IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAFIDGCFHIEHJJJJECAK
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\AECAKECAEGDHIECBGHII
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\HCAKFBGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HCAKFBGCBFHIJKECGIIJKJKJKJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HDAFIIDA
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HIDAKFIJJKJJJKEBKJEHCBGDAK
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJKFBAKFBGDHIEBGDAKFCAFHCB
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\KKFBAAFCGIEGDHIEBFII
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllKH
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllyH
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllwH
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37o
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpeF1
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpV
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpZ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.1
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php0
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phppFL
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dlleH
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFirefox
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll3IZ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php(
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 51 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4E80000
direct allocation
page read and write
 malicious
8A1000
unkown
page execute and read and write
 malicious
125E000
heap
page read and write
 malicious
1D31C000
stack
page read and write
1D634000
heap
page read and write
2991A000
heap
page read and write
4A01000
heap
page read and write
2E7F000
stack
page read and write
1D626000
heap
page read and write
42BE000
stack
page read and write
4A01000
heap
page read and write
1134000
heap
page read and write
3C3F000
stack
page read and write
467E000
stack
page read and write
3DBE000
stack
page read and write
A65000
unkown
page execute and read and write
F3C000
unkown
page execute and read and write
4A01000
heap
page read and write
61ED0000
direct allocation
page read and write
1D64B000
heap
page read and write
982000
unkown
page execute and read and write
1D634000
heap
page read and write
1120000
direct allocation
page read and write
4A01000
heap
page read and write
1134000
heap
page read and write
1D634000
heap
page read and write
1D64F000
heap
page read and write
1134000
heap
page read and write
1D650000
heap
page read and write
4B00000
trusted library allocation
page read and write
4A01000
heap
page read and write
1D64D000
heap
page read and write
463F000
stack
page read and write
6F8FE000
unkown
page read and write
4A20000
heap
page read and write
1D61A000
heap
page read and write
1D62F000
heap
page read and write
1258000
heap
page read and write
413F000
stack
page read and write
337F000
stack
page read and write
12D7000
heap
page read and write
6C85E000
unkown
page read and write
1D61A000
heap
page read and write
1D634000
heap
page read and write
3EBF000
stack
page read and write
5000000
direct allocation
page execute and read and write
4A01000
heap
page read and write
6F902000
unkown
page readonly
4A01000
heap
page read and write
1134000
heap
page read and write
1110000
heap
page read and write
1D634000
heap
page read and write
1D629000
heap
page read and write
1D622000
heap
page read and write
3C7E000
stack
page read and write
2FFE000
stack
page read and write
296E5000
heap
page read and write
4A01000
heap
page read and write
1D64B000
heap
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
1D64D000
heap
page read and write
87E000
stack
page read and write
1D642000
heap
page read and write
1134000
heap
page read and write
48BF000
stack
page read and write
AFE000
unkown
page execute and read and write
4A01000
heap
page read and write
1D629000
heap
page read and write
1134000
heap
page read and write
1134000
heap
page read and write
92F000
unkown
page execute and read and write
323F000
stack
page read and write
4A01000
heap
page read and write
103D000
stack
page read and write
1120000
direct allocation
page read and write
4FE0000
direct allocation
page execute and read and write
1D600000
heap
page read and write
1120000
direct allocation
page read and write
1D642000
heap
page read and write
1D628000
heap
page read and write
61ED3000
direct allocation
page read and write
2C2E000
stack
page read and write
1D634000
heap
page read and write
1134000
heap
page read and write
4A01000
heap
page read and write
43BF000
stack
page read and write
1134000
heap
page read and write
5000000
direct allocation
page execute and read and write
5030000
direct allocation
page execute and read and write
4A01000
heap
page read and write
49FF000
stack
page read and write
1120000
