
trusted library allocation
page read and write
171E000
stack
page read and write
3B85000
trusted library allocation
page read and write
3B7E000
trusted library allocation
page read and write
12CE000
heap
page read and write
3B81000
trusted library allocation
page read and write
12C0000
heap
page read and write
3B8A000
trusted library allocation
page read and write
3050000
remote allocation
page read and write
3B5C000
trusted library allocation
page read and write
12F4000
heap
page read and write
3B8A000
trusted library allocation
page read and write
3B86000
trusted library allocation
page read and write
15CE000
stack
page read and write
12DE000
heap
page read and write
3C41000
trusted library allocation
page read and write
3C61000
trusted library allocation
page read and write
12E5000
heap
page read and write
13F5000
heap
page read and write
3F1F000
trusted library allocation
page read and write
3B76000
trusted library allocation
page read and write
1245000
heap
page read and write
1200000
heap
page read and write
12E5000
heap
page read and write
15DE000
stack
page read and write
E71000
unkown
page execute read
3B4D000
trusted library allocation
page read and write
3C61000
trusted library allocation
page read and write
E71000
unkown
page execute read
3B64000
trusted library allocation
page read and write
1253000
heap
page read and write
32AE000
stack
page read and write
12E6000
heap
page read and write
3B50000
trusted library allocation
page read and write
3B94000
trusted library allocation
page read and write
12E0000
heap
page read and write
12CE000
heap
page read and write
EE8000
unkown
page write copy
12BC000
heap
page read and write
3B9F000
trusted library allocation
page read and write
3BAD000
trusted library allocation
page read and write
12E0000
heap
page read and write
3C79000
trusted library allocation
page read and write
3B88000
trusted library allocation
page read and write
12E1000
heap
page read and write
4449000
trusted library allocation
page read and write
3B6F000
trusted library allocation
page read and write
3C61000
trusted library allocation
page read and write
EE2000
unkown
page readonly
3B7A000
trusted library allocation
page read and write
3060000
heap
page read and write
3BA9000
trusted library allocation
page read and write
3B8E000
trusted library allocation
page read and write
3B50000
trusted library allocation
page read and write
3B73000
trusted library allocation
page read and write
3C61000
trusted library allocation
page read and write
12E5000
heap
page read and write
12C0000
heap
page read and write
3B85000
trusted library allocation
page read and write
3B6C000
trusted library allocation
page read and write
2EAD000
stack
page read and write
3BA4000
trusted library allocation
page read and write
12DE000
heap
page read and write
3C61000
trusted library allocation
page read and write
12E0000
heap
page read and write
316D000
stack
page read and write
13BE000
stack
page read and write
3C50000
trusted library allocation
page read and write
3B72000
trusted library allocation
page read and write
3B76000
trusted library allocation
page read and write
12D0000
heap
page read and write
73CBD000
unkown
page read and write
EE2000
unkown
page readonly
3C79000
trusted library allocation
page read and write
12F5000
heap
page read and write
13F0000
heap
page read and write
3B40000
trusted library allocation
page read and write
3C61000
trusted library allocation
page read and write
12F1000
heap
page read and write
12E0000
heap
page read and write
12C3000
heap
page read and write
3BA7000
trusted library allocation
page read and write
3B5B000
trusted library allocation
page read and write
E84000
unkown
page readonly
3B73000
trusted library allocation
page read and write
3B76000
trusted library allocation
page read and write
12EE000
heap
page read and write
3B4A000
trusted library allocation
page read and write
EE5000
unkown
page write copy
3B85000
trusted library allocation
page read and write
12C0000
heap
page read and write
12DB000
heap
page read and write
12E0000
heap
page read and write
12E2000
heap
page read and write
3B50000
trusted library allocation
page read and write
3B76000
trusted library allocation
page read and write
E71000
unkown
page execute read
12F5000
heap
page read and write
3B6C000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
3B61000
trusted library allocation
page read and write
3E40000
trusted library allocation
page read and write
181F000
stack
page read and write
3B92000
trusted library allocation
page read and write
12DB000
heap
page read and write
73CBF000
unkown
page readonly
12E2000
heap
page read and write
3B73000
trusted library allocation
page read and write
3B5C000
trusted library allocation
page read and write
12DB000
heap
page read and write
3C61000
trusted library allocation
page read and write
FEA000
stack
page read and write
3B83000
trusted library allocation
page read and write
12DB000
heap
page read and write
3B61000
trusted library allocation
page read and write
3B61000
trusted library allocation
page read and write
12CA000
heap
page read and write
3C6F000
trusted library allocation
page read and write
E8B000
unkown
page write copy
EE5000
unkown
page write copy
3C77000
trusted library allocation
page read and write
3B4A000
trusted library allocation
page read and write
12C1000
heap
page read and write
73CA0000
unkown
page readonly
3B9A000
trusted library allocation
page read and write
13F7000
heap
page read and write
12A9000
heap
page read and write
121C000
heap
page read and write
EE8000
unkown
page write copy
12E2000
heap
page read and write
12DB000
heap
page read and write
12BD000
heap
page read and write
126B000
heap
page read and write
12CE000
heap
page read and write
3B7C000
trusted library allocation
page read and write
1247000
heap
page read and write
12AB000
heap
page read and write
3B61000
trusted library allocation
page read and write
12DB000
heap
page read and write
12E4000
heap
page read and write
3B50000
trusted library allocation
page read and write
3BB8000
trusted library allocation
page read and write
3C40000
trusted library allocation
page read and write
12F3000
heap
page read and write
3B9E000
trusted library allocation
page read and write
3C50000
trusted library allocation
page read and write
12DE000
heap
page read and write
3C50000
trusted library allocation
page read and write
1291000
heap
page read and write
3B78000
trusted library allocation
page read and write
EE1000
unkown
page read and write
3B44000
trusted library allocation
page read and write
33AF000
stack
page read and write
326F000
stack
page read and write
16DF000
stack
page read and write
12A0000
heap
page read and write
12AB000
heap
page read and write
12F5000
heap
page read and write
13DA000
heap
page read and write
12DE000
heap
page read and write
3B52000
trusted library allocation
page read and write
12A6000
heap
page read and write
73CB6000
unkown
page readonly
13D0000
heap
page read and write
12C5000
heap
page read and write
12A9000
heap
page read and write
3C79000
trusted library allocation
page read and write
3B64000
trusted library allocation
page read and write
3B50000
trusted library allocation
page read and write
3FD3000
trusted library allocation
page read and write
3C47000
trusted library allocation
page read and write
12B9000
heap
page read and write
3B94000
trusted library allocation
page read and write
3050000
remote allocation
page read and write
133D000
stack
page read and write
E84000
unkown
page readonly
3BBA000
trusted library allocation
page read and write
3C41000
trusted library allocation
page read and write
3B4B000
trusted library allocation
page read and write
3B55000
trusted library allocation
page read and write
1251000
heap
page read and write
3B4A000
trusted library allocation
page read and write
3B53000
trusted library allocation
page read and write
3C41000
trusted library allocation
page read and write
1380000
heap
page read and write
12E0000
heap
page read and write
EE0000
unkown
page execute and read and write
3FAF000
trusted library allocation
page read and write
3B1F000
stack
page read and write
3B4A000
trusted library allocation
page read and write
1266000
heap
page read and write
12A6000
heap
page read and write
1208000
heap
page read and write
3C61000
trusted library allocation
page read and write
There are 377 hidden memdumps, click here to show them.