IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKJKFBAFIDAEBFHJKJEBFCBFHD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\BAAFBFBAAKECFIEBFIEC
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\DGHJECAF
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\ECGDAAFIIJDAAAAKFHID
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FCAAEHJDBKJJKFHJEBKFBGDAAE
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\FCGCGDHJEGHJKFHJJJKJJJJKEH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IDBAKKEC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JJJEBGDAFHJEBGDGIJDH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.100/e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpbnhcc
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpWi
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dllllb
unknown
 malicious
http://185.215.113.1005
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpcal
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpinR
unknown
 malicious
http://185.215.113.100/
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpPR
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpa
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php
185.215.113.100
 malicious
http://185.215.113.100
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpRUNTIME140.dllDH
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php:
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpE
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpal
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php)
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpettings
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpER
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpVB
unknown
 malicious
http://185.215.113.100/o
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllJJKFHJEBKFBGDAAE
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll
185.215.113.100
 malicious
http://185.215.113.100e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpNT
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpFBFBAAKECFIEBFIEC
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phppmfplkfogfpmcngplhnbdnnie
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpc=#
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php=C
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 54 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.100
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
11DE000
heap
page read and write
 malicious
1224000
heap
page read and write
4981000
heap
page read and write
1D456000
heap
page read and write
2C30000
heap
page read and write
4F80000
direct allocation
page execute and read and write
4981000
heap
page read and write
6C820000
unkown
page read and write
4E10000
direct allocation
page read and write
1D448000
heap
page read and write
EF8000
stack
page read and write
4981000
heap
page read and write
1D450000
heap
page read and write
1D442000
heap
page read and write
1D450000
heap
page read and write
603000
unkown
page execute and read and write
B7C000
stack
page read and write
3A5F000
stack
page read and write
4981000
heap
page read and write
1D27E000
stack
page read and write
1D44D000
heap
page read and write
12B1000
heap
page read and write
1D447000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
1CD4F000
stack
page read and write
1D45C000
heap
page read and write
1238000
heap
page read and write
4981000
heap
page read and write
2C40000
direct allocation
page read and write
319F000
stack
page read and write
4981000
heap
page read and write
61ECD000
direct allocation
page readonly
1D44C000
heap
page read and write
4981000
heap
page read and write
BD0000
heap
page read and write
4981000
heap
page read and write
2C40000
direct allocation
page read and write
409F000
stack
page read and write
1D45B000
heap
page read and write
1D450000
heap
page read and write
1D46A000
heap
page read and write
3CDF000
stack
page read and write
1D44C000
heap
page read and write
4981000
heap
page read and write
2C5E000
heap
page read and write
2C7000
unkown
page execute and read and write
4FB0000
direct allocation
page execute and read and write
1D540000
trusted library allocation
page read and write
4981000
heap
page read and write
391F000
stack
page read and write
4981000
heap
page read and write
1D445000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D422000
heap
page read and write
211000
unkown
page execute and read and write
431F000
stack
page read and write
2957E000
stack
page read and write
4981000
heap
page read and write
2967F000
stack
page read and write
1BF000
unkown
page execute and read and write
31DE000
stack
page read and write
1D540000
heap
page read and write
1D469000
heap
page read and write
1E4000
unkown
page execute and read and write
4981000
heap
page read and write
4981000
heap
page read and write
1D445000
