IOC Report
#U8d77#U8bc9#U6750#U6599#U548c#U501f#U6b3e#U8bc1#U636e.docx.exe

loading gif

Files

File Path
Type
Category
Malicious
#U8d77#U8bc9#U6750#U6599#U548c#U501f#U6b3e#U8bc1#U636e.docx.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Cookies_2.temp
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\History_4.temp
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\History_5.temp
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\Local State_0.temp
JSON data
dropped
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\LOG
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\LOG.old
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\MANIFEST-000001
OpenPGP Secret Key
dropped
C:\Users\user\AppData\Local\Temp\Login Data_1.temp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\Secure Preferences_9.temp
JSON data
dropped
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\000003.log
data
dropped
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\CURRENT
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\LOG
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000001
OpenPGP Secret Key
dropped
C:\Users\user\AppData\Local\Temp\Web Data_6.temp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\cookies.sqlite_14.temp
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\encrypted-4196093820.dat
data
dropped
C:\Users\user\AppData\Local\Temp\extensions.json_21.temp
JSON data
dropped
C:\Users\user\AppData\Local\Temp\key4.db_12.temp
SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\places.sqlite_15.temp
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\places.sqlite_16.temp
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\places.sqlite_17.temp
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\webappsstore.sqlite_19.temp
SQLite 3.x database, user version 2, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Roaming\hack\archive.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\hack\chrome_default_cookie.csv
CSV text
dropped
There are 16 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\#U8d77#U8bc9#U6750#U6599#U548c#U501f#U6b3e#U8bc1#U636e.docx.exe
"C:\Users\user\Desktop\#U8d77#U8bc9#U6750#U6599#U548c#U501f#U6b3e#U8bc1#U636e.docx.exe"
 malicious

URLs

Name
IP
Malicious
http://file://mailto:http://BINARY-x0X03.46.0
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.mdsync:
unknown
https://duckduckgo.com/ac/?q=
unknown
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signatureC:
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://chrome.google.com/webstore
unknown
https://drive-daily-2.corp.google.com/
unknown
https://drive-autopush.corp.google.com/
unknown
https://drive-daily-4.corp.google.com/
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://43.248.8.109:8888/uploadfmt:
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.ecosia.org/newtab/
unknown
https://drive-daily-1.corp.google.com/
unknown
https://chrome.google.com/webstore/detail/PrintableString
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://drive-daily-5.corp.google.com/
unknown
https://docs.google.com/
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://drive-staging.corp.google.com/
unknown
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signaturee
unknown
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md
unknown
https://drive-daily-6.corp.google.com/
unknown
https://drive.google.com/
unknown
https://drive-daily-0.corp.google.com/
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://43.248.8.109:8888/upload
43.248.8.109
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signature
unknown
https://drive-preprod.corp.google.com/
unknown
https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md04
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://www.google.com/
unknown
https://github.com/moonD4rk/HackBrowserDataCompactions
unknown
https://drive-daily-3.corp.google.com/
unknown
There are 27 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
43.248.8.109
unknown
Hong Kong

