IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_aa631021d087f9452799e575242b30ff106b8891_3293b468_5bdcc3dc-4cbe-4715-9c79-04e8aea1ad9f\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\BKJDGCGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EBGCBAFC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\ECGDAAFIIJDAAAAKFHID
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EGDGCGCFHIEHIDGDBAAEHJDAFB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FHIDAFHCBAKFCAAKFCFCFIIJKF
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\HDBGHDHCGHCAAKEBKECBKFIIDA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JJECFIECBGDGCAAAEHIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JKJDHDBKEBGHJJJJKEHDHJJEGH
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\KKJEBAAECBGDHIECAKJK
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F09.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Oct 7 15:21:57 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F87.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FB7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 19 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 268
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userEGDGCGCFHI.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllNgH
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.php
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll2f
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.phpEAU
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.php1f9a9c4a2f8b514.cdf-msJY
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllRg
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.phpe
unknown
 malicious
http://46.8.231.109
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.phpry=----HDGIJJDGCBKFIDHIEBKEaultrelease
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/nss3.dllM
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll9h
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
46.8.231.109
 malicious
http://46.8.231.109GCFHIrm-data;
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/nss3.dllB
unknown
 malicious
http://46.8.231.109/
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllffP
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.phpUP
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
46.8.231.109
 malicious
http://46.8.231.109/c4754d4f680ead72.phpT.
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlltfB
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 38 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
fp2e7a.wpc.phicdn.net
192.229.221.95
s-part-0032.t-0009.t-msedge.net
13.107.246.60

IPs

IP
Domain
Country
Malicious
46.8.231.109
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProgramId
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
FileId
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LowerCaseLongPath
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LongPathHash
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Name
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
OriginalFileName
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Publisher
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Version
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinFileVersion
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinaryType
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductName
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductVersion
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LinkDate
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinProductVersion
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
AppxPackageFullName
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
AppxPackageRelativeId
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Size
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Language
 malicious
\REGISTRY\A\{d2a97d1b-a95e-6e56-5702-1e116a785666}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Usn
 malicious
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
13F7000
heap
page read and write
 malicious
DED000
unkown
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
1B669000
heap
page read and write
14A3000
heap
page read and write
2174A000
heap
page read and write
1451000
heap
page read and write
B7F000
stack
page read and write
1B0DE000
stack
page read and write
21733000
heap
page read and write
51E000
remote allocation
page execute and read and write
6BD40000
unkown
page readonly
48F000
remote allocation
page execute and read and write
1AE9E000
stack
page read and write
21737000
heap
page read and write
215DC000
heap
page read and write
88A000
heap
page read and write
3E0000
heap
page read and write
2784B000
heap
page read and write
7D0000
heap
page read and write
61EB4000
direct allocation
page read and write
DC0000
unkown
page readonly
137D000
stack
page read and write
61E01000
direct allocation
page execute read
1B27E000
stack
page read and write
117D000
stack
page read and write
51B000
remote allocation
page execute and read and write
2E8F000
stack
page read and write
1AFDD000
stack
page read and write
13F0000
heap
page read and write
1303000
heap
page read and write
27780000
heap
page read and write
DED000
unkown
page write copy
DC0000
unkown
page readonly
11E0000
heap
page read and write
1310000
heap
page read and write
27811000
heap
page read and write
DC1000
unkown
page execute read
61ED4000
direct allocation
page readonly
21763000
heap
page read and write
6FD000
stack
page read and write
6BD32000
unkown
page readonly
5A5000
remote allocation
page execute and read and write
21713000
heap
page read and write
1325000
heap
page read and write
5C5000
remote allocation
page execute and read and write
1AF9F000
stack
page read and write
6BF20000
unkown
page read and write
65C000
remote allocation
page execute and read and write
61ECC000
direct allocation
page read and write
1436000
heap
page read and write
DE3000
unkown
page readonly
61ECD000
direct allocation
page readonly
1B21D000
stack
page read and write
A7F000
stack
page read and write
3F0000
heap
page read and write
4E2000
remote allocation
page execute and read and write
61ED0000
direct allocation
page read and write
880000
heap
page read and write
15EF000
stack
page read and write
E3C000
unkown
page readonly
2172C000
heap
page read and write
64A000
remote allocation
page execute and read and write
277C1000
heap
page read and write
488000
remote allocation
page execute and read and write
277A0000
heap
page read and write
DC1000
unkown
page execute read
2171E000
heap
page read and write
21676000
heap
page read and write
1B37F000
stack
page read and write
61E00000
direct allocation
page execute and read and write
E3A000
unkown
page execute and read and write
5CB000
remote allocation
page execute and read and write
4B1000
remote allocation
page execute and read and write
4EF000
remote allocation
page execute and read and write
34550000
heap
page read and write
1B11D000
stack
page read and write
2181E000
heap
page read and write
485000
remote allocation
page execute and read and write
61ED3000
direct allocation
page read and write
61EB7000
direct allocation
page readonly
1300000
heap
page read and write
6BCA1000
unkown
page execute read
1B550000
heap
page read and write
277E1000
heap
page read and write
4BD000
remote allocation
page execute and read and write
13B0000
heap
page read and write
E3B000
unkown
page read and write
6BF25000
unkown
page readonly
6BD41000
unkown
page execute read
6BEDF000
unkown
page readonly
38C000
stack
page read and write
6BD2E000
unkown
page read and write
88E000
heap
page read and write
492000
remote allocation
page execute and read and write
21752000
heap
page read and write
6BF1E000
unkown
page read and write
1B560000
heap
page read and write
1179000
stack
page read and write
1483000
heap
page read and write
85E000
stack
page read and write
6BF1F000
unkown
page write copy
130C000
heap
page read and write
27801000
heap
page read and write
277FA000
heap
page read and write
21710000
heap
page read and write
1B3EE000
stack
page read and write
1B4EC000
stack
page read and write
1320000
heap
page read and write
1173000
stack
page read and write
12FE000
stack
page read and write
50F000
remote allocation
page execute and read and write
2D95E000
stack
page read and write
E3C000
unkown
page readonly
107C000
stack
page read and write
45A000
remote allocation
page execute and read and write
6BD1D000
unkown
page readonly
DE3000
unkown
page readonly
6BCA0000
unkown
page readonly
81E000
stack
page read and write
14C3000
heap
page read and write
2D85D000
stack
page read and write
There are 112 hidden memdumps, click here to show them.