IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKJDGIEHCAEHIEBFBKKK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\CFIEBKEHCAKFCBFIDAAKJDAAFC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DAEGIIECGHCBFHJKEHDB
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\DGCAAAFC
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\ECGHCBGCBFHIIDHIJKFB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EGDAEBGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IJKFCFHJDBKKFHIEHIDGCFCAEB
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\JEHDHIEGIIIDHIDHDHJJKJKJJD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/ik
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpNT
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpp?
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37D
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll4
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phps
unknown
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllF
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllJ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllX
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpERmi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dlln
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpVB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpHzibE
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllr
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpes
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllX
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlld
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll&
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://ac.ecopnacl
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://ac.ecop
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 52 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
198.187.3.20.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4F50000
direct allocation
page read and write
 malicious
A3E000
heap
page read and write
 malicious
1001000
unkown
page execute and read and write
 malicious
2980E000
stack
page read and write
1D5B8000
heap
page read and write
295C2000
heap
page read and write
2F0F000
stack
page read and write
1D59C000
heap
page read and write
10B1000
unkown
page execute and read and write
4AC1000
heap
page read and write
1D5A0000
heap
page read and write
4AC1000
heap
page read and write
344E000
stack
page read and write
4AB0000
direct allocation
page read and write
318F000
stack
page read and write
1D592000
heap
page read and write
4AC1000
heap
page read and write
3A8E000
stack
page read and write
408F000
stack
page read and write
394E000
stack
page read and write
1D5A0000
heap
page read and write
4AC1000
heap
page read and write
444F000
stack
page read and write
4AC1000
heap
page read and write
2E0B000
stack
page read and write
1D586000
heap
page read and write
61ECC000
direct allocation
page read and write
1D570000
heap
page read and write
4AC1000
heap
page read and write
46CF000
stack
page read and write
111B000
unkown
page execute and read and write
6C5C1000
unkown
page execute read
1D11E000
stack
page read and write
4AC1000
heap
page read and write
1D586000
heap
page read and write
1D5A0000
heap
page read and write
1092000
unkown
page execute and read and write
4AC1000
heap
page read and write
10BD000
unkown
page execute and read and write
4AB0000
direct allocation
page read and write
4AC1000
heap
page read and write
23607000
heap
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
1D595000
heap
page read and write
1D5B4000
heap
page read and write
A96000
heap
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
1D5A0000
heap
page read and write
4F8B000
stack
page read and write
50A0000
direct allocation
page execute and read and write
11A5000
unkown
page execute and read and write
6C840000
unkown
page read and write
4AC1000
heap
page read and write
3E0F000
stack
page read and write
4AC1000
heap
page read and write
1D40D000
stack
page read and write
4AB0000
direct allocation
page read and write
4AC1000
heap
page read and write
A1D000
stack
page read and write
470E000
stack
page read and write
3CCF000
stack
page read and write
299BC000
heap
page read and write
1D595000
heap
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
1D5A0000
heap
page read and write
1D595000
heap
page read and write
1D5BC000
heap
page read and write
4AC1000
heap
page read and write
970000
heap
page read and write
4AC1000
heap
page read and write
4A8F000
stack
page read and write
4AC1000
heap
page read and write
296CE000
stack
page read and write
1D5B9000
heap
page read and write
1D5BC000
heap
page read and write
1D5A0000
