IOC Report
6j8aA9Av1m.exe

loading gifFilesProcessesURLsIPsRegistryMemdumps321010010Label

Files

File Path
Type
Category
Malicious
Download
6j8aA9Av1m.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\vmdeeo
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_comet.exe_e7bbc681222a1d73b6cf42d9a745c217a33551_d4022333_2af78d45-b336-44bd-b51b-a65038fcd7b2\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER44D3.tmp.dmp
Mini DuMP crash report, 15 streams, Tue Mar 25 13:48:34 2025, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4580.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER45C0.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\b86f9b50
PNG image data, 2688 x 523, 8-bit/color RGB, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\b8c90cd5
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\6j8aA9Av1m.exe
"C:\Users\user\Desktop\6j8aA9Av1m.exe"
 malicious
C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
 malicious
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Users\user\AppData\Roaming\ancar\comet.exe
C:\Users\user\AppData\Roaming\ancar\comet.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7180 -s 600

URLs

Name
IP
Malicious
http://62.60.226.15/8fj482jd9/index.php
62.60.226.15
 malicious
http://vovsoft.com/blog/how-to-activate-using-license-key/openU
unknown
http://62.60.226.15/
unknown
http://62.60.226.15/8fj482jd9/index.phpT
unknown
http://www.vmware.com/0
unknown
http://vovsoft.com
unknown
http://62.60.226.15/8fj482jd9/index.phpJ%4
unknown
http://www.aiim.org/pdfa/ns/id/
unknown
https://vovsoft.com/translation/
unknown
https://vovsoft.com/php/ocr_download.php?lang=
unknown
http://www.vmware.com/0/
unknown
http://vovsoft.com/help/
unknown
http://vovsoft.comopenU
unknown
http://www.indyproject.org/
unknown
http://vovsoft.comopenS
unknown
http://www.symauth.com/cps0(
unknown
http://www.color.org
unknown
http://62.60.226.15/8fj482jd9/index.php7
unknown
http://62.60.226.15/8fj482jd9/index.php:&
unknown
http://62.60.226.15/8fj482jd9/index.phpw
unknown
https://vovsoft.com/blog/credits-and-acknowledgements/open
unknown
http://vovsoft.com/
unknown
http://62.60.226.15/8fj482jd9/index.phpu
unknown
http://www.symauth.com/rpa00
unknown
http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/openU
unknown
https://vovsoft.com/translation/openU
unknown
http://www.info-zip.org/
unknown
https://www.google.com/search?q=openSV
unknown
http://62.60.226.15/8fj482jd9/index.php_
unknown
http://62.60.226.15/8fj482jd9/index.phpP%2
unknown
http://62.60.226.15/8fj482jd9/index.php(&
unknown
http://vovsoft.com/openU
unknown
There are 22 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
62.60.226.15
unknown
Iran (ISLAMIC Republic Of)
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
00184012D1FD5612
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
59E0000
direct allocation
page read and write
 malicious
36D2000
heap
page read and write
E1A000
heap
page read and write
E22000
heap
page read and write
29FD000
direct allocation
page read and write
9B5000
unkown
page readonly
98B000
unkown
page read and write
57F9000
direct allocation
page read and write
56D0000
direct allocation
page read and write
36EF000
heap
page read and write
3600000
heap
page read and write
29B1000
direct allocation
page read and write
3785000
heap
page read and write
E15000
heap
page read and write
B81000
unkown
page readonly
BC2000
unkown
page readonly
2A01000
direct allocation
page read and write
323F000
stack
page read and write
58EE000
stack
page read and write
2FF4000
heap
page read and write
95B000
unkown
page read and write
E26000
heap
page read and write
402B000
heap
page read and write
3037000
heap
page read and write
4FC0000
direct allocation
page read and write
5254000
trusted library allocation
page read and write
10F0000
heap
page read and write
4C53000
heap
page read and write
1126000
heap
page read and write
338E000
heap
page read and write
29FA000
direct allocation
page read and write
C30000
heap
page read and write
E26000
heap
page read and write
95B000
unkown
page read and write
2D4E000
stack
page read and write
2FF4000
heap
page read and write
333E000
stack
page read and write
46B3000
heap
page read and write
BFB000
unkown
page readonly
3780000
heap
page read and write
520C000
trusted library allocation
page read and write
