IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAFBAKECAEGCBFIEGDGIEGIEHD
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\CBGCAFIIECBFIDHIJKFB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ECGHJJEH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GHJKECAAAFHJECAAAEBFCAEBFH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HCBAKJEHDBGHIEBGCGDGHCAKEB
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\IDAEHCFH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\IJDGCAEBFIIECAKFHIJE
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\IJKFIIIJJKJJKEBGIDGCAEGCGD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KECGHIJDGCBKECAAKKEC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.206/
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/nss3.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/vcruntime140.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/softokn3.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/freebl3.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/msvcp140.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/sqlite3.dll
185.215.113.206
 malicious
http://185.215.113.206/e2b1563c6670f193.php
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/mozglue.dll
185.215.113.206
 malicious
http://185.215.113.206
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.215.113.206/0d60be0de163924d/freebl3.dll)
unknown
http://185.215.113.206/e2b1563c6670f193.php=CV
unknown
http://185.215.113.206/e2b1563c6670f193.php2
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
http://185.215.113.206/e2b1563c6670f193.php3
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
http://185.215.113.206/e2b1563c6670f193.phpN
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.113.206e2b1563c6670f193.phpion:
unknown
http://185.215.113.206/e2b1563c6670f193.phpC
unknown
http://185.215.113.206/e2b1563c6670f193.phpZ
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.206/e2b1563c6670f193.phpR
unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dllc
unknown
http://185.215.113.206/e2b1563c6670f193.phpBrowser
unknown
http://185.215.113.206/e2b1563c6670f193.phpLo
unknown
http://185.215.113.206/e2b1563c6670f193.phpER
unknown
http://185.215.113.206/e2b1563c6670f193.phpb
unknown
http://185.215.113.206/e2b1563c6670f193.phper
unknown
http://www.sqlite.org/copyright.html.
unknown
http://185.215.113.206/e2b1563c6670f193.php~
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://185.215.113.206/e2b1563c6670f193.phpnd
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.206/e2b1563c6670f193.phpFirefox
unknown
http://185.215.113.206/e2b1563c6670f193.phpv
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://185.215.113.206/e2b1563c6670f193.phpion:
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://185.215.113.206/e2b1563c6670f193.php_O
unknown
http://185.215.113.206/e2b1563c6670f193.phpSH
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dll5
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.206/e2b1563c6670f193.phpC:
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
http://185.215.113.206/e2b1563c6670f193.php.
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
http://185.215.113.206/0d60be0de163924d/freebl3.dllC
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.206/e2b1563c6670f193.php(
unknown
There are 49 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.206
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
E2E000
heap
page read and write
 malicious
281000
unkown
page execute and read and write
 malicious
4C20000
direct allocation
page read and write
 malicious
61E01000
direct allocation
page execute read
E71000
heap
page read and write
9F4000
heap
page read and write
9F4000
heap
page read and write
308000
unkown
page execute and read and write
9F4000
heap
page read and write
293D2000
heap
page read and write
1D286000
heap
page read and write
47A1000
heap
page read and write
9F4000
heap
page read and write
9F4000
heap
page read and write
9F4000
heap
page read and write
6C6E2000
unkown
page readonly
4DE000
unkown
page execute and read and write
1D26B000
heap
page read and write
29411000
heap
page read and write
2C1F000
stack
page read and write
1D29C000
heap
page read and write
EA3000
heap
