IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AECAKJJE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\AECAKJJECAEGCBGDHDHC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DBKKKEHDHCBFIEBFBGID
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\EBAKKFHJ
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GIEHIDHJDBFIIECAKECB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JDHCBAEHJJJKKFIDGHJECAFIDA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JKEBFBFIEHIDAAAAFHCFCGIECB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KKFHJDAEHIEHJJKFBGDAKKKKEG
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll$
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllXD
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll.D
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlltD
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllxE
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phph
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpM
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllJD
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpP
unknown
 malicious
http://185.215.113.37/#
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpT
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dlljE
unknown
 malicious
http://185.215.113.37OQIG
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpBFt
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpenSSH
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php8
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php#
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 51 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
341000
unkown
page execute and read and write
 malicious
4F30000
direct allocation
page read and write
 malicious
125E000
heap
page read and write
 malicious
4AB1000
heap
page read and write
396E000
stack
page read and write
4E5000
unkown
page execute and read and write
4AB1000
heap
page read and write
1D57C000
heap
page read and write
3C8000
unkown
page execute and read and write
1D566000
heap
page read and write
1D599000
heap
page read and write
486E000
stack
page read and write
50BE000
stack
page read and write
1D580000
heap
page read and write
1D599000
heap
page read and write
1D58E000
heap
page read and write
356F000
stack
page read and write
1D55B000
heap
page read and write
482F000
stack
page read and write
1240000
direct allocation
page read and write
50D0000
direct allocation
page execute and read and write
5090000
direct allocation
page execute and read and write
2E27000
heap
page read and write
61EB4000
direct allocation
page read and write
3F1000
unkown
page execute and read and write
1D575000
heap
page read and write
4AB1000
heap
page read and write
1240000
direct allocation
page read and write
1230000
heap
page read and write
D93000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
496F000
stack
page read and write
4AB2000
heap
page read and write
6C860000
unkown
page read and write
59E000
unkown
page execute and read and write
1D58B000
heap
page read and write
4AB1000
heap
page read and write
1D566000
heap
page read and write
1D580000
heap
page read and write
6F871000
unkown
page execute read
1D586000
heap
page read and write
45AF000
stack
page read and write
1D580000
heap
page read and write
1D599000
heap
page read and write
1240000
direct allocation
page read and write
4AB1000
heap
page read and write
1D592000
heap
page read and write
1D580000
heap
page read and write
144E000
stack
page read and write
6F8FE000
unkown
page read and write
1D59A000
heap
page read and write
2E20000
heap
page read and write
36AF000
stack
page read and write
29856000
heap
page read and write
432F000
stack
page read and write
1D59C000
heap
page read and write
29570000
heap
page read and write
5080000
direct allocation
page execute and read and write
4AB1000
heap
page read and write
39A000
unkown
page execute and read and write
235EF000
heap
page read and write
1D670000
trusted library allocation
page read and write
4AB1000
heap
page read and write
1D599000
heap
page read and write
1240000
direct allocation
page read and write
30AE000
stack
page read and write
340000
unkown
page read and write
1D566000
heap
page read and write
839000
unkown
page execute and write copy
2961A000
heap
page read and write
1D575000
heap
page read and write
2DEF000
stack
page read and write
2CEF000
stack
page read and write
1D575000
heap
page read and write
1D580000
heap
page read and write
3FAE000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
306F000
stack
page read and write
1D575000
heap
page read and write
