IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AEGHJEGIEBFIJJKFIIIJKEHJKJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\BFHIJEBKEBGHIDHJKJEG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DAEGIDHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DGHJEHJJDAAAKEBGCFCA
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\GDAAKKEH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\GHIDHCBGDHJKEBGDGIJE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GHIDHCBGDHJKEBGDGIJECFIDGC
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.100/e2b1563c6670f193.phpo
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dllllVp
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpb
unknown
 malicious
http://185.215.113.100/
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpho
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php
185.215.113.100
 malicious
http://185.215.113.100
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll2
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dll
185.215.113.100
 malicious
http://185.215.113.100#G
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php0oQ
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dlllC
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpata
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dllllDp
unknown
 malicious
http://185.215.113.100e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll6
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpBOK
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpdo
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dlljp
unknown
 malicious
185.215.113.100/e2b1563c6670f193.php
malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll%
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpnfigOverlay
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll.
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dllz
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dllll
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpDHCBGDHJKEBGDGIJEq
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
There are 46 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.100
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
146E000
heap
page read and write
 malicious
1420000
heap
page read and write
1DAC6000
heap
page read and write
6CD70000
unkown
page read and write
425E000
stack
page read and write
4FA0000
trusted library allocation
page read and write
359F000
stack
page read and write
1DAD4000
heap
page read and write
4EA1000
heap
page read and write
6CB7E000
unkown
page read and write
15D4000
heap
page read and write
15D4000
heap
page read and write
1DADA000
heap
page read and write
29B64000
heap
page read and write
1D52F000
stack
page read and write
3157000
heap
page read and write
15D4000
heap
page read and write
314E000
stack
page read and write
1DACC000
heap
page read and write
1DAE3000
heap
page read and write
4EA1000
heap
page read and write
1DAD7000
heap
page read and write
385E000
stack
page read and write
4EA1000
heap
page read and write
489E000
stack
page read and write
315B000
heap
page read and write
6CD2F000
unkown
page readonly
17ED000
stack
page read and write
1DABA000
heap
page read and write
1DAB9000
heap
page read and write
9A1000
unkown
page execute and read and write
3150000
heap
page read and write
15C0000
direct allocation
page read and write
3C1E000
stack
page read and write
4EA1000
heap
page read and write
4EA1000
heap
page read and write
536B000
stack
page read and write
D66000
unkown
page execute and read and write
1DACB000
heap
page read and write
61ECD000
direct allocation
page readonly
15C0000
direct allocation
page read and write
61ED0000
direct allocation
page read and write
1DAF1000
heap
page read and write
1DAF1000
heap
page read and write
B4D000
unkown
page execute and read and write
1D3EF000
stack
page read and write
4EA1000
heap
page read and write
5310000
heap
page read and write
15D4000
heap
page read and write
449F000
stack
page read and write
1DACD000
heap
page read and write
1DAD0000
heap
page read and write
61ED4000
direct allocation
page readonly
6CB6D000
unkown
page readonly
4EA1000
heap
page read and write
4EA1000
heap
page read and write
15C0000
direct allocation
page read and write
15D4000
heap
page read and write
15D4000
heap
page read and write
2FC6E000
stack
page read and write
335F000
stack
page read and write
3F9F000
stack
page read and write
23B33000
heap
page read and write
4B1E000
stack
page read and write
315E000
heap
page read and write
9A1000
unkown
page execute and write copy
15C0000
direct allocation
page read and write
B27000
unkown
page execute and read and write
399E000
stack
page read and write
1DABA000
heap
page read and write
3D1F000
stack
page read and write
6CD75000
unkown
page readonly
4EA1000
heap
page read and write
E82000
unkown
page execute and write copy
61EB7000
direct allocation
page readonly
4D9E000
stack
page read and write
4EA1000
heap
page read and write
15D4000
heap
page read and write
14E6000
heap
page read and write
1DAD4000
heap
page read and write
15D4000
heap
page read and write
4EB2000
heap
page read and write
4EA1000
heap
page read and write
