IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAFIDGCFHIEHJJJJECAK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BFBGDGIDBAAEBFHJKJDGCGCGDG
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\CBKJEGCB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\GIDHDGCBFBKECBFHCAFHJDBGHC
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\HIEHDAFH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HIIIDAKKJJJKKECAKKJE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IEGCBAAFHDHDHJKEGCFCBFHJDH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IJKFHDBKFCAAECBFIDHJECBKEB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJKFBAKFBGDHIEBGDAKF
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpV
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37s
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php~
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpB
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de1
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpp
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpz
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll0de163924d/nss3.dllv
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpb
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlle
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll)
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 38 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
206.23.85.13.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
321000
unkown
page execute and read and write
 malicious
F0E000
heap
page read and write
 malicious
4B60000
direct allocation
page read and write
 malicious
46E0000
heap
page read and write
46E1000
heap
page read and write
1D2B0000
heap
page read and write
1D2E1000
heap
page read and write
2940000
direct allocation
page read and write
1CA9F000
stack
page read and write
46E1000
heap
page read and write
320000
unkown
page read and write
46E1000
heap
page read and write
1D2E4000
heap
page read and write
1D2DD000
heap
page read and write
3B2000
unkown
page execute and read and write
4CC0000
direct allocation
page execute and read and write
1D2FB000
heap
page read and write
1D301000
heap
page read and write
1D2D9000
heap
page read and write
46E1000
heap
page read and write
2920000
direct allocation
page read and write
46E1000
heap
page read and write
1D2E8000
heap
page read and write
3F9E000
stack
page read and write
318000
stack
page read and write
4B9B000
stack
page read and write
2F671000
heap
page read and write
1D2DB000
heap
page read and write
46E1000
heap
page read and write
2CDE000
stack
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
4C9F000
stack
page read and write
1D2E8000
heap
page read and write
46E1000
heap
page read and write
289E000
stack
page read and write
46E1000
heap
page read and write
314000
stack
page read and write
46E1000
heap
page read and write
DF5000
heap
page read and write
1D2D6000
heap
page read and write
46E1000
heap
page read and write
1D2E4000
heap
page read and write
46E1000
heap
page read and write
449E000
stack
page read and write
46E1000
heap
page read and write
29471000
heap
page read and write
341F000
stack
page read and write
7DC000
unkown
page execute and read and write
2F66B000
heap
page read and write
CF0000
heap
page read and write
6C6F0000
unkown
page readonly
46E1000
heap
page read and write
1D2AD000
stack
page read and write
1D2DB000
heap
page read and write
46E1000
heap
page read and write
2F670000
heap
page read and write
1D2E8000
heap
page read and write
61E01000
direct allocation
page execute read
2920000
direct allocation
page read and write
1D2B6000
heap
page read and write
57E000
unkown
page execute and read and write
1D2E4000
heap
page read and write
1D2FE000
heap
page read and write
1CE7F000
stack
page read and write
320000
unkown
page readonly
2920000
direct allocation
page read and write
1D2E4000
heap
page read and write
1D3D0000
trusted library allocation
page read and write
43B000
unkown
page execute and read and write
319F000
stack
page read and write
2920000
direct allocation
page read and write
46E1000
heap
page read and write
3AF000
unkown
page execute and read and write
6C8D5000
unkown
page readonly
DAD000
stack
page read and write
1D2DD000
heap
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
31D000
stack
page read and write
1D2EC000
heap
page read and write
3A5000
unkown
page execute and read and write
233EC000
heap
page read and write
1D2F1000
heap
page read and write
2920000
direct allocation
page read and write
1CD1F000
stack
page read and write
40DE000
stack
page read and write
46E1000
heap
page read and write
409F000
stack
page read and write
1D301000
heap
page read and write
61EB4000
direct allocation
page read and write
46E1000
heap
page read and write
1D2E4000
heap
page read and write
29491000
heap
page read and write
1D2FB000
heap
page read and write
