IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFIEGIECGCBKFIEBGCAAFIEBFC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BKKJKFBKKECFHJKEBKEH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FBFCAKKKFBGDGCAKFCFHDAKFHC
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\GCGIDGCG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GHDHDBAECGCAFHJJDAKFHJJEBF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IIJDBGDGCGDAKFIDGIDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IJKJDAFHJDHIEBGCFIDB
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\JKJDAEBF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll(
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
http://185.215.113.37/e2b1563c6670f193.phpp
unknown
http://185.215.113.37/e2b1563c6670f193.phpimple-storage.json$
unknown
http://185.215.113.37e2b1563c6670f193.phption:
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
http://185.215.113.37/e2b1563c6670f193.phpla
unknown
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://185.215.113.37/e2b1563c6670f193.phpmR
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.37/e2b1563c6670f193.phpX
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://185.215.113.37y
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllv
unknown
https://www.ecosia.org/newtab/
unknown
http://185.215.113.37/e2b1563c6670f193.phpD
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllU
unknown
http://185.215.113.37/e2b1563c6670f193.php.
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.37/e2b1563c6670f193.php3
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.37/e2b1563c6670f193.php(
unknown
There are 40 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
61000
unkown
page execute and read and write
 malicious
D5E000
heap
page read and write
 malicious
4A30000
direct allocation
page read and write
 malicious
C24000
heap
page read and write
45A1000
heap
page read and write
1C9FE000
stack
page read and write
1D0AE000
heap
page read and write
4BD0000
direct allocation
page execute and read and write
291C0000
heap
page read and write
45A1000
heap
page read and write
C6D000
stack
page read and write
3B7F000
stack
page read and write
1D0A0000
heap
page read and write
45A1000
heap
page read and write
DB9000
heap
page read and write
1D095000
heap
page read and write
45A1000
heap
page read and write
45A1000
heap
page read and write
4BE0000
direct allocation
page execute and read and write
45A1000
heap
page read and write
1D0AD000
heap
page read and write
45A1000
heap
page read and write
2A3F000
stack
page read and write
45A1000
heap
page read and write
D4B000
stack
page read and write
1D09C000
heap
page read and write
4BC0000
direct allocation
page execute and read and write
C24000
heap
page read and write
291FC000
heap
page read and write
1D09A000
heap
page read and write
45A1000
heap
page read and write
2B7E000
stack
page read and write
1D0BC000
heap
page read and write
45A1000
heap
page read and write
C24000
heap
page read and write
28EF000
stack
page read and write
45A1000
heap
page read and write
291E8000
heap
page read and write
1D097000
heap
page read and write
C24000
heap
page read and write
1D190000
trusted library allocation
page read and write
17E000
unkown
page execute and read and write
32BF000
stack
page read and write
1D09F000
heap
page read and write
61ECD000
direct allocation
page readonly
45A1000
heap
page read and write
C24000
heap
page read and write
45A1000
heap
page read and write
1D0BC000
heap
page read and write
1D09B000
heap
page read and write
C24000
heap
page read and write
D0E000
stack
page read and write
1CF0D000
stack
page read and write
1D0A0000
heap
page read and write
C24000
heap
page read and write
367F000
stack
page read and write
1D0BC000
heap
page read and write
C24000
heap
page read and write
4590000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
45A1000
heap
page read and write
4590000
direct allocation
page read and write
1CC7E000
stack
page read and write
1D0A2000
heap
page read and write
45A1000
heap
page read and write
45A1000
heap
page read and write
61EB4000
direct allocation
page read and write
1D07B000
heap
page read and write
1CC3E000
stack
page read and write
45A1000
heap
page read and write
1D08B000
heap
page read and write
458F000
stack
page read and write
F4F000
stack
page read and write
1D09F000
heap
page read and write
2F3E000
stack
page read and write
45A1000
heap
page read and write
DA1000
heap
page read and write
45A1000
heap
page read and write
291E5000
heap
page read and write
D5A000
heap
page read and write
45A1000
heap
page read and write
45A1000
heap
page read and write
14F000
unkown
page execute and read and write
1D09B000
heap
page read and write
551000
unkown
page execute and read and write
45A1000
heap
page read and write
4590000
direct allocation
page read and write
45A1000
heap
page read and write
C24000
heap
page read and write
4B6F000
stack
page read and write
38FF000
stack
page read and write
61ED3000
direct allocation
page read and write
1D0A5000
heap
page read and write
225000
unkown
