IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFIEGCAECGCAEBFHDHIE
ASCII text, with very long lines (1765), with CRLF line terminators
dropped
C:\ProgramData\DGHDHIDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\EGDGIIJJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FCAFIJJJKEGIECAKKEHIDHDAKK
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\FHJDGHIJDGCBAAAAAFIJDAECGH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HCAAEBKEGHJKEBFHJDBFCFBKKJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IIJEBAECGCBKECAAAEBF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJDGCGHCGHCBFHJJKKJEHJEHJE
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\KFCFIEHCFIECBGCBFHIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://185.215.113.37/e2b1563c6670f193.phpxC
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllH
unknown
http://185.215.113.37/e2b1563c6670f193.phpnd9f1
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.113.37/e2b1563c6670f193.phpainnet
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll:
unknown
http://185.215.113.37/e2b1563c6670f193.phprowser
unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll0
unknown
http://185.215.113.37/e2b1563c6670f193.phpgr
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll&
unknown
http://185.215.113.37e2b1563c6670f193.phption:
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
unknown
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
http://185.215.113.37/e2b1563c6670f193.phpti
unknown
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
http://185.215.113.37/e2b1563c6670f193.phpi
unknown
http://www.sqlite.org/copyright.html.
unknown
http://185.215.113.37/e2b1563c6670f193.phpg
unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllr
unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll8L
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.37/2M
unknown
http://185.215.113.37/e2b1563c6670f193.phpirefox
unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllT
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://185.215.113.37/e2b1563c6670f193.phpmo
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllF
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://185.215.113.37/e2b1563c6670f193.php=C
unknown
http://185.215.113.37/e2b1563c6670f193.phpin
unknown
http://185.215.113.37/e2b1563c6670f193.phpem
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.37/e2b1563c6670f193.php5
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllh
unknown
http://185.215.113.37/e2b1563c6670f193.phpwsApps
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllZ
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 51 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
981000
unkown
page execute and read and write
 malicious
157C000
heap
page read and write
 malicious
5000000
direct allocation
page read and write
 malicious
15D5000
heap
page read and write
6CD22000
unkown
page readonly
2F50000
direct allocation
page read and write
3B6E000
stack
page read and write
4B71000
heap
page read and write
5180000
direct allocation
page execute and read and write
2F30000
heap
page read and write
1D637000
heap
page read and write
3CAE000
stack
page read and write
61EB4000
direct allocation
page read and write
4B71000
heap
page read and write
1D66D000
heap
page read and write
2F50000
direct allocation
page read and write
15EE000
heap
page read and write
155E000
heap
page read and write
15EA000
heap
page read and write
4B71000
heap
page read and write
930000
heap
page read and write
5000000
direct allocation
page read and write
3DAF000
stack
page read and write
1D64C000
heap
page read and write
A0F000
unkown
page execute and read and write
4B71000
heap
page read and write
297D1000
heap
page read and write
1D650000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
15A3000
heap
page read and write
BDE000
unkown
page execute and read and write
1D37D000
stack
page read and write
1D654000
heap
page read and write
4B71000
heap
page read and write
E84000
unkown
page execute and read and write
6CD30000
unkown
page readonly
466F000
stack
page read and write
D67000
unkown
page execute and read and write
11BE000
stack
page read and write
1D650000
heap
page read and write
38EE000
stack
page read and write
2F50000
direct allocation
page read and write
1D645000
heap
page read and write
2F9E9000
heap
page read and write
2380F000
heap
page read and write
1D66D000
heap
page read and write
61EB7000
direct allocation
page readonly
4B71000
heap
page read and write
316F000
stack
page read and write
402F000
stack
page read and write
6CF10000
unkown
page read and write
1D653000
heap
page read and write
3DEE000
stack
page read and write
980000
unkown
page readonly
4B71000
heap
page read and write
4B71000
heap
page read and write
1D64A000
heap
page read and write
1D651000
heap
page read and write
1D642000
heap
page read and write
4B80000
heap
page read and write
4B71000
heap
page read and write
1D65E000
heap
page read and write
6BC000
stack
page read and write
3A2E000
stack
page read and write
A8F000
unkown
page execute and read and write
4B71000
heap
page read and write
39EF000
stack
page read and write
A6F000
unkown
page execute and read and write
362F000
stack
page read and write
E6C000
unkown
page execute and read and write
2F50000
direct allocation
