IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAFIDGCFHIEHJJJJECAKKJDBAF
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\AKEGDAKEHJDHIDHJJDAECFBKFH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CBAKJKJJJECFIEBFHIEG
ASCII text, with very long lines (1765), with CRLF line terminators
dropped
C:\ProgramData\DBAEHCGHIIIDHIECFHJD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FCGCFCAF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FHCAEGCBFHJDGCBFHDAFBAFIII
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\GCBFBGCG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\KECBGCGCGIEGCBFHIIEBFCAFHI
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KKJKKJJKJEGIECAKJJEB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll/~
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll5
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpq
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpp
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phps
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dlla
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpe
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37h
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpj
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpM
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpY
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpW
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpA
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpbird
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllE
unknown
 malicious
http://185.215.113.37/e2
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpimple-storage.jsonl
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpKKJJKJEGIECAKJJEB
unknown
 malicious
http://185.215.113.37e2b1563c6670f193.phpefox
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 46 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4D80000
direct allocation
page read and write
 malicious
E9E000
heap
page read and write
 malicious
3C1000
unkown
page execute and read and write
 malicious
1D511000
heap
page read and write
4ED0000
direct allocation
page execute and read and write
4901000
heap
page read and write
2C1B000
heap
page read and write
6CB81000
unkown
page execute read
4901000
heap
page read and write
1D504000
heap
page read and write
61ED0000
direct allocation
page read and write
4901000
heap
page read and write
1D507000
heap
page read and write
6CE00000
unkown
page read and write
47DE000
stack
page read and write
39DF000
stack
page read and write
47D000
unkown
page execute and read and write
4901000
heap
page read and write
2C5C000
stack
page read and write
1D50C000
heap
page read and write
29640000
heap
page read and write
1D4CD000
stack
page read and write
4901000
heap
page read and write
FB0000
direct allocation
page read and write
1D4F9000
heap
page read and write
1D520000
heap
page read and write
448000
unkown
page execute and read and write
4901000
heap
page read and write
6CDFF000
unkown
page write copy
1D504000
heap
page read and write
2FDF000
stack
page read and write
1D504000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
3DDE000
stack
page read and write
4901000
heap
page read and write
FB0000
direct allocation
page read and write
4901000
heap
page read and write
1D504000
heap
page read and write
121D000
stack
page read and write
FC0000
heap
page read and write
33DE000
stack
page read and write
4F10000
direct allocation
page execute and read and write
29665000
heap
page read and write
1D4E5000
heap
page read and write
60A000
unkown
page execute and read and write
3EDF000
stack
page read and write
4901000
heap
page read and write
2F8A6000
heap
page read and write
4901000
heap
page read and write
1D4E9000
heap
page read and write
42DE000
stack
page read and write
1D4EA000
heap
page read and write
29676000
heap
page read and write
1D4F6000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
401F000
stack
page read and write
1D511000
heap
page read and write
1D508000
heap
page read and write
4901000
heap
page read and write
419E000
stack
page read and write
FB0000
direct allocation
page read and write
61ED3000
direct allocation
page read and write
329E000
stack
page read and write
131E000
stack
page read and write
3D9F000
stack
page read and write
479F000
stack
page read and write
1D51B000
heap
page read and write
1D504000
heap
page read and write
4901000
heap
page read and write
1D4F9000
heap
page read and write
471000
unkown
page execute and read and write
1D5F0000
trusted library allocation
page read and write
6CC0E000
unkown
page read and write
4901000
heap
page read and write
339F000
stack
page read and write
AEC000
stack
page read and write
4901000
heap
page read and write
1D4FA000
heap
page read and write
4901000
heap
page read and write
61ECC000
direct allocation
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
1D504000
heap
page read and write
4910000
heap
page read and write
1D4F9000
heap
page read and write
1D520000
heap
page read and write
1D5F4000
heap
page read and write
1D4E8000
heap
page read and write
451F000
stack
page read and write
4901000
