IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BAAFBFBAAKECFIEBFIECFCGCAF
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DAAFIIJDAAAAKFHIDAAAKJJEGD
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\DHDHJJJECFIECBGDGCAAAEHIEG
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EHDHDHIECGCAEBFIIDHI
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GHJKJDAK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HIIEGHJJ
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IIDAAFBGDBKJJJKFIIIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KFIDAFBFBKFHJJKEHIEG
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/e2b1563c6670f193.php9b
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php5f
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll2)?
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllP)
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllL
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpT2
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php)f
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllZ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37Ll
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllh
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpyfL
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll$)1
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpafT
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpDAFBFBKFHJJKEHIEG
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpS
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpus.wallet
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php2
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dlln
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFirefox
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllKe
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll6(#
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll3
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 55 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
7F1000
unkown
page execute and read and write
 malicious
50D0000
direct allocation
page read and write
 malicious
133E000
heap
page read and write
 malicious
1D744000
heap
page read and write
3D8E000
stack
page read and write
4C51000
heap
page read and write
FE4000
heap
page read and write
7F0000
unkown
page read and write
878000
unkown
page execute and read and write
4C51000
heap
page read and write
FE4000
heap
page read and write
FE4000
heap
page read and write
4C51000
heap
page read and write
1D73E000
heap
page read and write
1D729000
heap
page read and write
4C51000
heap
page read and write
4C51000
heap
page read and write
1D744000
heap
page read and write
4C70000
heap
page read and write
FE4000
heap
page read and write
FE4000
heap
page read and write
6C86E000
unkown
page read and write
E8E000
unkown
page execute and read and write
4C51000
heap
page read and write
4C51000
heap
page read and write
4C50000
heap
page read and write
2FA0000
direct allocation
page read and write
F9D000
stack
page read and write
320F000
stack
page read and write
1D72A000
heap
page read and write
1D5AD000
stack
page read and write
4C51000
heap
page read and write
1D09E000
stack
page read and write
4C51000
heap
page read and write
1396000
heap
page read and write
29860000
heap
page read and write
4C57000
heap
page read and write
29A10000
heap
page read and write
1D758000
heap
page read and write
FE4000
heap
page read and write
1D739000
heap
page read and write
4C51000
heap
page read and write
FE4000
heap
page read and write
1D739000
heap
page read and write
CEE000
unkown
page execute and write copy
4C51000
heap
page read and write
237DE000
stack
page read and write
1D73F000
heap
page read and write
1D72A000
heap
page read and write
995000
unkown
page execute and read and write
1D744000
heap
page read and write
1D75D000
heap
page read and write
1D739000
heap
page read and write
4C51000
heap
page read and write
FE0000
heap
page read and write
875000
unkown
page execute and read and write
4C51000
heap
page read and write
4C51000
heap
page read and write
FC0000
heap
page read and write
1D738000
heap
page read and write
4C51000
heap
page read and write
FE4000
heap
page read and write
FE4000
heap
page read and write
8DF000
unkown
page execute and read and write
44CF000
stack
page read and write
1D752000
heap
page read and write
1D73F000
heap
page read and write
460F000
stack
page read and write
6C690000
unkown
page readonly
5270000
direct allocation
page execute and read and write
1D75D000
heap
page read and write
1383000
heap
page read and write
1D744000
heap
page read and write
1D744000
heap
page read and write
1D41F000
stack
page read and write
1D75B000
heap
page read and write
1D31E000
stack
page read and write
2FA0000
direct allocation
page read and write
29A18000
heap
page read and write
2FC0000
heap
page read and write
90E000
unkown
page execute and read and write
5220000
direct allocation
page execute and read and write
1D732000
heap
page read and write
