IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFIEGIECGCBKFIEBGCAA
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\CGCFIIEB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FBAKEHIEBKJJJJJKKKEG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GHJEGCAEGIIIDHIEBKEB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GIJJKKJJDAAAAAKFHJJDGDAFBA
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\IDHIEGIIIECAKEBFBAAEBKFCFH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IIJDBGDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllp
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpn
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpr
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpx
unknown
 malicious
http://185.215.113.37S
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll5
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllm
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3d
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dlle
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllUser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpEGIECGCBKFIEBGCAA
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dlly
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllw
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpem
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php5
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFirefox
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php)
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 48 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
50A0000
direct allocation
page read and write
 malicious
121E000
heap
page read and write
 malicious
6F1000
unkown
page execute and read and write
 malicious
31FE000
stack
page read and write
4C11000
heap
page read and write
151D000
stack
page read and write
6C84F000
unkown
page write copy
51DF000
stack
page read and write
4C11000
heap
page read and write
3E7E000
stack
page read and write
4C18000
heap
page read and write
29743000
heap
page read and write
1D70C000
heap
page read and write
1D71B000
heap
page read and write
1D710000
heap
page read and write
393F000
stack
page read and write
5250000
direct allocation
page execute and read and write
29741000
heap
page read and write
11A4000
heap
page read and write
4C11000
heap
page read and write
1D702000
heap
page read and write
1D53C000
stack
page read and write
1D6E0000
heap
page read and write
1D6E2000
heap
page read and write
8BB000
unkown
page execute and read and write
1D710000
heap
page read and write
4C11000
heap
page read and write
775000
unkown
page execute and read and write
6C671000
unkown
page execute read
6C64D000
unkown
page readonly
1262000
heap
page read and write
D8F000
unkown
page execute and read and write
1D725000
heap
page read and write
299F6000
heap
page read and write
1D707000
heap
page read and write
5080000
heap
page read and write
1218000
heap
page read and write
80E000
unkown
page execute and read and write
1133000
stack
page read and write
4C11000
heap
page read and write
11A4000
heap
page read and write
11A4000
heap
page read and write
1D71C000
heap
page read and write
4C11000
heap
page read and write
12F7000
heap
page read and write
1D6EB000
heap
page read and write
2DE0000
heap
page read and write
4C00000
direct allocation
page read and write
4C11000
heap
page read and write
1277000
heap
page read and write
29755000
heap
page read and write
447F000
stack
page read and write
2E3E000
stack
page read and write
3CFF000
stack
page read and write
4C00000
direct allocation
page read and write
4C11000
heap
page read and write
94E000
unkown
page execute and read and write
1D6F6000
heap
page read and write
61ECD000
direct allocation
page readonly
5050000
trusted library allocation
page read and write
1D707000
heap
page read and write
487E000
stack
page read and write
433F000
stack
page read and write
4C11000
heap
page read and write
1D710000
heap
page read and write
11A4000
heap
page read and write
437E000
stack
page read and write
4C11000
heap
page read and write
6C5D1000
unkown
page execute read
1D710000
heap
page read and write
6F0000
unkown
page readonly
1D729000
heap
page read and write
1D722000
heap
page read and write
4C10000
heap
page read and write
BDF000
unkown
page execute and read and write
4C11000
heap
page read and write
1D71D000
heap
page read and write
6C65E000
unkown
page read and write
4C11000
heap
page read and write
1D809000
heap
page read and write
782000
unkown
page execute and read and write
4C00000
direct allocation
page read and write
299EE000
heap
page read and write
77F000
unkown
page execute and read and write
46FF000
stack
page read and write
61EB4000
direct allocation
page read and write
1D710000
heap
page read and write
1D713000
heap
page read and write
D90000
unkown
page execute and write copy
1D70B000
heap
page read and write
299F5000
heap
page read and write
11A4000
heap
page read and write
1D710000
heap
page read and write
11A4000
heap
page read and write
6C670000
unkown
page readonly
1190000
heap
page read and write
4C11000
heap
page read and write
30BE000