4AB1000
heap
page read and write
1240000
direct allocation
page read and write
1D58D000
heap
page read and write
12D4000
heap
page read and write
4AB1000
heap
page read and write
44AE000
stack
page read and write
1D57D000
heap
page read and write
1250000
heap
page read and write
6C85F000
unkown
page write copy
1095000
heap
page read and write
DF0000
heap
page read and write
46EF000
stack
page read and write
3BAF000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
6C680000
unkown
page readonly
4AB1000
heap
page read and write
1D599000
heap
page read and write
29590000
heap
page read and write
4AB1000
heap
page read and write
4AD0000
heap
page read and write
1240000
direct allocation
page read and write
2985E000
heap
page read and write
1D580000
heap
page read and write
297C0000
trusted library allocation
page read and write
1D58C000
heap
page read and write
4AB1000
heap
page read and write
1D57B000
heap
page read and write
1D577000
heap
page read and write
4AB1000
heap
page read and write
29864000
heap
page read and write
36EE000
stack
page read and write
12A0000
heap
page read and write
6C85E000
unkown
page read and write
122B000
stack
page read and write
1D577000
heap
page read and write
3AAE000
stack
page read and write
61EB7000
direct allocation
page readonly
2985F000
heap
page read and write
1D583000
heap
page read and write
41EF000
stack
page read and write
58A000
unkown
page execute and read and write
61ECD000
direct allocation
page readonly
4AB1000
heap
page read and write
1D3AC000
stack
page read and write
35AE000
stack
page read and write
37EF000
stack
page read and write
1D57C000
heap
page read and write
11EE000
stack
page read and write
3BEE000
stack
page read and write
45E000
unkown
page execute and read and write
4AB1000
heap
page read and write
3E6E000
stack
page read and write
1D4ED000
stack
page read and write
40EE000
stack
page read and write
1D58C000
heap
page read and write
1D580000
heap
page read and write
4AB1000
heap
page read and write
1D572000
heap
page read and write
12A2000
heap
page read and write
4AB1000
heap
page read and write
1CFFD000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
61ED3000
direct allocation
page read and write
1D15E000
stack
page read and write
1CFBF000
stack
page read and write
45EE000
stack
page read and write
129E000
heap
page read and write
1D580000
heap
page read and write
2DF0000
heap
page read and write
44F000
unkown
page execute and read and write
6F902000
unkown
page readonly
4AB1000
heap
page read and write
505000
unkown
page execute and read and write
1D578000
heap
page read and write
1D3EE000
stack
page read and write
1D57C000
heap
page read and write
4AB1000
heap
page read and write
1D57D000
heap
page read and write
4AB1000
heap
page read and write
3F6F000
stack
page read and write
1D583000
heap
page read and write
1D580000
heap
page read and write
822000
unkown
page execute and read and write
4AB1000
heap
page read and write
436E000
stack
page read and write
1D568000
heap
page read and write
50B000
unkown
page execute and read and write
1D587000
heap
page read and write
4AAF000
stack
page read and write
50A0000
direct allocation
page execute and read and write
1D550000
heap
page read and write
D9D000
stack
page read and write
297BF000
stack
page read and write
1240000
direct allocation
page read and write
446F000
stack
page read and write
4AB1000
heap
page read and write
1D57D000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1000000
heap
page read and write
29550000
heap
page read and write
4AB1000
heap
page read and write
1D58D000
heap
page read and write
1D59C000
heap
page read and write
1D0FE000
stack
page read and write
1D59C000
heap
page read and write
4AB1000
heap
page read and write
1D572000
heap
page read and write
11AE000
stack
page read and write
4AB0000
heap
page read and write
1CE7E000
stack
page read and write
3CEF000
stack
page read and write
1D566000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
D99000
stack
page read and write
50B0000
direct allocation
page execute and read and write
4AC0000
heap
page read and write
4AB1000
heap
page read and write
340000
unkown
page readonly
4AB1000
heap
page read and write
422000
unkown
page execute and read and write
1240000
direct allocation
page read and write
1258000
heap
page read and write
32EF000
stack
page read and write
4AB1000
heap
page read and write
1D57D000
heap
page read and write
9D2000
unkown
page execute and read and write
382E000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D599000
heap
page read and write
50E0000
direct allocation
page execute and read and write
