IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAAAECGHCBGCBFHIIDHIJKFBKF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\BAAEHDBFIDAFIDHJEBFBGDGHJD
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\ECGDBAEHIJKKFHIEGCBG
ASCII text, with very long lines (1765), with CRLF line terminators
dropped
C:\ProgramData\EHIJDHCAKKFCBGCBAAEC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EHJKKKFIIJJKJKFIECBF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FIDGHIIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\FIDGHIIECGHDHJKFCAEGIJDGCB
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GIDHDGCB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KFIJJEGHDAEBGCAKJKFHDHCFHC
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllM
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php)U
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll5
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllm9X
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phptB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php7-
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllQ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllC9
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpPB
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpJDHCAKKFCBGCBAAEC
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll#
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpDBAEHIJKKFHIEGCBG
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll%
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3a
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllo0
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php$B
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpJ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllJ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllq9
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlli
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll_
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php(
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 49 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
87E000
heap
page read and write
 malicious
4CA0000
direct allocation
page read and write
 malicious
F11000
unkown
page execute and read and write
 malicious
1D437000
heap
page read and write
1D431000
heap
page read and write
1D451000
heap
page read and write
4821000
heap
page read and write
1D450000
heap
page read and write
13E4000
unkown
page execute and read and write
4821000
heap
page read and write
4821000
heap
page read and write
1D441000
heap
page read and write
4821000
heap
page read and write
1CBEF000
stack
page read and write
1D431000
heap
page read and write
295F1000
heap
page read and write
1D42A000
heap
page read and write
81E000
stack
page read and write
445F000
stack
page read and write
1CD2F000
stack
page read and write
1D426000
heap
page read and write
4821000
heap
page read and write
4C60000
trusted library allocation
page read and write
4821000
heap
page read and write
459F000
stack
page read and write
345E000
stack
page read and write
1D434000
heap
page read and write
1D426000
heap
page read and write
1D434000
heap
page read and write
61ED0000
direct allocation
page read and write
295F6000
heap
page read and write
1D434000
heap
page read and write
1D434000
heap
page read and write
1D429000
heap
page read and write
4821000
heap
page read and write
2DDF000
stack
page read and write
1D451000
heap
page read and write
1D429000
heap
page read and write
1408000
unkown
page execute and read and write
F00000
direct allocation
page read and write
F11000
unkown
page execute and write copy
1D520000
trusted library allocation
page read and write
4821000
heap
page read and write
116E000
unkown
page execute and read and write
4821000
heap
page read and write
319F000
stack
page read and write
481F000
stack
page read and write
6CC51000
unkown
page execute read
3A9E000
stack
page read and write
1D438000
heap
page read and write
4821000
heap
page read and write
1D44E000
heap
page read and write
4821000
heap
page read and write
90E000
heap
page read and write
1D418000
heap
page read and write
395E000
stack
page read and write
29570000
heap
page read and write
381E000
stack
page read and write
2A9B000
heap
page read and write
471E000
stack
page read and write
95D000
heap
page read and write
32DF000
stack
page read and write
1D450000
heap
page read and write
F00000
direct allocation
page read and write
85D000
stack
page read and write
6F2000
stack
page read and write
4821000
heap
page read and write
1D41A000
heap
page read and write
295B1000
heap
page read and write
295A5000
heap
page read and write
4E10000
direct allocation
page execute and read and write
4821000
heap
page read and write
331E000
stack
page read and write
1D406000
heap
page read and write
1D441000
heap
page read and write
8C0000
heap
page read and write
4821000
heap
page read and write
6F8000
stack
page read and write
29596000
heap
page read and write
6CE2E000
unkown
page read and write
1CD6E000
stack
page read and write
1D526000
heap
page read and write
34C000
stack
page read and write
4821000
heap
page read and write
3E1F000
stack
page read and write
1D42A000
heap
page read and write
1D434000
heap
page read and write
1D434000
heap
page read and write
1D441000
heap
page read and write
61EB4000
direct allocation
