IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BAECFCAAECBGDGDHIEHJ
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\CGCAKKKEGCAKJKFIIEGIIDGIII
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DAECFIJD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\EBGDHJECFCFCAKFHCFID
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FIIIIDGHJEBFBGDHDGIIIIJDHJ
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IJJDBAEH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JJDBAEHIJKJKEBFIEGHI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KEGCFCAKFHCGCBFHCGHDBGIJJD
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\KJKKJKEHDBGIDGDHCFHIJKJJJJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpata
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php28
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll7
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllC
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll=
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpc_
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phprowser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll8
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllU
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpKR
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phperbird
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll$
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpr9
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dlly
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllQ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phptop
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37s
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpA
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllW
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllu
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllk
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllV
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlla
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpB9rf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php$
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlle
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php69
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
There are 53 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
18.31.95.13.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4E10000
direct allocation
page read and write
 malicious
461000
unkown
page execute and read and write
 malicious
11CE000
heap
page read and write
 malicious
1D480000
heap
page read and write
605000
unkown
page execute and read and write
4981000
heap
page read and write
1D465000
heap
page read and write
4970000
direct allocation
page read and write
4981000
heap
page read and write
1CDDE000
stack
page read and write
4981000
heap
page read and write
1D475000
heap
page read and write
FF4000
heap
page read and write
46EF000
stack
page read and write
61E00000
direct allocation
page execute and read and write
1227000
heap
page read and write
FF4000
heap
page read and write
4981000
heap
page read and write
1D480000
heap
page read and write
1D480000
heap
page read and write
4E4C000
stack
page read and write
12B5000
heap
page read and write
1CF1E000
stack
page read and write
6FD6E000
unkown
page read and write
1D479000
heap
page read and write
1289000
heap
page read and write
1D48B000
heap
page read and write
4981000
heap
page read and write
4F60000
direct allocation
page execute and read and write
1D48B000
heap
page read and write
1D47C000
heap
page read and write
1D47F000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
B9C000
stack
page read and write
4981000
heap
page read and write
294BF000
heap
page read and write
952000
unkown
page execute and read and write
FF4000
heap
page read and write
1D487000
heap
page read and write
422E000
stack
page read and write
1D472000
heap
page read and write
6CD35000
unkown
page readonly
4981000
heap
page read and write
6CD30000
unkown
page read and write
FF4000
heap
page read and write
460000
unkown
page readonly
1D01F000
stack
page read and write
4970000
direct allocation
page read and write
857000
unkown
page execute and read and write
2CEB000
stack
page read and write
29470000
heap
page read and write
FF4000
heap
page read and write
3D2E000
stack
page read and write
2F8D9000
heap
page read and write
4981000
heap
page read and write
1D1AD000
stack
page read and write
FF4000
heap
page read and write
968000
unkown
page execute and write copy
36AF000
stack
page read and write
486E000
stack
page read and write
EFD000
stack
page read and write
1D48A000
heap
page read and write
4981000
heap
page read and write
1D478000
heap
page read and write
1D474000
heap
page read and write
FF4000
heap
page read and write
4981000
heap
page read and write
FF4000
heap
page read and write
1299000
heap
page read and write
56F000
unkown
page execute and read and write
FF4000
heap
page read and write
1D472000
heap
page read and write
1D3EC000
stack
page read and write
4981000
heap
page read and write
2CAE000
heap
page read and write
4981000
heap
page read and write
1D06E000
stack
page read and write
61ED0000
direct allocation
page read and write
B0A000
unkown
page execute and read and write
356F000
stack
page read and write
4981000
heap
page read and write
6FCE1000
unkown
page execute read
4981000
