IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BFHJJJDAFBKEBGDGHCGD
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\CFCBFBGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\DBKKKEHDHCBFIEBFBGIDGHJJJD
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DHJKJKKKJJJKJKFHJJJJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EBAKKFHJDBKKEBFHDAAEBGIEGD
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\EGIIIECBGDHJJKFIDAKJDHJJKE
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GIEBAECAKKFCBFIEGCBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IDBFHJDA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JJDBFCAEBFIJJKFHDAECGDAEGI
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php0u
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllE
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll?
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllS
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpx
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllw
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpP
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll7
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllA
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpbird
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllY
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllA
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php0
unknown
 malicious
http://185.215.113.37/C
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllb
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllg
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 43 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
DF1000
unkown
page execute and read and write
 malicious
5620000
direct allocation
page read and write
 malicious
150E000
heap
page read and write
 malicious
E82000
unkown
page execute and read and write
6F8DD000
unkown
page readonly
29F13000
heap
page read and write
DDD000
stack
page read and write
4B9E000
stack
page read and write
1DDA8000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1DDA1000
heap
page read and write
42DE000
stack
page read and write
1DD9A000
heap
page read and write
1DE9E000
heap
page read and write
1DDA4000
heap
page read and write
51A1000
heap
page read and write
1990000
heap
page read and write
465F000
stack
page read and write
3B1F000
stack
page read and write
51A1000
heap
page read and write
1DD96000
heap
page read and write
51A1000
heap
page read and write
12EF000
unkown
page execute and write copy
51A1000
heap
page read and write
1D59E000
stack
page read and write
51A1000
heap
page read and write
29F0F000
heap
page read and write
1DDC0000
heap
page read and write
1DD96000
heap
page read and write
51A1000
heap
page read and write
1DDA8000
heap
page read and write
1DE90000
trusted library allocation
page read and write
1DDAB000
heap
page read and write
51A1000
heap
page read and write
405E000
stack
page read and write
1DDA4000
heap
page read and write
51A1000
heap
page read and write
491E000
stack
page read and write
159C000
heap
page read and write
3D9F000
stack
page read and write
EDF000
unkown
page execute and read and write
1DDC0000
heap
page read and write
3460000
direct allocation
page read and write
1DDC0000
heap
page read and write
1DD6E000
stack
page read and write
519F000
stack
page read and write
51A1000
heap
page read and write
1DDA2000
heap
page read and write
33DC000
stack
page read and write
1DD70000
heap
page read and write
1DD88000
heap
page read and write
3EDF000
stack
page read and write
51A1000
heap
page read and write
12F0000
unkown
page execute and write copy
51A1000
heap
page read and write
DF1000
unkown
page execute and write copy
51A1000
heap
page read and write
51A1000
heap
page read and write
61ED0000
direct allocation
page read and write
51A1000
heap
page read and write
1DD9D000
heap
page read and write
1DDB1000
heap
page read and write
6C8D5000
unkown
page readonly
51A1000
heap
page read and write
1DD89000
heap
page read and write
1DDA4000
heap
page read and write
1DBCC000
stack
page read and write
1DD8A000
heap
page read and write
1DDA4000
heap
page read and write
DF0000
unkown
page readonly
341E000
stack
page read and write
369F000
stack
page read and write
1DDC1000
heap
page read and write
51A1000
heap
page read and write
1DDB1000
heap
page read and write
1DDA4000
heap
page read and write
51A1000
heap
page read and write
1D83E000
stack
page read and write
51A1000
heap
page read and write
1DDA4000
heap
page read and write
51A1000
heap
page read and write
1DDC1000
heap
page read and write
1DDA1000
heap
page read and write
1DDA4000
heap
page read and write
3460000
direct allocation
page read and write
CDC000
stack
page read and write
1DDA4000
heap
page read and write
F95000
unkown
page execute and read and write
51C0000
heap
page read and write
3460000
direct allocation
page read and write
104E000
unkown
page execute and read and write
29F07000
heap
page read and write
3460000
direct allocation
page read and write
51A1000
heap
page read and write
4F1F000
stack
page read and write
51A1000
