IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAEBAKKJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\AFBKKFBAEGDHJJJJKFBKFHCAFC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CFHIIJDBKEGIDHIDAFCFBGHIJD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DHJECFCGHIDGHIDHDHIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GDBAKKKFBGDHJKFHJJJJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IECGIEBA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\JJDBAAEGDBKKECBGIJEBGDAEBF
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\KECGDBFCBKFIDHIDHDHI
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\KFBGCAKFHCFHJKECFIIDAEHJDA
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpata
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCash
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll&
unknown
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllpData
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllm5
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll;5
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpq
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpQ5
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.pI5
unknown
 malicious
http://185.215.113.37j
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll_5
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpY
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllO
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllh
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpA
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlls5y
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllV
unknown
 malicious
http://185.215.113.37/7
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllrowser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpJ:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllh
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php%
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpronCash
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
There are 51 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4B00000
direct allocation
page read and write
 malicious
768000
heap
page read and write
 malicious
AF1000
unkown
page execute and read and write
 malicious
1D249000
heap
page read and write
1D249000
heap
page read and write
ED1000
unkown
page execute and read and write
4690000
heap
page read and write
AD0000
direct allocation
page read and write
AD0000
direct allocation
page read and write
6CB40000
unkown
page readonly
1D259000
heap
page read and write
FE6000
unkown
page execute and write copy
1D251000
heap
page read and write
4681000
heap
page read and write
34FF000
stack
page read and write
3C7F000
stack
page read and write
B75000
unkown
page execute and read and write
1D25E000
heap
page read and write
1D25D000
heap
page read and write
1D264000
heap
page read and write
117C000
unkown
page execute and write copy
4681000
heap
page read and write
1D281000
heap
page read and write
FE5000
unkown
page execute and write copy
4681000
heap
page read and write
407E000
stack
page read and write
1CE1F000
stack
page read and write
AD0000
direct allocation
page read and write
4681000
heap
page read and write
1D280000
heap
page read and write
2C7E000
stack
page read and write
1D281000
heap
page read and write
1D264000
heap
page read and write
317E000
stack
page read and write
4C50000
direct allocation
page execute and read and write
1C95E000
stack
page read and write
363F000
stack
page read and write
4681000
heap
page read and write
3F3E000
stack
page read and write
292F6000
heap
page read and write
2FFF000
stack
page read and write
3B3F000
stack
page read and write
1CCDF000
stack
page read and write
FCF000
unkown
page execute and read and write
42FE000
stack
page read and write
1D263000
heap
page read and write
2937000
heap
page read and write
4C60000
direct allocation
page execute and read and write
2B3F000
stack
page read and write
4681000
heap
page read and write
1D25E000
heap
page read and write
1D264000
heap
page read and write
1D258000
heap
page read and write
43FF000
stack
page read and write
4681000
heap
page read and write
1D271000
heap
page read and write
2F4AA000
heap
page read and write
AF0000
unkown
page readonly
443E000
stack
page read and write
2920000
direct allocation
page execute and read and write
4681000
heap
page read and write
1D281000
heap
page read and write
61ED0000
direct allocation
page read and write
4681000
heap
page read and write
1D230000
heap
page read and write
1D281000
heap
page read and write
2EBF000
stack
page read and write
AD0000
direct allocation
page read and write
4681000
heap
page read and write
7C6000
heap
page read and write
4681000
heap
page read and write
1D256000
heap
page read and write
1D258000
heap
page read and write