page read and write
870000
heap
page read and write
1D434000
heap
page read and write
4821000
heap
page read and write
1D441000
heap
page read and write
2354A000
heap
page read and write
2C9F000
stack
page read and write
2F7D5000
heap
page read and write
4821000
heap
page read and write
1D429000
heap
page read and write
4821000
heap
page read and write
919000
heap
page read and write
4CA0000
direct allocation
page read and write
4821000
heap
page read and write
2A97000
heap
page read and write
1D450000
heap
page read and write
87A000
heap
page read and write
4E20000
direct allocation
page execute and read and write
1D42A000
heap
page read and write
4E20000
direct allocation
page execute and read and write
FC1000
unkown
page execute and read and write
1D438000
heap
page read and write
409F000
stack
page read and write
1D438000
heap
page read and write
4821000
heap
page read and write
F00000
direct allocation
page read and write
1D430000
heap
page read and write
925000
heap
page read and write
101F000
unkown
page execute and read and write
4821000
heap
page read and write
4821000
heap
page read and write
1D438000
heap
page read and write
1D434000
heap
page read and write
4821000
heap
page read and write
6CDEF000
unkown
page readonly
295D1000
heap
page read and write
61ED3000
direct allocation
page read and write
1D11C000
stack
page read and write
F95000
unkown
page execute and read and write
4821000
heap
page read and write
8D9000
heap
page read and write
1D450000
heap
page read and write
1D42D000
heap
page read and write
391F000
stack
page read and write
1D434000
heap
page read and write
3CDF000
stack
page read and write
1D450000
heap
page read and write
4830000
heap
page read and write
1D41B000
heap
page read and write
435E000
stack
page read and write
4821000
heap
page read and write
3E5E000
stack
page read and write
10B5000
unkown
page execute and read and write
1D419000
heap
page read and write
4E40000
direct allocation
page execute and read and write
46DF000
stack
page read and write
3F5F000
stack
page read and write
1D434000
heap
page read and write
1410000
unkown
page execute and read and write
1D434000
heap
page read and write
61E01000
direct allocation
page execute read
1D43B000
heap
page read and write
4821000
heap
page read and write
B6E000
stack
page read and write
1D432000
heap
page read and write
1D15D000
stack
page read and write
4CA0000
direct allocation
page read and write
1420000
unkown
page execute and write copy
1D434000
heap
page read and write
2F7DB000
heap
page read and write
1D44B000
heap
page read and write
1D434000
heap
page read and write
1D2FD000
stack
page read and write
F00000
direct allocation
page read and write
1CEDE000
stack
page read and write
1D438000
heap
page read and write
4DDF000
stack
page read and write
29550000
heap
page read and write
4821000
heap
page read and write
40DE000
stack
page read and write
4821000
heap
page read and write
909000
heap
page read and write
1D434000
heap
page read and write
4E00000
direct allocation
page execute and read and write
305F000
stack
page read and write
1D43C000
heap
page read and write
2A1E000
stack
page read and write
309E000
stack
page read and write
1D400000
heap
page read and write
1D428000
heap
page read and write
860000
heap
page read and write
F98000
unkown
page execute and read and write
2F7CD000
heap
page read and write
4821000
heap
page read and write
1D441000
heap
page read and write
449E000
stack
page read and write
6FE3D000
unkown
page readonly
1D434000
heap
page read and write
4821000
heap
page read and write
6F4000
stack
page read and write
4821000
heap
page read and write
4821000
heap
page read and write
2F7D3000
heap
page read and write
2F7DB000
heap
page read and write
F00000
direct allocation
page read and write
4821000
heap
page read and write
4821000
heap
page read and write
1D451000
heap
page read and write
2B9F000
stack
page read and write
6CC50000
unkown
page readonly
369F000
stack
page read and write
1D429000
heap
page read and write
FF2000
unkown
page execute and read and write
1D432000
heap
page read and write
4821000
heap
page read and write
4821000
heap
page read and write
1D419000
heap
page read and write
359E000
stack
page read and write
F00000
direct allocation
page read and write
F00000
direct allocation
page read and write
6FDC1000
unkown
page execute read
1D402000
heap
page read and write
4E2E000
stack
page read and write
913000
heap
page read and write
1D41A000
heap
page read and write
1D450000
heap
page read and write
A6E000
stack
page read and write
61ECD000
direct allocation
page readonly
1D42A000
heap
page read and write
4821000
heap
page read and write
2959C000
heap
page read and write
1D450000
heap
page read and write
4821000
heap
page read and write
2CDE000
stack
page read and write
4821000
heap
page read and write
4823000
heap
page read and write
3B0000
heap
page read and write
4E30000
direct allocation
page execute and read and write
4821000
heap
page read and write
1D41A000
heap
page read and write
4821000
heap
page read and write
2F1F000
stack
page read and write
1D434000
heap
page read and write
FFF000
unkown
page execute and read and write
1D41A000
heap
page read and write
295AE000
heap
page read and write
141F000
unkown
page execute and write copy
4821000
heap
page read and write
295A8000
heap
page read and write
1D434000
heap
