IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKEGDHJDHDAFHJJKJEHCAAAEBG
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CGHCFBAAAFHJDGCBFIIJDBGDHJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\GCFCFCGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HCFBAFIDAECAKFHJDBAF
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\IDAAFBGDBKJJJKFIIIJJJECAAE
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\JKJKKKJJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\KEHCAFHIJECGCAKFCGDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KFIEHIIIJDAAAAAAKECB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KJJJDHDGDAAKECAKJDAEGCBKEH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/d
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllLr
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpn
unknown
 malicious
http://185.215.113.37B3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpet-805c
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpb
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll4s
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpZ8
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll.r
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdllA8d5
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllBr
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllls
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 39 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4BC0000
direct allocation
page read and write
 malicious
F91000
unkown
page execute and read and write
 malicious
6EE000
heap
page read and write
 malicious
624000
heap
page read and write
1CD9E000
stack
page read and write
4741000
heap
page read and write
4760000
heap
page read and write
4741000
heap
page read and write
1D360000
heap
page read and write
34BE000
stack
page read and write
1072000
unkown
page execute and read and write
1D341000
heap
page read and write
2F7F000
stack
page read and write
4741000
heap
page read and write
1D344000
heap
page read and write
1D344000
heap
page read and write
4741000
heap
page read and write
624000
heap
page read and write
61EB7000
direct allocation
page readonly
1D35F000
heap
page read and write
4741000
heap
page read and write
2E7E000
stack
page read and write
294FA000
heap
page read and write
FEA000
unkown
page execute and read and write
1D35C000
heap
page read and write
1D339000
heap
page read and write
4741000
heap
page read and write
4741000
heap
page read and write
624000
heap
page read and write
1D33A000
heap
page read and write
1D340000
heap
page read and write
1D344000
heap
page read and write
F5E000
stack
page read and write
1D339000
heap
page read and write
2949D000
heap
page read and write
3FBF000
stack
page read and write
624000
heap
page read and write
1D02E000
stack
page read and write
3EBE000
stack
page read and write
4741000
heap
page read and write
F00000
direct allocation
page read and write
1D344000
heap
page read and write
1D344000
heap
page read and write
624000
heap
page read and write
1D32A000
heap
page read and write
1D360000
heap
page read and write
4741000
heap
page read and write
463E000
stack
page read and write
4741000
heap
page read and write
44BF000
stack
page read and write
6C6F1000
unkown
page execute read
1D33B000
heap
page read and write
1D351000
heap
page read and write
1D35B000
heap
page read and write
3D7E000
stack
page read and write
1D347000
heap
page read and write
F00000
direct allocation
page read and write
624000
heap
page read and write
4741000
heap
page read and write
4741000
heap
page read and write
1D339000
heap
page read and write
1D339000
heap
page read and write
4740000
heap
page read and write
6C6F0000
unkown
page readonly
F80000
direct allocation
page execute and read and write
1D339000
heap
page read and write
1D348000
heap
page read and write
1015000
unkown
page execute and read and write
4741000
heap
page read and write
1D348000
heap
page read and write
F00000
direct allocation
page read and write
1D342000
heap
page read and write
4CFF000
stack
page read and write
1D33D000
heap
page read and write
6C8D0000
unkown
page read and write
1489000
unkown
page execute and read and write
6C650000
unkown
page readonly
36FF000
stack
page read and write
6AE000
stack
page read and write
F00000
direct allocation
page read and write
4741000
heap
page read and write
F17000
heap
page read and write
624000
heap
page read and write
F00000
direct allocation
page read and write
F91000
unkown
page execute and write copy
1D360000
heap
page read and write
4741000
heap
page read and write
104D000
unkown
page execute and read and write
624000
heap
page read and write
1628000
unkown
page execute and write copy
1D360000
heap
page read and write
F70000
direct allocation
page read and write
1CF2E000
stack
page read and write
4741000
heap
page read and write
1D344000
heap
page read and write
1D351000
heap
page read and write
1D33A000
heap
page read and write
4741000
heap
page read and write
4741000
heap
page read and write
4741000
heap
page read and write
F00000
direct allocation
page read and write
413E000
stack
page read and write
748000
heap
page read and write
4741000
heap
page read and write
48C000
stack
