IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFCBFIJEHDHCBGDGDGCB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\AKEGDHJDHDAFHJJKJEHC
ASCII text, with very long lines (1765), with CRLF line terminators
dropped
C:\ProgramData\AKKKFBGDHJKFHJJJJDGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BFCFBKKKFHCFHJKFIIEHDBGCBK
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\CAKKKFBFIDGDBFHJJEHIDHDAAF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DAECAECFCAAEBFHIEHDGHDHCBA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EGDGIEGH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\IDAAFBGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JKFCBAEHCAEGDHJKFHJKFIJKJE
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdowsApps
unknown
 malicious
http://185.215.113.37/b
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlly
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dllA
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpimple-storage.json
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll0
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpw
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpa
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpGDHJDHDAFHJJKJEHC
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpll
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllV
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll8
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpZ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll5.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php?
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllJ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpH
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllA
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php4
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllg
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php#
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlll
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://185.215.113.37d
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.37e2b1563c6670f193.phpefox
unknown
There are 54 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
5100000
direct allocation
page read and write
 malicious
761000
unkown
page execute and read and write
 malicious
123E000
heap
page read and write
 malicious
61ED0000
direct allocation
page read and write
298DA000
heap
page read and write
1278000
heap
page read and write
29932000
heap
page read and write
1224000
heap
page read and write
6CDCF000
unkown
page readonly
4C81000
heap
page read and write
3C7E000
stack
page read and write
1224000
heap
page read and write
4C87000
heap
page read and write
123A000
heap
page read and write
1D786000
heap
page read and write
6CE0E000
unkown
page read and write
427F000
stack
page read and write
4C81000
heap
page read and write
6CE15000
unkown
page readonly
1D0CE000
stack
page read and write
1D764000
heap
page read and write
1224000
heap
page read and write
463F000
stack
page read and write
4C81000
heap
page read and write
92B000
unkown
page execute and read and write
1D77E000
heap
page read and write
1D775000
heap
page read and write
1D776000
heap
page read and write
12F7000
heap
page read and write
34FE000
stack
page read and write
4C81000
heap
page read and write
1224000
heap
page read and write
1224000
heap
page read and write
4C81000
heap
page read and write
4C81000
heap
page read and write
760000
unkown
page readonly
6CC0D000
unkown
page readonly
1D770000
heap
page read and write
1284000
heap
page read and write
50E0000
heap
page read and write
2F9A0000
heap
page read and write
1D59D000
stack
page read and write
1D764000
heap
page read and write
4B7E000
stack
page read and write
4C81000
heap
page read and write
1D35E000
stack
page read and write
4C81000
heap
page read and write
1224000
heap
page read and write
1224000
heap
page read and write
1224000
heap
page read and write
1D45F000
stack
page read and write
4C81000
heap
page read and write
2D2E000
stack
page read and write
298C3000
heap
page read and write
4C81000
heap
page read and write
4C81000
heap
page read and write
4C81000
heap
page read and write
337F000
stack
page read and write
2ED0000
direct allocation
page read and write
1224000
heap
page read and write
35FF000
stack
page read and write
2ED0000
direct allocation
page read and write
1224000
heap
page read and write
33BE000
stack
page read and write
6CC1E000
unkown
page read and write
1D74B000
heap
page read and write
C23000
unkown
page execute and read and write
1D770000
heap
page read and write
1224000
heap
page read and write
4C81000
heap
page read and write
905000
unkown
page execute and read and write
81D000
unkown
page execute and read and write
1224000
heap
page read and write
1D771000
heap
page read and write
237D1000
heap
page read and write
1D78B000
heap
page read and write
2F9AE000
heap
page read and write
1D76F000
heap
page read and write
2ED0000
direct allocation
page read and write
1D78C000
heap
page read and write
4C81000
heap
page read and write
1D76F000
heap
page read and write
1224000
heap
page read and write
4C81000
heap
page read and write
87E000
unkown
page execute and read and write
1D780000
heap
page read and write
5100000
direct allocation
page read and write
12E5000
heap
page read and write
1D765000
heap
page read and write
1D76F000
heap
