IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AEGHJEGIEBFIJJKFIIIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BFHIJEBKEBGHIDHJKJEGCBAEGH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CGDHIEGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DAKFIDHDGIEGCAKFIIJK
ASCII text, with very long lines (1765), with CRLF line terminators
dropped
C:\ProgramData\DBFBFBGDBKJJKFIEHJDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HJDHCFCBGIDGHJJKJJDGHDGDHI
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\IDBGHDGHCGHCAAKFIIECFHCFBF
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\KEGDAKEH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\KEGDAKEHJDHIDHJJDAECFBKFHC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpX#
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpkP
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll6
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnfigOverlay
unknown
 malicious
http://185.215.113.37.u
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php%_
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpainnet
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpOP
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phprowser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllept
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllT
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll2
unknown
 malicious
http://185.215.113.37/Ebi)
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllZ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php;P
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dlll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllH
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpP
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phptrf_
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpirefox
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll~
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllz
unknown
 malicious
http://185.215.113.37e2b1563c6670f193.phpox
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllm
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll$
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpB_9)
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php24
unknown
 malicious
http://185.215.113.37/1b
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 52 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4D60000
direct allocation
page read and write
 malicious
F1E000
heap
page read and write
 malicious
3A1000
unkown
page execute and read and write
 malicious
451F000
stack
page read and write
1D3B7000
heap
page read and write
48E1000
heap
page read and write
1D4B0000
trusted library allocation
page read and write
565000
unkown
page execute and read and write
48E1000
heap
page read and write
1D3A0000
heap
page read and write
3A1E000
stack
page read and write
48E1000
heap
page read and write
1D3DD000
heap
page read and write
1D3C5000
heap
page read and write
48E1000
heap
page read and write
361F000
stack
page read and write
3C5F000
stack
page read and write
1D3B9000
heap
page read and write
E14000
heap
page read and write
1D3C0000
heap
page read and write
2B70000
direct allocation
page read and write
6CC91000
unkown
page execute read
1D3A6000
heap
page read and write
1D3B8000
heap
page read and write
1D3DD000
heap
page read and write
48E1000
heap
page read and write
12DE000
stack
page read and write
F79000
heap
page read and write
1D3B9000
heap
page read and write
1D3B6000
heap
page read and write
F1A000
heap
page read and write
48E1000
heap
page read and write
E14000
heap
page read and write
48E1000
heap
page read and write
1D3B5000
heap
page read and write
301E000
stack
page read and write
1D3DD000
heap
page read and write
2B70000
direct allocation
page read and write
329E000
stack
page read and write
455E000
stack
page read and write
3EDF000
stack
page read and write
1D3C1000
heap
page read and write
325F000
stack
page read and write
4D40000
heap
page read and write
4EE0000
direct allocation
page execute and read and write
465F000
stack
page read and write
6CECF000
unkown
page readonly
48E1000
heap
page read and write
39DF000
stack
page read and write
1D3C8000
heap
page read and write
1D3B5000
heap
page read and write
29511000
heap
page read and write
48E1000
heap
page read and write
482000
unkown
page execute and read and write
48E1000
heap
page read and write
4AF000
unkown
page execute and read and write
1D3B5000
heap
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
BE2000
stack
page read and write
294D0000
heap
page read and write
351E000
stack
page read and write
419E000
stack
page read and write
2B1C000
stack
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
2B60000
heap
page read and write
2B70000
direct allocation
page read and write
1D3C1000
heap
page read and write
1D3DD000
heap
page read and write
2C9F000
stack
page read and write
1D3C0000
heap
page read and write
48E1000
heap
page read and write
48E0000
heap
page read and write
E14000
heap
page read and write
479F000
stack
page read and write
48E1000
heap
page read and write
6CD0D000
unkown
page readonly
48E1000
heap
page read and write
1D3C0000
heap
page read and write
1D3BC000
heap
page read and write
1D3BE000
heap
page read and write
1D1ED000
stack
page read and write
42DE000
stack
page read and write
47DE000
stack
page read and write
1D22D000
stack
page read and write
1CCDF000
stack
page read and write
5EA000
unkown
page execute and read and write