page read and write
47A1000
heap
page read and write
1D274000
heap
page read and write
47A1000
heap
page read and write
1D29B000
heap
page read and write
47A1000
heap
page read and write
1D280000
heap
page read and write
1D277000
heap
page read and write
3C9E000
stack
page read and write
9F4000
heap
page read and write
6C88F000
unkown
page readonly
1D264000
heap
page read and write
1D27F000
heap
page read and write
293F1000
heap
page read and write
2970000
direct allocation
page read and write
9F4000
heap
page read and write
4C20000
direct allocation
page read and write
9F4000
heap
page read and write
9F4000
heap
page read and write
9F4000
heap
page read and write
2970000
direct allocation
page read and write
2970000
direct allocation
page read and write
1D293000
heap
page read and write
23429000
heap
page read and write
305000
unkown
page execute and read and write
6C8D0000
unkown
page read and write
770000
unkown
page execute and read and write
47A1000
heap
page read and write
3B5E000
stack
page read and write
47A1000
heap
page read and write
47A1000
heap
page read and write
1D275000
heap
page read and write
9AC000
stack
page read and write
47A1000
heap
page read and write
38F000
unkown
page execute and read and write
1D277000
heap
page read and write
47A1000
heap
page read and write
1D27F000
heap
page read and write
9F0000
heap
page read and write
1D280000
heap
page read and write
4CA000
unkown
page execute and read and write
1D29C000
heap
page read and write
2F570000
trusted library allocation
page read and write
9F4000
heap
page read and write
2F614000
heap
page read and write
DF0000
heap
page read and write
2F56E000
stack
page read and write
F5D000
stack
page read and write
2970000
direct allocation
page read and write
29390000
heap
page read and write
47A1000
heap
page read and write
47A0000
heap
page read and write
61ED3000
direct allocation
page read and write
1D27B000
heap
page read and write
47A1000
heap
page read and write
47A1000
heap
page read and write
6C8CE000
unkown
page read and write
1D281000
heap
page read and write
47A1000
heap
page read and write
47A1000
heap
page read and write
47A1000
heap
page read and write
1D29C000
heap
page read and write
47A1000
heap
page read and write
105E000
stack
page read and write
1D280000
heap
page read and write
E87000
heap
page read and write
47A1000
heap
page read and write
2990000
heap
page read and write
47A1000
heap
page read and write
2970000
direct allocation
page read and write
6C6DE000
unkown
page read and write
9F4000
heap
page read and write
6C8CF000
unkown
page write copy
4D90000
direct allocation
page execute and read and write
1D275000
heap
page read and write
1D265000
heap
page read and write
2F46E000
stack
page read and write
9F4000
heap
page read and write
2970000
direct allocation
page read and write
379E000
stack
page read and write
1D27F000
heap
page read and write
1D274000
heap
page read and write
3DDE000
stack
page read and write
119E000
stack
page read and write
1D28E000
heap
page read and write
47A1000
heap
page read and write
2970000
direct allocation
page read and write
47A1000
heap
page read and write
4D80000
direct allocation
page execute and read and write
1CE5E000
stack
page read and write
61ECD000
direct allocation
page readonly
47A1000
heap
page read and write
39E000
unkown
page execute and read and write
6C6CD000
unkown
page readonly
1D290000
heap
page read and write
1D28E000
heap
page read and write
2B1B000
stack
page read and write
47A1000
heap
page read and write
1D27F000
heap
page read and write
47A1000
heap
page read and write
1D29C000
heap
page read and write
47A1000
heap
page read and write
61ED0000
direct allocation
page read and write
1D272000
heap
page read and write
9F4000
heap
page read and write
47A1000
heap
page read and write
1D266000
heap
page read and write
1D28E000
heap
page read and write
1D27F000
heap
page read and write
1D28E000
heap
page read and write
1D27F000
heap
page read and write
1D265000
heap
page read and write
280000
unkown
page readonly
30F000
unkown
page execute and read and write
1D275000
heap
page read and write
1CB9F000
stack
page read and write
2ADF000
stack
page read and write
9F4000
heap
page read and write
47A1000
heap
