IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAAKEBGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\AFCAAEGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\BKJJJDHDGDAAKECAKJDAEGCBKE
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DAKJDAAFBKFHIEBFCFBK
ASCII text, with very long lines (1769), with CRLF line terminators
dropped
C:\ProgramData\GCFHDAKECFIDGDGDBKJDGIIIDB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GHJEHJJDAAAKEBGCFCAAAAEHCB
SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
dropped
C:\ProgramData\HDGIJJDGCBKFIDHIEBKE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JEGHJDGIJECGDHJJECGH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KFBGDBFBKKJECBFHDGIECAFCGC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
unknown
http://185.215.113.37/e2b1563c6670f193.php&/
unknown
https://duckduckgo.com/chrome_newtab
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllc1
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllx
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.113.37/e2b1563c6670f193.phpB(i
unknown
http://185.215.113.37/e2b1563c6670f193.phpData
unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllN
unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll0
unknown
http://185.215.113.37/e2b1563c6670f193.php~(
unknown
http://185.215.113.37/49
unknown
http://185.215.113.37/e2b1563c6670f193.phpt
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllI1
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.37/e2b1563c6670f193.phpte:(
unknown
http://185.215.113.37/e2b1563c6670f193.phpv/
unknown
http://185.215.113.37/e2b1563c6670f193.phpD:
unknown
http://185.215.113.37/e2b1563c6670f193.phpb
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
unknown
http://www.sqlite.org/copyright.html.
unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllJ
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://185.215.113.37/e2b1563c6670f193.phpnce
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.37/e2b1563c6670f193.phpT
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
http://185.215.113.37/e2b1563c6670f193.phpD
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.37/e2b1563c6670f193.phpic_qt
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
http://185.215.113.37/e2b1563c6670f193.php.(
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.37.google.com
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllX
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
unknown
There are 45 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
6DE000
heap
page read and write
 malicious
4BA0000
direct allocation
page read and write
 malicious
FC1000
unkown
page execute and read and write
 malicious
398E000
stack
page read and write
30CE000
stack
page read and write
4711000
heap
page read and write
1D36F000
heap
page read and write
434F000
stack
page read and write
308F000
stack
page read and write
4D30000
direct allocation
page execute and read and write
4711000
heap
page read and write
1471000
unkown
page execute and read and write
1D34F000
heap
page read and write
2F5A6000
heap
page read and write
410E000
stack
page read and write
370E000
stack
page read and write
754000
heap
page read and write
4D10000
direct allocation
page execute and read and write
3D4000
heap
page read and write
1D34E000
heap
page read and write
4711000
heap
page read and write
1D35F000
heap
page read and write
1D33B000
heap
page read and write
460E000
stack
page read and write
1052000
unkown
page execute and read and write
4D20000
direct allocation
page execute and read and write
1D32F000
heap
page read and write
1D370000
heap
page read and write
4711000
heap
page read and write
3D4000
heap
page read and write
723000
heap
page read and write
1D36C000
heap
page read and write
1D36F000
heap
page read and write
3D4000
heap
page read and write
1D36D000
heap
page read and write
3F8F000
stack
page read and write
3D4000
heap
page read and write
438E000
stack
page read and write
4711000
heap
page read and write
1D34D000
heap
page read and write
1D03D000
stack
page read and write
4CDF000
stack
page read and write
4711000
heap
page read and write
1D356000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D356000
heap
page read and write
293E2000
heap
page read and write
2F598000
heap
page read and write
1CB2E000
stack
page read and write
6D125000
unkown
page readonly
1D33A000
heap
page read and write
36CF000
stack
page read and write
1D356000
heap
page read and write
FB0000
direct allocation
page read and write
1D341000
heap
page read and write
2F3EE000
stack
page read and write
1D349000
heap
page read and write
4711000
heap
page read and write
1D366000
heap
page read and write
1071000
unkown
page execute and read and write
1CCAE000
stack
page read and write
4711000
heap
page read and write
1D366000
heap
page read and write
3D4000
heap
page read and write
FB0000
direct allocation
page read and write
1D353000
heap
page read and write
3D4000
heap
page read and write
3D4000
heap
page read and write
1D342000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1CA2E000
stack
page read and write
1D356000
heap
page read and write
2F5AE000
heap
page read and write
1D31E000
stack
page read and write
4711000
heap
page read and write
1D366000
heap
page read and write
61EB4000
direct allocation
page read and write
448F000
stack
page read and write
1D327000
heap
page read and write
F6E000
heap
page read and write
1D341000
heap
page read and write
1D338000
heap
page read and write
1CDAF000
stack
page read and write
ECB000