page read and write
1D635000
heap
page read and write
4B71000
heap
page read and write
1D650000
heap
page read and write
4B71000
heap
page read and write
1D646000
heap
page read and write
1D647000
heap
page read and write
406E000
stack
page read and write
1D640000
heap
page read and write
1D636000
heap
page read and write
2F9F7000
heap
page read and write
6CD0D000
unkown
page readonly
1D66D000
heap
page read and write
810000
heap
page read and write
1D650000
heap
page read and write
6CD31000
unkown
page execute read
4B71000
heap
page read and write
42EE000
stack
page read and write
4B70000
heap
page read and write
4B71000
heap
page read and write
1D65E000
heap
page read and write
1D646000
heap
page read and write
981000
unkown
page execute and write copy
61ECD000
direct allocation
page readonly
4B71000
heap
page read and write
1D74F000
heap
page read and write
47EE000
stack
page read and write
1D649000
heap
page read and write
E84000
unkown
page execute and write copy
1D646000
heap
page read and write
4B71000
heap
page read and write
A9E000
unkown
page execute and read and write
47AF000
stack
page read and write
6CC91000
unkown
page execute read
1D65D000
heap
page read and write
1D650000
heap
page read and write
1D65D000
heap
page read and write
8F0000
heap
page read and write
1D5BC000
stack
page read and write
1D635000
heap
page read and write
1D64B000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
5000000
direct allocation
page read and write
1D658000
heap
page read and write
B25000
unkown
page execute and read and write
1D651000
heap
page read and write
A08000
unkown
page execute and read and write
1D655000
heap
page read and write
11FC000
stack
page read and write
518E000
stack
page read and write
32AE000
stack
page read and write
4B71000
heap
page read and write
2F9FD000
heap
page read and write
1D650000
heap
page read and write
1D63E000
heap
page read and write
2F50000
direct allocation
page read and write
4B71000
heap
page read and write
1D668000
heap
page read and write
4B71000
heap
page read and write
1D66D000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
48EF000
stack
page read and write
236BD000
heap
page read and write
6CC90000
unkown
page readonly
1D620000
heap
page read and write
29811000
heap
page read and write
1D66D000
heap
page read and write
2F93F000
stack
page read and write
4B71000
heap
page read and write
6CECF000
unkown
page readonly
5180000
direct allocation
page execute and read and write
15F4000
heap
page read and write
1CF8E000
stack
page read and write
1D64E000
heap
page read and write
6CF0E000
unkown
page read and write
51A0000
direct allocation
page execute and read and write
1D64A000
heap
page read and write
1D62B000
heap
page read and write
7BD000
stack
page read and write
4B71000
heap
page read and write
1D65E000
heap
page read and write
1D645000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
297B1000
heap
page read and write
7B3000
stack
page read and write
1D66D000
heap
page read and write
1540000
heap
page read and write
153E000
stack
page read and write
1CF4F000
stack
page read and write
935000
heap
page read and write
1D646000
heap
page read and write
A9B000
unkown
page execute and read and write
4B71000
heap
page read and write
1D645000
heap
page read and write
1D622000
heap
page read and write
3F2E000
stack
page read and write
29790000
heap
page read and write
4A6E000
stack
page read and write
416F000
stack
page read and write
1D650000
heap
page read and write
297F1000
heap
page read and write
1D65D000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
1D65E000
heap
page read and write
1D650000
heap
page read and write
1D47D000
stack
page read and write
1D644000
heap
page read and write
33AF000
stack
page read and write
4B71000
heap
page read and write
1D66D000
heap
page read and write
2F50000
direct allocation
page read and write
442E000
stack
page read and write
4B71000
heap
page read and write
1D63B000
heap
page read and write
1D65E000
heap
page read and write
2F950000
trusted library allocation
page read and write
1D656000
heap
page read and write
2F50000
direct allocation
page read and write
1026000
unkown
page execute and write copy
1D650000
heap
page read and write
2F50000
direct allocation
page read and write
2F2E000
stack
page read and write
4B71000
heap
page read and write
7B9000
stack
page read and write
1D65E000
heap
page read and write
4B71000
heap
page read and write
2F9F1000
heap
page read and write
1D645000
heap
page read and write
1D66D000
heap
page read and write
4B71000
heap
page read and write
2F83E000
stack
page read and write
1D668000
heap
page read and write
1D65E000
heap
page read and write
4B71000
heap
page read and write
1D650000
heap
page read and write
1D646000
heap
page read and write
1D23E000
stack
page read and write
1D644000
heap
page read and write
1D648000
heap
page read and write
1D66D000
heap
page read and write
1D66D000
heap
page read and write
4B90000
heap
page read and write
1D66C000
heap
page read and write
4B71000
heap
page read and write
1D64D000
heap
page read and write
43EF000
stack
page read and write
41AE000
stack
page read and write
1D650000
heap
page read and write
2F50000
direct allocation
page read and write
14FF000
stack
page read and write
4B71000
heap
page read and write
4A2F000
stack
