IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFCBKFHJJJKKFHIDAAKFBFBFCG
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\CBFCBKKFBAEHJKEBKFCBGHIDBF
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DGDBFBFCBFBKECAAKJKF
ASCII text, with very long lines (1765), with CRLF line terminators
dropped
C:\ProgramData\EHIJJDGDHDGDAKFIECFI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FBFIDBFHDBGIDHJJEGHIIDAFID
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\GIEBGIIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\GIEHJKEB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IDHIEBAAKJDHIECAAFHCAECAFC
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JKJEHJKJEBGHJJKEBGIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll13.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpSU
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phprowser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpowT
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpv
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpz
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllQ:1
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll%;
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllG:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllm;e
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpg
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpZ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php2
unknown
 malicious
http://185.215.113.37/:A
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php/
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpenSSH
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll0
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php$
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 42 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
EAE000
heap
page read and write
 malicious
4AC0000
direct allocation
page read and write
 malicious
5D1000
unkown
page execute and read and write
 malicious
1D10C000
heap
page read and write
681000
unkown
page execute and read and write
6DF000
unkown
page execute and read and write
1D12D000
heap
page read and write
F09000
heap
page read and write
1D0F6000
heap
page read and write
1D0FD000
heap
page read and write
1D109000
heap
page read and write
1D106000
heap
page read and write
1D105000
heap
page read and write
1CCAF000
stack
page read and write
DD4000
heap
page read and write
DD4000
heap
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
38BE000
stack
page read and write
4641000
heap
page read and write
1D128000
heap
page read and write
C53000
unkown
page execute and write copy
1D102000
heap
page read and write
1D117000
heap
page read and write
1D100000
heap
page read and write
DBB000
heap
page read and write
6CF25000
unkown
page readonly
DD4000
heap
page read and write
1D11E000
heap
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
DD4000
heap
page read and write
4641000
heap
page read and write
1D110000
heap
page read and write
1D10A000
heap
page read and write
1D0F6000
heap
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
39FE000
stack
page read and write
2C3F000
stack
page read and write
1D12C000
heap
page read and write
1D105000
heap
page read and write
1D110000
heap
page read and write
4641000
heap
page read and write
1D110000
heap
page read and write
6CF1F000
unkown
page write copy
1D110000
heap
page read and write
1D106000
heap
page read and write
61ED0000
direct allocation
page read and write
D90000
direct allocation
page read and write
1D12D000
heap
page read and write
68D000
unkown
page execute and read and write
4641000
heap
page read and write
4641000
heap
page read and write
1D107000
heap
page read and write
1D0FE000
heap
page read and write
1D0EB000
heap
page read and write
1D111000
heap
page read and write
29250000
heap
page read and write
1D118000
heap
page read and write
DD4000
heap
page read and write
1D106000
heap
page read and write
D90000
direct allocation
page read and write
4641000
heap
page read and write
43FE000
stack
page read and write
D90000
direct allocation
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
1D106000
heap
page read and write
4641000
heap
page read and write
3DBE000
stack
page read and write
2D7E000
stack
page read and write
1C92E000
stack
page read and write
61EB7000
direct allocation
page readonly
DD4000
heap
page read and write
1D128000
heap
page read and write
DD4000
heap
page read and write
6BF000
unkown
page execute and read and write
4AA0000
heap
page read and write
6EE000
unkown
page execute and read and write
DD4000
heap
page read and write
3C3F000
stack
page read and write
4FD000
stack
page read and write
1D12D000
heap
page read and write
1D106000
heap
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
323F000
stack
page read and write
1D109000
heap
page read and write
500000
heap
page read and write
1D102000
heap
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
29271000
heap
page read and write
463F000
stack
page read and write
4641000
heap
page read and write
1D11D000
heap
page read and write
1D114000
heap
page read and write
4641000
heap
page read and write
DD4000
heap
page read and write
D90000
direct allocation
page read and write
1D111000
heap
page read and write
1D106000
heap