stack
page read and write
610000
heap
page read and write
1D33A000
heap
page read and write
FB0000
direct allocation
page read and write
F60000
heap
page read and write
1D354000
heap
page read and write
1D33A000
heap
page read and write
4B50000
trusted library allocation
page read and write
F67000
heap
page read and write
1D354000
heap
page read and write
6D0DF000
unkown
page readonly
A9E000
stack
page read and write
1D338000
heap
page read and write
4717000
heap
page read and write
7C5000
heap
page read and write
2938D000
heap
page read and write
1D352000
heap
page read and write
F6B000
heap
page read and write
3D4000
heap
page read and write
3D4000
heap
page read and write
1D366000
heap
page read and write
4711000
heap
page read and write
4720000
heap
page read and write
1D350000
heap
page read and write
1D33E000
heap
page read and write
44CE000
stack
page read and write
4BDB000
stack
page read and write
4711000
heap
page read and write
1D36F000
heap
page read and write
99E000
stack
page read and write
3D4000
heap
page read and write
29340000
heap
page read and write
3C0E000
stack
page read and write
4711000
heap
page read and write
6CEA1000
unkown
page execute read
14AA000
unkown
page execute and read and write
3D4000
heap
page read and write
118B000
unkown
page execute and read and write
1D346000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
3D4000
heap
page read and write
1D352000
heap
page read and write
3D4000
heap
page read and write
61E01000
direct allocation
page execute read
1D356000
heap
page read and write
7C2000
heap
page read and write
330F000
stack
page read and write
FB0000
direct allocation
page read and write
4711000
heap
page read and write
1D354000
heap
page read and write
3FCE000
stack
page read and write
1D356000
heap
page read and write
FB0000
direct allocation
page read and write
45CF000
stack
page read and write
3D4000
heap
page read and write
1D34B000
heap
page read and write
1D34E000
heap
page read and write
3D4000
heap
page read and write
1D35F000
heap
page read and write
4711000
heap
page read and write
3D4000
heap
page read and write
4B80000
heap
page read and write
14AB000
unkown
page execute and write copy
1D354000
heap
page read and write
FB0000
direct allocation
page read and write
1D354000
heap
page read and write
1D357000
heap
page read and write
1D339000
heap
page read and write
29385000
heap
page read and write
3E8E000
stack
page read and write
61EB7000
direct allocation
page readonly
4711000
heap
page read and write
4711000
heap
page read and write
7C3000
heap
page read and write
3A9000
stack
page read and write
1D354000
heap
page read and write
FC1000
unkown
page execute and write copy
4710000
heap
page read and write
4711000
heap
page read and write
3E4F000
stack
page read and write
6CF1D000
unkown
page readonly
FC0000
unkown
page readonly
1D33A000
heap
page read and write
3D4000
heap
page read and write
3D4000
heap
page read and write
1D352000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D446000
heap
page read and write
420F000
stack
page read and write
293A2000
heap
page read and write
61E00000
direct allocation
page execute and read and write
4711000
heap
page read and write
1D354000
heap
page read and write
3D4000
heap
page read and write
1D35F000
heap
page read and write
1D362000
heap
page read and write
1045000
unkown
page execute and read and write
1CB6D000
stack
page read and write
FC0000
unkown
page read and write
4711000
heap
page read and write
1185000
unkown
page execute and read and write
4711000
heap
page read and write
6D0000
heap
page read and write
1D366000
heap
page read and write
1D34C000
heap
page read and write
1D366000
heap
page read and write
1D34E000
heap
page read and write
1D356000
heap
page read and write
3D4000
heap
page read and write
61ECD000
direct allocation
page readonly
3D4000
heap
page read and write
1D357000
heap
page read and write
4711000
heap
page read and write
358F000
stack
page read and write
1D370000
heap
page read and write
1CF3D000
stack
page read and write
2B4F000
stack
page read and write
3A8F000
stack
page read and write
1D355000
heap
page read and write
40CF000
stack
page read and write
4711000
heap
page read and write
1D346000
heap
page read and write
384E000
stack
page read and write
2AC000
stack
page read and write
1D354000
heap
page read and write
1D370000
heap
page read and write
1D34F000
heap
page read and write
163B000
unkown
page execute and write copy
4711000
heap
page read and write
3D4000
heap
page read and write
4711000
heap
page read and write
3D4000
heap
page read and write
1D440000
trusted library allocation
page read and write
476E000
heap
page read and write
6D11F000
unkown
page write copy
2F500000
trusted library allocation
page read and write
4711000
heap
page read and write
139D000
unkown
page execute and read and write
10AF000
unkown
page execute and read and write
2D4F000
stack
page read and write
6CF40000
unkown
page readonly
348E000
stack
page read and write
2E4F000
stack
page read and write
6CF41000
unkown
page execute read
4730000
heap
page read and write
4D20000
direct allocation
page execute and read and write
3ACE000
stack
page read and write
E8E000
stack
page read and write
2F5A6000
heap
page read and write
FB0000
direct allocation
page read and write
6D120000
unkown
page read and write
4711000
heap
page read and write
380F000
stack
page read and write
4711000
heap
page read and write
1D36F000
heap
page read and write
4BA0000
direct allocation
page read and write
2F4EF000
stack
page read and write