heap
page read and write
2C70000
heap
page read and write
1D5A0000
heap
page read and write
1D5BC000
heap
page read and write
1D5AD000
heap
page read and write
61ED0000
direct allocation
page read and write
16AB000
unkown
page execute and write copy
1D59B000
heap
page read and write
9DE000
stack
page read and write
1D59C000
heap
page read and write
1D5B8000
heap
page read and write
4AC1000
heap
page read and write
2CCE000
stack
page read and write
4AC1000
heap
page read and write
4AD0000
heap
page read and write
14CC000
unkown
page execute and read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
1D596000
heap
page read and write
1D5A0000
heap
page read and write
14EF000
unkown
page execute and read and write
36CE000
stack
page read and write
4AB0000
direct allocation
page read and write
297CD000
stack
page read and write
4AC1000
heap
page read and write
1D5B4000
heap
page read and write
4AC1000
heap
page read and write
1508000
unkown
page execute and read and write
340F000
stack
page read and write
CFF000
stack
page read and write
1D5A0000
heap
page read and write
2C87000
heap
page read and write
4AC1000
heap
page read and write
390F000
stack
page read and write
308E000
stack
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
50C0000
direct allocation
page execute and read and write
3D0E000
stack
page read and write
1D5A6000
heap
page read and write
420E000
stack
page read and write
1D5AC000
heap
page read and write
61ED4000
direct allocation
page readonly
1CFDF000
stack
page read and write
448E000
stack
page read and write
4AC1000
heap
page read and write
1D585000
heap
page read and write
494F000
stack
page read and write
108F000
unkown
page execute and read and write
6C63D000
unkown
page readonly
A81000
heap
page read and write
105A000
unkown
page execute and read and write
1001000
unkown
page execute and write copy
4AB0000
direct allocation
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
1D5A0000
heap
page read and write
2990E000
stack
page read and write
1000000
unkown
page read and write
31CE000
stack
page read and write
1D5AC000
heap
page read and write
4AC1000
heap
page read and write
1D594000
heap
page read and write
1D17E000
stack
page read and write
1D588000
heap
page read and write
304F000
stack
page read and write
430F000
stack
page read and write
1D5B9000
heap
page read and write
4AC1000
heap
page read and write
3BCE000
stack
page read and write
1D27F000
stack
page read and write
4AB0000
direct allocation
page read and write
938000
stack
page read and write
1D59B000
heap
page read and write
4AC1000
heap
page read and write
1D59D000
heap
page read and write
4AB0000
direct allocation
page read and write
480F000
stack
page read and write
1000000
unkown
page readonly
484E000
stack
page read and write
4AC1000
heap
page read and write
16AA000
unkown
page execute and read and write
A38000
heap
page read and write
1D5A0000
heap
page read and write
4F00000
trusted library allocation
page read and write
61ECD000
direct allocation
page readonly
1D592000
heap
page read and write
4AC1000
heap
page read and write
1D5A0000
heap
page read and write
4AED000
heap
page read and write
4AB0000
direct allocation
page read and write
1D2CD000
stack
page read and write
61ED3000
direct allocation
page read and write
6C845000
unkown
page readonly
DFE000
stack
page read and write
1D5AD000
heap
page read and write
5100000
direct allocation
page execute and read and write
4AC1000
heap
page read and write
1D59C000
heap
page read and write
1509000
unkown
page execute and write copy
6C661000
unkown
page execute read
2F4E000
stack
page read and write
960000
heap
page read and write
4AC1000
heap
page read and write
299CB000
heap
page read and write
1D5A0000
heap
page read and write
3F8E000
stack
page read and write
6C64E000
unkown
page read and write
4AC1000
heap
page read and write
3E4E000
stack
page read and write
299C5000
heap
page read and write
1D586000
heap
page read and write
1D597000
heap
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
50F0000
direct allocation
page execute and read and write
1D5B9000
heap
page read and write
368F000
stack
page read and write
1D5AC000
heap
page read and write
6C83F000
unkown
page write copy
4AC1000
heap
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
4F50000
direct allocation
page read and write
50B0000
direct allocation
page execute and read and write
4AC1000
heap
page read and write
61E01000
direct allocation
page execute read
4AC1000
heap
page read and write
4AC1000
heap
page read and write
93D000
stack
page read and write
1D5AC000
heap
page read and write
4AC1000
heap
page read and write
A20000
heap
page read and write
1D5B4000
heap
