IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\AFIEGCAECGCAEBFHDHIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\AKEGIIJDGHCAKFHJEHCFIJJEGI
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CGIDAAAK
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EGIJKEHCAKFCAKFHDAAA
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HCGCBFHCFCFBFIEBGHJECGHCFI
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\HDAFIIDAKJDGDHIDAKJJJEHCFB
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HJDBFBKK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IEHDBAAFIDGDAAAAAAAA
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://194.87.29.53/97f9710b31d15029/mozglue.dll
194.87.29.53
 malicious
http://194.87.29.53/97f9710b31d15029/nss3.dll
194.87.29.53
 malicious
http://194.87.29.53/6f9307efa625dd18.php
194.87.29.53
 malicious
http://194.87.29.53/97f9710b31d15029/vcruntime140.dll
194.87.29.53
 malicious
http://194.87.29.53/
194.87.29.53
 malicious
http://194.87.29.53/97f9710b31d15029/sqlite3.dll
194.87.29.53
 malicious
http://194.87.29.53/97f9710b31d15029/msvcp140.dll
194.87.29.53
 malicious
http://194.87.29.53/97f9710b31d15029/freebl3.dll
194.87.29.53
 malicious
http://194.87.29.53
unknown
 malicious
http://194.87.29.53/97f9710b31d15029/softokn3.dll
194.87.29.53
 malicious
http://194.87.29.53/6f9307efa625dd18.phpS
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
http://194.87.29.53/6f9307efa625dd18.phpV
unknown
http://194.87.29.53/97f9710b31d15029/vcruntime140.dll~
unknown
http://194.87.29.53/97f9710b31d15029/mozglue.dllN
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
http://194.87.29.53/97f9710b31d15029/softokn3.dllJ
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://194.87.29.53/6f9307efa625dd18.php3
unknown
http://194.87.29.53/6f9307efa625dd18.phpoinomi
unknown
http://194.87.29.53/6f9307efa625dd18.phppRH6tRH6hRH6vRH6jRH6nRH6lRH6
unknown
http://194.87.29.53/6f9307efa625dd18.phpowser
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
http://194.87.29.53at
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://194.87.29.53/6f9307efa625dd18.php/
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://194.87.29.53/6f9307efa625dd18.php.
unknown
http://www.sqlite.org/copyright.html.
unknown
http://194.87.29.53/6f9307efa625dd18.phpsition:
unknown
http://194.87.29.53/97f9710b31d15029/sqlite3.dllj
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://194.87.29.53/6f9307efa625dd18.phpHDBAAFIDGDAAAAAAAA
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
http://194.87.29.53/6f9307efa625dd18.phpl7
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
http://194.87.29.53/6f9307efa625dd18.phpl3
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17-
unknown
http://194.87.29.53/6f9307efa625dd18.phpw
unknown
http://194.87.29.53/:
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://194.87.29.53/6f9307efa625dd18.php-D
unknown
http://194.87.29.53/97f9710b31d15029/freebl3.dllX
unknown
http://194.87.29.53/97f9710b31d15029/softokn3.dllv
unknown
http://194.87.29.53/6f9307efa625dd18.phpa
unknown
https://support.mozilla.org
unknown
http://194.87.29.53/6f9307efa625dd18.phpe
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://194.87.29.536f9307efa625dd18.phpsition:
unknown
There are 53 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
194.87.29.53
unknown
Russian Federation
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
3595000
trusted library allocation
page read and write
 malicious
145A000
heap
page read and write
 malicious
99E000
stack
page read and write
69B000
trusted library allocation
page execute and read and write
21600000
heap
page read and write
848000
heap
page read and write
488000
remote allocation
page execute and read and write
215F2000
heap
page read and write
116C000
stack
page read and write
61ED0000
direct allocation
page read and write
29A1000
trusted library allocation
page read and write
238E000
stack
page read and write
132D000
stack
page read and write
6C382000
unkown
page readonly
653000
trusted library allocation
page execute and read and write
AEE000
stack
page read and write
1A9EE000
stack
page read and write
4F8000
stack
page read and write
21621000
heap
page read and write
1B37F000
stack
page read and write
4E2000
remote allocation
page execute and read and write
84D000
heap
page read and write