7FF000
unkown
page execute and read and write
4AB1000
heap
page read and write
1D580000
heap
page read and write
1D59C000
heap
page read and write
1D58C000
heap
page read and write
3CF000
unkown
page execute and read and write
1D583000
heap
page read and write
1D2AD000
stack
page read and write
4AB1000
heap
page read and write
29867000
heap
page read and write
4AB1000
heap
page read and write
4F6B000
stack
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D575000
heap
page read and write
4AB1000
heap
page read and write
3E2F000
stack
page read and write
2E2B000
heap
page read and write
1D565000
heap
page read and write
1D577000
heap
page read and write
839000
unkown
page execute and read and write
1D575000
heap
page read and write
4EF0000
trusted library allocation
page read and write
4F30000
direct allocation
page read and write
1240000
direct allocation
page read and write
4AB1000
heap
page read and write
1D57C000
heap
page read and write
3C5000
unkown
page execute and read and write
61ED0000
direct allocation
page read and write
1D599000
heap
page read and write
6C865000
unkown
page readonly
720000
unkown
page execute and read and write
1D58B000
heap
page read and write
6C81F000
unkown
page readonly
1D574000
heap
page read and write
1D566000
heap
page read and write
1D572000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
422E000
stack
page read and write
1D575000
heap
page read and write
4AB1000
heap
page read and write
1240000
direct allocation
page read and write
83A000
unkown
page execute and write copy
C9C000
stack
page read and write
1D671000
heap
page read and write
1240000
direct allocation
page read and write
1D58C000
heap
page read and write
1D595000
heap
page read and write
6F8ED000
unkown
page readonly
4AB1000
heap
page read and write
1D577000
heap
page read and write
1D577000
heap
page read and write
295B1000
heap
page read and write
6C681000
unkown
page execute read
4AB1000
heap
page read and write
2E2E000
heap
page read and write
342F000
stack
page read and write
1D59C000
heap
page read and write
4F30000
direct allocation
page read and write
106E000
stack
page read and write
1D58D000
heap
page read and write
4AB1000
heap
page read and write
1D580000
heap
page read and write
4AB1000
heap
page read and write
3D2000
unkown
page execute and read and write
1D564000
heap
page read and write
1D580000
heap
page read and write
1CEBE000
stack
page read and write
1D580000
heap
page read and write
296BE000
stack
page read and write
40AF000
stack
page read and write
1D580000
heap
page read and write
4AB1000
heap
page read and write
31AF000
stack
page read and write
4AB1000
heap
page read and write
1D580000
heap
page read and write
392F000
stack
page read and write
341000
unkown
page execute and write copy
4AB1000
heap
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D25F000
stack
page read and write
50B0000
direct allocation
page execute and read and write
50C0000
direct allocation
page execute and read and write
9D3000
unkown
page execute and write copy
4AB1000
heap
page read and write
4AB1000
heap
page read and write
42F000
unkown
page execute and read and write
1D580000
heap
page read and write
3FD000
unkown
page execute and read and write
31EE000
stack
page read and write
1240000
direct allocation
page read and write
61E01000
direct allocation
page execute read
61ECC000
direct allocation
page read and write
45B000
unkown
page execute and read and write
332E000
stack
page read and write
346E000
stack
page read and write
4AB1000
heap
page read and write
2F6E000
stack
page read and write
4AB1000
heap
page read and write
1240000
direct allocation
page read and write
3D2E000
stack
page read and write
4AB1000
heap
page read and write
1090000
heap
page read and write
2F2F000
stack
page read and write
12B8000
heap
page read and write
1240000
direct allocation
page read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D58B000
heap
page read and write
4AB1000
heap
page read and write
1D580000
heap
page read and write
1D599000
heap
page read and write
6F870000
unkown
page readonly
82B000
unkown
page execute and read and write
4AB1000
heap
page read and write
4AB1000
heap
page read and write
1D552000
heap
page read and write
3A6F000
stack
page read and write
1D599000
heap
page read and write
61ED4000
direct allocation
page readonly
506F000
stack
page read and write
1D595000
heap
page read and write
1D575000
heap
page read and write
1D580000
heap
page read and write
49AE000
stack
page read and write
472E000
stack
page read and write
There are 335 hidden memdumps, click here to show them.