IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\CGCFBFBGHDGDAKECAKJE
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\ECFHJKEBAAECBFHIECGI
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EHDHIDAE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FHDAEHDAKECGCAKFCFIJDHJDBK
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\GCAFCAFHJJDBFIECFBKECFHDGI
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GDBKJDGIJECFIEBFIDHC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GHIDHCBG
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/e2b1563c6670f193.phpnw
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll7WXa
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll.
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/f
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllL
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFBFBGHDGDAKECAKJEHq:
unknown
 malicious
http://185.215.113.37/m
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFBFBGHDGDAKECAKJE
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpmple-storage.json
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php2
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php0
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllr
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php$
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpYw
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php)
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 47 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4B90000
direct allocation
page read and write
 malicious
61E000
heap
page read and write
 malicious
B91000
unkown
page execute and read and write
 malicious
1224000
unkown
page execute and read and write
604000
heap
page read and write
604000
heap
page read and write
398E000
stack
page read and write
44CE000
stack
page read and write
604000
heap
page read and write
F74000
unkown
page execute and read and write
1D2D0000
trusted library allocation
page read and write
1D1F9000
heap
page read and write
2E4E000
stack
page read and write
4711000
heap
page read and write
AC0000
direct allocation
page read and write
1D1D2000
heap
page read and write
1D1F9000
heap
page read and write
B6E000
stack
page read and write
3FCE000
stack
page read and write
291D0000
heap
page read and write
4711000
heap
page read and write
4716000
heap
page read and write
1D1C8000
heap
page read and write
4711000
heap
page read and write
604000
heap
page read and write
4711000
heap
page read and write
6C84F000
unkown
page write copy
604000
heap
page read and write
330F000
stack
page read and write
1D1EC000
heap
page read and write
1D1D5000
heap
page read and write
1D1D5000
heap
page read and write
460E000
stack
page read and write
1D1C6000
heap
page read and write
4711000
heap
page read and write
1D1D7000
heap
page read and write
394F000
stack
page read and write
4711000
heap
page read and write
B90000
unkown
page read and write
604000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D1FC000
heap
page read and write
1D1DC000
heap
page read and write
4711000
heap
page read and write
604000
heap
page read and write
1D1F9000
heap
page read and write
1D1E3000
heap
page read and write
4711000
heap
page read and write
1D1C6000
heap
page read and write
3ACE000
stack
page read and write
3E4F000
stack
page read and write
B90000
unkown
page readonly
6C850000
unkown
page read and write
604000
heap
page read and write
1D1E0000
heap
page read and write
3D0F000
stack
page read and write
604000
heap
page read and write
1D1FC000
heap
page read and write
61ED3000
direct allocation
page read and write
1D1E0000
heap
page read and write
1CEBF000
stack
page read and write
6C670000
unkown
page readonly
1D1BB000
heap
page read and write
294CE000
heap
page read and write
1D1E3000
heap
page read and write
1D1F9000
heap
page read and write
1D1DB000
heap
page read and write
D5B000
unkown
page execute and read and write
2324E000
heap
page read and write
1D1DD000
heap
page read and write
4711000
heap
page read and write
1D1D5000
heap
page read and write
C41000
unkown
page execute and read and write
604000
heap
page read and write
294B9000
heap
page read and write
4711000
heap
page read and write
DEE000
unkown
page execute and read and write
1D1E0000
heap
page read and write
1D1D9000
heap
page read and write
1088000
unkown
page execute and write copy
30CE000
stack
page read and write
384E000
stack
page read and write
1D1F9000
heap
page read and write
1D1E0000
heap
page read and write
AE0000
heap
page read and write
BEA000
unkown
page execute and read and write
4711000
heap
page read and write
1D1D8000
heap
page read and write
604000
heap
page read and write
1D1B0000
heap
page read and write
C1F000
unkown
page execute and read and write
604000
heap
page read and write
AC0000
direct allocation
page read and write
2CCF000
stack
page read and write
1D1F5000
heap
