IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BFHJECAAAFHIJKFIJEGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BGCAFHCAKFBFIECAFIIJ
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\CFIEGDAEHIEHIDHJDAAK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CGIEGHJEGHJKFIEBFHJKKKFHCF
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DGHCBAAE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\EHIIIJDAAAAAAKECBFBAEBKJJJ
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GDHIDHIEGIIIECAKEBFBAAEBKF
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\HDAFBGIJKEGIECAAFHDHDGCBFC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IECBGIDA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dlli
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phps
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll1
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dlllle
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php3c_
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phptream
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dll3
unknown
 malicious
http://185.215.113.100/
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpg
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpfKc
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dllC
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dllllM
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpO
unknown
 malicious
http://185.215.113.100
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpodus.wallet
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php;
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dllx
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpC
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phppP
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dll#
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dlli
unknown
 malicious
http://185.215.113.100e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpC)
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.php=c)
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpLc
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll.
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dllll
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
There are 49 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
198.187.3.20.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
185.215.113.100
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
175E000
heap
page read and write
 malicious
1D99D000
heap
page read and write
49EE000
stack
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
3FEE000
stack
page read and write
4EE1000
heap
page read and write
1D9AA000
heap
page read and write
54E0000
direct allocation
page execute and read and write
49AF000
stack
page read and write
1D9B3000
heap
page read and write
2FBEC000
heap
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
1D9B4000
heap
page read and write
372E000
stack
page read and write
2FBFD000
heap
page read and write
4EE1000
heap
page read and write
39AE000
stack
page read and write
4EE1000
heap
page read and write
1D9A7000
heap
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
1D995000
heap
page read and write
4EE1000
heap
page read and write
29A30000
heap
page read and write
1D9A2000
heap
page read and write
4EE1000
heap
page read and write
4ED0000
direct allocation
page read and write
1D9A4000
heap
page read and write
16F0000
heap
page read and write
4EE1000
heap
page read and write
1D99C000
heap
page read and write
1D9AA000
heap
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
1D9B0000
heap
page read and write
1D9B6000
heap
page read and write
6CBA0000
unkown
page readonly
4EE1000
heap
page read and write
4EE1000
heap
page read and write
E91000
unkown
page execute and read and write
1D9A5000
heap
page read and write
1D996000
heap
page read and write
4EE1000
heap
page read and write
1D9B0000
heap
page read and write
4EE1000
heap
page read and write
1D9B0000
heap
page read and write
1D995000
heap
page read and write
3C2E000
stack
page read and write
346F000
stack
page read and write
53AC000
stack
page read and write
1430000
heap
page read and write
4ED0000
direct allocation
page read and write
1700000
heap
page read and write
1D9CD000
heap
page read and write
5500000
direct allocation
page execute and read and write
1D9BD000
heap
page read and write
1D996000
heap
page read and write
1D9B0000
heap
page read and write
4EE1000
heap
page read and write
54FE000
stack
page read and write
4EE1000
heap
page read and write
4ED0000
direct allocation
page read and write
54F0000
direct allocation
page execute and read and write
4EE1000
heap
page read and write
61ED4000
direct allocation
page readonly
43AE000
stack
page read and write
1D995000
heap
page read and write