Memdumps

Base Address
Regiontype
Protect
Malicious
15DE000
unkown
page readonly
 malicious
15DE000
unkown
page readonly
 malicious
1B81000
unkown
page write copy
C000791000
direct allocation
page read and write
C000304000
direct allocation
page read and write
C000BEB000
direct allocation
page read and write
C000789000
direct allocation
page read and write
C0000EA000
direct allocation
page read and write
1B8E000
unkown
page read and write
C0001D2000
direct allocation
page read and write
C0001DE000
direct allocation
page read and write
C00008B000
direct allocation
page read and write
17DE6546000
direct allocation
page read and write
17DE620C000
direct allocation
page read and write
C00023E000
direct allocation
page read and write
17DA0EB8000
heap
page read and write
C0001EC000
direct allocation
page read and write
C000006000
direct allocation
page read and write
C00004D000
direct allocation
page read and write
C00033C000
direct allocation
page read and write
1CB7000
unkown
page readonly
C00009E000
direct allocation
page read and write
C00118D000
direct allocation
page read and write
C00032C000
direct allocation
page read and write
1B98000
unkown
page write copy
C0001BA000
direct allocation
page read and write
17DE6586000
direct allocation
page read and write
C00030E000
direct allocation
page read and write
1B9E000
unkown
page read and write
C000344000
direct allocation
page read and write
C0002F1000
direct allocation
page read and write
C000148000
direct allocation
page read and write
17DE65C8000
direct allocation
page read and write
17DE65D7000
direct allocation
page read and write
17DE64B6000
direct allocation
page read and write
C00000A000
direct allocation
page read and write
C000626000
direct allocation
page read and write
17DE6542000
direct allocation
page read and write
1B9C000
unkown
page write copy
17DE64C6000
direct allocation
page read and write
C00025C000
direct allocation
page read and write
1B92000
unkown
page write copy
1B8F000
unkown
page write copy
FE1000
unkown
page execute read
17DE6530000
direct allocation
page read and write
17DE65B0000
direct allocation
page read and write
1B8D000
unkown
page write copy
17DE6230000
direct allocation
page read and write
59661FF000
stack
page read and write
C000312000
direct allocation
page read and write
C0002DE000
direct allocation
page read and write
C000078000
direct allocation
page read and write
C000354000
direct allocation
page read and write
C000592000
direct allocation
page read and write
C0002BD000
direct allocation
page read and write
C000626000
direct allocation
page read and write
17DA0E90000
direct allocation
page read and write
17DA0EA0000
direct allocation
page read and write
C0010ED000
direct allocation
page read and write
C000258000
direct allocation
page read and write
C0000EC000
direct allocation
page read and write
C0000F0000
direct allocation
page read and write
17DE6490000
direct allocation
page read and write
17DE6550000
direct allocation
page read and write
C0001D0000
direct allocation
page read and write
17DE6560000
direct allocation
page read and write
C000BCB000
direct allocation
page read and write
C00122D000
direct allocation
page read and write
C000322000
direct allocation
page read and write
C000711000
direct allocation
page read and write
17DE6260000
direct allocation
page read and write
C000250000
direct allocation
page read and write
17DE65A7000
direct allocation
page read and write
C00015C000
direct allocation
page read and write
C000059000
direct allocation
page read and write
17DA0FB0000
direct allocation
page read and write
17DE6240000
direct allocation
page read and write
1C76000
unkown
page read and write
C000046000
direct allocation
page read and write
C0002FA000
direct allocation
page read and write
C000098000
direct allocation
page read and write
C000367000
direct allocation
page read and write
C000214000
direct allocation
page read and write
C000384000
direct allocation
page read and write
C000100000
direct allocation
page read and write
1BB0000
unkown
page write copy
C00024E000
direct allocation
page read and write
C000332000
direct allocation
page read and write
C0001D2000
direct allocation
page read and write
C000106000
direct allocation
page read and write
C0007F1000
direct allocation
page read and write
C0000AA000
direct allocation
page read and write
C00017C000
direct allocation
page read and write
C000352000
direct allocation
page read and write
17DE6556000
direct allocation
page read and write
1B8B000
unkown
page read and write
C000322000
direct allocation
page read and write
C0006BA000
direct allocation
page read and write
C000C63000
direct allocation
page read and write
5965BFD000
stack
page read and write
17DE6530000
direct allocation
page read and write
C00033E000
direct allocation
page read and write
C00036B000
direct allocation
page read and write
C0001E6000
direct allocation
page read and write
17DA0E80000
heap
page read and write
C000158000
direct allocation
page read and write
17DE6495000
direct allocation
page read and write
C000382000
direct allocation
page read and write
C00030C000
direct allocation
page read and write
C000082000
direct allocation
page read and write
17DE64C0000
direct allocation
page read and write
59665FE000
stack
page read and write
17DE64B2000
direct allocation
page read and write
C0001BE000
direct allocation
page read and write
17DE6495000
direct allocation
page read and write
1C9F000
unkown
page readonly
C000369000
direct allocation
page read and write
FE0000
unkown
