IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKJKFBAFIDAEBFHJKJEBFCBFHD
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\BGIJJKKJJDAAAAAKFHJJ
ASCII text, with very long lines (1765), with CRLF line terminators
dropped
C:\ProgramData\CFCFCAAA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DAAFIIJDAAAAKFHIDAAAKJJEGD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EBKJDBAAKJDGCBFHCFCG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ECGDAAFIIJDAAAAKFHIDAAAKJJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EGDGCGCF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\GDBFCGIIIJDBGCBGIDGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KKJEBAAECBGDHIECAKJKKECFHJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.100/e2b1563c6670f193.phpGO
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpst~
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/vcruntime140.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpBrowser
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dll3h
unknown
 malicious
http://185.215.113.100/
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/mozglue.dllkhY
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpX&
unknown
 malicious
http://185.215.113.100
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php_O
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpst
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpC
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php(
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/sqlite3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpER
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php=I%
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll4j
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php0
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/freebl3.dll=io
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll
185.215.113.100
 malicious
http://185.215.113.100/e2b1563c6670f193.phpro
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/softokn3.dllpj
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/nss3.dll%h
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.phpJJKKJJDAAAAAKFHJJOv
unknown
 malicious
http://185.215.113.100e2b1563c6670f193.phpion:
unknown
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dll
185.215.113.100
 malicious
http://185.215.113.100/0d60be0de163924d/msvcp140.dllAj
unknown
 malicious
http://185.215.113.100/e2b1563c6670f193.php=C
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 46 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.100
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
110E000
heap
page read and write
 malicious
6CBC1000
unkown
page execute read
8E0000
unkown
page execute and write copy
29580000
heap
page read and write
1D48B000
heap
page read and write
4861000
heap
page read and write
8DF000
unkown
page execute and write copy
3F9F000
stack
page read and write
1100000
heap
page read and write
1D474000
heap
page read and write
4861000
heap
page read and write
2C1F000
stack
page read and write
4861000
heap
page read and write
399E000
stack
page read and write
4861000
heap
page read and write
4861000
heap
page read and write
1D45A000
heap
page read and write
4861000
heap
page read and write
4861000
heap
page read and write
1D474000
heap
page read and write
6CDFF000
unkown
page readonly
1D46A000
heap
page read and write
4861000
heap
page read and write
1D46B000
heap
page read and write
1D471000
heap
page read and write
5A7000
unkown
page execute and read and write
1D474000
heap
page read and write
FA4000
heap
page read and write
640000
unkown
page execute and read and write
1D470000
heap
page read and write
40DF000
stack
page read and write
1D48E000
heap
page read and write
4861000
heap
page read and write
3DC000
stack
page read and write
61ECD000
direct allocation
page readonly
61EB7000
direct allocation
page readonly
400000
unkown
page read and write
1168000
heap
page read and write
1D05D000
stack
page read and write
B79000
stack
page read and write
1D477000
heap
page read and write
1D45A000
heap
page read and write
1D474000
heap
page read and write
1D45A000
heap
page read and write
4870000
heap
page read and write
4861000
heap
page read and write
12FE000
stack
page read and write
6CC4E000
unkown
page read and write
4861000
heap
page read and write
4861000
heap
page read and write
1D478000
heap
page read and write
1D466000
heap
page read and write
1D469000
heap
page read and write
1D490000
heap
page read and write
A7A000
unkown
page execute and read and write
4FD000
unkown
page execute and read and write
485F000
stack
page read and write
4F1000
unkown
page execute and read and write
4861000
heap
page read and write
FA4000
heap
page read and write
2B17000
heap
page read and write
4861000
heap
page read and write
FA4000
heap
page read and write
1D469000
heap
page read and write
4861000
heap
page read and write
10EC000
stack
page read and write
2AE0000
direct allocation
page read and write
1CECF000
stack
page read and write
4861000
heap
page read and write
BB0000
heap
page read and write
411E000
stack
page read and write
1D46D000
heap
page read and write
4861000
heap
page read and write
2AE0000
direct allocation
page read and write
1D458000
heap
page read and write
1D46B000
heap
page read and write
61ECC000
direct allocation
page read and write
43C000
unkown
page execute and read and write
1D478000
heap
page read and write
425E000
stack
page read and write
321E000
stack
page read and write
1D481000
heap
page read and write
1D45B000
heap
page read and write
3C1E000