page read and write
6D0000
heap
page read and write
1D348000
heap
page read and write
11EE000
unkown
page execute and read and write
624000
heap
page read and write
4B90000
heap
page read and write
1D430000
trusted library allocation
page read and write
4D30000
direct allocation
page execute and read and write
1D344000
heap
page read and write
4741000
heap
page read and write
F1B000
heap
page read and write
6C6CD000
unkown
page readonly
4741000
heap
page read and write
6C8CE000
unkown
page read and write
4741000
heap
page read and write
1D35B000
heap
page read and write
61ED0000
direct allocation
page read and write
1135000
unkown
page execute and read and write
437F000
stack
page read and write
2D3F000
stack
page read and write
1D344000
heap
page read and write
1D33D000
heap
page read and write
1D351000
heap
page read and write
F10000
heap
page read and write
1D344000
heap
page read and write
624000
heap
page read and write
4D10000
direct allocation
page execute and read and write
EFE000
stack
page read and write
1479000
unkown
page execute and read and write
2949B000
heap
page read and write
1D351000
heap
page read and write
1D434000
heap
page read and write
EBB000
stack
page read and write
2FBE000
stack
page read and write
624000
heap
page read and write
1D329000
heap
page read and write
3C3E000
stack
page read and write
F00000
direct allocation
page read and write
F70000
direct allocation
page read and write
4750000
heap
page read and write
1CB1F000
stack
page read and write
294A6000
heap
page read and write
624000
heap
page read and write
4741000
heap
page read and write
29470000
heap
page read and write
4741000
heap
page read and write
39BE000
stack
page read and write
1CC9E000
stack
page read and write
1D344000
heap
page read and write
4741000
heap
page read and write
1D351000
heap
page read and write
4741000
heap
page read and write
1D344000
heap
page read and write
1D32A000
heap
page read and write
4741000
heap
page read and write
7D8000
heap
page read and write
4741000
heap
page read and write
624000
heap
page read and write
1D340000
heap
page read and write
387E000
stack
page read and write
583000
stack
page read and write
4741000
heap
page read and write
337E000
stack
page read and write
6C651000
unkown
page execute read
F00000
direct allocation
page read and write
1D351000
heap
page read and write
1D341000
heap
page read and write
F00000
direct allocation
page read and write
624000
heap
page read and write
1D344000
heap
page read and write
4741000
heap
page read and write
1CC5F000
stack
page read and write
234E6000
heap
page read and write
F00000
direct allocation
page read and write
624000
heap
page read and write
624000
heap
page read and write
1D339000
heap
page read and write
1D347000
heap
page read and write
1D34B000
heap
page read and write
4741000
heap
page read and write
1D351000
heap
page read and write
1D16C000
stack
page read and write
624000
heap
page read and write
2C3F000
stack
page read and write
1D20E000
stack
page read and write
1D344000
heap
page read and write
1D342000
heap
page read and write
6C88F000
unkown
page readonly
1D32A000
heap
page read and write
1D32A000
heap
page read and write
233A6000
heap
page read and write
1D360000
heap
page read and write
4D40000
direct allocation
page execute and read and write
5E0000
heap
page read and write
4741000
heap
page read and write
4741000
heap
page read and write
35FE000
stack
page read and write
294B2000
heap
page read and write
1D339000
heap
page read and write
1D344000
heap
page read and write
5F0000
heap
page read and write
115B000
unkown
page execute and read and write
1CA1E000
stack
page read and write
1018000
unkown
page execute and read and write
AAE000
stack
page read and write
3E7F000
stack
page read and write
61EB4000
direct allocation
page read and write
1041000
unkown
page execute and read and write
397F000
stack
page read and write
1D344000
heap
page read and write
6EA000
heap
page read and write
473F000
stack
page read and write
624000
heap
page read and write
6C6E2000
unkown
page readonly
1D317000
heap
page read and write
1D351000
heap
page read and write
1D06E000
stack
page read and write
620000
heap
page read and write
1D348000
heap
page read and write
624000
heap
page read and write
61ED4000
direct allocation
page readonly
1D361000
heap
page read and write
1D31F000
heap
page read and write
4741000
heap
page read and write
6C8D5000
unkown
page readonly
9AE000
stack
page read and write
1D361000
heap
page read and write
148A000
unkown
page execute and write copy
61E00000
direct allocation
page execute and read and write
31FF000
stack
page read and write
4741000
heap
page read and write
2F6D3000
heap
page read and write
4741000
heap
page read and write
624000
heap
page read and write
1022000
unkown
page execute and read and write
1D344000
heap
page read and write
2F630000
trusted library allocation
page read and write
4741000
heap
page read and write
3D3F000
stack
page read and write
3ABF000
stack
page read and write
1D310000
heap
page read and write
1D35E000
heap
page read and write
35BF000
stack
page read and write
43BE000
stack
page read and write
2F52E000
stack
page read and write
2F6CB000
heap
page read and write
