IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AEHIDAKECFIEBGDHJEBK
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\AFHDAKJKFCFBGCBGDHCBAFCAKE
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\AKFHCAKJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BFCFBFBFBKFIDHJKFCAF
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\FIJECAEH
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GHJDHDAECBGCAKEBAEBAAKKKFH
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\HJJJECFIECBGDGCAAAEH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JDHJKKFBAEGDGDGCBKECBGCGCF
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/e2b1563c6670f193.phpl6
unknown
 malicious
http://185.215.113.37/a
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php36
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpy6
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpowsApps
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phppc
unknown
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php4cF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll&Q
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phplc
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpR
unknown
 malicious
http://185.215.113.37_S
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpPb
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpZ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpLb
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpA6
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phplS6
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpre
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll16X
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlle
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 51 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4B20000
direct allocation
page read and write
 malicious
971000
unkown
page execute and read and write
 malicious
82E000
heap
page read and write
 malicious
299E000
heap
page read and write
329F000
stack
page read and write
3CDE000
stack
page read and write
61E00000
direct allocation
page execute and read and write
1D146000
heap
page read and write
4CA0000
direct allocation
page execute and read and write
391E000
stack
page read and write
1D179000
heap
page read and write
E2B000
unkown
page execute and read and write
960000
direct allocation
page read and write
46A1000
heap
page read and write
1CBDE000
stack
page read and write
1D15C000
heap
page read and write
1D167000
heap
page read and write
1CF8D000
stack
page read and write
1D175000
heap
page read and write
41DE000
stack
page read and write
6C652000
unkown
page readonly
B15000
unkown
page execute and read and write
A5F000
unkown
page execute and read and write
291F2000
heap
page read and write
1D16C000
heap
page read and write
29439000
heap
page read and write
46A1000
heap
page read and write
3F5E000
stack
page read and write
1CD3E000
stack
page read and write
1D160000
heap
page read and write
37DE000
stack
page read and write
46A1000
heap
page read and write
3A1F000
stack
page read and write
E6A000
unkown
page execute and write copy
4F3000
stack
page read and write
441F000
stack
page read and write
46A1000
heap
page read and write
1D148000
heap
page read and write
46A1000
heap
page read and write
970000
unkown
page readonly
B35000
unkown
page execute and read and write
960000
direct allocation
page read and write
2D9F000
stack
page read and write
1D155000
heap
page read and write
2F1E000
stack
page read and write
1D179000
heap
page read and write
6C63D000
unkown
page readonly
1D157000
heap
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
341E000
stack
page read and write
6C5C0000
unkown
page readonly
46A1000
heap
page read and write
E51000
unkown
page execute and read and write
1D252000
heap
page read and write
61E01000
direct allocation
page execute read
610000
heap
page read and write
1D16D000
heap
page read and write
110E000
stack
page read and write
1D160000
heap
page read and write
1D155000
heap
page read and write
2943F000
heap
page read and write
445E000
stack
page read and write
6AE000
stack
page read and write
887000
heap
page read and write
960000
direct allocation
page read and write
379F000
stack
page read and write
6C845000
unkown
page readonly
665000
heap
page read and write
960000
direct allocation
page read and write
1D160000
heap
page read and write
46A1000
heap
page read and write
1D157000
heap
page read and write
61ECC000
direct allocation
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
1D17C000
heap
page read and write
960000
direct allocation
page read and write
A7F000