1CBDE000
stack
page read and write
E14000
heap
page read and write
1D3AB000
heap
page read and write
1D3DD000
heap
page read and write
2356B000
heap
page read and write
6CD22000
unkown
page readonly
F95000
heap
page read and write
1D3B6000
heap
page read and write
311F000
stack
page read and write
2F60E000
heap
page read and write
6CD30000
unkown
page readonly
78C000
unkown
page execute and read and write
A4E000
unkown
page execute and read and write
BE4000
stack
page read and write
1CD1E000
stack
page read and write
2EDE000
stack
page read and write
1D3A6000
heap
page read and write
1D3CE000
heap
page read and write
1CF5F000
stack
page read and write
1D3B4000
heap
page read and write
E14000
heap
page read and write
1D0AF000
stack
page read and write
1D3B9000
heap
page read and write
2B70000
direct allocation
page read and write
1D3C4000
heap
page read and write
48E1000
heap
page read and write
1D3B5000
heap
page read and write
61ED0000
direct allocation
page read and write
E14000
heap
page read and write
48E1000
heap
page read and write
1D3B6000
heap
page read and write
1D3A5000
heap
page read and write
6CF0E000
unkown
page read and write
61ECC000
direct allocation
page read and write
4F00000
direct allocation
page execute and read and write
1D3C2000
heap
page read and write
1D3CE000
heap
page read and write
8AA000
unkown
page execute and read and write
405E000
stack
page read and write
3F1E000
stack
page read and write
48E1000
heap
page read and write
1D3DD000
heap
page read and write
1D3C0000
heap
page read and write
1D3C0000
heap
page read and write
1D3BC000
heap
page read and write
E14000
heap
page read and write
48E1000
heap
page read and write
1D3DD000
heap
page read and write
2B5E000
stack
page read and write
33DE000
stack
page read and write
2B70000
direct allocation
page read and write
1D3A6000
heap
page read and write
61EB7000
direct allocation
page readonly
4EC0000
direct allocation
page execute and read and write
48E1000
heap
page read and write
2B70000
direct allocation
page read and write
4EF0000
direct allocation
page execute and read and write
23425000
heap
page read and write
1D3C0000
heap
page read and write
1D3CE000
heap
page read and write
1D3CE000
heap
page read and write
56B000
unkown
page execute and read and write
1D3C0000
heap
page read and write
E14000
heap
page read and write
432000
unkown
page execute and read and write
1D3BA000
heap
page read and write
F61000
heap
page read and write
1D3C0000
heap
page read and write
1D3C0000
heap
page read and write
48E4000
heap
page read and write
48E1000
heap
page read and write
BED000
stack
page read and write
1D3CD000
heap
page read and write
1D3C6000
heap
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
1D3C1000
heap
page read and write
4BB000
unkown
page execute and read and write
E14000
heap
page read and write
2D9F000
stack
page read and write
E14000
heap
page read and write
E14000
heap
page read and write
E14000
heap
page read and write
1D3AE000
heap
page read and write
3C9E000
stack
page read and write
1D3CE000
heap
page read and write
1D3C0000
heap
page read and write
1D3A5000
heap
page read and write
415F000
stack
page read and write
48E1000
heap
page read and write
E14000
heap
page read and write
E14000
heap
page read and write
315E000
stack
page read and write
441E000
stack
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
451000
unkown
page execute and read and write
2F61C000
heap
page read and write
425000
unkown
page execute and read and write
1D3B9000
heap
page read and write
6CC90000
unkown
page readonly
38DE000
stack
page read and write
48E1000
heap
page read and write
ECE000
stack
page read and write
48E1000
heap
page read and write
339F000
stack
page read and write
2B9E000
heap
page read and write
E14000
heap
page read and write
F10000
heap
page read and write
1D39B000
heap
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
E14000
heap
page read and write
61ED3000
direct allocation
page read and write
E14000
heap
page read and write
48E1000
heap
page read and write
4D60000
direct allocation
page read and write
294F0000
heap
page read and write
48E1000
heap
page read and write
1D3BB000
heap
page read and write
1CE1F000
stack
page read and write
48E1000
heap
page read and write
1D3B6000
heap
page read and write
1CE5E000
stack
page read and write
89B000
unkown
page execute and read and write
2B70000
direct allocation
page read and write
2E9F000
stack
page read and write
1D3C0000
heap
page read and write
1D3BA000
heap
page read and write
11DF000
stack
page read and write
48E1000
heap
page read and write
1D3CD000
heap
page read and write
61EB4000
direct allocation
page read and write
1D3A6000
heap
page read and write
43DF000
stack
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
1D3DD000
heap
page read and write
1D3D8000
heap
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
3A0000
unkown
page readonly
48E1000
heap
page read and write
E14000
heap
page read and write
1D3BD000
heap
page read and write
E14000
heap
page read and write
2B70000
direct allocation
page read and write
8AA000
unkown
page execute and write copy
1D392000
heap
page read and write
2F609000
heap
page read and write
4ED0000
direct allocation
page execute and read and write
61ECD000
direct allocation
page readonly
48E1000
heap
page read and write
E14000
heap
page read and write
2B70000
direct allocation
page read and write
1D3AD000
heap
page read and write
2B9B000
heap
page read and write
AEC000
stack
page read and write
