IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAAKEBGDAFHIIDHIIECFBKFIJK
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BGIJJKKJJDAAAAAKFHJJDGDAFB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DBGIJEHIIDGCFHIEGDGCBFHDBA
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\DGHIDHCAAKECGCBFIJDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GDBFCGII
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HJJKJJDHCGCAECAAECFH
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IECFBKFH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IEHDBGDHDAECBGDHJKFI
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll3
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime
unknown
 malicious
http://185.215.113.37JJDHIE--
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpVi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllK
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpBzi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpo
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll%
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phps
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpz
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php6o
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dlla
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllE~4
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdllsi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllO
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpoei
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php;i
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpW
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpHi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpfAi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFirefox
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllY
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 53 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
171E000
heap
page read and write
 malicious
5570000
direct allocation
page read and write
 malicious
BE1000
unkown
page execute and read and write
 malicious
56AF000
stack
page read and write
50E0000
heap
page read and write
17EB000
heap
page read and write
C72000
unkown
page execute and read and write
16B4000
heap
page read and write
359E000
stack
page read and write
61E01000
direct allocation
page execute read
16B4000
heap
page read and write
55AB000
stack
page read and write
1DBCC000
heap
page read and write
32C0000
direct allocation
page read and write
1660000
heap
page read and write
1DBD0000
heap
page read and write
DA5000
unkown
page execute and read and write
DAB000
unkown
page execute and read and write
50E1000
heap
page read and write
1DBC2000
heap
page read and write
6C81F000
unkown
page readonly
50E1000
heap
page read and write
1D3EE000
stack
page read and write
CC2000
unkown
page execute and read and write
3F5F000
stack
page read and write
10AB000
unkown
page execute and read and write
50E1000
heap
page read and write
1DBD6000
heap
page read and write
1DBE5000
heap
page read and write
1DBD0000
heap
page read and write
32DE000
heap
page read and write
32C0000
direct allocation
page read and write
16B4000
heap
page read and write
1DBD0000
heap
page read and write
32D0000
heap
page read and write
1DBD0000
heap
page read and write
1DBC5000
heap
page read and write
128B000
unkown
page execute and read and write
50E1000
heap
page read and write
1777000
heap
page read and write
23C3D000
heap
page read and write
1DBC2000
heap
page read and write
1DBE2000
heap
page read and write
50E1000
heap
page read and write
1DBC5000
heap
page read and write
29DFF000
stack
page read and write
16B0000
heap
page read and write
1DBD0000
heap
page read and write
17DF000
heap
page read and write
1DBDD000
heap
page read and write
1DBE9000
heap
page read and write
50E1000
heap
page read and write
50E1000
heap
page read and write
50E1000
heap
page read and write
16B4000
heap
page read and write
CFB000
unkown
page execute and read and write
50E1000
heap
page read and write
50E1000
heap
page read and write
391F000
stack
page read and write
50E1000
heap
page read and write
1DB3C000
stack
page read and write
1DBC5000
heap
page read and write
50E1000
heap
page read and write
61ED0000
direct allocation
page read and write
61ECD000
direct allocation
page readonly
6C680000
unkown
page readonly
50E1000
heap
page read and write
10D8000
unkown
page execute and read and write
32C0000
direct allocation
page read and write
50E1000
heap
page read and write
13F3000
stack
page read and write
345B000
stack
page read and write
50E1000
heap
page read and write
1DBC4000
heap
page read and write
50E1000
heap
page read and write
6F8FE000
unkown
page read and write
50E1000
heap
page read and write
16B4000
heap
page read and write
50E8000
heap
page read and write
56F0000
direct allocation
page execute and read and write
1DBD0000
heap
page read and write
56D0000
direct allocation
page execute and read and write
1DBC5000
heap
page read and write
56E0000
direct allocation
page execute and read and write
10E8000
unkown
page execute and read and write
16B4000
heap
page read and write
29EA9000
