IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BFIIEHJDBKJKECBFHDGHJKEHIJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\BGHIDGCA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\CAFIEBKKJJDAKFHIDBFHJDBFBA
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CGCFCFBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EHJDHJKFIECAAKFIJJKJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EHJKFCGHIDHCBGDHJKEBGDGIJE
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HDAKJDHIEBFIIDGDGDBA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJJJDAAECGHDGDGCGHDB
ASCII text, with very long lines (1769), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/e2b1563c6670f193.phpHDAK
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpN
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllv
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpData
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll~
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllV
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlld
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phps
unknown
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpic_qt
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllX
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
unknown
https://duckduckgo.com/chrome_newtab
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
unknown
http://www.sqlite.org/copyright.html.
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
unknown
There are 36 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
521000
unkown
page execute and read and write
 malicious
106E000
heap
page read and write
 malicious
4EE0000
direct allocation
page read and write
 malicious
1D67F000
heap
page read and write
6CF11000
unkown
page execute read
1D66E000
heap
page read and write
4A51000
heap
page read and write
296C1000
heap
page read and write
1D21F000
stack
page read and write
2C30000
heap
page read and write
1CE2F000
stack
page read and write
29640000
heap
page read and write
4A51000
heap
page read and write
1D672000
heap
page read and write
4A40000
direct allocation
page read and write
1D66C000
heap
page read and write
4A51000
heap
page read and write
1D686000
heap
page read and write
1D670000
heap
page read and write
46BE000
stack
page read and write
4A51000
heap
page read and write
102E000
stack
page read and write
1D674000
heap
page read and write
1D76D000
heap
page read and write
4A51000
heap
page read and write
506E000
stack
page read and write
4A51000
heap
page read and write
47FE000
stack
page read and write
E5C000
stack
page read and write
1D640000
heap
page read and write
1060000
heap
page read and write
4A51000
heap
page read and write
520000
unkown
page read and write
4A51000
heap
page read and write
1D674000
heap
page read and write
521000
unkown
page execute and write copy
4A40000
direct allocation
page read and write
4A51000
heap
page read and write
1D673000
heap
page read and write
501F000
stack
page read and write
1D67F000
heap
page read and write
4A51000
heap
page read and write
5A8000
unkown
page execute and read and write
1D682000
heap
page read and write
4A51000
heap
page read and write
6D0F5000
unkown
page readonly
1D65A000
heap
page read and write
29680000
heap
page read and write
1D760000
trusted library allocation
page read and write
4A51000
heap
page read and write
1D662000
heap
page read and write
4EE0000
direct allocation
page read and write
1D668000
heap
page read and write
4A51000
heap
page read and write
5AF000
unkown
page execute and read and write
4A60000
heap
page read and write
6EB000
unkown
page execute and read and write
4A51000
heap
page read and write
303E000
stack
page read and write
1D68E000
heap
page read and write
1D66B000
heap
page read and write
4A40000
direct allocation
page read and write
132F000
stack
page read and write
4A51000
heap
page read and write
6D0F0000
unkown
page read and write
520000
unkown
page readonly
4A3F000
stack
page read and write
61EB7000
direct allocation
page readonly
4A51000
heap
page read and write
1D669000
heap
page read and write
6CE70000
unkown
page readonly
61EB4000
direct allocation
page read and write
FB0000
heap
page read and write
1D676000
heap
page read and write
4A51000
heap
page read and write
1D678000
heap
page read and write
2F77B000
heap
page read and write
1D671000
heap
page read and write
1D674000
heap
page read and write
1D675000
heap
page read and write
4A51000
heap
page read and write
61E01000
direct allocation
page execute read
4A51000
heap
page read and write
4A51000
heap
page read and write
1D661000
heap
page read and write
1D666000
heap
page read and write
F52000
stack
page read and write
1D0AF000
stack
page read and write
4A51000
heap
page read and write
1D659000
heap
page read and write
6CEED000
unkown
page readonly
