IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAEBAFBGIDHCBFHIECFCBGHIEG
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\AEBAKJDG
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CGIDHIIJKEBGHJJKFIDA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FBKFCFBFIDGCGDHJDBKFHCFBGI
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FIDHIEBA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HJKJEHJKJEBGHJJKEBGI
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\IIJJDGHJKKJEBFHJDBGHDBKFIE
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\JKJECBAAAFHIIEBFCBKF
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlls
unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll5
unknown
http://185.215.113.37/e2b1563c6670f193.phpBRj
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
http://185.215.113.37/AS
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll~
unknown
http://185.215.113.37/e2b1563c6670f193.php_U
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.113.37/e2b1563c6670f193.phpog
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
unknown
http://185.215.113.37e2b1563c6670f193.phption:
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.37/e2b1563c6670f193.phpy
unknown
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
http://185.215.113.37/e2b1563c6670f193.phpnte
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.37/e2b1563c6670f193.php=C9
unknown
http://185.215.113.37u#
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
http://185.215.113.37/e2b1563c6670f193.phpCOF
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlly
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://185.215.113.37/e2b1563c6670f193.php-
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllo
unknown
http://185.215.113.37/e2b1563c6670f193.php3
unknown
http://185.215.113.37/e2b1563c6670f193.php:
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 49 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4D60000
direct allocation
page read and write
 malicious
3C1000
unkown
page execute and read and write
 malicious
E65000
heap
page read and write
 malicious
1D3D0000
heap
page read and write
3C0000
unkown
page readonly
48D1000
heap
page read and write
1CE2F000
stack
page read and write
11BF000
stack
page read and write
E48000
heap
page read and write
4DE000
unkown
page execute and read and write
44F000
unkown
page execute and read and write
48D1000
heap
page read and write
1D3C5000
heap
page read and write
323F000
stack
page read and write
6C7FE000
unkown
page read and write
48D1000
heap
page read and write
1D3D0000
heap
page read and write
39FE000
stack
page read and write
1D3E8000
heap
page read and write
48D1000
heap
page read and write
61E000
unkown
page execute and read and write
29463000
heap
page read and write
1D0AF000
stack
page read and write
1D3B5000
heap
page read and write
61ED4000
direct allocation
page readonly
1D3DD000
heap
page read and write
FA4000
heap
page read and write
1D3DD000
heap
page read and write
6C620000
unkown
page readonly
4D9C000
stack
page read and write
1D3DD000
heap
page read and write
61ECD000
direct allocation
page readonly
48C0000
direct allocation
page read and write
1D3E9000
heap
page read and write
48D1000
heap
page read and write
48D1000
heap
page read and write
1D3E5000
heap
page read and write
4D60000
direct allocation
page read and write
29401000
heap
page read and write
293C0000
heap
page read and write
1D4C7000
heap
page read and write
61ED3000
direct allocation
page read and write
1D3B6000
heap
page read and write
1D4C0000
trusted library allocation
page read and write
2BFF000
stack
page read and write
1D3CC000
heap
page read and write
FA4000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D3B6000
heap
page read and write
48D1000
heap
page read and write
48D1000
heap
page read and write
4AF000
unkown
page execute and read and write
61ECC000
direct allocation
page read and write
6C7FF000
unkown
page write copy
FA4000
heap
page read and write
35FF000
stack
page read and write
48D1000
heap
page read and write
1D3D0000
heap
page read and write
48D1000
heap
page read and write
1D3EC000
heap
page read and write
1D3D7000
heap
page read and write
297F0000
heap
page read and write
8AB000
unkown
page execute and read and write
6C7BF000
unkown
page readonly
48C0000
direct allocation
page read and write
1D23E000
stack
page read and write
1D3E4000
heap
page read and write
AEC000
stack
page read and write
48D1000
heap
page read and write
467E000
stack
page read and write
A53000
unkown
page execute and read and write
4A2000
unkown
page execute and read and write
453E000
stack
page read and write
3C1000
unkown
page execute and write copy
FA4000
heap
page read and write
1D3EC000
heap
page read and write
48C0000
direct allocation
page read and write
FA4000
heap
page read and write
48D1000
heap
page read and write
1CBEE000
stack
page read and write
4ED0000
direct allocation
page execute and read and write
FA4000
heap
page read and write
6C612000
unkown
page readonly
6C581000
unkown
page execute read
FA4000
heap
page read and write
2946B000
heap
page read and write
48D1000
heap
page read and write
