IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AEGHJKJKKJDHIDHJKJDB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\CBFBGCGIJKJJKFIDBFCG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DGCFHIDAKECFHIEBFCGI
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\ECAKECAE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EGHJKJKK
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EGHJKJKKJDHIDHJKJDBGCGCBAE
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JKEGIDGDGHCAAAAKKFCGDAFIIJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\KEHDHIDAEHCFHJJJJECAAFBKJJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpRY
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllA
unknown
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dllL
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllO
unknown
 malicious
http://185.215.113.37C
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll=
unknown
 malicious
http://185.215.113.37/l
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpR
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllS
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php_url
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpe_las
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpASCA
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll=
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllH
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpNTEGEG
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllEQ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllWQ-
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll3Q
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll/Qe
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFirefox
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpmainnet
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 54 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
B81000
unkown
page execute and read and write
 malicious
5000000
direct allocation
page read and write
 malicious
131E000
heap
page read and write
 malicious
13CE000
heap
page read and write
375F000
stack
page read and write
4B71000
heap
page read and write
1D636000
heap
page read and write
1CF8E000
stack
page read and write
1D622000
heap
page read and write
4B71000
heap
page read and write
296EB000
heap
page read and write
1D645000
heap
page read and write
1D666000
heap
page read and write
1D64C000
heap
page read and write
38DE000
stack
page read and write
B7D000
stack
page read and write
29660000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
3B5E000
stack
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
429F000
stack
page read and write
4B60000
direct allocation
page read and write
3C9E000
stack
page read and write
C62000
unkown
page execute and read and write
1D0CE000
stack
page read and write
13D3000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
1D740000
trusted library allocation
page read and write
6C850000
unkown
page read and write
1D664000
heap
page read and write
299D0000
trusted library allocation
page read and write
4B71000
heap
page read and write
6CC000
stack
page read and write
29620000
heap
page read and write
4A1F000
stack
page read and write
3B1F000
stack
page read and write
6C855000
unkown
page readonly
1D650000
heap
page read and write
1D647000
heap
page read and write
1D645000
heap
page read and write
1D645000
heap
page read and write
4B5F000
stack
page read and write
4B71000
heap
page read and write
C9B000
unkown
page execute and read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
C3D000
unkown
page execute and read and write
415F000
stack
page read and write
61E00000
direct allocation
page execute and read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
4B90000
heap
page read and write
469E000
stack
page read and write
29681000
heap
page read and write
2F9F000
stack
page read and write
1D668000
heap
page read and write
1D65C000
heap
page read and write
7CD000
stack
page read and write
6F8FE000
unkown
page read and write
1D37D000
stack
page read and write
C31000
unkown
page execute and read and write
1D650000
heap
page read and write
D25000
unkown
page execute and read and write
1D650000
heap
page read and write
1D746000
heap
page read and write
4C70000
trusted library allocation
page read and write
4B71000
heap
page read and write
1D64D000
heap
page read and write
236BE000
heap
page read and write
12FC000
stack
page read and write
1D650000
heap
page read and write
298CE000
stack
page read and write
4B71000
heap
page read and write
D45000
unkown
page execute and read and write
12BE000
stack
page read and write
1D666000
heap
page read and write
C12000
unkown
page execute and read and write
455E000
stack