stack
page read and write
1D729000
heap
page read and write
1D705000
heap
page read and write
1D70D000
heap
page read and write
11A4000
heap
page read and write
11A4000
heap
page read and write
1D725000
heap
page read and write
120E000
stack
page read and write
1D705000
heap
page read and write
11A4000
heap
page read and write
497F000
stack
page read and write
3BFE000
stack
page read and write
1D6F6000
heap
page read and write
1D71E000
heap
page read and write
4C11000
heap
page read and write
1D1AE000
stack
page read and write
11A4000
heap
page read and write
4C00000
direct allocation
page read and write
4C11000
heap
page read and write
4C11000
heap
page read and write
2DFB000
heap
page read and write
1D6F6000
heap
page read and write
4C11000
heap
page read and write
4C11000
heap
page read and write
1D707000
heap
page read and write
1D729000
heap
page read and write
7D2000
unkown
page execute and read and write
BB3000
unkown
page execute and read and write
5220000
direct allocation
page execute and read and write
1D70D000
heap
page read and write
1D72C000
heap
page read and write
1D710000
heap
page read and write
778000
unkown
page execute and read and write
11A4000
heap
page read and write
4C11000
heap
page read and write
29700000
heap
page read and write
4C11000
heap
page read and write
4C11000
heap
page read and write
80B000
unkown
page execute and read and write
4C11000
heap
page read and write
4C11000
heap
page read and write
4C11000
heap
page read and write
11A4000
heap
page read and write
2984E000
stack
page read and write
3A7F000
stack
page read and write
297AA000
heap
page read and write
1D729000
heap
page read and write
11A4000
heap
page read and write
4C11000
heap
page read and write
11A4000
heap
page read and write
1D70C000
heap
page read and write
5210000
direct allocation
page execute and read and write
4C11000
heap
page read and write
1D2EE000
stack
page read and write
4C11000
heap
page read and write
50A0000
direct allocation
page read and write
61ED4000
direct allocation
page readonly
1D716000
heap
page read and write
1D729000
heap
page read and write
1D729000
heap
page read and write
4C11000
heap
page read and write
4C11000
heap
page read and write
50DB000
stack
page read and write
1D705000
heap
page read and write
11A4000
heap
page read and write
299ED000
heap
page read and write
1D705000
heap
page read and write
8B5000
unkown
page execute and read and write
1D800000
trusted library allocation
page read and write
1D705000
heap
page read and write
103C000
stack
page read and write
1CF2E000
stack
page read and write
11A4000
heap
page read and write
1139000
stack
page read and write
3FBE000
stack
page read and write
4C00000
direct allocation
page read and write
3E3F000
stack
page read and write
4C11000
heap
page read and write
29950000
trusted library allocation
page read and write
11A4000
heap
page read and write
11A0000
heap
page read and write
61EB7000
direct allocation
page readonly
299FC000
heap
page read and write
296E0000
heap
page read and write
4C11000
heap
page read and write
2975C000
heap
page read and write
11A4000
heap
page read and write
423E000
stack
page read and write
4C00000
direct allocation
page read and write
4C11000
heap
page read and write
2F3F000
stack
page read and write
4C11000
heap
page read and write
40BF000
stack
page read and write
3D3E000
stack
page read and write
12EF000
heap
page read and write
1D710000
heap
page read and write
61ECC000
direct allocation
page read and write
4C11000
heap
page read and write
1D710000
heap
page read and write
1D710000
heap
page read and write
11A4000
heap
page read and write
BEE000
unkown
page execute and write copy
307F000
stack
page read and write
4C11000
heap
page read and write
41FF000
stack
page read and write
3BBF000
stack
page read and write
1D70D000
heap
page read and write
35BE000
stack
page read and write
4C00000
direct allocation
page read and write
383E000
stack
page read and write
1D72C000
heap
page read and write
11A4000
heap
page read and write
4C30000
heap
page read and write
14DE000
stack
page read and write
1D710000
heap
page read and write
12E2000
heap
page read and write
36BF000
stack
page read and write
49BE000
stack
page read and write
1D70C000
heap
page read and write
5230000
direct allocation
page execute and read and write
473E000
stack
page read and write
4C11000
heap
page read and write
11A4000
heap
page read and write
4C11000
heap
page read and write
1D710000
heap
page read and write
45FE000
stack
page read and write
6C80F000
unkown
page readonly
113D000
stack
page read and write
1D6F6000
heap
page read and write
4C00000
direct allocation
page read and write
4C11000
heap
page read and write
1D71B000
heap
page read and write
61ED3000
direct allocation
page read and write
357F000
stack
page read and write
1D06E000
stack
page read and write
12E9000
heap
page read and write
4C00000
direct allocation
page read and write
397E000
stack
page read and write
2994E000
stack
page read and write
161E000
stack
page read and write
44BE000
stack
page read and write
12CA000
heap
page read and write
3F7F000
stack
page read and write
