IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BFCAAEHJDBKJJKFHJEBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CBGCBGCAFIIECBFIDHIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ECBGCGCGIEGCBFHIIEBFCAFHIE
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FHDHCAAKECFIDHIEBAKF
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\HIDAFHDHCBGDGCBGCGIIEHIDBF
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\IEHIIIJD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JDGIIJJDHDGCGDHIJDAKJKKKFH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JJDBFCAEBFIJJKFHDAECGDAEGI
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\KECFIDGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.206/
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/nss3.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/vcruntime140.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/softokn3.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/freebl3.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/msvcp140.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/sqlite3.dll
185.215.113.206
 malicious
http://185.215.113.206/e2b1563c6670f193.php
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/mozglue.dll
185.215.113.206
 malicious
http://185.215.113.206
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.215.113.206/0d60be0de163924d/softokn3.dll-W
unknown
http://185.215.113.206/e2b1563c6670f193.php2
unknown
http://185.215.113.206/e2b1563c6670f193.phpGb
unknown
http://185.215.113.206/0d60be0de163924d/freebl3.dllNU
unknown
http://185.215.113.206/e2b1563c6670f193.php;cf
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
http://185.215.113.206e2b1563c6670f193.phpion:
unknown
http://185.215.113.206/e2b1563c6670f193.phpQQBrowser
unknown
http://185.215.113.206/e2b1563c6670f193.php_
unknown
http://185.215.113.206/e2b1563c6670f193.phpf5
unknown
http://185.215.113.206/0d60be0de163924d/msvcp140.dllRW
unknown
http://185.215.113.206/5C
unknown
http://185.215.113.206/e2b1563c6670f193.php7cR
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.206/e2b1563c6670f193.phpWc2
unknown
http://185.215.113.206/e2b1563c6670f193.phpm
unknown
http://185.215.113.206/e2b1563c6670f193.php#c
unknown
http://185.215.113.206/e2b1563c6670f193.phpsb.
unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dll2U
unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dllG
unknown
http://185.215.113.206/e2b1563c6670f193.phpe
unknown
http://185.215.113.206/0d60be0de163924d/mozglue.dllpT
unknown
http://185.215.113.206/e2b1563c6670f193.phpb
unknown
http://www.sqlite.org/copyright.html.
unknown
http://185.215.113.206/e2b1563c6670f193.phpenSSH
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.206/0d60be0de163924d/mozglue.dllBT
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
http://185.215.113.206/0d60be0de163924d/nss3.dll.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://185.215.113.206/e2b1563c6670f193.phpKb6
unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dllg
unknown
http://185.215.113.206/e2b1563c6670f193.phpion:
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://185.215.113.206/e2b1563c6670f193.phpndowsApps
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://185.215.113.206/0d60be0de163924d/nss3.dllll
unknown
http://185.215.113.206/e2b1563c6670f193.phpata
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
http://185.215.113.206/0d60be0de163924d/mozglue.dll8T
unknown
http://185.215.113.206/0d60be0de163924d/nss3.dllllPU
unknown
https://support.mozilla.org
unknown
http://185.215.113.206/e2b1563c6670f193.php_b
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.206/e2b1563c6670f193.phpodus.wallet
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
http://185.215.113.206/e2b1563c6670f193.php#
unknown
There are 57 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.206
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
871000
unkown
page execute and read and write
 malicious
10DE000
heap
page read and write
 malicious
4F40000
direct allocation
page read and write
 malicious
50F0000
direct allocation
page execute and read and write
1D6CC000
heap
page read and write
4AC0000
heap
page read and write
4AB1000
heap
page read and write
408F000
stack
page read and write
10C0000
heap
page read and write
2F922000
heap
page read and write
4AB4000
heap
page read and write
871000
unkown
page execute and write copy
444F000
stack
page read and write
4AB1000
heap
page read and write
1D6F1000
heap
page read and write
1D59E000
stack
page read and write
10B0000
direct allocation
page read and write
10B0000
direct allocation
page read and write
4AB1000
heap
page read and write
61E00000
direct allocation
page execute and read and write
2F929000
heap
page read and write
2F77E000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1139000
heap
page read and write
A3B000
unkown
page execute and read and write
296E0000
heap
page read and write
1D6CE000
heap
page read and write
4AB1000
heap
page read and write
61ED3000
direct allocation
page read and write
6CB30000
unkown
page readonly
4AB1000
heap
page read and write
1D69D000
stack
page read and write
921000
unkown
page execute and read and write
D32000
unkown
page execute and read and write
340F000
stack
page read and write
4AB1000
heap
page read and write
50C0000
direct allocation