heap
page read and write
6CBFD000
unkown
page readonly
4901000
heap
page read and write
1D4FA000
heap
page read and write
4F20000
direct allocation
page execute and read and write
1D502000
heap
page read and write
1D520000
heap
page read and write
41A000
unkown
page execute and read and write
F89000
heap
page read and write
FB0000
direct allocation
page read and write
1D511000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
1D22E000
stack
page read and write
1CF3E000
stack
page read and write
BED000
stack
page read and write
4901000
heap
page read and write
FB0000
direct allocation
page read and write
E9A000
heap
page read and write
2AFE000
stack
page read and write
F85000
heap
page read and write
4D40000
trusted library allocation
page read and write
389F000
stack
page read and write
A52000
unkown
page execute and write copy
8B9000
unkown
page execute and read and write
3C1000
unkown
page execute and write copy
3C0000
unkown
page readonly
301E000
stack
page read and write
4901000
heap
page read and write
61E000
unkown
page execute and read and write
4901000
heap
page read and write
7A8000
unkown
page execute and read and write
3A1E000
stack
page read and write
A51000
unkown
page execute and read and write
585000
unkown
page execute and read and write
4901000
heap
page read and write
1D508000
heap
page read and write
10DE000
stack
page read and write
1D508000
heap
page read and write
1D4FB000
heap
page read and write
445000
unkown
page execute and read and write
4901000
heap
page read and write
2F7FF000
stack
page read and write
1D504000
heap
page read and write
315E000
stack
page read and write
441E000
stack
page read and write
1D511000
heap
page read and write
4901000
heap
page read and write
87E000
unkown
page execute and read and write
1D508000
heap
page read and write
29682000
heap
page read and write
FB0000
direct allocation
page read and write
1D4F9000
heap
page read and write
F16000
heap
page read and write
1D504000
heap
page read and write
29667000
heap
page read and write
296CC000
heap
page read and write
1D511000
heap
page read and write
1D4EA000
heap
page read and write
44F000
unkown
page execute and read and write
4901000
heap
page read and write
1D511000
heap
page read and write
469E000
stack
page read and write
1D4EA000
heap
page read and write
FB0000
direct allocation
page read and write
1D504000
heap
page read and write
1D50B000
heap
page read and write
1D520000
heap
page read and write
4F00000
direct allocation
page execute and read and write
EF8000
heap
page read and write
61EB7000
direct allocation
page readonly
4901000
heap
page read and write
29663000
heap
page read and write
1D4EA000
heap
page read and write
48DF000
stack
page read and write
3B5E000
stack
page read and write
325F000
stack
page read and write
FB0000
direct allocation
page read and write
565000
unkown
page execute and read and write
EE1000
heap
page read and write
1D511000
heap
page read and write
43DF000
stack
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
1D50C000
heap
page read and write
1D51F000
heap
page read and write
1D4FB000
heap
page read and write
4901000
heap
page read and write
4EBF000
stack
page read and write
1D51B000
heap
page read and write
6CC21000
unkown
page execute read
4901000
heap
page read and write
1D504000
heap
page read and write
61EB4000
direct allocation
page read and write
1D508000
heap
page read and write
429F000
stack
page read and write
2EDE000
stack
page read and write
FC5000
heap
page read and write
3C9E000
stack
page read and write
1D51F000
heap
page read and write
1D4FA000
heap
page read and write
4901000
heap
page read and write
1D501000
heap
page read and write
4901000
heap
page read and write
1D521000
heap
page read and write
2E9F000
stack
page read and write
379E000
stack
page read and write
23616000
heap
page read and write
1D504000
heap
page read and write
1D504000
heap
page read and write
1D520000
heap
page read and write
2F897000
heap
page read and write
4901000
heap
page read and write
3F1E000
stack
page read and write
2F800000
trusted library allocation
page read and write
4D80000
direct allocation
page read and write
FB0000
direct allocation
page read and write
236BA000
heap
page read and write
415F000
stack
page read and write
61E01000
direct allocation
page execute read
4901000
heap
page read and write
4F0E000
stack
page read and write
2C17000
heap
page read and write
1D511000
heap
page read and write
1D4EA000
heap
page read and write
1D500000
heap
page read and write
1CCFE000
stack
page read and write
FB0000
direct allocation
page read and write
1D500000
heap
page read and write
1D504000
heap
page read and write
351E000
stack
page read and write
2D9E000
stack
page read and write
4901000
heap
page read and write
58B000
unkown
page execute and read and write
365E000
stack
page read and write
1D4F8000
heap
page read and write
8A3000
unkown
page execute and read and write
1D507000
heap
page read and write
1D0EE000
stack
page read and write
BE8000
stack
page read and write
1D501000
heap
page read and write
6CDBF000
unkown
page readonly
4901000
heap
page read and write
1D504000
heap
page read and write