page readonly
C000270000
direct allocation
page read and write
C000C8B000
direct allocation
page read and write
C000C13000
direct allocation
page read and write
C000829000
direct allocation
page read and write
C0010C4000
direct allocation
page read and write
C00119D000
direct allocation
page read and write
C0007F1000
direct allocation
page read and write
C0000AC000
direct allocation
page read and write
C000369000
direct allocation
page read and write
C0002A6000
direct allocation
page read and write
C0002DA000
direct allocation
page read and write
C0001CB000
direct allocation
page read and write
C000110000
direct allocation
page read and write
C000761000
direct allocation
page read and write
C0000BE000
direct allocation
page read and write
C00036B000
direct allocation
page read and write
1BE2000
unkown
page read and write
C0001D8000
direct allocation
page read and write
C000210000
direct allocation
page read and write
C00003A000
direct allocation
page read and write
1C9F000
unkown
page readonly
17DA0E85000
heap
page read and write
C000000000
direct allocation
page read and write
C0001FC000
direct allocation
page read and write
C00016E000
direct allocation
page read and write
17DE6525000
direct allocation
page read and write
C0006F1000
direct allocation
page read and write
17DE6520000
direct allocation
page read and write
C00032E000
direct allocation
page read and write
C0010F5000
direct allocation
page read and write
1BAE000
unkown
page read and write
C00025A000
direct allocation
page read and write
C000367000
direct allocation
page read and write
C000C93000
direct allocation
page read and write
1B91000
unkown
page read and write
C000BC2000
direct allocation
page read and write
17DE6546000
direct allocation
page read and write
C000300000
direct allocation
page read and write
C00032C000
direct allocation
page read and write
C0000A6000
direct allocation
page read and write
C0000D2000
direct allocation
page read and write
C00027A000
direct allocation
page read and write
17DA0E00000
heap
page read and write
C0010BE000
direct allocation
page read and write
C0000C8000
direct allocation
page read and write
1BD3000
unkown
page read and write
C000285000
direct allocation
page read and write
C000344000
direct allocation
page read and write
17DE6521000
direct allocation
page read and write
C00015A000
direct allocation
page read and write
17DA0FB4000
direct allocation
page read and write
C00034E000
direct allocation
page read and write
C0001BC000
direct allocation
page read and write
C000BBC000
direct allocation
page read and write
C000212000
direct allocation
page read and write
17DE6564000
direct allocation
page read and write
C000312000
direct allocation
page read and write
C0002D0000
direct allocation
page read and write
C00001A000
direct allocation
page read and write
1C6D000
unkown
page read and write
17DE6213000
direct allocation
page read and write
C000364000
direct allocation
page read and write
1C9E000
unkown
page write copy
1B9A000
unkown
page read and write
C000306000
direct allocation
page read and write
C000CF3000
direct allocation
page read and write
C000226000
direct allocation
page read and write
C00006E000
direct allocation
page read and write
C000050000
direct allocation
page read and write
C000326000
direct allocation
page read and write
C00002F000
direct allocation
page read and write
C0001B2000
direct allocation
page read and write
C00026E000
direct allocation
page read and write
17DE6490000
direct allocation
page read and write
C000BDB000
direct allocation
page read and write
17DE64A0000
direct allocation
page read and write
C000426000
direct allocation
page read and write
C0001C6000
direct allocation
page read and write
C0000DA000
direct allocation
page read and write
C00003F000
direct allocation
page read and write
C000799000
direct allocation
page read and write
1C06000
unkown
page read and write
C00035C000
direct allocation
page read and write
1C9E000
unkown
page write copy
17DA0FB8000
direct allocation
page read and write
1CB7000
unkown
page readonly
C00027F000
direct allocation
page read and write
1BCB000
unkown
page read and write
C000024000
direct allocation
page read and write
C000D2B000
direct allocation
page read and write
C00010C000
direct allocation
page read and write
17DE64D0000
direct allocation
page read and write
17DE64B6000
direct allocation
page read and write
C0001C6000
direct allocation
page read and write
C0001D4000
direct allocation
page read and write
17DA0E70000
direct allocation
page read and write
17DE6570000
direct allocation
page read and write
C000118000
direct allocation
page read and write
C0006C0000
direct allocation
page read and write
C000276000
direct allocation
page read and write
C000470000
direct allocation
page read and write
C001195000
direct allocation
page read and write
17DE6270000
direct allocation
page read and write
1BDA000
unkown
page write copy
17DE6530000
direct allocation
page read and write
C00008F000
direct allocation
page read and write
C000190000
direct allocation
page read and write
C000208000
direct allocation
page read and write
17DE6525000
direct allocation
page read and write
17DE65E8000
direct allocation
page read and write
C0002A8000
direct allocation
page read and write
59663FE000
stack
page read and write
C0000FE000
direct allocation
page read and write
C0000E2000
direct allocation
page read and write
C00026C000
direct allocation
page read and write
1BFF000
unkown
page read and write
FE1000
unkown
page execute read
C00013C000