E10000
heap
page read and write
2B90000
heap
page read and write
894000
unkown
page execute and read and write
401E000
stack
page read and write
6CF0F000
unkown
page write copy
1D3B6000
heap
page read and write
1D3B2000
heap
page read and write
469E000
stack
page read and write
E14000
heap
page read and write
E14000
heap
page read and write
375F000
stack
page read and write
1D390000
heap
page read and write
2F611000
heap
page read and write
1D3B6000
heap
page read and write
6CD31000
unkown
page execute read
4E9F000
stack
page read and write
6CD1E000
unkown
page read and write
1D3CE000
heap
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
874000
unkown
page execute and read and write
1D3DD000
heap
page read and write
48E1000
heap
page read and write
6CF10000
unkown
page read and write
365E000
stack
page read and write
1D0ED000
stack
page read and write
E14000
heap
page read and write
E14000
heap
page read and write
E14000
heap
page read and write
48E1000
heap
page read and write
1D3C0000
heap
page read and write
48E1000
heap
page read and write
1D3C0000
heap
page read and write
234CC000
heap
page read and write
1D3C0000
heap
page read and write
48E1000
heap
page read and write
1D3B6000
heap
page read and write
1D3C0000
heap
page read and write
48E1000
heap
page read and write
1D3B8000
heap
page read and write
1D3CE000
heap
page read and write
1D3C0000
heap
page read and write
1D3DD000
heap
page read and write
3DDE000
stack
page read and write
2B70000
direct allocation
page read and write
3A0000
unkown
page read and write
1D3A7000
heap
page read and write
1CFAE000
stack
page read and write
1D3BB000
heap
page read and write
48E1000
heap
page read and write
48F000
unkown
page execute and read and write
48E1000
heap
page read and write
1D3B0000
heap
page read and write
4D9B000
stack
page read and write
1D3CD000
heap
page read and write
E60000
heap
page read and write
E14000
heap
page read and write
1D3BA000
heap
page read and write
48DF000
stack
page read and write
48E1000
heap
page read and write
1D3CE000
heap
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
1D3C0000
heap
page read and write
1D3B2000
heap
page read and write
1D3B6000
heap
page read and write
48E1000
heap
page read and write
428000
unkown
page execute and read and write
1D3C7000
heap
page read and write
2B70000
direct allocation
page read and write
2B97000
heap
page read and write
1D4B8000
heap
page read and write
E14000
heap
page read and write
48E1000
heap
page read and write
1D3B2000
heap
page read and write
E14000
heap
page read and write
1D3C0000
heap
page read and write
1D3B5000
heap
page read and write
1D3DC000
heap
page read and write
29582000
heap
page read and write
48E1000
heap
page read and write
2FDF000
stack
page read and write
48E1000
heap
page read and write
1D3C0000
heap
page read and write
E14000
heap
page read and write
389F000
stack
page read and write
61E01000
direct allocation
page execute read
4900000
heap
page read and write
A4F000
unkown
page execute and write copy
E14000
heap
page read and write
E14000
heap
page read and write
2F570000
trusted library allocation
page read and write
1D3C1000
heap
page read and write
4BE000
unkown
page execute and read and write
1D3B0000
heap
page read and write
2ADE000
stack
page read and write
3D9F000
stack
page read and write
429F000
stack
page read and write
61ED4000
direct allocation
page readonly
48F0000
heap
page read and write
61E00000
direct allocation
page execute and read and write
2958C000
heap
page read and write
1D3DD000
heap
page read and write
F0D000
stack
page read and write
BE8000
stack
page read and write
4D60000
direct allocation
page read and write
42F000
unkown
page execute and read and write
E14000
heap
page read and write
1D3CD000
heap
page read and write
1D3B6000
heap
page read and write
8AB000
unkown
page execute and write copy
E14000
heap
page read and write
3A1000
unkown
page execute and write copy
34DF000
stack
page read and write
1D3C3000
heap
page read and write
1D3C0000
heap
page read and write
545000
unkown
page execute and read and write
1D3D8000
heap
page read and write
2B70000
direct allocation
page read and write
1D3AE000
heap
page read and write
F5F000
heap
page read and write
E14000
heap
page read and write
1D3B4000
heap
page read and write
2B70000
direct allocation
page read and write
45D000
unkown
page execute and read and write
4EE0000
direct allocation
page execute and read and write
1D3C0000
heap
page read and write
1D32C000
stack
page read and write
E14000
heap
page read and write
E14000
heap
page read and write
1D3B7000
heap
page read and write
E14000
heap
page read and write
1D3DD000
heap
page read and write
1D3B6000
heap
page read and write
48E1000
heap
page read and write
48E1000
heap
page read and write
1D3C0000
heap
page read and write
1D3B6000
heap
page read and write
6CF15000
unkown
page readonly
2B70000
direct allocation
page read and write
3B5E000
stack
page read and write
E50000
heap
page read and write
48E1000
heap
page read and write
1D3B6000
heap
page read and write
48E1000
heap
page read and write
3B1F000
stack
page read and write
1D3AD000
heap
page read and write
49E0000
trusted library allocation
page read and write
379E000
stack
page read and write
5FE000
unkown
page execute and read and write
2F616000
heap
page read and write
4EB0000
direct allocation
page execute and read and write
3FA000
unkown
page execute and read and write
There are 390 hidden memdumps, click here to show them.