IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BAAFCAFCBKFHJJJKKFHIDAAKFB
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\BFIIIDAFBFBKECBGDBGIIIJJDA
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\CFCBKKKJJJKKEBGDAFID
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\CFIJEBFC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\FHDHCAAKECFIDHIEBAKF
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\HJJJJKEH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IEBAAFCAFCBKFHJJJKKFHIDAAK
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JJJKEHCAKFBFHJKEHCFIIDAEGD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JKEBFBFIEHIDAAAAFHCF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.100/e2b1563c6670f193.phpn
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpBrowser
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dllP
unknown
 malicious
http://185.215.113.100/
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dllR
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpN
unknown
 malicious
http://185.215.113.100
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpwh
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpS
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll.113.100
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll2
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dlles
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpFirefox
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dll
185.215.113.100
 malicious
http://185.215.113.100S
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllart
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllc
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php5
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll
185.215.113.100
 malicious
http://185.215.113.100e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dllj
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllocas
unknown
 malicious
185.215.113.100/e2b1563c6670f193.php
malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllta
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpz
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpy
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 47 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.100
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
72E000
heap
page read and write
 malicious
6C8CF000
unkown
page write copy
A90000
heap
page read and write
710000
direct allocation
page read and write
1CD0F000
stack
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
720000
heap
page read and write
1D2B0000
heap
page read and write
407F000
stack
page read and write
1D289000
heap
page read and write
4CA0000
direct allocation
page execute and read and write
2F440000
trusted library allocation
page read and write
46C4000
heap
page read and write
46C1000
heap
page read and write
B4C000
unkown
page execute and read and write
1D291000
heap
page read and write
293C0000
heap
page read and write
FF8000
unkown
page execute and write copy
1D28B000
heap
page read and write
1D298000
heap
page read and write
91E000
stack
page read and write
1D294000
heap
page read and write
4C80000
direct allocation
page execute and read and write
46D0000
heap
page read and write
EDA000
unkown
page execute and read and write
1D297000
heap
page read and write
6F8FD000
unkown
page readonly
710000
direct allocation
page read and write
1D298000
heap
page read and write
32FE000
stack
page read and write
1D286000
heap
page read and write
46C1000
heap
page read and write
1D294000
heap
page read and write
710000
direct allocation
page read and write
443F000
stack
page read and write
710000
direct allocation
page read and write
710000
direct allocation
page read and write
2A3F000
stack
page read and write
46F0000
heap
page read and write
1D294000
heap
page read and write
A9B000
heap
page read and write
46C1000
heap
page read and write
A60000
heap
page read and write
70E000
stack
page read and write
46C1000
heap
page read and write
1D294000
heap
page read and write
46C1000
heap
page read and write
1D294000
heap
page read and write
1D294000
heap
page read and write
1CBCF000
stack
page read and write
46E0000
heap
page read and write
AE0000
direct allocation
page read and write
7D1000
heap
page read and write
232F9000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
1D294000
heap
page read and write
61EB4000
direct allocation
page read and write
1D298000
heap
page read and write
B7A000
unkown
page execute and read and write
1D2A1000
heap
page read and write
3CBF000
stack
page read and write
710000
direct allocation
page read and write
343E000
stack
page read and write
C0D000
unkown
page execute and read and write
46C1000
heap
page read and write
710000
direct allocation
page read and write
1D292000
heap
page read and write
FBA000
unkown
page execute and read and write
46C1000
heap
page read and write
29421000
heap
page read and write
1D291000
heap
page read and write
61ECD000
direct allocation
page readonly
46C1000
heap
page read and write
1D2AB000
heap
page read and write
1D278000
heap
page read and write
2C7F000
stack
page read and write
293FE000
heap
page read and write
46C1000
heap
page read and write
1D290000
