IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\DAEBFHJKJEBFCBFHDAEG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DGIJECGDGCBKECAKFBGC
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FHDHCAAKECFIDHIEBAKFCGCFCB
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FHIDBKFC
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FHIDBKFCAAEBFIDHDBAECFIEGC
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJECAAEHCFIEBGCBGHIE
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\KEGDBFIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KFHJJDHJEGHJKECBGCFHDBFIEG
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.206/
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/nss3.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/vcruntime140.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/softokn3.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/freebl3.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/msvcp140.dll
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/sqlite3.dll
185.215.113.206
 malicious
http://185.215.113.206/e2b1563c6670f193.php
185.215.113.206
 malicious
http://185.215.113.206/0d60be0de163924d/mozglue.dll
185.215.113.206
 malicious
http://185.215.113.206
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dllC1.
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.215.113.206/e2b1563c6670f193.php2
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
http://185.215.113.206/e2b1563c6670f193.phpPR
unknown
http://185.215.113.206/e2b1563c6670f193.phpP
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.113.206/0d60be0de163924d/nss3.dll#R
unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dll1)
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://185.215.113.206e2b1563c6670f193.phpion:
unknown
http://185.215.113.206/e2b1563c6670f193.phpH
unknown
http://185.215.113.206/e2b1563c6670f193.phpmainnet
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.206/e2b1563c6670f193.php=C
unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dll3.206
unknown
http://185.215.113.206/e2b1563c6670f193.phpBFHJKJEBFCBFHDAEG_
unknown
http://185.215.113.206/0d60be0de163924d/softokn3.dll;
unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dlla.
unknown
http://185.215.113.206/e2b1563c6670f193.phph
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://185.215.113.206/e2b1563c6670f193.phpam
unknown
http://185.215.113.206/e2b1563c6670f193.phpve
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.206/e2b1563c6670f193.php6)
unknown
http://185.215.113.206/e2b1563c6670f193.phpc=
unknown
http://185.215.113.206/e2b1563c6670f193.phps
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
http://185.215.113.206/e2b1563c6670f193.phpt
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
http://185.215.113.206/e2b1563c6670f193.phpion:
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://185.215.113.206/e2b1563c6670f193.php;Cj3%
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.206/e2b1563c6670f193.php-
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dllES
unknown
http://185.215.113.206/e2b1563c6670f193.phpCO
unknown
There are 53 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.206
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
79E000
heap
page read and write
 malicious
4D80000
direct allocation
page read and write
 malicious
FC1000
unkown
page execute and read and write
 malicious
4901000
heap
page read and write
2EBF000
stack
page read and write
1D3DC000
heap
page read and write
4901000
heap
page read and write
4F0E000
stack
page read and write
1D4C0000
trusted library allocation
page read and write
1D3C5000
heap
page read and write
4901000
heap
page read and write
B2E000
stack
page read and write
293A0000
heap
page read and write
61EB4000
direct allocation
page read and write
4F30000
direct allocation
page execute and read and write
101A000
unkown
page execute and read and write
47FE000
stack
page read and write
4EE0000
direct allocation
page execute and read and write
4901000
heap
page read and write
296B1000
heap
page read and write
1D3C7000
heap
page read and write
14C2000
unkown
page execute and read and write
4901000
heap
page read and write
1D3E9000
heap
page read and write
4901000
heap
page read and write
63C000
stack
page read and write
4901000
heap
page read and write
6C680000
unkown
page readonly
1D3B8000
heap
page read and write
61ED3000
direct allocation
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
29462000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
3F3D000
stack
page read and write
1D3E5000
heap
page read and write
1D3D7000
heap
page read and write
453F000
stack
page read and write
1D3E9000
heap
page read and write
790000
heap
page read and write
4901000
heap
page read and write
1D3D0000
heap
page read and write
E8E000
stack
page read and write
3B7E000
stack
page read and write
457E000
stack
page read and write
1D3DC000
heap
page read and write
7F7000
heap
page read and write
4901000
heap
page read and write
417F000
stack
page read and write
1D3D0000
heap
page read and write
8A0000
heap
page read and write
1D3C5000
heap