2FBF000
stack
page read and write
2343C000
heap
page read and write
6C805000
unkown
page readonly
1D3C2000
heap
page read and write
4EE0000
direct allocation
page execute and read and write
1D33D000
stack
page read and write
8BA000
unkown
page execute and write copy
E4E000
heap
page read and write
1D3EC000
heap
page read and write
FA4000
heap
page read and write
FA4000
heap
page read and write
48D1000
heap
page read and write
48D1000
heap
page read and write
1D3E9000
heap
page read and write
48D1000
heap
page read and write
FA4000
heap
page read and write
48C0000
direct allocation
page read and write
BE9000
stack
page read and write
327E000
stack
page read and write
48D1000
heap
page read and write
294FE000
stack
page read and write
FA4000
heap
page read and write
E40000
heap
page read and write
4DB000
unkown
page execute and read and write
48D1000
heap
page read and write
1D3EC000
heap
page read and write
1D3CB000
heap
page read and write
1D3B8000
heap
page read and write
34FE000
stack
page read and write
6C60E000
unkown
page read and write
48D1000
heap
page read and write
363E000
stack
page read and write
4EE0000
direct allocation
page execute and read and write
6C580000
unkown
page readonly
1D3E6000
heap
page read and write
48D1000
heap
page read and write
2EBE000
stack
page read and write
413F000
stack
page read and write
1D3D0000
heap
page read and write
1D3CC000
heap
page read and write
2E7F000
stack
page read and write
6C800000
unkown
page read and write
43BF000
stack
page read and write
297F8000
heap
page read and write
1D3C2000
heap
page read and write
1D3E4000
heap
page read and write
373F000
stack
page read and write
1D3CC000
heap
page read and write
49D0000
trusted library allocation
page read and write
7AA000
unkown
page execute and read and write
33BE000
stack
page read and write
3C7E000
stack
page read and write
1D3C5000
heap
page read and write
2D3F000
stack
page read and write
2AF7000
heap
page read and write
1D3D0000
heap
page read and write
6C621000
unkown
page execute read
4D60000
direct allocation
page read and write
1CF6F000
stack
page read and write
48C0000
direct allocation
page read and write
61EB4000
direct allocation
page read and write
1D3E6000
heap
page read and write
1D3D0000
heap
page read and write
377E000
stack
page read and write
48D1000
heap
page read and write
1CCEF000
stack
page read and write
1D3DE000
heap
page read and write
1D3D0000
heap
page read and write
1D3D0000
heap
page read and write
48D1000
heap
page read and write
1D3E6000
heap
page read and write
48E0000
heap
page read and write
3AFF000
stack
page read and write
48D1000
heap
page read and write
403E000
stack
page read and write
8A4000
unkown
page execute and read and write
1D3CC000
heap
page read and write
4CF000
unkown
page execute and read and write
10BE000
stack
page read and write
48D1000
heap
page read and write
48D1000
heap
page read and write
48D1000
heap
page read and write
1D3B6000
heap
page read and write
387F000
stack
page read and write
1D3C5000
heap
page read and write
3C0000
unkown
page read and write
48C0000
direct allocation
page read and write
4F00000
direct allocation
page execute and read and write
43FE000
stack
page read and write
48C0000
direct allocation
page read and write
1D3CB000
heap
page read and write
FA4000
heap
page read and write
1D3DC000
heap
page read and write
48D1000
heap
page read and write
427F000
stack
page read and write
4EB0000
direct allocation
page execute and read and write
12FE000
stack
page read and write
EC2000
heap
page read and write
48D1000
heap
page read and write
1D3D0000
heap
page read and write
1D3E8000
heap
page read and write
881000
unkown
page execute and read and write
1D3C5000
heap
page read and write
34BF000
stack
page read and write
1D3CE000
heap
page read and write
1D3E6000
heap
page read and write
4EC0000
direct allocation
page execute and read and write
1D3E5000
heap
page read and write
47BE000
stack
page read and write
38BE000
stack
page read and write
297EA000
heap
page read and write
1D3E2000
heap
page read and write
FA4000
heap
page read and write
FA4000
heap
page read and write
452000
unkown
page execute and read and write
FA4000
heap
page read and write
1CE6E000
stack
page read and write
FA4000
heap
page read and write
42BE000
stack
page read and write
48D1000
heap
page read and write
48D1000
heap
page read and write
471000
unkown
page execute and read and write
337F000
stack
page read and write
1D3A2000
heap
page read and write
1D3B6000
heap
page read and write
48D1000
heap
page read and write
477F000
stack
page read and write
2AE0000
heap
page read and write
FA4000
heap
page read and write
2ADE000
stack
page read and write
4E9F000
stack
page read and write
1D3C7000
heap
page read and write
1D3E8000
heap
page read and write
E92000
heap
page read and write
448000
unkown
page execute and read and write
44FF000
stack
page read and write
48C0000
direct allocation
page read and write
48D1000
heap
page read and write
48D1000
heap
page read and write
1CD2E000
stack
page read and write
48D1000
heap
page read and write
293A0000
heap
page read and write
295FE000
stack
page read and write
