IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAFBAKECAEGCBFIEGDGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\AEHIJDAF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\AFHDAKJKFCFBGCBGDHCB
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\BFCGDAAKFHIDBFIDBKFHJDHCAF
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\CFHIIEHJKKECGCBFIIJDAKFHJK
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DBKKFCBAKKFBGCBFHJDGDGDHCA
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EBGDHJECFCFCAKFHCFID
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HJECAAKK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IJDGCAEBFIIECAKFHIJEGIJEGC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dllh
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpn
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpS_
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpBrowser
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpGO4
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php3P
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phppl
unknown
 malicious
http://185.215.113.100/
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dll4
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpe
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpH
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpive
unknown
 malicious
http://185.215.113.100
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dllP
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpP
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php8
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllz
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.php33
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllj
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php=I
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.php1
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllZ
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php$
unknown
 malicious
http://185.215.113.100e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100$
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllJ
unknown
 malicious
185.215.113.100/e2b1563c6670f193.php
malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll~
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php=C
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 51 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.100
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
11EE000
heap
page read and write
 malicious
6C710000
unkown
page readonly
3BAF000
stack
page read and write
1D554000
heap
page read and write
29695000
heap
page read and write
1CFCE000
stack
page read and write
1D554000
heap
page read and write
AFD000
unkown
page execute and read and write
356F000
stack
page read and write
482F000
stack
page read and write
4971000
heap
page read and write
1D53A000
heap
page read and write
4971000
heap
page read and write
1D54A000
heap
page read and write
4971000
heap
page read and write
61ED4000
direct allocation
page readonly
1D549000
heap
page read and write
1D560000
heap
page read and write
32EF000
stack
page read and write
1CECE000
stack
page read and write
2DEF000
stack
page read and write
1D560000
heap
page read and write
4971000
heap
page read and write
2C7F000
stack
page read and write
E3E000
unkown
page execute and write copy
1D570000
heap
page read and write
31AF000
stack
page read and write
1D550000
heap
page read and write
1D570000
heap
page read and write
1D554000
heap
page read and write
1D554000
heap
page read and write
6C8F5000
unkown
page readonly
1263000
heap
page read and write
1D557000
heap
page read and write
1D561000
heap
page read and write
36EE000
stack
page read and write
1D570000
heap
page read and write
1D28D000
stack
page read and write
2E2E000
stack
page read and write
4971000
heap
page read and write
1D554000
heap
page read and write
11AE000
stack
page read and write
61E01000
direct allocation
page execute read
61ED0000
direct allocation
page read and write
44AE000
stack
page read and write
1D558000
heap
page read and write
296AA000
heap
page read and write
12C8000
heap
page read and write
9BA000
unkown
page execute and read and write
1D561000
heap
page read and write
4971000
heap
page read and write
1D56F000
heap
page read and write
4F50000
direct allocation
page execute and read and write
840000
heap
page read and write
3FAE000
stack
page read and write
296F4000
heap
page read and write
1D52F000
heap
page read and write
E2D000
unkown
page execute and read and write
2CA0000
heap
page read and write
1CC4E000
stack
page read and write
1D549000
heap
page read and write
1D56E000
heap
page read and write
29693000
heap
page read and write
1D561000
heap
page read and write
1D10F000
stack
page read and write
12B2000
heap
page read and write
1230000
heap
page read and write
2F830000
trusted library allocation
page read and write
6C702000
unkown
page readonly
45EE000
stack
page read and write
9EF000
unkown
page execute and read and write
3D2E000
stack
page read and write
1D535000
heap
page read and write
1D56B000
heap
page read and write
1D554000
heap
page read and write
4971000
heap
page read and write
1D561000
heap
page read and write
2C80000
direct allocation
page read and write