page read and write
AC0000
direct allocation
page read and write
4711000
heap
page read and write
2927B000
heap
page read and write
1D1DC000
heap
page read and write
2F8E000
stack
page read and write
4711000
heap
page read and write
1D1DD000
heap
page read and write
1D2DC000
heap
page read and write
604000
heap
page read and write
5C0000
heap
page read and write
604000
heap
page read and write
358F000
stack
page read and write
AC0000
direct allocation
page read and write
1D1EB000
heap
page read and write
4711000
heap
page read and write
1D1E7000
heap
page read and write
C18000
unkown
page execute and read and write
424E000
stack
page read and write
4711000
heap
page read and write
1D1C5000
heap
page read and write
C72000
unkown
page execute and read and write
D35000
unkown
page execute and read and write
4CCF000
stack
page read and write
6C84E000
unkown
page read and write
604000
heap
page read and write
6F860000
unkown
page readonly
4CF0000
direct allocation
page execute and read and write
6C80F000
unkown
page readonly
1D1D2000
heap
page read and write
4711000
heap
page read and write
1088000
unkown
page execute and read and write
31CF000
stack
page read and write
1D1D7000
heap
page read and write
4711000
heap
page read and write
320E000
stack
page read and write
4711000
heap
page read and write
35CE000
stack
page read and write
604000
heap
page read and write
294B1000
heap
page read and write
1D1E0000
heap
page read and write
1CB3E000
stack
page read and write
1CD7E000
stack
page read and write
1D1DC000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D1EB000
heap
page read and write
3C0E000
stack
page read and write
604000
heap
page read and write
553000
stack
page read and write
1D04E000
stack
page read and write
61ED4000
direct allocation
page readonly
4711000
heap
page read and write
291B0000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
AB0000
heap
page read and write
4BCC000
stack
page read and write
1D1D5000
heap
page read and write
1D1ED000
heap
page read and write
AEE000
heap
page read and write
1D1E0000
heap
page read and write
6F8F2000
unkown
page readonly
4711000
heap
page read and write
AC0000
direct allocation
page read and write
1D1D5000
heap
page read and write
2F4F000
stack
page read and write
1D1F5000
heap
page read and write
104F000
unkown
page execute and read and write
334E000
stack
page read and write
1D1EB000
heap
page read and write
1D1E0000
heap
page read and write
1D1D5000
heap
page read and write
2930E000
stack
page read and write
AC0000
direct allocation
page read and write
434F000
stack
page read and write
6C671000
unkown
page execute read
1D1B2000
heap
page read and write
6F8DD000
unkown
page readonly
4730000
heap
page read and write
4711000
heap
page read and write
410E000
stack
page read and write
2D0E000
stack
page read and write
604000
heap
page read and write
4711000
heap
page read and write
1D00D000
stack
page read and write
AC0000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
4711000
heap
page read and write
1CAFF000
stack
page read and write
2ACF000
stack
page read and write
B70000
direct allocation
page read and write
3BCF000
stack
page read and write
438E000
stack
page read and write
604000
heap
page read and write
3A8F000
stack
page read and write
1D1EE000
heap
page read and write
AC0000
direct allocation
page read and write
4720000
heap
page read and write
4D20000
direct allocation
page execute and read and write
1D1FC000
heap
page read and write
4711000
heap
page read and write
4710000
heap
page read and write
4711000
heap
page read and write
1D1F2000
heap
page read and write
3E8E000
stack
page read and write
294BF000
heap
page read and write
1079000
unkown
page execute and read and write
4D00000
direct allocation
page execute and read and write
4711000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
36CF000
stack
page read and write
4711000
heap
page read and write
1D1F9000
heap
page read and write
1D1C6000
heap
page read and write
1CC7E000
stack
page read and write
61EB7000
direct allocation
page readonly
677000
heap
page read and write
4711000
heap
page read and write
B91000
unkown
page execute and write copy
1D1E0000
heap
page read and write
448F000
stack
page read and write
29211000
heap
page read and write
1D1FC000
heap
page read and write
1D1ED000
heap
page read and write
470F000
stack
page read and write
1D1C6000
heap
page read and write
604000
heap
page read and write
4711000
heap
page read and write
AC0000
direct allocation
page read and write
C15000
unkown
page execute and read and write
1D1E0000
heap
page read and write
610000
heap
page read and write
1D1E0000
heap
page read and write
1D1E6000
heap
page read and write
AC0000
direct allocation
page read and write
370E000
stack
page read and write
1D1D4000
heap
page read and write
4711000
heap
page read and write
4D10000
direct allocation
page execute and read and write
4711000