4741000
heap
page read and write
347F000
stack
page read and write
4741000
heap
page read and write
294AE000
heap
page read and write
61ED3000
direct allocation
page read and write
1D339000
heap
page read and write
294A0000
heap
page read and write
4741000
heap
page read and write
1D360000
heap
page read and write
1D33B000
heap
page read and write
1D33D000
heap
page read and write
4741000
heap
page read and write
624000
heap
page read and write
1D34C000
heap
page read and write
4741000
heap
page read and write
101F000
unkown
page execute and read and write
1D360000
heap
page read and write
4741000
heap
page read and write
624000
heap
page read and write
1D328000
heap
page read and write
29450000
heap
page read and write
61E01000
direct allocation
page execute read
F1E000
heap
page read and write
294B7000
heap
page read and write
4741000
heap
page read and write
136C000
unkown
page execute and read and write
F90000
unkown
page read and write
383F000
stack
page read and write
624000
heap
page read and write
1D32A000
heap
page read and write
1D344000
heap
page read and write
F00000
direct allocation
page read and write
1D344000
heap
page read and write
333F000
stack
page read and write
2F62F000
stack
page read and write
4741000
heap
page read and write
294FD000
heap
page read and write
30FE000
stack
page read and write
40FF000
stack
page read and write
4741000
heap
page read and write
1D339000
heap
page read and write
F00000
direct allocation
page read and write
4BFC000
stack
page read and write
1D344000
heap
page read and write
1D329000
heap
page read and write
F90000
unkown
page readonly
4741000
heap
page read and write
1D351000
heap
page read and write
4840000
trusted library allocation
page read and write
4741000
heap
page read and write
1CDDE000
stack
page read and write
107F000
unkown
page execute and read and write
1D348000
heap
page read and write
61ECD000
direct allocation
page readonly
2B3F000
stack
page read and write
1472000
unkown
page execute and read and write
66D000
stack
page read and write
423F000
stack
page read and write
4741000
heap
page read and write
109F000
unkown
page execute and read and write
1D338000
heap
page read and write
1D360000
heap
page read and write
44FE000
stack
page read and write
624000
heap
page read and write
1CEDF000
stack
page read and write
2F6DB000
heap
page read and write
1D360000
heap
page read and write
30BF000
stack
page read and write
2F6D9000
heap
page read and write
1D361000
heap
page read and write
61ECC000
direct allocation
page read and write
4D20000
direct allocation
page execute and read and write
4741000
heap
page read and write
10AB000
unkown
page execute and read and write
1155000
unkown
page execute and read and write
1D339000
heap
page read and write
1450000
unkown
page execute and read and write
1D351000
heap
page read and write
624000
heap
page read and write
1489000
unkown
page execute and write copy
624000
heap
page read and write
1D34C000
heap
page read and write
6C8CF000
unkown
page write copy
323E000
stack
page read and write
3BFF000
stack
page read and write
4741000
heap
page read and write
427E000
stack
page read and write
1D32B000
heap
page read and write
589000
stack
page read and write
2E3F000
stack
page read and write
3AFE000
stack
page read and write
1D30D000
stack
page read and write
4741000
heap
page read and write
1D344000
heap
page read and write
4741000
heap
page read and write
1D35F000
heap
page read and write
624000
heap
page read and write
1D351000
heap
page read and write
1D348000
heap
page read and write
1D340000
heap
page read and write
4741000
heap
page read and write
1D32A000
heap
page read and write
1D336000
heap
page read and write
1D347000
heap
page read and write
624000
heap
page read and write
3FFE000
stack
page read and write
4741000
heap
page read and write
1D336000
heap
page read and write
624000
heap
page read and write
1D325000
heap
page read and write
58D000
stack
page read and write
6E0000
heap
page read and write
624000
heap
page read and write
6C6DE000
unkown
page read and write
23447000
heap
page read and write
F00000
direct allocation
page read and write
1D348000
heap
page read and write
624000
heap
page read and write
624000
heap
page read and write
4741000
heap
page read and write
45FF000
stack
page read and write
734000
heap
page read and write
1CB5E000
stack
page read and write
4741000
heap
page read and write
766000
heap
page read and write
1D33A000
heap
page read and write
624000
heap
page read and write
4741000
heap
page read and write
4741000
heap
page read and write
1D344000
heap
page read and write
1D336000
heap
page read and write
1D33B000
heap
page read and write
1D33A000
heap
page read and write
1D360000
heap
page read and write
624000
heap
page read and write
1D344000
heap
page read and write
4D00000
direct allocation
page execute and read and write
2F6D3000
heap
page read and write
F00000
direct allocation
page read and write
E7E000
stack
page read and write
373E000
stack
page read and write
1627000
unkown
page execute and read and write
4D20000
direct allocation
page execute and read and write
1D344000
heap
page read and write
There are 384 hidden memdumps, click here to show them.