IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\DBKFIDAAEHIEGCBFIDBFHCGDAK
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\EBGIDGCAFCBKECAAKJJK
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\GIJJKKJJDAAAAAKFHJJDGDAFBA
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HDAKJDHI
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IDAAKEHJDHJKEBFHJEGD
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJJJDAAE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KJDGDBFBGIDGIEBGHCGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KJKJKFCBKKJDGDHIDBGIECBGHJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllS
unknown
 malicious
http://185.215.113.37/0d60be0de1
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpw
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll#C
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php3Ob
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllo
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllW
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf6
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpntime
unknown
 malicious
http://185.215.113.37y
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php0
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFirefox
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwO
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll_so
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpoO
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll-
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpba
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 47 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
A01000
unkown
page execute and read and write
 malicious
4EC0000
direct allocation
page read and write
 malicious
109E000
heap
page read and write
 malicious
1D508000
heap
page read and write
47DE000
stack
page read and write
1D23D000
stack
page read and write
1D510000
heap
page read and write
1167000
heap
page read and write
1D529000
heap
page read and write
9EE000
stack
page read and write
10E3000
heap
page read and write
1D1EF000
stack
page read and write
504E000
stack
page read and write
1D52C000
heap
page read and write
469E000
stack
page read and write
325F000
stack
page read and write
1D08F000
stack
page read and write
1D502000
heap
page read and write
9AE000
stack
page read and write
1114000
heap
page read and write
1D505000
heap
page read and write
6C845000
unkown
page readonly
4A41000
heap
page read and write
3B5E000
stack
page read and write
1D52C000
heap
page read and write
1D510000
heap
page read and write
1D505000
heap
page read and write
6C840000
unkown
page read and write
4A41000
heap
page read and write
1D510000
heap
page read and write
4A41000
heap
page read and write
301E000
stack
page read and write
1D510000
heap
page read and write
1D510000
heap
page read and write
9F0000
direct allocation
page read and write
6C5C0000
unkown
page readonly
B1B000
unkown
page execute and read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
297E4000
heap
page read and write
1D52C000
heap
page read and write
1D510000
heap
page read and write
1D50C000
heap
page read and write
1D51B000
heap
page read and write
34DF000
stack
page read and write
1CE4E000
stack
page read and write
297F6000
heap
page read and write
4A41000
heap
page read and write
1171000
heap
page read and write
429F000
stack
page read and write
1D505000
heap
page read and write
3C5F000
stack
page read and write
401F000
stack
page read and write
297EE000
heap
page read and write
4A41000
heap
page read and write
297F2000
heap
page read and write
4A41000
heap
page read and write
1D4EB000
heap
page read and write
59C000
stack
page read and write
AE2000
unkown
page execute and read and write
1D516000
heap
page read and write
4A41000
heap
page read and write
42DE000
stack
page read and write
29750000
trusted library allocation
page read and write
9F0000
direct allocation
page read and write
1D51C000
heap
page read and write
1D529000
heap
page read and write
6C652000
unkown
page readonly
4A41000
heap
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
EE0000
unkown
page execute and read and write
1D47D000
stack
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
1D502000
heap
page read and write
DDC000
unkown
page execute and read and write
1176000
heap
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
339F000
stack
page read and write
A5A000
unkown
page execute and read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
1D33D000
stack
page read and write
4A41000
heap
page read and write
A92000
unkown
page execute and read and write
1D510000
heap
