IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAFIDGCFHIEHJJJJECAKKJDBAF
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DGCBAFIJDGHCAKECAEGCAAKEHD
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\HIEHDAFHDHCBFIDGCFIDGHJDGD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IJDBKKJKJEBFBGCBAAFIJKJKJJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IJDHDGDA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JJEGCBGIDHCAKEBGIIDB
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\JJKFBAKFBGDHIEBGDAKF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JKFIDGDHJEGIEBFHDGDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KEHCGCGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/e2b1563c6670f193.phpnx
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpata
unknown
 malicious
http://185.215.113.37/X
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllD
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCash
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllH
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpo
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpJx
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll4
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php1xi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpe
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllu
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpg
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpK
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll2
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpirefox
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll~
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php;
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllh
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpXx
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpG
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3x
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllp
unknown
 malicious
http://185.215.113.37/1
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
There are 50 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
171.39.242.20.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
5050000
direct allocation
page read and write
 malicious
14BE000
heap
page read and write
 malicious
9F1000
unkown
page execute and read and write
 malicious
9E4000
heap
page read and write
1490000
direct allocation
page read and write
AAD000
unkown
page execute and read and write
4BD1000
heap
page read and write
9E4000
heap
page read and write
1D52D000
stack
page read and write
4BD1000
heap
page read and write
1D6A6000
heap
page read and write
3F4F000
stack
page read and write
1D15E000
stack
page read and write
444F000
stack
page read and write
1490000
direct allocation
page read and write
2F91B000
heap
page read and write
6CD0F000
unkown
page readonly
358E000
stack
page read and write
4BD1000
heap
page read and write
4BD1000
heap
page read and write
BB5000
unkown
page execute and read and write
508B000
stack
page read and write
2970F000
heap
page read and write
159F000
heap
page read and write
9E4000
heap
page read and write
1D6DD000
heap
page read and write
6CB62000
unkown
page readonly
1D3AF000
stack
page read and write
156F000
heap
page read and write
EE3000
unkown
page execute and write copy
1D6B4000
heap
page read and write
1D6B2000
heap
page read and write
31CE000
stack
page read and write
61ED4000
direct allocation
page readonly
11FD000
stack
page read and write
1D6A5000
heap
page read and write
2F912000
heap
page read and write
1D6C0000
heap
page read and write
29752000
heap
page read and write
6CB71000
unkown
page execute read
A4A000
unkown
page execute and read and write
4BD1000
heap
page read and write
1D6A6000
heap
page read and write
2F75E000
stack
page read and write
1D6AD000
heap
page read and write
14B0000
heap
page read and write
1490000
direct allocation
page read and write
EE4000
unkown
page execute and write copy
A82000
unkown
page execute and read and write
4BD1000
heap
page read and write
29690000
heap
page read and write
1D6C3000
heap
page read and write
4BD1000
heap
page read and write
9D0000
heap
page read and write
A78000
unkown
page execute and read and write
1D6C0000
heap
page read and write
B0E000
unkown
page execute and read and write
6CD4E000
unkown
page read and write
4BD1000
heap
page read and write
61ED3000
direct allocation
page read and write
4BD1000
heap
page read and write
EE3000
unkown
page execute and read and write
9E4000
heap
page read and write
1D3ED000
stack
page read and write
1490000
direct allocation
page read and write
5030000
heap
page read and write
1D6BA000
heap
page read and write
394E000
stack
page read and write
4BD1000
heap
page read and write
6CD55000
unkown
page readonly
ECC000
unkown
page execute and read and write
296F7000
heap
page read and write
458F000
stack
page read and write
4BD1000
heap
page read and write
1D6B7000
heap
page read and write
4BD1000
heap
page read and write
107B000
unkown
page execute and write copy
1574000
heap
page read and write
6CB70000
unkown
page readonly
4BD1000
heap
page read and write
147C000
stack
page read and write
1D6BF000
heap
page read and write
3D0E000
stack
page read and write
1D6B2000
heap
page read and write
2F85F000
stack
page read and write
4BD1000
heap
page read and write
1490000
direct allocation