heap
page read and write
36BE000
stack
page read and write
1D290000
heap
page read and write
1D27A000
heap
page read and write
1D294000
heap
page read and write
1C98E000
stack
page read and write
2B7E000
stack
page read and write
46C1000
heap
page read and write
1D15E000
stack
page read and write
3F7E000
stack
page read and write
46C1000
heap
page read and write
1D25D000
stack
page read and write
46C1000
heap
page read and write
B11000
unkown
page execute and write copy
46C1000
heap
page read and write
2CBE000
stack
page read and write
670000
heap
page read and write
B10000
unkown
page readonly
1D294000
heap
page read and write
6CE000
stack
page read and write
B10000
unkown
page read and write
B11000
unkown
page execute and read and write
4F9000
stack
page read and write
1D29C000
heap
page read and write
357E000
stack
page read and write
1D0CD000
stack
page read and write
1D297000
heap
page read and write
1D27B000
heap
page read and write
46C1000
heap
page read and write
47C0000
trusted library allocation
page read and write
46C1000
heap
page read and write
710000
direct allocation
page read and write
1D28A000
heap
page read and write
293E4000
heap
page read and write
710000
direct allocation
page read and write
6C8D5000
unkown
page readonly
1D286000
heap
page read and write
7C6000
heap
page read and write
37BF000
stack
page read and write
303F000
stack
page read and write
1D292000
heap
page read and write
BE1000
unkown
page execute and read and write
1D28D000
heap
page read and write
46C1000
heap
page read and write
45BE000
stack
page read and write
1D29C000
heap
page read and write
1D298000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
42FF000
stack
page read and write
1D289000
heap
page read and write
1D289000
heap
page read and write
1D294000
heap
page read and write
6F881000
unkown
page execute read
1D28A000
heap
page read and write
2DFE000
stack
page read and write
29401000
heap
page read and write
72A000
heap
page read and write
1CE4F000
stack
page read and write
46C1000
heap
page read and write
710000
direct allocation
page read and write
4CB0000
direct allocation
page execute and read and write
1CC0E000
stack
page read and write
32BF000
stack
page read and write
46C1000
heap
page read and write
1D279000
heap
page read and write
46C1000
heap
page read and write
1CE8E000
stack
page read and write
46C1000
heap
page read and write
4C90000
direct allocation
page execute and read and write
1D2A1000
heap
page read and write
710000
direct allocation
page read and write
ADB000
stack
page read and write
1D2B0000
heap
page read and write
46C0000
heap
page read and write
1D286000
heap
page read and write
46C1000
heap
page read and write
293A0000
heap
page read and write
1D290000
heap
page read and write
61ED0000
direct allocation
page read and write
1D294000
heap
page read and write
7CB000
heap
page read and write
FDC000
unkown
page execute and read and write
1D28B000
heap
page read and write
FE7000
unkown
page execute and read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
1D294000
heap
page read and write
1D29B000
heap
page read and write
293F8000
heap
page read and write
46C1000
heap
page read and write
1D2AF000
heap
page read and write
1D2A1000
heap
page read and write
1D2B0000
heap
page read and write
33FF000
stack
page read and write
317F000
stack
page read and write
620000
heap
page read and write
46C1000
heap
page read and write
7B1000
heap
page read and write
1D266000
heap
page read and write
A9E000
heap
page read and write
31BE000
stack
page read and write
1D27A000
heap
page read and write
787000
heap
page read and write
353F000
stack
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
685000
heap
page read and write
1D294000
heap
page read and write
1D2B1000
heap
page read and write
4B7C000
stack
page read and write
7D8000
heap
page read and write
1198000
unkown
page execute and read and write
1D298000
heap
page read and write
D50000
unkown
page execute and read and write
1D294000
heap
page read and write
1D294000
heap
page read and write
46C1000
heap
page read and write
293E2000
heap
page read and write
1D2B0000
heap
page read and write
6C6F1000
unkown
page execute read
1D294000
heap
page read and write
61E01000
direct allocation
page execute read
1D2B0000
heap
page read and write
6F90E000
unkown
page read and write
1CF8C000
stack
page read and write
1CD4E000
stack
page read and write
46C1000
heap
page read and write
1D27A000
heap
page read and write
1D28A000
heap
page read and write
775000
heap
page read and write
46C1000
heap
page read and write
37FE000
stack
page read and write
46C1000
heap
page read and write
BD4000
unkown
page execute and read and write
2F4E3000
heap
page read and write
2EFF000
stack
page read and write
1D289000
heap
page read and write
1D28D000
heap
page read and write
1D289000
heap
page read and write
46C1000
heap
page read and write
3DFF000
stack
page read and write
7A0000
heap
page read and write
AE0000
direct allocation
page read and write
1CFCD000
stack
page read and write
1D28A000
heap
page read and write
29441000
heap
page read and write
46C1000
heap
page read and write
816000
heap
page read and write
393E000
stack
page read and write
46C1000
heap