page read and write
1D50C000
heap
page read and write
6C7FF000
unkown
page readonly
1D4F6000
heap
page read and write
BA5000
unkown
page execute and read and write
1D505000
heap
page read and write
1D50C000
heap
page read and write
1D507000
heap
page read and write
1D522000
heap
page read and write
1D505000
heap
page read and write
4A50000
heap
page read and write
4A41000
heap
page read and write
2DDB000
heap
page read and write
1D505000
heap
page read and write
AEF000
unkown
page execute and read and write
1D52A000
heap
page read and write
1D4E2000
heap
page read and write
3EDF000
stack
page read and write
9F0000
direct allocation
page read and write
4A41000
heap
page read and write
2955D000
heap
page read and write
1CF4F000
stack
page read and write
8FD000
stack
page read and write
A88000
unkown
page execute and read and write
4A41000
heap
page read and write
9F0000
direct allocation
page read and write
2FDF000
stack
page read and write
4A1F000
stack
page read and write
B1E000
unkown
page execute and read and write
1D51D000
heap
page read and write
1CE0F000
stack
page read and write
4EC0000
direct allocation
page read and write
361F000
stack
page read and write
A01000
unkown
page execute and write copy
9F0000
direct allocation
page read and write
61ECD000
direct allocation
page readonly
33DE000
stack
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
1098000
heap
page read and write
B0F000
unkown
page execute and read and write
61ED4000
direct allocation
page readonly
4A41000
heap
page read and write
5F0000
heap
page read and write
1D507000
heap
page read and write
4A41000
heap
page read and write
4A20000
heap
page read and write
1D0EE000
stack
page read and write
1D4F6000
heap
page read and write
1D51C000
heap
page read and write
EB3000
unkown
page execute and read and write
9F0000
direct allocation
page read and write
3A1E000
stack
page read and write
AB1000
unkown
page execute and read and write
9F0000
direct allocation
page read and write
4A41000
heap
page read and write
6C661000
unkown
page execute read
297EC000
heap
page read and write
1D50D000
heap
page read and write
1D510000
heap
page read and write
A00000
unkown
page read and write
1D529000
heap
page read and write
1D510000
heap
page read and write
10F8000
heap
page read and write
1D504000
heap
page read and write
4A41000
heap
page read and write
9F0000
direct allocation
page read and write
375F000
stack
page read and write
1D507000
heap
page read and write
1D507000
heap
page read and write
900000
heap
page read and write
EEE000
unkown
page execute and write copy
315E000
stack
page read and write
61ED0000
direct allocation
page read and write
2DDE000
heap
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
2D7C000
stack
page read and write
2974F000
stack
page read and write
48DF000
stack
page read and write
29550000
heap
page read and write
4A41000
heap
page read and write
1D510000
heap
page read and write
4A41000
heap
page read and write
1D52C000
heap
page read and write
1084000
unkown
page execute and read and write
2964E000
stack
page read and write
441E000
stack
page read and write
4A41000
heap
page read and write
4A60000
heap
page read and write
5040000
direct allocation
page execute and read and write
38DE000
stack
page read and write
1D529000
heap
page read and write
29500000
heap
page read and write
3F1E000
stack
page read and write
1D510000
heap
page read and write
9F0000
direct allocation
page read and write
455E000
stack
page read and write
BC5000
unkown
page execute and read and write
6C5C1000
unkown
page execute read
351E000
stack
page read and write
405D000
stack
page read and write
9F0000
direct allocation
page read and write
1D529000
heap
page read and write
419E000
stack
page read and write
1D51C000
heap
page read and write
1D510000
heap
page read and write
4EFB000
stack
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
29549000
heap
page read and write
6C83F000
unkown
page write copy
4A41000
heap
page read and write
4A41000
heap
page read and write
1D600000
trusted library allocation
page read and write
A00000
unkown
page readonly
965000
heap
page read and write
EEF000
unkown
page execute and write copy
1D60B000
heap
page read and write
61E01000
direct allocation
page execute read
1D51B000
heap
page read and write
1D525000
heap
page read and write
6C83E000
unkown
page read and write
145F000
stack
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
1D51D000
heap
page read and write
4A41000
heap
page read and write
29556000
heap
page read and write
950000
heap
page read and write
294E0000
heap
page read and write
3D9F000
stack
page read and write
3DDE000