740000
heap
page read and write
3DBF000
stack
page read and write
327F000
stack
page read and write
B82000
unkown
page execute and read and write
2F4B2000
heap
page read and write
1D281000
heap
page read and write
28CB000
stack
page read and write
1D264000
heap
page read and write
1D259000
heap
page read and write
AD0000
direct allocation
page read and write
288E000
stack
page read and write
1D24A000
heap
page read and write
1D251000
heap
page read and write
4681000
heap
page read and write
4680000
heap
page read and write
BD2000
unkown
page execute and read and write
93E000
stack
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
C0B000
unkown
page execute and read and write
CBB000
unkown
page execute and read and write
1CBDE000
stack
page read and write
71E000
stack
page read and write
33FE000
stack
page read and write
42BF000
stack
page read and write
4681000
heap
page read and write
FE5000
unkown
page execute and read and write
4681000
heap
page read and write
6CD1E000
unkown
page read and write
1D264000
heap
page read and write
1D26C000
heap
page read and write
640000
heap
page read and write
4FD000
stack
page read and write
1D281000
heap
page read and write
AD0000
direct allocation
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
1D23F000
heap
page read and write
4681000
heap
page read and write
2F410000
trusted library allocation
page read and write
3EFF000
stack
page read and write
1D24A000
heap
page read and write
2930000
heap
page read and write
4681000
heap
page read and write
377F000
stack
page read and write
29250000
heap
page read and write
37BE000
stack
page read and write
39FF000
stack
page read and write
1D259000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
2EFE000
stack
page read and write
29270000
heap
page read and write
4B3C000
stack
page read and write
1D236000
heap
page read and write
1D264000
heap
page read and write
2F2FE000
stack
page read and write
CB5000
unkown
page execute and read and write
4681000
heap
page read and write
1D26B000
heap
page read and write
29230000
heap
page read and write
4681000
heap
page read and write
1D281000
heap
page read and write
1CA5F000
stack
page read and write
1D264000
heap
page read and write
292B2000
heap
page read and write
4681000
heap
page read and write
655000
heap
page read and write
1D26A000
heap
page read and write
1D09E000
stack
page read and write
4681000
heap
page read and write
6CB2E000
unkown
page read and write
4681000
heap
page read and write
1D24A000
heap
page read and write
4681000
heap
page read and write
FA9000
unkown
page execute and read and write
4681000
heap
page read and write
1D267000
heap
page read and write
6CD1F000
unkown
page write copy
4681000
heap
page read and write
4C60000
direct allocation
page execute and read and write
457E000
stack
page read and write
69E000
stack
page read and write
74A000
heap
page read and write
B78000
unkown
page execute and read and write
1D25E000
heap
page read and write
1D254000
heap
page read and write
4F3000
stack
page read and write
2910000
direct allocation
page read and write
1D262000
heap
page read and write
4C3F000
stack
page read and write
29291000
heap
page read and write
C0E000
unkown
page execute and read and write
41BE000
stack
page read and write
46A0000
heap
page read and write
6CD25000
unkown
page readonly
1D264000
heap
page read and write
1D264000
heap
page read and write
293E000
heap
page read and write
4681000
heap
page read and write
1D25E000
heap
page read and write
4681000
heap
page read and write
1BC000
stack
page read and write
BAD000
unkown
page execute and read and write
6CB1D000
unkown
page readonly
1D273000
heap
page read and write
C95000
unkown
page execute and read and write
1D24A000
heap
page read and write
1D24A000
heap
page read and write
650000
heap
page read and write
1D26F000
heap
page read and write
4C70000
direct allocation
page execute and read and write
3A3E000
stack
page read and write
1D24A000
heap
page read and write
1CF5C000
stack
page read and write
AD0000
direct allocation
page read and write
1D25C000
heap
page read and write
1CB9F000
stack
page read and write
4681000
heap
page read and write
6CAA1000
unkown
page execute read
1D256000
heap
page read and write
417F000
stack
page read and write
BA1000
unkown
page execute and read and write
AF0000
unkown
page read and write
4681000
heap
page read and write
B4A000
unkown
page execute and read and write
303E000
stack
page read and write
1D25E000
heap
page read and write
4681000
heap
page read and write
1D281000
heap
page read and write
4681000
heap
page read and write
1D264000
heap
page read and write
6CB41000
unkown
page execute read
4681000
heap
page read and write
4681000
heap
page read and write
467F000
stack
page read and write
61EB4000
direct allocation
page read and write
4681000