heap
page read and write
1D474000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
6BE000
unkown
page execute and read and write
114E000
stack
page read and write
61ED4000
direct allocation
page readonly
FF4000
heap
page read and write
4981000
heap
page read and write
306F000
stack
page read and write
1D49D000
heap
page read and write
2B9E000
stack
page read and write
1D478000
heap
page read and write
1D57D000
heap
page read and write
4981000
heap
page read and write
1D49D000
heap
page read and write
1D16F000
stack
page read and write
1D466000
heap
page read and write
1D46D000
heap
page read and write
6FD72000
unkown
page readonly
432F000
stack
page read and write
294D4000
heap
page read and write
511000
unkown
page execute and read and write
11CA000
heap
page read and write
1212000
heap
page read and write
FF4000
heap
page read and write
4F70000
direct allocation
page execute and read and write
1D480000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
35AE000
stack
page read and write
1D474000
heap
page read and write
1D48A000
heap
page read and write
4F90000
direct allocation
page execute and read and write
1D452000
heap
page read and write
FF4000
heap
page read and write
4DF0000
heap
page read and write
1D488000
heap
page read and write
2F62F000
stack
page read and write
2F6E000
stack
page read and write
1D480000
heap
page read and write
332E000
stack
page read and write
2DEF000
stack
page read and write
2F8D1000
heap
page read and write
1D47A000
heap
page read and write
4981000
heap
page read and write
36EE000
stack
page read and write
446F000
stack
page read and write
1D465000
heap
page read and write
461000
unkown
page execute and write copy
4980000
heap
page read and write
FF4000
heap
page read and write
2C9F000
stack
page read and write
1D466000
heap
page read and write
4970000
direct allocation
page read and write
472E000
stack
page read and write
4981000
heap
page read and write
EF2000
stack
page read and write
1D47A000
heap
page read and write
118E000
stack
page read and write
1D47A000
heap
page read and write
1D46A000
heap
page read and write
4BA000
unkown
page execute and read and write
1D474000
heap
page read and write
3AAE000
stack
page read and write
FF4000
heap
page read and write
4981000
heap
page read and write
1D472000
heap
page read and write
FF4000
heap
page read and write
3BAF000
stack
page read and write
4981000
heap
page read and write
4E8000
unkown
page execute and read and write
4F2000
unkown
page execute and read and write
FF4000
heap
page read and write
1D47A000
heap
page read and write
294C8000
heap
page read and write
234E1000
heap
page read and write
2E2E000
stack
page read and write
FD0000
heap
page read and write
294D9000
heap
page read and write
542000
unkown
page execute and read and write
4990000
heap
page read and write
6CB51000
unkown
page execute read
4981000
heap
page read and write
625000
unkown
page execute and read and write
1D47B000
heap
page read and write
2F630000
heap
page read and write
11B0000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
4DC0000
trusted library allocation
page read and write
1D475000
heap
page read and write
6CD2F000
unkown
page write copy
FF4000
heap
page read and write
1D49D000
heap
page read and write
4F90000
direct allocation
page execute and read and write
1D47A000
heap
page read and write
1D47A000
heap
page read and write
4981000
heap
page read and write
FF4000
heap
page read and write
FF4000
heap
page read and write
4970000
direct allocation
page read and write
2CAB000
heap
page read and write
2CA7000
heap
page read and write
11C0000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
4FC0000
direct allocation
page execute and read and write
4981000
heap
page read and write
1D47C000
heap
page read and write
1D466000
heap
page read and write
12A6000
heap
page read and write
6FD5D000
unkown
page readonly
382E000
stack
page read and write
396E000
stack
page read and write
1D484000
heap
page read and write
2CA0000
heap
page read and write
FF4000
heap
page read and write
FF4000
heap
page read and write
4981000
heap
page read and write
4970000
direct allocation
page read and write
4981000
heap
page read and write
4970000
direct allocation
page read and write
61ECC000
direct allocation
page read and write
1D46C000
heap
page read and write
13BE000
stack
page read and write
1D48D000
heap
page read and write
37EF000
stack
page read and write
4F4F000
stack
page read and write
1D466000
heap
page read and write
1D466000
heap
page read and write
342F000
stack
page read and write
4981000
heap
page read and write
1D480000
heap
page read and write
1D450000
heap
page read and write
61ECD000
direct allocation
page readonly
EF4000
stack
page read and write
482F000
stack
page read and write
B0B000
unkown
page execute and write copy
FF4000
heap
page read and write
3E2F000
stack
page read and write
1D49D000
heap
page read and write
FF4000
heap
page read and write
61E01000
direct allocation
page execute read
1D480000
heap
page read and write
44AE000
stack
page read and write
61EB7000
direct allocation
page readonly
29450000
heap
page read and write
1D480000
heap
page read and write
1D480000
heap
page read and write
4981000
heap
page read and write
1D480000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
4EF000
unkown
page execute and read and write
4981000
heap
page read and write
128F000
heap
page read and write
