IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BAKFBKEHDBGHJJKFIEGDBKKFID
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FBKKFBAEGDHJJJJKFBKF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FHIDBKFCAAEBFIDHDBAE
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\GHJDGDBFCBKFHJKFHCBK
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HCAEHJJKFCAAFHJKFBKKEBKECB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJJKEHCA
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KECBKKEBKEBFCAAAEGDHDGIIJE
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\KJECFHCB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.100/e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.php2b
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dlle
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpd_
unknown
 malicious
http://185.215.113.100/
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phprowser
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpe
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dll?
unknown
 malicious
http://185.215.113.100
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpYb$X
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllep
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dllO
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php4_
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpDBKFCAAEBFIDHDBAENy
unknown
 malicious
http://185.215.113.100e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll5s
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phptware
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dllw
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll2
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpH_
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 42 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.100
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
12BE000
heap
page read and write
 malicious
B90000
unkown
page execute and read and write
445E000
stack
page read and write
4CE1000
heap
page read and write
12A0000
heap
page read and write
8B1000
unkown
page execute and read and write
2F20000
heap
page read and write
884000
unkown
page execute and read and write
1D7B0000
heap
page read and write
1D22D000
stack
page read and write
1D7AC000
heap
page read and write
1D0AF000
stack
page read and write
2F50000
heap
page read and write
4CE1000
heap
page read and write
4CF0000
heap
page read and write
2EDE000
stack
page read and write
6C855000
unkown
page readonly
1D7B3000
heap
page read and write
29BD9000
heap
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
4A9E000
stack
page read and write
1D7C8000
heap
page read and write
4CE1000
heap
page read and write
FD2000
stack
page read and write
1D7C8000
heap
page read and write
4CE1000
heap
page read and write
2F40000
direct allocation
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
6C850000
unkown
page read and write
CA4000
unkown
page execute and write copy
4CE1000
heap
page read and write
1D7B0000
heap
page read and write
1372000
heap
page read and write
1D7BC000
heap
page read and write
1D7A2000
heap
page read and write
138A000
heap
page read and write
4CE1000
heap
page read and write
7C0000
unkown
page read and write
4CE1000
heap
page read and write
29B30000
trusted library allocation
page read and write
46DE000
stack
page read and write
2F40000
direct allocation
page read and write
1D8A0000
trusted library allocation
page read and write
1D7BD000
heap
page read and write
4CE1000
heap
page read and write
1D7C8000
heap
page read and write
1D7A5000
heap
page read and write
1D7B0000
heap
page read and write
1D798000
heap
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
1D7AD000
heap
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
1D795000
heap
page read and write
5170000
direct allocation
page read and write
82A000
unkown
page execute and read and write
138F000
heap
page read and write
61EB4000
direct allocation
page read and write
7C0000
unkown
page readonly
4CE1000
heap
page read and write
1D782000
heap
page read and write
947000
unkown
page execute and read and write
1D7A5000
heap
page read and write
2F57000
heap
page read and write
6C5D0000
unkown
page readonly
29BCF000
heap
page read and write
4CE1000
heap
page read and write
1D7AB000
heap
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
5170000
direct allocation
page read and write
1D71C000
stack
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
1D7CC000
heap
page read and write
3E1E000
stack
page read and write
853000
unkown
page execute and read and write
1D7AC000
heap
page read and write
1D7B3000
heap