heap
page read and write
1D25E000
heap
page read and write
2F4A0000
heap
page read and write
4681000
heap
page read and write
1D251000
heap
page read and write
1D25C000
heap
page read and write
1D258000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
2F3FF000
stack
page read and write
AD0000
direct allocation
page read and write
4681000
heap
page read and write
2DBE000
stack
page read and write
6CD20000
unkown
page read and write
1CD1E000
stack
page read and write
4C80000
direct allocation
page execute and read and write
453F000
stack
page read and write
292F2000
heap
page read and write
4681000
heap
page read and write
1D25D000
heap
page read and write
61E01000
direct allocation
page execute read
AD0000
direct allocation
page read and write
1D258000
heap
page read and write
61EB7000
direct allocation
page readonly
510000
heap
page read and write
766000
heap
page read and write
1D353000
heap
page read and write
1D251000
heap
page read and write
FD6000
unkown
page execute and read and write
1D25E000
heap
page read and write
1CE5E000
stack
page read and write
1D258000
heap
page read and write
1D256000
heap
page read and write
367E000
stack
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
33BF000
stack
page read and write
7FE000
heap
page read and write
4780000
trusted library allocation
page read and write
D4E000
unkown
page execute and read and write
232C8000
heap
page read and write
720000
heap
page read and write
1D25E000
heap
page read and write
1D25B000
heap
page read and write
6DE000
stack
page read and write
AD0000
direct allocation
page read and write
74E000
heap
page read and write
2D7F000
stack
page read and write
7A9000
heap
page read and write
4681000
heap
page read and write
1D264000
heap
page read and write
2910000
direct allocation
page read and write
6CB32000
unkown
page readonly
4681000
heap
page read and write
6CAA0000
unkown
page readonly
AD0000
direct allocation
page read and write
4681000
heap
page read and write
AD0000
direct allocation
page read and write
AF1000
unkown
page execute and write copy
1D249000
heap
page read and write
1D25F000
heap
page read and write
1D26F000
heap
page read and write
1D24A000
heap
page read and write
1D281000
heap
page read and write
1D268000
heap
page read and write
1D24A000
heap
page read and write
2F4AE000
heap
page read and write
4681000
heap
page read and write
290E000
stack
page read and write
2C3F000
stack
page read and write
1D25E000
heap
page read and write
3B7E000
stack
page read and write
1D350000
trusted library allocation
page read and write
1D264000
heap
page read and write
1D25C000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
2A3F000
stack
page read and write
4681000
heap
page read and write
791000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
1CF9E000
stack
page read and write
4681000
heap
page read and write
61E00000
direct allocation
page execute and read and write
763000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
1D260000
heap
page read and write
61ECD000
direct allocation
page readonly
3DFE000
stack
page read and write
4682000
heap
page read and write
32BE000
stack
page read and write
293B000
heap
page read and write
2F4A8000
heap
page read and write
6CCDF000
unkown
page readonly
4681000
heap
page read and write
4681000
heap
page read and write
1D264000
heap
page read and write
1D264000
heap
page read and write
61ECC000
direct allocation
page read and write
1D260000
heap
page read and write
1D12E000
stack
page read and write
1D267000
heap
page read and write
BDF000
unkown
page execute and read and write
313F000
stack
page read and write
292D2000
heap
page read and write
BFF000
unkown
page execute and read and write
AD0000
direct allocation
page read and write
4681000
heap
page read and write
5F0000
heap
page read and write
38BF000
stack
page read and write
4681000
heap
page read and write
3CBE000
stack
page read and write
4681000
heap
page read and write
7CD000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
805000
heap
page read and write
1CA9E000
stack
page read and write
4681000
heap
page read and write
4F9000
stack
page read and write
B7F000
unkown
page execute and read and write
4C40000
direct allocation
page execute and read and write
1D264000
heap
page read and write
38FE000
stack
page read and write
1D281000
heap
page read and write
1D22D000
stack
page read and write
117B000
unkown
page execute and read and write
AD0000
direct allocation
page read and write
1D25C000
heap
page read and write
403F000
stack
page read and write
61ED3000
direct allocation
page read and write
353E000
stack
page read and write
61ED4000
direct allocation
page readonly
7F7000
heap
page read and write
4681000
heap
page read and write
4681000
heap
page read and write
There are 342 hidden memdumps, click here to show them.