4EE0000
direct allocation
page execute and read and write
1D504000
heap
page read and write
4CF000
unkown
page execute and read and write
4901000
heap
page read and write
296A3000
heap
page read and write
1D0AF000
stack
page read and write
4901000
heap
page read and write
1D511000
heap
page read and write
1D4FA000
heap
page read and write
1D51C000
heap
page read and write
8B9000
unkown
page execute and write copy
1D504000
heap
page read and write
452000
unkown
page execute and read and write
4901000
heap
page read and write
1D32C000
stack
page read and write
4901000
heap
page read and write
1D511000
heap
page read and write
1D4F9000
heap
page read and write
34DF000
stack
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
1D4FD000
heap
page read and write
1D1ED000
stack
page read and write
11DE000
stack
page read and write
3B1F000
stack
page read and write
4901000
heap
page read and write
2966D000
heap
page read and write
361F000
stack
page read and write
29679000
heap
page read and write
1D504000
heap
page read and write
1D4EB000
heap
page read and write
455E000
stack
page read and write
8BA000
unkown
page execute and write copy
4901000
heap
page read and write
1D502000
heap
page read and write
29620000
heap
page read and write
1D4F9000
heap
page read and write
8AB000
unkown
page execute and read and write
2BFF000
stack
page read and write
1D4D0000
heap
page read and write
1D504000
heap
page read and write
6CB80000
unkown
page readonly
2F6FE000
stack
page read and write
38DE000
stack
page read and write
1CE3D000
stack
page read and write
1D4D6000
heap
page read and write
4901000
heap
page read and write
BE2000
stack
page read and write
FA0000
heap
page read and write
1D504000
heap
page read and write
4D80000
direct allocation
page read and write
1D504000
heap
page read and write
1D520000
heap
page read and write
4901000
heap
page read and write
4904000
heap
page read and write
1D508000
heap
page read and write
1D507000
heap
page read and write
48E0000
heap
page read and write
3C0000
unkown
page read and write
375F000
stack
page read and write
1D4DF000
heap
page read and write
405E000
stack
page read and write
1D521000
heap
page read and write
2C10000
heap
page read and write
1D51E000
heap
page read and write
1D4F6000
heap
page read and write
1D4EA000
heap
page read and write
EDE000
heap
page read and write
1D521000
heap
page read and write
4DB000
unkown
page execute and read and write
1D520000
heap
page read and write
F81000
heap
page read and write
6CC12000
unkown
page readonly
1D504000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
29661000
heap
page read and write
6CE05000
unkown
page readonly
4901000
heap
page read and write
4F00000
direct allocation
page execute and read and write
4901000
heap
page read and write
1D4FD000
heap
page read and write
4901000
heap
page read and write
61ECD000
direct allocation
page readonly
2F8A5000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
4DE000
unkown
page execute and read and write
1CCBF000
stack
page read and write
465F000
stack
page read and write
1D520000
heap
page read and write
F8B000
heap
page read and write
4901000
heap
page read and write
2967F000
heap
page read and write
2356E000
heap
page read and write
3C5F000
stack
page read and write
E40000
heap
page read and write
1D4E9000
heap
page read and write
4901000
heap
page read and write
4901000
heap
page read and write
2F89E000
heap
page read and write
4901000
heap
page read and write
4EF0000
direct allocation
page execute and read and write
FB0000
direct allocation
page read and write
1D508000
heap
page read and write
FB0000
direct allocation
page read and write
4901000
heap
page read and write
2F89F000
heap
page read and write
4DBC000
stack
page read and write
1D4FD000
heap
page read and write
4901000
heap
page read and write
4A2000
unkown
page execute and read and write
61E00000
direct allocation
page execute and read and write
1CFAE000
stack
page read and write
61ED4000
direct allocation
page readonly
1D504000
heap
page read and write
1D4F9000
heap
page read and write
4900000
heap
page read and write
E90000
heap
page read and write
4920000
heap
page read and write
4901000
heap
page read and write
6CC20000
unkown
page readonly
1D520000
heap
page read and write
1D520000
heap
page read and write
4901000
heap
page read and write
1D3CD000
stack
page read and write
1D511000
heap
page read and write
311F000
stack
page read and write
6CDFE000
unkown
page read and write
FB0000
direct allocation
page read and write
1D4F9000
heap
page read and write
4901000
heap
page read and write
1D4F6000
heap
page read and write
1D4F9000
heap
page read and write
2D5F000
stack
page read and write
296C3000
heap
page read and write
1D4FB000
heap
page read and write
1D504000
heap
page read and write
1D4F9000
heap
page read and write
E50000
heap
page read and write
1D500000
heap
page read and write
1CDFF000
stack
page read and write
4901000
heap
page read and write
FB0000
direct allocation
page read and write
4AF000
unkown
page execute and read and write
2C1E000
heap
page read and write
There are 373 hidden memdumps, click here to show them.