4971000
heap
page read and write
1D554000
heap
page read and write
A4D000
unkown
page execute and read and write
4F70000
direct allocation
page execute and read and write
3E2F000
stack
page read and write
4F2F000
stack
page read and write
1D554000
heap
page read and write
4971000
heap
page read and write
6C6FE000
unkown
page read and write
3AAE000
stack
page read and write
296FD000
heap
page read and write
1D570000
heap
page read and write
436E000
stack
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
1D548000
heap
page read and write
1D551000
heap
page read and write
A50000
unkown
page execute and read and write
1D570000
heap
page read and write
4971000
heap
page read and write
382E000
stack
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
AD7000
unkown
page execute and read and write
1D539000
heap
page read and write
332E000
stack
page read and write
496F000
stack
page read and write
4971000
heap
page read and write
6C6ED000
unkown
page readonly
1D558000
heap
page read and write
4971000
heap
page read and write
1D554000
heap
page read and write
472E000
stack
page read and write
3BEE000
stack
page read and write
4971000
heap
page read and write
2F8D5000
heap
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
45AF000
stack
page read and write
1D570000
heap
page read and write
1D539000
heap
page read and write
2F8CE000
heap
page read and write
1CE8F000
stack
page read and write
236F0000
heap
page read and write
1D554000
heap
page read and write
40EE000
stack
page read and write
1D53A000
heap
page read and write
61EB4000
direct allocation
page read and write
4971000
heap
page read and write
E3D000
unkown
page execute and read and write
1D41E000
stack
page read and write
4971000
heap
page read and write
599000
stack
page read and write
1D55C000
heap
page read and write
1D53A000
heap
page read and write
1D560000
heap
page read and write
1D54B000
heap
page read and write
1D554000
heap
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
1D14D000
stack
page read and write
2F82F000
stack
page read and write
593000
stack
page read and write
1D546000
heap
page read and write
4DB0000
trusted library allocation
page read and write
E26000
unkown
page execute and read and write
1D561000
heap
page read and write
4971000
heap
page read and write
1D554000
heap
page read and write
29698000
heap
page read and write
4971000
heap
page read and write
1D54A000
heap
page read and write
1D24D000
stack
page read and write
1D570000
heap
page read and write
1D640000
trusted library allocation
page read and write
1D56C000
heap
page read and write
41EE000
stack
page read and write
1D56B000
heap
page read and write
1D551000
heap
page read and write
FE0000
unkown
page execute and write copy
4971000
heap
page read and write
422E000
stack
page read and write
296B0000
heap
page read and write
1D561000
heap
page read and write
4971000
heap
page read and write
6C8EF000
unkown
page write copy
1D546000
heap
page read and write
392F000
stack
page read and write
940000
direct allocation
page read and write
3CEF000
stack
page read and write
1D549000
heap
page read and write
1D526000
heap
page read and write
1D558000
heap
page read and write
1D522000
heap
page read and write
1D570000
heap
page read and write
940000
direct allocation
page read and write
1D554000
heap
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
112E000
stack
page read and write
930000
heap
page read and write
4E2B000
stack
page read and write
2CAB000
heap
page read and write
4971000
heap
page read and write
61ECC000
direct allocation
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
1D64D000
heap
page read and write
A21000
unkown
page execute and read and write
4971000
heap
page read and write
11E0000
heap
page read and write
800000
heap
page read and write
29650000
heap
page read and write
940000
direct allocation
page read and write
2969E000
heap
page read and write
950000
unkown
page readonly
1D561000
heap
page read and write
29691000
heap
page read and write
940000
direct allocation
page read and write
23650000
heap
page read and write
4971000
heap
page read and write
6C8EE000
unkown
page read and write
342F000
stack
page read and write
1D56F000
heap
page read and write
1D53A000
heap
page read and write
1D38D000
stack
page read and write
1D54D000
heap
page read and write
1D560000
heap
page read and write
1D554000
heap
page read and write
6C8AF000
unkown
page readonly
1D554000
heap
page read and write
37EF000
stack
page read and write
1D554000
heap
page read and write
59D000
stack
page read and write
1D571000
heap
page read and write
4F50000
direct allocation
page execute and read and write
2CAE000
heap
page read and write
1D554000
heap
page read and write
6C671000
unkown
page execute read
40AF000
stack
page read and write
4971000
heap
page read and write
1D560000
heap
page read and write
30AE000
stack
page read and write
951000
unkown
page execute and read and write
2C90000
direct allocation
page execute and read and write
36AF000
stack
page read and write
940000
direct allocation
page read and write
306F000
stack
page read and write
4971000
heap
page read and write
1D54B000
heap
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
31EE000
stack
page read and write
1D54D000
heap
page read and write
1D55C000