page read and write
77E000
unkown
page execute and read and write
1D29C000
heap
page read and write
1D0EE000
stack
page read and write
47B0000
heap
page read and write
47A1000
heap
page read and write
4D70000
direct allocation
page execute and read and write
9F4000
heap
page read and write
47A1000
heap
page read and write
1D276000
heap
page read and write
339F000
stack
page read and write
1D28E000
heap
page read and write
1D27F000
heap
page read and write
61ED4000
direct allocation
page readonly
47A1000
heap
page read and write
47A1000
heap
page read and write
9F4000
heap
page read and write
4C00000
heap
page read and write
1D27F000
heap
page read and write
2FDF000
stack
page read and write
1D27E000
heap
page read and write
293EE000
heap
page read and write
419E000
stack
page read and write
2D5F000
stack
page read and write
47A1000
heap
page read and write
1D280000
heap
page read and write
109E000
stack
page read and write
293D6000
heap
page read and write
77E000
unkown
page execute and write copy
455E000
stack
page read and write
9F4000
heap
page read and write
1D28E000
heap
page read and write
47A1000
heap
page read and write
441E000
stack
page read and write
47A1000
heap
page read and write
365E000
stack
page read and write
4C5C000
stack
page read and write
61EB4000
direct allocation
page read and write
1D376000
heap
page read and write
91C000
unkown
page execute and read and write
2338C000
heap
page read and write
301E000
stack
page read and write
29431000
heap
page read and write
4DA0000
direct allocation
page execute and read and write
1D274000
heap
page read and write
1D27F000
heap
page read and write
1D266000
heap
page read and write
293D4000
heap
page read and write
47A1000
heap
page read and write
1D1EC000
stack
page read and write
329E000
stack
page read and write
9F4000
heap
page read and write
9F4000
heap
page read and write
2970000
direct allocation
page read and write
1D272000
heap
page read and write
1D296000
heap
page read and write
2970000
direct allocation
page read and write
47A1000
heap
page read and write
2970000
direct allocation
page read and write
1D250000
heap
page read and write
1D280000
heap
page read and write
E2A000
heap
page read and write
3A1E000
stack
page read and write
1D27A000
heap
page read and write
3C5F000
stack
page read and write
2970000
direct allocation
page read and write
F0D000
heap
page read and write
9F4000
heap
page read and write
2EDE000
stack
page read and write
1D28E000
heap
page read and write
312000
unkown
page execute and read and write
3EDE000
stack
page read and write
2960000
heap
page read and write
299E000
heap
page read and write
375F000
stack
page read and write
39B000
unkown
page execute and read and write
47A1000
heap
page read and write
1D27F000
heap
page read and write
CFD000
stack
page read and write
1D27B000
heap
page read and write
1D285000
heap
page read and write
293D0000
heap
page read and write
1D27B000
heap
page read and write
1CF5F000
stack
page read and write
47A1000
heap
page read and write
293E8000
heap
page read and write
77F000
unkown
page execute and write copy
9F4000
heap
page read and write
39DF000
stack
page read and write
2943D000
heap
page read and write
1D25B000
heap
page read and write
1D274000
heap
page read and write
9F4000
heap
page read and write
445000
unkown
page execute and read and write
1D29C000
heap
page read and write
1D252000
heap
page read and write
6C651000
unkown
page execute read
1D27B000
heap
page read and write
3F1E000
stack
page read and write
2E9F000
stack
page read and write
1D370000
trusted library allocation
page read and write
36F000
unkown
page execute and read and write
9F4000
heap
page read and write
469E000
stack
page read and write
4D5F000
stack
page read and write
768000
unkown
page execute and read and write
E20000
heap
page read and write
361F000
stack
page read and write
6C8D5000
unkown
page readonly
479F000
stack
page read and write
1CBDE000
stack
page read and write
47A1000
heap
page read and write
1D27C000
heap
page read and write
1D29C000
heap
page read and write
351E000
stack
page read and write
47A1000
heap
page read and write
1D29C000
heap
page read and write
43DF000
stack
page read and write
429F000
stack
page read and write
91D000
unkown
