IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AEBKKECB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\AEBKKECBGIIJJKECGIJECGDHIE
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\AFBAFBKEGCFBGCBFIDAKEHDAFC
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\AKFIDHDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EGCFIDAFBFBAKFHJEGIJ
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\FCAAEHJDBKJJKFHJEBKF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HDAFHIDGIJKJKECBGDBGHDBKFH
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\IDBAKKECAEGCAKFIIIDHCBAKKJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IJECBGIJDGCAEBFIIECA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.100/e2b1563c6670f193.phph
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpm
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpBrowser
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpH;
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpp
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dllK
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php=Iq
unknown
 malicious
http://185.215.113.100/
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpndI
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php
185.215.113.100
 malicious
http://185.215.113.100
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php:
unknown
 malicious
http://185.215.113.100Z
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dllc
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php(
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php0
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllN
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dlll5
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php$
unknown
 malicious
http://185.215.113.100e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll
185.215.113.100
 malicious
185.215.113.100/e2b1563c6670f193.php
malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll)
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpLo
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 45 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.100
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
138E000
heap
page read and write
 malicious
1260000
heap
page read and write
1D7B0000
heap
page read and write
61ED0000
direct allocation
page read and write
668000
unkown
page execute and write copy
304F000
stack
page read and write
1D1CF000
stack
page read and write
3C4F000
stack
page read and write
1D790000
heap
page read and write
52D0000
direct allocation
page execute and read and write
13E7000
heap
page read and write
528F000
stack
page read and write
1D7B1000
heap
page read and write
3B0F000
stack
page read and write
1220000
heap
page read and write
4CC1000
heap
page read and write
324F000
stack
page read and write
1D794000
heap
page read and write
1D779000
heap
page read and write
400F000
stack
page read and write
414F000
stack
page read and write
1D794000
heap
page read and write
1D46F000
stack
page read and write
4CB0000
direct allocation
page read and write
4CC1000
heap
page read and write
4CB0000
direct allocation
page read and write
1D779000
heap
page read and write
29A8D000
heap
page read and write
1D79C000
heap
page read and write
29A37000
heap
page read and write
1BC000
unkown
page execute and read and write
6C8F0000
unkown
page read and write
33CE000
stack
page read and write
6C8EE000
unkown
page read and write
3C0000
unkown
page execute and read and write
4CB0000
direct allocation
page read and write
1D794000
heap
page read and write
1D7B0000
heap
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
1D789000
heap
page read and write
1D78D000
heap
page read and write
490E000
stack
page read and write
6C670000
unkown
page readonly
1D77A000
heap
page read and write
4CC0000
heap
page read and write
4CC1000
heap
page read and write
1D7A1000
heap
page read and write
1D77A000
heap
page read and write
1D789000
heap
page read and write
1D794000
heap
page read and write
4CC1000
heap
page read and write
1D789000
heap
page read and write
1D7A1000
heap
page read and write
6C6ED000
unkown
page readonly
4CD0000
heap
page read and write
1D794000
heap
page read and write
4CC1000
heap
page read and write
1D790000
heap
page read and write
1D7A1000
heap
page read and write
1D794000
heap
page read and write
4CC1000
heap
page read and write
1D7A1000
heap
page read and write
138A000
heap
page read and write
4CC1000
heap
page read and write
29A25000
heap
page read and write
1D798000
heap
page read and write
1D798000
heap
page read and write
1D30F000
stack
page read and write
280000
unkown
page execute and read and write
1475000
heap
page read and write
FB8000
stack
page read and write
4CC1000
heap
page read and write
4CB0000
direct allocation
page read and write
181000
unkown
page execute and read and write
4CB0000
direct allocation
page read and write
61EB4000
direct allocation
page read and write
181000
unkown
page execute and write copy
1D7B0000
heap
page read and write
327000
unkown
page execute and read and write
4CB0000
direct allocation
page read and write
1D789000
