IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AEHIJDAFBKFHIDGCFBFCBAFIIJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BAECFCAA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BFCGDAAKFHIDBFIDBKFH
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\DGCFHIDAKECFHIEBFCGIJDBKJD
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\FHCGCAAK
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HCFCFHJDBKJKEBFHJEHI
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JKEGIDGDGHCAAAAKKFCG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KKJDGDHIDBGIECBGHJDBAAKJDH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllGr
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll#
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllQr-
unknown
http://185.215.113.37/e2b1563c6670f193.phpCO
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
http://185.215.113.37/e2b1563c6670f193.phpGDAAKFHIDBFIDBKFH
unknown
http://185.215.113.37/e2b1563c6670f193.phps
unknown
http://185.215.113.37e2b1563c6670f193.phption:
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllG
unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll=r1
unknown
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
http://185.215.113.37/e2b1563c6670f193.phpGDAAKFHIDBFIDBKFHR
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll1#
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
http://185.215.113.37/e2b1563c6670f193.php=
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
http://185.215.113.37/e2b1563c6670f193.phpus.wallet
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
http://185.215.113.37/e2b1563c6670f193.phpE
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://185.215.113.37/e2b1563c6670f193.php.
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://185.215.113.37/e2b1563c6670f193.phpVB
unknown
http://185.215.113.37/e2b1563c6670f193.php=C
unknown
http://185.215.113.37/e2b1563c6670f193.php6
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.37/e2b1563c6670f193.phpes
unknown
http://185.215.113.37/e2b1563c6670f193.php3QF2
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllc
unknown
https://support.mozilla.org
unknown
http://185.215.113.37/e2b1563c6670f193.phpWi6Fo
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll_so
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.37/e2b1563c6670f193.phpBRx
unknown
There are 53 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
471000
unkown
page execute and read and write
 malicious
4E30000
direct allocation
page read and write
 malicious
10EE000
heap
page read and write
 malicious
49B1000
heap
page read and write
4FD0000
direct allocation
page execute and read and write
6BA000
unkown
page execute and read and write
2CC0000
direct allocation
page read and write
96D000
unkown
page execute and read and write
462E000
stack
page read and write
294A5000
heap
page read and write
3C2E000
stack
page read and write
1D473000
heap
page read and write
1D456000
heap
page read and write
49AF000
stack
page read and write
1D467000
heap
page read and write
61ED3000
direct allocation
page read and write
1D48A000
heap
page read and write
31EF000
stack
page read and write
1D465000
heap
page read and write
1D46D000
heap
page read and write
2CC0000
direct allocation
page read and write
58B000
unkown
page execute and read and write
1CEED000
stack
page read and write
1D470000
heap
page read and write
49B1000
heap
page read and write
486F000
stack
page read and write
2CC0000
direct allocation
page read and write
3BEF000
stack
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
1D470000
heap
page read and write
44EE000
stack
page read and write
855000
unkown
page execute and read and write
1D482000
heap
page read and write
61E00000
direct allocation
page execute and read and write
2CC0000
direct allocation
page read and write
29430000
heap
page read and write
1D440000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
4F80000
direct allocation
page execute and read and write
1D458000
heap
page read and write
1D470000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
29749000
heap
page read and write
6C85E000
unkown
page read and write
1D470000
heap
page read and write
49B1000
heap
page read and write
1CDAE000
stack
page read and write
2CC0000
direct allocation
page read and write
1D470000
heap
page read and write
1D489000
heap
page read and write
49B1000
heap
page read and write
1D14F000
stack
page read and write
43AE000
stack
page read and write
502000
unkown
page execute and read and write
52D000
unkown
page execute and read and write
29746000
heap
page read and write
6C680000
unkown
page readonly
2FAE000
stack
page read and write
29498000
heap
page read and write
49B1000
heap
page read and write
1D46C000
heap
page read and write
6C65D000
unkown
page readonly
436F000
stack
page read and write
1D48C000
heap