direct allocation
page read and write
C000346000
direct allocation
page read and write
C000404000
direct allocation
page read and write
C000091000
direct allocation
page read and write
C00036D000
direct allocation
page read and write
C00004B000
direct allocation
page read and write
C0006E9000
direct allocation
page read and write
C000799000
direct allocation
page read and write
C000036000
direct allocation
page read and write
C000328000
direct allocation
page read and write
C0000F6000
direct allocation
page read and write
1BCD000
unkown
page write copy
C00033A000
direct allocation
page read and write
1B81000
unkown
page read and write
17DA0E20000
heap
page read and write
C000592000
direct allocation
page read and write
C000144000
direct allocation
page read and write
C000038000
direct allocation
page read and write
C0000A4000
direct allocation
page read and write
C0000F4000
direct allocation
page read and write
C0002D8000
direct allocation
page read and write
C0001C4000
direct allocation
page read and write
C001115000
direct allocation
page read and write
C000364000
direct allocation
page read and write
C000342000
direct allocation
page read and write
5965DFE000
stack
page read and write
C000278000
direct allocation
page read and write
17DE64A0000
direct allocation
page read and write
C000096000
direct allocation
page read and write
17DA0D20000
heap
page read and write
C0004FE000
direct allocation
page read and write
C00025E000
direct allocation
page read and write
C0001DC000
direct allocation
page read and write
C0001CB000
direct allocation
page read and write
1BB1000
unkown
page write copy
C0010DD000
direct allocation
page read and write
C000761000
direct allocation
page read and write
17DE6250000
direct allocation
page read and write
C0001A0000
direct allocation
page read and write
C000280000
direct allocation
page read and write
C00021E000
direct allocation
page read and write
17DE6523000
direct allocation
page read and write
1B8A000
unkown
page write copy
C000380000
direct allocation
page read and write
C000356000
direct allocation
page read and write
C000C9B000
direct allocation
page read and write
17DE6550000
direct allocation
page read and write
C000296000
direct allocation
page read and write
C0004FE000
direct allocation
page read and write
17DE6493000
direct allocation
page read and write
17DE6520000
direct allocation
page read and write
C0000C0000
direct allocation
page read and write
C00002C000
direct allocation
page read and write
17DE61F0000
direct allocation
page read and write
1C78000
unkown
page readonly
C0006C9000
direct allocation
page read and write
17DE6490000
direct allocation
page read and write
C0006D9000
direct allocation
page read and write
17DE6550000
direct allocation
page read and write
C000789000
direct allocation
page read and write
C0011F5000
direct allocation
page read and write
C0010CD000
direct allocation
page read and write
C001165000
direct allocation
page read and write
C0002D2000
direct allocation
page read and write
C0001B8000
direct allocation
page read and write
C000332000
direct allocation
page read and write
C0001EC000
direct allocation
page read and write
C000216000
direct allocation
page read and write
1B97000
unkown
page read and write
C000324000
direct allocation
page read and write
C000168000
direct allocation
page read and write
C000BF3000
direct allocation
page read and write
C000002000
direct allocation
page read and write
C000330000
direct allocation
page read and write
C000711000
direct allocation
page read and write
C00015E000
direct allocation
page read and write
17DE61FB000
direct allocation
page read and write
17DA0EB0000
heap
page read and write
C00001E000
direct allocation
page read and write
17DE64E2000
direct allocation
page read and write
C0000E6000
direct allocation
page read and write
17DE64A0000
direct allocation
page read and write
C000791000
direct allocation
page read and write
C0000E0000
direct allocation
page read and write
C000205000
direct allocation
page read and write
59669FE000
stack
page read and write
C000334000
direct allocation
page read and write
C00027C000
direct allocation
page read and write
C000236000
direct allocation
page read and write
C00023A000
direct allocation
page read and write
C000138000
direct allocation
page read and write
17DE64B5000
direct allocation
page read and write
C0001DC000
direct allocation
page read and write
C000252000
direct allocation
page read and write
1BE0000
unkown
page write copy
17DE6520000
direct allocation
page read and write
FE0000
unkown
page readonly
17DE64C0000
direct allocation
page read and write
17DE6490000
direct allocation
page read and write
C00010E000
direct allocation
page read and write
C00001C000
direct allocation
page read and write
C0002E0000
direct allocation
page read and write
1BA0000
unkown
page write copy
59667FD000
stack
page read and write
C000360000
direct allocation
page read and write
C000328000
direct allocation
page read and write
1BDD000
unkown
page read and write
1C78000
unkown
page readonly
C00036D000
direct allocation
page read and write
C00032A000
direct allocation
page read and write
5965FFE000
stack
page read and write
C000052000
direct allocation
page read and write
17DE6560000
direct allocation
page read and write
C0000DE000
direct allocation
page read and write
C000274000
direct allocation
page read and write
C00008D000
direct allocation
page read and write
C000022000
direct allocation
page read and write
There are 342 hidden memdumps, click here to show them.