heap
page read and write
4CF0000
direct allocation
page execute and read and write
1D1DC000
heap
page read and write
CAB000
unkown
page execute and read and write
3D4E000
stack
page read and write
618000
heap
page read and write
1D1D7000
heap
page read and write
1D1D2000
heap
page read and write
1D1D7000
heap
page read and write
1CDBE000
stack
page read and write
61EB4000
direct allocation
page read and write
4711000
heap
page read and write
1072000
unkown
page execute and read and write
C22000
unkown
page execute and read and write
1D1E3000
heap
page read and write
61E01000
direct allocation
page execute read
4810000
trusted library allocation
page read and write
1D1E0000
heap
page read and write
604000
heap
page read and write
604000
heap
page read and write
1D1E0000
heap
page read and write
1225000
unkown
page execute and write copy
420F000
stack
page read and write
1CF0E000
stack
page read and write
1089000
unkown
page execute and write copy
4711000
heap
page read and write
45C000
stack
page read and write
1D14D000
stack
page read and write
1D1D5000
heap
page read and write
4711000
heap
page read and write
61ECD000
direct allocation
page readonly
4711000
heap
page read and write
4711000
heap
page read and write
C9F000
unkown
page execute and read and write
4711000
heap
page read and write
600000
heap
page read and write
291F0000
heap
page read and write
6F8EE000
unkown
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
AC0000
direct allocation
page read and write
AC0000
direct allocation
page read and write
45CF000
stack
page read and write
604000
heap
page read and write
604000
heap
page read and write
294C6000
heap
page read and write
40CF000
stack
page read and write
1D1E0000
heap
page read and write
4711000
heap
page read and write
1D1E0000
heap
page read and write
CAE000
unkown
page execute and read and write
604000
heap
page read and write
380F000
stack
page read and write
604000
heap
page read and write
1D1D7000
heap
page read and write
604000
heap
page read and write
6F861000
unkown
page execute read
1D1C6000
heap
page read and write
4711000
heap
page read and write
3F8F000
stack
page read and write
61ED0000
direct allocation
page read and write
1D1E0000
heap
page read and write
348E000
stack
page read and write
AE7000
heap
page read and write
AC0000
direct allocation
page read and write
308F000
stack
page read and write
B70000
direct allocation
page read and write
1D1EC000
heap
page read and write
2E0F000
stack
page read and write
1C9FE000
stack
page read and write
81D000
stack
page read and write
B80000
direct allocation
page execute and read and write
4711000
heap
page read and write
91E000
stack
page read and write
1D1F9000
heap
page read and write
C4D000
unkown
page execute and read and write
604000
heap
page read and write
696000
heap
page read and write
4CE0000
direct allocation
page execute and read and write
559000
stack
page read and write
690000
heap
page read and write
1D1EC000
heap
page read and write
1D1E0000
heap
page read and write
4711000
heap
page read and write
B2C000
stack
page read and write
2940E000
stack
page read and write
29273000
heap
page read and write
1D1DD000
heap
page read and write
1D1EC000
heap
page read and write
4711000
heap
page read and write
5B0000
heap
page read and write
AC0000
direct allocation
page read and write
1D1F9000
heap
page read and write
4711000
heap
page read and write
61ECC000
direct allocation
page read and write
2BCF000
stack
page read and write
604000
heap
page read and write
604000
heap
page read and write
1D1D5000
heap
page read and write
604000
heap
page read and write
1D1ED000
heap
page read and write
604000
heap
page read and write
604000
heap
page read and write
4711000
heap
page read and write
4CD0000
direct allocation
page execute and read and write
4711000
heap
page read and write
665000
heap
page read and write
AEB000
heap
page read and write
55D000
stack
page read and write
4711000
heap
page read and write
AAE000
stack
page read and write
1CC3F000
stack
page read and write
344F000
stack
page read and write
4711000
heap
page read and write
604000
heap
page read and write
1D1DD000
heap
page read and write
C7F000
unkown
page execute and read and write
95E000
stack
page read and write
1D1E0000
heap
page read and write
1D1F9000
heap
page read and write
1D1E0000
heap
page read and write
D55000
unkown
page execute and read and write
4711000
heap
page read and write
6C855000
unkown
page readonly
604000
heap
page read and write
4B60000
heap
page read and write
29420000
trusted library allocation
page read and write
4711000
heap
page read and write
1D1FA000
heap
page read and write
604000
heap
page read and write
604000
heap
page read and write
A5E000
stack
page read and write
4711000
heap
page read and write
1D1FC000
heap
page read and write
65F000
heap
page read and write
There are 361 hidden memdumps, click here to show them.