IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\CGHDAKKJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DAAFBAKECAEGCBFIEGDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DAAFBAKECAEGCBFIEGDGIEGIEH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EBFBKFBGIIIDGDGCFCGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EBGCFBGCBFHJECBGDAKKJDGHII
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\ECGIIIDAKJDHJKFHIEBFCGHCGH
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\GCGCFCBAKKFBFIECAEBA
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\GIIEGHIDBGHIECAAECGDAEHDHJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JKEGDHCF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpata
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpX%
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdlld
unknown
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllP
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phprowser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/N?
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll563c6670f193.php
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll4
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phplS
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php4%
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll$
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll:$
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpe
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/Q?D
unknown
 malicious
http://185.215.113.37r
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll8
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCl&
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllF
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpH
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllp
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllV
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlljo
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpx&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php9
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
There are 51 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
AB1000
unkown
page execute and read and write
 malicious
5CE000
heap
page read and write
 malicious
4B50000
direct allocation
page read and write
 malicious
46AF000
stack
page read and write
3F6E000
stack
page read and write
456F000
stack
page read and write
46C1000
heap
page read and write
46B0000
direct allocation
page read and write
689000
heap
page read and write
2F2AB000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
1158000
unkown
page execute and write copy
1D176000
heap
page read and write
1D17D000
heap
page read and write
1D175000
heap
page read and write
1D193000
heap
page read and write
46C1000
heap
page read and write
1CC0E000
stack
page read and write
29EB000
heap
page read and write
61ED3000
direct allocation
page read and write
61ECD000
direct allocation
page readonly
46C1000
heap
page read and write
46C1000
heap
page read and write
442F000
stack
page read and write
2F2E000
stack
page read and write
1D18A000
heap
page read and write
46C1000
heap
page read and write
1D188000
heap
page read and write
302F000
stack
page read and write
46B0000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
29180000
heap
page read and write
646000
heap
page read and write
1D190000
heap
page read and write
1CEBD000
stack
page read and write
6BA000
heap
page read and write
6CD50000
unkown
page read and write
1D184000
heap
page read and write
1D175000
heap
page read and write
46C1000
heap
page read and write
36AE000
stack
page read and write
FB5000
unkown
page execute and write copy
366F000
stack
page read and write
432E000
stack
page read and write
46C1000
heap
page read and write
1CFBD000
stack
page read and write
46C1000
heap
page read and write
42EF000
stack
page read and write
32EE000
stack
page read and write
1D16B000
heap
page read and write
1D176000
heap
page read and write
4CD0000
direct allocation
page execute and read and write
1D190000
heap
page read and write
46C1000
heap
page read and write
D0E000
unkown
page execute and read and write
3A6E000
stack
page read and write
2AEF000
stack
page read and write
1D190000
heap
page read and write
3BAE000
stack
page read and write
46C1000
heap
page read and write
1D18A000
heap
page read and write
46C1000
heap
page read and write
43C000
stack
page read and write
446E000
stack
page read and write
1CFFD000
stack
page read and write
1D18A000
heap
page read and write
29EE000
heap
page read and write
1D1AD000
heap
page read and write
1D1AD000
heap
page read and write
46C1000
heap
page read and write
A0F000
stack
page read and write
46C1000
heap
page read and write
1D176000
heap
page read and write
1D182000
heap
page read and write
291D5000
heap
page read and write
46C1000
heap