149C000
unkown
page execute and read and write
101A000
unkown
page execute and read and write
3D0F000
stack
page read and write
320E000
stack
page read and write
29383000
heap
page read and write
6CF32000
unkown
page readonly
1D34D000
heap
page read and write
3D4000
heap
page read and write
163A000
unkown
page execute and read and write
1D349000
heap
page read and write
1D339000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
29387000
heap
page read and write
1D354000
heap
page read and write
29396000
heap
page read and write
3BCF000
stack
page read and write
1D07D000
stack
page read and write
4711000
heap
page read and write
4D50000
direct allocation
page execute and read and write
4711000
heap
page read and write
4D00000
direct allocation
page execute and read and write
10CF000
unkown
page execute and read and write
107D000
unkown
page execute and read and write
6DA000
heap
page read and write
1D354000
heap
page read and write
61ED0000
direct allocation
page read and write
4D40000
direct allocation
page execute and read and write
29380000
heap
page read and write
394F000
stack
page read and write
424E000
stack
page read and write
1D358000
heap
page read and write
10DB000
unkown
page execute and read and write
6D11E000
unkown
page read and write
1D370000
heap
page read and write
F50000
heap
page read and write
4711000
heap
page read and write
6CF2E000
unkown
page read and write
4711000
heap
page read and write
3D4000
heap
page read and write
1D17C000
stack
page read and write
FB0000
direct allocation
page read and write
29360000
heap
page read and write
3D4000
heap
page read and write
1D362000
heap
page read and write
4711000
heap
page read and write
1165000
unkown
page execute and read and write
4BA0000
direct allocation
page read and write
1CEFF000
stack
page read and write
1D351000
heap
page read and write
4711000
heap
page read and write
1D34B000
heap
page read and write
1D34C000
heap
page read and write
3D4000
heap
page read and write
1D353000
heap
page read and write
2C4F000
stack
page read and write
620000
heap
page read and write
1D352000
heap
page read and write
10A2000
unkown
page execute and read and write
FB0000
direct allocation
page read and write
4711000
heap
page read and write
1CDFE000
stack
page read and write
1D36F000
heap
page read and write
4711000
heap
page read and write
344F000
stack
page read and write
1D370000
heap
page read and write
FB0000
direct allocation
page read and write
FB0000
direct allocation
page read and write
1D36F000
heap
page read and write
4711000
heap
page read and write
3D4000
heap
page read and write
4711000
heap
page read and write
293C2000
heap
page read and write
2F4F000
stack
page read and write
4711000
heap
page read and write
2F5A0000
heap
page read and write
F4E000
stack
page read and write
1D357000
heap
page read and write
1D352000
heap
page read and write
1D34D000
heap
page read and write
3D4000
heap
page read and write
1D355000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D36F000
heap
page read and write
3D4D000
stack
page read and write
3D4000
heap
page read and write
2F8E000
stack
page read and write
3D4000
heap
page read and write
1D354000
heap
page read and write
61ECC000
direct allocation
page read and write
F0E000
stack
page read and write
6CEA0000
unkown
page readonly
1D36E000
heap
page read and write
FAE000
stack
page read and write
3D4000
heap
page read and write
1D354000
heap
page read and write
3D4000
heap
page read and write
73A000
heap
page read and write
FB0000
direct allocation
page read and write
1D349000
heap
page read and write
334E000
stack
page read and write
1D353000
heap
page read and write
1D348000
heap
page read and write
1D352000
heap
page read and write
61ED4000
direct allocation
page readonly
29399000
heap
page read and write
1D366000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
121E000
unkown
page execute and read and write
35CE000
stack
page read and write
61ED3000
direct allocation
page read and write
29320000
heap
page read and write
FB0000
direct allocation
page read and write
14AA000
unkown
page execute and write copy
4711000
heap
page read and write
4711000
heap
page read and write
3A3000
stack
page read and write
1D351000
heap
page read and write
4711000
heap
page read and write
3D4000
heap
page read and write
1D320000
heap
page read and write
4711000
heap
page read and write
1D21E000
stack
page read and write
233B3000
heap
page read and write
4711000
heap
page read and write
1CC6E000
stack
page read and write
4711000
heap
page read and write
3D4000
heap
page read and write
3D4000
heap
page read and write
1492000
unkown
page execute and read and write
2939F000
heap
page read and write
68E000
stack
page read and write
1D346000
heap
page read and write
3D0000
heap
page read and write
1D35F000
heap
page read and write
3AD000
stack
page read and write
1D354000
heap
page read and write
1D34E000
heap
page read and write
1D366000
heap
page read and write
1D355000
heap
page read and write
1048000
unkown
page execute and read and write
4711000
heap
page read and write
4711000
heap
page read and write
31CF000
stack
page read and write
4711000
heap
page read and write
104F000
unkown
page execute and read and write
1D344000
heap
page read and write
3D4000
heap
page read and write
470F000
stack
page read and write
1D342000
heap
page read and write
6CE000
stack
page read and write
4CF0000
direct allocation
page execute and read and write
FB0000
direct allocation
page read and write
There are 390 hidden memdumps, click here to show them.