IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKJDAEGCAFIIDGDGCGIJ
ASCII text, with very long lines (1765), with CRLF line terminators
dropped
C:\ProgramData\DGIJECGDGCBKECAKFBGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FCBAEHCAEGDHJKFHJKFIJKJEGH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GDBAKEGIDBGIEBFHDHJJEHDHDG
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HIDBFCBG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\JDGIIJJDHDGCGDHIJDAK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JKECGDBF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KECFIDGCBFBAKEBFBKFBFBAFII
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php0u
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/H
unknown
 malicious
http://185.215.113.37/G
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll-
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf-9bc86c8e8c94$
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dlli
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpg
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllc
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpY
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php?
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpbird
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpJECGDGCBKECAKFBGC
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll7
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwindow-state.json
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 44 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
AC1000
unkown
page execute and read and write
 malicious
176E000
heap
page read and write
 malicious
5480000
direct allocation
page read and write
 malicious
5001000
heap
page read and write
1DC11000
heap
page read and write
49BF000
stack
page read and write
D1E000
unkown
page execute and read and write
29DA5000
heap
page read and write
11EC000
stack
page read and write
FA3000
unkown
page execute and read and write
F7E000
unkown
page execute and read and write
3C3E000
stack
page read and write
1DC04000
heap
page read and write
4DBE000
stack
page read and write
AC0000
unkown
page read and write
34BE000
stack
page read and write
1DC04000
heap
page read and write
5001000
heap
page read and write
17D2000
heap
page read and write
1DC04000
heap
page read and write
1DC1C000
heap
page read and write
5480000
direct allocation
page read and write
2FF81000
heap
page read and write
1DC04000
heap
page read and write
5001000
heap
page read and write
17B0000
heap
page read and write
B4F000
unkown
page execute and read and write
1DC02000
heap
page read and write
5001000
heap
page read and write
1DBE5000
heap
page read and write
61ED4000
direct allocation
page readonly
5001000
heap
page read and write
5001000
heap
page read and write
1DBD0000
heap
page read and write
1DCF0000
trusted library allocation
page read and write
347F000
stack
page read and write
1DBFD000
heap
page read and write
3D7E000
stack
page read and write
560E000
stack
page read and write
FB9000
unkown
page execute and read and write
1DBE8000
heap
page read and write
1DC04000
heap
page read and write
1DBF9000
heap
page read and write
61ED0000
direct allocation
page read and write
23D07000
heap
page read and write
1750000
direct allocation
page read and write
29DBD000
heap
page read and write
5001000
heap
page read and write
4EBF000
stack
page read and write
1813000
heap
page read and write
3330000
heap
page read and write
6CC3E000
unkown
page read and write
1750000
direct allocation
page read and write
473F000
stack
page read and write
1DC11000
heap
page read and write
5001000
heap
page read and write
437F000
stack
page read and write
1DC20000
heap
page read and write
1DC08000
heap
page read and write
5010000
heap
page read and write
1DC20000
heap
page read and write
1DC1E000
heap
page read and write
1DBEA000
heap
page read and write
4FFF000
stack
page read and write
1DBF9000
heap
page read and write
2FDDE000
stack
page read and write
AC1000
unkown
page execute and write copy
337C000
stack
page read and write
5001000
heap
page read and write
6CE35000
unkown
page readonly
5610000
direct allocation
page execute and read and write
1DC11000
heap
page read and write
3BFF000
stack
page read and write
1DBEA000
heap
page read and write
61EB7000
direct allocation
page readonly
1DC21000
heap
page read and write
4C3F000
stack
page read and write
397F000
stack
page read and write
6CBB1000
unkown
page execute read
5001000
heap
page read and write
5001000
heap
page read and write
1DC04000
heap
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
1DBF9000
heap
page read and write
1D3FE000
stack
page read and write
3E7F000
stack
page read and write
5001000
heap
page read and write
1DC11000
heap
page read and write
1750000
direct allocation
page read and write
1750000
direct allocation
page read and write
1DBFD000
heap
page read and write
1DBFA000
heap
page read and write
5001000
heap