page read and write
4CE1000
heap
page read and write
1D7B0000
heap
page read and write
1215000
heap
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
2F40000
direct allocation
page read and write
1D7B0000
heap
page read and write
1D7C9000
heap
page read and write
1318000
heap
page read and write
6C5D1000
unkown
page execute read
431E000
stack
page read and write
1382000
heap
page read and write
351F000
stack
page read and write
459E000
stack
page read and write
1D796000
heap
page read and write
1D7A6000
heap
page read and write
2F40000
direct allocation
page read and write
12B8000
heap
page read and write
1D7A5000
heap
page read and write
4CE1000
heap
page read and write
CA3000
unkown
page execute and read and write
29780000
heap
page read and write
14BD000
stack
page read and write
1D7CC000
heap
page read and write
4BDE000
stack
page read and write
61ECD000
direct allocation
page readonly
136C000
heap
page read and write
4A5F000
stack
page read and write
1D7B0000
heap
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
1D7AC000
heap
page read and write
96D000
unkown
page execute and read and write
305F000
stack
page read and write
1D7CC000
heap
page read and write
3B5F000
stack
page read and write
1D7BE000
heap
page read and write
4CE1000
heap
page read and write
6C84E000
unkown
page read and write
1D7C4000
heap
page read and write
391E000
stack
page read and write
1D7CC000
heap
page read and write
1D796000
heap
page read and write
5170000
direct allocation
page read and write
41DE000
stack
page read and write
52C0000
direct allocation
page execute and read and write
29853000
heap
page read and write
1378000
heap
page read and write
1D4DE000
stack
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
379F000
stack
page read and write
8BD000
unkown
page execute and read and write
61ED3000
direct allocation
page read and write
1D32E000
stack
page read and write
5120000
trusted library allocation
page read and write
2F40000
direct allocation
page read and write
315F000
stack
page read and write
61E00000
direct allocation
page execute and read and write
EDC000
stack
page read and write
329F000
stack
page read and write
4CE1000
heap
page read and write
1D7B0000
heap
page read and write
FD8000
stack
page read and write
4CE1000
heap
page read and write
1D7B0000
heap
page read and write
6C84F000
unkown
page write copy
405F000
stack
page read and write
4CE1000
heap
page read and write
1D7C9000
heap
page read and write
419F000
stack
page read and write
365F000
stack
page read and write
1D7B0000
heap
page read and write
4D00000
heap
page read and write
1D7A5000
heap
page read and write
1D7A5000
heap
page read and write
52AF000
stack
page read and write
4CE1000
heap
page read and write
51AB000
stack
page read and write
4B9F000
stack
page read and write
297E1000
heap
page read and write
891000
unkown
page execute and read and write
29B2F000
stack
page read and write
1D7BD000
heap
page read and write
2F40000
direct allocation
page read and write
1D7AD000
heap
page read and write
2F5B000
heap
page read and write
1D1EF000
stack
page read and write
455F000
stack
page read and write
2F40000
direct allocation
page read and write
4CE7000
heap
page read and write
52E0000
direct allocation
page execute and read and write
6C662000
unkown
page readonly
341E000
stack
page read and write
1D7CC000
heap
page read and write
61E01000
direct allocation
page execute read
4CE1000
heap
page read and write
29A2E000
stack
page read and write
6C671000
unkown
page execute read
15BE000
stack
page read and write
1D796000
heap
page read and write
4CE1000
heap
page read and write
1304000
heap
page read and write
2F40000
direct allocation
page read and write
1D7BC000
heap
page read and write
4CE1000
heap
page read and write
12B0000
heap
page read and write
1D61E000
stack
page read and write
1D7C5000
heap
page read and write
8C0000
unkown
page execute and read and write
4CE1000
heap
page read and write
3CDE000
stack
page read and write
E42000
unkown
page execute and write copy
4CE1000
heap
page read and write
1302000
heap
page read and write
47DF000
stack
page read and write
61ECC000
direct allocation
page read and write
1D7AD000
heap
page read and write
4CE1000
heap
page read and write
1D780000
heap
page read and write
61EB7000
direct allocation
page readonly
369E000
stack
page read and write
3F5E000
stack
page read and write
1D7B0000
heap
page read and write
409E000
stack
page read and write
297A0000
heap
page read and write
1D7B0000
heap
page read and write
1D7C9000
heap
page read and write
4CE1000
heap
page read and write
1D7C4000
heap
page read and write
23815000
