IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\9a540d1b-7348-4c8a-95a6-63efbd690371 (copy)
Google Chrome extension, version 3
dropped
C:\Users\user\Downloads\6f4d0126-b89f-4a74-bbac-50c2eb2de7e2.tmp
Google Chrome extension, version 3
dropped
Chrome Cache Entry: 76
ASCII text, with very long lines (405)
downloaded
Chrome Cache Entry: 77
ASCII text, with very long lines (777)
downloaded
Chrome Cache Entry: 78
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
downloaded
Chrome Cache Entry: 79
ASCII text, with very long lines (574)
downloaded
Chrome Cache Entry: 80
ASCII text, with very long lines (1694)
downloaded
Chrome Cache Entry: 81
Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
downloaded
Chrome Cache Entry: 82
ASCII text, with very long lines (2362)
downloaded
Chrome Cache Entry: 83
HTML document, ASCII text, with very long lines (687)
downloaded
Chrome Cache Entry: 84
ASCII text, with very long lines (777)
downloaded
Chrome Cache Entry: 85
ASCII text, with very long lines (467)
downloaded
Chrome Cache Entry: 86
ASCII text, with very long lines (4478)
downloaded
Chrome Cache Entry: 87
ASCII text, with very long lines (1192)
downloaded
Chrome Cache Entry: 88
ASCII text, with very long lines (693)
downloaded
Chrome Cache Entry: 89
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 90
ASCII text, with very long lines (44533)
downloaded
There are 8 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1972,i,16422733890045715603,8918321103436250044,262144 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5348 --field-trial-handle=1972,i,16422733890045715603,8918321103436250044,262144 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1972,i,16422733890045715603,8918321103436250044,262144 /prefetch:8

URLs

Name
IP
Malicious
https://www.youtube.com/accountKk
unknown
https://play.google/intl/
unknown
https://families.google.com/intl/
unknown
https://youtube.com/t/terms?gl=
unknown
https://policies.google.com/technologies/location-data
unknown
https://www.google.com/intl/
unknown
https://apis.google.com/js/api.js
unknown
https://policies.google.com/privacy/google-partners
unknown
https://play.google.com/work/enroll?identifier=
unknown
https://policies.google.com/terms/service-specific
unknown
https://g.co/recover
unknown
https://policies.google.com/privacy/additional
unknown
https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072
unknown
https://play.google.com/log?format=json&hasfast=true&authuser=0
142.250.185.206
https://www.youtube.com/account
172.217.16.142
https://policies.google.com/technologies/cookies
unknown
https://www.google.com/favicon.ico
142.250.185.164
https://policies.google.com/terms
unknown
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
unknown
https://www.google.com
unknown
https://play.google.com/log?format=json&hasfast=true
unknown
https://policies.google.com/privacy/additional/embedded?gl=kr
unknown
https://policies.google.com/terms/location/embedded
unknown
https://www.youtube.com/t/terms?chromeless=1&hl=
unknown
https://support.google.com/accounts?hl=
unknown
https://policies.google.com/privacy
unknown
https://www.youtube.com/accountL
unknown
https://www.youtube.com/account~fh~
unknown
https://support.google.com/accounts?p=new-si-ui
unknown
https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage
unknown
There are 20 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
youtube-ui.l.google.com
172.217.16.142
www3.l.google.com
142.250.184.238
play.google.com
142.250.185.206
www.google.com
142.250.185.164
accounts.youtube.com
unknown
www.youtube.com
unknown

IPs

IP
Domain
Country
Malicious
142.250.186.46
unknown
United States
142.250.185.206
play.google.com
United States
192.168.2.4
unknown
unknown
192.168.2.5
unknown
unknown
239.255.255.250
unknown
Reserved
142.250.185.164
www.google.com
United States
142.250.184.238
www3.l.google.com
United States
172.217.16.142
youtube-ui.l.google.com
United States

Memdumps

Base Address
Regiontype
Protect
Malicious
EA7000
heap
page read and write
B85000
heap
page read and write
A0D000
stack
page read and write
E06000
heap
page read and write
4F1F000
stack
page read and write
BAF000
heap
page read and write
3374000
heap
page read and write
BFE000
heap
page read and write
C76000
heap
page read and write
3281000
heap
page read and write