23348000
heap
page read and write
2920000
direct allocation
page read and write
4700000
heap
page read and write
305F000
stack
page read and write
1D2CA000
heap
page read and write
1D2E4000
heap
page read and write
6C8CF000
unkown
page write copy
46E1000
heap
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
4C5000
unkown
page execute and read and write
445F000
stack
page read and write
3D1E000
stack
page read and write
1D2EC000
heap
page read and write
1D2E4000
heap
page read and write
1D2FC000
heap
page read and write
3CDF000
stack
page read and write
2957000
heap
page read and write
459F000
stack
page read and write
1D300000
heap
page read and write
2920000
direct allocation
page read and write
46E1000
heap
page read and write
F00000
heap
page read and write
46E1000
heap
page read and write
817000
unkown
page execute and read and write
1D00E000
stack
page read and write
46E1000
heap
page read and write
1D2E0000
heap
page read and write
817000
unkown
page execute and write copy
1D300000
heap
page read and write
6C6E2000
unkown
page readonly
1CD7E000
stack
page read and write
1D300000
heap
page read and write
9B1000
unkown
page execute and write copy
6C6F1000
unkown
page execute read
F80000
heap
page read and write
46E1000
heap
page read and write
2E1E000
stack
page read and write
1D2C9000
heap
page read and write
1CC1E000
stack
page read and write
36DE000
stack
page read and write
808000
unkown
page execute and read and write
2DDF000
stack
page read and write
3D1000
unkown
page execute and read and write
331E000
stack
page read and write
1D2E8000
heap
page read and write
1D2DD000
heap
page read and write
3B9F000
stack
page read and write
4CD0000
direct allocation
page execute and read and write
1D2E4000
heap
page read and write
3A8000
unkown
page execute and read and write
1D2E0000
heap
page read and write
1D2E8000
heap
page read and write
4D00000
direct allocation
page execute and read and write
1D2E4000
heap
page read and write
31DE000
stack
page read and write
F51000
heap
page read and write
1D2E2000
heap
page read and write
1CFCD000
stack
page read and write
6C650000
unkown
page readonly
1D2E4000
heap
page read and write
46E1000
heap
page read and write
1D2C8000
heap
page read and write
46DF000
stack
page read and write
1D2F1000
heap
page read and write
2920000
direct allocation
page read and write
6C8D0000
unkown
page read and write
1D2D9000
heap
page read and write
F0A000
heap
page read and write
2F5E000
stack
page read and write
46E1000
heap
page read and write
2920000
direct allocation
page read and write
46E1000
heap
page read and write
1D2F1000
heap
page read and write
61ED4000
direct allocation
page readonly
1CBDF000
stack
page read and write
29451000
heap
page read and write
46E1000
heap
page read and write
32DF000
stack
page read and write
1D2D9000
heap
page read and write
46E1000
heap
page read and write
1D2DA000
heap
page read and write
369F000
stack
page read and write
61ECC000
direct allocation
page read and write
1D2EB000
heap
page read and write
295B000
heap
page read and write
4CA0000
direct allocation
page execute and read and write
61EB7000
direct allocation
page readonly
46E1000
heap
page read and write
46E1000
heap
page read and write
DC0000
heap
page read and write
46E1000
heap
page read and write
61ED3000
direct allocation
page read and write
1D2E4000
heap
page read and write
800000
unkown
page execute and read and write
703000
unkown
page execute and read and write
46F0000
heap
page read and write
42F000
unkown
page execute and read and write
1D2D9000
heap
page read and write
F67000
heap
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
2920000
direct allocation
page read and write
EFF000
stack
page read and write
21C000
stack
page read and write
2B9E000
stack
page read and write
1D2CA000
heap
page read and write
1D2DA000
heap
page read and write
46E1000
heap
page read and write
2348C000
heap
page read and write
46E1000
heap
page read and write
1D2F1000
heap
page read and write
41DF000
stack
page read and write
1D2CA000
heap
page read and write
46E1000
heap
page read and write
9B0000
unkown
page execute and read and write
1D2E7000
heap
page read and write
1D2CA000
heap
page read and write
C10000
heap
page read and write
4CD0000
direct allocation
page execute and read and write
1D2E4000
heap
page read and write
1D300000
heap
page read and write
1D2D9000
heap
page read and write
1D3D6000
heap
page read and write
4CE0000
direct allocation
page execute and read and write
1D2FF000
heap
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
1CADE000
stack
page read and write
2F5D0000
trusted library allocation
page read and write
295E000
heap
page read and write
29410000
heap
page read and write
1D2CB000
heap
page read and write
2F1F000
stack
page read and write
1D2E4000
heap
page read and write
3A9E000
stack
page read and write
1D2BF000
heap