heap
page read and write
1D7BD000
heap
page read and write
4CE1000
heap
page read and write
1D7A5000
heap
page read and write
1250000
heap
page read and write
4CE1000
heap
page read and write
16FE000
stack
page read and write
5300000
direct allocation
page execute and read and write
1D38E000
stack
page read and write
1D7C4000
heap
page read and write
33DF000
stack
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
1D7B6000
heap
page read and write
1D7A4000
heap
page read and write
4CE1000
heap
page read and write
1240000
heap
page read and write
52F0000
direct allocation
page execute and read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
7C1000
unkown
page execute and read and write
1D7C9000
heap
page read and write
2F1B000
stack
page read and write
37DE000
stack
page read and write
4CE1000
heap
page read and write
1D7B0000
heap
page read and write
52F0000
direct allocation
page execute and read and write
1D7BC000
heap
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
3F1F000
stack
page read and write
4CE1000
heap
page read and write
4D0C000
heap
page read and write
FDD000
stack
page read and write
1D78B000
heap
page read and write
298DE000
stack
page read and write
29BD3000
heap
page read and write
319E000
stack
page read and write
A00000
unkown
page execute and read and write
6C64D000
unkown
page readonly
1D796000
heap
page read and write
4CE1000
heap
page read and write
491F000
stack
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
CA3000
unkown
page execute and write copy
1D7A7000
heap
page read and write
15FD000
stack
page read and write
85F000
unkown
page execute and read and write
4D10000
heap
page read and write
1D7C2000
heap
page read and write
355E000
stack
page read and write
29BD7000
heap
page read and write
137D000
heap
page read and write
1D7AE000
heap
page read and write
441E000
stack
page read and write
1D7A8000
heap
page read and write
3C9F000
stack
page read and write
6C670000
unkown
page readonly
C8C000
unkown
page execute and read and write
4CE1000
heap
page read and write
1D8A5000
heap
page read and write
3DDF000
stack
page read and write
4CE1000
heap
page read and write
2F40000
direct allocation
page read and write
61ED0000
direct allocation
page read and write
1D7BC000
heap
page read and write
1D7A2000
heap
page read and write
52FE000
stack
page read and write
2F5E000
heap
page read and write
4CDF000
stack
page read and write
1D7A5000
heap
page read and write
1D796000
heap
page read and write
1210000
heap
page read and write
38DF000
stack
page read and write
4CE1000
heap
page read and write
2F40000
direct allocation
page read and write
297C0000
heap
page read and write
3B9E000
stack
page read and write
6C65E000
unkown
page read and write
2F40000
direct allocation
page read and write
2F40000
direct allocation
page read and write
61ED4000
direct allocation
page readonly
E41000
unkown
page execute and read and write
1D7A5000
heap
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
1D7C8000
heap
page read and write
4CE1000
heap
page read and write
3A5E000
stack
page read and write
3A1F000
stack
page read and write
2F40000
direct allocation
page read and write
C95000
unkown
page execute and read and write
42DF000
stack
page read and write
4CE1000
heap
page read and write
32DE000
stack
page read and write
7C1000
unkown
page execute and write copy
1D0EE000
stack
page read and write
1D7C5000
heap
page read and write
481E000
stack
page read and write
5310000
direct allocation
page execute and read and write
967000
unkown
page execute and read and write
1D7A2000
heap
page read and write
1D48F000
stack
page read and write
4CE1000
heap
page read and write
4CE1000
heap
page read and write
495E000
stack
page read and write
2F40000
direct allocation
page read and write
1D5DD000
stack
page read and write
1D7B0000
heap
page read and write
1D7AB000
heap
page read and write
1D7C4000
heap
page read and write
1333000
heap
page read and write
4CE1000
heap
page read and write
1D7B7000
heap
page read and write
4CE1000
heap
page read and write
C61000
unkown
page execute and read and write
4CE1000
heap
page read and write
6C80F000
unkown
page readonly
4CE0000
heap
page read and write
1D7B0000
heap
page read and write
1D7B0000
heap
page read and write
1D7C8000
heap
page read and write
1D7AC000
heap
page read and write
1D7C9000
heap
page read and write
2985B000
heap
page read and write
29BCB000
heap
page read and write
469F000
stack
page read and write
1D7A7000
heap
page read and write
299DE000
stack
page read and write
7FC000
unkown
page execute and read and write
There are 335 hidden memdumps, click here to show them.