IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BKEHDGDGHCBGCAKFIIIE
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\EBAAAFBG
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GCBKFBFCGIEHIDGCFBFBFBKEBG
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GCGIDGCGIEGDGDGDGHJKKKJKEC
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\GHDHJEBFBFHJECAKFCAA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HDAFBGIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JJEGIJEGDBFHDGCAFCAE
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJEGIJEGDBFHDGCAFCAEBGCGCB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phpfox
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php5k
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpo
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpv
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllA
unknown
 malicious
http://185.215.113.37e
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpP
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllN
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpHDGDGHCBGCAKFIIIE
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpD
unknown
 malicious
http://185.215.113.37/NJ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFirefox
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dlld
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 45 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
6CE000
heap
page read and write
 malicious
4BF0000
direct allocation
page read and write
 malicious
941000
unkown
page execute and read and write
 malicious
E36000
unkown
page execute and read and write
1D240000
heap
page read and write
1D232000
heap
page read and write
7C0000
direct allocation
page read and write
4771000
heap
page read and write
426F000
stack
page read and write
B0B000
unkown
page execute and read and write
4771000
heap
page read and write
7C0000
direct allocation
page read and write
4771000
heap
page read and write
1D237000
heap
page read and write
29230000
heap
page read and write
1D259000
heap
page read and write
2EAE000
stack
page read and write
42AE000
stack
page read and write
940000
unkown
page readonly
6F870000
unkown
page readonly
4771000
heap
page read and write
3DAE000
stack
page read and write
4771000
heap
page read and write
1D240000
heap
page read and write
1D246000
heap
page read and write
1D21B000
heap
page read and write
29286000
heap
page read and write
4771000
heap
page read and write
39AF000
stack
page read and write
1D235000
heap
page read and write
1D25C000
heap
page read and write
1D335000
heap
page read and write
1D24B000
heap
page read and write
2D2F000
stack
page read and write
61ED3000
direct allocation
page read and write
E37000
unkown
page execute and write copy
2951D000
heap
page read and write
1D252000
heap
page read and write
362E000
stack
page read and write
1D237000
heap
page read and write
4771000
heap
page read and write
386F000
stack
page read and write
1D237000
heap
page read and write
1D226000
heap
page read and write
1D235000
heap
page read and write
61ED0000
direct allocation
page read and write
4780000
heap
page read and write
4771000
heap
page read and write
1D232000
heap
page read and write
1D240000
heap
page read and write
61ED4000
direct allocation
page readonly
4771000
heap
page read and write
466E000
stack
page read and write
1D247000
heap
page read and write
1D240000
heap
page read and write
4771000
heap
page read and write
2B2E000
heap
page read and write
1D238000
heap
page read and write
1D235000
heap
page read and write
44EF000
stack
page read and write
4771000
heap
page read and write
1D240000
heap
page read and write
416E000
stack
page read and write
A22000
unkown
page execute and read and write
1D24D000
heap
page read and write
7C0000
direct allocation
page read and write
4771000
heap
page read and write
4770000
heap
page read and write
61ECD000
direct allocation
page readonly
9F1000
unkown
page execute and read and write
9C5000
unkown
page execute and read and write
4771000
heap
page read and write
1D25C000
heap
page read and write
6C850000
unkown
page read and write
6C0000
heap
page read and write
4771000
heap
page read and write
372F000
stack
page read and write
1D240000
heap
page read and write
1D225000
heap
page read and write
61E00000
direct allocation
page execute and read and write
6C84E000
unkown
page read and write
4D70000
direct allocation
page execute and read and write
1D24C000
heap
page read and write
620000
heap
page read and write
1D24B000
heap
page read and write
4D2F000
stack
page read and write
1D24E000
heap
page read and write
4771000
heap
page read and write
4771000
heap
page read and write
2BC000
stack
page read and write
1D240000
heap