heap
page read and write
1D3BC000
stack
page read and write
1D462000
heap
page read and write
4981000
heap
page read and write
1040000
heap
page read and write
234A3000
heap
page read and write
1D45D000
heap
page read and write
6C81F000
unkown
page write copy
1256000
heap
page read and write
485E000
stack
page read and write
1D436000
heap
page read and write
2C40000
direct allocation
page read and write
1D44B000
heap
page read and write
6C641000
unkown
page execute read
4990000
heap
page read and write
1D46C000
heap
page read and write
4981000
heap
page read and write
1D450000
heap
page read and write
BE0000
heap
page read and write
481F000
stack
page read and write
3F9E000
stack
page read and write
11D0000
heap
page read and write
1D436000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
1D447000
heap
page read and write
1D447000
heap
page read and write
1D45C000
heap
page read and write
1CD8E000
stack
page read and write
5F6000
unkown
page execute and read and write
603000
unkown
page execute and write copy
341F000
stack
page read and write
1D450000
heap
page read and write
2C2E000
stack
page read and write
6C7DF000
unkown
page readonly
1CE8F000
stack
page read and write
1D469000
heap
page read and write
61ED0000
direct allocation
page read and write
355F000
stack
page read and write
2C40000
direct allocation
page read and write
4981000
heap
page read and write
1D12F000
stack
page read and write
2972F000
heap
page read and write
18A000
unkown
page execute and read and write
11CE000
stack
page read and write
2CD000
unkown
page execute and read and write
1D450000
heap
page read and write
2971A000
heap
page read and write
4981000
heap
page read and write
2C5B000
heap
page read and write
1D469000
heap
page read and write
45DE000
stack
page read and write
6C61D000
unkown
page readonly
12B4000
heap
page read and write
2C40000
direct allocation
page read and write
1D465000
heap
page read and write
4F9E000
stack
page read and write
1D445000
heap
page read and write
4981000
heap
page read and write
1D469000
heap
page read and write
2C40000
direct allocation
page read and write
4981000
heap
page read and write
40DE000
stack
page read and write
2C40000
direct allocation
page read and write
435E000
stack
page read and write
7A2000
unkown
page execute and write copy
4981000
heap
page read and write
4981000
heap
page read and write
345E000
stack
page read and write
1D450000
heap
page read and write
1D450000
heap
page read and write
2948C000
heap
page read and write
1D42B000
heap
page read and write
1D450000
heap
page read and write
4981000
heap
page read and write
4960000
heap
page read and write
2F5F000
stack
page read and write
2BAC000
stack
page read and write
29450000
heap
page read and write
1D45B000
heap
page read and write
46DF000
stack
page read and write
2C40000
direct allocation
page read and write
61ED4000
direct allocation
page readonly
1D45C000
heap
page read and write
1D46C000
heap
page read and write
331E000
stack
page read and write
32DF000
stack
page read and write
37DF000
stack
page read and write
29471000
heap
page read and write
4981000
heap
page read and write
1D450000
heap
page read and write
101E000
stack
page read and write
220000
unkown
page execute and read and write
1D17D000
stack
page read and write
61ECC000
direct allocation
page read and write
6C81E000
unkown
page read and write
2C57000
heap
page read and write
1D420000
heap
page read and write
1D450000
heap
page read and write
4981000
heap
page read and write
1D436000
heap
page read and write
36DE000
stack
page read and write
1D450000
heap
page read and write
7A1000
unkown
page execute and read and write
5ED000
unkown
page execute and read and write
4981000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
604000
unkown
page execute and write copy
1D457000
heap
page read and write
381E000
stack
page read and write
1D450000
heap
page read and write
1D445000
heap
page read and write
4981000
heap
page read and write
1D45D000
heap
page read and write
1D44C000
heap
page read and write
449E000
stack
page read and write
6C5A0000
unkown
page readonly
4981000
heap
page read and write
1D436000
heap
page read and write
13CE000
stack
page read and write
4981000
heap
page read and write
61EB7000
direct allocation
page readonly
1045000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
29680000
trusted library allocation
page read and write
4981000
heap
page read and write
41DF000
stack
page read and write
1D45C000
heap
page read and write
360000
unkown
page execute and read and write
2C40000
direct allocation
page read and write
294D2000
heap
page read and write
1D445000
heap
page read and write
2D5F000
stack
page read and write
4981000
heap
page read and write
12AC000
heap
page read and write
4981000
heap
page read and write
49A0000
heap
page read and write
2C40000
direct allocation
