IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFHDGDGIIDGCFIDHDHDH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\CFCBFBGDBKJKECAAKKFHDBFHII
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DAEGIDHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DAKFIDHDGIEGCAKFIIJKFCBFBF
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DGDAEHCBGIIJJJJKKKEHDGHJKF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HCAEGCBF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HIIEBAFCBKFIDGCAKKKF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IDBGHDGHCGHCAAKFIIEC
ASCII text, with very long lines (1765), with CRLF line terminators
dropped
C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK
SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php1b
unknown
 malicious
http://185.215.113.37/Z
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllD
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll&
unknown
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpk
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllh
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php3Ba
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll3%8
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpW
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllsibility
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php?
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllb
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlly$
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php6
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php8
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpfa
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500000.1&cta
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_f6f292994d7c60be109e4c185cbc03032d36d17160d4e639
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.Qb0WswhkLhoa
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 42 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
56A0000
direct allocation
page read and write
 malicious
D91000
unkown
page execute and read and write
 malicious
192E000
heap
page read and write
 malicious
5211000
heap
page read and write
1DCD5000
heap
page read and write
4BCE000
stack
page read and write
6C5DD000
unkown
page readonly
29CE0000
heap
page read and write
19E2000
heap
page read and write
1DCEF000
heap
page read and write
57F0000
direct allocation
page execute and read and write
1DCC0000
heap
page read and write
3A4E000
stack
page read and write
1DCC2000
heap
page read and write
4CD0000
heap
page read and write
1DCF0000
heap
page read and write
1DCE7000
heap
page read and write
5211000
heap
page read and write
1DCEE000
heap
page read and write
5211000
heap
page read and write
E22000
unkown
page execute and read and write
358F000
stack
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
15EE000
stack
page read and write
1DCEB000
heap
page read and write
6C7DF000
unkown
page write copy
1A12000
heap
page read and write
5230000
heap
page read and write
454F000
stack
page read and write
1DCE5000
heap
page read and write
1DCE4000
heap
page read and write
1D76E000
stack
page read and write
19DA000
heap
page read and write
5211000
heap
page read and write
51E0000
heap
page read and write
5200000
direct allocation
page read and write
1DCEB000
heap
page read and write
1DCF0000
heap
page read and write
4E5E000
stack
page read and write
5211000
heap
page read and write
19E7000
heap
page read and write
1DCFF000
heap
page read and write
468F000
stack
page read and write
3CCE000
stack
page read and write
F55000
unkown
page execute and read and write
1529000
stack
page read and write
1DCD6000
heap
page read and write
3B4F000
stack
page read and write
1928000
heap
page read and write
116C000
unkown
page execute and read and write
D91000
unkown
page execute and write copy
61E00000
direct allocation
page execute and read and write
1DCFC000
heap
page read and write
E41000
unkown
page execute and read and write
5220000
heap
page read and write
1DC5C000
stack
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
1550000
heap
page read and write
1421000
unkown
page execute and write copy
5273000
heap
page read and write
61ED3000
direct allocation
page read and write
440F000
stack
page read and write
1DA1D000
stack
page read and write
29D84000
heap
page read and write
404F000
stack
page read and write
347E000
stack
page read and write
1420000
unkown
page execute and read and write
1DCED000
heap
page read and write
5211000
heap
page read and write
1287000
unkown
page execute and read and write
1DCF5000
heap
page read and write
5200000
direct allocation
page read and write
F35000
unkown
page execute and read and write
1989000
heap
page read and write
1DCE4000
heap
page read and write
5211000
heap
page read and write
5810000
direct allocation
page execute and read and write
343B000
stack
page read and write
4A4E000
stack
page read and write
5211000
heap
page read and write
1DCF0000
heap
page read and write
418F000
stack
page read and write