page read and write
4771000
heap
page read and write
4771000
heap
page read and write
35EF000
stack
page read and write
4771000
heap
page read and write
DF9000
unkown
page execute and read and write
2FEE000
stack
page read and write
29279000
heap
page read and write
6F902000
unkown
page readonly
4771000
heap
page read and write
1D23D000
heap
page read and write
6C670000
unkown
page readonly
61E01000
direct allocation
page execute read
61ECC000
direct allocation
page read and write
4772000
heap
page read and write
4771000
heap
page read and write
402E000
stack
page read and write
1CC7F000
stack
page read and write
9C8000
unkown
page execute and read and write
8EE000
stack
page read and write
2928D000
heap
page read and write
1D24D000
heap
page read and write
3B3000
stack
page read and write
4771000
heap
page read and write
4D90000
direct allocation
page execute and read and write
D21000
unkown
page execute and read and write
34AF000
stack
page read and write
1D259000
heap
page read and write
4771000
heap
page read and write
3C2F000
stack
page read and write
1D259000
heap
page read and write
3B9000
stack
page read and write
6C80F000
unkown
page readonly
1D259000
heap
page read and write
462F000
stack
page read and write
7C0000
direct allocation
page read and write
6C855000
unkown
page readonly
4DA0000
direct allocation
page execute and read and write
2A7F000
stack
page read and write
2952B000
heap
page read and write
1D240000
heap
page read and write
70E000
heap
page read and write
322F000
stack
page read and write
A5E000
unkown
page execute and read and write
312E000
stack
page read and write
6F871000
unkown
page execute read
1D240000
heap
page read and write
1D226000
heap
page read and write
43AF000
stack
page read and write
940000
unkown
page read and write
4771000
heap
page read and write
728000
heap
page read and write
4771000
heap
page read and write
1D235000
heap
page read and write
1D24C000
heap
page read and write
4771000
heap
page read and write
1D255000
heap
page read and write
4771000
heap
page read and write
6F8FE000
unkown
page read and write
29250000
heap
page read and write
1CB7E000
stack
page read and write
452E000
stack
page read and write
7C0000
direct allocation
page read and write
1D240000
heap
page read and write
9FD000
unkown
page execute and read and write
AE5000
unkown
page execute and read and write
2B27000
heap
page read and write
10DE000
stack
page read and write
4771000
heap
page read and write
7C0000
direct allocation
page read and write
A4F000
unkown
page execute and read and write
9D2000
unkown
page execute and read and write
7C0000
direct allocation
page read and write
6F8ED000
unkown
page readonly
2E6F000
stack
page read and write
1D232000
heap
page read and write
2947F000
stack
page read and write
1D210000
heap
page read and write
610000
heap
page read and write
4771000
heap
page read and write
3FEF000
stack
page read and write
B8A000
unkown
page execute and read and write
4771000
heap
page read and write
1D255000
heap
page read and write
7C0000
direct allocation
page read and write
4771000
heap
page read and write
4771000
heap
page read and write
A2F000
unkown
page execute and read and write
2951A000
heap
page read and write
2FAF000
stack
page read and write
1CB3F000
stack
page read and write
E36000
unkown
page execute and write copy
2AFE000
stack
page read and write
4771000
heap
page read and write
2C2F000
stack
page read and write
4771000
heap
page read and write
1CF6D000
stack
page read and write
29522000
heap
page read and write
4771000
heap
page read and write
29271000
heap
page read and write
4771000
heap
page read and write
1D226000
heap
page read and write
4771000
heap
page read and write
4771000
heap
page read and write
61EB7000
direct allocation
page readonly
B9E000
unkown
page execute and read and write
4771000
heap
page read and write
4771000
heap
page read and write
1D226000
heap
page read and write
4771000
heap
page read and write
1D228000
heap
page read and write
4771000
heap
page read and write
7C0000
direct allocation
page read and write
4771000
heap
page read and write
29210000
heap
page read and write
4790000
heap
page read and write
3EAF000
stack
page read and write
1D24B000
heap
page read and write
1D24C000
heap
page read and write
1CDBF000
stack
page read and write
4771000
heap
page read and write
1D23C000
heap
page read and write
FD0000
unkown
page execute and write copy
9CF000
unkown
page execute and read and write
1D330000
trusted library allocation
page read and write
4771000
heap
page read and write
1D25A000
heap
page read and write
1D259000
heap
page read and write
1D259000
heap
page read and write
3EEE000
stack
page read and write
7C0000
direct allocation
page read and write