direct allocation
page read and write
1D64F000
heap
page read and write
477F000
stack
page read and write
1D4FD000
stack
page read and write
1334000
heap
page read and write
1D61A000
heap
page read and write
1D35D000
stack
page read and write
133B000
heap
page read and write
44FF000
stack
page read and write
1CE4E000
stack
page read and write
1134000
heap
page read and write
4E60000
heap
page read and write
1134000
heap
page read and write
4A01000
heap
page read and write
1134000
heap
page read and write
1120000
direct allocation
page read and write
1D642000
heap
page read and write
403D000
stack
page read and write
1D629000
heap
page read and write
2C70000
heap
page read and write
4A01000
heap
page read and write
4A32000
heap
page read and write
2D7F000
stack
page read and write
4A01000
heap
page read and write
1134000
heap
page read and write
4A01000
heap
page read and write
377E000
stack
page read and write
1039000
stack
page read and write
427F000
stack
page read and write
4A00000
heap
page read and write
8A0000
unkown
page readonly
1250000
heap
page read and write
1134000
heap
page read and write
6C81F000
unkown
page readonly
4A01000
heap
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
453E000
stack
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
6C865000
unkown
page readonly
4FD0000
direct allocation
page execute and read and write
3B3E000
stack
page read and write
4A01000
heap
page read and write
34FE000
stack
page read and write
1134000
heap
page read and write
F3D000
unkown
page execute and write copy
1D60F000
heap
page read and write
4A32000
heap
page read and write
1D629000
heap
page read and write
9BE000
unkown
page execute and read and write
1D62F000
heap
page read and write
4A01000
heap
page read and write
56C000
stack
page read and write
4A01000
heap
page read and write
29640000
heap
page read and write
D64000
unkown
page execute and read and write
4A01000
heap
page read and write
4A10000
heap
page read and write
1D634000
heap
page read and write
48FE000
stack
page read and write
83D000
stack
page read and write
1D634000
heap
page read and write
95D000
unkown
page execute and read and write
313E000
stack
page read and write
4E80000
direct allocation
page read and write
1134000
heap
page read and write
1120000
direct allocation
page read and write
2990C000
heap
page read and write
1033000
stack
page read and write
133F000
heap
page read and write
4EBC000
stack
page read and write
1134000
heap
page read and write
1D602000
heap
page read and write
4A01000
heap
page read and write
2990C000
heap
page read and write
4A01000
heap
page read and write
1D61A000
heap
page read and write
144E000
stack
page read and write
373F000
stack
page read and write
1D629000
heap
page read and write
5C0000
heap
page read and write
1D61A000
heap
page read and write
928000
unkown
page execute and read and write
4A01000
heap
page read and write
1D629000
heap
page read and write
1D62F000
heap
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
1120000
direct allocation
page read and write
1D1CF000
stack
page read and write
2986F000
stack
page read and write
2EBE000
stack
page read and write
30FF000
stack
page read and write
1D64B000
heap
page read and write
3EFE000
stack
page read and write
29914000
heap
page read and write
61ECC000
direct allocation
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
D9D000
unkown
page execute and write copy
932000
unkown
page execute and read and write
1134000
heap
page read and write
12EE000
heap
page read and write
1D21D000
stack
page read and write
34BF000
stack
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
1D634000
heap
page read and write
1134000
heap
page read and write
1D634000
heap
page read and write
1134000
heap
page read and write
1120000
direct allocation
page read and write
1D64D000
heap
page read and write
6C681000
unkown
page execute read
1D634000
heap
page read and write
1D64A000
heap
page read and write
1332000
heap
page read and write
D9D000
unkown
page execute and read and write
327E000
stack
page read and write
4A01000
heap
page read and write
47BE000
stack
page read and write
1120000
direct allocation
page read and write
1D634000
heap
page read and write
4A01000
heap
page read and write
1D64B000
heap
page read and write
1D642000
heap
page read and write
1120000
direct allocation
page read and write
1D61A000
heap
page read and write
1D72B000
heap
page read and write
1134000
heap
page read and write
A6B000
unkown
page execute and read and write
29870000
trusted library allocation
page read and write
4A01000
heap
page read and write
D85000
unkown
page execute and read and write
3FFF000
stack
page read and write
8A1000
unkown
page execute and write copy
1D5FD000
stack
page read and write
1D634000
heap
page read and write
2976E000
stack
page read and write
1D634000
heap
page read and write
1D634000
heap
page read and write
417E000