page read and write
1D2E4000
heap
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
1D2E2000
heap
page read and write
2F5BF000
stack
page read and write
293F0000
heap
page read and write
818000
unkown
page execute and write copy
1D2FF000
heap
page read and write
2920000
direct allocation
page read and write
435E000
stack
page read and write
46E1000
heap
page read and write
4E5000
unkown
page execute and read and write
355F000
stack
page read and write
1D301000
heap
page read and write
2F678000
heap
page read and write
1D2F1000
heap
page read and write
45DE000
stack
page read and write
1D2E8000
heap
page read and write
29495000
heap
page read and write
1D2F1000
heap
page read and write
1D300000
heap
page read and write
2920000
direct allocation
page read and write
46E1000
heap
page read and write
6C651000
unkown
page execute read
1D2E4000
heap
page read and write
1D300000
heap
page read and write
1D300000
heap
page read and write
29431000
heap
page read and write
F4F000
heap
page read and write
431F000
stack
page read and write
309E000
stack
page read and write
1D2E7000
heap
page read and write
1D2E4000
heap
page read and write
2F4BD000
stack
page read and write
2920000
direct allocation
page read and write
46E1000
heap
page read and write
DD0000
heap
page read and write
2B5F000
stack
page read and write
6C6CD000
unkown
page readonly
46E1000
heap
page read and write
1D300000
heap
page read and write
1D2CA000
heap
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
1D2C5000
heap
page read and write
1D2F1000
heap
page read and write
F92000
heap
page read and write
2940000
direct allocation
page read and write
4CF0000
direct allocation
page execute and read and write
4CB0000
direct allocation
page execute and read and write
321000
unkown
page execute and write copy
6C88F000
unkown
page readonly
391F000
stack
page read and write
1CECD000
stack
page read and write
1D300000
heap
page read and write
1D2E4000
heap
page read and write
2950000
heap
page read and write
1D2DB000
heap
page read and write
37A000
unkown
page execute and read and write
1D2B2000
heap
page read and write
46E1000
heap
page read and write
1D2D8000
heap
page read and write
1D1AE000
stack
page read and write
1D2E4000
heap
page read and write
1D2E4000
heap
page read and write
46E1000
heap
page read and write
43E000
unkown
page execute and read and write
46E3000
heap
page read and write
DF0000
heap
page read and write
1D2F1000
heap
page read and write
1D2D9000
heap
page read and write
3DD000
unkown
page execute and read and write
40F000
unkown
page execute and read and write
1D2D9000
heap
page read and write
46E1000
heap
page read and write
61E00000
direct allocation
page execute and read and write
3E1F000
stack
page read and write
1D2E7000
heap
page read and write
37DF000
stack
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
3F5E000
stack
page read and write
4EB000
unkown
page execute and read and write
6C8CE000
unkown
page read and write
1D2E4000
heap
page read and write
1D2D9000
heap
page read and write
1D2F1000
heap
page read and write
3BDE000
stack
page read and write
1D2E4000
heap
page read and write
359E000
stack
page read and write
D5E000
stack
page read and write
381E000
stack
page read and write
46E1000
heap
page read and write
1D2D6000
heap
page read and write
1D2C9000
heap
page read and write
4CDE000
stack
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
2A5F000
stack
page read and write
28DE000
stack
page read and write
46E1000
heap
page read and write
1D2CA000
heap
page read and write
46E1000
heap
page read and write
46E1000
heap
page read and write
1D2F1000
heap
page read and write
1D2E1000
heap
page read and write
46E1000
heap
page read and write
1D2E4000
heap
page read and write
47E0000
trusted library allocation
page read and write
312000
stack
page read and write
402000
unkown
page execute and read and write
291C000
stack
page read and write
1D2F1000
heap
page read and write
1D10D000
stack
page read and write
1D2E0000
heap
page read and write
345E000
stack
page read and write
6C6DE000
unkown
page read and write
1D2D9000
heap
page read and write
1D2DA000
heap
page read and write
2920000
direct allocation
page read and write
46E1000
heap
page read and write
3A5F000
stack
page read and write
61ED0000
direct allocation
page read and write
2C9F000
stack
page read and write
3E5E000
stack
page read and write
1D300000
heap
page read and write
1D2D9000
heap
page read and write
46E1000
heap
page read and write
1D2E8000
heap
page read and write
61ECD000
direct allocation
page readonly
1D2DA000
heap
page read and write
46E1000
heap
page read and write
421E000
stack
page read and write
395E000
stack
page read and write
46E1000
heap
page read and write
1D2E4000
heap
page read and write
2F663000
heap
page read and write
1D2D6000
heap
page read and write
There are 363 hidden memdumps, click here to show them.