heap
page read and write
4CC1000
heap
page read and write
669000
unkown
page execute and write copy
4CC1000
heap
page read and write
29A2E000
heap
page read and write
4C90000
heap
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
16BF000
stack
page read and write
1D794000
heap
page read and write
61ED3000
direct allocation
page read and write
1D78B000
heap
page read and write
2392D000
stack
page read and write
440E000
stack
page read and write
1D794000
heap
page read and write
1D7AB000
heap
page read and write
23931000
heap
page read and write
2FBBF000
stack
page read and write
478F000
stack
page read and write
808000
unkown
page execute and write copy
61ED4000
direct allocation
page readonly
1D794000
heap
page read and write
4A0F000
stack
page read and write
2F2E000
stack
page read and write
1D778000
heap
page read and write
450F000
stack
page read and write
38CE000
stack
page read and write
1EA000
unkown
page execute and read and write
1D0CE000
stack
page read and write
630000
unkown
page execute and read and write
4CC1000
heap
page read and write
2FC61000
heap
page read and write
4CC1000
heap
page read and write
1D797000
heap
page read and write
4CC1000
heap
page read and write
1D7B0000
heap
page read and write
1D762000
heap
page read and write
146F000
heap
page read and write
3C8E000
stack
page read and write
1D7A1000
heap
page read and write
146B000
heap
page read and write
1D789000
heap
page read and write
213000
unkown
page execute and read and write
364E000
stack
page read and write
3A0E000
stack
page read and write
1D7B1000
heap
page read and write
1D7AE000
heap
page read and write
2FC59000
heap
page read and write
1D7AF000
heap
page read and write
1D7AC000
heap
page read and write
4CC1000
heap
page read and write
1D7AB000
heap
page read and write
4CC1000
heap
page read and write
1D7AF000
heap
page read and write
2382D000
stack
page read and write
4CB0000
direct allocation
page read and write
4C8F000
stack
page read and write
1D791000
heap
page read and write
52D0000
direct allocation
page execute and read and write
388F000
stack
page read and write
1D792000
heap
page read and write
1D88A000
heap
page read and write
1D798000
heap
page read and write
1D790000
heap
page read and write
6C8AF000
unkown
page readonly
307000
unkown
page execute and read and write
4CC1000
heap
page read and write
180000
unkown
page readonly
299E0000
heap
page read and write
1D794000
heap
page read and write
404E000
stack
page read and write
2FC5F000
heap
page read and write
5100000
trusted library allocation
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
1D7A1000
heap
page read and write
1D788000
heap
page read and write
52C0000
direct allocation
page execute and read and write
350E000
stack
page read and write
518C000
stack
page read and write
61E00000
direct allocation
page execute and read and write
1D794000
heap
page read and write
29A84000
heap
page read and write
4CE0000
heap
page read and write
13D2000
heap
page read and write
1D789000
heap
page read and write
4B8E000
stack
page read and write
4CC1000
heap
page read and write
1D7B0000
heap
page read and write
1D7A1000
heap
page read and write
4CB0000
direct allocation
page read and write
4CC1000
heap
page read and write
3D8F000
stack
page read and write
374F000
stack
page read and write
1D79C000
heap
page read and write
2EAE000
stack
page read and write
1D797000
heap
page read and write
1D36E000
stack
page read and write
271000
unkown
page execute and read and write
1265000
heap
page read and write
1D792000
heap
page read and write
1D798000
heap
page read and write
1D77A000
heap
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
65A000
unkown
page execute and read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
2FC51000
heap
page read and write
1D794000
heap
page read and write
4CC1000
heap
page read and write
1D798000
heap
page read and write
1D77A000
heap
page read and write
5150000
direct allocation
page read and write
4CC1000
heap
page read and write
1D78D000
heap
page read and write
1D08F000
stack
page read and write
4CC1000
heap
page read and write
1D20E000
stack
page read and write
4CC1000
heap
page read and write
1D789000
heap
page read and write
3F0E000
stack
page read and write
3B4E000
stack
page read and write
1D794000
heap
page read and write
2FBC0000
trusted library allocation
page read and write
454E000
stack
page read and write
34CF000
stack
page read and write
1D78A000
heap
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
418E000
stack
page read and write
251000
unkown
page execute and read and write
4CC1000
heap
page read and write
52DE000
stack
page read and write
4CC1000
heap
page read and write
29A40000
heap
page read and write
4CB0000
direct allocation
page read and write
1D789000
heap
page read and write
4CC1000
heap
page read and write
3ECF000
stack
page read and write
4CC1000
heap
page read and write
652000
unkown
page execute and read and write
4CC1000
heap
page read and write
1D794000
heap
page read and write
1D794000
heap
page read and write
807000
unkown
page execute and read and write
1472000
heap
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