4A51000
heap
page read and write
1D35D000
stack
page read and write
2C3B000
heap
page read and write
4A51000
heap
page read and write
1D686000
heap
page read and write
1D67F000
heap
page read and write
A1A000
unkown
page execute and write copy
4A51000
heap
page read and write
327F000
stack
page read and write
5050000
direct allocation
page execute and read and write
1D662000
heap
page read and write
A19000
unkown
page execute and write copy
4A50000
heap
page read and write
493E000
stack
page read and write
1D68F000
heap
page read and write
1D65E000
heap
page read and write
1D66F000
heap
page read and write
353E000
stack
page read and write
4A40000
direct allocation
page read and write
1D65A000
heap
page read and write
1D675000
heap
page read and write
4A51000
heap
page read and write
34FF000
stack
page read and write
1D659000
heap
page read and write
3B3F000
stack
page read and write
1D672000
heap
page read and write
1D690000
heap
page read and write
1D676000
heap
page read and write
1D677000
heap
page read and write
1D68F000
heap
page read and write
4A51000
heap
page read and write
363F000
stack
page read and write
5070000
direct allocation
page execute and read and write
1D677000
heap
page read and write
317E000
stack
page read and write
4A51000
heap
page read and write
FA0000
heap
page read and write
38BF000
stack
page read and write
1D49C000
stack
page read and write
48FF000
stack
page read and write
1D68D000
heap
page read and write
4A51000
heap
page read and write
60F000
unkown
page execute and read and write
A19000
unkown
page execute and read and write
1CF6F000
stack
page read and write
2F77B000
heap
page read and write
3DFE000
stack
page read and write
1D676000
heap
page read and write
1D676000
heap
page read and write
1D674000
heap
page read and write
1D39D000
stack
page read and write
6C5000
unkown
page execute and read and write
5030000
direct allocation
page execute and read and write
296A0000
heap
page read and write
3CBE000
stack
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
1D661000
heap
page read and write
5B2000
unkown
page execute and read and write
2C7E000
stack
page read and write
4A51000
heap
page read and write
2FFF000
stack
page read and write
1D66B000
heap
page read and write
61ED0000
direct allocation
page read and write
F5D000
stack
page read and write
4A51000
heap
page read and write
1D682000
heap
page read and write
1D686000
heap
page read and write
4A51000
heap
page read and write
4A40000
direct allocation
page read and write
61ED3000
direct allocation
page read and write
1D674000
heap
page read and write
29701000
heap
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
1D666000
heap
page read and write
42FE000
stack
page read and write
4A51000
heap
page read and write
38FE000
stack
page read and write
1D673000
heap
page read and write
BB3000
unkown
page execute and write copy
1D65B000
heap
page read and write
900000
unkown
page execute and read and write
5D1000
unkown
page execute and read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
1D672000
heap
page read and write
3EFF000
stack
page read and write
1D674000
heap
page read and write
1D63D000
stack
page read and write
1D686000
heap
page read and write
4A70000
heap
page read and write
4A51000
heap
page read and write
1D658000
heap
page read and write
57A000
unkown
page execute and read and write
4A51000
heap
page read and write
1D664000
heap
page read and write
33BF000
stack
page read and write
4A51000
heap
page read and write
2C37000
heap
page read and write
4A51000
heap
page read and write
403F000
stack
page read and write
6CE71000
unkown
page execute read
5A5000
unkown
page execute and read and write
1D676000
heap
page read and write
4A51000
heap
page read and write
1D690000
heap
page read and write
1D64F000
heap
page read and write
63E000
unkown
page execute and read and write
4B50000
trusted library allocation
page read and write
5080000
direct allocation
page execute and read and write
1D686000
heap
page read and write
4A51000
heap
page read and write
4EE0000
direct allocation
page read and write
4A51000
heap
page read and write
1D11E000
stack
page read and write
4A51000
heap
page read and write
6D0EF000
unkown
page write copy
2C0F000
stack
page read and write
10CB000
heap
page read and write
4A40000
direct allocation
page read and write
377F000
stack
page read and write
77E000
unkown
page execute and read and write
457E000
stack
page read and write
4A40000
direct allocation
page read and write
1D68F000
heap
page read and write
4A51000
heap
page read and write
2F783000
heap
page read and write
4A51000
heap
page read and write
1CE6E000
stack
page read and write
1D674000
heap
page read and write
407E000
stack
page read and write
2B0E000
stack
page read and write
2EBF000
stack
page read and write
6CF10000
unkown