stack
page read and write
1D50C000
heap
page read and write
451F000
stack
page read and write
1D51E000
heap
page read and write
ABD000
unkown
page execute and read and write
4A41000
heap
page read and write
3C9E000
stack
page read and write
61E00000
direct allocation
page execute and read and write
C5E000
unkown
page execute and read and write
9F0000
direct allocation
page read and write
3B1F000
stack
page read and write
4A41000
heap
page read and write
1D510000
heap
page read and write
1D525000
heap
page read and write
4A41000
heap
page read and write
23572000
heap
page read and write
1D513000
heap
page read and write
135E000
stack
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
1D529000
heap
page read and write
4A41000
heap
page read and write
6C64E000
unkown
page read and write
39DF000
stack
page read and write
1D505000
heap
page read and write
4A41000
heap
page read and write
5040000
direct allocation
page execute and read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
1D510000
heap
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
5030000
direct allocation
page execute and read and write
1D51D000
heap
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
1155000
heap
page read and write
4A40000
heap
page read and write
43DF000
stack
page read and write
5050000
direct allocation
page execute and read and write
2DD7000
heap
page read and write
1D529000
heap
page read and write
1D4F5000
heap
page read and write
4EC0000
direct allocation
page read and write
1D50D000
heap
page read and write
1D4F8000
heap
page read and write
29542000
heap
page read and write
1D50B000
heap
page read and write
4B40000
trusted library allocation
page read and write
465F000
stack
page read and write
479F000
stack
page read and write
A8F000
unkown
page execute and read and write
115A000
heap
page read and write
5010000
direct allocation
page execute and read and write
1D51B000
heap
page read and write
9F0000
direct allocation
page read and write
1D4E0000
heap
page read and write
BCB000
unkown
page execute and read and write
61ED3000
direct allocation
page read and write
1D510000
heap
page read and write
4FFF000
stack
page read and write
9F0000
direct allocation
page read and write
4A41000
heap
page read and write
A85000
unkown
page execute and read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
1D4F6000
heap
page read and write
1D513000
heap
page read and write
1085000
unkown
page execute and write copy
1D502000
heap
page read and write
415F000
stack
page read and write
115F000
heap
page read and write
1D513000
heap
page read and write
1D50D000
heap
page read and write
61EB4000
direct allocation
page read and write
1D510000
heap
page read and write
960000
heap
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
2EDF000
stack
page read and write
4A41000
heap
page read and write
4A41000
heap
page read and write
379E000
stack
page read and write
1D4F6000
heap
page read and write
5070000
direct allocation
page execute and read and write
2DD0000
heap
page read and write
1D505000
heap
page read and write
1D529000
heap
page read and write
1D37D000
stack
page read and write
4A41000
heap
page read and write
2D3F000
stack
page read and write
1CF8E000
stack
page read and write
4A41000
heap
page read and write
116C000
heap
page read and write
29544000
heap
page read and write
1D517000
heap
page read and write
5060000
direct allocation
page execute and read and write
1D50D000
heap
page read and write
6C63D000
unkown
page readonly
4A41000
heap
page read and write
1D529000
heap
page read and write
491E000
stack
page read and write
1D507000
heap
page read and write
5020000
direct allocation
page execute and read and write
1D510000
heap
page read and write
1D51C000
heap
page read and write
311F000
stack
page read and write
1090000
heap
page read and write
4A41000
heap
page read and write
1D52C000
heap
page read and write
1D510000
heap
page read and write
329E000
stack
page read and write
365E000
stack
page read and write
2DBE000
stack
page read and write
8F3000
stack
page read and write
9F0000
direct allocation
page read and write
61ECC000
direct allocation
page read and write
1D4F6000
heap
page read and write
4A41000
heap
page read and write
2C3E000
stack
page read and write
8F9000
stack
page read and write
6C660000
unkown
page readonly
4A41000
heap
page read and write
4A41000
heap
page read and write
389F000
stack
page read and write
ED8000
unkown
page execute and read and write
EEE000
unkown
page execute and read and write
61EB7000
direct allocation
page readonly
4A41000
heap
page read and write
There are 340 hidden memdumps, click here to show them.