heap
page read and write
29EFE000
heap
page read and write
E75000
unkown
page execute and read and write
1DDA4000
heap
page read and write
1DD99000
heap
page read and write
E78000
unkown
page execute and read and write
1DD9D000
heap
page read and write
1DD9A000
heap
page read and write
1DDA8000
heap
page read and write
51A1000
heap
page read and write
1DDA0000
heap
page read and write
1DD76000
heap
page read and write
1DD98000
heap
page read and write
1DDB1000
heap
page read and write
12D9000
unkown
page execute and read and write
1DDA8000
heap
page read and write
1DDA4000
heap
page read and write
1DD9B000
heap
page read and write
3460000
direct allocation
page read and write
51A1000
heap
page read and write
51A1000
heap
page read and write
DD9000
stack
page read and write
429F000
stack
page read and write
1500000
heap
page read and write
1DDA0000
heap
page read and write
19B0000
heap
page read and write
51A1000
heap
page read and write
1DACD000
stack
page read and write
1DDA4000
heap
page read and write
335E000
stack
page read and write
23F4D000
heap
page read and write
1DD8A000
heap
page read and write
15F3000
heap
page read and write
1D6DE000
stack
page read and write
51A1000
heap
page read and write
196D000
stack
page read and write
4DDF000
stack
page read and write
4E1E000
stack
page read and write
FBB000
unkown
page execute and read and write
1DD99000
heap
page read and write
1DD9D000
heap
page read and write
1DDB1000
heap
page read and write
57C0000
direct allocation
page execute and read and write
51A1000
heap
page read and write
29F18000
heap
page read and write
1D55F000
stack
page read and write
509E000
stack
page read and write
4C9F000
stack
page read and write
1DDC0000
heap
page read and write
379F000
stack
page read and write
47DD000
stack
page read and write
EA1000
unkown
page execute and read and write
1DDC0000
heap
page read and write
51A1000
heap
page read and write
1DD99000
heap
page read and write
1ABE000
stack
page read and write
148D000
unkown
page execute and write copy
6F8F2000
unkown
page readonly
1DD99000
heap
page read and write
1DDA4000
heap
page read and write
51A1000
heap
page read and write
4A1F000
stack
page read and write
ED2000
unkown
page execute and read and write
1DDA4000
heap
page read and write
51A1000
heap
page read and write
51A1000
heap
page read and write
2FF8E000
stack
page read and write
349E000
heap
page read and write
51A1000
heap
page read and write
469E000
stack
page read and write
30125000
heap
page read and write
51A1000
heap
page read and write
51A1000
heap
page read and write
51A1000
heap
page read and write
1DDBC000
heap
page read and write
61ED3000
direct allocation
page read and write
1DD8A000
heap
page read and write
6F8EE000
unkown
page read and write
6C8CF000
unkown
page write copy
61ED4000
direct allocation
page readonly
51A1000
heap
page read and write
55E0000
trusted library allocation
page read and write
1DDC0000
heap
page read and write
1DDBE000
heap
page read and write
3C5F000
stack
page read and write
3490000
heap
page read and write
441E000
stack
page read and write
6C88F000
unkown
page readonly
1DDC0000
heap
page read and write
1DD85000
heap
page read and write
154D000
heap
page read and write
5780000
direct allocation
page execute and read and write
455E000
stack
page read and write
1DDA4000
heap
page read and write
51A1000
heap
page read and write
6C6F0000
unkown
page readonly
14D0000
heap
page read and write
401F000
stack
page read and write
51A1000
heap
page read and write
6F860000
unkown
page readonly
3012D000
heap
page read and write
1DDA4000
heap
page read and write
29EF1000
heap
page read and write
565C000
stack
page read and write
3C9E000
stack
page read and write
1DDA4000
heap
page read and write
3460000
direct allocation
page read and write
150A000
heap
page read and write
3497000
heap
page read and write
29EFC000
heap
page read and write
1DDC1000
heap
page read and write
4A5E000
stack
page read and write
1D98D000
stack
page read and write
1DDBB000
heap
page read and write
1DDB1000
heap
page read and write
51A1000
heap
page read and write
3A1E000
stack
page read and write
3460000
direct allocation
page read and write
51A1000
heap
page read and write
3F1E000
stack
page read and write
1DDB1000
heap
page read and write
6C8CE000
unkown
page read and write
1DA8D000
stack
page read and write
11D3000
unkown
page execute and read and write
EAD000
unkown
page execute and read and write
1DDB1000
heap
page read and write
419E000
stack
page read and write
1DD8B000
heap
page read and write
191E000
stack
page read and write
1DD8A000
heap
page read and write
1DDA0000
heap
page read and write
61ECC000
direct allocation
page read and write
61EB7000
direct allocation
page readonly
1DDA7000
heap
page read and write
12EF000
unkown
page execute and read and write
1DDAC000
heap
page read and write
51A1000
heap
page read and write
3DDE000
stack
page read and write
1DD8A000
heap
page read and write
451F000
stack
page read and write
E7F000
unkown
page execute and read and write
1DDA4000
heap
page read and write
51A1000
heap
page read and write