page read and write
1D645000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
1D64C000
heap
page read and write
4B71000
heap
page read and write
1D668000
heap
page read and write
4B71000
heap
page read and write
B80000
unkown
page readonly
C8F000
unkown
page execute and read and write
47DE000
stack
page read and write
4B71000
heap
page read and write
6C80F000
unkown
page readonly
4B71000
heap
page read and write
4B71000
heap
page read and write
1D665000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
C0F000
unkown
page execute and read and write
A10000
heap
page read and write
29A6C000
heap
page read and write
365E000
stack
page read and write
4B60000
direct allocation
page read and write
1D66C000
heap
page read and write
379E000
stack
page read and write
13E6000
heap
page read and write
5180000
direct allocation
page execute and read and write
4B71000
heap
page read and write
1D653000
heap
page read and write
1D646000
heap
page read and write
1D642000
heap
page read and write
2E9E000
heap
page read and write
1D5BD000
stack
page read and write
4B71000
heap
page read and write
1D650000
heap
page read and write
7C9000
stack
page read and write
B81000
unkown
page execute and write copy
4B71000
heap
page read and write
6F8ED000
unkown
page readonly
1D64E000
heap
page read and write
B10000
heap
page read and write
1D650000
heap
page read and write
43DF000
stack
page read and write
1364000
heap
page read and write
42DE000
stack
page read and write
1067000
unkown
page execute and read and write
1D650000
heap
page read and write
2E2E000
stack
page read and write
4B71000
heap
page read and write
2987E000
stack
page read and write
4B71000
heap
page read and write
1D636000
heap
page read and write
296E3000
heap
page read and write
61EB7000
direct allocation
page readonly
4B71000
heap
page read and write
5000000
direct allocation
page read and write
4B71000
heap
page read and write
13D9000
heap
page read and write
C05000
unkown
page execute and read and write
29A7D000
heap
page read and write
4B71000
heap
page read and write
33DE000
stack
page read and write
1075000
unkown
page execute and read and write
4B60000
direct allocation
page read and write
1D636000
heap
page read and write
1D668000
heap
page read and write
4B71000
heap
page read and write
1D650000
heap
page read and write
3D9F000
stack
page read and write
2E97000
heap
page read and write
1D665000
heap
page read and write
4B71000
heap
page read and write
2E90000
heap
page read and write
4B71000
heap
page read and write
503C000
stack
page read and write
299CF000
stack
page read and write
419E000
stack
page read and write
1D664000
heap
page read and write
1D644000
heap
page read and write
7C3000
stack
page read and write
329F000
stack
page read and write
1212000
unkown
page execute and write copy
61E01000
direct allocation
page execute read
4B71000
heap
page read and write
1D664000
heap
page read and write
105F000
unkown
page execute and read and write
1D669000
heap
page read and write
1D620000
heap
page read and write
1D647000
heap
page read and write
1D650000
heap
page read and write
4B70000
heap
page read and write
1D645000
heap
page read and write
29A7A000
heap
page read and write
51A0000
direct allocation
page execute and read and write
1D638000
heap
page read and write
1D662000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
1D657000
heap
page read and write
4B71000
heap
page read and write
2E9B000
heap
page read and write
1D47D000
stack
page read and write
4B60000
direct allocation
page read and write
51B0000
direct allocation
page execute and read and write
1378000
heap
page read and write
1D66C000
heap
page read and write
48DF000
stack
page read and write
4B71000
heap
page read and write
1D642000
heap
page read and write
361F000
stack
page read and write
513F000
stack
page read and write
A30000
heap
page read and write
1D650000
heap
page read and write
1D664000
heap
page read and write
3F1E000
stack
page read and write
4B71000
heap
page read and write
1D666000
heap
page read and write
6C84F000
unkown
page write copy
1D65C000
heap
page read and write
1300000
heap
page read and write
6C84E000
unkown
page read and write
1D635000
heap
page read and write
3EDF000
stack
page read and write
1D669000
heap
page read and write
1D1CE000
stack
page read and write
4B71000
heap
page read and write
1318000
heap
page read and write
5170000
direct allocation
page execute and read and write
1D645000
heap
page read and write
1D668000
heap
page read and write
1D62B000
heap
page read and write
1D64C000
heap
page read and write
34DF000
stack
page read and write
319F000
stack
page read and write
4B71000
heap
page read and write
6F902000
unkown
page readonly
2E70000
heap