page read and write
32CF000
stack
page read and write
51E0000
direct allocation
page execute and read and write
1D6C4000
heap
page read and write
1D6A5000
heap
page read and write
4BD1000
heap
page read and write
1490000
direct allocation
page read and write
4BD1000
heap
page read and write
434E000
stack
page read and write
4BD1000
heap
page read and write
1D6C0000
heap
page read and write
9E4000
heap
page read and write
1D6BA000
heap
page read and write
1D25F000
stack
page read and write
46CF000
stack
page read and write
1D692000
heap
page read and write
9E4000
heap
page read and write
448E000
stack
page read and write
4BD1000
heap
page read and write
1D6C6000
heap
page read and write
1D6C3000
heap
page read and write
9E4000
heap
page read and write
4BD1000
heap
page read and write
4BD1000
heap
page read and write
4BD1000
heap
page read and write
6CB4D000
unkown
page readonly
ADF000
unkown
page execute and read and write
9F0000
unkown
page read and write
9E4000
heap
page read and write
EA7000
unkown
page execute and read and write
3BCE000
stack
page read and write
4BD1000
heap
page read and write
1D6CD000
heap
page read and write
296D0000
heap
page read and write
1D11F000
stack
page read and write
3E4E000
stack
page read and write
3B8F000
stack
page read and write
4BD1000
heap
page read and write
1D690000
heap
page read and write
1D6C0000
heap
page read and write
4CD0000
trusted library allocation
page read and write
4BD1000
heap
page read and write
1586000
heap
page read and write
5050000
direct allocation
page read and write
1579000
heap
page read and write
498E000
stack
page read and write
1D6AA000
heap
page read and write
9E4000
heap
page read and write
1D6DD000
heap
page read and write
4A8F000
stack
page read and write
1D6BA000
heap
page read and write
4BE7000
heap
page read and write
9E4000
heap
page read and write
4BE0000
heap
page read and write
1D6BC000
heap
page read and write
1D6A6000
heap
page read and write
10BE000
stack
page read and write
1D6C0000
heap
page read and write
1D6B4000
heap
page read and write
B95000
unkown
page execute and read and write
470E000
stack
page read and write
9E4000
heap
page read and write
1D6DD000
heap
page read and write
6CD4F000
unkown
page write copy
1D6C0000
heap
page read and write
4BD1000
heap
page read and write
1D6DD000
heap
page read and write
1D6BE000
heap
page read and write
368F000
stack
page read and write
1D6DD000
heap
page read and write
484E000
stack
page read and write
4BD1000
heap
page read and write
1D6DD000
heap
page read and write
1490000
direct allocation
page read and write
1D6BA000
heap
page read and write
9E4000
heap
page read and write
1D69B000
heap
page read and write
9F1000
unkown
page execute and write copy
ED5000
unkown
page execute and read and write
1D6B9000
heap
page read and write
6CAD1000
unkown
page execute read
9E4000
heap
page read and write
843000
stack
page read and write
4BD1000
heap
page read and write
9E4000
heap
page read and write
1503000
heap
page read and write
1490000
direct allocation
page read and write
304F000
stack
page read and write
4BD1000
heap
page read and write
380E000
stack
page read and write
1D6CB000
heap
page read and write
1CFDF000
stack
page read and write
9E4000
heap
page read and write
9E4000
heap
page read and write
344E000
stack
page read and write
9E4000
heap
page read and write
AFF000
unkown
page execute and read and write
45CE000
stack
page read and write
6CB5E000
unkown
page read and write
151A000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D6B9000
heap
page read and write
4BD1000
heap
page read and write
9E4000
heap
page read and write
A75000
unkown
page execute and read and write
318F000
stack
page read and write
41CF000
stack
page read and write
9E4000
heap
page read and write
4BD1000
heap
page read and write
8A0000
heap
page read and write
1D6DD000
heap
page read and write
3E0F000
stack
page read and write
3A8E000
stack
page read and write
1D6C8000
heap
page read and write
1D6B5000
heap
page read and write
1490000
direct allocation
page read and write
29709000
heap
page read and write
4BD1000
heap
page read and write
29732000
heap
page read and write
296F0000
heap
page read and write
9E4000
heap
page read and write
1D6AD000
heap
page read and write
1D6CB000
heap
page read and write
29712000
heap
page read and write
1D6DD000
heap
page read and write
C3A000
unkown
page execute and read and write
61ED0000
direct allocation
page read and write
1D6B8000
heap
page read and write
4BD0000
heap
page read and write
2F90D000
heap
page read and write
1D6BA000
heap
page read and write
1D6DD000
heap
page read and write
9F0000
unkown
page readonly
1D6BF000
heap
page read and write
B0B000
unkown
page execute and read and write
4BD1000
heap
page read and write
1D6A6000
heap
page read and write
4BD1000
heap
page read and write
1D6B8000
heap
page read and write
143E000
stack
page read and write
61EB7000
direct allocation
page readonly
4BD1000
heap
page read and write
4BD1000
heap
page read and write
4BD1000
heap
page read and write
1D6C0000
heap
page read and write
420D000
stack
page read and write
1D6CF000
heap
page read and write
14BA000
heap
page read and write
51F0000
direct allocation
page execute and read and write
1490000
direct allocation
page read and write
1D6B0000
heap
page read and write
3CCF000
stack
page read and write
51A0000
direct allocation