1DCE7000
heap
page read and write
5211000
heap
page read and write
1DCCB000
heap
page read and write
5200000
direct allocation
page read and write
4E1F000
stack
page read and write
509F000
stack
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
4B8F000
stack
page read and write
5211000
heap
page read and write
1DCE4000
heap
page read and write
1DCE5000
heap
page read and write
378F000
stack
page read and write
6C600000
unkown
page readonly
5820000
direct allocation
page execute and read and write
57DF000
stack
page read and write
5840000
direct allocation
page execute and read and write
29D22000
heap
page read and write
1DCE4000
heap
page read and write
1DCF0000
heap
page read and write
1DCF0000
heap
page read and write
5211000
heap
page read and write
1DCE2000
heap
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
2FF3C000
heap
page read and write
1570000
heap
page read and write
29D24000
heap
page read and write
6C7DE000
unkown
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
6C560000
unkown
page readonly
5200000
direct allocation
page read and write
5211000
heap
page read and write
5215000
heap
page read and write
1DD0C000
heap
page read and write
1288000
unkown
page execute and write copy
1DCF0000
heap
page read and write
1278000
unkown
page execute and read and write
5211000
heap
page read and write
1580000
heap
page read and write
5211000
heap
page read and write
390E000
stack
page read and write
6C5EE000
unkown
page read and write
50DE000
stack
page read and write
1DCD5000
heap
page read and write
61E01000
direct allocation
page execute read
1DCD6000
heap
page read and write
1DCD5000
heap
page read and write
19ED000
heap
page read and write
3C8F000
stack
page read and write
1DCF7000
heap
page read and write
4F5F000
stack
page read and write
196C000
heap
page read and write
5211000
heap
page read and write
5650000
trusted library allocation
page read and write
3A0F000
stack
page read and write
1920000
heap
page read and write
1D72F000
stack
page read and write
2FEA0000
trusted library allocation
page read and write
5211000
heap
page read and write
1DCF0000
heap
page read and write
56A0000
direct allocation
page read and write
5211000
heap
page read and write
E7F000
unkown
page execute and read and write
1DCD6000
heap
page read and write
458E000
stack
page read and write
3487000
heap
page read and write
3B8E000
stack
page read and write
1DCEB000
heap
page read and write
47CF000
stack
page read and write
5211000
heap
page read and write
46CE000
stack
page read and write
5820000
direct allocation
page execute and read and write
F5B000
unkown
page execute and read and write
494E000
stack
page read and write
1DCEF000
heap
page read and write
5211000
heap
page read and write
348E000
heap
page read and write
5830000
direct allocation
page execute and read and write
3F4E000
stack
page read and write
5211000
heap
page read and write
1DCF0000
heap
page read and write
5211000
heap
page read and write
4CCF000
stack
page read and write
29D35000
heap
page read and write
1DB1D000
stack
page read and write
5211000
heap
page read and write
1DD0B000
heap
page read and write
5211000
heap
page read and write
2FF3C000
heap
page read and write
1DCE4000
heap
page read and write
5211000
heap
page read and write
FEE000
unkown
page execute and read and write
5211000
heap
page read and write
3E0E000
stack
page read and write
1DCF0000
heap
page read and write
348B000
heap
page read and write
5211000
heap
page read and write
1DCEF000
heap
page read and write
33FE000
stack
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
2FD9E000
stack
page read and write
1523000
stack
page read and write
1DD0C000
heap
page read and write
1DCEE000
heap
page read and write
1DCE8000
heap
page read and write
1DCF4000
heap
page read and write
1DCEF000
heap
page read and write
1DDE4000
heap
page read and write
5211000
heap
page read and write
DEA000
unkown
page execute and read and write
1DCF0000
heap
page read and write
1287000
unkown
page execute and write copy
1DCEF000
heap
page read and write
23D5B000
heap
page read and write
51DF000
stack
page read and write
1DCE4000
heap
page read and write
1A0E000
heap
page read and write
1DCD6000
heap
page read and write
61ED0000
direct allocation
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
56DB000
stack
page read and write
5211000
heap
page read and write
1DB5D000
stack
page read and write
29CC0000
heap
page read and write
5211000
heap
page read and write
29D2C000
heap
page read and write
19F9000
heap
page read and write
E18000
unkown
page execute and read and write
1DCEE000
heap
page read and write
37CE000
stack
page read and write
61ED4000
direct allocation
page readonly
41CE000
stack
page read and write
1DCF0000
heap
page read and write
E4D000
unkown
page execute and read and write
1DCEC000
heap
page read and write
1972000
heap
page read and write
5200000
direct allocation
page read and write
4D1E000
stack
page read and write
1DCEF000
heap
page read and write
5211000
heap
page read and write
EAE000
unkown