1D9B0000
heap
page read and write
1D3EF000
stack
page read and write
382F000
stack
page read and write
17A6000
heap
page read and write
15BE000
stack
page read and write
6CD80000
unkown
page read and write
472F000
stack
page read and write
1D9BB000
heap
page read and write
1D9B7000
heap
page read and write
170E000
heap
page read and write
1D9CD000
heap
page read and write
4EE1000
heap
page read and write
29A33000
heap
page read and write
4EE1000
heap
page read and write
6FD7D000
unkown
page readonly
4EE1000
heap
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
17D6000
heap
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
4ED0000
direct allocation
page read and write
5510000
direct allocation
page execute and read and write
36EF000
stack
page read and write
4AEF000
stack
page read and write
2FA4E000
stack
page read and write
3E6F000
stack
page read and write
29970000
heap
page read and write
4EE1000
heap
page read and write
6CD3F000
unkown
page readonly
4EE1000
heap
page read and write
299B0000
heap
page read and write
1D9AA000
heap
page read and write
1D9A5000
heap
page read and write
3AAF000
stack
page read and write
170B000
heap
page read and write
9FC000
unkown
page execute and read and write
299D0000
heap
page read and write
4C2F000
stack
page read and write
4EE1000
heap
page read and write
1D9A4000
heap
page read and write
A53000
unkown
page execute and read and write
322B000
stack
page read and write
1D9B0000
heap
page read and write
11D8000
stack
page read and write
44AF000
stack
page read and write
1D91D000
stack
page read and write
422F000
stack
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
1D9A2000
heap
page read and write
1D9CD000
heap
page read and write
476E000
stack
page read and write
1D7DC000
stack
page read and write
C00000
unkown
page execute and read and write
1750000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D9B0000
heap
page read and write
1D9A4000
heap
page read and write
4ED0000
direct allocation
page read and write
2FBF5000
heap
page read and write
4EF0000
heap
page read and write
462E000
stack
page read and write
4EE1000
heap
page read and write
1D6DD000
stack
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
1D996000
heap
page read and write
4EE1000
heap
page read and write
4EF6000
heap
page read and write
E6E000
unkown
page execute and read and write
174E000
stack
page read and write
1D9B0000
heap
page read and write
61ED3000
direct allocation
page read and write
1D99A000
heap
page read and write
EA8000
unkown
page execute and write copy
1D9A9000
heap
page read and write
1D996000
heap
page read and write
4EE1000
heap
page read and write
1D9CD000
heap
page read and write
4C6E000
stack
page read and write
4EE1000
heap
page read and write
34AE000
stack
page read and write
29990000
heap
page read and write
1D9A8000
heap
page read and write
6CD7F000
unkown
page write copy
1D9CD000
heap
page read and write
4EE1000
heap
page read and write
396F000
stack
page read and write
1707000
heap
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
16DE000
stack
page read and write
1D9CC000
heap
page read and write
1D9B0000
heap
page read and write
1D9CD000
heap
page read and write
3AEE000
stack
page read and write
1D52F000
stack
page read and write
9C1000
unkown
page execute and write copy
4D6F000
stack
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
1D9BF000
heap
page read and write
1D9AC000
heap
page read and write
1D9AA000
heap
page read and write
2FBFA000
heap
page read and write
E99000
unkown
page execute and read and write
1D980000
heap
page read and write
1D9AA000
heap
page read and write
4EE1000
heap
page read and write
1045000
unkown
page execute and write copy
45EF000
stack
page read and write
6CBA1000
unkown
page execute read
5370000
direct allocation
page read and write
61EB7000
direct allocation
page readonly
4EE1000
heap
page read and write
4ED0000
direct allocation
page read and write
412E000
stack
page read and write
1D9CD000
heap
page read and write
4EE1000
heap
page read and write
4ED0000
direct allocation
page read and write
1D2AF000
stack
page read and write
1D59E000
stack
page read and write
1D9AB000
heap
page read and write
1D9A0000
heap
page read and write
1D9A8000
heap
page read and write
6CD7E000
unkown
page read and write
1D9A5000
heap
page read and write
5370000
direct allocation
page read and write
4FE0000
trusted library allocation
page read and write
1D9AA000
heap
page read and write
4EB0000
heap
page read and write
11D2000
stack
page read and write
4EE1000
heap
page read and write
194E000
stack
page read and write
4EE1000
heap
page read and write
1D2EE000
stack
page read and write
3EAE000
stack
page read and write
4EE1000
heap
page read and write
1DAA0000
heap
page read and write
11DD000
stack
page read and write
4EE1000