page execute and read and write
1D4ED000
stack
page read and write
1D6B4000
heap
page read and write
4BD1000
heap
page read and write
61EB4000
direct allocation
page read and write
9E4000
heap
page read and write
4BD1000
heap
page read and write
1D6A6000
heap
page read and write
1D6C0000
heap
page read and write
1D6B8000
heap
page read and write
1D6DD000
heap
page read and write
4BD1000
heap
page read and write
11BE000
stack
page read and write
1D6B2000
heap
page read and write
494F000
stack
page read and write
296F3000
heap
page read and write
1534000
heap
page read and write
1D6C0000
heap
page read and write
2F915000
heap
page read and write
51D0000
direct allocation
page execute and read and write
9D7000
heap
page read and write
6CD50000
unkown
page read and write
1D62D000
stack
page read and write
4BD1000
heap
page read and write
4BD1000
heap
page read and write
1D6BB000
heap
page read and write
296FD000
heap
page read and write
354F000
stack
page read and write
390F000
stack
page read and write
40CE000
stack
page read and write
4BF0000
heap
page read and write
1567000
heap
page read and write
296F5000
heap
page read and write
9E4000
heap
page read and write
1D6BC000
heap
page read and write
1D6A6000
heap
page read and write
9E4000
heap
page read and write
430F000
stack
page read and write
4BD1000
heap
page read and write
107A000
unkown
page execute and read and write
18AE000
stack
page read and write
518F000
stack
page read and write
4BD1000
heap
page read and write
480F000
stack
page read and write
9E4000
heap
page read and write
296B0000
heap
page read and write
9E4000
heap
page read and write
61ECC000
direct allocation
page read and write
330E000
stack
page read and write
9E4000
heap
page read and write
1D6DC000
heap
page read and write
4BD1000
heap
page read and write
9DE000
heap
page read and write
1D6C0000
heap
page read and write
1490000
direct allocation
page read and write
4BD1000
heap
page read and write
4BCF000
stack
page read and write
4BD1000
heap
page read and write
4ACE000
stack
page read and write
4BD1000
heap
page read and write
37CF000
stack
page read and write
1D6BA000
heap
page read and write
4BD1000
heap
page read and write
9E4000
heap
page read and write
1D6C0000
heap
page read and write
4BD1000
heap
page read and write
9E4000
heap
page read and write
51C0000
direct allocation
page execute and read and write
9E4000
heap
page read and write
1D6BA000
heap
page read and write
340F000
stack
page read and write
3F8E000
stack
page read and write
4BD1000
heap
page read and write
1D6AD000
heap
page read and write
4BD1000
heap
page read and write
51B0000
direct allocation
page execute and read and write
4BD1000
heap
page read and write
BBB000
unkown
page execute and read and write
408F000
stack
page read and write
9E4000
heap
page read and write
36CE000
stack
page read and write
1D6AC000
heap
page read and write
1D6B4000
heap
page read and write
4BD1000
heap
page read and write
1D7B0000
trusted library allocation
page read and write
2F4F000
stack
page read and write
1D6BA000
heap
page read and write
51D0000
direct allocation
page execute and read and write
1D6C0000
heap
page read and write
9E4000
heap
page read and write
308E000
stack
page read and write
2F91A000
heap
page read and write
4BD1000
heap
page read and write
9E4000
heap
page read and write
5050000
direct allocation
page read and write
1D7BC000
heap
page read and write
4BD1000
heap
page read and write
1D6B5000
heap
page read and write
1580000
heap
page read and write
4BD1000
heap
page read and write
1490000
direct allocation
page read and write
980000
heap
page read and write
4BD1000
heap
page read and write
1D2AE000
stack
page read and write
AA1000
unkown
page execute and read and write
9E4000
heap
page read and write
9E4000
heap
page read and write
9E4000
heap
page read and write
29706000
heap
page read and write
9E0000
heap
page read and write
1480000
heap
page read and write
4BD1000
heap
page read and write
4BD1000
heap
page read and write
A7F000
unkown
page execute and read and write
23721000
heap
page read and write
AD2000
unkown
page execute and read and write
1D6A6000
heap
page read and write
3A4F000
stack
page read and write
1D6C0000
heap
page read and write
4BD1000
heap
page read and write
1D6B5000
heap
page read and write
1D6C0000
heap
page read and write
9E4000
heap
page read and write
5200000
direct allocation
page execute and read and write
1D6B8000
heap
page read and write
4BD1000
heap
page read and write
1D6C7000
heap
page read and write
1490000
direct allocation
page read and write
849000
stack
page read and write
9E4000
heap
page read and write
1D6C0000
heap
page read and write
61E01000
direct allocation
page execute read
4BD1000
heap
page read and write
C4E000
unkown
page execute and read and write
2F870000
trusted library allocation
page read and write
DCF000
unkown
page execute and read and write
1D6BA000
heap
page read and write
4BD1000
heap
page read and write
1D6A5000
heap
page read and write
1D01E000
stack
page read and write
1D6B4000
heap
page read and write
1CEDE000
stack
page read and write
6CAD0000
unkown
page readonly
74C000
stack
page read and write
1490000
direct allocation
page read and write
84D000
stack
page read and write
61ECD000
direct allocation
page readonly
9DB000
heap
page read and write
There are 376 hidden memdumps, click here to show them.