heap
page read and write
1D76F000
stack
page read and write
4D1F000
stack
page read and write
19DE000
stack
page read and write
1DBD0000
heap
page read and write
4ADE000
stack
page read and write
1DBD0000
heap
page read and write
29E10000
trusted library allocation
page read and write
36DE000
stack
page read and write
5100000
heap
page read and write
1DBE5000
heap
page read and write
4BDF000
stack
page read and write
5700000
direct allocation
page execute and read and write
1DCC0000
trusted library allocation
page read and write
50E1000
heap
page read and write
32C0000
direct allocation
page read and write
50E1000
heap
page read and write
1D9FD000
stack
page read and write
32C0000
direct allocation
page read and write
50E1000
heap
page read and write
5520000
trusted library allocation
page read and write
1DBD0000
heap
page read and write
50E1000
heap
page read and write
C9D000
unkown
page execute and read and write
341F000
stack
page read and write
32DB000
heap
page read and write
17CD000
heap
page read and write
50E1000
heap
page read and write
16B4000
heap
page read and write
32C0000
direct allocation
page read and write
395E000
stack
page read and write
5570000
direct allocation
page read and write
16B4000
heap
page read and write
1DBC7000
heap
page read and write
1DBC5000
heap
page read and write
50E1000
heap
page read and write
50E1000
heap
page read and write
4E9E000
stack
page read and write
E2A000
unkown
page execute and read and write
CEF000
unkown
page execute and read and write
50E1000
heap
page read and write
381E000
stack
page read and write
3D1E000
stack
page read and write
1DBEC000
heap
page read and write
12FC000
stack
page read and write
4F9F000
stack
page read and write
32C0000
direct allocation
page read and write
1DBD3000
heap
page read and write
1DBDC000
heap
page read and write
1D4EF000
stack
page read and write
1DBD0000
heap
page read and write
50E1000
heap
page read and write
1DBE9000
heap
page read and write
5710000
direct allocation
page execute and read and write
495F000
stack
page read and write
FCB000
unkown
page execute and read and write
1DBC5000
heap
page read and write
1D66E000
stack
page read and write
3CDF000
stack
page read and write
50DF000
stack
page read and write
16B4000
heap
page read and write
16B4000
heap
page read and write
1650000
heap
page read and write
1DBB6000
heap
page read and write
1700000
heap
page read and write
1DBC5000
heap
page read and write
50E1000
heap
page read and write
1DBAB000
heap
page read and write
1DBD3000
heap
page read and write
5550000
heap
page read and write
29C01000
heap
page read and write
1DBE9000
heap
page read and write
16B4000
heap
page read and write
E3E000
unkown
page execute and read and write
C6F000
unkown
page execute and read and write
1DBDC000
heap
page read and write
41DF000
stack
page read and write
1DBB6000
heap
page read and write
50E1000
heap
page read and write
1DBD3000
heap
page read and write
1DBCC000
heap
page read and write
16B4000
heap
page read and write
1DBEC000
heap
page read and write
16B4000
heap
page read and write
BE1000
unkown
page execute and write copy
1DBD0000
heap
page read and write
6C865000
unkown
page readonly
50F0000
heap
page read and write
16B4000
heap
page read and write
61EB4000
direct allocation
page read and write
16B4000
heap
page read and write
1DBDD000
heap
page read and write
1DBEA000
heap
page read and write
128C000
unkown
page execute and write copy
16B4000
heap
page read and write
CCF000
unkown
page execute and read and write
16B4000
heap
page read and write
1A1E000
stack
page read and write
1B1E000
stack
page read and write
3E5E000
stack
page read and write
1DBD0000
heap
page read and write
1DBCB000
heap
page read and write
16B4000
heap
page read and write
50E1000
heap
page read and write
BE0000
unkown
page read and write
16B4000
heap
page read and write
29EB7000
heap
page read and write
50E1000
heap
page read and write
1DBE9000
heap
page read and write
37DF000
stack
page read and write
29C43000
heap
page read and write
5570000
direct allocation
page read and write
50E1000
heap
page read and write
6C681000
unkown
page execute read
10E8000
unkown
page execute and write copy
1DBE9000
heap
page read and write
1DCCD000
heap
page read and write
D85000
unkown
page execute and read and write
50E1000
heap
page read and write
1DBD0000
heap
page read and write
16B4000
heap
page read and write
50E1000
heap
page read and write
10E9000
unkown
page execute and write copy
1DBE9000
heap
page read and write
1DBC7000
heap
page read and write
50E1000
heap
page read and write
29EB5000
heap
page read and write
1710000
heap
page read and write
50E1000
heap
page read and write
1D8AF000
stack
page read and write
50E1000
heap
page read and write
50E1000
heap
page read and write
4FDE000
stack
page read and write
1DBD0000
heap
page read and write
50E1000
heap
page read and write
4A9F000
stack
page read and write
499E000
stack
page read and write
16B4000
heap
page read and write
50E1000
heap
page read and write
50E1000
heap
page read and write
6F8ED000
unkown
page readonly
3A9E000
stack
page read and write
16B4000
heap
page read and write
C91000
unkown