unkown
page execute and read and write
1D160000
heap
page read and write
1D15C000
heap
page read and write
6C83F000
unkown
page write copy
4CB0000
direct allocation
page execute and read and write
9F5000
unkown
page execute and read and write
970000
unkown
page read and write
29130000
heap
page read and write
1D160000
heap
page read and write
1CA9E000
stack
page read and write
960000
direct allocation
page read and write
1D250000
trusted library allocation
page read and write
315F000
stack
page read and write
46A1000
heap
page read and write
4B5B000
stack
page read and write
61ED4000
direct allocation
page readonly
46A1000
heap
page read and write
46A1000
heap
page read and write
2929E000
stack
page read and write
29431000
heap
page read and write
2980000
direct allocation
page read and write
B3B000
unkown
page execute and read and write
1D155000
heap
page read and write
1D166000
heap
page read and write
1D17C000
heap
page read and write
293A0000
trusted library allocation
page read and write
38DF000
stack
page read and write
9F8000
unkown
page execute and read and write
1D16C000
heap
page read and write
1D16C000
heap
page read and write
1D160000
heap
page read and write
3B9E000
stack
page read and write
46A1000
heap
page read and write
E69000
unkown
page execute and read and write
960000
direct allocation
page read and write
6C661000
unkown
page execute read
4C80000
direct allocation
page execute and read and write
1D160000
heap
page read and write
1D179000
heap
page read and write
1D146000
heap
page read and write
61ED3000
direct allocation
page read and write
3DDF000
stack
page read and write
1D13B000
heap
page read and write
4C5F000
stack
page read and write
1D179000
heap
page read and write
7F0000
heap
page read and write
A02000
unkown
page execute and read and write
46A1000
heap
page read and write
1D158000
heap
page read and write
29191000
heap
page read and write
1D154000
heap
page read and write
46A1000
heap
page read and write
BCE000
unkown
page execute and read and write
46A1000
heap
page read and write
469F000
stack
page read and write
960000
direct allocation
page read and write
46A1000
heap
page read and write
369E000
stack
page read and write
4FD000
stack
page read and write
292E000
stack
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
1D145000
heap
page read and write
1D179000
heap
page read and write
1D15C000
heap
page read and write
305E000
stack
page read and write
301F000
stack
page read and write
46A1000
heap
page read and write
296E000
stack
page read and write
1D172000
heap
page read and write
46A0000
heap
page read and write
299B000
heap
page read and write
46A1000
heap
page read and write
1D155000
heap
page read and write
1D160000
heap
page read and write
29441000
heap
page read and write
960000
direct allocation
page read and write
46A1000
heap
page read and write
1CE3F000
stack
page read and write
46A1000
heap
page read and write
1D160000
heap
page read and write
1D163000
heap
page read and write
1D15D000
heap
page read and write
61EB7000
direct allocation
page readonly
1D0CD000
stack
page read and write
319E000
stack
page read and write
6C64E000
unkown
page read and write
1D16B000
heap
page read and write
A21000
unkown
page execute and read and write
971000
unkown
page execute and write copy
3C9F000
stack
page read and write
2A9F000
stack
page read and write
1D16D000
heap
page read and write
8E6000
heap
page read and write
1D160000
heap
page read and write
1D15D000
heap
page read and write
2B9F000
stack
page read and write
1D157000
heap
page read and write
800000
heap
page read and write
46A1000
heap
page read and write
9CA000
unkown
page execute and read and write
1D15D000
heap
page read and write
2939F000
stack
page read and write
4CC0000
direct allocation
page execute and read and write
1D17C000
heap
page read and write
7EE000
stack
page read and write
1DC000
stack
page read and write
419F000
stack
page read and write
1D17C000
heap
page read and write
1D16D000
heap
page read and write
3E1E000
stack
page read and write
355E000
stack
page read and write
1D175000
heap
page read and write
1D15B000
heap
page read and write
231C9000
heap
page read and write
46A1000
heap
page read and write
1D17A000
heap
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
8A6000
heap
page read and write
46A1000
heap
page read and write
61ECD000
direct allocation
page readonly
1D155000
heap
page read and write
46A1000
heap
page read and write
1D146000
heap
page read and write
46A1000
heap
page read and write
365F000
stack
page read and write
1D160000
heap
page read and write
46A1000
heap
page read and write