stack
page read and write
1D469000
heap
page read and write
1D481000
heap
page read and write
1CF1E000
stack
page read and write
500000
unkown
page execute and read and write
381F000
stack
page read and write
10AE000
stack
page read and write
1D474000
heap
page read and write
1D47B000
heap
page read and write
4861000
heap
page read and write
FA4000
heap
page read and write
1D48C000
heap
page read and write
61ED0000
direct allocation
page read and write
4861000
heap
page read and write
4861000
heap
page read and write
B7D000
stack
page read and write
6CE3F000
unkown
page write copy
46A000
unkown
page execute and read and write
29621000
heap
page read and write
1D490000
heap
page read and write
1D46B000
heap
page read and write
2F65E000
stack
page read and write
2B1E000
heap
page read and write
3A9F000
stack
page read and write
2AE0000
direct allocation
page read and write
1D43E000
stack
page read and write
1D45A000
heap
page read and write
1D446000
heap
page read and write
4861000
heap
page read and write
493000
unkown
page execute and read and write
110A000
heap
page read and write
385E000
stack
page read and write
4861000
heap
page read and write
401000
unkown
page execute and write copy
FA4000
heap
page read and write
4861000
heap
page read and write
4861000
heap
page read and write
1D442000
heap
page read and write
4880000
heap
page read and write
4861000
heap
page read and write
2B1B000
heap
page read and write
471F000
stack
page read and write
FA4000
heap
page read and write
29601000
heap
page read and write
1D15D000
stack
page read and write
1152000
heap
page read and write
4861000
heap
page read and write
1D455000
heap
page read and write
A7B000
unkown
page execute and write copy
4E50000
direct allocation
page execute and read and write
8A1000
unkown
page execute and read and write
FA4000
heap
page read and write
61EB4000
direct allocation
page read and write
4861000
heap
page read and write
1189000
heap
page read and write
FA4000
heap
page read and write
421F000
stack
page read and write
1D560000
trusted library allocation
page read and write
1D469000
heap
page read and write
4861000
heap
page read and write
10F0000
heap
page read and write
371E000
stack
page read and write
1D474000
heap
page read and write
475E000
stack
page read and write
295A0000
heap
page read and write
F4E000
stack
page read and write
1CC8E000
stack
page read and write
1D466000
heap
page read and write
2AE0000
direct allocation
page read and write
2AE0000
direct allocation
page read and write
4861000
heap
page read and write
335E000
stack
page read and write
FA4000
heap
page read and write
6CC60000
unkown
page readonly
1D459000
heap
page read and write
1D474000
heap
page read and write
1D491000
heap
page read and write
4861000
heap
page read and write
7C4000
unkown
page execute and read and write
6CBC0000
unkown
page readonly
FA4000
heap
page read and write
401000
unkown
page execute and read and write
461E000
stack
page read and write
FA4000
heap
page read and write
4861000
heap
page read and write
400000
unkown
page readonly
44DE000
stack
page read and write
1D44F000
heap
page read and write
1D481000
heap
page read and write
4861000
heap
page read and write
1D478000
heap
page read and write
FA4000
heap
page read and write
2F7FD000
heap
page read and write
1D472000
heap
page read and write
1D490000
heap
page read and write
1D469000
heap
page read and write
2ADE000
stack
page read and write
349E000
stack
page read and write
1D472000
heap
page read and write
45DF000
stack
page read and write
4861000
heap
page read and write
1D481000
heap
page read and write
FA4000
heap
page read and write
1D566000
heap
page read and write
1D474000
heap
page read and write
1CD8F000
stack
page read and write
2F80B000
heap
page read and write
4861000
heap
page read and write
2AE0000
direct allocation
page read and write
1D490000
heap
page read and write
2D1F000
stack
page read and write
1D481000
heap
page read and write
4861000
heap
page read and write
4861000
heap
page read and write
1D491000
heap
page read and write
FA4000
heap
page read and write
4861000
heap
page read and write
4861000
heap
page read and write
FA4000
heap
page read and write
1D478000
heap
page read and write
1D478000
heap
page read and write
1D466000
heap
page read and write
4861000
heap
page read and write
1D469000
heap
page read and write
29625000
heap
page read and write
2AE0000
direct allocation
page read and write
295E1000
heap
page read and write
FA4000
heap
page read and write
FA4000
heap
page read and write
2B00000
direct allocation
page read and write
4861000
heap
page read and write
1D474000
heap
page read and write
1D46A000
heap
page read and write
1D478000
heap
page read and write
1D48B000
heap
page read and write
1D469000
heap
page read and write
1D491000
heap
page read and write
4CC0000
heap
page read and write
1D29C000
stack
page read and write
4861000
heap
page read and write
FA0000
heap
page read and write
6CE3E000
unkown
page read and write
2AE0000
direct allocation
page read and write
11DA000
heap
page read and write
3E5F000
stack
page read and write
1D474000
heap
page read and write
4CE0000
direct allocation
page read and write
1D478000
heap
page read and write
FA4000
heap
page read and write
23578000
heap
page read and write
4861000
heap
page read and write
1D469000
heap
page read and write
1CC4F000
stack
page read and write
3ADE000
stack
page read and write
4861000
heap
page read and write
4861000
heap
page read and write
2F5F000
stack
page read and write
2F9E000
stack
page read and write
1D474000
heap