page read and write
1D65E000
heap
page read and write
1D66D000
heap
page read and write
4B71000
heap
page read and write
1D651000
heap
page read and write
2F50000
direct allocation
page read and write
4B71000
heap
page read and write
9DA000
unkown
page execute and read and write
51B0000
direct allocation
page execute and read and write
B4B000
unkown
page execute and read and write
61E00000
direct allocation
page execute and read and write
1D0CE000
stack
page read and write
61ED4000
direct allocation
page readonly
1D650000
heap
page read and write
352E000
stack
page read and write
42AE000
stack
page read and write
A62000
unkown
page execute and read and write
61ECC000
direct allocation
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
A12000
unkown
page execute and read and write
1D630000
heap
page read and write
4B71000
heap
page read and write
1D646000
heap
page read and write
376F000
stack
page read and write
1D650000
heap
page read and write
1025000
unkown
page execute and read and write
513F000
stack
page read and write
4B71000
heap
page read and write
5150000
direct allocation
page execute and read and write
5160000
direct allocation
page execute and read and write
A31000
unkown
page execute and read and write
1D642000
heap
page read and write
6CF15000
unkown
page readonly
1D63D000
heap
page read and write
1D650000
heap
page read and write
1D648000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
1D63E000
heap
page read and write
3EEF000
stack
page read and write
4B71000
heap
page read and write
980000
unkown
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
3C6F000
stack
page read and write
4B6F000
stack
page read and write
4B71000
heap
page read and write
37AE000
stack
page read and write
1D646000
heap
page read and write
1D636000
heap
page read and write
5190000
direct allocation
page execute and read and write
1D645000
heap
page read and write
4B71000
heap
page read and write
1D636000
heap
page read and write
2F9EF000
heap
page read and write
4B87000
heap
page read and write
1D657000
heap
page read and write
1D649000
heap
page read and write
155A000
heap
page read and write
4B71000
heap
page read and write
2F67000
heap
page read and write
4B71000
heap
page read and write
B45000
unkown
page execute and read and write
1D650000
heap
page read and write
34EF000
stack
page read and write
4B71000
heap
page read and write
1D740000
trusted library allocation
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
1D646000
heap
page read and write
E4B000
unkown
page execute and read and write
4B71000
heap
page read and write
1D650000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
492E000
stack
page read and write
1D646000
heap
page read and write
29770000
heap
page read and write
366E000
stack
page read and write
E85000
unkown
page execute and write copy
1D647000
heap
page read and write
112E000
stack
page read and write
1D63D000
heap
page read and write
2F6E000
heap
page read and write
2F50000
direct allocation
page read and write
1D4BD000
stack
page read and write
61ED0000
direct allocation
page read and write
1D650000
heap
page read and write
1D652000
heap
page read and write
326F000
stack
page read and write
1D646000
heap
page read and write
1D1CE000
stack
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
1D650000
heap
page read and write
4B71000
heap
page read and write
2F50000
direct allocation
page read and write
1D642000
heap
page read and write
1D650000
heap
page read and write
1D651000
heap
page read and write
2EEF000
stack
page read and write
1D64C000
heap
page read and write
33EE000
stack
page read and write
306F000
stack
page read and write
A05000
unkown
page execute and read and write
1550000
heap
page read and write
1D650000
heap
page read and write
1D64A000
heap
page read and write
6CF0F000
unkown
page write copy
3B2F000
stack
page read and write
46AE000
stack
page read and write
1D650000
heap
page read and write
1D33F000
stack
page read and write
23761000
heap
page read and write
97D000
stack
page read and write
A3D000
unkown
page execute and read and write
6CD1E000
unkown
page read and write
2F50000
direct allocation
page read and write
5170000
direct allocation
page execute and read and write
1D646000
heap
page read and write
61E01000
direct allocation
page execute read
2F6B000
heap
page read and write
1D649000
heap
page read and write
1D636000
heap
page read and write
4B71000
heap
page read and write
4C70000
trusted library allocation
page read and write
456E000
stack
page read and write
4B71000
heap
page read and write
E74000
unkown
page execute and read and write
116E000
stack
page read and write
2F50000
direct allocation
page read and write
1D65D000
heap
page read and write
1D64B000
heap
page read and write
1D640000
heap
page read and write
1D649000
heap
page read and write
1D650000
heap
page read and write
503B000
stack
page read and write
1D646000
heap
page read and write
4B71000
heap
page read and write
1D66D000
heap
page read and write
15BB000
heap
page read and write
1D08F000
stack
page read and write
61ED3000
direct allocation
page read and write
38AF000
stack
page read and write
4B71000
heap
page read and write
452F000
stack
page read and write
2F60000
heap
page read and write
4B71000
heap
page read and write
There are 368 hidden memdumps, click here to show them.