IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\DGCBKECAKFBGCAKECGIE
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\DGCBKECAKFBGCAKECGIEHDGHCB
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\FCAKFCGCGIEGDGCAAKKJ
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FHIDBKFC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HCAEHJJKFCAAFHJKFBKKEBKECB
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HIIIECAA
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HIIIECAAKECFHIECBKJD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JEBKJDAFHJDGDHJKKEGIJDAKJJ
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllcM
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllr
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll5M
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpa
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpe
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllCB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpj
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllOM
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dlli
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37t
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpB
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllqB
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllX
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php6
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php8
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllgB
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll)M
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 49 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
EA1000
unkown
page execute and read and write
 malicious
4ED0000
direct allocation
page read and write
 malicious
B1E000
heap
page read and write
 malicious
1D50C000
heap
page read and write
B92000
heap
page read and write
1D4F6000
heap
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
1D4F0000
heap
page read and write
4A51000
heap
page read and write
1D4FB000
heap
page read and write
304E000
stack
page read and write
3A0F000
stack
page read and write
1D4F0000
heap
page read and write
1D4E5000
heap
page read and write
1D505000
heap
page read and write
1393000
unkown
page execute and read and write
153F000
unkown
page execute and read and write
106B000
unkown
page execute and read and write
1CF8E000
stack
page read and write
9C4000
heap
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
F25000
unkown
page execute and read and write
1D4E4000
heap
page read and write
32CE000
stack
page read and write
4A51000
heap
page read and write
9C4000
heap
page read and write
1D35E000
stack
page read and write
4A51000
heap
page read and write
1D4E2000
heap
page read and write
4A51000
heap
page read and write
3E0E000
stack
page read and write
9C4000
heap
page read and write
990000
heap
page read and write
1540000
unkown
page execute and write copy
B10000
heap
page read and write
3C8F000
stack
page read and write
4E90000
heap
page read and write
1D4D8000
heap
page read and write
9C4000
heap
page read and write
2962E000
stack
page read and write
10FE000
unkown
page execute and read and write
4A51000
heap
page read and write
1D4F3000
heap
page read and write
9C4000
heap
page read and write
390E000
stack
page read and write
F5D000
unkown
page execute and read and write
9A0000
direct allocation
page read and write
4A51000
heap
page read and write
1D4FD000
heap
page read and write
1D4FD000
heap
page read and write
1065000
unkown
page execute and read and write
9C4000
heap
page read and write
1CF4F000
stack
page read and write
1D4E5000
heap
page read and write
4A51000
heap
page read and write
61ED3000
direct allocation
page read and write
9C0000
heap
page read and write
1D5E0000
trusted library allocation
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
AE0000
direct allocation
page read and write
4A51000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D509000
heap
page read and write
9C4000
heap
page read and write
480E000
stack
page read and write
2E00000
heap
page read and write
4A51000
heap
page read and write
1D4F0000
heap
page read and write
1D4ED000
heap
page read and write
4A51000
heap
page read and write
440F000
stack
page read and write
1D502000
heap
page read and write
4A51000
heap
page read and write
328F000
stack
page read and write
4A51000
heap
page read and write
9C4000
heap
page read and write
9C4000
heap
page read and write
5C0000
heap
page read and write
29521000
heap
page read and write
61ED4000
direct allocation
page readonly
1D4D6000
heap
page read and write
1D509000
heap
page read and write
4A57000
heap
page read and write
6C81F000
unkown
page readonly
1D1CF000
stack
page read and write
4A51000
heap
page read and write
1D4FC000
heap
page read and write
4A51000
heap
page read and write
1D31C000
stack
page read and write
4A51000
heap
page read and write
1D4EC000
heap
page read and write
314F000
stack
page read and write
1D4ED000
heap
page read and write
494E000
stack
page read and write