page read and write
6F89E000
unkown
page read and write
1D11E000
heap
page read and write
1D10B000
heap
page read and write
4641000
heap
page read and write
4C30000
direct allocation
page execute and read and write
1D110000
heap
page read and write
A89000
unkown
page execute and read and write
C52000
unkown
page execute and read and write
1D12D000
heap
page read and write
DBE000
heap
page read and write
4641000
heap
page read and write
6F8A2000
unkown
page readonly
4641000
heap
page read and write
1D12D000
heap
page read and write
44FF000
stack
page read and write
3D7F000
stack
page read and write
33BE000
stack
page read and write
1D109000
heap
page read and write
1D110000
heap
page read and write
1D100000
heap
page read and write
427F000
stack
page read and write
4641000
heap
page read and write
2F3FF000
stack
page read and write
61EB4000
direct allocation
page read and write
2F4B4000
heap
page read and write
30FF000
stack
page read and write
1D11E000
heap
page read and write
1CDFF000
stack
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
1D106000
heap
page read and write
DD4000
heap
page read and write
1CBAE000
stack
page read and write
4641000
heap
page read and write
1D0E0000
heap
page read and write
9B0000
unkown
page execute and read and write
82E000
unkown
page execute and read and write
62A000
unkown
page execute and read and write
4641000
heap
page read and write
DD4000
heap
page read and write
29291000
heap
page read and write
1D109000
heap
page read and write
4641000
heap
page read and write
1D0F5000
heap
page read and write
3EBE000
stack
page read and write
1D104000
heap
page read and write
3AFF000
stack
page read and write
4641000
heap
page read and write
DD4000
heap
page read and write
1D110000
heap
page read and write
4BFF000
stack
page read and write
1D104000
heap
page read and write
6CD41000
unkown
page execute read
2E7F000
stack
page read and write
1D0F7000
heap
page read and write
1D200000
trusted library allocation
page read and write
1D12D000
heap
page read and write
6CEDF000
unkown
page readonly
1D10A000
heap
page read and write
1D0F0000
heap
page read and write
DD4000
heap
page read and write
DD4000
heap
page read and write
4641000
heap
page read and write
E5E000
stack
page read and write
DD4000
heap
page read and write
DD4000
heap
page read and write
4641000
heap
page read and write
1D0F6000
heap
page read and write
4641000
heap
page read and write
D90000
direct allocation
page read and write
6CF20000
unkown
page read and write
61ED4000
direct allocation
page readonly
AB1000
unkown
page execute and read and write
1D111000
heap
page read and write
5D0000
unkown
page read and write
2D3F000
stack
page read and write
4641000
heap
page read and write
4C00000
direct allocation
page execute and read and write
1D110000
heap
page read and write
5D0000
unkown
page readonly
1D12D000
heap
page read and write
4641000
heap
page read and write
1D106000
heap
page read and write
DD4000
heap
page read and write
DD4000
heap
page read and write
775000
unkown
page execute and read and write
DB7000
heap
page read and write
DD4000
heap
page read and write
2EBE000
stack
page read and write
1CA2F000
stack
page read and write
1D110000
heap
page read and write
2F2FE000
stack
page read and write
109E000
stack
page read and write
3B3E000
stack
page read and write
D90000
direct allocation
page read and write
377E000
stack
page read and write
795000
unkown
page execute and read and write
1D11E000
heap
page read and write
1D110000
heap
page read and write
3C7E000
stack
page read and write
DD4000
heap
page read and write
4C40000
direct allocation
page execute and read and write
D90000
direct allocation
page read and write
DD4000
heap
page read and write
1CF7E000
stack
page read and write
1D07D000
stack
page read and write
4740000
trusted library allocation
page read and write
1D105000
heap
page read and write
1D11E000
heap
page read and write
1D110000
heap
page read and write
4641000
heap
page read and write
1D112000
heap
page read and write
D90000
direct allocation
page read and write
57E000
stack
page read and write
4641000
heap
page read and write
1D111000
heap
page read and write
D90000
direct allocation
page read and write
4C50000
direct allocation
page execute and read and write
1CE3E000
stack
page read and write
4641000
heap
page read and write
313E000
stack
page read and write
4641000
heap
page read and write
AC0000
unkown
page execute and write copy
2317E000
heap
page read and write
1D108000
heap
page read and write
3FFF000
stack
page read and write
DD4000
heap
page read and write
29230000
heap
page read and write
1D0FE000
heap
page read and write
DD4000
heap
page read and write
2A3F000
stack
page read and write
DD4000
heap
page read and write
1D12D000
heap
page read and write
1D110000
heap
page read and write
4641000
heap
page read and write
1D113000
heap
page read and write
1D102000
heap
page read and write
510000
heap
page read and write
1D0F5000
heap
page read and write
5BE000
stack
page read and write
5D1000
unkown
page execute and write copy
1D107000
heap
page read and write
34BF000
stack
page read and write
4641000
heap
page read and write
DD4000
heap
page read and write
DD4000
heap
page read and write
1D106000
heap
page read and write
1D110000
heap