stack
page read and write
1134000
heap
page read and write
61EB4000
direct allocation
page read and write
1134000
heap
page read and write
12A3000
heap
page read and write
1134000
heap
page read and write
1338000
heap
page read and write
1D630000
heap
page read and write
4E80000
direct allocation
page read and write
1D622000
heap
page read and write
1134000
heap
page read and write
61E00000
direct allocation
page execute and read and write
4A01000
heap
page read and write
3AFF000
stack
page read and write
61ED4000
direct allocation
page readonly
29660000
heap
page read and write
2FBF000
stack
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
2C77000
heap
page read and write
4FBF000
stack
page read and write
2C6C000
stack
page read and write
9BB000
unkown
page execute and read and write
61ECD000
direct allocation
page readonly
1CE0F000
stack
page read and write
1D634000
heap
page read and write
9AF000
unkown
page execute and read and write
134B000
heap
page read and write
1D606000
heap
page read and write
1D61A000
heap
page read and write
1134000
heap
page read and write
1D634000
heap
page read and write
1D634000
heap
page read and write
1D642000
heap
page read and write
2369E000
heap
page read and write
61E01000
direct allocation
page execute read
39FE000
stack
page read and write
1D64B000
heap
page read and write
1134000
heap
page read and write
1D630000
heap
page read and write
1D64B000
heap
page read and write
2C7E000
heap
page read and write
1D648000
heap
page read and write
D9E000
unkown
page execute and write copy
5020000
direct allocation
page execute and read and write
35FF000
stack
page read and write
D8D000
unkown
page execute and read and write
8A0000
unkown
page read and write
1134000
heap
page read and write
38BE000
stack
page read and write
4A01000
heap
page read and write
29620000
heap
page read and write
387F000
stack
page read and write
6F870000
unkown
page readonly
4A01000
heap
page read and write
1D61C000
heap
page read and write
1D621000
heap
page read and write
1D08F000
stack
page read and write
61EB7000
direct allocation
page readonly
6C680000
unkown
page readonly
4A01000
heap
page read and write
1120000
direct allocation
page read and write
1CF8E000
stack
page read and write
2C7B000
heap
page read and write
5010000
direct allocation
page execute and read and write
1134000
heap
page read and write
1CD0E000
stack
page read and write
4A01000
heap
page read and write
6F871000
unkown
page execute read
AEA000
unkown
page execute and read and write
A45000
unkown
page execute and read and write
1D62B000
heap
page read and write
1134000
heap
page read and write
1D64B000
heap
page read and write
33BE000
stack
page read and write
1D621000
heap
page read and write
1134000
heap
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
1134000
heap
page read and write
1134000
heap
page read and write
43FE000
stack
page read and write
1D62E000
heap
page read and write
1D634000
heap
page read and write
C87000
unkown
page execute and read and write
4A01000
heap
page read and write
1134000
heap
page read and write
363E000
stack
page read and write
1D62B000
heap
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
29600000
heap
page read and write
1D634000
heap
page read and write
98F000
unkown
page execute and read and write
1CF4E000
stack
page read and write
1D626000
heap
page read and write
5D0000
heap
page read and write
1D629000
heap
page read and write
1D0CE000
stack
page read and write
1134000
heap
page read and write
1120000
direct allocation
page read and write
1D619000
heap
page read and write
123E000
stack
page read and write
4FF0000
direct allocation
page execute and read and write
1344000
heap
page read and write
1134000
heap
page read and write
4A01000
heap
page read and write
4A01000
heap
page read and write
1D62B000
heap
page read and write
1D634000
heap
page read and write
1130000
heap
page read and write
1D45D000
stack
page read and write
1D634000
heap
page read and write
1D628000
heap
page read and write
1D62E000
heap
page read and write
4A01000
heap
page read and write
29914000
heap
page read and write
4A01000
heap
page read and write
1120000
direct allocation
page read and write
12B6000
heap
page read and write
4A01000
heap
page read and write
1D720000
trusted library allocation
page read and write
1D629000
heap
page read and write
1120000
direct allocation
page read and write
951000
unkown
page execute and read and write
1D626000
heap
page read and write
8FA000
unkown
page execute and read and write
6C860000
unkown
page read and write
6C85F000
unkown
page write copy
1D634000
heap
page read and write
6F8ED000
unkown
page readonly
1134000
heap
page read and write
39BF000
stack
page read and write
4A01000
heap
page read and write
3D7F000
stack
page read and write
925000
unkown
page execute and read and write
There are 363 hidden memdumps, click here to show them.