4C51000
heap
page read and write
4C51000
heap
page read and write
2FC7000
heap
page read and write
4C60000
heap
page read and write
488F000
stack
page read and write
4C51000
heap
page read and write
61E01000
direct allocation
page execute read
1D736000
heap
page read and write
1D744000
heap
page read and write
4C51000
heap
page read and write
1D744000
heap
page read and write
1D731000
heap
page read and write
334F000
stack
page read and write
4C51000
heap
page read and write
1D75B000
heap
page read and write
438E000
stack
page read and write
8D2000
unkown
page execute and read and write
1D744000
heap
page read and write
8AD000
unkown
page execute and read and write
FB0000
heap
page read and write
1CF5E000
stack
page read and write
4C51000
heap
page read and write
1D46E000
stack
page read and write
84A000
unkown
page execute and read and write
1D75D000
heap
page read and write
7F0000
unkown
page readonly
1D72C000
heap
page read and write
50D0000
direct allocation
page read and write
4C51000
heap
page read and write
1338000
heap
page read and write
310E000
stack
page read and write
1D744000
heap
page read and write
FE4000
heap
page read and write
61ED4000
direct allocation
page readonly
5250000
direct allocation
page execute and read and write
2F90000
heap
page read and write
1D75A000
heap
page read and write
1D2DF000
stack
page read and write
1D72A000
heap
page read and write
50B0000
heap
page read and write
166F000
stack
page read and write
5240000
direct allocation
page execute and read and write
4C51000
heap
page read and write
4C51000
heap
page read and write
298A1000
heap
page read and write
7F1000
unkown
page execute and write copy
4C51000
heap
page read and write
2E4E000
stack
page read and write
410F000
stack
page read and write
29A17000
heap
page read and write
FE4000
heap
page read and write
156E000
stack
page read and write
2FA0000
direct allocation
page read and write
1D75B000
heap
page read and write
1D72A000
heap
page read and write
1D744000
heap
page read and write
6F8F2000
unkown
page readonly
FE4000
heap
page read and write
1D75B000
heap
page read and write
4C51000
heap
page read and write
FE4000
heap
page read and write
FE4000
heap
page read and write
4C51000
heap
page read and write
428E000
stack
page read and write
3C4E000
stack
page read and write
CEF000
unkown
page execute and write copy
4C51000
heap
page read and write
F93000
stack
page read and write
29A09000
heap
page read and write
4C51000
heap
page read and write
FE4000
heap
page read and write
1D744000
heap
page read and write
FE4000
heap
page read and write
61ECD000
direct allocation
page readonly
5260000
direct allocation
page execute and read and write
2FA0000
direct allocation
page read and write
5250000
direct allocation
page execute and read and write
1D83A000
heap
page read and write
61ECC000
direct allocation
page read and write
2F4F000
stack
page read and write
450E000
stack
page read and write
1D744000
heap
page read and write
4C51000
heap
page read and write
29880000
heap
page read and write
61EB7000
direct allocation
page readonly
4C51000
heap
page read and write
1D736000
heap
page read and write
29A11000
heap
page read and write
39CE000
stack
page read and write
1D752000
heap
page read and write
50D0000
direct allocation
page read and write
43CE000
stack
page read and write
4C51000
heap
page read and write
3ACF000
stack
page read and write
3C0F000
stack
page read and write
2FA0000
direct allocation
page read and write
384F000
stack
page read and write
424F000
stack
page read and write
324E000
stack
page read and write
1D710000
heap
page read and write
1D739000
heap
page read and write
4C51000
heap
page read and write
1D6AC000
stack
page read and write
1D739000
heap
page read and write
1D732000
heap
page read and write
4C51000
heap
page read and write
FE4000
heap
page read and write
1D73F000
heap
page read and write
882000
unkown
page execute and read and write
6C86F000
unkown
page write copy
2FA0000
direct allocation
page read and write
2FA0000
direct allocation
page read and write
1D73B000
heap
page read and write
1D738000
heap
page read and write
FE4000
heap
page read and write
2FA0000
direct allocation
page read and write
29840000
heap
page read and write
4C4F000
stack
page read and write
1D744000
heap
page read and write
1D760000
heap
page read and write
1D73B000
heap
page read and write
4C51000
heap
page read and write
398F000
stack
page read and write
FE4000
heap
page read and write
1D712000
heap
page read and write
FE4000
heap
page read and write
4A0E000
stack
page read and write
2FA0000
direct allocation
page read and write
30CF000
stack
page read and write
1D72A000
heap
page read and write
FE4000
heap
page read and write
4C51000
heap
page read and write
4C51000
heap
page read and write
6F8DD000
unkown
page readonly
FE4000
heap
page read and write
A4E000
unkown
page execute and read and write
4B0F000
stack
page read and write
2990B000
heap
page read and write
1D19F000
stack
page read and write
61E00000
direct allocation