5EFD000
stack
page read and write
5330000
trusted library allocation
page read and write
2F9F000
stack
page read and write
334D000
stack
page read and write
19A000
stack
page read and write
E3F000
heap
page read and write
2A7A000
direct allocation
page read and write
9B000
stack
page read and write
55CA000
unkown
page read and write
5AFB000
stack
page read and write
95D000
unkown
page read and write
2FF4000
heap
page read and write
5119000
trusted library allocation
page read and write
769000
unkown
page execute read
2A73000
direct allocation
page read and write
D35000
heap
page read and write
3700000
heap
page read and write
E28000
heap
page read and write
5330000
unkown
page read and write
3750000
heap
page read and write
5ABC000
stack
page read and write
3FE4000
heap
page read and write
4480000
heap
page read and write
E25000
heap
page read and write
61BE000
stack
page read and write
4420000
heap
page read and write
F3D000
heap
page read and write
2A38000
direct allocation
page read and write
2A22000
direct allocation
page read and write
2FF4000
heap
page read and write
29C8000
direct allocation
page read and write
33B0000
heap
page read and write
401C000
heap
page read and write
E19000
heap
page read and write
29EC000
direct allocation
page read and write
36E6000
heap
page read and write
E0F000
heap
page read and write
29AA000
direct allocation
page read and write
F4E000
stack
page read and write
2FF4000
heap
page read and write
47E0000
heap
page read and write
2A6C000
direct allocation
page read and write
D7E000
stack
page read and write
E40000
heap
page read and write
F00000
heap
page read and write
FEF000
stack
page read and write
2FF4000
heap
page read and write
2FF4000
heap
page read and write
95B000
unkown
page write copy
F06000
heap
page read and write
2A56000
direct allocation
page read and write
2FF0000
heap
page read and write
2FF4000
heap
page read and write
D10000
heap
page read and write
2C30000
heap
page read and write
11A0000
heap
page read and write
592F000
stack
page read and write
E2D000
heap
page read and write
4E9E000
trusted library allocation
page read and write
596E000
stack
page read and write
4484000
heap
page read and write
47BF000
heap
page read and write
962000
unkown
page read and write
2A4F000
direct allocation
page read and write
2FF4000
heap
page read and write
2FF4000
heap
page read and write
2A88000
direct allocation
page read and write
2FDE000
stack
page read and write
298D000
direct allocation
page read and write
29F3000
direct allocation
page read and write
29D6000
direct allocation
page read and write
BA3000
unkown
page write copy
B9D000
unkown
page readonly
2A7E000
stack
page read and write
DF8000
heap
page read and write
C80000
heap
page read and write
2FF4000
heap
page read and write
613D000
stack
page read and write
C07000
unkown
page readonly
2FF4000
heap
page read and write
330C000
stack
page read and write
2D80000
heap
page read and write
E15000
heap
page read and write
29B8000
direct allocation
page read and write
2D83000
heap
page read and write
2FF4000
heap
page read and write
2FF4000
heap
page read and write
E1E000
heap
page read and write
2FF4000
heap
page read and write
1110000
heap
page read and write
9B0000
unkown
page read and write
9B7000
unkown
page readonly
4029000
heap
page read and write
10EF000
stack
page read and write
2C20000
direct allocation
page execute and read and write
CB0000
heap
page read and write
518E000
trusted library allocation
page read and write
2C10000
heap
page read and write
2FF4000
heap
page read and write
36E6000
heap
page read and write
FDE000
stack
page read and write
E48000
heap
page read and write
B31000
unkown
page execute read
9B0000
unkown
page write copy
515E000
direct allocation
page read and write
2D0F000
stack
page read and write
9B4000
unkown
page read and write
E21000
heap
page read and write
EA8000
heap
page read and write
2FF4000
heap
page read and write
2FF4000
heap
page read and write
3000000
direct allocation
page read and write
3030000
heap
page read and write
D30000
heap
page read and write
4034000
heap
page read and write
29E4000
direct allocation
page read and write
5370000
unkown
page read and write
2FF4000
heap
page read and write
586E000
direct allocation
page read and write
2FF4000
heap
page read and write
2A0D000
direct allocation
page read and write