page execute and read and write
2D00000
heap
page read and write
1D6CE000
heap
page read and write
1CECE000
stack
page read and write
6CA90000
unkown
page readonly
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D6C6000
heap
page read and write
1D10E000
stack
page read and write
4AB1000
heap
page read and write
32CF000
stack
page read and write
3E4E000
stack
page read and write
1D6CE000
heap
page read and write
1D6C1000
heap
page read and write
10B0000
direct allocation
page read and write
4AB1000
heap
page read and write
50D0000
direct allocation
page execute and read and write
4AB1000
heap
page read and write
4A90000
heap
page read and write
1D6CC000
heap
page read and write
1D4FD000
stack
page read and write
1D6D3000
heap
page read and write
10A0000
heap
page read and write
16DF000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
61ECC000
direct allocation
page read and write
1D6C1000
heap
page read and write
C56000
unkown
page execute and read and write
107D000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D6A0000
heap
page read and write
4AB1000
heap
page read and write
1D6CF000
heap
page read and write
6CD10000
unkown
page read and write
1D6CD000
heap
page read and write
430F000
stack
page read and write
1D6E3000
heap
page read and write
4AB1000
heap
page read and write
1D6DF000
heap
page read and write
6CA91000
unkown
page execute read
3F4F000
stack
page read and write
50CE000
stack
page read and write
4AB1000
heap
page read and write
8F5000
unkown
page execute and read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D6D4000
heap
page read and write
368E000
stack
page read and write
434E000
stack
page read and write
1D6C9000
heap
page read and write
3A4F000
stack
page read and write
50C0000
direct allocation
page execute and read and write
1008000
stack
page read and write
6CB22000
unkown
page readonly
1D6D2000
heap
page read and write
1D6D4000
heap
page read and write
4AB1000
heap
page read and write
29761000
heap
page read and write
29763000
heap
page read and write
1155000
heap
page read and write
2F921000
heap
page read and write
1D6BA000
heap
page read and write
2D0B000
heap
page read and write
46CF000
stack
page read and write
1D6CE000
heap
page read and write
354F000
stack
page read and write
1D6CE000
heap
page read and write
1122000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D6CB000
heap
page read and write
344E000
stack
page read and write
4AB1000
heap
page read and write
1D6D8000
heap
page read and write
4AB1000
heap
page read and write
3CCF000
stack
page read and write
1D6D4000
heap
page read and write
8F8000
unkown
page execute and read and write
ABA000
unkown
page execute and read and write
1D6DA000
heap
page read and write
1D6C4000
heap
page read and write
61ECD000
direct allocation
page readonly
4AB1000
heap
page read and write
A15000
unkown
page execute and read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
296C0000
heap
page read and write
2D07000
heap
page read and write
484E000
stack
page read and write
870000
unkown
page read and write
1D6CE000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
29723000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
61EB4000
direct allocation
page read and write
1D6D4000
heap
page read and write
1D6C8000
heap
page read and write
8CA000
unkown
page execute and read and write
4AB1000
heap
page read and write
3E0F000
stack
page read and write
1D6C8000
heap
page read and write
498E000
stack
page read and write
50E0000
direct allocation
page execute and read and write
1D6BA000
heap
page read and write
3A8E000
stack
page read and write
494F000
stack
page read and write
1D6CC000
heap
page read and write
29701000
heap
page read and write
1CE8F000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
952000
unkown
page execute and read and write
1D7C7000
heap
page read and write
6CD15000
unkown
page readonly
308E000
stack
page read and write
1D6BA000
heap
page read and write
1D6F1000
heap
page read and write
1D6F1000
heap
page read and write
2F914000
heap
page read and write
1D6BA000
heap
page read and write
1D6BA000
heap
page read and write
4AB1000
heap
page read and write
6CCCF000
unkown
page readonly
D6C000
unkown
page execute and read and write
10B0000
direct allocation
page read and write
480F000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
870000
unkown
page readonly
4AB1000
heap
page read and write
2D0E000
heap
page read and write
296A0000
heap
page read and write
4AB1000
heap
page read and write
448E000
stack
page read and write
F08000
unkown
page execute and write copy
D6D000
unkown
page execute and write copy
1D00E000
stack
page read and write
1D6B9000
heap
page read and write
4AB1000
heap
page read and write
100D000
stack
page read and write
6CD0E000
unkown
page read and write
8FF000
unkown
page execute and read and write
2CFC000
stack
page read and write
458F000
stack
page read and write
1D6DC000
heap
page read and write
4AB1000
heap
page read and write
1D6F1000
heap
page read and write
61ED4000
direct allocation
page readonly
61ED0000
direct allocation
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D6C8000
heap
page read and write
36CE000
stack
page read and write
1002000
stack
page read and write
1D6B9000
heap
page read and write
4F40000
direct allocation
page read and write
6CD0F000
unkown
page write copy
2F4E000