page read and write
95E000
unkown
page execute and read and write
B0C000
unkown
page execute and write copy
4E30000
direct allocation
page read and write
30AF000
stack
page read and write
4CA000
unkown
page execute and read and write
1D456000
heap
page read and write
49B1000
heap
page read and write
1D470000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
396F000
stack
page read and write
30EE000
stack
page read and write
1D462000
heap
page read and write
2F6F000
stack
page read and write
2D2C000
stack
page read and write
29741000
heap
page read and write
1D456000
heap
page read and write
1D48C000
heap
page read and write
2CC0000
direct allocation
page read and write
1D470000
heap
page read and write
294FA000
heap
page read and write
49B1000
heap
page read and write
4FBE000
stack
page read and write
552000
unkown
page execute and read and write
4F6F000
stack
page read and write
2BBE000
stack
page read and write
63B000
unkown
page execute and read and write
4FB0000
direct allocation
page execute and read and write
1D470000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
1D46D000
heap
page read and write
2CE0000
heap
page read and write
96D000
unkown
page execute and write copy
6C681000
unkown
page execute read
44AF000
stack
page read and write
29491000
heap
page read and write
49B1000
heap
page read and write
1D47B000
heap
page read and write
1D489000
heap
page read and write
2CC0000
direct allocation
page read and write
332F000
stack
page read and write
386E000
stack
page read and write
49B1000
heap
page read and write
40EF000
stack
page read and write
57F000
unkown
page execute and read and write
1D47C000
heap
page read and write
6CE000
unkown
page execute and read and write
2949F000
heap
page read and write
10B0000
heap
page read and write
1D19D000
stack
page read and write
521000
unkown
page execute and read and write
3FAF000
stack
page read and write
49D0000
heap
page read and write
4F8000
unkown
page execute and read and write
49B0000
heap
page read and write
1D470000
heap
page read and write
2CC0000
direct allocation
page read and write
49B1000
heap
page read and write
1D465000
heap
page read and write
1147000
heap
page read and write
49B1000
heap
page read and write
6C5E1000
unkown
page execute read
12DF000
stack
page read and write
346F000
stack
page read and write
3EAE000
stack
page read and write
1D465000
heap
page read and write
1D489000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
11C2000
heap
page read and write
1D44B000
heap
page read and write
3E6F000
stack
page read and write
1D46B000
heap
page read and write
472F000
stack
page read and write
1CD6F000
stack
page read and write
1D47B000
heap
page read and write
2CE7000
heap
page read and write
2CEB000
heap
page read and write
2E2F000
stack
page read and write
1D46D000
heap
page read and write
1CFEE000
stack
page read and write
1162000
heap
page read and write
470000
unkown
page read and write
49B1000
heap
page read and write
1D470000
heap
page read and write
1D462000
heap
page read and write
1D48C000
heap
page read and write
6C672000
unkown
page readonly
412E000
stack
page read and write
1D455000
heap
page read and write
49B1000
heap
page read and write
1D470000
heap
page read and write
1D47E000
heap
page read and write
1D489000
heap
page read and write
1D48C000
heap
page read and write
49B1000
heap
page read and write
1D470000
heap
page read and write
2969F000
stack
page read and write
4F90000
direct allocation
page execute and read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
3D6E000
stack
page read and write
1D489000
heap
page read and write
35EE000
stack
page read and write
322E000
stack
page read and write
61ED4000
direct allocation
page readonly
1D477000
heap
page read and write
470000
unkown
page readonly
1D470000
heap
page read and write
49B1000
heap
page read and write
6C865000
unkown
page readonly
3AAF000
stack
page read and write
1D04E000
stack
page read and write
10E0000
heap
page read and write
4FF000
unkown
page execute and read and write
49B1000
heap
page read and write
F6E000
stack
page read and write
234C2000
heap
page read and write
49B1000
heap
page read and write
1D465000
heap
page read and write
4F5000
unkown
page execute and read and write
933000
unkown
page execute and read and write
296A0000
trusted library allocation
page read and write
2CC0000
direct allocation
page read and write
61EB4000
direct allocation
page read and write
476E000
stack
page read and write
96E000
unkown
page execute and write copy
1135000
heap
page read and write
49B1000
heap
page read and write
49B3000
heap
page read and write
29470000
heap
page read and write
F70000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
1D47B000
heap
page read and write
1D560000
heap
page read and write
48AE000
stack
page read and write
B0B000
unkown
page execute and read and write