5FFE000
stack
page read and write
4E40000
trusted library allocation
page read and write
2A81000
direct allocation
page read and write
E48000
heap
page read and write
3680000
heap
page read and write
2FF4000
heap
page read and write
625E000
stack
page read and write
EA0000
heap
page read and write
C30000
heap
page read and write
10DF000
stack
page read and write
549D000
heap
page read and write
2A31000
direct allocation
page read and write
2FF4000
heap
page read and write
2A64000
direct allocation
page read and write
2A08000
direct allocation
page read and write
3380000
heap
page read and write
337F000
stack
page read and write
974000
unkown
page write copy
29A2000
direct allocation
page read and write
4590000
unkown
page read and write
4B30000
heap
page read and write
2FF4000
heap
page read and write
53AE000
unkown
page read and write
4EE6000
trusted library allocation
page read and write
5371000
unkown
page read and write
5470000
unkown
page read and write
50E9000
direct allocation
page read and write
57FD000
direct allocation
page read and write
36D5000
heap
page read and write
537A000
heap
page read and write
E9C000
stack
page read and write
76E000
unkown
page execute read
29DD000
direct allocation
page read and write
C0A000
unkown
page readonly
2FF4000
heap
page read and write
19D000
stack
page read and write
2FE0000
heap
page read and write
1120000
heap
page read and write
9B4000
unkown
page read and write
29EF000
direct allocation
page read and write
4AB1000
heap
page read and write
5655000
unkown
page read and write
441C000
stack
page read and write
4A2F000
heap
page read and write
E2A000
heap
page read and write
2FF4000
heap
page read and write
569D000
unkown
page read and write
2A48000
direct allocation
page read and write
98B000
unkown
page read and write
2FF4000
heap
page read and write
BF6000
unkown
page readonly
2984000
direct allocation
page read and write
59B0000
unkown
page read and write
3700000
heap
page read and write
2A5D000
direct allocation
page read and write
9A000
stack
page read and write
95D000
unkown
page read and write
603D000
stack
page read and write
11A9000
heap
page read and write
2FF4000
heap
page read and write
986000
unkown
page read and write
398F000
stack
page read and write
48E2000
heap
page read and write
4017000
heap
page read and write
303C000
heap
page read and write
5471000
unkown
page read and write
5371000
unkown
page read and write
C7E000
stack
page read and write
50ED000
direct allocation
page read and write
1120000
heap
page read and write
3703000
heap
page read and write
C11000
unkown
page readonly
5550000
unkown
page read and write
11A5000
heap
page read and write
986000
unkown
page read and write
2FF4000
heap
page read and write
635E000
stack
page read and write
E19000
heap
page read and write
2C33000
heap
page read and write
DF0000
heap
page read and write
3688000
heap
page read and write
401000
unkown
page execute read
E32000
heap
page read and write
E7F000
stack
page read and write
29CF000
direct allocation
page read and write
61FF000
stack
page read and write
5360000
heap
page read and write
DCE000
stack
page read and write
511D000
trusted library allocation
page read and write
2FF4000
heap
page read and write
2FF4000
heap
page read and write
4032000
heap
page read and write
2FF4000
heap
page read and write
400000
unkown
page readonly
E22000
heap
page read and write
4484000
heap
page read and write
2FF4000
heap
page read and write
B30000
unkown
page readonly
36EF000
heap
page read and write
5471000
unkown
page read and write
2FF4000
heap
page read and write
E2A000
heap
page read and write
2FF4000
heap
page read and write
E21000
heap
page read and write
E5C000
stack
page read and write
1120000
direct allocation
page execute and read and write
3DC4000
heap
page read and write
36CB000
heap
page read and write
299B000
direct allocation
page read and write
E35000
heap
page read and write
4FF0000
trusted library allocation
page read and write
4EED000
trusted library allocation
page read and write
988000
unkown
page read and write
59AF000
stack
page read and write
458E000
stack
page read and write
2A2A000
direct allocation
page read and write
3851000
heap
page read and write
E29000
heap
page read and write
B96000
unkown
page read and write
There are 271 hidden memdumps, click here to show them.