page read and write
C6F000
unkown
page execute and read and write
1D65C000
heap
page read and write
1D650000
heap
page read and write
1D66C000
heap
page read and write
401F000
stack
page read and write
339F000
stack
page read and write
D4B000
unkown
page execute and read and write
29640000
heap
page read and write
4B60000
direct allocation
page read and write
1D65D000
heap
page read and write
4B71000
heap
page read and write
1CF4F000
stack
page read and write
3A1E000
stack
page read and write
5160000
direct allocation
page execute and read and write
405E000
stack
page read and write
3DDE000
stack
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
465F000
stack
page read and write
2977E000
stack
page read and write
6C670000
unkown
page readonly
1D650000
heap
page read and write
4B71000
heap
page read and write
61ED3000
direct allocation
page read and write
150E000
stack
page read and write
103A000
unkown
page execute and read and write
309F000
stack
page read and write
13E0000
heap
page read and write
4B71000
heap
page read and write
1310000
heap
page read and write
5190000
direct allocation
page execute and read and write
1D64B000
heap
page read and write
61EB4000
direct allocation
page read and write
C9E000
unkown
page execute and read and write
4B60000
direct allocation
page read and write
1D650000
heap
page read and write
1D65C000
heap
page read and write
61ED0000
direct allocation
page read and write
1076000
unkown
page execute and write copy
1D65E000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
4A5E000
stack
page read and write
2DEE000
stack
page read and write
4B71000
heap
page read and write
1D653000
heap
page read and write
1D666000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
4B71000
heap
page read and write
1D642000
heap
page read and write
389F000
stack
page read and write
4B71000
heap
page read and write
61ECD000
direct allocation
page readonly
518E000
stack
page read and write
1D669000
heap
page read and write
2DAE000
stack
page read and write
1D666000
heap
page read and write
C08000
unkown
page execute and read and write
1D650000
heap
page read and write
4B71000
heap
page read and write
4B60000
direct allocation
page read and write
1D636000
heap
page read and write
1D648000
heap
page read and write
126E000
stack
page read and write
6F870000
unkown
page readonly
1D636000
heap
page read and write
1D4BD000
stack
page read and write
4B71000
heap
page read and write
1D65D000
heap
page read and write
1075000
unkown
page execute and write copy
1D64D000
heap
page read and write
1D656000
heap
page read and write
1D645000
heap
page read and write
1D645000
heap
page read and write
5180000
direct allocation
page execute and read and write
4B71000
heap
page read and write
491E000
stack
page read and write
1D65D000
heap
page read and write
2E6E000
stack
page read and write
A15000
heap
page read and write
4B85000
heap
page read and write
1D64B000
heap
page read and write
479F000
stack
page read and write
4B71000
heap
page read and write
1395000
heap
page read and write
F5E000
unkown
page execute and read and write
4B71000
heap
page read and write
4B60000
direct allocation
page read and write
4B60000
direct allocation
page read and write
DDE000
unkown
page execute and read and write
451F000
stack
page read and write
5150000
direct allocation
page execute and read and write
4B60000
direct allocation
page read and write
1D22E000
stack
page read and write
351E000
stack
page read and write
1D64C000
heap
page read and write
1D66C000
heap
page read and write
4B71000
heap
page read and write
61ECC000
direct allocation
page read and write
6C671000
unkown
page execute read
BDA000
unkown
page execute and read and write
1D66C000
heap
page read and write
61ED4000
direct allocation
page readonly
1D32F000
stack
page read and write
29A75000
heap
page read and write
4B71000
heap
page read and write
1D669000
heap
page read and write
3C5F000
stack
page read and write
B80000
unkown
page read and write
1D669000
heap
page read and write
39DF000
stack
page read and write
6F871000
unkown
page execute read
1D650000
heap
page read and write
1D668000
heap
page read and write
4B60000
direct allocation
page read and write
4B71000
heap
page read and write
441E000
stack
page read and write
4B60000
direct allocation
page read and write
1211000
unkown
page execute and read and write
29A74000
heap
page read and write
5000000
direct allocation
page read and write
4B71000
heap
page read and write
1D08F000
stack
page read and write
4B60000
direct allocation
page read and write
4B60000
direct allocation
page read and write
4B71000
heap
page read and write
1D64D000
heap
page read and write
There are 339 hidden memdumps, click here to show them.