1D71D000
heap
page read and write
11A4000
heap
page read and write
5220000
direct allocation
page execute and read and write
45BF000
stack
page read and write
1D710000
heap
page read and write
1D708000
heap
page read and write
4C11000
heap
page read and write
1D717000
heap
page read and write
1D71C000
heap
page read and write
31BF000
stack
page read and write
4C00000
direct allocation
page read and write
AD1000
unkown
page execute and read and write
1D71C000
heap
page read and write
1D704000
heap
page read and write
1D710000
heap
page read and write
1D71C000
heap
page read and write
6F1000
unkown
page execute and write copy
1D71D000
heap
page read and write
4C11000
heap
page read and write
4C11000
heap
page read and write
4C11000
heap
page read and write
4C11000
heap
page read and write
2DF7000
heap
page read and write
1180000
heap
page read and write
74A000
unkown
page execute and read and write
1D707000
heap
page read and write
4C11000
heap
page read and write
2DFE000
heap
page read and write
1291000
heap
page read and write
32FF000
stack
page read and write
4C11000
heap
page read and write
4C00000
direct allocation
page read and write
1D705000
heap
page read and write
11A4000
heap
page read and write
4C11000
heap
page read and write
1D729000
heap
page read and write
2974F000
heap
page read and write
1D702000
heap
page read and write
1D710000
heap
page read and write
6C662000
unkown
page readonly
1D70D000
heap
page read and write
4BFF000
stack
page read and write
4ABF000
stack
page read and write
4C11000
heap
page read and write
BD8000
unkown
page execute and read and write
343F000
stack
page read and write
1D710000
heap
page read and write
40FE000
stack
page read and write
11A4000
heap
page read and write
4C11000
heap
page read and write
1D02F000
stack
page read and write
61E00000
direct allocation
page execute and read and write
11A4000
heap
page read and write
1D707000
heap
page read and write
4C11000
heap
page read and write
6C850000
unkown
page read and write
1D705000
heap
page read and write
7AD000
unkown
page execute and read and write
4C11000
heap
page read and write
4C11000
heap
page read and write
11A4000
heap
page read and write
4C00000
direct allocation
page read and write
4C11000
heap
page read and write
50A0000
direct allocation
page read and write
1D67D000
stack
page read and write
11A4000
heap
page read and write
12F3000
heap
page read and write
1D713000
heap
page read and write
895000
unkown
page execute and read and write
4C00000
direct allocation
page read and write
3ABE000
stack
page read and write
347E000
stack
page read and write
1D6F8000
heap
page read and write
1D710000
heap
page read and write
1D70C000
heap
page read and write
1D713000
heap
page read and write
61E01000
direct allocation
page execute read
2F7B000
stack
page read and write
483F000
stack
page read and write
6C855000
unkown
page readonly
4C11000
heap
page read and write
1D705000
heap
page read and write
6C84E000
unkown
page read and write
29748000
heap
page read and write
1D6F5000
heap
page read and write
37FF000
stack
page read and write
4C20000
heap
page read and write
1D3EF000
stack
page read and write
333E000
stack
page read and write
4C11000
heap
page read and write
1D729000
heap
page read and write
4C11000
heap
page read and write
1D72A000
heap
page read and write
12DC000
heap
page read and write
1D72C000
heap
page read and write
7A1000
unkown
page execute and read and write
5200000
direct allocation
page execute and read and write
11A4000
heap
page read and write
4C00000
direct allocation
page read and write
12D7000
heap
page read and write
11A4000
heap
page read and write
51F0000
direct allocation
page execute and read and write
11A4000
heap
page read and write
11A4000
heap
page read and write
11A4000
heap
page read and write
1D57D000
stack
page read and write
1D72C000
heap
page read and write
7DF000
unkown
page execute and read and write
5240000
direct allocation
page execute and read and write
BEE000
unkown
page execute and read and write
36FE000
stack
page read and write
4C11000
heap
page read and write
4AFE000
stack
page read and write
6C5D0000
unkown
page readonly
11A4000
heap
page read and write
1D2AF000
stack
page read and write
4C11000
heap
page read and write
11A4000
heap
page read and write
6F0000
unkown
page read and write
1D71B000
heap
page read and write
4C11000
heap
page read and write
11A4000
heap
page read and write
7FF000
unkown
page execute and read and write
297A2000
heap
page read and write
1D729000
heap
page read and write
23771000
heap
page read and write
11A4000
heap
page read and write
1210000
heap
page read and write
BEF000
unkown
page execute and write copy
11A4000
heap
page read and write
29720000
heap
page read and write
1D710000
heap
page read and write
1D16F000
stack
page read and write
61ED0000
direct allocation
page read and write
1D6F6000
heap
page read and write
1D72C000
heap
page read and write
1D43D000
stack
page read and write
4C11000
heap
page read and write
1D702000
heap
page read and write
2DF0000
heap
page read and write
There are 370 hidden memdumps, click here to show them.