page read and write
4981000
heap
page read and write
120000
unkown
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
2E5F000
stack
page read and write
29430000
heap
page read and write
1D447000
heap
page read and write
369F000
stack
page read and write
1F1000
unkown
page execute and read and write
2A7000
unkown
page execute and read and write
4DC0000
trusted library allocation
page read and write
1D435000
heap
page read and write
61ED3000
direct allocation
page read and write
3E1F000
stack
page read and write
1D2BD000
stack
page read and write
1CFCE000
stack
page read and write
5CA000
unkown
page execute and read and write
6C5A1000
unkown
page execute read
4981000
heap
page read and write
61E01000
direct allocation
page execute read
4981000
heap
page read and write
421E000
stack
page read and write
2C40000
direct allocation
page read and write
21D000
unkown
page execute and read and write
4981000
heap
page read and write
305F000
stack
page read and write
1D450000
heap
page read and write
4F90000
direct allocation
page execute and read and write
1D450000
heap
page read and write
4981000
heap
page read and write
2BEE000
stack
page read and write
3F5F000
stack
page read and write
1D453000
heap
page read and write
1D453000
heap
page read and write
1CECE000
stack
page read and write
121000
unkown
page execute and write copy
4981000
heap
page read and write
471E000
stack
page read and write
4F90000
direct allocation
page execute and read and write
1D465000
heap
page read and write
3D1E000
stack
page read and write
29720000
heap
page read and write
1D45B000
heap
page read and write
4E4C000
stack
page read and write
1D02E000
stack
page read and write
4980000
heap
page read and write
1D453000
heap
page read and write
1D450000
heap
page read and write
1D442000
heap
page read and write
1D469000
heap
page read and write
1D469000
heap
page read and write
1D46C000
heap
page read and write
1D447000
heap
page read and write
4F60000
direct allocation
page execute and read and write
6C62E000
unkown
page read and write
1D45D000
heap
page read and write
4981000
heap
page read and write
1D469000
heap
page read and write
1D44D000
heap
page read and write
1D445000
heap
page read and write
2947F000
heap
page read and write
459F000
stack
page read and write
4FA0000
direct allocation
page execute and read and write
4981000
heap
page read and write
1D438000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
3BDE000
stack
page read and write
4E10000
direct allocation
page read and write
29410000
heap
page read and write
29712000
heap
page read and write
1D44D000
heap
page read and write
6C825000
unkown
page readonly
4981000
heap
page read and write
4E10000
direct allocation
page read and write
4981000
heap
page read and write
1D450000
heap
page read and write
4981000
heap
page read and write
1D44C000
heap
page read and write
EF3000
stack
page read and write
4EE000
unkown
page execute and read and write
4981000
heap
page read and write
1D46C000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
2C50000
heap
page read and write
4981000
heap
page read and write
1D469000
heap
page read and write
120000
unkown
page readonly
445F000
stack
page read and write
4981000
heap
page read and write
1D436000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
3A9E000
stack
page read and write
309E000
stack
page read and write
4981000
heap
page read and write
1D46C000
heap
page read and write
4981000
heap
page read and write
15C000
unkown
page execute and read and write
4981000
heap
page read and write
4981000
heap
page read and write
1D469000
heap
page read and write
395E000
stack
page read and write
29727000
heap
page read and write
61EB4000
direct allocation
page read and write
2C40000
direct allocation
page read and write
121000
unkown
page execute and read and write
1D444000
heap
page read and write
118E000
stack
page read and write
29485000
heap
page read and write
114E000
stack
page read and write
6C632000
unkown
page readonly
6C640000
unkown
page readonly
4F4F000
stack
page read and write
359E000
stack
page read and write
1D44D000
heap
page read and write
2C40000
direct allocation
page read and write
29478000
heap
page read and write
EFD000
stack
page read and write
4981000
heap
page read and write
1D45E000
heap
page read and write
2C40000
direct allocation
page read and write
4981000
heap
page read and write
3E5E000
stack
page read and write
495F000
stack
page read and write
1B3000
unkown
page execute and read and write
1D445000
heap
page read and write
3B9F000
stack
page read and write
1D445000
heap
page read and write
1D442000
heap
page read and write
4981000
heap
page read and write
1D450000
heap
page read and write
4981000
heap
page read and write
29473000
heap
page read and write
11D8000
heap
page read and write
There are 333 hidden memdumps, click here to show them.