page read and write
1048000
unkown
page execute and read and write
3DFE000
stack
page read and write
2D90000
direct allocation
page read and write
4901000
heap
page read and write
1CFAE000
stack
page read and write
10DB000
unkown
page execute and read and write
3A3E000
stack
page read and write
6C860000
unkown
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
327F000
stack
page read and write
6F870000
unkown
page readonly
2D90000
direct allocation
page read and write
1D3CD000
heap
page read and write
4901000
heap
page read and write
1D3C5000
heap
page read and write
61E01000
direct allocation
page execute read
4901000
heap
page read and write
4EF0000
direct allocation
page execute and read and write
1D3B6000
heap
page read and write
2DBE000
heap
page read and write
1D3DD000
heap
page read and write
1489000
unkown
page execute and read and write
1D3CC000
heap
page read and write
1D33C000
stack
page read and write
4901000
heap
page read and write
890000
heap
page read and write
6F8FE000
unkown
page read and write
2D90000
direct allocation
page read and write
61EB7000
direct allocation
page readonly
7E3000
heap
page read and write
1CD0E000
stack
page read and write
4DBC000
stack
page read and write
2DB0000
heap
page read and write
61ECD000
direct allocation
page readonly
1CCCF000
stack
page read and write
121E000
unkown
page execute and read and write
F8F000
stack
page read and write
4901000
heap
page read and write
6C681000
unkown
page execute read
104F000
unkown
page execute and read and write
4901000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
1D3EC000
heap
page read and write
4901000
heap
page read and write
2D4F000
stack
page read and write
1D3E9000
heap
page read and write
2D90000
direct allocation
page read and write
3C7F000
stack
page read and write
4901000
heap
page read and write
1D3C2000
heap
page read and write
33FE000
stack
page read and write
4901000
heap
page read and write
1D3B5000
heap
page read and write
1D3C2000
heap
page read and write
1D3D0000
heap
page read and write
61E00000
direct allocation
page execute and read and write
407E000
stack
page read and write
14C3000
unkown
page execute and write copy
1D3D0000
heap
page read and write
6F8ED000
unkown
page readonly
950000
heap
page read and write
34FF000
stack
page read and write
42BF000
stack
page read and write
733000
stack
page read and write
61ED0000
direct allocation
page read and write
1D3DE000
heap
page read and write
107D000
unkown
page execute and read and write
6C81F000
unkown
page readonly
47BF000
stack
page read and write
4901000
heap
page read and write
C2E000
stack
page read and write
6C85F000
unkown
page write copy
1D4C6000
heap
page read and write
4901000
heap
page read and write
1D3C7000
heap
page read and write
816000
heap
page read and write
4901000
heap
page read and write
2EFE000
stack
page read and write
353E000
stack
page read and write
1D3C8000
heap
page read and write
3B3F000
stack
page read and write
10A2000
unkown
page execute and read and write
4901000
heap
page read and write
1D3E5000
heap
page read and write
33BF000
stack
page read and write
317E000
stack
page read and write
1185000
unkown
page execute and read and write
1D3B6000
heap
page read and write
296B2000
heap
page read and write
1D3CC000
heap
page read and write
4901000
heap
page read and write
1D3D3000
heap
page read and write
46BE000
stack
page read and write
1D3B6000
heap
page read and write
2D90000
direct allocation
page read and write
1CE4E000
stack
page read and write
296AC000
heap
page read and write
1D3D0000
heap
page read and write
FC0000
unkown
page read and write
2D90000
direct allocation
page read and write
1D3E9000
heap
page read and write
FA0000
heap
page read and write
2D90000
direct allocation
page read and write
4901000
heap
page read and write
6F902000
unkown
page readonly
1D3D3000
heap
page read and write
10AF000
unkown
page execute and read and write
4901000
heap
page read and write
41BE000
stack
page read and write
1D3C7000
heap
page read and write
1D3C7000
heap
page read and write
4901000
heap
page read and write
6C865000
unkown
page readonly
4D80000
direct allocation
page read and write
1165000
unkown
page execute and read and write
118B000
unkown
page execute and read and write
739000
stack
page read and write
1D3E9000
heap
page read and write
4901000
heap
page read and write
2D90000
direct allocation
page read and write
1D3CD000
heap
page read and write
4901000
heap
page read and write
4F10000
direct allocation
page execute and read and write
1D3DB000
heap
page read and write
1D3D0000
heap
page read and write
4901000
heap
page read and write
1D3DD000
heap
page read and write
1D3E2000
heap
page read and write
1D3E9000
heap
page read and write
1D3EC000
heap
page read and write
1D3EC000
heap
page read and write
955000
heap
page read and write
1D1FD000
stack
page read and write
1071000
unkown
page execute and read and write
1D3C5000
heap
page read and write
1D3CC000
heap
page read and write
798000
heap
page read and write
38BF000
stack
page read and write
1D3D0000
heap
page read and write
13A8000
unkown
page execute and read and write