page read and write
392E000
stack
page read and write
B0A000
unkown
page execute and read and write
1D190000
heap
page read and write
1D180000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
1D162000
heap
page read and write
297E000
stack
page read and write
4B50000
direct allocation
page read and write
C7B000
unkown
page execute and read and write
1D1AD000
heap
page read and write
46C1000
heap
page read and write
A5E000
stack
page read and write
46C1000
heap
page read and write
46E0000
heap
page read and write
1D190000
heap
page read and write
46C1000
heap
page read and write
1D189000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
65E000
heap
page read and write
2BEF000
stack
page read and write
6CD4E000
unkown
page read and write
90E000
stack
page read and write
46C1000
heap
page read and write
61ED0000
direct allocation
page read and write
46B0000
direct allocation
page read and write
8CF000
stack
page read and write
1157000
unkown
page execute and read and write
46C1000
heap
page read and write
1D190000
heap
page read and write
4CB0000
direct allocation
page execute and read and write
61EB7000
direct allocation
page readonly
46C1000
heap
page read and write
291DE000
heap
page read and write
46C1000
heap
page read and write
32AF000
stack
page read and write
46B0000
direct allocation
page read and write
1D188000
heap
page read and write
FA5000
unkown
page execute and read and write
46B0000
direct allocation
page read and write
1D18A000
heap
page read and write
291CD000
heap
page read and write
3CED000
stack
page read and write
6A0000
heap
page read and write
6CB71000
unkown
page execute read
4CF0000
direct allocation
page execute and read and write
BCE000
unkown
page execute and read and write
2DEF000
stack
page read and write
1D182000
heap
page read and write
1D1AD000
heap
page read and write
46C1000
heap
page read and write
580000
heap
page read and write
37AF000
stack
page read and write
1CACE000
stack
page read and write
AB1000
unkown
page execute and write copy
31AE000
stack
page read and write
6CD0F000
unkown
page readonly
1D185000
heap
page read and write
1D160000
heap
page read and write
1D190000
heap
page read and write
1D189000
heap
page read and write
3F2F000
stack
page read and write
1D175000
heap
page read and write
1D18C000
heap
page read and write
6CB4D000
unkown
page readonly
46C1000
heap
page read and write
1D18A000
heap
page read and write
61ED4000
direct allocation
page readonly
1D190000
heap
page read and write
1D17D000
heap
page read and write
1D19B000
heap
page read and write
46C1000
heap
page read and write
1D185000
heap
page read and write
29160000
heap
page read and write
46C1000
heap
page read and write
4CC0000
direct allocation
page execute and read and write
6CB5E000
unkown
page read and write
2EEF000
stack
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
306E000
stack
page read and write
46C1000
heap
page read and write
46B0000
direct allocation
page read and write
BBF000
unkown
page execute and read and write
1D185000
heap
page read and write
4CDE000
stack
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
AA0000
heap
page read and write
46C1000
heap
page read and write
1D176000
heap
page read and write
629000
heap
page read and write
3DEF000
stack
page read and write
533000
stack
page read and write
B42000
unkown
page execute and read and write
46C1000
heap
page read and write
5C0000
heap
page read and write
29222000
heap
page read and write
1D19D000
heap
page read and write
61E01000
direct allocation
page execute read
3E2E000
stack
page read and write
46B0000
direct allocation
page read and write
C55000
unkown
page execute and read and write
F9C000
unkown
page execute and read and write
B9F000
unkown
page execute and read and write
46B0000
direct allocation
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
1D18C000
heap
page read and write
46C1000
heap
page read and write
1D1AD000
heap
page read and write
291C4000
heap
page read and write
1D190000
heap
page read and write
46C1000
heap
page read and write
BCB000
unkown
page execute and read and write
4CA0000
direct allocation
page execute and read and write
1F0000
heap
page read and write
46C1000
heap
page read and write
316F000
stack
page read and write
46B0000
direct allocation
page read and write
1D190000
heap
page read and write
FB6000
unkown
page execute and write copy
46C1000
heap
page read and write
1D193000
heap
page read and write
1CD7E000
stack
page read and write
1D18A000
heap
page read and write
1F5000
heap
page read and write
1D184000
heap
page read and write
46D0000
heap
page read and write
46C1000
heap
page read and write
4CE0000
direct allocation
page execute and read and write
6CAD0000
unkown
page readonly
46B0000
direct allocation
page read and write
4C8F000
stack
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
1D1AD000
heap
page read and write