page execute and read and write
1DBDC000
heap
page read and write
1764000
heap
page read and write
1DBE9000
heap
page read and write
61ECC000
direct allocation
page read and write
485E000
stack
page read and write
50E1000
heap
page read and write
3F9E000
stack
page read and write
1D62F000
stack
page read and write
13FD000
stack
page read and write
50E1000
heap
page read and write
29C63000
heap
page read and write
1DBD0000
heap
page read and write
1DBCD000
heap
page read and write
6F870000
unkown
page readonly
1DBDC000
heap
page read and write
32C0000
direct allocation
page read and write
50E1000
heap
page read and write
50E1000
heap
page read and write
1DBD7000
heap
page read and write
32C0000
direct allocation
page read and write
409F000
stack
page read and write
4D5E000
stack
page read and write
1DBB6000
heap
page read and write
331E000
stack
page read and write
6F871000
unkown
page execute read
1DBCD000
heap
page read and write
16B4000
heap
page read and write
1DBA0000
heap
page read and write
481F000
stack
page read and write
1DBD0000
heap
page read and write
50E1000
heap
page read and write
1DBCD000
heap
page read and write
3B9F000
stack
page read and write
17D9000
heap
page read and write
16FE000
stack
page read and write
32C0000
direct allocation
page read and write
16B4000
heap
page read and write
16B4000
heap
page read and write
29BC0000
heap
page read and write
17D4000
heap
page read and write
1DBB5000
heap
page read and write
3E1F000
stack
page read and write
1DBEC000
heap
page read and write
421E000
stack
page read and write
40DE000
stack
page read and write
16B4000
heap
page read and write
1DBDB000
heap
page read and write
50E1000
heap
page read and write
1DBC7000
heap
page read and write
445F000
stack
page read and write
1DBC7000
heap
page read and write
1DBE9000
heap
page read and write
369F000
stack
page read and write
50E1000
heap
page read and write
10D0000
unkown
page execute and read and write
61ED4000
direct allocation
page readonly
BE0000
unkown
page readonly
50E1000
heap
page read and write
1DBDE000
heap
page read and write
C65000
unkown
page execute and read and write
13F9000
stack
page read and write
29CFE000
stack
page read and write
1D8FD000
stack
page read and write
3BDE000
stack
page read and write
6F902000
unkown
page readonly
50E1000
heap
page read and write
1D52E000
stack
page read and write
1718000
heap
page read and write
61ED3000
direct allocation
page read and write
61EB7000
direct allocation
page readonly
50E1000
heap
page read and write
32C0000
direct allocation
page read and write
459F000
stack
page read and write
32C0000
direct allocation
page read and write
1DBDB000
heap
page read and write
1DBB6000
heap
page read and write
1DBCC000
heap
page read and write
50E1000
heap
page read and write
1DBD0000
heap
page read and write
29EBD000
heap
page read and write
50E1000
heap
page read and write
16B4000
heap
page read and write
29C23000
heap
page read and write
431F000
stack
page read and write
50E1000
heap
page read and write
50E1000
heap
page read and write
16B4000
heap
page read and write
1DBDB000
heap
page read and write
1DBEC000
heap
page read and write
56C0000
direct allocation
page execute and read and write
1DBC5000
heap
page read and write
32C0000
direct allocation
page read and write
32C0000
direct allocation
page read and write
1DBCD000
heap
page read and write
C3A000
unkown
page execute and read and write
29BA0000
heap
page read and write
1DBEC000
heap
page read and write
1DBB8000
heap
page read and write
1791000
heap
page read and write
16B4000
heap
page read and write
1DBD0000
heap
page read and write
16B4000
heap
page read and write
16B4000
heap
page read and write
6C85F000
unkown
page write copy
471E000
stack
page read and write
4E5F000
stack
page read and write
1DBE9000
heap
page read and write
32D7000
heap
page read and write
355F000
stack
page read and write
6C85E000
unkown
page read and write
3A5F000
stack
page read and write
50E1000
heap
page read and write
1DBC7000
heap
page read and write
16B4000
heap
page read and write
16B4000
heap
page read and write
1DBC8000
heap
page read and write
C68000
unkown
page execute and read and write
16B4000
heap
page read and write
6C860000
unkown
page read and write
56F0000
direct allocation
page execute and read and write
449E000
stack
page read and write
29EB1000
heap
page read and write
16B4000
heap
page read and write
1DBB6000
heap
page read and write
16B4000
heap
page read and write
16B4000
heap
page read and write
17E6000
heap
page read and write
1DBDD000
heap
page read and write
1D7AE000
stack
page read and write
435E000
stack
page read and write
1DBC2000
heap
page read and write
46DF000
stack
page read and write
45DE000
stack
page read and write
1DBA2000
heap
page read and write
50E1000
heap
page read and write
1DA3E000
stack
page read and write
50E1000
heap
page read and write
4C1E000
stack
page read and write
1DBCC000
heap
page read and write
50E1000
heap
page read and write
50E1000
heap
page read and write
CFE000
unkown
page execute and read and write
61E00000
direct allocation
page execute and read and write
There are 363 hidden memdumps, click here to show them.