IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\PID8.vbs
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\kms.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\Desktop\LIC_SWITCH.log
ASCII text, with CRLF line terminators
modified

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\System32\cmd.exe
C:\Windows\sysnative\cmd.exe /c (cscript.exe /nologo C:\Users\user\AppData\Local\Temp\PID8.vbs)>>C:\Users\user\AppData\Local\Temp\kms.log
 malicious
C:\Windows\System32\cscript.exe
cscript.exe /nologo C:\Users\user\AppData\Local\Temp\PID8.vbs
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://autohotkey.com
unknown
https://autohotkey.comCould
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
3184000
trusted library allocation
page read and write
1EC2A809000
heap
page read and write
2E60000
heap
page read and write
1EC2A849000
heap
page read and write
502E000
stack
page read and write
1500000
heap
page read and write
546E000
stack
page read and write
2D30000
heap
page read and write
4A0000
unkown
page execute and read and write
110000
heap
page read and write
1505000
heap
page read and write
100000
heap
page read and write
135000
heap
page read and write
48369FE000
stack
page read and write
1EC2A844000
heap
page read and write
B68000
heap
page read and write
1EC2A85B000
heap
page read and write
14C0000
heap
page read and write
1EC2A840000
heap
page read and write
1EC2A84A000
heap
page read and write
3180000
trusted library allocation
page read and write
1EC2A864000
heap
page read and write
4FEF000
stack
page read and write
1EC2A84F000
heap
page read and write
1EC2A81B000
heap
page read and write
586F000
stack
page read and write
2D58000
heap
page read and write
483611A000
stack
page read and write
1EC2A80A000
heap
page read and write
1EC2A84D000
heap
page read and write
1EC2C600000
heap
page read and write
4E9000
unkown
page execute and read and write
1EC2A85E000
heap
page read and write
14C4000
heap
page read and write
401000
unkown
page execute and read and write
1EC2A7E8000
heap
page read and write
1EC2AB15000
heap
page read and write
1EC2A770000
heap
page read and write
48364FE000
stack
page read and write
1EC2A850000
heap
page read and write
1EC2A83D000
heap
page read and write
400000
unkown
page readonly
64E000
unkown
page write copy
4836BFF000
stack
page read and write
BC8000
heap
page read and write
B50000
heap
page read and write
5880000
trusted library allocation
page read and write
1EC2A85D000
heap
page read and write
400000
unkown
page readonly
1EC2A844000
heap
page read and write
1EC2A848000
heap
page read and write
A5A000
stack
page read and write
1EC2A83D000
heap
page read and write
4C4000
unkown
page execute and read and write
2D50000
heap
page read and write
542F000
stack
page read and write
BA0000
heap
page read and write
1EC2A831000
heap
page read and write
1EC2A861000
heap
page read and write
B8A000
heap
page read and write
48365FE000
stack
page read and write
1EC2A858000
heap
page read and write
A63000
stack
page read and write
1EC2A863000
heap
page read and write
1EC2A84F000
heap
page read and write
14BE000
stack
page read and write
1EC2A81E000
heap
page read and write
1EC2A858000
heap
page read and write
1EC2A83E000
heap
page read and write
1EC2A800000
heap
page read and write
64E000
unkown
page read and write
1EC2A84F000
heap
page read and write
1EC2A844000
heap
page read and write
1EC2A832000
heap
page read and write
2D5E000
heap
page read and write
1EC2A740000
heap
page read and write
1EC2A816000
heap
page read and write
1EC2A857000
heap
page read and write
1EC2A868000
heap
page read and write
2E90000
heap
page read and write
4B1000
unkown
page execute and read and write
1EC2A815000
heap
page read and write
1EC2A750000
heap
page read and write
A55000
stack
page read and write
14D0000
heap
page read and write
B60000
heap
page read and write
2E51000
heap
page read and write
1EC2A7F2000
heap
page read and write
1EC2A86B000
heap
page read and write
1EC2A85D000
heap
page read and write
48367FE000
stack
page read and write
130000
heap
page read and write
4CF000
unkown
page execute and read and write
1EC2A85F000
heap
page read and write
150A000
heap
page read and write
A32000
stack
page read and write
B87000
heap
page read and write
1EC2A7E0000
heap
page read and write
BCC000
heap
page read and write
64D000
unkown
page execute and write copy
B8A000
heap
page read and write
1EC2A83D000
heap
page read and write
97000
stack
page read and write
48368FE000
stack
page read and write
1EC2A844000
heap
page read and write
1EC2A852000
heap
page read and write
1EC2A85A000
heap
page read and write
1EC2AB10000
heap
page read and write
1EC2A7D0000
heap
page read and write
B81000
heap
page read and write
4836AFF000
stack
page read and write
B8B000
heap
page read and write
4D0000
unkown
page execute and write copy
A68000
stack
page read and write
2D60000
heap
page read and write
1EC2A85D000
heap
page read and write
1E0000
heap
page read and write
A42000
stack
page read and write
BAC000
heap
page read and write
1EC2A7FC000
heap
page read and write
1EC2A846000
heap
page read and write
1EC2A868000
heap
page read and write
There are 112 hidden memdumps, click here to show them.