page execute and read and write
4590000
direct allocation
page read and write
6C651000
unkown
page execute read
45A1000
heap
page read and write
3A3F000
stack
page read and write
C24000
heap
page read and write
2F27E000
stack
page read and write
C24000
heap
page read and write
23192000
heap
page read and write
293B000
heap
page read and write
2F37F000
stack
page read and write
291EA000
heap
page read and write
448E000
stack
page read and write
1D0AE000
heap
page read and write
1C8BE000
stack
page read and write
567000
unkown
page execute and write copy
E3C000
heap
page read and write
C24000
heap
page read and write
4590000
direct allocation
page read and write
C24000
heap
page read and write
C24000
heap
page read and write
C24000
heap
page read and write
4BB0000
direct allocation
page execute and read and write
45A1000
heap
page read and write
4B90000
direct allocation
page execute and read and write
1D094000
heap
page read and write
45A1000
heap
page read and write
303F000
stack
page read and write
45A1000
heap
page read and write
6C8D0000
unkown
page read and write
EF000
unkown
page execute and read and write
1D09B000
heap
page read and write
61EB7000
direct allocation
page readonly
4A10000
heap
page read and write
22B000
unkown
page execute and read and write
1D0AE000
heap
page read and write
45A1000
heap
page read and write
1D095000
heap
page read and write
1D0A5000
heap
page read and write
C24000
heap
page read and write
29247000
heap
page read and write
BA000
unkown
page execute and read and write
1D09F000
heap
page read and write
1D09F000
heap
page read and write
4BB0000
direct allocation
page execute and read and write
1D090000
heap
page read and write
45A1000
heap
page read and write
1D0AE000
heap
page read and write
1D0BC000
heap
page read and write
6C6DE000
unkown
page read and write
DD4000
heap
page read and write
45A1000
heap
page read and write
1D0AE000
heap
page read and write
2B3F000
stack
page read and write
C24000
heap
page read and write
343E000
stack
page read and write
1D092000
heap
page read and write
1D0BC000
heap
page read and write
B10000
heap
page read and write
1C9BF000
stack
page read and write
F2000
unkown
page execute and read and write
49E0000
trusted library allocation
page read and write
1D0AE000
heap
page read and write
31BE000
stack
page read and write
1D0A0000
heap
page read and write
61E01000
direct allocation
page execute read
C24000
heap
page read and write
45A8000
heap
page read and write
C24000
heap
page read and write
4590000
direct allocation
page read and write
45A1000
heap
page read and write
45A1000
heap
page read and write
2930000
heap
page read and write
1D00E000
stack
page read and write
60000
unkown
page read and write
2F41F000
heap
page read and write
C24000
heap
page read and write
1D070000
heap
page read and write
C24000
heap
page read and write
61000
unkown
page execute and write copy
1D092000
heap
page read and write
1D094000
heap
page read and write
45A1000
heap
page read and write
29205000
heap
page read and write
1D0A0000
heap
page read and write
291E0000
heap
page read and write
1D086000
heap
page read and write
4BA0000
direct allocation
page execute and read and write
C24000
heap
page read and write
45A1000
heap
page read and write
C24000
heap
page read and write
C24000
heap
page read and write
E5000
unkown
page execute and read and write
C24000
heap
page read and write
6C6E2000
unkown
page readonly
1CB3E000
stack
page read and write
1D0A1000
heap
page read and write
6C6F1000
unkown
page execute read
C24000
heap
page read and write
1D09F000
heap
page read and write
17B000
unkown
page execute and read and write
292E000
stack
page read and write
45B0000
heap
page read and write
D9C000
heap
page read and write
4590000
direct allocation
page read and write
111000
unkown
page execute and read and write
1D0B3000
heap
page read and write
16F000
unkown
page execute and read and write
45A1000
heap
page read and write
1D072000
heap
page read and write
357E000
stack
page read and write
29225000
heap
page read and write
393E000
stack
page read and write
1D09F000
heap
page read and write
1D0AE000
heap
page read and write
2F42D000
heap
page read and write
40CE000
stack
page read and write
45A1000
heap
page read and write
1CECC000
stack
page read and write
45A0000
heap
page read and write
1D094000
heap
page read and write
45A1000
heap
page read and write
45A1000
heap
page read and write
6C88F000
unkown
page readonly
45A1000
heap
page read and write
45A1000
heap
page read and write
2C7F000
stack
page read and write
434E000
stack
page read and write
37BF000
stack
page read and write
1D0B6000
heap
page read and write
45A1000
heap
page read and write
291E6000
heap
page read and write
4080000
heap
page read and write
1D0BC000
heap
page read and write
1D190000
heap
page read and write
407F000
stack
page read and write
C24000
heap
page read and write
AFD000
stack
page read and write
45A1000
heap
page read and write
45A1000
heap
page read and write
1D086000
heap
page read and write
230F7000
heap
page read and write
205000
unkown
page execute and read and write