539000
stack
page read and write
1D280000
trusted library allocation
page read and write
46C1000
heap
page read and write
1D18B000
heap
page read and write
1D17A000
heap
page read and write
AB0000
unkown
page read and write
1D190000
heap
page read and write
A9B000
stack
page read and write
46C0000
heap
page read and write
46C1000
heap
page read and write
1D1AD000
heap
page read and write
1D190000
heap
page read and write
1CD0F000
stack
page read and write
1D18A000
heap
page read and write
1D197000
heap
page read and write
1D28E000
heap
page read and write
1D1AC000
heap
page read and write
342E000
stack
page read and write
1D19B000
heap
page read and write
1D188000
heap
page read and write
B35000
unkown
page execute and read and write
1D196000
heap
page read and write
1D190000
heap
page read and write
406F000
stack
page read and write
2F200000
trusted library allocation
page read and write
1D1AD000
heap
page read and write
41EE000
stack
page read and write
7CE000
stack
page read and write
AB0000
unkown
page readonly
291A0000
heap
page read and write
53D000
stack
page read and write
46B0000
direct allocation
page read and write
1D194000
heap
page read and write
41AF000
stack
page read and write
46C1000
heap
page read and write
1D187000
heap
page read and write
C75000
unkown
page execute and read and write
1D18F000
heap
page read and write
1D1AD000
heap
page read and write
1D1AD000
heap
page read and write
291D9000
heap
page read and write
46C1000
heap
page read and write
1D176000
heap
page read and write
38EF000
stack
page read and write
1D182000
heap
page read and write
47C0000
trusted library allocation
page read and write
B6D000
unkown
page execute and read and write
46C1000
heap
page read and write
1D184000
heap
page read and write
F75000
unkown
page execute and read and write
4CD0000
direct allocation
page execute and read and write
1D190000
heap
page read and write
1D18A000
heap
page read and write
6CD55000
unkown
page readonly
1D19F000
heap
page read and write
291C7000
heap
page read and write
1D188000
heap
page read and write
46C1000
heap
page read and write
570000
heap
page read and write
1D198000
heap
page read and write
694000
heap
page read and write
69B000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
1D184000
heap
page read and write
1D0FC000
stack
page read and write
68E000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
1D176000
heap
page read and write
29224000
heap
page read and write
291C2000
heap
page read and write
FB5000
unkown
page execute and read and write
3CAF000
stack
page read and write
B3F000
unkown
page execute and read and write
6CB70000
unkown
page readonly
40AE000
stack
page read and write
4B50000
direct allocation
page read and write
1D17C000
heap
page read and write
46C1000
heap
page read and write
29E7000
heap
page read and write
2F2A1000
heap
page read and write
46B0000
direct allocation
page read and write
46C1000
heap
page read and write
6CAD1000
unkown
page execute read
1CA8F000
stack
page read and write
231FB000
heap
page read and write
3A2F000
stack
page read and write
2F29D000
heap
page read and write
46C1000
heap
page read and write
1D17D000
heap
page read and write
352F000
stack
page read and write
46C1000
heap
page read and write
33EF000
stack
page read and write
B92000
unkown
page execute and read and write
61ECC000
direct allocation
page read and write
1D18F000
heap
page read and write
45AE000
stack
page read and write
46C1000
heap
page read and write
2CEF000
stack
page read and write
1D18E000
heap
page read and write
37EE000
stack
page read and write
29226000
heap
page read and write
46B0000
direct allocation
page read and write
29E0000
heap
page read and write
5CA000
heap
page read and write
29C0000
heap
page read and write
356E000
stack
page read and write
46C1000
heap
page read and write
4B8C000
stack
page read and write
61EB4000
direct allocation
page read and write
6CD4F000
unkown
page write copy
E9A000
unkown
page execute and read and write
46C1000
heap
page read and write
293E000
stack
page read and write
1D176000
heap
page read and write
46C1000
heap
page read and write
B38000
unkown
page execute and read and write
1CE7F000
stack
page read and write
B61000
unkown
page execute and read and write
1D18A000
heap
page read and write
46C1000
heap
page read and write
1D190000
heap
page read and write
291C0000
heap
page read and write
6CB62000
unkown
page readonly
1D184000
heap
page read and write
2F299000
heap
page read and write
3B6F000
stack
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
1CBCF000
stack
page read and write
29BE000
stack
page read and write
46B0000
direct allocation
page read and write
2F2A5000
heap
page read and write
46C1000
heap
page read and write
612000
heap
page read and write
46C1000
heap
page read and write
There are 344 hidden memdumps, click here to show them.