stack
page read and write
2F880000
trusted library allocation
page read and write
45CE000
stack
page read and write
1D6A6000
heap
page read and write
83C000
stack
page read and write
31CE000
stack
page read and write
860000
heap
page read and write
507F000
stack
page read and write
4AB1000
heap
page read and write
2373F000
heap
page read and write
61EB7000
direct allocation
page readonly
3B8F000
stack
page read and write
10B0000
direct allocation
page read and write
1D2BD000
stack
page read and write
1D6D4000
heap
page read and write
D56000
unkown
page execute and read and write
4AB1000
heap
page read and write
98B000
unkown
page execute and read and write
A35000
unkown
page execute and read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D6CC000
heap
page read and write
1D6BA000
heap
page read and write
394E000
stack
page read and write
4AB1000
heap
page read and write
4BB0000
trusted library allocation
page read and write
1D6F1000
heap
page read and write
F07000
unkown
page execute and read and write
1D6CE000
heap
page read and write
10DA000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
6CB0D000
unkown
page readonly
1D6D4000
heap
page read and write
1D3BC000
stack
page read and write
4F7B000
stack
page read and write
97F000
unkown
page execute and read and write
1D6D4000
heap
page read and write
6CB1E000
unkown
page read and write
ACE000
unkown
page execute and read and write
10C5000
heap
page read and write
1D6D4000
heap
page read and write
1D6D7000
heap
page read and write
470E000
stack
page read and write
40CD000
stack
page read and write
95F000
unkown
page execute and read and write
390F000
stack
page read and write
1D6C9000
heap
page read and write
92D000
unkown
page execute and read and write
15DE000
stack
page read and write
1D6D4000
heap
page read and write
2CBE000
stack
page read and write
10D0000
heap
page read and write
4AB1000
heap
page read and write
10B0000
direct allocation
page read and write
1D6BA000
heap
page read and write
10B0000
direct allocation
page read and write
4AB1000
heap
page read and write
10B0000
direct allocation
page read and write
4A8F000
stack
page read and write
4AB0000
heap
page read and write
902000
unkown
page execute and read and write
1D27F000
stack
page read and write
1D6DF000
heap
page read and write
10B0000
direct allocation
page read and write
1D6D4000
heap
page read and write
1D3FE000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D7C0000
trusted library allocation
page read and write
3D0E000
stack
page read and write
304F000
stack
page read and write
1D6D0000
heap
page read and write
4AD0000
heap
page read and write
10B0000
direct allocation
page read and write
3F8E000
stack
page read and write
2F0F000
stack
page read and write
4AB1000
heap
page read and write
1D6F1000
heap
page read and write
4AB1000
heap
page read and write
4F40000
direct allocation
page read and write
1D6E1000
heap
page read and write
4AB1000
heap
page read and write
1D6F1000
heap
page read and write
318F000
stack
page read and write
1D6F1000
heap
page read and write
1D6BA000
heap
page read and write
1D6C1000
heap
page read and write
1D6C9000
heap
page read and write
380E000
stack
page read and write
1D6C8000
heap
page read and write
1D6CE000
heap
page read and write
10B0000
direct allocation
page read and write
1D6C6000
heap
page read and write
4AB1000
heap
page read and write
61E01000
direct allocation
page execute read
1D6F1000
heap
page read and write
358E000
stack
page read and write
5090000
direct allocation
page execute and read and write
1D17E000
stack
page read and write
1D6C1000
heap
page read and write
41CF000
stack
page read and write
139E000
stack
page read and write
6CB31000
unkown
page execute read
10B0000
direct allocation
page read and write
1D6F1000
heap
page read and write
1004000
stack
page read and write
1D6D4000
heap
page read and write
1D6F0000
heap
page read and write
2F91C000
heap
page read and write
1CFCF000
stack
page read and write
1010000
heap
page read and write
4AB1000
heap
page read and write
1D6D0000
heap
page read and write
98E000
unkown
page execute and read and write
420E000
stack
page read and write
1D6DB000
heap
page read and write
2E0F000
stack
page read and write
1D6AF000
heap
page read and write
1D6B9000
heap
page read and write
3BCE000
stack
page read and write
10B0000
direct allocation
page read and write
1D6CE000
heap
page read and write
29743000
heap
page read and write
4AB1000
heap
page read and write
1D6D4000
heap
page read and write
4AB1000
heap
page read and write
50A0000
direct allocation
page execute and read and write
1D6C6000
heap
page read and write
D6C000
unkown
page execute and write copy
4AB1000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D6C8000
heap
page read and write
1D6D7000
heap
page read and write
37CF000
stack
page read and write
2F87F000
stack
page read and write
1D6D4000
heap
page read and write
4AB1000
heap
page read and write
D5E000
unkown
page execute and read and write
111D000
heap
page read and write
10B0000
direct allocation
page read and write
1D6CD000
heap
page read and write
1D6D4000
heap
page read and write
4AB1000
heap
page read and write
1D6D4000
heap
page read and write
50B0000
direct allocation
page execute and read and write
330E000
stack
page read and write
There are 339 hidden memdumps, click here to show them.