page read and write
333B000
heap
page read and write
2FF7B000
heap
page read and write
55D0000
direct allocation
page execute and read and write
1685000
heap
page read and write
5620000
direct allocation
page execute and read and write
B45000
unkown
page execute and read and write
1DC07000
heap
page read and write
1D6AE000
stack
page read and write
61ECC000
direct allocation
page read and write
1DBF9000
heap
page read and write
477E000
stack
page read and write
48BE000
stack
page read and write
6CE30000
unkown
page read and write
1DBF8000
heap
page read and write
1DC04000
heap
page read and write
5001000
heap
page read and write
2FF7F000
heap
page read and write
B1A000
unkown
page execute and read and write
1DC04000
heap
page read and write
1DC1F000
heap
page read and write
C8B000
unkown
page execute and read and write
5001000
heap
page read and write
3337000
heap
page read and write
1DC04000
heap
page read and write
1DC07000
heap
page read and write
1DBF9000
heap
page read and write
4EFE000
stack
page read and write
1DC04000
heap
page read and write
1750000
direct allocation
page read and write
5001000
heap
page read and write
43BE000
stack
page read and write
1DBF9000
heap
page read and write
1DC11000
heap
page read and write
5001000
heap
page read and write
1750000
direct allocation
page read and write
181F000
heap
page read and write
195E000
stack
page read and write
5001000
heap
page read and write
1A5E000
stack
page read and write
1DC08000
heap
page read and write
3300000
heap
page read and write
487F000
stack
page read and write
1D3BF000
stack
page read and write
1DC08000
heap
page read and write
61E01000
direct allocation
page execute read
1DC0C000
heap
page read and write
C65000
unkown
page execute and read and write
1DC20000
heap
page read and write
1680000
heap
page read and write
1DC08000
heap
page read and write
17F5000
heap
page read and write
55BF000
stack
page read and write
1DC11000
heap
page read and write
3AFE000
stack
page read and write
1DC20000
heap
page read and write
17C8000
heap
page read and write
5001000
heap
page read and write
1DC08000
heap
page read and write
3D3E000
stack
page read and write
5001000
heap
page read and write
170D000
stack
page read and write
5001000
heap
page read and write
1540000
heap
page read and write
1DC04000
heap
page read and write
14F2000
stack
page read and write
23C68000
heap
page read and write
1DBF6000
heap
page read and write
1DC02000
heap
page read and write
1DC04000
heap
page read and write
1DC00000
heap
page read and write
1DC07000
heap
page read and write
32FF000
stack
page read and write
1DC20000
heap
page read and write
FB9000
unkown
page execute and write copy
463E000
stack
page read and write
B48000
unkown
page execute and read and write
1DBEA000
heap
page read and write
6CC2D000
unkown
page readonly
16CE000
stack
page read and write
1DC08000
heap
page read and write
1DBEA000
heap
page read and write
14FD000
stack
page read and write
B7E000
unkown
page execute and read and write
5001000
heap
page read and write
5001000
heap
page read and write
373E000
stack
page read and write
5001000
heap
page read and write
BDB000
unkown
page execute and read and write
1DC21000
heap
page read and write
FBA000
unkown
page execute and write copy
5001000
heap
page read and write
17B3000
heap
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
5100000
trusted library allocation
page read and write
1670000
heap
page read and write
1D7AF000
stack
page read and write
1DC04000
heap
page read and write
1DC1F000
heap
page read and write
61ED3000
direct allocation
page read and write
5001000
heap
page read and write
1DBFD000
heap
page read and write
5001000
heap
page read and write
B71000
unkown
page execute and read and write
5001000
heap
page read and write
1DBFB000
heap
page read and write
1D63F000
stack
page read and write
FAA000
unkown
page execute and read and write
1750000
direct allocation
page read and write
1DBD6000
heap
page read and write
6CE2E000
unkown
page read and write
1DC01000
heap
page read and write
5001000
heap
page read and write
3EBE000
stack
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
1DBF6000
heap
page read and write
1DC21000
heap
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
383F000
stack
page read and write
1151000
unkown
page execute and write copy
29DB5000
heap
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
B80000
unkown
page execute and read and write
1DBF9000
heap
page read and write
1DC20000
heap
page read and write
6CDEF000
unkown
page readonly
1DC04000
heap
page read and write
1DBE9000
heap
page read and write
5001000
heap
page read and write
4D7F000
stack
page read and write
1D8EC000
stack
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
1DBEB000
heap
page read and write
1DC04000
heap
page read and write
35FE000
stack
page read and write
2FF73000
heap
page read and write
5020000
heap
page read and write
1DACE000
stack
page read and write
1DBF9000
heap
