IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\DGCAAAFC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DGCAAAFCBFBAKFHJDBKJJJJJJD
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\FBFIJJEBKEBFCBGDAEGDHDGHCG
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FCAAAAFBKFIECAAKECGCAAKJEC
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FIDAFCAFCBKECBGCFIIJ
ASCII text, with very long lines (1769), with CRLF line terminators
dropped
C:\ProgramData\GHDBKFHI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\HIDHDAAEHIEHIECBKJDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IEHCAKKJDBKKFHJJDHII
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\1M8V7EFU\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlls
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpv
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpt
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpsimple-storage.json
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll2
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3Z
unknown
 malicious
http://185.215.113.37u
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll9
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dlli
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll/;
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpus.wallet
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpH
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php4
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php8
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll9
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696506299400400001.1&ci=1696506299033.12791&cta
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_cd61a4703a8613be887576f2bd084bcc6f4756dccdbe5062
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.P9ZDdyXKOWl2
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696506299400400001.2&ci=1696506299033.
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbmfQq%2B4pbW4pbWfpbX7ReNxR3UIG8zInwYIFIVs9e
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 40 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
561000
unkown
page execute and read and write
 malicious
42E000
heap
page read and write
 malicious
4A20000
direct allocation
page read and write
 malicious
2F38E000
stack
page read and write
1D194000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
1D1C0000
heap
page read and write
1D199000
heap
page read and write
61ED3000
direct allocation
page read and write
72B000
unkown
page execute and read and write
4591000
heap
page read and write
3CBF000
stack
page read and write
1D1C0000
heap
page read and write
1D18A000
heap
page read and write
4591000
heap
page read and write
6CA80000
unkown
page readonly
1D1B1000
heap
page read and write
420000
heap
page read and write
61ECC000
direct allocation
page read and write
6CA81000
unkown
page execute read
1D1A4000
heap
page read and write
232AA000
heap
page read and write
4591000
heap
page read and write
1D19B000
heap
page read and write
1D1C0000
heap
page read and write
1D193000
heap
page read and write
4C8000
heap
page read and write
4580000
direct allocation
page read and write
4591000
heap
page read and write
23202000
heap
page read and write
4591000
heap
page read and write
4D5000
heap
page read and write
4591000
heap
page read and write
EC000
stack
page read and write
1D16E000
stack
page read and write
32FE000
stack
page read and write
1D18A000
heap
page read and write
1D293000
heap
page read and write
1D1A4000
heap
page read and write
4591000
heap
page read and write
1D1C0000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
447E000
stack
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
1D196000
heap
page read and write
1D189000
heap
page read and write
1D19F000
heap
page read and write
1D1A4000
heap
page read and write
2EFF000
stack
page read and write
1D19F000
heap
page read and write
1D1A4000
heap
page read and write
560000
unkown
page read and write
2CBE000
stack
page read and write
4591000
heap
page read and write
4580000
direct allocation
page read and write
4591000
heap
page read and write
307E000
stack
page read and write
61ECD000
direct allocation
page readonly
1D1A4000
heap
page read and write
4580000
direct allocation
page read and write
4591000
heap
page read and write
A5F000
unkown
page execute and write copy
DCE000
stack
page read and write
5EF000
unkown
page execute and read and write
3F3F000
stack
page read and write
4591000
heap
page read and write
1D1C0000
heap
page read and write
560000
unkown
page readonly
4591000
heap
page read and write
1D1A3000
heap
page read and write
1CA9F000
stack
page read and write
A50000
unkown
page execute and read and write
1D1A0000
heap
page read and write
1D1B6000
heap
page read and write
475000
heap
page read and write
1D1A4000
heap
page read and write
4591000
heap
page read and write
1E8000
stack
page read and write
D7E000
stack
page read and write
1CE8C000
stack
page read and write
3B7F000
stack
page read and write
1D19C000
heap
page read and write
40BE000
stack
page read and write
1CFCD000
stack
page read and write
1D1A4000
heap
page read and write
45B0000