654000
trusted library allocation
page read and write
1AAEE000
stack
page read and write
6C2F0000
unkown
page readonly
106C000
stack
page read and write
6C575000
unkown
page readonly
1AF8F000
stack
page read and write
61ECD000
direct allocation
page readonly
640000
trusted library allocation
page read and write
215D0000
heap
page read and write
170C000
heap
page read and write
149E000
heap
page read and write
52000
unkown
page readonly
45A000
remote allocation
page execute and read and write
6C2F1000
unkown
page execute read
51E000
remote allocation
page execute and read and write
6C391000
unkown
page execute read
215D3000
heap
page read and write
1B0CD000
stack
page read and write
6D0000
trusted library allocation
page read and write
60E000
stack
page read and write
95E000
stack
page read and write
61ED4000
direct allocation
page readonly
9E0000
heap
page read and write
1AFCD000
stack
page read and write
4B1000
remote allocation
page execute and read and write
278AF000
stack
page read and write
6C570000
unkown
page read and write
61EB4000
direct allocation
page read and write
A2000
unkown
page readonly
1168000
stack
page read and write
1B20E000
stack
page read and write
2591000
trusted library allocation
page execute and read and write
255E000
stack
page read and write
6E0000
heap
page read and write
6E5000
heap
page read and write
1AE8E000
stack
page read and write
50000
unkown
page readonly
276EA000
heap
page read and write
674000
trusted library allocation
page read and write
21614000
heap
page read and write
6C37E000
unkown
page read and write
27640000
heap
page read and write
1FE000
stack
page read and write
12B0000
heap
page read and write
1162000
stack
page read and write
1B0000
heap
page read and write
1B10D000
stack
page read and write
51B000
remote allocation
page execute and read and write
6C36D000
unkown
page readonly
12C5000
heap
page read and write
216DE000
heap
page read and write
65C000
remote allocation
page execute and read and write
142E000
stack
page read and write
4BD000
remote allocation
page execute and read and write
5A5000
remote allocation
page execute and read and write
4EF000
remote allocation
page execute and read and write
11D0000
heap
page read and write
61E01000
direct allocation
page execute read
23B0000
heap
page read and write
1704000
heap
page read and write
6C56F000
unkown
page write copy
277AE000
stack
page read and write
1B3DE000
stack
page read and write
7F0000
heap
page read and write
2580000
heap
page execute and read and write
61ED3000
direct allocation
page read and write
276E2000
heap
page read and write
3591000
trusted library allocation
page read and write
1700000
heap
page read and write
27660000
heap
page read and write
6C56E000
unkown
page read and write
6C390000
unkown
page readonly
676000
trusted library allocation
page read and write
82E000
heap
page read and write
5CB000
remote allocation
page execute and read and write
215F7000
heap
page read and write
48F000
remote allocation
page execute and read and write
6C0000
trusted library allocation
page execute and read and write
660000
heap
page read and write
1450000
heap
page read and write
64A000
remote allocation
page execute and read and write
14BB000
heap
page read and write
50F000
remote allocation
page execute and read and write
61ECC000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
7EF000
stack
page read and write
864000
heap
page read and write
6C52F000
unkown
page readonly
1A0000
heap
page read and write
5C5000
remote allocation
page execute and read and write
492000
remote allocation
page execute and read and write
670000
trusted library allocation
page read and write
855000
heap
page read and write
1B550000
heap
page read and write
1B560000
heap
page read and write
13C000
stack
page read and write
1AE30000
heap
page read and write
2593000
trusted library allocation
page read and write
61EB7000
direct allocation
page readonly
1B666000
heap
page read and write
12C0000
heap
page read and write
828000
heap
page read and write
820000
heap
page read and write
1B4DC000
stack
page read and write
215EA000
heap
page read and write
1B27E000
stack
page read and write
485000
remote allocation
page execute and read and write
27681000
heap
page read and write
2160C000
heap
page read and write
There are 122 hidden memdumps, click here to show them.