1DACC000
heap
page read and write
18EE000
stack
page read and write
4EA1000
heap
page read and write
4C5E000
stack
page read and write
4EA1000
heap
page read and write
E6C000
unkown
page execute and read and write
A64000
unkown
page execute and read and write
4EA1000
heap
page read and write
15D4000
heap
page read and write
29B6E000
heap
page read and write
4EA1000
heap
page read and write
310B000
stack
page read and write
1DAF1000
heap
page read and write
1DAF1000
heap
page read and write
15D4000
heap
page read and write
15D4000
heap
page read and write
15D4000
heap
page read and write
4EA1000
heap
page read and write
1D7BD000
stack
page read and write
4EB0000
heap
page read and write
1DABA000
heap
page read and write
1DAB9000
heap
page read and write
61E01000
direct allocation
page execute read
15D4000
heap
page read and write
485F000
stack
page read and write
1DACD000
heap
page read and write
1DAB9000
heap
page read and write
3FDE000
stack
page read and write
1DAC8000
heap
page read and write
61E00000
direct allocation
page execute and read and write
3E5F000
stack
page read and write
1DBCB000
heap
page read and write
15C0000
direct allocation
page read and write
4EA1000
heap
page read and write
1DAC9000
heap
page read and write
1DAD2000
heap
page read and write
15C0000
direct allocation
page read and write
15D4000
heap
page read and write
4EA1000
heap
page read and write
4C1F000
stack
page read and write
15C0000
direct allocation
page read and write
15D4000
heap
page read and write
29AA0000
heap
page read and write
11B3000
stack
page read and write
4EA1000
heap
page read and write
15C0000
direct allocation
page read and write
1D2EE000
stack
page read and write
A91000
unkown
page execute and read and write
1DAC8000
heap
page read and write
2FC80000
trusted library allocation
page read and write
1555000
heap
page read and write
6CAF0000
unkown
page readonly
159E000
stack
page read and write
1DAC4000
heap
page read and write
1DAC9000
heap
page read and write
1DAD7000
heap
page read and write
1DAD4000
heap
page read and write
1DAD4000
heap
page read and write
54D0000
direct allocation
page execute and read and write
1DACF000
heap
page read and write
35DE000
stack
page read and write
1DACE000
heap
page read and write
1D6BD000
stack
page read and write
2FD1C000
heap
page read and write
6CB82000
unkown
page readonly
1024000
unkown
page execute and read and write
15D4000
heap
page read and write
14AF000
heap
page read and write
15D4000
heap
page read and write
1DAC1000
heap
page read and write
15D4000
heap
page read and write
15D4000
heap
page read and write
15C0000
direct allocation
page read and write
395F000
stack
page read and write
4EA1000
heap
page read and write
1DABA000
heap
page read and write
3ADE000
stack
page read and write
1DAD8000
heap
page read and write
1DABA000
heap
page read and write
1D57E000
stack
page read and write
14C9000
heap
page read and write
4EA1000
heap
page read and write
1DAF0000
heap
page read and write
4EA1000
heap
page read and write
40DF000
stack
page read and write
4EA1000
heap
page read and write
1DAD4000
heap
page read and write
4EA1000
heap
page read and write
435F000
stack
page read and write
4EC0000
heap
page read and write
471E000
stack
page read and write
4EA1000
heap
page read and write
1DAAF000
heap
page read and write
A9D000
unkown
page execute and read and write
2FB6E000
stack
page read and write
1DAD4000
heap
page read and write
4EA1000
heap
page read and write
3A9F000
stack
page read and write
15D4000
heap
page read and write
15D4000
heap
page read and write
29AC0000
heap
page read and write
15B0000
heap
page read and write
1DAC8000
heap
page read and write
546F000
stack
page read and write
1DAC6000
heap
page read and write
15C0000
direct allocation
page read and write
54B0000
direct allocation
page execute and read and write
1DAF1000
heap
page read and write
9DC000
unkown
page execute and read and write
4EA1000
heap
page read and write
4EA0000
heap
page read and write
29B00000
heap
page read and write
475E000
stack
page read and write
1DAC6000
heap
page read and write
4EA1000
heap
page read and write
A0A000
unkown
page execute and read and write
E82000
unkown
page execute and read and write
1DADF000
heap
page read and write
4EA1000
heap
page read and write
4EA1000
heap
page read and write
1DAD4000
heap
page read and write
1DA9D000
stack
page read and write
4EA1000
heap
page read and write
4EA1000
heap
page read and write
499F000
stack
page read and write
4EA1000
heap
page read and write
15D4000
heap
page read and write
1DAF1000
heap
page read and write
15D4000
heap
page read and write
1DACE000
heap
page read and write
4E9F000
stack
page read and write
B47000
unkown
page execute and read and write
2FD24000
heap
page read and write
4EA1000
heap
page read and write
BE0000
unkown
page execute and read and write
2FD16000
heap
page read and write
AA0000
unkown
page execute and read and write
15D0000
heap
page read and write
54A0000
direct allocation
page execute and read and write
11BD000
stack
page read and write
1D8FC000
stack
page read and write
4EA1000
heap
page read and write
1DACC000
heap
page read and write
4EA1000