heap
page read and write
4591000
heap
page read and write
4A20000
direct allocation
page read and write
4580000
direct allocation
page read and write
292F1000
heap
page read and write
1D19A000
heap
page read and write
1CECE000
stack
page read and write
4591000
heap
page read and write
45A0000
heap
page read and write
1E2000
stack
page read and write
1D1C0000
heap
page read and write
1D1C0000
heap
page read and write
1D1A4000
heap
page read and write
540000
heap
page read and write
1D19E000
heap
page read and write
4591000
heap
page read and write
1D189000
heap
page read and write
561000
unkown
page execute and write copy
4BC0000
direct allocation
page execute and read and write
49D0000
trusted library allocation
page read and write
41BF000
stack
page read and write
2B3F000
stack
page read and write
1D192000
heap
page read and write
1D1B1000
heap
page read and write
4591000
heap
page read and write
67B000
unkown
page execute and read and write
1D1B0000
heap
page read and write
1D196000
heap
page read and write
4591000
heap
page read and write
1D1A4000
heap
page read and write
4591000
heap
page read and write
1D1C0000
heap
page read and write
4591000
heap
page read and write
29351000
heap
page read and write
DD0000
heap
page read and write
1D19B000
heap
page read and write
1D198000
heap
page read and write
1CBDF000
stack
page read and write
1D199000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
1D1C0000
heap
page read and write
428000
heap
page read and write
1D19F000
heap
page read and write
4591000
heap
page read and write
1D1B2000
heap
page read and write
1D199000
heap
page read and write
1D1A4000
heap
page read and write
7BE000
unkown
page execute and read and write
4580000
direct allocation
page read and write
473000
heap
page read and write
1D18A000
heap
page read and write
1D198000
heap
page read and write
1D193000
heap
page read and write
4591000
heap
page read and write
1D1B2000
heap
page read and write
317F000
stack
page read and write
4591000
heap
page read and write
1D1B1000
heap
page read and write
4BA0000
direct allocation
page execute and read and write
4591000
heap
page read and write
1D1C0000
heap
page read and write
5F2000
unkown
page execute and read and write
1D196000
heap
page read and write
4591000
heap
page read and write
29331000
heap
page read and write
1D1B6000
heap
page read and write
4591000
heap
page read and write
5E8000
unkown
page execute and read and write
11EE000
stack
page read and write
1D193000
heap
page read and write
1D18B000
heap
page read and write
61ED4000
direct allocation
page readonly
1D194000
heap
page read and write
61EB4000
direct allocation
page read and write
3CFE000
stack
page read and write
725000
unkown
page execute and read and write
1D1A4000
heap
page read and write
61EB7000
direct allocation
page readonly
1D1C0000
heap
page read and write
23345000
heap
page read and write
A22000
unkown
page execute and read and write
1D1B2000
heap
page read and write
DE0000
heap
page read and write
A5F000
unkown
page execute and read and write
1D1B2000
heap
page read and write
4580000
direct allocation
page read and write
4580000
direct allocation
page read and write
1D1A3000
heap
page read and write
1D1C0000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
611000
unkown
page execute and read and write
64F000
unkown
page execute and read and write
4B5F000
stack
page read and write
457F000
stack
page read and write
4591000
heap
page read and write
2A3E000
stack
page read and write
1D176000
heap
page read and write
4591000
heap
page read and write
61D000
unkown
page execute and read and write
1CD8D000
stack
page read and write
1D1A2000
heap
page read and write
1D1C0000
heap
page read and write
1D06E000
stack
page read and write
1D18A000
heap
page read and write
27CB000
stack
page read and write
2DFE000
stack
page read and write
A60000
unkown
page execute and write copy
1D1A4000
heap
page read and write
1D1AA000
heap
page read and write
EEF000
stack
page read and write
4591000
heap
page read and write
1D1BF000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
6CB0E000
unkown
page read and write
489000
heap
page read and write
27D0000
heap
page read and write
42FF000
stack
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
1D1B2000
heap
page read and write
1D1C0000
heap
page read and write
4591000
heap
page read and write
1D1B2000
heap
page read and write
A47000
unkown
page execute and read and write
4BA0000
direct allocation
page execute and read and write
357E000
stack
page read and write
1D1A4000
heap
page read and write
5E5000
unkown
page execute and read and write
3F7E000
stack
page read and write
4591000
heap
page read and write
61E01000
direct allocation
page execute read
1D1A4000
heap
page read and write
4580000
direct allocation
page read and write
4591000
heap
page read and write
4A20000
direct allocation
page read and write
1D290000
trusted library allocation
page read and write
393E000
stack
page read and write
5BA000
unkown
page execute and read and write
1D1B2000
heap
page read and write
303F000
stack
page read and write
4591000
heap
page read and write
4580000
direct allocation
page read and write