page readonly
10B4000
heap
page read and write
1D674000
heap
page read and write
1D67F000
heap
page read and write
1D686000
heap
page read and write
4A40000
direct allocation
page read and write
1D674000
heap
page read and write
1D674000
heap
page read and write
1D669000
heap
page read and write
296E1000
heap
page read and write
1D68F000
heap
page read and write
4A51000
heap
page read and write
6E5000
unkown
page execute and read and write
1D673000
heap
page read and write
1D676000
heap
page read and write
2F6E0000
trusted library allocation
page read and write
1D66E000
heap
page read and write
33FE000
stack
page read and write
1D53E000
stack
page read and write
4A51000
heap
page read and write
6CF02000
unkown
page readonly
1D674000
heap
page read and write
1D676000
heap
page read and write
1050000
heap
page read and write
602000
unkown
page execute and read and write
1D65A000
heap
page read and write
2C3E000
heap
page read and write
367E000
stack
page read and write
1D65A000
heap
page read and write
4A40000
direct allocation
page read and write
4A51000
heap
page read and write
5060000
direct allocation
page execute and read and write
2D7F000
stack
page read and write
BB3000
unkown
page execute and read and write
4A51000
heap
page read and write
9DD000
unkown
page execute and read and write
37BE000
stack
page read and write
1D690000
heap
page read and write
BB4000
unkown
page execute and write copy
47BF000
stack
page read and write
1D690000
heap
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
1D671000
heap
page read and write
6D0AF000
unkown
page readonly
FC5000
heap
page read and write
4A51000
heap
page read and write
443E000
stack
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
32BE000
stack
page read and write
1D674000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D66E000
heap
page read and write
1D68F000
heap
page read and write
236D2000
heap
page read and write
5090000
direct allocation
page execute and read and write
3F3E000
stack
page read and write
417F000
stack
page read and write
4A40000
direct allocation
page read and write
1D672000
heap
page read and write
63B000
unkown
page execute and read and write
A02000
unkown
page execute and read and write
1D672000
heap
page read and write
4A51000
heap
page read and write
1D66D000
heap
page read and write
4A51000
heap
page read and write
61ED4000
direct allocation
page readonly
4A51000
heap
page read and write
39FF000
stack
page read and write
4A51000
heap
page read and write
6CEFE000
unkown
page read and write
29660000
heap
page read and write
3A3E000
stack
page read and write
1D690000
heap
page read and write
1D672000
heap
page read and write
1D666000
heap
page read and write
313F000
stack
page read and write
4A40000
direct allocation
page read and write
5DD000
unkown
page execute and read and write
1D646000
heap
page read and write
3B7E000
stack
page read and write
1D686000
heap
page read and write
43FF000
stack
page read and write
3C7F000
stack
page read and write
4A40000
direct allocation
page read and write
4A51000
heap
page read and write
1D68F000
heap
page read and write
42BF000
stack
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
2C10000
heap
page read and write
1D68F000
heap
page read and write
1D686000
heap
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
5040000
direct allocation
page execute and read and write
1D25E000
stack
page read and write
4F1B000
stack
page read and write
4A51000
heap
page read and write
467F000
stack
page read and write
453F000
stack
page read and write
5060000
direct allocation
page execute and read and write
2EFE000
stack
page read and write
1D66C000
heap
page read and write
3DBF000
stack
page read and write
1D658000
heap
page read and write
1D674000
heap
page read and write
1D66D000
heap
page read and write
2F773000
heap
page read and write
1D677000
heap
page read and write
2DBC000
stack
page read and write
1D66F000
heap
page read and write
6D0EE000
unkown
page read and write
1D669000
heap
page read and write
FC0000
heap
page read and write
F58000
stack
page read and write
2F781000
heap
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
10E6000
heap
page read and write
29716000
heap
page read and write
1D66E000
heap
page read and write
1D675000
heap
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
61ECC000
direct allocation
page read and write
4A40000
direct allocation
page read and write
61ECD000
direct allocation
page readonly
A0C000
unkown
page execute and read and write
4A40000
direct allocation
page read and write
1CFAE000
stack
page read and write
41BE000
stack
page read and write
1D66D000
heap
page read and write
106A000
heap
page read and write
62F000
unkown
page execute and read and write
1D68C000
heap
page read and write
There are 353 hidden memdumps, click here to show them.