heap
page read and write
371E000
stack
page read and write
5330000
direct allocation
page read and write
4EA1000
heap
page read and write
1DABA000
heap
page read and write
4EA1000
heap
page read and write
29AE0000
heap
page read and write
461E000
stack
page read and write
1DAC9000
heap
page read and write
1DABA000
heap
page read and write
1DACC000
heap
page read and write
1D99E000
stack
page read and write
1DACE000
heap
page read and write
146A000
heap
page read and write
411E000
stack
page read and write
1DAD0000
heap
page read and write
4EA1000
heap
page read and write
44DD000
stack
page read and write
1DADF000
heap
page read and write
E4A000
unkown
page execute and read and write
421F000
stack
page read and write
4EA1000
heap
page read and write
1D7FD000
stack
page read and write
1DBC0000
trusted library allocation
page read and write
61EB4000
direct allocation
page read and write
30CE000
stack
page read and write
1DAC8000
heap
page read and write
1DADF000
heap
page read and write
1DAD4000
heap
page read and write
4EA1000
heap
page read and write
E83000
unkown
page execute and write copy
1DAD4000
heap
page read and write
1DAC1000
heap
page read and write
3BDF000
stack
page read and write
1DADB000
heap
page read and write
5480000
direct allocation
page execute and read and write
15D4000
heap
page read and write
4EA1000
heap
page read and write
4EA1000
heap
page read and write
61ED3000
direct allocation
page read and write
381F000
stack
page read and write
1D42E000
stack
page read and write
1DAF1000
heap
page read and write
1DAF1000
heap
page read and write
15D4000
heap
page read and write
15D4000
heap
page read and write
15D4000
heap
page read and write
2FD1E000
heap
page read and write
1DAD4000
heap
page read and write
1DAC8000
heap
page read and write
14B3000
heap
page read and write
4EA1000
heap
page read and write
1D67F000
stack
page read and write
4EA1000
heap
page read and write
15D4000
heap
page read and write
4EA1000
heap
page read and write
4EA1000
heap
page read and write
45DF000
stack
page read and write
1DAD4000
heap
page read and write
15C0000
direct allocation
page read and write
1460000
heap
page read and write
1DAC1000
heap
page read and write
4EA1000
heap
page read and write
17AF000
stack
page read and write
9A0000
unkown
page read and write
15D4000
heap
page read and write
6CB90000
unkown
page readonly
15D4000
heap
page read and write
54B0000
direct allocation
page execute and read and write
E75000
unkown
page execute and read and write
1DACE000
heap
page read and write
1DADC000
heap
page read and write
15C0000
direct allocation
page read and write
1025000
unkown
page execute and write copy
1410000
heap
page read and write
1DABA000
heap
page read and write
4EA1000
heap
page read and write
1D2AF000
stack
page read and write
5330000
direct allocation
page read and write
49DE000
stack
page read and write
A3F000
unkown
page execute and read and write
1DAD3000
heap
page read and write
1DAD4000
heap
page read and write
4EA1000
heap
page read and write
1DAE1000
heap
page read and write
1D1AE000
stack
page read and write
1DACE000
heap
page read and write
1DACE000
heap
page read and write
5330000
direct allocation
page read and write
2FD24000
heap
page read and write
15D4000
heap
page read and write
1DAA0000
heap
page read and write
6CD6F000
unkown
page write copy
4ADF000
stack
page read and write
10BC000
stack
page read and write
1DAD4000
heap
page read and write
54C0000
direct allocation
page execute and read and write
1DACE000
heap
page read and write
4EA1000
heap
page read and write
439E000
stack
page read and write
15D4000
heap
page read and write
15D4000
heap
page read and write
1DAF1000
heap
page read and write
6CB91000
unkown
page execute read
325F000
stack
page read and write
4EA1000
heap
page read and write
4EA1000
heap
page read and write
1DACE000
heap
page read and write
4EA1000
heap
page read and write
15C0000
direct allocation
page read and write
4EA1000
heap
page read and write
4EA1000
heap
page read and write
61ECC000
direct allocation
page read and write
1DAC1000
heap
page read and write
9A0000
unkown
page readonly
3D5E000
stack
page read and write
A33000
unkown
page execute and read and write
15D4000
heap
page read and write
1DAD4000
heap
page read and write
4D5F000
stack
page read and write
A71000
unkown
page execute and read and write
6CAF1000
unkown
page execute read
4EA1000
heap
page read and write
11B9000
stack
page read and write
36DF000
stack
page read and write
4EA1000
heap
page read and write
1DACE000
heap
page read and write
4EA1000
heap
page read and write
15C0000
direct allocation
page read and write
1DAA6000
heap
page read and write
4EA1000
heap
page read and write
1DAD4000
heap
page read and write
4EA1000
heap
page read and write
345F000
stack
page read and write
4EA1000
heap
page read and write
15D4000
heap
page read and write
6CD6E000
unkown
page read and write
349E000
stack
page read and write
4EA1000
heap
page read and write
15D4000
heap
page read and write
15D4000
heap
page read and write
3E9E000
stack
page read and write
1DAF1000
heap
page read and write
There are 359 hidden memdumps, click here to show them.