page read and write
327E000
stack
page read and write
1D10A000
heap
page read and write
453E000
stack
page read and write
1D108000
heap
page read and write
2F410000
trusted library allocation
page read and write
1D11D000
heap
page read and write
4F3000
stack
page read and write
1D203000
heap
page read and write
61E01000
direct allocation
page execute read
4640000
heap
page read and write
35FF000
stack
page read and write
6F810000
unkown
page readonly
6CF1E000
unkown
page read and write
1D10D000
heap
page read and write
DD4000
heap
page read and write
1CA6D000
stack
page read and write
6CD40000
unkown
page readonly
1D12D000
heap
page read and write
E9E000
stack
page read and write
79B000
unkown
page execute and read and write
4641000
heap
page read and write
6B2000
unkown
page execute and read and write
4641000
heap
page read and write
1D106000
heap
page read and write
658000
unkown
page execute and read and write
1D110000
heap
page read and write
2F4AC000
heap
page read and write
DD4000
heap
page read and write
1D110000
heap
page read and write
1D0F6000
heap
page read and write
1D0FD000
heap
page read and write
1D11D000
heap
page read and write
417E000
stack
page read and write
1D106000
heap
page read and write
6F811000
unkown
page execute read
1D11E000
heap
page read and write
1D110000
heap
page read and write
1AC000
stack
page read and write
2F4A2000
heap
page read and write
DD4000
heap
page read and write
4641000
heap
page read and write
4C10000
direct allocation
page execute and read and write
119E000
stack
page read and write
61E00000
direct allocation
page execute and read and write
61ED3000
direct allocation
page read and write
DD4000
heap
page read and write
337F000
stack
page read and write
AC0000
unkown
page execute and read and write
D90000
direct allocation
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
662000
unkown
page execute and read and write
E1C000
stack
page read and write
373F000
stack
page read and write
6F88D000
unkown
page readonly
1D11E000
heap
page read and write
43BF000
stack
page read and write
2F4AA000
heap
page read and write
1D105000
heap
page read and write
1D115000
heap
page read and write
1D0E2000
heap
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
AA9000
unkown
page execute and read and write
DD4000
heap
page read and write
D90000
direct allocation
page read and write
DD4000
heap
page read and write
4641000
heap
page read and write
1CCFE000
stack
page read and write
39BF000
stack
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
4F9000
stack
page read and write
1D110000
heap
page read and write
1D10E000
heap
page read and write
1D116000
heap
page read and write
4AFB000
stack
page read and write
1D110000
heap
page read and write
DC0000
direct allocation
page read and write
1D110000
heap
page read and write
4C30000
direct allocation
page execute and read and write
F28000
heap
page read and write
1D12D000
heap
page read and write
403E000
stack
page read and write
D90000
direct allocation
page read and write
DD4000
heap
page read and write
61ECD000
direct allocation
page readonly
4660000
heap
page read and write
DD4000
heap
page read and write
6EB000
unkown
page execute and read and write
61ECC000
direct allocation
page read and write
1D110000
heap
page read and write
1D110000
heap
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
42BE000
stack
page read and write
413F000
stack
page read and write
292D1000
heap
page read and write
4650000
heap
page read and write
4641000
heap
page read and write
D80000
heap
page read and write
4641000
heap
page read and write
EF1000
heap
page read and write
DB0000
heap
page read and write
DD4000
heap
page read and write
DD4000
heap
page read and write
1CB6E000
stack
page read and write
1D10C000
heap
page read and write
DC0000
direct allocation
page read and write
4644000
heap
page read and write
292B1000
heap
page read and write
1D106000
heap
page read and write
2FFE000
stack
page read and write
34FE000
stack
page read and write
4641000
heap
page read and write
DD0000
heap
page read and write
4641000
heap
page read and write
23220000
heap
page read and write
AC1000
unkown
page execute and write copy
232CE000
heap
page read and write
3EFE000
stack
page read and write
1D0FB000
heap
page read and write
1D12D000
heap
page read and write
1D110000
heap
page read and write
2FBF000
stack
page read and write
1D12D000
heap
page read and write
2B3F000
stack
page read and write
1D105000
heap
page read and write
EAA000
heap
page read and write
1D11E000
heap
page read and write
1D10B000
heap
page read and write
4641000
heap
page read and write
4641000
heap
page read and write
DD4000
heap
page read and write
4641000
heap
page read and write
65F000
unkown
page execute and read and write
387F000
stack
page read and write
EA0000
heap
page read and write
D90000
direct allocation
page read and write
363E000
stack
page read and write
1CF3C000
stack
page read and write
4641000
heap
page read and write
4C20000
direct allocation
page execute and read and write
655000
unkown
page execute and read and write
D7E000
stack
page read and write
2F4B0000
heap
page read and write
D90000
direct allocation
page read and write
1D11D000
heap
page read and write
There are 390 hidden memdumps, click here to show them.