page read and write
1D490000
heap
page read and write
1D471000
heap
page read and write
1D490000
heap
page read and write
FA4000
heap
page read and write
1D474000
heap
page read and write
3E9E000
stack
page read and write
1D46D000
heap
page read and write
8DF000
unkown
page execute and read and write
1D474000
heap
page read and write
4D1000
unkown
page execute and read and write
2F75F000
stack
page read and write
2AE0000
direct allocation
page read and write
FA4000
heap
page read and write
FA4000
heap
page read and write
1D474000
heap
page read and write
4E40000
direct allocation
page execute and read and write
1D47C000
heap
page read and write
6CC52000
unkown
page readonly
2F802000
heap
page read and write
2E5E000
stack
page read and write
4861000
heap
page read and write
4861000
heap
page read and write
1D46D000
heap
page read and write
1CB4E000
stack
page read and write
1D474000
heap
page read and write
1D490000
heap
page read and write
1D477000
heap
page read and write
31DF000
stack
page read and write
295C1000
heap
page read and write
331F000
stack
page read and write
FA4000
heap
page read and write
FA4000
heap
page read and write
2B00000
direct allocation
page read and write
1CDCE000
stack
page read and write
4CA0000
trusted library allocation
page read and write
1D469000
heap
page read and write
3D5E000
stack
page read and write
4860000
heap
page read and write
1D490000
heap
page read and write
4E70000
direct allocation
page execute and read and write
4861000
heap
page read and write
4861000
heap
page read and write
FA4000
heap
page read and write
1D477000
heap
page read and write
1D481000
heap
page read and write
6CE40000
unkown
page read and write
3D1F000
stack
page read and write
1D46A000
heap
page read and write
4C4000
unkown
page execute and read and write
435F000
stack
page read and write
439E000
stack
page read and write
6CC3D000
unkown
page readonly
FA4000
heap
page read and write
1D474000
heap
page read and write
1D45A000
heap
page read and write
1D474000
heap
page read and write
4861000
heap
page read and write
4861000
heap
page read and write
1D48F000
heap
page read and write
1D481000
heap
page read and write
4861000
heap
page read and write
F0E000
stack
page read and write
F9E000
stack
page read and write
1D474000
heap
page read and write
1D474000
heap
page read and write
1D481000
heap
page read and write
2AE0000
direct allocation
page read and write
1D474000
heap
page read and write
1D481000
heap
page read and write
1D459000
heap
page read and write
1D481000
heap
page read and write
6CC61000
unkown
page execute read
4861000
heap
page read and write
4861000
heap
page read and write
1D481000
heap
page read and write
4861000
heap
page read and write
359F000
stack
page read and write
4D1B000
stack
page read and write
1D48F000
heap
page read and write
4861000
heap
page read and write
1D46A000
heap
page read and write
4861000
heap
page read and write
49F000
unkown
page execute and read and write
36DF000
stack
page read and write
1D470000
heap
page read and write
FA4000
heap
page read and write
449F000
stack
page read and write
3BDF000
stack
page read and write
4861000
heap
page read and write
61ED4000
direct allocation
page readonly
BC0000
heap
page read and write
FA4000
heap
page read and write
FA4000
heap
page read and write
35DE000
stack
page read and write
FA4000
heap
page read and write
309F000
stack
page read and write
FA4000
heap
page read and write
1D45A000
heap
page read and write
61E00000
direct allocation
page execute and read and write
4E1F000
stack
page read and write
61ED3000
direct allocation
page read and write
8C7000
unkown
page execute and read and write
2B10000
heap
page read and write
2E1F000
stack
page read and write
4862000
heap
page read and write
2F760000
trusted library allocation
page read and write
1D468000
heap
page read and write
2AE0000
direct allocation
page read and write
FA4000
heap
page read and write
3FDE000
stack
page read and write
6CE45000
unkown
page readonly
4861000
heap
page read and write
1D01F000
stack
page read and write
1D490000
heap
page read and write
1D474000
heap
page read and write
587000
unkown
page execute and read and write
4861000
heap
page read and write
2AE0000
direct allocation
page read and write
FA4000
heap
page read and write
1D490000
heap
page read and write
1D440000
heap
page read and write
1D474000
heap
page read and write
345F000
stack
page read and write
4E60000
direct allocation
page execute and read and write
1D470000
heap
page read and write
395F000
stack
page read and write
4861000
heap
page read and write
2F805000
heap
page read and write
FA4000
heap
page read and write
4861000
heap
page read and write
4E50000
direct allocation
page execute and read and write
8D1000
unkown
page execute and read and write
1D469000
heap
page read and write
2F7FA000
heap
page read and write
2AE0000
direct allocation
page read and write
2361A000
heap
page read and write
FA4000
heap
page read and write
5AD000
unkown
page execute and read and write
234D7000
heap
page read and write
1D33E000
stack
page read and write
B73000
stack
page read and write
FA4000
heap
page read and write
4861000
heap
page read and write
61E01000
direct allocation
page execute read
4E20000
direct allocation
page execute and read and write
1D47C000
heap
page read and write
1D474000
heap
page read and write
1D19E000
stack
page read and write
FA4000
heap
page read and write
2AE0000
direct allocation
page read and write
FA4000
heap
page read and write
30DE000
stack
page read and write
There are 384 hidden memdumps, click here to show them.