1D467000
heap
page read and write
29738000
heap
page read and write
1D465000
heap
page read and write
1D462000
heap
page read and write
4E30000
direct allocation
page read and write
49B1000
heap
page read and write
1D47C000
heap
page read and write
4DF0000
trusted library allocation
page read and write
1D46C000
heap
page read and write
B9C000
stack
page read and write
1D465000
heap
page read and write
61EB7000
direct allocation
page readonly
49B1000
heap
page read and write
1D48C000
heap
page read and write
6C860000
unkown
page read and write
2CC0000
direct allocation
page read and write
1D47D000
heap
page read and write
EFD000
stack
page read and write
49C0000
heap
page read and write
1D560000
trusted library allocation
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
1D465000
heap
page read and write
1CEAF000
stack
page read and write
294AC000
heap
page read and write
3AEE000
stack
page read and write
294F2000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
1D489000
heap
page read and write
EF8000
stack
page read and write
4FA0000
direct allocation
page execute and read and write
1D485000
heap
page read and write
108E000
stack
page read and write
55F000
unkown
page execute and read and write
49B1000
heap
page read and write
1D465000
heap
page read and write
1D46D000
heap
page read and write
635000
unkown
page execute and read and write
615000
unkown
page execute and read and write
6C66E000
unkown
page read and write
1D46C000
heap
page read and write
1D468000
heap
page read and write
1D452000
heap
page read and write
61E01000
direct allocation
page execute read
3D2F000
stack
page read and write
36EF000
stack
page read and write
49B1000
heap
page read and write
58E000
unkown
page execute and read and write
1D2DD000
stack
page read and write
EF2000
stack
page read and write
49B1000
heap
page read and write
1D470000
heap
page read and write
1D464000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
2CC0000
direct allocation
page read and write
382F000
stack
page read and write
1D470000
heap
page read and write
1D467000
heap
page read and write
6C5E0000
unkown
page readonly
957000
unkown
page execute and read and write
61ECD000
direct allocation
page readonly
1D470000
heap
page read and write
4FB0000
direct allocation
page execute and read and write
49B1000
heap
page read and write
61ECC000
direct allocation
page read and write
35AF000
stack
page read and write
49B1000
heap
page read and write
3FEE000
stack
page read and write
49B1000
heap
page read and write
2E6E000
stack
page read and write
34AE000
stack
page read and write
2CEE000
heap
page read and write
49B1000
heap
page read and write
1D442000
heap
page read and write
49B1000
heap
page read and write
2CC0000
direct allocation
page read and write
1D485000
heap
page read and write
49B1000
heap
page read and write
1D456000
heap
page read and write
61ED0000
direct allocation
page read and write
45EF000
stack
page read and write
1D46C000
heap
page read and write
29740000
heap
page read and write
1D47D000
heap
page read and write
6C85F000
unkown
page write copy
49B1000
heap
page read and write
39AE000
stack
page read and write
49B1000
heap
page read and write
1D470000
heap
page read and write
1D473000
heap
page read and write
1D3DD000
stack
page read and write
1D476000
heap
page read and write
1D470000
heap
page read and write
1D456000
heap
page read and write
1D489000
heap
page read and write
29450000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
422F000
stack
page read and write
6C81F000
unkown
page readonly
29493000
heap
page read and write
2959E000
stack
page read and write
49B1000
heap
page read and write
1D467000
heap
page read and write
13DE000
stack
page read and write
49B1000
heap
page read and write
1D29C000
stack
page read and write
372E000
stack
page read and write
49B1000
heap
page read and write
4E6B000
stack
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
F75000
heap
page read and write
1131000
heap
page read and write
F00000
heap
page read and write
426E000
stack
page read and write
BF0000
heap
page read and write
336E000
stack
page read and write
2CC0000
direct allocation
page read and write
2CC0000
direct allocation
page read and write
1D489000
heap
page read and write
1D47D000
heap
page read and write
1D489000
heap
page read and write
4FC0000
direct allocation
page execute and read and write
11C7000
heap
page read and write
10E8000
heap
page read and write
1D47C000
heap
page read and write
10C0000
heap
page read and write
1D47C000
heap
page read and write
1D467000
heap
page read and write
1D473000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
2CBF000
stack
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
49B1000
heap
page read and write
471000
unkown
page execute and write copy
There are 341 hidden memdumps, click here to show them.