D0B000
heap
page read and write
F50000
heap
page read and write
E6A000
heap
page read and write
C6E000
heap
page read and write
FB0000
unkown
page readonly
C15000
heap
page read and write
34B8000
heap
page read and write
C1C000
heap
page read and write
33CE000
heap
page read and write
CBF000
heap
page read and write
34A2000
heap
page read and write
57D0000
heap
page read and write
32D4000
heap
page read and write
D84000
heap
page read and write
B1E000
heap
page read and write
CF7000
heap
page read and write
DB8000
heap
page read and write
BC5000
heap
page read and write
3424000
heap
page read and write
DD5000
heap
page read and write
34C4000
heap
page read and write
346E000
heap
page read and write
34AA000
heap
page read and write
EA7000
heap
page read and write
350C000
heap
page read and write
D49000
heap
page read and write
B55000
heap
page read and write
3502000
heap
page read and write
B93000
heap
page read and write
B97000
heap
page read and write
B55000
heap
page read and write
EA7000
heap
page read and write
C39000
heap
page read and write
FB0000
unkown
page readonly
38C0000
heap
page read and write
C4C000
heap
page read and write
14DE000
stack
page read and write
AD4000
heap
page read and write
DA4000
heap
page read and write
32C9000
heap
page read and write
BBA000
heap
page read and write
D84000
heap
page read and write
B55000
heap
page read and write
30AC000
heap
page read and write
D84000
heap
page read and write
86B000
stack
page read and write
B89000
heap
page read and write
33CD000
heap
page read and write
D00000
heap
page read and write
B6E000
heap
page read and write
CEA000
heap
page read and write
D6F000
heap
page read and write
B55000
heap
page read and write
87F000
stack
page read and write
BAF000
heap
page read and write
B55000
heap
page read and write
E2E000
heap
page read and write
341A000
heap
page read and write
336C000
heap
page read and write
D62000
heap
page read and write
32F2000
heap
page read and write
DD5000
heap
page read and write
3523000
heap
page read and write
CD7000
heap
page read and write
C83000
heap
page read and write
B93000
heap
page read and write
EA7000
heap
page read and write
3410000
heap
page read and write
BEC000
heap
page read and write
DA4000
heap
page read and write
348F000
heap
page read and write
B7C000
heap
page read and write
BC5000
heap
page read and write
34B1000
heap
page read and write
CB0000
heap
page read and write
E5E000
heap
page read and write
D1C000
heap
page read and write
B66000
heap
page read and write
CCC000
heap
page read and write
B03000
heap
page read and write
3380000
heap
page read and write
3361000
heap
page read and write
3445000
heap
page read and write
EA7000
heap
page read and write
1080000
unkown
page write copy
33AB000
heap
page read and write
34A2000
heap
page read and write
84E000
stack
page read and write
341A000
heap
page read and write
DCD000
heap
page read and write
346E000
heap
page read and write
34D1000
heap
page read and write
BA5000
heap
page read and write
ADA000
heap
page read and write
B1B000
heap
page read and write
1A86000
heap
page read and write
3535000
heap
page read and write
C83000
heap
page read and write
D7A000
heap
page read and write
BC4000
heap
page read and write
33A0000
heap
page read and write
18DE000
stack
page read and write
B93000
heap
page read and write
104C000
unkown
page readonly
EA9000
heap
page read and write
FB1000
unkown
page execute read
CBF000
heap
page read and write
BE6000
heap
page read and write
BC4000
heap
page read and write
EAD000
heap
page read and write
DC3000
heap
page read and write
104C000
unkown
page readonly
B78000
heap
page read and write
D7B000
heap
page read and write
D62000
heap
page read and write
3488000
heap
page read and write
D84000
heap
page read and write
B78000
heap
page read and write
D39000
heap
page read and write
CDB000
heap
page read and write
AD3000
heap
page read and write
CD7000
heap
page read and write
E0F000
heap
page read and write
C1C000
heap
page read and write
3312000
heap
page read and write
337D000
heap
page read and write
33CE000
heap
page read and write
C79000
heap
page read and write
32D2000
heap
page read and write
33CF000
heap
page read and write
48BF000
stack
page read and write
BC4000
heap
page read and write
E5E000
heap
page read and write
CC1000
heap
