IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAKJEGCFBGDHJJJJJKJE
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\CAEBGHDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CGIEBAFHJJDBGCAKJJKFBGCFIJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DAKFCGIJKJKFHIDHIIIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GCBGCGHDGIEGCBFIEGCB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GCBKECAKFBGCAKECGIEHDGHCBA
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\IDHCGDAFBKFIDHJJJDHCBFBGHD
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\IIEGHJJD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\KJJECGHJDBFIJJJKEHCBFIJJDG
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpata
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllw
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll%
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpEt
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phprowser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpJt
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll0
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll4
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll7t
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpmQ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phptt
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpV
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpyQK
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpXt
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpD
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllz
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpIQ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php=Q
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdllot
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php9P
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpQPc
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php1Q
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
There are 48 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
F31000
unkown
page execute and read and write
 malicious
788000
heap
page read and write
 malicious
4D20000
direct allocation
page read and write
 malicious
1D4C1000
heap
page read and write
AAE000
stack
page read and write
1D4D2000
heap
page read and write
314F000
stack
page read and write
3D8E000
stack
page read and write
1D4CE000
heap
page read and write
1D4E1000
heap
page read and write
874000
heap
page read and write
61ED3000
direct allocation
page read and write
4891000
heap
page read and write
1D4D4000
heap
page read and write
4891000
heap
page read and write
1D4C6000
heap
page read and write
1D4F1000
heap
page read and write
474F000
stack
page read and write
1D4CC000
heap
page read and write
61E01000
direct allocation
page execute read
4891000
heap
page read and write
874000
heap
page read and write
4891000
heap
page read and write
2D3E000
stack
page read and write
1D4D4000
heap
page read and write
6CAD1000
unkown
page execute read
9AD000
stack
page read and write
4891000
heap
page read and write
874000
heap
page read and write
FBF000
unkown
page execute and read and write
374E000
stack
page read and write
338E000
stack
page read and write
1D0BD000
stack
page read and write
1D4DF000
heap
page read and write
1D4CD000
heap
page read and write
1CBAE000
stack
page read and write
1D4F1000
heap
page read and write
1D4D4000
heap
page read and write
750000
heap
page read and write
F30000
unkown
page readonly
F10000
heap
page read and write
400E000
stack
page read and write
874000
heap
page read and write
29520000
heap
page read and write
F20000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
6CD55000
unkown
page readonly
F20000
direct allocation
page read and write
874000
heap
page read and write
6CB4D000
unkown
page readonly
61ECD000
direct allocation
page readonly
1D49E000
stack
page read and write
4891000
heap
page read and write
3E8F000
stack
page read and write
2CBE000
stack
page read and write
1D4F1000
heap
page read and write
874000
heap
page read and write
4CD0000
trusted library allocation
page read and write
1D4CE000
heap
page read and write
1D4BA000
heap
page read and write
1D4CE000
heap
page read and write
874000
heap
page read and write
294E0000
heap
page read and write
61ECC000
direct allocation
page read and write
4D5B000
stack
page read and write
1CF7E000
stack
page read and write
424F000
stack
page read and write
F20000
direct allocation
page read and write
2CFE000
stack
page read and write
874000
heap
page read and write
783000
heap
page read and write
1432000
unkown
page execute and read and write
1D4D4000
heap
page read and write
294A0000
heap
page read and write
1D4BA000
heap
page read and write
F20000
direct allocation
page read and write
398F000
stack
page read and write
1424000
unkown
page execute and read and write
4891000
heap
page read and write
4D20000
direct allocation
page read and write
1D4D0000
heap
page read and write
E4E000
stack
page read and write
4D00000
heap
page read and write
61ED4000
direct allocation
page readonly
61EB7000
direct allocation
page readonly
324F000
stack
page read and write
2D4E000
heap
page read and write
1D4C1000
heap
page read and write
4891000
heap