page execute and read and write
5200000
direct allocation
page read and write
56A0000
direct allocation
page read and write
1DCE4000
heap
page read and write
1DCE0000
heap
page read and write
3480000
heap
page read and write
38CF000
stack
page read and write
5211000
heap
page read and write
490E000
stack
page read and write
2FF34000
heap
page read and write
5211000
heap
page read and write
1DCE5000
heap
page read and write
1D8DE000
stack
page read and write
3F0F000
stack
page read and write
5211000
heap
page read and write
368F000
stack
page read and write
1DCEB000
heap
page read and write
61EB4000
direct allocation
page read and write
1DCE5000
heap
page read and write
5211000
heap
page read and write
1DCE2000
heap
page read and write
42CF000
stack
page read and write
124E000
unkown
page execute and read and write
5211000
heap
page read and write
152D000
stack
page read and write
1DCD6000
heap
page read and write
1DD0C000
heap
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
29D00000
heap
page read and write
5211000
heap
page read and write
29D3E000
heap
page read and write
5800000
direct allocation
page execute and read and write
5211000
heap
page read and write
1DD0C000
heap
page read and write
5211000
heap
page read and write
1DD0C000
heap
page read and write
1DCFB000
heap
page read and write
1DCFE000
heap
page read and write
190D000
stack
page read and write
29D26000
heap
page read and write
E9F000
unkown
page execute and read and write
1DCED000
heap
page read and write
1DCF0000
heap
page read and write
E72000
unkown
page execute and read and write
1DCE4000
heap
page read and write
1B1F000
stack
page read and write
5211000
heap
page read and write
2FE9F000
stack
page read and write
5211000
heap
page read and write
5200000
direct allocation
page read and write
5211000
heap
page read and write
1DD0C000
heap
page read and write
1DCF0000
heap
page read and write
5200000
direct allocation
page read and write
6C79F000
unkown
page readonly
5200000
direct allocation
page read and write
1DD0C000
heap
page read and write
E15000
unkown
page execute and read and write
29D41000
heap
page read and write
1555000
heap
page read and write
5200000
direct allocation
page read and write
19F4000
heap
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
1DCE5000
heap
page read and write
6C561000
unkown
page execute read
6C601000
unkown
page execute read
1DD0C000
heap
page read and write
430E000
stack
page read and write
1DCED000
heap
page read and write
D90000
unkown
page read and write
3DCF000
stack
page read and write
1DCF0000
heap
page read and write
1DCEF000
heap
page read and write
5200000
direct allocation
page read and write
1DDE0000
trusted library allocation
page read and write
1DCE7000
heap
page read and write
61ECC000
direct allocation
page read and write
5211000
heap
page read and write
582E000
stack
page read and write
6C7E0000
unkown
page read and write
1DCE7000
heap
page read and write
1DCEC000
heap
page read and write
5211000
heap
page read and write
1DCDA000
heap
page read and write
5211000
heap
page read and write
1D9DF000
stack
page read and write
1DCF0000
heap
page read and write
1271000
unkown
page execute and read and write
5211000
heap
page read and write
1DD0C000
heap
page read and write
5211000
heap
page read and write
4F9E000
stack
page read and write
444E000
stack
page read and write
408E000
stack
page read and write
5211000
heap
page read and write
1DCF0000
heap
page read and write
5211000
heap
page read and write
1DCEF000
heap
page read and write
29D21000
heap
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
1DCE6000
heap
page read and write
19DD000
heap
page read and write
2FF42000
heap
page read and write
1D62E000
stack
page read and write
61EB7000
direct allocation
page readonly
1DCE2000
heap
page read and write
1DCE5000
heap
page read and write
1D86F000
stack
page read and write
61ECD000
direct allocation
page readonly
29D38000
heap
page read and write
1DCE5000
heap
page read and write
5211000
heap
page read and write
E1F000
unkown
page execute and read and write
D6C000
stack
page read and write
19A3000
heap
page read and write
5211000
heap
page read and write
5850000
direct allocation
page execute and read and write
6C7E5000
unkown
page readonly
480E000
stack
page read and write
6C5F2000
unkown
page readonly
5200000
direct allocation
page read and write
1DCE5000
heap
page read and write
29D81000
heap
page read and write
4A8E000
stack
page read and write
5200000
direct allocation
page read and write
1DCE4000
heap
page read and write
EAB000
unkown
page execute and read and write
D90000
unkown
page readonly
1D5EF000
stack
page read and write
5210000
heap
page read and write
1DCD6000
heap
page read and write
5211000
heap
page read and write
5211000
heap
page read and write
1C1E000
stack
page read and write
2FF44000
heap
page read and write
29D61000
heap
page read and write
5200000
direct allocation
page read and write
1A12000
heap
page read and write
There are 359 hidden memdumps, click here to show them.