page read and write
1D5A3000
heap
page read and write
4AC1000
heap
page read and write
4AC0000
heap
page read and write
40CE000
stack
page read and write
4AC1000
heap
page read and write
932000
stack
page read and write
1D5B9000
heap
page read and write
1CE9F000
stack
page read and write
11CB000
unkown
page execute and read and write
4A90000
heap
page read and write
1D595000
heap
page read and write
2DCF000
stack
page read and write
29920000
trusted library allocation
page read and write
498E000
stack
page read and write
4AB0000
direct allocation
page read and write
AC1000
heap
page read and write
1D50C000
stack
page read and write
6C660000
unkown
page readonly
50E0000
direct allocation
page execute and read and write
1508000
unkown
page execute and write copy
6C83E000
unkown
page read and write
AB1000
heap
page read and write
1D5AE000
heap
page read and write
1D59D000
heap
page read and write
4AC1000
heap
page read and write
4AED000
heap
page read and write
1D5A0000
heap
page read and write
61E00000
direct allocation
page execute and read and write
295B1000
heap
page read and write
50D0000
direct allocation
page execute and read and write
4AC1000
heap
page read and write
110F000
unkown
page execute and read and write
299C4000
heap
page read and write
1D5A3000
heap
page read and write
1085000
unkown
page execute and read and write
1D01E000
stack
page read and write
A30000
heap
page read and write
41CF000
stack
page read and write
1D572000
heap
page read and write
1D59D000
heap
page read and write
14FA000
unkown
page execute and read and write
10E2000
unkown
page execute and read and write
2C8E000
heap
page read and write
508F000
stack
page read and write
125E000
unkown
page execute and read and write
29590000
heap
page read and write
1D586000
heap
page read and write
61EB7000
direct allocation
page readonly
1D5B8000
heap
page read and write
4AB0000
direct allocation
page read and write
354F000
stack
page read and write
6C7FF000
unkown
page readonly
1D5B8000
heap
page read and write
4AC1000
heap
page read and write
1D5B2000
heap
page read and write
1D694000
heap
page read and write
4AB0000
direct allocation
page read and write
4AB0000
direct allocation
page read and write
1D5B4000
heap
page read and write
4AB0000
direct allocation
page read and write
1D5A0000
heap
page read and write
4AC1000
heap
page read and write
1D595000
heap
page read and write
83C000
stack
page read and write
4AC1000
heap
page read and write
458F000
stack
page read and write
1D595000
heap
page read and write
1D5B8000
heap
page read and write
1D5BC000
heap
page read and write
434E000
stack
page read and write
3F4F000
stack
page read and write
1D57B000
heap
page read and write
1D5B5000
heap
page read and write
1CEDE000
stack
page read and write
4AC5000
heap
page read and write
3B8F000
stack
page read and write
1D595000
heap
page read and write
1D3CD000
stack
page read and write
6C5C0000
unkown
page readonly
1D5B5000
heap
page read and write
4AB0000
direct allocation
page read and write
1D592000
heap
page read and write
1D59C000
heap
page read and write
4AE0000
heap
page read and write
29623000
heap
page read and write
4AC1000
heap
page read and write
380E000
stack
page read and write
1D586000
heap
page read and write
10EF000
unkown
page execute and read and write
1D5AD000
heap
page read and write
1D598000
heap
page read and write
45CE000
stack
page read and write
2C80000
heap
page read and write
1D595000
heap
page read and write
37CF000
stack
page read and write
61EB4000
direct allocation
page read and write
1D597000
heap
page read and write
11C5000
unkown
page execute and read and write
1088000
unkown
page execute and read and write
299BD000
heap
page read and write
4AC1000
heap
page read and write
3A4F000
stack
page read and write
1D5BC000
heap
page read and write
13EE000
unkown
page execute and read and write
4AC1000
heap
page read and write
358E000
stack
page read and write
1D690000
trusted library allocation
page read and write
4AC1000
heap
page read and write
A25000
heap
page read and write
2C8B000
heap
page read and write
4AC1000
heap
page read and write
50D0000
direct allocation
page execute and read and write
330E000
stack
page read and write
50DE000
stack
page read and write
4AC1000
heap
page read and write
1D5A7000
heap
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
4AC1000
heap
page read and write
29570000
heap
page read and write
6C652000
unkown
page readonly
4AC1000
heap
page read and write
4F50000
direct allocation
page read and write
1D5B9000
heap
page read and write
1D59E000
heap
page read and write
32CF000
stack
page read and write
There are 331 hidden memdumps, click here to show them.