IOC Report
[SOH] CS1.6 Hack v2.bat

loading gifFilesProcessesURLsRegistryMemdumps1020102Label

Files

File Path
Type
Category
Malicious
Download
[SOH] CS1.6 Hack v2.exe
MS-DOS executable PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_[SOH] CS1.6 Hack_d2e752d27c733e64b9b05b113fbd9cc43686c5a_8a141c15_7e724db4-cbf0-4afa-ace4-829a750062d0\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3266.tmp.dmp
Mini DuMP crash report, 15 streams, Wed Apr 2 22:53:54 2025, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3312.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3352.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\[SOH] CS1.6 Hack v2.exe
"C:\Users\user\Desktop\[SOH] CS1.6 Hack v2.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c color F8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 576

URLs

Name
IP
Malicious
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
ProgramId
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
FileId
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
LowerCaseLongPath
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
LongPathHash
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
Name
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
OriginalFileName
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
Publisher
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
Version
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
BinFileVersion
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
BinaryType
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
ProductName
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
ProductVersion
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
LinkDate
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
BinProductVersion
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
AppxPackageFullName
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
AppxPackageRelativeId
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
Size
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
Language
\REGISTRY\A\{cec80c4c-1b07-713e-26fa-42f02090e81e}\Root\InventoryApplicationFile\[soh] cs1.6 hack|c17e8b6e71c537a4
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018000DDABBE6B3
There are 13 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
4D5000
heap
page read and write
54C000
heap
page read and write
220E000
stack
page read and write
496000
heap
page read and write
54C000
heap
page read and write
400000
unkown
page readonly
2380000
heap
page read and write
509000
heap
page read and write
8CF000
stack
page read and write
470000
heap
page read and write
4C5000
heap
page read and write
4D5000
heap
page read and write
7FDF0000
trusted library allocation
page read and write
47E000
heap
page read and write
9B000
stack
page read and write
4B5000
heap
page read and write
430000
unkown
page execute and write copy
401000
unkown
page execute and read and write
4CE000
heap
page read and write
196000
stack
page read and write
268F000
stack
page read and write
22B0000
heap
page read and write
19D000
stack
page read and write
431000
unkown
page write copy
4D5000
heap
page read and write
5AE000
stack
page read and write
430000
unkown
page execute and read and write
19B000
stack
page read and write
450000
heap
page read and write
A0F000
stack
page read and write
400000
unkown
page readonly
5EE000
stack
page read and write
4CF000
heap
page read and write
4D1000
heap
page read and write
4B1000
heap
page read and write
4A3000
heap
page read and write
4CE000
heap
page read and write
440000
heap
page read and write
47A000
heap
page read and write
4B8000
heap
page read and write
42B000
unkown
page execute and read and write
54C000
heap
page read and write
5F0000
heap
page read and write
4C0000
heap
page read and write
4D1000
heap
page read and write
42D000
unkown
page execute and read and write
4C9000
heap
page read and write
4D5000
heap
page read and write
7CF000
stack
page read and write
54C000
heap
page read and write
2240000
heap
page read and write
4D1000
heap
page read and write
401000
unkown
page execute and write copy
54C000
heap
page read and write
431000
unkown
page write copy
54C000
heap
page read and write
4D1000
heap
page read and write
90E000
stack
page read and write
54C000
heap
page read and write
4CF000
heap
page read and write
490000
heap
page read and write
There are 51 hidden memdumps, click here to show them.