page read and write
1D765000
heap
page read and write
4C81000
heap
page read and write
4C81000
heap
page read and write
1D77E000
heap
page read and write
47BE000
stack
page read and write
4C81000
heap
page read and write
2EF0000
heap
page read and write
1224000
heap
page read and write
1D770000
heap
page read and write
1D762000
heap
page read and write
4A3E000
stack
page read and write
2991D000
heap
page read and write
298C0000
heap
page read and write
1D768000
heap
page read and write
1D76B000
heap
page read and write
5280000
direct allocation
page execute and read and write
3B3E000
stack
page read and write
12B2000
heap
page read and write
1D764000
heap
page read and write
39BF000
stack
page read and write
4C81000
heap
page read and write
3C3F000
stack
page read and write
1D76E000
heap
page read and write
4C81000
heap
page read and write
298BE000
heap
page read and write
4C81000
heap
page read and write
23870000
heap
page read and write
1D76F000
heap
page read and write
1D742000
heap
page read and write
1224000
heap
page read and write
4C81000
heap
page read and write
1D76F000
heap
page read and write
842000
unkown
page execute and read and write
39FE000
stack
page read and write
1D78C000
heap
page read and write
1D76A000
heap
page read and write
298D5000
heap
page read and write
1D76F000
heap
page read and write
2ED0000
direct allocation
page read and write
1D783000
heap
page read and write
1224000
heap
page read and write
52B0000
direct allocation
page execute and read and write
477F000
stack
page read and write
1D783000
heap
page read and write
3EBF000
stack
page read and write
2992D000
heap
page read and write
1297000
heap
page read and write
2E7E000
stack
page read and write
4C81000
heap
page read and write
4C81000
heap
page read and write
4D80000
trusted library allocation
page read and write
1D76A000
heap
page read and write
417E000
stack
page read and write
4CA0000
heap
page read and write
2EC0000
heap
page read and write
7EF000
unkown
page execute and read and write
1D764000
heap
page read and write
4C81000
heap
page read and write
1D78C000
heap
page read and write
143E000
stack
page read and write
1220000
heap
page read and write
DFD000
unkown
page execute and write copy
298D1000
heap
page read and write
4C81000
heap
page read and write
1D78C000
heap
page read and write
1D762000
heap
page read and write
2EFE000
heap
page read and write
4C81000
heap
page read and write
4C81000
heap
page read and write
4C81000
heap
page read and write
1224000
heap
page read and write
34BF000
stack
page read and write
403E000
stack
page read and write
61E00000
direct allocation
page execute and read and write
1D861000
heap
page read and write
12C0000
heap
page read and write
2EF7000
heap
page read and write
2F9AE000
heap
page read and write
38BE000
stack
page read and write
4C80000
heap
page read and write
C5E000
unkown
page execute and write copy
4C81000
heap
page read and write
C5D000
unkown
page execute and read and write
4C81000
heap
page read and write
1224000
heap
page read and write
1D76F000
heap
page read and write
4C81000
heap
page read and write
5290000
direct allocation
page execute and read and write
1D76F000
heap
page read and write
4C81000
heap
page read and write
6CC31000
unkown
page execute read
2ED0000
direct allocation
page read and write
1D78C000
heap
page read and write
7BA000
unkown
page execute and read and write
4C81000
heap
page read and write
298C9000
heap
page read and write
29890000
heap
page read and write
2F9B6000
heap
page read and write
48BF000
stack
page read and write
1D770000
heap
page read and write
30FF000
stack
page read and write
C47000
unkown
page execute and read and write
1D77E000
heap
page read and write
2ED0000
direct allocation
page read and write
1189000
stack
page read and write
2ED0000
direct allocation
page read and write
153E000
stack
page read and write
1D740000
heap
page read and write
4C81000
heap
page read and write
61ECD000
direct allocation
page readonly
1D766000
heap
page read and write
4C81000
heap
page read and write
61ED4000
direct allocation
page readonly
925000
unkown
page execute and read and write
6CB90000
unkown
page readonly
4C81000
heap
page read and write
6CC30000
unkown
page readonly
1D770000
heap
page read and write
7E8000
unkown
page execute and read and write
6CE0F000
unkown
page write copy
44FF000
stack
page read and write
5280000
direct allocation
page execute and read and write
1D77E000
heap
page read and write
1D77E000
heap
page read and write
413F000
stack
page read and write
1D77D000
heap
page read and write
2F910000
trusted library allocation
page read and write
84F000
unkown
page execute and read and write
42BE000
stack
page read and write
513C000
stack
page read and write
4C81000
heap
page read and write
12EF000
heap
page read and write
1D77E000
heap
page read and write
313E000
stack
page read and write
1D76F000
heap
page read and write
4C81000
heap
page read and write
1D75B000
heap
page read and write
1D755000
heap
page read and write
1D76B000
heap
page read and write
1224000
heap
page read and write
1D6DC000
stack
page read and write
132A000
heap
page read and write
49FF000
stack
page read and write
4C81000
heap
page read and write
4C81000
heap
page read and write
4C90000
heap
page read and write
2ED0000
direct allocation
page read and write
1D1CF000
stack
page read and write
23910000
heap
page read and write