page read and write
1D2AF000
heap
page read and write
C10000
unkown
page execute and read and write
AF0000
direct allocation
page execute and read and write
61ECC000
direct allocation
page read and write
710000
direct allocation
page read and write
46C1000
heap
page read and write
293EC000
heap
page read and write
1D2A1000
heap
page read and write
A97000
heap
page read and write
A1F000
stack
page read and write
1D26F000
heap
page read and write
1D2AC000
heap
page read and write
C97000
unkown
page execute and read and write
CBD000
unkown
page execute and read and write
6C6F0000
unkown
page readonly
61E00000
direct allocation
page execute and read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
4B40000
direct allocation
page read and write
293E6000
heap
page read and write
1D380000
trusted library allocation
page read and write
1D294000
heap
page read and write
7DE000
heap
page read and write
1D2A1000
heap
page read and write
46C1000
heap
page read and write
1D2A1000
heap
page read and write
2F4EB000
heap
page read and write
1D2B1000
heap
page read and write
3A3F000
stack
page read and write
2F3E000
stack
page read and write
4C90000
direct allocation
page execute and read and write
46C1000
heap
page read and write
710000
direct allocation
page read and write
1D2A1000
heap
page read and write
FF7000
unkown
page execute and read and write
61ED3000
direct allocation
page read and write
680000
heap
page read and write
1D27A000
heap
page read and write
367F000
stack
page read and write
46C1000
heap
page read and write
2F4DF000
heap
page read and write
FF7000
unkown
page execute and write copy
1D385000
heap
page read and write
1D294000
heap
page read and write
61EB7000
direct allocation
page readonly
2339C000
heap
page read and write
6F912000
unkown
page readonly
6C8CE000
unkown
page read and write
2DBF000
stack
page read and write
46C1000
heap
page read and write
3F3F000
stack
page read and write
C01000
unkown
page execute and read and write
1CACE000
stack
page read and write
3E3E000
stack
page read and write
3BBE000
stack
page read and write
41FE000
stack
page read and write
1D289000
heap
page read and write
1D294000
heap
page read and write
46C1000
heap
page read and write
BA3000
unkown
page execute and read and write
1D289000
heap
page read and write
447E000
stack
page read and write
1D2B0000
heap
page read and write
1D27A000
heap
page read and write
46C1000
heap
page read and write
3B7F000
stack
page read and write
BAF000
unkown
page execute and read and write
46C1000
heap
page read and write
1D294000
heap
page read and write
6C88F000
unkown
page readonly
1D2A1000
heap
page read and write
1D2B1000
heap
page read and write
46C1000
heap
page read and write
1EC000
stack
page read and write
2343F000
heap
page read and write
2F4D9000
heap
page read and write
46C1000
heap
page read and write
4C7F000
stack
page read and write
1D2AE000
heap
page read and write
1D297000
heap
page read and write
46C1000
heap
page read and write
307E000
stack
page read and write
41BF000
stack
page read and write
1D28B000
heap
page read and write
433E000
stack
page read and write
46C1000
heap
page read and write
540000
heap
page read and write
38FF000
stack
page read and write
1D289000
heap
page read and write
46BF000
stack
page read and write
46C1000
heap
page read and write
A5E000
stack
page read and write
46C1000
heap
page read and write
771000
heap
page read and write
46C1000
heap
page read and write
2F4D1000
heap
page read and write
3CFE000
stack
page read and write
46C1000
heap
page read and write
40BE000
stack
page read and write
1D298000
heap
page read and write
4F3000
stack
page read and write
293F5000
heap
page read and write
1D2B0000
heap
page read and write
3A7E000
stack
page read and write
46EA000
heap
page read and write
61ED4000
direct allocation
page readonly
46C1000
heap
page read and write
1D260000
heap
page read and write
1D288000
heap
page read and write
1D2B0000
heap
page read and write
4FD000
stack
page read and write
1D294000
heap
page read and write
1D294000
heap
page read and write
46C1000
heap
page read and write
1D2B0000
heap
page read and write
1D28D000
heap
page read and write
CB7000
unkown
page execute and read and write
1D2A1000
heap
page read and write
46C1000
heap
page read and write
1D294000
heap
page read and write
46C1000
heap
page read and write
1D298000
heap
page read and write
46C1000
heap
page read and write
710000
direct allocation
page read and write
1D289000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
1D289000
heap
page read and write
6C8D0000
unkown
page read and write
1D2AB000
heap
page read and write
46C1000
heap
page read and write
2B3F000
stack
page read and write
1D2B0000
heap
page read and write
6F880000
unkown
page readonly
46C1000
heap
page read and write
1D275000
heap
page read and write
46C1000
heap
page read and write
457F000
stack
page read and write
1199000
unkown
page execute and write copy
1D27A000
heap
page read and write
1D279000
heap
page read and write
46C1000
heap
page read and write
1D2A1000
heap
page read and write
1D2A1000
heap
page read and write
293E1000
heap
page read and write
1CA8E000
stack
page read and write
There are 368 hidden memdumps, click here to show them.