61EB7000
direct allocation
page readonly
4A51000
heap
page read and write
1D4FC000
heap
page read and write
1D4F0000
heap
page read and write
1D4E5000
heap
page read and write
1D4EC000
heap
page read and write
4A51000
heap
page read and write
6F8ED000
unkown
page readonly
9A0000
direct allocation
page read and write
1CE0F000
stack
page read and write
EFA000
unkown
page execute and read and write
4A51000
heap
page read and write
1D4E7000
heap
page read and write
BDD000
heap
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
9C4000
heap
page read and write
9C4000
heap
page read and write
4A51000
heap
page read and write
29529000
heap
page read and write
9A0000
direct allocation
page read and write
3DCF000
stack
page read and write
1D4FC000
heap
page read and write
297D5000
heap
page read and write
9C4000
heap
page read and write
1D4F0000
heap
page read and write
42CF000
stack
page read and write
F32000
unkown
page execute and read and write
29583000
heap
page read and write
29536000
heap
page read and write
9A0000
direct allocation
page read and write
B77000
heap
page read and write
297D7000
heap
page read and write
9C4000
heap
page read and write
AE0000
direct allocation
page read and write
AF0000
direct allocation
page execute and read and write
B18000
heap
page read and write
1D4FE000
heap
page read and write
9C4000
heap
page read and write
454F000
stack
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
1D509000
heap
page read and write
4F0C000
stack
page read and write
1D4D6000
heap
page read and write
4A51000
heap
page read and write
1D4F0000
heap
page read and write
9A0000
direct allocation
page read and write
1D4EC000
heap
page read and write
4A51000
heap
page read and write
46CE000
stack
page read and write
D0E000
stack
page read and write
4A51000
heap
page read and write
29500000
heap
page read and write
4A51000
heap
page read and write
294C0000
heap
page read and write
33CF000
stack
page read and write
364F000
stack
page read and write
9C4000
heap
page read and write
1D4FB000
heap
page read and write
1D4F0000
heap
page read and write
ADE000
stack
page read and write
1D4D6000
heap
page read and write
9C4000
heap
page read and write
294E0000
heap
page read and write
4A51000
heap
page read and write
1D4F0000
heap
page read and write
9C4000
heap
page read and write
1D509000
heap
page read and write
2DF0000
direct allocation
page execute and read and write
1D4E7000
heap
page read and write
9C4000
heap
page read and write
9A0000
direct allocation
page read and write
1D4D6000
heap
page read and write
BD2000
heap
page read and write
4A51000
heap
page read and write
458E000
stack
page read and write
F51000
unkown
page execute and read and write
4A51000
heap
page read and write
6C85F000
unkown
page write copy
4A51000
heap
page read and write
3B8E000
stack
page read and write
1D4E8000
heap
page read and write
1D4F0000
heap
page read and write
1D4CB000
heap
page read and write
13A2000
unkown
page execute and write copy
6C865000
unkown
page readonly
E8E000
stack
page read and write
1D4F0000
heap
page read and write
3F0F000
stack
page read and write
9C4000
heap
page read and write
1D4F7000
heap
page read and write
4A60000
heap
page read and write
1D50A000
heap
page read and write
9C4000
heap
page read and write
297DB000
heap
page read and write
1D4E2000
heap
page read and write
6F871000
unkown
page execute read
4A51000
heap
page read and write
4E90000
trusted library allocation
page read and write
444E000
stack
page read and write
9C4000
heap
page read and write
2355A000
heap
page read and write
8FD000
stack
page read and write
1D4FB000
heap
page read and write
61ECC000
direct allocation
page read and write
9C4000
heap
page read and write
97E000
stack
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
5B0000
heap
page read and write
1288000
unkown
page execute and read and write
354E000
stack
page read and write
318E000
stack
page read and write
B65000
heap
page read and write
4A51000
heap
page read and write
9C4000
heap
page read and write
1D4E7000
heap
page read and write
2E0E000
heap
page read and write
1D4F3000
heap
page read and write
4A51000
heap
page read and write
297CF000
heap
page read and write
E4B000
stack
page read and write
1D21E000
stack
page read and write
1D4F0000
heap
page read and write
368E000
stack
page read and write
BEF000
heap
page read and write
300F000
stack
page read and write
4A70000
heap
page read and write
4A51000
heap
page read and write
6C680000
unkown
page readonly
9C4000
heap
page read and write
9C4000
heap
page read and write
9C4000
heap
page read and write
2DEF000
stack
page read and write
8F4000
stack
page read and write
3A4E000
stack
page read and write
418F000
stack
page read and write
3B4F000
stack
page read and write
404F000
stack
page read and write
61E01000
direct allocation
page execute read
1D509000
heap
page read and write
4A51000
heap
page read and write
1D4E5000
heap
page read and write
61EB4000
direct allocation
page read and write
9C4000
heap
page read and write
2953D000