1D475000
heap
page read and write
1D49D000
heap
page read and write
4981000
heap
page read and write
1D49D000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
4FB0000
direct allocation
page execute and read and write
4F80000
direct allocation
page execute and read and write
294D0000
heap
page read and write
1D486000
heap
page read and write
4981000
heap
page read and write
FF4000
heap
page read and write
4970000
direct allocation
page read and write
1D49D000
heap
page read and write
1D483000
heap
page read and write
1D466000
heap
page read and write
49A0000
heap
page read and write
1D49C000
heap
page read and write
1D477000
heap
page read and write
1CC9E000
stack
page read and write
1D480000
heap
page read and write
346E000
stack
page read and write
FF4000
heap
page read and write
1D46D000
heap
page read and write
32EF000
stack
page read and write
1D483000
heap
page read and write
2951C000
heap
page read and write
4981000
heap
page read and write
4970000
direct allocation
page read and write
FF4000
heap
page read and write
1D2AD000
stack
page read and write
92B000
unkown
page execute and read and write
4981000
heap
page read and write
12B9000
heap
page read and write
FF4000
heap
page read and write
4970000
direct allocation
page read and write
BF0000
heap
page read and write
12A0000
heap
page read and write
1D47A000
heap
page read and write
968000
unkown
page execute and read and write
30AE000
stack
page read and write
1D479000
heap
page read and write
31AF000
stack
page read and write
1D465000
heap
page read and write
40AF000
stack
page read and write
3F6F000
stack
page read and write
1294000
heap
page read and write
2952C000
heap
page read and write
460000
unkown
page read and write
1D480000
heap
page read and write
40EE000
stack
page read and write
1D47F000
heap
page read and write
1D46D000
heap
page read and write
54F000
unkown
page execute and read and write
1D49D000
heap
page read and write
1D480000
heap
page read and write
4981000
heap
page read and write
4E10000
direct allocation
page read and write
4E5000
unkown
page execute and read and write
4981000
heap
page read and write
FF4000
heap
page read and write
1D478000
heap
page read and write
4981000
heap
page read and write
FF4000
heap
page read and write
6CB50000
unkown
page readonly
45AF000
stack
page read and write
2F8D7000
heap
page read and write
FF4000
heap
page read and write
4970000
direct allocation
page read and write
FF4000
heap
page read and write
1D480000
heap
page read and write
1D474000
heap
page read and write
4981000
heap
page read and write
1CEDF000
stack
page read and write
95A000
unkown
page execute and read and write
FF4000
heap
page read and write
1D480000
heap
page read and write
FF4000
heap
page read and write
1D49D000
heap
page read and write
4981000
heap
page read and write
496F000
stack
page read and write
1D478000
heap
page read and write
3A6F000
stack
page read and write
1D470000
heap
page read and write
4981000
heap
page read and write
2F637000
heap
page read and write
61EB4000
direct allocation
page read and write
4981000
heap
page read and write
61ED3000
direct allocation
page read and write
45EE000
stack
page read and write
1D2ED000
stack
page read and write
6CCEF000
unkown
page readonly
4981000
heap
page read and write
392F000
stack
page read and write
2F8DD000
heap
page read and write
1D49D000
heap
page read and write
4981000
heap
page read and write
2F8CF000
heap
page read and write
1D466000
heap
page read and write
3CEF000
stack
page read and write
3E6E000
stack
page read and write
FF4000
heap
page read and write
51D000
unkown
page execute and read and write
4970000
direct allocation
page read and write
EF8000
stack
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
29490000
heap
page read and write
4970000
direct allocation
page read and write
2F2F000
stack
page read and write
57E000
unkown
page execute and read and write
FF0000
heap
page read and write
294B0000
heap
page read and write
969000
unkown
page execute and write copy
1D45B000
heap
page read and write
4E10000
direct allocation
page read and write
436E000
stack
page read and write
1D47A000
heap
page read and write
31EE000
stack
page read and write
1D48A000
heap
page read and write
FF4000
heap
page read and write
62B000
unkown
page execute and read and write
4981000
heap
page read and write
4981000
heap
page read and write
2F52E000
stack
page read and write
57B000
unkown
page execute and read and write
1D47E000
heap
page read and write
1255000
heap
page read and write
1D570000
trusted library allocation
page read and write
4981000
heap
page read and write
1D47A000
heap
page read and write
4970000
direct allocation
page read and write
3BEE000
stack
page read and write
2F830000
trusted library allocation
page read and write
1D48F000
heap
page read and write
4FA0000
direct allocation
page execute and read and write
4970000
direct allocation
page read and write
FF4000
heap
page read and write
294C2000
heap
page read and write
3FAD000
stack
page read and write
FF4000
heap
page read and write
4981000
heap
page read and write
4981000
heap
page read and write
41EF000
stack
page read and write
1CD9F000
stack
page read and write
104E000
stack
page read and write
6FCE0000
unkown
page readonly
6CD2E000
unkown
page read and write
294BD000
heap
page read and write
There are 379 hidden memdumps, click here to show them.