43EE000
stack
page read and write
4771000
heap
page read and write
4BF0000
direct allocation
page read and write
4771000
heap
page read and write
4771000
heap
page read and write
799000
heap
page read and write
1D06D000
stack
page read and write
1CCBE000
stack
page read and write
29525000
heap
page read and write
38AE000
stack
page read and write
1D23B000
heap
page read and write
1D0AD000
stack
page read and write
4771000
heap
page read and write
1D259000
heap
page read and write
1D25C000
heap
page read and write
2B2B000
heap
page read and write
7C0000
direct allocation
page read and write
1D25C000
heap
page read and write
7C0000
direct allocation
page read and write
3AEF000
stack
page read and write
1D24D000
heap
page read and write
1D240000
heap
page read and write
4771000
heap
page read and write
4D7E000
stack
page read and write
4771000
heap
page read and write
29274000
heap
page read and write
4771000
heap
page read and write
4BF0000
direct allocation
page read and write
4771000
heap
page read and write
1D237000
heap
page read and write
4C2C000
stack
page read and write
1D240000
heap
page read and write
4771000
heap
page read and write
1D212000
heap
page read and write
A5B000
unkown
page execute and read and write
3B2E000
stack
page read and write
1D259000
heap
page read and write
39EE000
stack
page read and write
476F000
stack
page read and write
29480000
trusted library allocation
page read and write
4D80000
direct allocation
page execute and read and write
1D235000
heap
page read and write
4D40000
direct allocation
page execute and read and write
4771000
heap
page read and write
4771000
heap
page read and write
1D243000
heap
page read and write
4D70000
direct allocation
page execute and read and write
1D235000
heap
page read and write
4771000
heap
page read and write
1D1AC000
stack
page read and write
2ABB000
stack
page read and write
2937E000
stack
page read and write
1D240000
heap
page read and write
1D235000
heap
page read and write
1D23D000
heap
page read and write
68E000
stack
page read and write
4D50000
direct allocation
page execute and read and write
2B20000
heap
page read and write
1D240000
heap
page read and write
232A7000
heap
page read and write
2D6E000
stack
page read and write
6C8000
heap
page read and write
3C6E000
stack
page read and write
1D25C000
heap
page read and write
4771000
heap
page read and write
1CF1F000
stack
page read and write
1D235000
heap
page read and write
4870000
trusted library allocation
page read and write
336F000
stack
page read and write
4771000
heap
page read and write
1D240000
heap
page read and write
33AE000
stack
page read and write
34EE000
stack
page read and write
79B000
heap
page read and write
B05000
unkown
page execute and read and write
326E000
stack
page read and write
1D23C000
heap
page read and write
1D234000
heap
page read and write
1D23D000
heap
page read and write
E20000
unkown
page execute and read and write
4771000
heap
page read and write
4771000
heap
page read and write
1CE1E000
stack
page read and write
4771000
heap
page read and write
376E000
stack
page read and write
FCF000
unkown
page execute and read and write
744000
heap
page read and write
92E000
stack
page read and write
1D240000
heap
page read and write
7C0000
direct allocation
page read and write
4771000
heap
page read and write
1D240000
heap
page read and write
E28000
unkown
page execute and read and write
29280000
heap
page read and write
6B0000
heap
page read and write
1D243000
heap
page read and write
1D23D000
heap
page read and write
713000
heap
page read and write
1D226000
heap
page read and write
6C671000
unkown
page execute read
1D237000
heap
page read and write
4771000
heap
page read and write
61EB4000
direct allocation
page read and write
6C84F000
unkown
page write copy
1D23C000
heap
page read and write
3D6F000
stack
page read and write
1D240000
heap
page read and write
1D24C000
heap
page read and write
1D243000
heap
page read and write
11DF000
stack
page read and write
7A0000
heap
page read and write
3BD000
stack
page read and write
7D0000
heap
page read and write
4771000
heap
page read and write
412F000
stack
page read and write
7D5000
heap
page read and write
4771000
heap
page read and write
2B00000
heap
page read and write
941000
unkown
page execute and write copy
30EF000
stack
page read and write
4771000
heap
page read and write
4771000
heap
page read and write
99A000
unkown
page execute and read and write
4D60000
direct allocation
page execute and read and write
1D23C000
heap
page read and write
4771000
heap
page read and write
1D259000
heap
page read and write
4771000
heap
page read and write
7C0000
direct allocation
page read and write
There are 340 hidden memdumps, click here to show them.