page read and write
C55000
heap
page read and write
34C6000
heap
page read and write
BC7000
heap
page read and write
34CF000
heap
page read and write
C55000
heap
page read and write
E35000
heap
page read and write
C27000
heap
page read and write
D1B000
heap
page read and write
3434000
heap
page read and write
38C9000
heap
page read and write
BF5000
heap
page read and write
351A000
heap
page read and write
BCF000
heap
page read and write
B74000
heap
page read and write
BFE000
heap
page read and write
BD0000
heap
page read and write
33E7000
heap
page read and write
A10000
heap
page read and write
C83000
heap
page read and write
D00000
heap
page read and write
D6F000
heap
page read and write
BC1000
heap
page read and write
B1F000
heap
page read and write
C5A000
heap
page read and write
57CF000
stack
page read and write
31FD000
stack
page read and write
AB8000
heap
page read and write
D00000
heap
page read and write
D1F000
heap
page read and write
BBC000
heap
page read and write
CB7000
heap
page read and write
D39000
heap
page read and write
3190000
heap
page read and write
1084000
unkown
page readonly
DC5000
heap
page read and write
E06000
heap
page read and write
3280000
heap
page read and write
342D000
heap
page read and write
B20000
heap
page read and write
BC5000
heap
page read and write
AEB000
heap
page read and write
BAE000
heap
page read and write
A5D000
stack
page read and write
E45000
heap
page read and write
E2E000
heap
page read and write
D60000
heap
page read and write
341A000
heap
page read and write
3323000
heap
page read and write
BC4000
heap
page read and write
E07000
heap
page read and write
323E000
stack
page read and write
BEB000
heap
page read and write
BBD000
heap
page read and write
B89000
heap
page read and write
B85000
heap
page read and write
B71000
heap
page read and write
EA7000
heap
page read and write
DFF000
heap
page read and write
BA2000
heap
page read and write
B6C000
heap
page read and write
DAD000
heap
page read and write
AEE000
heap
page read and write
53CE000
stack
page read and write
3546000
heap
page read and write
3563000
heap
page read and write
3358000
heap
page read and write
C24000
heap
page read and write
3274000
heap
page read and write
BC4000
heap
page read and write
BFE000
heap
page read and write
107C000
unkown
page write copy
3524000
heap
page read and write
3560000
heap
page read and write
C55000
heap
page read and write
DD5000
heap
page read and write
BC4000
heap
page read and write
33CD000
heap
page read and write
B89000
heap
page read and write
32E9000
heap
page read and write
3502000
heap
page read and write
D87000
heap
page read and write
88D000
stack
page read and write
C63000
heap
page read and write
E2E000
heap
page read and write
354E000
heap
page read and write
48D0000
heap
page read and write
C1C000
heap
page read and write
DB8000
heap
page read and write
CD7000
heap
page read and write
AD8000
heap
page read and write
34C4000
heap
page read and write
34C4000
heap
page read and write
3345000
heap
page read and write
B54000
heap
page read and write
34E9000
heap
page read and write
D1B000
heap
page read and write
CF7000
heap
page read and write
E93000
heap
page read and write
CF0000
heap
page read and write
B78000
heap
page read and write
DAF000
heap
page read and write
3379000
heap
page read and write
3358000
heap
page read and write
C7B000
heap
page read and write
3292000
heap
page read and write
E5E000
heap
page read and write
DA6000
heap
page read and write
33CE000
heap
page read and write
CEF000
heap
page read and write
33CD000
heap
page read and write
34CF000
heap
page read and write
B89000
heap
page read and write
E27000
heap
page read and write
32D2000
heap
page read and write
3358000
heap
page read and write
33AB000
heap
page read and write
1A80000
heap
page read and write
CD7000
heap
page read and write
44BE000
stack
page read and write
CBF000
heap
page read and write
CEA000
heap
page read and write
B98000
heap
page read and write
348F000
heap
page read and write
C02000
heap
page read and write
4F5B000
stack
page read and write
34D8000
heap
page read and write
E12000
heap
page read and write
B57000
heap
page read and write
C8B000
heap
page read and write
3547000
heap
page read and write
DC1000
heap
page read and write
34CF000
heap
page read and write
38CE000
heap