heap
page read and write
93D000
stack
page read and write
8F8000
stack
page read and write
F28000
unkown
page execute and read and write
1D4F0000
heap
page read and write
1D08E000
stack
page read and write
297CD000
heap
page read and write
4A51000
heap
page read and write
1D4EB000
heap
page read and write
1D4ED000
heap
page read and write
61ECD000
direct allocation
page readonly
47CF000
stack
page read and write
378F000
stack
page read and write
13A2000
unkown
page execute and read and write
4A4F000
stack
page read and write
1D50C000
heap
page read and write
9A0000
direct allocation
page read and write
9A0000
direct allocation
page read and write
2E0B000
heap
page read and write
6C860000
unkown
page read and write
1D4F0000
heap
page read and write
5010000
direct allocation
page execute and read and write
BE4000
heap
page read and write
1D4E7000
heap
page read and write
1D4E7000
heap
page read and write
29524000
heap
page read and write
4A51000
heap
page read and write
1D4F0000
heap
page read and write
4A51000
heap
page read and write
1D4F0000
heap
page read and write
13A3000
unkown
page execute and write copy
37CE000
stack
page read and write
4A51000
heap
page read and write
9C4000
heap
page read and write
1D4E5000
heap
page read and write
350F000
stack
page read and write
9C4000
heap
page read and write
29530000
heap
page read and write
1D4F3000
heap
page read and write
9C4000
heap
page read and write
29730000
trusted library allocation
page read and write
2E07000
heap
page read and write
4A51000
heap
page read and write
1D4D6000
heap
page read and write
55C000
stack
page read and write
1D4F0000
heap
page read and write
1D4FC000
heap
page read and write
41CE000
stack
page read and write
1368000
unkown
page execute and read and write
6F870000
unkown
page readonly
EA1000
unkown
page execute and write copy
FBB000
unkown
page execute and read and write
3F4E000
stack
page read and write
1D0CE000
stack
page read and write
BD7000
heap
page read and write
1CD0E000
stack
page read and write
4A51000
heap
page read and write
9A0000
direct allocation
page read and write
9C4000
heap
page read and write
1D4C0000
heap
page read and write
1D4C2000
heap
page read and write
BCC000
heap
page read and write
138C000
unkown
page execute and read and write
500F000
stack
page read and write
1D4FD000
heap
page read and write
1D45D000
stack
page read and write
4A51000
heap
page read and write
4A51000
heap
page read and write
EA0000
unkown
page readonly
1D4E5000
heap
page read and write
1D509000
heap
page read and write
2F0F000
stack
page read and write
2DF0000
direct allocation
page execute and read and write
38CF000
stack
page read and write
9C4000
heap
page read and write
4A50000
heap
page read and write
1045000
unkown
page execute and read and write
1D505000
heap
page read and write
468F000
stack
page read and write
E0F000
stack
page read and write
1D50C000
heap
page read and write
4A51000
heap
page read and write
1D4EC000
heap
page read and write
6C681000
unkown
page execute read
4A51000
heap
page read and write
9A0000
direct allocation
page read and write
1D509000
heap
page read and write
9A0000
direct allocation
page read and write
1D4F0000
heap
page read and write
4A51000
heap
page read and write
6F902000
unkown
page readonly
1D4E5000
heap
page read and write
340E000
stack
page read and write
408D000
stack
page read and write
9A0000
direct allocation
page read and write
E90000
direct allocation
page execute and read and write
1D4E5000
heap
page read and write
1D4ED000
heap
page read and write
F2F000
unkown
page execute and read and write
61ED0000
direct allocation
page read and write
4A51000
heap
page read and write
2972F000
stack
page read and write
FBE000
unkown
page execute and read and write
BE9000
heap
page read and write
1D4F0000
heap
page read and write
9C4000
heap
page read and write
9C4000
heap
page read and write
1D4E2000
heap
page read and write
6F8FE000
unkown
page read and write
4A51000
heap
page read and write
9A0000
direct allocation
page read and write
6C85E000
unkown
page read and write
9C4000
heap
page read and write
430E000
stack
page read and write
B00000
direct allocation
page execute and read and write
5020000
direct allocation
page execute and read and write
EA0000
unkown
page read and write
1D509000
heap
page read and write
BEA000
heap
page read and write
1CE4E000
stack
page read and write
1D50C000
heap
page read and write
FAF000
unkown
page execute and read and write
9C4000
heap
page read and write
4A51000
heap
page read and write
1D509000
heap
page read and write
1D50C000
heap
page read and write
1D4D5000
heap
page read and write
1D5E6000
heap
page read and write
3CCE000
stack
page read and write
F82000
unkown
page execute and read and write
490F000
stack
page read and write
4A51000
heap
page read and write
9A0000
direct allocation
page read and write
9C4000
heap
page read and write
8F2000
stack
page read and write
5030000
direct allocation
page execute and read and write
There are 369 hidden memdumps, click here to show them.