1D3CD000
heap
page read and write
14AC000
unkown
page execute and read and write
4901000
heap
page read and write
2D90000
direct allocation
page read and write
61ED4000
direct allocation
page readonly
4901000
heap
page read and write
295FE000
stack
page read and write
1D3DB000
heap
page read and write
1D3D0000
heap
page read and write
2D90000
direct allocation
page read and write
467F000
stack
page read and write
1D3D0000
heap
page read and write
293E0000
heap
page read and write
7DF000
heap
page read and write
4901000
heap
page read and write
1D3D3000
heap
page read and write
1D3C5000
heap
page read and write
1D3E9000
heap
page read and write
1D3EA000
heap
page read and write
1D3DD000
heap
page read and write
4901000
heap
page read and write
1D3B6000
heap
page read and write
FC1000
unkown
page execute and write copy
4901000
heap
page read and write
94E000
stack
page read and write
4901000
heap
page read and write
2C4B000
stack
page read and write
4901000
heap
page read and write
1D3E9000
heap
page read and write
443E000
stack
page read and write
4920000
heap
page read and write
4901000
heap
page read and write
1D3AB000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
1663000
unkown
page execute and read and write
4901000
heap
page read and write
1D23E000
stack
page read and write
1D3DC000
heap
page read and write
4900000
heap
page read and write
293C0000
heap
page read and write
4901000
heap
page read and write
39FF000
stack
page read and write
1D3CC000
heap
page read and write
4A00000
trusted library allocation
page read and write
3DBF000
stack
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
90E000
stack
page read and write
6F871000
unkown
page execute read
37BE000
stack
page read and write
1D3D0000
heap
page read and write
403E000
stack
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
14B5000
unkown
page execute and read and write
1D0FE000
stack
page read and write
4ED0000
direct allocation
page execute and read and write
1D3C5000
heap
page read and write
1D3D0000
heap
page read and write
367E000
stack
page read and write
3EFF000
stack
page read and write
377F000
stack
page read and write
1D3D0000
heap
page read and write
4D80000
direct allocation
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
1D3D0000
heap
page read and write
32BE000
stack
page read and write
4EBF000
stack
page read and write
1D3D0000
heap
page read and write
4901000
heap
page read and write
1D3D0000
heap
page read and write
1CF4F000
stack
page read and write
303E000
stack
page read and write
4901000
heap
page read and write
1045000
unkown
page execute and read and write
FC0000
unkown
page readonly
1D3CD000
heap
page read and write
4F00000
direct allocation
page execute and read and write
4901000
heap
page read and write
4901000
heap
page read and write
61ECC000
direct allocation
page read and write
1D3D0000
heap
page read and write
38FE000
stack
page read and write
1D3DB000
heap
page read and write
29610000
trusted library allocation
page read and write
14C2000
unkown
page execute and write copy
4901000
heap
page read and write
1D3C5000
heap
page read and write
3CBE000
stack
page read and write
4901000
heap
page read and write
1D3A2000
heap
page read and write
6C85E000
unkown
page read and write
4F00000
direct allocation
page execute and read and write
23438000
heap
page read and write
1D3D0000
heap
page read and write
296A9000
heap
page read and write
1D3B6000
heap
page read and write
1D3C5000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
F90000
heap
page read and write
1D3DC000
heap
page read and write
2DBB000
heap
page read and write
296A4000
heap
page read and write
4901000
heap
page read and write
10CF000
unkown
page execute and read and write
1D3D6000
heap
page read and write
2D90000
direct allocation
page read and write
42FE000
stack
page read and write
4901000
heap
page read and write
2FFF000
stack
page read and write
1D3EC000
heap
page read and write
4F20000
direct allocation
page execute and read and write
1052000
unkown
page execute and read and write
1D3EC000
heap
page read and write
1D3C7000
heap
page read and write
1D3C4000
heap
page read and write
2D8E000
stack
page read and write
4901000
heap
page read and write
43FF000
stack
page read and write
4901000
heap
page read and write
1D0AF000
stack
page read and write
4901000
heap
page read and write
2D90000
direct allocation
page read and write
294FE000
stack
page read and write
1D3E9000
heap
page read and write
313F000
stack
page read and write
1CE0F000
stack
page read and write
1D3CB000
heap
page read and write
1D3D0000
heap
page read and write
1D3C2000
heap
page read and write
4910000
heap
page read and write
2D90000
direct allocation
page read and write
29401000
heap
page read and write
120A000
unkown
page execute and read and write
48FF000
stack
page read and write
73D000
stack
page read and write
4901000
heap
page read and write
2DB7000
heap
page read and write
1D3A0000
heap
page read and write
2D90000
direct allocation
page read and write
363F000
stack
page read and write
There are 330 hidden memdumps, click here to show them.