2980000
direct allocation
page read and write
4C70000
direct allocation
page execute and read and write
960000
direct allocation
page read and write
2DDE000
stack
page read and write
4C9E000
stack
page read and write
1D179000
heap
page read and write
409E000
stack
page read and write
46A1000
heap
page read and write
1D16B000
heap
page read and write
D4F000
unkown
page execute and read and write
1D160000
heap
page read and write
1D146000
heap
page read and write
29170000
heap
page read and write
1004000
unkown
page execute and read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
1CFCD000
stack
page read and write
A2D000
unkown
page execute and read and write
3B5F000
stack
page read and write
46A1000
heap
page read and write
1D15C000
heap
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
2997000
heap
page read and write
431E000
stack
page read and write
1D160000
heap
page read and write
46A1000
heap
page read and write
1D157000
heap
page read and write
1D155000
heap
page read and write
1D160000
heap
page read and write
1D179000
heap
page read and write
6C660000
unkown
page readonly
1D163000
heap
page read and write
46B0000
heap
page read and write
1D163000
heap
page read and write
1CA5F000
stack
page read and write
873000
heap
page read and write
3F1F000
stack
page read and write
1D160000
heap
page read and write
46A1000
heap
page read and write
1D152000
heap
page read and write
351F000
stack
page read and write
46A1000
heap
page read and write
1D152000
heap
page read and write
61ED0000
direct allocation
page read and write
1D17C000
heap
page read and write
4AE0000
trusted library allocation
page read and write
1005000
unkown
page execute and write copy
2EDF000
stack
page read and write
1D155000
heap
page read and write
46A1000
heap
page read and write
A8B000
unkown
page execute and read and write
1D160000
heap
page read and write
1CCDF000
stack
page read and write
46A1000
heap
page read and write
29150000
heap
page read and write
46A1000
heap
page read and write
6C5C1000
unkown
page execute read
405F000
stack
page read and write
2990000
heap
page read and write
1D146000
heap
page read and write
7AE000
stack
page read and write
A8E000
unkown
page execute and read and write
46A1000
heap
page read and write
1D16B000
heap
page read and write
1D160000
heap
page read and write
46A1000
heap
page read and write
4F9000
stack
page read and write
6C83E000
unkown
page read and write
960000
direct allocation
page read and write
530000
heap
page read and write
E5B000
unkown
page execute and read and write
1D152000
heap
page read and write
660000
heap
page read and write
46A1000
heap
page read and write
1D157000
heap
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
1CE8D000
stack
page read and write
6C840000
unkown
page read and write
1D16C000
heap
page read and write
46A1000
heap
page read and write
42DF000
stack
page read and write
E69000
unkown
page execute and write copy
46A1000
heap
page read and write
46A1000
heap
page read and write
6C7FF000
unkown
page readonly
46A1000
heap
page read and write
1D179000
heap
page read and write
1D15D000
heap
page read and write
46A1000
heap
page read and write
1D130000
heap
page read and write
46A1000
heap
page read and write
1D16E000
heap
page read and write
1D132000
heap
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
960000
direct allocation
page read and write
4C90000
direct allocation
page execute and read and write
95E000
stack
page read and write
1D179000
heap
page read and write
828000
heap
page read and write
1CB9F000
stack
page read and write
4C60000
direct allocation
page execute and read and write
46A1000
heap
page read and write
29439000
heap
page read and write
A52000
unkown
page execute and read and write
46A1000
heap
page read and write
9FF000
unkown
page execute and read and write
2C9F000
stack
page read and write
46A1000
heap
page read and write
820000
heap
page read and write
32DE000
stack
page read and write
46A1000
heap
page read and write
46A1000
heap
page read and write
960000
direct allocation
page read and write
61EB4000
direct allocation
page read and write
4C90000
direct allocation
page execute and read and write
3A5E000
stack
page read and write
46A1000
heap
page read and write
33DF000
stack
page read and write
459E000
stack
page read and write
46A1000
heap
page read and write
1D155000
heap
page read and write
1D160000
heap
page read and write
28EC000
stack
page read and write
960000
direct allocation
page read and write
455F000
stack
page read and write
46A1000
heap
page read and write
There are 330 hidden memdumps, click here to show them.