heap
page read and write
1D9AF000
heap
page read and write
1D9B8000
heap
page read and write
4ED0000
direct allocation
page read and write
A5F000
unkown
page execute and read and write
4ED0000
direct allocation
page read and write
44ED000
stack
page read and write
4EE1000
heap
page read and write
4ED0000
direct allocation
page read and write
3D6E000
stack
page read and write
AC0000
unkown
page execute and read and write
336E000
stack
page read and write
1D9B0000
heap
page read and write
1D9BB000
heap
page read and write
1D9A8000
heap
page read and write
1D9AF000
heap
page read and write
AB1000
unkown
page execute and read and write
1D9B0000
heap
page read and write
1D99D000
heap
page read and write
1D9A4000
heap
page read and write
6FD01000
unkown
page execute read
3D2F000
stack
page read and write
1D996000
heap
page read and write
4ED0000
direct allocation
page read and write
1D81E000
stack
page read and write
6FD00000
unkown
page readonly
1D9CD000
heap
page read and write
1D9B0000
heap
page read and write
1044000
unkown
page execute and read and write
6FD8E000
unkown
page read and write
40EF000
stack
page read and write
61ECC000
direct allocation
page read and write
9C1000
unkown
page execute and read and write
29A10000
heap
page read and write
4EE1000
heap
page read and write
A2A000
unkown
page execute and read and write
4EE1000
heap
page read and write
3FAF000
stack
page read and write
4EE1000
heap
page read and write
486F000
stack
page read and write
61ED0000
direct allocation
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
4EE0000
heap
page read and write
EA7000
unkown
page execute and write copy
2FBF4000
heap
page read and write
4EAF000
stack
page read and write
B6D000
unkown
page execute and read and write
61ECD000
direct allocation
page readonly
1D99D000
heap
page read and write
4EE1000
heap
page read and write
1DAA0000
trusted library allocation
page read and write
35AF000
stack
page read and write
1D9B0000
heap
page read and write
1D996000
heap
page read and write
4B2E000
stack
page read and write
2FB4F000
stack
page read and write
4ED0000
direct allocation
page read and write
6CD85000
unkown
page readonly
15D0000
heap
page read and write
61EB4000
direct allocation
page read and write
D93000
unkown
page execute and read and write
1D9AC000
heap
page read and write
1D996000
heap
page read and write
157E000
stack
page read and write
4EE1000
heap
page read and write
4DAE000
stack
page read and write
48AE000
stack
page read and write
54AF000
stack
page read and write
4F00000
heap
page read and write
4ED0000
direct allocation
page read and write
436F000
stack
page read and write
17B8000
heap
page read and write
1D9B0000
heap
page read and write
6FD92000
unkown
page readonly
4EE1000
heap
page read and write
10DC000
stack
page read and write
332F000
stack
page read and write
426E000
stack
page read and write
4EE1000
heap
page read and write
386E000
stack
page read and write
1D9CD000
heap
page read and write
1D98B000
heap
page read and write
A84000
unkown
page execute and read and write
2FB50000
trusted library allocation
page read and write
5370000
direct allocation
page read and write
4EE1000
heap
page read and write
1D69F000
stack
page read and write
4EE1000
heap
page read and write
4EE1000
heap
page read and write
1D9B0000
heap
page read and write
1D982000
heap
page read and write
31EF000
stack
page read and write
4EE1000
heap
page read and write
4ED0000
direct allocation
page read and write
175A000
heap
page read and write
B47000
unkown
page execute and read and write
A91000
unkown
page execute and read and write
B67000
unkown
page execute and read and write
EA7000
unkown
page execute and read and write
4EE1000
heap
page read and write
1D9B3000
heap
page read and write
1D9AA000
heap
page read and write
54F0000
direct allocation
page execute and read and write
9C0000
unkown
page read and write
3BEF000
stack
page read and write
4EE1000
heap
page read and write
9C0000
unkown
page readonly
35EE000
stack
page read and write
4EE1000
heap
page read and write
1D9A4000
heap
page read and write
23A08000
heap
page read and write
1D9A8000
heap
page read and write
1D9AA000
heap
page read and write
299F0000
heap
page read and write
1D9A2000
heap
page read and write
1D42E000
stack
page read and write
4EE1000
heap
page read and write
ABD000
unkown
page execute and read and write
4EE1000
heap
page read and write
1D9AE000
heap
page read and write
4EE1000
heap
page read and write
1510000
heap
page read and write
1D9CD000
heap
page read and write
54C0000
direct allocation
page execute and read and write
61E01000
direct allocation
page execute read
1D9AA000
heap
page read and write
1D9A9000
heap
page read and write
15D5000
heap
page read and write
There are 330 hidden memdumps, click here to show them.