page execute and read and write
414E000
stack
page read and write
1D744000
heap
page read and write
4C51000
heap
page read and write
1D740000
heap
page read and write
4C51000
heap
page read and write
6F861000
unkown
page execute read
2FA0000
direct allocation
page read and write
1D744000
heap
page read and write
2FCB000
heap
page read and write
1D752000
heap
page read and write
29970000
trusted library allocation
page read and write
1D75B000
heap
page read and write
464E000
stack
page read and write
FE4000
heap
page read and write
6F860000
unkown
page readonly
4C51000
heap
page read and write
338E000
stack
page read and write
6C82F000
unkown
page readonly
1D72A000
heap
page read and write
FE4000
heap
page read and write
1D744000
heap
page read and write
3B0E000
stack
page read and write
3E8F000
stack
page read and write
4C51000
heap
page read and write
370F000
stack
page read and write
2FCE000
heap
page read and write
130D000
stack
page read and write
1D744000
heap
page read and write
CB4000
unkown
page execute and read and write
FE4000
heap
page read and write
1D731000
heap
page read and write
FE4000
heap
page read and write
4C51000
heap
page read and write
1D72A000
heap
page read and write
5230000
direct allocation
page execute and read and write
4C51000
heap
page read and write
1D739000
heap
page read and write
5090000
trusted library allocation
page read and write
35CF000
stack
page read and write
4C51000
heap
page read and write
1D75F000
heap
page read and write
1D71F000
heap
page read and write
152E000
stack
page read and write
478E000
stack
page read and write
1D739000
heap
page read and write
6C875000
unkown
page readonly
2FA0000
direct allocation
page read and write
4C51000
heap
page read and write
9B5000
unkown
page execute and read and write
1D744000
heap
page read and write
F99000
stack
page read and write
2F8C000
stack
page read and write
4C51000
heap
page read and write
E8F000
unkown
page execute and write copy
1D75B000
heap
page read and write
61ED3000
direct allocation
page read and write
1D744000
heap
page read and write
13B2000
heap
page read and write
1D744000
heap
page read and write
4C51000
heap
page read and write
FE4000
heap
page read and write
348F000
stack
page read and write
CEE000
unkown
page execute and read and write
48CE000
stack
page read and write
4C51000
heap
page read and write
520F000
stack
page read and write
2FA0000
direct allocation
page read and write
510B000
stack
page read and write
7AC000
stack
page read and write
4C51000
heap
page read and write
90B000
unkown
page execute and read and write
1D830000
trusted library allocation
page read and write
4C51000
heap
page read and write
3FCF000
stack
page read and write
1D736000
heap
page read and write
FE4000
heap
page read and write
1D752000
heap
page read and write
474F000
stack
page read and write
61ED0000
direct allocation
page read and write
FE4000
heap
page read and write
374E000
stack
page read and write
1D744000
heap
page read and write
4C51000
heap
page read and write
4C51000
heap
page read and write
1330000
heap
page read and write
4C51000
heap
page read and write
1D752000
heap
page read and write
3D4F000
stack
page read and write
CD8000
unkown
page execute and read and write
238DD000
stack
page read and write
4B4E000
stack
page read and write
8A1000
unkown
page execute and read and write
49CF000
stack
page read and write
1D75F000
heap
page read and write
CE0000
unkown
page execute and read and write
4C51000
heap
page read and write
1D73E000
heap
page read and write
5280000
direct allocation
page execute and read and write
1D744000
heap
page read and write
388E000
stack
page read and write
34CE000
stack
page read and write
1D56D000
stack
page read and write
FE4000
heap
page read and write
FE4000
heap
page read and write
1D740000
heap
page read and write
FE4000
heap
page read and write
FE4000
heap
page read and write
4C51000
heap
page read and write
1D05F000
stack
page read and write
FE4000
heap
page read and write
61EB4000
direct allocation
page read and write
238E0000
heap
page read and write
4C51000
heap
page read and write
BD8000
unkown
page execute and read and write
1D744000
heap
page read and write
FE4000
heap
page read and write
FE4000
heap
page read and write
4C51000
heap
page read and write
FE4000
heap
page read and write
1D75B000
heap
page read and write
2FA0000
direct allocation
page read and write
2FA0000
direct allocation
page read and write
1D1DE000
stack
page read and write
3ECE000
stack
page read and write
9BB000
unkown
page execute and read and write
4C51000
heap
page read and write
1D73B000
heap
page read and write
6C691000
unkown
page execute read
1D739000
heap
page read and write
4C51000
heap
page read and write
400E000
stack
page read and write
87F000
unkown
page execute and read and write
360E000
stack
page read and write
8FF000
unkown
page execute and read and write
6F8EE000
unkown
page read and write
6C870000
unkown
page read and write
There are 349 hidden memdumps, click here to show them.