page read and write
3D4F000
stack
page read and write
1D4B9000
heap
page read and write
F20000
direct allocation
page read and write
F20000
direct allocation
page read and write
388E000
stack
page read and write
141A000
unkown
page execute and read and write
1D4D4000
heap
page read and write
1D4F1000
heap
page read and write
2951B000
heap
page read and write
29563000
heap
page read and write
1D4C4000
heap
page read and write
428E000
stack
page read and write
4891000
heap
page read and write
1D4CC000
heap
page read and write
1D07F000
stack
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
103F000
unkown
page execute and read and write
FB8000
unkown
page execute and read and write
F20000
direct allocation
page read and write
4EA0000
direct allocation
page execute and read and write
1D4F1000
heap
page read and write
4891000
heap
page read and write
3ECE000
stack
page read and write
2F724000
heap
page read and write
1D4F1000
heap
page read and write
1D4C8000
heap
page read and write
464E000
stack
page read and write
1D4C1000
heap
page read and write
1D4CC000
heap
page read and write
48B0000
heap
page read and write
4891000
heap
page read and write
4EB0000
direct allocation
page execute and read and write
1D4F0000
heap
page read and write
334F000
stack
page read and write
4890000
heap
page read and write
4ED0000
direct allocation
page execute and read and write
76E000
heap
page read and write
760000
heap
page read and write
828000
heap
page read and write
101F000
unkown
page execute and read and write
118E000
unkown
page execute and read and write
1D4D4000
heap
page read and write
1D4F1000
heap
page read and write
450E000
stack
page read and write
76A000
heap
page read and write
2E4F000
stack
page read and write
1D4A0000
heap
page read and write
29502000
heap
page read and write
1D4BA000
heap
page read and write
7B0000
heap
page read and write
104B000
unkown
page execute and read and write
4891000
heap
page read and write
4891000
heap
page read and write
2F4F000
stack
page read and write
1D4D4000
heap
page read and write
860000
heap
page read and write
82D000
heap
page read and write
1D4BA000
heap
page read and write
4891000
heap
page read and write
6CD4E000
unkown
page read and write
1D4D7000
heap
page read and write
1D4CD000
heap
page read and write
1D4E3000
heap
page read and write
6CB71000
unkown
page execute read
1CCAF000
stack
page read and write
1D4D8000
heap
page read and write
29506000
heap
page read and write
34CE000
stack
page read and write
83B000
heap
page read and write
4891000
heap
page read and write
1D4D4000
heap
page read and write
FB5000
unkown
page execute and read and write
2D4B000
heap
page read and write
874000
heap
page read and write
1D4C9000
heap
page read and write
1D4CF000
heap
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
2D47000
heap
page read and write
1D1BC000
stack
page read and write
4898000
heap
page read and write
4891000
heap
page read and write
874000
heap
page read and write
F20000
direct allocation
page read and write
874000
heap
page read and write
874000
heap
page read and write
874000
heap
page read and write
1D4DA000
heap
page read and write
29517000
heap
page read and write
4891000
heap
page read and write
2F712000
heap
page read and write
4891000
heap
page read and write
874000
heap
page read and write
2F680000
trusted library allocation
page read and write
4D20000
direct allocation
page read and write
1D4C8000
heap
page read and write
4891000
heap
page read and write
1D4CE000
heap
page read and write
61EB4000
direct allocation
page read and write
61ED0000
direct allocation
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
1D4CC000
heap
page read and write
874000
heap
page read and write
1CE2E000
stack
page read and write
870000
heap
page read and write
15D0000
unkown
page execute and read and write
1432000
unkown
page execute and write copy
7C8000
heap
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
410F000
stack
page read and write
4891000
heap
page read and write
48A0000
heap
page read and write
4E90000
direct allocation
page execute and read and write
4E80000
direct allocation
page execute and read and write
4891000
heap
page read and write
4891000
heap
page read and write
1D4D0000
heap
page read and write
1D5CE000
heap
page read and write
ECE000
stack
page read and write
823000
heap
page read and write
F0E000
stack
page read and write
4891000
heap
page read and write
3FCE000
stack
page read and write
4891000
heap
page read and write
2950E000
heap
page read and write
1310000
unkown
page execute and read and write
874000
heap
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
1D4A6000
heap
page read and write
35CF000
stack
page read and write
4891000
heap
page read and write
1D4BA000
heap
page read and write
F20000
direct allocation
page read and write
1D4CE000
heap
page read and write
F20000
direct allocation
page read and write
29504000
heap
page read and write
1D4C8000
heap
page read and write
4891000
heap
page read and write
1D4D4000
heap
page read and write
1012000
unkown
page execute and read and write
23537000
heap
page read and write
1D4CB000
heap
page read and write
4891000
heap
page read and write
BEE000
stack
page read and write
10F5000
unkown
page execute and read and write