page execute and write copy
9F4000
heap
page read and write
1D282000
heap
page read and write
2F617000
heap
page read and write
1D29C000
heap
page read and write
1D293000
heap
page read and write
9F4000
heap
page read and write
401F000
stack
page read and write
1D272000
heap
page read and write
47A1000
heap
page read and write
1CA9E000
stack
page read and write
4C20000
direct allocation
page read and write
D10000
heap
page read and write
9F4000
heap
page read and write
1D280000
heap
page read and write
48A0000
trusted library allocation
page read and write
405E000
stack
page read and write
9F4000
heap
page read and write
2970000
direct allocation
page read and write
2997000
heap
page read and write
44B000
unkown
page execute and read and write
9F4000
heap
page read and write
61E00000
direct allocation
page execute and read and write
9F4000
heap
page read and write
1D28E000
heap
page read and write
47A1000
heap
page read and write
389F000
stack
page read and write
280000
unkown
page read and write
1D28D000
heap
page read and write
1D29C000
heap
page read and write
47A1000
heap
page read and write
1CFAD000
stack
page read and write
2F60F000
heap
page read and write
451F000
stack
page read and write
4DB0000
direct allocation
page execute and read and write
2D9E000
stack
page read and write
9F4000
heap
page read and write
47A1000
heap
page read and write
9F4000
heap
page read and write
299B000
heap
page read and write
9F4000
heap
page read and write
47A1000
heap
page read and write
47A1000
heap
page read and write
29DE000
stack
page read and write
4DC0000
direct allocation
page execute and read and write
1D275000
heap
page read and write
33D000
unkown
page execute and read and write
38DE000
stack
page read and write
1D270000
heap
page read and write
1D280000
heap
page read and write
47A1000
heap
page read and write
664000
unkown
page execute and read and write
465F000
stack
page read and write
61ECC000
direct allocation
page read and write
1D278000
heap
page read and write
47A1000
heap
page read and write
47A1000
heap
page read and write
1D27F000
heap
page read and write
47A1000
heap
page read and write
2C5E000
stack
page read and write
6C650000
unkown
page readonly
9F4000
heap
page read and write
47A1000
heap
page read and write
1D274000
heap
page read and write
34DF000
stack
page read and write
CF9000
stack
page read and write
3D9F000
stack
page read and write
415F000
stack
page read and write
47A1000
heap
page read and write
33DE000
stack
page read and write
293B0000
heap
page read and write
748000
unkown
page execute and read and write
47A1000
heap
page read and write
232EC000
heap
page read and write
1D27A000
heap
page read and write
2970000
direct allocation
page read and write
9F4000
heap
page read and write
47A1000
heap
page read and write
293DC000
heap
page read and write
1CE1F000
stack
page read and write
47A1000
heap
page read and write
4DA0000
direct allocation
page execute and read and write
6C6F0000
unkown
page readonly
2F606000
heap
page read and write
47A1000
heap
page read and write
2F60E000
heap
page read and write
47A1000
heap
page read and write
42DE000
stack
page read and write
9F4000
heap
page read and write
1CCDF000
stack
page read and write
1D28E000
heap
page read and write
362000
unkown
page execute and read and write
1D277000
heap
page read and write
1D274000
heap
page read and write
2DA000
unkown
page execute and read and write
293E5000
heap
page read and write
425000
unkown
page execute and read and write
47C0000
heap
page read and write
CF3000
stack
page read and write
47A1000
heap
page read and write
47A1000
heap
page read and write
1D0AD000
stack
page read and write
1CD1E000
stack
page read and write
47A1000
heap
page read and write
2970000
direct allocation
page read and write
1D27F000
heap
page read and write
281000
unkown
page execute and write copy
61EB7000
direct allocation
page readonly
6C6F1000
unkown
page execute read
47A1000
heap
page read and write
315E000
stack
page read and write
325F000
stack
page read and write
311F000
stack
page read and write
1D285000
heap
page read and write
331000
unkown
page execute and read and write
3B1F000
stack
page read and write
There are 364 hidden memdumps, click here to show them.