180000
unkown
page read and write
4CB0000
direct allocation
page read and write
4CC1000
heap
page read and write
2F47000
heap
page read and write
1D786000
heap
page read and write
1D78B000
heap
page read and write
1D794000
heap
page read and write
1D794000
heap
page read and write
4CB0000
direct allocation
page read and write
1D794000
heap
page read and write
42CE000
stack
page read and write
1D794000
heap
page read and write
4CC1000
heap
page read and write
1D7A1000
heap
page read and write
1D7B0000
heap
page read and write
4CB0000
direct allocation
page read and write
1401000
heap
page read and write
21F000
unkown
page execute and read and write
1D77B000
heap
page read and write
1D794000
heap
page read and write
4CC1000
heap
page read and write
1D7B0000
heap
page read and write
1D786000
heap
page read and write
61ECD000
direct allocation
page readonly
1D789000
heap
page read and write
4CC1000
heap
page read and write
1D7A1000
heap
page read and write
4A4E000
stack
page read and write
1D7B0000
heap
page read and write
1D77A000
heap
page read and write
1D7A1000
heap
page read and write
2F4B000
heap
page read and write
4CC1000
heap
page read and write
468E000
stack
page read and write
4CC1000
heap
page read and write
13CF000
heap
page read and write
4CC1000
heap
page read and write
1D880000
trusted library allocation
page read and write
4CC1000
heap
page read and write
239D8000
heap
page read and write
1D78B000
heap
page read and write
1D5BE000
stack
page read and write
EBC000
stack
page read and write
2EEB000
stack
page read and write
328E000
stack
page read and write
1D786000
heap
page read and write
23A7C000
heap
page read and write
52E0000
direct allocation
page execute and read and write
4CC1000
heap
page read and write
1D760000
heap
page read and write
1D78D000
heap
page read and write
52A0000
direct allocation
page execute and read and write
2F4E000
heap
page read and write
3DCE000
stack
page read and write
29A43000
heap
page read and write
6C711000
unkown
page execute read
FBD000
stack
page read and write
244000
unkown
page execute and read and write
1D77A000
heap
page read and write
61EB7000
direct allocation
page readonly
1D5FD000
stack
page read and write
4B4F000
stack
page read and write
5150000
direct allocation
page read and write
29A23000
heap
page read and write
4CC1000
heap
page read and write
428F000
stack
page read and write
61E01000
direct allocation
page execute read
157F000
stack
page read and write
39CE000
stack
page read and write
43CF000
stack
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
1D798000
heap
page read and write
1D797000
heap
page read and write
4CC1000
heap
page read and write
1D78A000
heap
page read and write
1D794000
heap
page read and write
6C710000
unkown
page readonly
1D6FD000
stack
page read and write
464F000
stack
page read and write
52F0000
direct allocation
page execute and read and write
6C702000
unkown
page readonly
4CC1000
heap
page read and write
1380000
heap
page read and write
32D000
unkown
page execute and read and write
2F30000
heap
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
4CC1000
heap
page read and write
29A21000
heap
page read and write
FB4000
stack
page read and write
1D794000
heap
page read and write
1D798000
heap
page read and write
338F000
stack
page read and write
1D794000
heap
page read and write
61ECC000
direct allocation
page read and write
4CC1000
heap
page read and write
29A00000
heap
page read and write
1D791000
heap
page read and write
4CC1000
heap
page read and write
2FC59000
heap
page read and write
6C671000
unkown
page execute read
4CC1000
heap
page read and write
4CC1000
heap
page read and write
54F000
unkown
page execute and read and write
29A28000
heap
page read and write
29A3A000
heap
page read and write
1D7A1000
heap
page read and write
6C6FE000
unkown
page read and write
4CC1000
heap
page read and write
378E000
stack
page read and write
4CC1000
heap
page read and write
360F000
stack
page read and write
1D78A000
heap
page read and write
4CC1000
heap
page read and write
1D7B1000
heap
page read and write
4CC1000
heap
page read and write
1D789000
heap
page read and write
47CE000
stack
page read and write
1D78A000
heap
page read and write
48CF000
stack
page read and write
4CB0000
direct allocation
page read and write
27D000
unkown
page execute and read and write
1D775000
heap
page read and write
4CC1000
heap
page read and write
15BE000
stack
page read and write
1D76F000
heap
page read and write
1D79B000
heap
page read and write
4CB0000
direct allocation
page read and write
1D7B0000
heap
page read and write
1210000
heap
page read and write
6C8F5000
unkown
page readonly
6C8EF000
unkown
page write copy
2FABE000
stack
page read and write
314F000
stack
page read and write
1D7B0000
heap
page read and write
5150000
direct allocation
page read and write
668000
unkown
page execute and read and write
4CC1000
heap
page read and write
FB2000
stack
page read and write
1D4BE000
stack
page read and write
137E000
stack
page read and write
2F40000
heap
page read and write
There are 365 hidden memdumps, click here to show them.