1D4C9000
heap
page read and write
6CB70000
unkown
page readonly
874000
heap
page read and write
10FB000
unkown
page execute and read and write
1D4D4000
heap
page read and write
3C0F000
stack
page read and write
44CF000
stack
page read and write
1D1FD000
stack
page read and write
29509000
heap
page read and write
3B0E000
stack
page read and write
1D4D4000
heap
page read and write
874000
heap
page read and write
1D4DF000
heap
page read and write
1D4BA000
heap
page read and write
1D4C6000
heap
page read and write
1D4DC000
heap
page read and write
2D40000
heap
page read and write
AEE000
stack
page read and write
4EA0000
direct allocation
page execute and read and write
4891000
heap
page read and write
1D4D4000
heap
page read and write
874000
heap
page read and write
874000
heap
page read and write
851000
heap
page read and write
1D4AF000
heap
page read and write
438F000
stack
page read and write
FE1000
unkown
page execute and read and write
1D4CE000
heap
page read and write
4891000
heap
page read and write
4E70000
direct allocation
page execute and read and write
6CD4F000
unkown
page write copy
370F000
stack
page read and write
6F3000
stack
page read and write
4891000
heap
page read and write
1D39E000
stack
page read and write
4891000
heap
page read and write
874000
heap
page read and write
F20000
direct allocation
page read and write
1433000
unkown
page execute and write copy
10D5000
unkown
page execute and read and write
874000
heap
page read and write
4891000
heap
page read and write
384F000
stack
page read and write
3FC000
stack
page read and write
4891000
heap
page read and write
874000
heap
page read and write
1CDEF000
stack
page read and write
1D4B9000
heap
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
F8A000
unkown
page execute and read and write
478E000
stack
page read and write
874000
heap
page read and write
6CB5E000
unkown
page read and write
1D4C8000
heap
page read and write
6FD000
stack
page read and write
4891000
heap
page read and write
7EE000
heap
page read and write
874000
heap
page read and write
F30000
unkown
page read and write
874000
heap
page read and write
2F67F000
stack
page read and write
F20000
direct allocation
page read and write
4891000
heap
page read and write
874000
heap
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
1D4B9000
heap
page read and write
29560000
heap
page read and write
1D4F1000
heap
page read and write
1D4D3000
heap
page read and write
1D4BA000
heap
page read and write
4891000
heap
page read and write
1D4BA000
heap
page read and write
4891000
heap
page read and write
3ACF000
stack
page read and write
874000
heap
page read and write
348F000
stack
page read and write
2C7F000
stack
page read and write
1D4CE000
heap
page read and write
15D0000
unkown
page execute and write copy
874000
heap
page read and write
414E000
stack
page read and write
2F720000
heap
page read and write
460F000
stack
page read and write
874000
heap
page read and write
83A000
heap
page read and write
6CB62000
unkown
page readonly
1D5C0000
trusted library allocation
page read and write
6CD0F000
unkown
page readonly
874000
heap
page read and write
1D4D4000
heap
page read and write
13F5000
unkown
page execute and read and write
1D4C6000
heap
page read and write
1D4D7000
heap
page read and write
1D4D4000
heap
page read and write
874000
heap
page read and write
7E7000
heap
page read and write
1CF2E000
stack
page read and write
6CD50000
unkown
page read and write
81D000
heap
page read and write
1D4F1000
heap
page read and write
4891000
heap
page read and write
1D4F1000
heap
page read and write
1D4C9000
heap
page read and write
874000
heap
page read and write
1D4C1000
heap
page read and write
3C4E000
stack
page read and write
4891000
heap
page read and write
E8B000
stack
page read and write
F20000
direct allocation
page read and write
39CE000
stack
page read and write
FED000
unkown
page execute and read and write
1D4CE000
heap
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
6CAD0000
unkown
page readonly
FC2000
unkown
page execute and read and write
4891000
heap
page read and write
2F71A000
heap
page read and write
294C0000
heap
page read and write
488F000
stack
page read and write
4EC0000
direct allocation
page execute and read and write
360E000
stack
page read and write
834000
heap
page read and write
1D4DB000
heap
page read and write
1D4E1000
heap
page read and write
4891000
heap
page read and write
1CCEE000
stack
page read and write
29501000
heap
page read and write
874000
heap
page read and write
4891000
heap
page read and write
43CE000
stack
page read and write
4891000
heap
page read and write
4891000
heap
page read and write
F20000
direct allocation
page read and write
304F000
stack
page read and write
4E5F000
stack
page read and write
2F71C000
heap
page read and write
874000
heap
page read and write
1D4D4000
heap
page read and write
6F9000
stack
page read and write
874000
heap
page read and write
1D4CE000
heap
page read and write
1D2FD000
stack
page read and write
1D4C8000
heap
page read and write
874000
heap
page read and write
F31000
unkown
page execute and write copy
2F57E000
stack
page read and write
7B6000
heap
page read and write
There are 380 hidden memdumps, click here to show them.