29311000
heap
page read and write
4590000
heap
page read and write
1D199000
heap
page read and write
4B90000
direct allocation
page execute and read and write
32BF000
stack
page read and write
4591000
heap
page read and write
1D1A4000
heap
page read and write
93E000
unkown
page execute and read and write
4BE000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
2F48E000
stack
page read and write
4591000
heap
page read and write
4A2000
heap
page read and write
1D1C0000
heap
page read and write
38FF000
stack
page read and write
1D1C0000
heap
page read and write
4C3000
heap
page read and write
1C99E000
stack
page read and write
2F529000
heap
page read and write
1ED000
stack
page read and write
4591000
heap
page read and write
1D19F000
heap
page read and write
67E000
unkown
page execute and read and write
6CD00000
unkown
page read and write
1D17F000
heap
page read and write
1CC4E000
stack
page read and write
642000
unkown
page execute and read and write
2F52A000
heap
page read and write
4591000
heap
page read and write
4580000
direct allocation
page read and write
3DFF000
stack
page read and write
37FE000
stack
page read and write
343E000
stack
page read and write
61ED0000
direct allocation
page read and write
1D1C0000
heap
page read and write
3A3F000
stack
page read and write
4B70000
direct allocation
page execute and read and write
4A5B000
stack
page read and write
BFC000
unkown
page execute and read and write
6CCBF000
unkown
page readonly
2B7E000
stack
page read and write
1C95F000
stack
page read and write
4B80000
direct allocation
page execute and read and write
4591000
heap
page read and write
1D196000
heap
page read and write
3E3E000
stack
page read and write
6CB12000
unkown
page readonly
2C7F000
stack
page read and write
1D1A4000
heap
page read and write
2DBF000
stack
page read and write
4580000
direct allocation
page read and write
1D199000
heap
page read and write
66F000
unkown
page execute and read and write
6CCFF000
unkown
page write copy
6CB20000
unkown
page readonly
1D1A2000
heap
page read and write
27FE000
heap
page read and write
4591000
heap
page read and write
4580000
direct allocation
page read and write
27F7000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
1D1A4000
heap
page read and write
1D190000
heap
page read and write
353F000
stack
page read and write
4591000
heap
page read and write
6CD05000
unkown
page readonly
4591000
heap
page read and write
3BBD000
stack
page read and write
31BE000
stack
page read and write
1D1A1000
heap
page read and write
4591000
heap
page read and write
4BAE000
stack
page read and write
3A7E000
stack
page read and write
1D1C0000
heap
page read and write
6CCFE000
unkown
page read and write
1D1B2000
heap
page read and write
1D19E000
heap
page read and write
1D1A4000
heap
page read and write
37BF000
stack
page read and write
1D19C000
heap
page read and write
33FF000
stack
page read and write
27F0000
heap
page read and write
1D1A4000
heap
page read and write
4580000
direct allocation
page read and write
1D1C0000
heap
page read and write
550000
heap
page read and write
4BB0000
direct allocation
page execute and read and write
27FB000
heap
page read and write
443F000
stack
page read and write
2F532000
heap
page read and write
1D1A4000
heap
page read and write
1D18A000
heap
page read and write
2F537000
heap
page read and write
1D1A2000
heap
page read and write
1D19F000
heap
page read and write
4580000
direct allocation
page read and write
292D0000
heap
page read and write
6CB21000
unkown
page execute read
4591000
heap
page read and write
61E00000
direct allocation
page execute and read and write
4594000
heap
page read and write
1D198000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
1D193000
heap
page read and write
4591000
heap
page read and write
1CADE000
stack
page read and write
1D1A9000
heap
page read and write
4591000
heap
page read and write
29FF000
stack
page read and write
1D1A4000
heap
page read and write
705000
unkown
page execute and read and write
DE5000
heap
page read and write
1D1C0000
heap
page read and write
1D1B6000
heap
page read and write
1D19F000
heap
page read and write
1D19B000
heap
page read and write
1D1A3000
heap
page read and write
407F000
stack
page read and write
28FF000
stack
page read and write
4591000
heap
page read and write
292B0000
heap
page read and write
2F531000
heap
page read and write
1D1B2000
heap
page read and write
1D198000
heap
page read and write
4591000
heap
page read and write
1D18A000
heap
page read and write
367F000
stack
page read and write
2F490000
trusted library allocation
page read and write
433E000
stack
page read and write
D2E000
stack
page read and write
4591000
heap
page read and write
2F3E000
stack
page read and write
4591000
heap
page read and write
1CD4F000
stack
page read and write
41FE000
stack
page read and write
1D1AA000
heap
page read and write
4591000
heap
page read and write
6CAFD000
unkown
page readonly
4CF000
heap
page read and write
1D1A4000
heap
page read and write
1D1AC000
heap
page read and write
1D170000
heap
page read and write
36BE000
stack
page read and write
There are 371 hidden memdumps, click here to show them.