page read and write
85E000
stack
page read and write
CAB000
heap
page read and write
D3F000
heap
page read and write
C30000
heap
page read and write
4B1E000
stack
page read and write
D27000
heap
page read and write
D63000
heap
page read and write
C78000
heap
page read and write
34FB000
heap
page read and write
34F2000
heap
page read and write
B7C000
heap
page read and write
E24000
heap
page read and write
33CE000
heap
page read and write
336C000
heap
page read and write
D01000
heap
page read and write
E69000
heap
page read and write
BB2000
heap
page read and write
344E000
heap
page read and write
B5D000
heap
page read and write
BC4000
heap
page read and write
D39000
heap
page read and write
347F000
heap
page read and write
C49000
heap
page read and write
336C000
heap
page read and write
E33000
heap
page read and write
D66000
heap
page read and write
3575000
heap
page read and write
B7B000
heap
page read and write
E14000
heap
page read and write
B87000
heap
page read and write
BC8000
heap
page read and write
33CD000
heap
page read and write
ADB000
heap
page read and write
3470000
heap
page read and write
C90000
heap
page read and write
33A1000
heap
page read and write
48A000
stack
page read and write
3512000
heap
page read and write
CBF000
heap
page read and write
350C000
heap
page read and write
1072000
unkown
page readonly
E94000
heap
page read and write
C75000
heap
page read and write
BBC000
heap
page read and write
3270000
heap
page read and write
BBD000
heap
page read and write
34BD000
heap
page read and write
3358000
heap
page read and write
1072000
unkown
page readonly
34A2000
heap
page read and write
AB0000
heap
page read and write
357B000
heap
page read and write
350C000
heap
page read and write
3333000
heap
page read and write
34CF000
heap
page read and write
D63000
heap
page read and write
CD7000
heap
page read and write
BFE000
heap
page read and write
B85000
heap
page read and write
33B2000
heap
page read and write
D84000
heap
page read and write
3381000
heap
page read and write
C1D000
heap
page read and write
BC6000
heap
page read and write
33D8000
heap
page read and write
CB7000
heap
page read and write
B8A000
heap
page read and write
1084000
unkown
page readonly
3498000
heap
page read and write
349B000
heap
page read and write
38DE000
heap
page read and write
3358000
heap
page read and write
3378000
heap
page read and write
C55000
heap
page read and write
336C000
heap
page read and write
DEE000
heap
page read and write
D00000
heap
page read and write
350B000
heap
page read and write
B69000
heap
page read and write
FB1000
unkown
page execute read
3524000
heap
page read and write
3425000
heap
page read and write
33E7000
heap
page read and write
346E000
heap
page read and write
3413000
heap
page read and write
DBA000
heap
page read and write
C84000
heap
page read and write
E68000
heap
page read and write
BFE000
heap
page read and write
33E7000
heap
page read and write
107C000
unkown
page read and write
33BC000
heap
page read and write
DD5000
heap
page read and write
A15000
heap
page read and write
CCE000
heap
page read and write
C37000
heap
page read and write
DD7000
heap
page read and write
33E9000
heap
page read and write
348F000
heap
page read and write
34B8000
heap
page read and write
BBC000
heap
page read and write
3491000
heap
page read and write
B55000
heap
page read and write
347F000
heap
page read and write
BFE000
heap
page read and write
BC0000
heap
page read and write
32E7000
heap
page read and write
535C000
stack
page read and write
BDC000
heap
page read and write
AE2000
heap
page read and write
E5E000
heap
page read and write
32E7000
heap
page read and write
333C000
heap
page read and write
D00000
heap
page read and write
BB3000
heap
page read and write
A60000
heap
page read and write
354E000
heap
page read and write
BA3000
heap
page read and write
CD7000
heap
page read and write
B0A000
heap
page read and write
34A2000
heap
page read and write
34F2000
heap
page read and write
CF9000
heap
page read and write
AE2000
heap
page read and write
32DD000
heap
page read and write
BEC000
heap
page read and write
BBC000
heap
page read and write
8F0000
heap
page read and write
D1B000
heap
page read and write
32E7000
heap
page read and write
357A000
heap
page read and write
There are 398 hidden memdumps, click here to show them.