heap
page read and write
4971000
heap
page read and write
950000
unkown
page read and write
4971000
heap
page read and write
1D55B000
heap
page read and write
D1B000
unkown
page execute and read and write
4971000
heap
page read and write
940000
direct allocation
page read and write
11EA000
heap
page read and write
1D54A000
heap
page read and write
46EF000
stack
page read and write
1D560000
heap
page read and write
12D3000
heap
page read and write
4971000
heap
page read and write
49C000
stack
page read and write
5F0000
heap
page read and write
1D560000
heap
page read and write
1D549000
heap
page read and write
116E000
stack
page read and write
1D549000
heap
page read and write
4971000
heap
page read and write
E3D000
unkown
page execute and write copy
940000
direct allocation
page read and write
1D558000
heap
page read and write
1D549000
heap
page read and write
1D546000
heap
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
1D561000
heap
page read and write
B90000
unkown
page execute and read and write
940000
direct allocation
page read and write
4F40000
direct allocation
page execute and read and write
1D538000
heap
page read and write
61ED3000
direct allocation
page read and write
3A6F000
stack
page read and write
940000
direct allocation
page read and write
13DE000
stack
page read and write
1D00E000
stack
page read and write
4971000
heap
page read and write
1D549000
heap
page read and write
1247000
heap
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
1D520000
heap
page read and write
1D554000
heap
page read and write
951000
unkown
page execute and write copy
1D561000
heap
page read and write
2CEC000
stack
page read and write
E04000
unkown
page execute and read and write
98C000
unkown
page execute and read and write
1D554000
heap
page read and write
29670000
heap
page read and write
346E000
stack
page read and write
61E00000
direct allocation
page execute and read and write
1D549000
heap
page read and write
1D554000
heap
page read and write
3F6F000
stack
page read and write
1D550000
heap
page read and write
1CD8E000
stack
page read and write
4971000
heap
page read and write
396E000
stack
page read and write
432F000
stack
page read and write
1D549000
heap
page read and write
4971000
heap
page read and write
1D54B000
heap
page read and write
1D54A000
heap
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
2F8D6000
heap
page read and write
4F60000
direct allocation
page execute and read and write
1D561000
heap
page read and write
1D557000
heap
page read and write
4971000
heap
page read and write
4980000
heap
page read and write
1D549000
heap
page read and write
2F8DD000
heap
page read and write
1D571000
heap
page read and write
4971000
heap
page read and write
1D54D000
heap
page read and write
940000
direct allocation
page read and write
4971000
heap
page read and write
A14000
unkown
page execute and read and write
1D561000
heap
page read and write
1D552000
heap
page read and write
4971000
heap
page read and write
4971000
heap
page read and write
4970000
heap
page read and write
4971000
heap
page read and write
2F2F000
stack
page read and write
2F6E000
stack
page read and write
A41000
unkown
page execute and read and write
4971000
heap
page read and write
1D557000
heap
page read and write
2F8DC000
heap
page read and write
3E6E000
stack
page read and write
2CA7000
heap
page read and write
940000
direct allocation
page read and write
845000
heap
page read and write
6C670000
unkown
page readonly
4971000
heap
page read and write
1D554000
heap
page read and write
4971000
heap
page read and write
296A7000
heap
page read and write
4971000
heap
page read and write
12CD000
heap
page read and write
446F000
stack
page read and write
35AE000
stack
page read and write
1D558000
heap
page read and write
940000
direct allocation
page read and write
4DF0000
direct allocation
page read and write
FDF000
unkown
page execute and read and write
1D554000
heap
page read and write
1CD4F000
stack
page read and write
1D571000
heap
page read and write
1D53A000
heap
page read and write
1232000
heap
page read and write
4971000
heap
page read and write
1D550000
heap
page read and write
486E000
stack
page read and write
102E000
stack
page read and write
4971000
heap
page read and write
1D558000
heap
page read and write
1D51E000
stack
page read and write
1D554000
heap
page read and write
4971000
heap
page read and write
1D552000
heap
page read and write
2F72E000
stack
page read and write
61ECD000
direct allocation
page readonly
4971000
heap
page read and write
1D53A000
heap
page read and write
11B0000
heap
page read and write
2C80000
direct allocation
page read and write
4971000
heap
page read and write
61EB7000
direct allocation
page readonly
4971000
heap
page read and write
4971000
heap
page read and write
1D570000
heap
page read and write
940000
direct allocation
page read and write
1D570000
heap
page read and write
1D558000
heap
page read and write
6C711000
unkown
page execute read
940000
direct allocation
page read and write
6C8F0000
unkown
page read and write
235BC000
heap
page read and write
9E3000
unkown
page execute and read and write
1D53B000
heap
page read and write
AF7000
unkown
page execute and read and write
There are 370 hidden memdumps, click here to show them.