1D765000
heap
page read and write
4B3F000
stack
page read and write
29870000
heap
page read and write
1D20E000
stack
page read and write
1D775000
heap
page read and write
1D08F000
stack
page read and write
1D764000
heap
page read and write
453E000
stack
page read and write
4C81000
heap
page read and write
4C81000
heap
page read and write
1D860000
trusted library allocation
page read and write
4C81000
heap
page read and write
7F2000
unkown
page execute and read and write
1224000
heap
page read and write
4C81000
heap
page read and write
1D78C000
heap
page read and write
387F000
stack
page read and write
1D49D000
stack
page read and write
1224000
heap
page read and write
1D754000
heap
page read and write
1224000
heap
page read and write
4C81000
heap
page read and write
1224000
heap
page read and write
1D76F000
heap
page read and write
811000
unkown
page execute and read and write
3DBE000
stack
page read and write
1D76F000
heap
page read and write
1224000
heap
page read and write
5270000
direct allocation
page execute and read and write
1D767000
heap
page read and write
4C81000
heap
page read and write
43BF000
stack
page read and write
1D756000
heap
page read and write
1D770000
heap
page read and write
1224000
heap
page read and write
118D000
stack
page read and write
61ED3000
direct allocation
page read and write
1D764000
heap
page read and write
2ED0000
direct allocation
page read and write
4C81000
heap
page read and write
3D7F000
stack
page read and write
1CF8E000
stack
page read and write
5250000
direct allocation
page execute and read and write
87B000
unkown
page execute and read and write
2F9A8000
heap
page read and write
377E000
stack
page read and write
4C81000
heap
page read and write
467E000
stack
page read and write
2ED0000
direct allocation
page read and write
1D767000
heap
page read and write
4C81000
heap
page read and write
1224000
heap
page read and write
C4F000
unkown
page execute and read and write
4C81000
heap
page read and write
3FFF000
stack
page read and write
1224000
heap
page read and write
4C81000
heap
page read and write
9BE000
unkown
page execute and read and write
760000
unkown
page read and write
1D760000
heap
page read and write
1224000
heap
page read and write
3AFF000
stack
page read and write
1D77E000
heap
page read and write
4C81000
heap
page read and write
1D5DE000
stack
page read and write
1D76B000
heap
page read and write
1D76F000
heap
page read and write
1D770000
heap
page read and write
B49000
unkown
page execute and read and write
327E000
stack
page read and write
2EFB000
heap
page read and write
6CE10000
unkown
page read and write
1D762000
heap
page read and write
4C81000
heap
page read and write
6CC22000
unkown
page readonly
761000
unkown
page execute and write copy
1183000
stack
page read and write
2ED0000
direct allocation
page read and write
9AA000
unkown
page execute and read and write
4C81000
heap
page read and write
132E000
heap
page read and write
7E5000
unkown
page execute and read and write
52A0000
direct allocation
page execute and read and write
2ED0000
direct allocation
page read and write
2FFF000
stack
page read and write
1224000
heap
page read and write
3EFE000
stack
page read and write
1224000
heap
page read and write
1D76C000
heap
page read and write
1224000
heap
page read and write
5260000
direct allocation
page execute and read and write
1224000
heap
page read and write
12FC000
heap
page read and write
1D78C000
heap
page read and write
4C81000
heap
page read and write
1D77E000
heap
page read and write
12EA000
heap
page read and write
43FE000
stack
page read and write
1D78C000
heap
page read and write
61ECC000
direct allocation
page read and write
11F0000
heap
page read and write
86F000
unkown
page execute and read and write
1224000
heap
page read and write
363E000
stack
page read and write
11E0000
heap
page read and write
5100000
direct allocation
page read and write
1D77E000
heap
page read and write
4C81000
heap
page read and write
323F000
stack
page read and write
523F000
stack
page read and write
61EB4000
direct allocation
page read and write
DFC000
unkown
page execute and read and write
373F000
stack
page read and write
4C81000
heap
page read and write
12C6000
heap
page read and write
48FE000
stack
page read and write
1D755000
heap
page read and write
1224000
heap
page read and write
1D767000
heap
page read and write
6CB91000
unkown
page execute read
1230000
heap
page read and write
1D765000
heap
page read and write
2EBC000
stack
page read and write
4C81000
heap
page read and write
1D30E000
stack
page read and write
4C81000
heap
page read and write
1D756000
heap
page read and write
2ED0000
direct allocation
page read and write
1D78C000
heap
page read and write
298B1000
heap
page read and write
61E01000
direct allocation
page execute read
4C81000
heap
page read and write
4C81000
heap
page read and write
C5D000
unkown
page execute and write copy
2E2F000
stack
page read and write
4C7F000
stack
page read and write
61EB7000
direct allocation
page readonly
1D78C000
heap
page read and write
2ED0000
direct allocation
page read and write
108C000
stack
page read and write
1224000
heap
page read and write
1D76B000
heap
page read and write
4C81000
heap
page read and write
1D772000
heap
page read and write
1224000
heap
page read and write
1224000
heap
page read and write
There are 375 hidden memdumps, click here to show them.