293E0000
heap
page read and write
61EB7000
direct allocation
page readonly
3EBF000
stack
page read and write
313E000
stack
page read and write
3C3F000
stack
page read and write
48D1000
heap
page read and write
2D7E000
stack
page read and write
1D3CD000
heap
page read and write
48D1000
heap
page read and write
1D3E4000
heap
page read and write
61E01000
direct allocation
page execute read
48D1000
heap
page read and write
48D1000
heap
page read and write
8BA000
unkown
page execute and read and write
61ED0000
direct allocation
page read and write
FA4000
heap
page read and write
FA4000
heap
page read and write
1D3C5000
heap
page read and write
1D3E8000
heap
page read and write
BE3000
stack
page read and write
48D1000
heap
page read and write
297E2000
heap
page read and write
1D3D0000
heap
page read and write
48C0000
direct allocation
page read and write
1D3CD000
heap
page read and write
6C5FD000
unkown
page readonly
48BF000
stack
page read and write
417E000
stack
page read and write
48C0000
direct allocation
page read and write
3FFF000
stack
page read and write
FA4000
heap
page read and write
463F000
stack
page read and write
48D1000
heap
page read and write
1D3C5000
heap
page read and write
41A000
unkown
page execute and read and write
2C3B000
stack
page read and write
1D3D0000
heap
page read and write
FA4000
heap
page read and write
FA4000
heap
page read and write
48D1000
heap
page read and write
8BB000
unkown
page execute and write copy
4D40000
heap
page read and write
FA4000
heap
page read and write
1D3E9000
heap
page read and write
48D1000
heap
page read and write
48C0000
direct allocation
page read and write
48D1000
heap
page read and write
48D1000
heap
page read and write
2973F000
stack
page read and write
30FF000
stack
page read and write
48D1000
heap
page read and write
FA4000
heap
page read and write
48D1000
heap
page read and write
2963E000
stack
page read and write
48D1000
heap
page read and write
4F10000
direct allocation
page execute and read and write
1D3E9000
heap
page read and write
FA4000
heap
page read and write
1D3C5000
heap
page read and write
1D3C5000
heap
page read and write
48D1000
heap
page read and write
39BF000
stack
page read and write
ECB000
heap
page read and write
445000
unkown
page execute and read and write
F40000
heap
page read and write
1D3E8000
heap
page read and write
3DBE000
stack
page read and write
11FE000
stack
page read and write
FA4000
heap
page read and write
48D1000
heap
page read and write
48F0000
heap
page read and write
1D3AB000
heap
page read and write
48D1000
heap
page read and write
FA4000
heap
page read and write
EA7000
heap
page read and write
FA0000
heap
page read and write
1D3E6000
heap
page read and write
F1B000
heap
page read and write
48D1000
heap
page read and write
48D1000
heap
page read and write
1D3C6000
heap
page read and write
1D3D3000
heap
page read and write
3EFE000
stack
page read and write
FA4000
heap
page read and write
48D1000
heap
page read and write
1D3D0000
heap
page read and write
58B000
unkown
page execute and read and write
1D3C8000
heap
page read and write
48D1000
heap
page read and write
FA4000
heap
page read and write
1D3C7000
heap
page read and write
48C0000
direct allocation
page read and write
FA4000
heap
page read and write
2AFE000
heap
page read and write
1D3C4000
heap
page read and write
48D1000
heap
page read and write
2AF0000
heap
page read and write
FA4000
heap
page read and write
47D000
unkown
page execute and read and write
A54000
unkown
page execute and write copy
48D1000
heap
page read and write
1D3A0000
heap
page read and write
1D3CD000
heap
page read and write
1D3DC000
heap
page read and write
1D3E9000
heap
page read and write
3B3E000
stack
page read and write
48D1000
heap
page read and write
1CFAE000
stack
page read and write
BED000
stack
page read and write
1D3D6000
heap
page read and write
1D3D0000
heap
page read and write
1D3DC000
heap
page read and write
1D3EC000
heap
page read and write
F50000
heap
page read and write
48D0000
heap
page read and write
1D3E4000
heap
page read and write
4EF0000
direct allocation
page execute and read and write
1D3C2000
heap
page read and write
FA4000
heap
page read and write
1D3D0000
heap
page read and write
3D7F000
stack
page read and write
48C0000
direct allocation
page read and write
585000
unkown
page execute and read and write
FA4000
heap
page read and write
48D1000
heap
page read and write
565000
unkown
page execute and read and write
1D3D3000
heap
page read and write
1D1FD000
stack
page read and write
60A000
unkown
page execute and read and write
48D1000
heap
page read and write
1D3DC000
heap
page read and write
FA4000
heap
page read and write
2AFB000
heap
page read and write
FA4000
heap
page read and write
29750000
trusted library allocation
page read and write
2FFE000
stack
page read and write
1D3B6000
heap
page read and write
48D1000
heap
page read and write
297F0000
heap
page read and write
1D0FD000
stack
page read and write
48C0000
direct allocation
page read and write
FA4000
heap
page read and write
1D3D0000
heap
page read and write
FA4000
heap
page read and write
There are 364 hidden memdumps, click here to show them.