FB5000
unkown
page execute and read and write
38DE000
stack
page read and write
1DDB1000
heap
page read and write
339E000
stack
page read and write
1DD9B000
heap
page read and write
5790000
direct allocation
page execute and read and write
3460000
direct allocation
page read and write
51A1000
heap
page read and write
3B5E000
stack
page read and write
1568000
heap
page read and write
3460000
direct allocation
page read and write
359F000
stack
page read and write
51A1000
heap
page read and write
51A1000
heap
page read and write
51A1000
heap
page read and write
F0B000
unkown
page execute and read and write
349B000
heap
page read and write
51A1000
heap
page read and write
61E01000
direct allocation
page execute read
48DF000
stack
page read and write
1DDA4000
heap
page read and write
14E0000
heap
page read and write
1DDB1000
heap
page read and write
1980000
heap
page read and write
19B5000
heap
page read and write
1DDC0000
heap
page read and write
23E03000
heap
page read and write
5760000
direct allocation
page execute and read and write
39DF000
stack
page read and write
1DDA4000
heap
page read and write
1DDBF000
heap
page read and write
1DD99000
heap
page read and write
5770000
direct allocation
page execute and read and write
51A1000
heap
page read and write
1DDC0000
heap
page read and write
579E000
stack
page read and write
1DDA4000
heap
page read and write
61ECD000
direct allocation
page readonly
1DDBB000
heap
page read and write
1DD99000
heap
page read and write
51A1000
heap
page read and write
505F000
stack
page read and write
1DDC0000
heap
page read and write
51A1000
heap
page read and write
4F5E000
stack
page read and write
51A1000
heap
page read and write
57B0000
direct allocation
page execute and read and write
1DDA4000
heap
page read and write
51B0000
heap
page read and write
3480000
direct allocation
page read and write
61EB4000
direct allocation
page read and write
1552000
heap
page read and write
6C6F1000
unkown
page execute read
1DD89000
heap
page read and write
51A1000
heap
page read and write
1DDA7000
heap
page read and write
51A1000
heap
page read and write
1DDA2000
heap
page read and write
51A1000
heap
page read and write
1DD7F000
heap
page read and write
1DD72000
heap
page read and write
51A1000
heap
page read and write
1DD99000
heap
page read and write
51A1000
heap
page read and write
30090000
trusted library allocation
page read and write
1D93F000
stack
page read and write
51A1000
heap
page read and write
51A1000
heap
page read and write
51A1000
heap
page read and write
3460000
direct allocation
page read and write
5790000
direct allocation
page execute and read and write
1DD99000
heap
page read and write
3460000
direct allocation
page read and write
1DDA8000
heap
page read and write
29F01000
heap
page read and write
EFF000
unkown
page execute and read and write
1DDA7000
heap
page read and write
51A1000
heap
page read and write
1DD99000
heap
page read and write
1DDAC000
heap
page read and write
29EB0000
heap
page read and write
51A1000
heap
page read and write
3008F000
stack
page read and write
1582000
heap
page read and write
1DDA8000
heap
page read and write
1DDB1000
heap
page read and write
51A1000
heap
page read and write
1DDA4000
heap
page read and write
30133000
heap
page read and write
1DDA4000
heap
page read and write
6C8D0000
unkown
page read and write
3480000
direct allocation
page read and write
DD3000
stack
page read and write
51A1000
heap
page read and write
DF0000
unkown
page read and write
3460000
direct allocation
page read and write
4CDE000
stack
page read and write
389F000
stack
page read and write
51A1000
heap
page read and write
1DD9A000
heap
page read and write
51A0000
heap
page read and write
1DDA8000
heap
page read and write
23EA3000
heap
page read and write
12B6000
unkown
page execute and read and write
3460000
direct allocation
page read and write
1DC6E000
stack
page read and write
51A1000
heap
page read and write
29ED0000
heap
page read and write
1D69F000
stack
page read and write
F0E000
unkown
page execute and read and write
51A1000
heap
page read and write
1DDB1000
heap
page read and write
1DD99000
heap
page read and write
51A1000
heap
page read and write
3013F000
heap
page read and write
30137000
heap
page read and write
51A1000
heap
page read and write
1DDBF000
heap
page read and write
1DD9B000
heap
page read and write
1D7DE000
stack
page read and write
479F000
stack
page read and write
3460000
direct allocation
page read and write
51A1000
heap
page read and write
575F000
stack
page read and write
1DD96000
heap
page read and write
148C000
unkown
page execute and read and write
345E000
stack
page read and write
43DF000
stack
page read and write
E4A000
unkown
page execute and read and write
415F000
stack
page read and write
51A1000
heap
page read and write
57A0000
direct allocation
page execute and read and write
6F861000
unkown
page execute read
12E0000
unkown
page execute and read and write
1DD9A000
heap
page read and write
1DD8A000
heap
page read and write
4B5F000
stack
page read and write
There are 365 hidden memdumps, click here to show them.