page read and write
4821000
heap
page read and write
141F000
unkown
page execute and read and write
4821000
heap
page read and write
1D415000
heap
page read and write
6FE4E000
unkown
page read and write
29592000
heap
page read and write
1D434000
heap
page read and write
F00000
direct allocation
page read and write
4821000
heap
page read and write
1D450000
heap
page read and write
1D44F000
heap
page read and write
2F71F000
stack
page read and write
1D434000
heap
page read and write
4821000
heap
page read and write
1D441000
heap
page read and write
F00000
direct allocation
page read and write
3A0000
heap
page read and write
4821000
heap
page read and write
4821000
heap
page read and write
6CE2F000
unkown
page write copy
1D42B000
heap
page read and write
7D5000
heap
page read and write
1D429000
heap
page read and write
1D41A000
heap
page read and write
4840000
heap
page read and write
4821000
heap
page read and write
29594000
heap
page read and write
37DF000
stack
page read and write
4821000
heap
page read and write
1D44F000
heap
page read and write
4821000
heap
page read and write
1D429000
heap
page read and write
2F5E000
stack
page read and write
F00000
direct allocation
page read and write
3A5F000
stack
page read and write
1D441000
heap
page read and write
1D441000
heap
page read and write
6CE30000
unkown
page read and write
1D44B000
heap
page read and write
4821000
heap
page read and write
45DE000
stack
page read and write
4821000
heap
page read and write
1D42D000
heap
page read and write
61E00000
direct allocation
page execute and read and write
2A60000
heap
page read and write
2349F000
heap
page read and write
2A90000
heap
page read and write
4821000
heap
page read and write
61ECC000
direct allocation
page read and write
F9F000
unkown
page execute and read and write
4821000
heap
page read and write
4DF0000
direct allocation
page execute and read and write
1D41A000
heap
page read and write
4821000
heap
page read and write
4821000
heap
page read and write
341F000
stack
page read and write
4821000
heap
page read and write
7D0000
heap
page read and write
36DE000
stack
page read and write
1D434000
heap
page read and write
4821000
heap
page read and write
6FD000
stack
page read and write
1D42B000
heap
page read and write
1CFDF000
stack
page read and write
1D434000
heap
page read and write
4821000
heap
page read and write
4821000
heap
page read and write
1D450000
heap
page read and write
1D40F000
heap
page read and write
1D430000
heap
page read and write
4820000
heap
page read and write
4821000
heap
page read and write
235E2000
heap
page read and write
431F000
stack
page read and write
1D43C000
heap
page read and write
3B9F000
stack
page read and write
1D44C000
heap
page read and write
F00000
direct allocation
page read and write
FCD000
unkown
page execute and read and write
2E1E000
stack
page read and write
61EB7000
direct allocation
page readonly
3D1E000
stack
page read and write
4821000
heap
page read and write
1D438000
heap
page read and write
920000
heap
page read and write
4821000
heap
page read and write
4821000
heap
page read and write
FA2000
unkown
page execute and read and write
1D426000
heap
page read and write
4CDC000
stack
page read and write
1D42D000
heap
page read and write
355F000
stack
page read and write
41DF000
stack
page read and write
8C2000
heap
page read and write
4821000
heap
page read and write
4821000
heap
page read and write
4821000
heap
page read and write
1D430000
heap
page read and write
421E000
stack
page read and write
2A5B000
stack
page read and write
31DE000
stack
page read and write
1D450000
heap
page read and write
F6A000
unkown
page execute and read and write
3F9E000
stack
page read and write
3BDE000
stack
page read and write
1D441000
heap
page read and write
1D42B000
heap
page read and write
1D438000
heap
page read and write
1D429000
heap
page read and write
10DB000
unkown
page execute and read and write
2A9E000
heap
page read and write
1D25D000
stack
page read and write
1D429000
heap
page read and write
1D429000
heap
page read and write
F00000
direct allocation
page read and write
1D01E000
stack
page read and write
102B000
unkown
page execute and read and write
1D437000
heap
page read and write
1D441000
heap
page read and write
61ED4000
direct allocation
page readonly
4821000
heap
page read and write
4821000
heap
page read and write
6CE35000
unkown
page readonly
2F61E000
stack
page read and write
8F8000
heap
page read and write
F00000
direct allocation
page read and write
1D429000
heap
page read and write
15C3000
unkown
page execute and read and write
1CC2E000
stack
page read and write
4821000
heap
page read and write
10D5000
unkown
page execute and read and write
130C000
unkown
page execute and read and write
1CE6F000
stack
page read and write
1D3FD000
stack
page read and write
6FE52000
unkown
page readonly
1D441000
heap
page read and write
4821000
heap
page read and write
4E50000
direct allocation
page execute and read and write
1D434000
heap
page read and write
1D434000
heap
page read and write
15C4000
unkown
page execute and write copy
F10000
unkown
page readonly
F00000
direct allocation
page read and write
2F730000
trusted library allocation
page read and write
1D437000
heap
page read and write
6FDC0000
unkown
page readonly
F10000
unkown
page read and write
There are 376 hidden memdumps, click here to show them.