45A1000
heap
page read and write
1D09F000
heap
page read and write
2937000
heap
page read and write
60000
unkown
page readonly
6C6F0000
unkown
page readonly
2F427000
heap
page read and write
45A1000
heap
page read and write
1D097000
heap
page read and write
61ED0000
direct allocation
page read and write
7BC000
stack
page read and write
70A000
unkown
page execute and write copy
1D0A6000
heap
page read and write
29245000
heap
page read and write
45A1000
heap
page read and write
3CBE000
stack
page read and write
3E3E000
stack
page read and write
4A30000
direct allocation
page read and write
33FF000
stack
page read and write
45A1000
heap
page read and write
45A1000
heap
page read and write
1D0BB000
heap
page read and write
C24000
heap
page read and write
142000
unkown
page execute and read and write
2BE000
unkown
page execute and read and write
104E000
stack
page read and write
4590000
direct allocation
page read and write
11D000
unkown
page execute and read and write
1D094000
heap
page read and write
317F000
stack
page read and write
709000
unkown
page execute and read and write
29202000
heap
page read and write
D50000
heap
page read and write
1D0BC000
heap
page read and write
2EFF000
stack
page read and write
BF0000
heap
page read and write
1D098000
heap
page read and write
2F42F000
heap
page read and write
45A1000
heap
page read and write
2CBE000
stack
page read and write
293E000
heap
page read and write
1D095000
heap
page read and write
291F0000
heap
page read and write
C24000
heap
page read and write
45A1000
heap
page read and write
1D09F000
heap
page read and write
AF9000
stack
page read and write
45A1000
heap
page read and write
45A1000
heap
page read and write
1D0A0000
heap
page read and write
1D0B3000
heap
page read and write
1D09F000
heap
page read and write
C24000
heap
page read and write
6C8CF000
unkown
page write copy
1D09B000
heap
page read and write
6C650000
unkown
page readonly
1D095000
heap
page read and write
1D0A0000
heap
page read and write
3CFE000
stack
page read and write
1D0A0000
heap
page read and write
32FE000
stack
page read and write
1D0BC000
heap
page read and write
353F000
stack
page read and write
C24000
heap
page read and write
1D0AE000
heap
page read and write
4590000
direct allocation
page read and write
45A1000
heap
page read and write
307E000
stack
page read and write
1D0BC000
heap
page read and write
1CD7F000
stack
page read and write
3A7E000
stack
page read and write
1D0AE000
heap
page read and write
45C0000
heap
page read and write
AF3000
stack
page read and write
420E000
stack
page read and write
4590000
direct allocation
page read and write
1D09F000
heap
page read and write
1D085000
heap
page read and write
1D092000
heap
page read and write
3DFF000
stack
page read and write
6C6CD000
unkown
page readonly
C24000
heap
page read and write
52B000
unkown
page execute and read and write
C24000
heap
page read and write
2F380000
trusted library allocation
page read and write
1D094000
heap
page read and write
2DFE000
stack
page read and write
1D094000
heap
page read and write
3F3F000
stack
page read and write
444F000
stack
page read and write
45A1000
heap
page read and write
36BE000
stack
page read and write
4590000
direct allocation
page read and write
1CDCE000
stack
page read and write
45A1000
heap
page read and write
6C8CE000
unkown
page read and write
1D09F000
heap
page read and write
37FE000
stack
page read and write
291F9000
heap
page read and write
4A30000
direct allocation
page read and write
567000
unkown
page execute and read and write
C24000
heap
page read and write
1CAFF000
stack
page read and write
61ECC000
direct allocation
page read and write
45A1000
heap
page read and write
1D0B0000
heap
page read and write
3BBE000
stack
page read and write
2F427000
heap
page read and write
558000
unkown
page execute and read and write
CAD000
stack
page read and write
C24000
heap
page read and write
4590000
direct allocation
page read and write
45A1000
heap
page read and write
61ED4000
direct allocation
page readonly
568000
unkown
page execute and write copy
1D09F000
heap
page read and write
1D09A000
heap
page read and write
3F7E000
stack
page read and write
6C8D5000
unkown
page readonly
430F000
stack
page read and write
4590000
direct allocation
page read and write
291A0000
heap
page read and write
1D096000
heap
page read and write
45A1000
heap
page read and write
23232000
heap
page read and write
1D0BC000
heap
page read and write
4B80000
direct allocation
page execute and read and write
1D097000
heap
page read and write
C24000
heap
page read and write
453000
unkown
page execute and read and write
C20000
heap
page read and write
1D085000
heap
page read and write
1D09E000
heap
page read and write
41CF000
stack
page read and write
1D084000
heap
page read and write
E8000
unkown
page execute and read and write
4A6B000
stack
page read and write
45A1000
heap
page read and write
C24000
heap
page read and write
2DBF000
stack
page read and write
4590000
direct allocation
page read and write
There are 366 hidden memdumps, click here to show them.