page read and write
1DBF9000
heap
page read and write
6CC50000
unkown
page readonly
1DBFB000
heap
page read and write
180E000
heap
page read and write
6CBB0000
unkown
page readonly
427E000
stack
page read and write
1DC04000
heap
page read and write
1DC11000
heap
page read and write
1818000
heap
page read and write
5001000
heap
page read and write
1DBFA000
heap
page read and write
1DC1B000
heap
page read and write
5001000
heap
page read and write
1750000
direct allocation
page read and write
3FBF000
stack
page read and write
1DC04000
heap
page read and write
1DBFA000
heap
page read and write
1620000
heap
page read and write
5000000
heap
page read and write
4AFF000
stack
page read and write
45FF000
stack
page read and write
5001000
heap
page read and write
14F8000
stack
page read and write
1DBDF000
heap
page read and write
54BC000
stack
page read and write
36FF000
stack
page read and write
1DC11000
heap
page read and write
1DBE9000
heap
page read and write
5001000
heap
page read and write
1DC01000
heap
page read and write
2FEE0000
trusted library allocation
page read and write
1DC04000
heap
page read and write
BA2000
unkown
page execute and read and write
1750000
direct allocation
page read and write
44BF000
stack
page read and write
5001000
heap
page read and write
1DC0B000
heap
page read and write
29D00000
heap
page read and write
1DBFB000
heap
page read and write
1DC04000
heap
page read and write
5001000
heap
page read and write
1DC11000
heap
page read and write
387E000
stack
page read and write
413E000
stack
page read and write
17E8000
heap
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
1DC04000
heap
page read and write
23DA0000
heap
page read and write
29D20000
heap
page read and write
3ABF000
stack
page read and write
1150000
unkown
page execute and read and write
1DBF9000
heap
page read and write
1DC1B000
heap
page read and write
5001000
heap
page read and write
1DC20000
heap
page read and write
55E0000
direct allocation
page execute and read and write
5001000
heap
page read and write
6CC51000
unkown
page execute read
1D53E000
stack
page read and write
35BF000
stack
page read and write
333E000
heap
page read and write
2FF87000
heap
page read and write
5001000
heap
page read and write
1DC20000
heap
page read and write
1D92E000
stack
page read and write
1DC08000
heap
page read and write
5001000
heap
page read and write
55F0000
direct allocation
page execute and read and write
1750000
direct allocation
page read and write
423F000
stack
page read and write
1DBEA000
heap
page read and write
5001000
heap
page read and write
44FE000
stack
page read and write
1DC20000
heap
page read and write
4C7E000
stack
page read and write
39BE000
stack
page read and write
5001000
heap
page read and write
1DA2D000
stack
page read and write
49FE000
stack
page read and write
1D7ED000
stack
page read and write
1DC04000
heap
page read and write
61ECD000
direct allocation
page readonly
1DC00000
heap
page read and write
6CE2F000
unkown
page write copy
1DBCE000
stack
page read and write
176A000
heap
page read and write
2FEDF000
stack
page read and write
1DC00000
heap
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
5480000
direct allocation
page read and write
B52000
unkown
page execute and read and write
5001000
heap
page read and write
174E000
stack
page read and write
BCF000
unkown
page execute and read and write
1DC11000
heap
page read and write
5001000
heap
page read and write
1DC20000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1DC0C000
heap
page read and write
17E8000
heap
page read and write
1750000
direct allocation
page read and write
5001000
heap
page read and write
1750000
direct allocation
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
1DC04000
heap
page read and write
5600000
direct allocation
page execute and read and write
1750000
direct allocation
page read and write
1DCF4000
heap
page read and write
BAF000
unkown
page execute and read and write
EA6000
unkown
page execute and read and write
5001000
heap
page read and write
5600000
direct allocation
page execute and read and write
5001000
heap
page read and write
4B3E000
stack
page read and write
5001000
heap
page read and write
40FF000
stack
page read and write
1760000
heap
page read and write
1DC04000
heap
page read and write
C85000
unkown
page execute and read and write
1825000
heap
page read and write
1DC11000
heap
page read and write
5001000
heap
page read and write
5001000
heap
page read and write
1DBFA000
heap
page read and write
5001000
heap
page read and write
3FFE000
stack
page read and write
1DBEA000
heap
page read and write
5001000
heap
page read and write
1D4FF000
stack
page read and write
1750000
direct allocation
page read and write
AC0000
unkown
page readonly
1DBF6000
heap
page read and write
61EB4000
direct allocation
page read and write
6CC42000
unkown
page readonly
BDE000
unkown
page execute and read and write
There are 367 hidden memdumps, click here to show them.