IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BFBFBFIIJDAKECAKKJEHCFIJKK
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DHCFIDAK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\ECGHCBGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EHJJKFCBGIDGHIECGCBKFHIEBG
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\FHJKKECFIECAKECAFBGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJDGCGHCGHCBFHJJKKJE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KJDGIJECFIEBFIDHCGHD
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\KJDGIJECFIEBFIDHCGHDHIEBAK
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\KKJKKJJKJEGIECAKJJEBFBAKKE
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllL
unknown
http://185.215.113.37/e2b1563c6670f193.php9e
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.215.113.37/e2b1563c6670f193.php0u
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllr
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllP
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
http://185.215.113.37/e2b1563c6670f193.phppiT
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.113.37:
unknown
http://185.215.113.37/e2b1563c6670f193.phpm
unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll(
unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllZ
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.37/e2b1563c6670f193.php3C
unknown
http://185.215.113.37/e2b1563c6670f193.phpx
unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll17-2476756634-1003gv
unknown
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.37/e2b1563c6670f193.phpZ
unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll~
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllLocal
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll$u
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllp
unknown
http://185.215.113.37/e2b1563c6670f193.php3
unknown
http://185.215.113.37/:
unknown
http://185.215.113.37/e2b1563c6670f193.phpMeq
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
http://185.215.113.37/e2b1563c6670f193.phpieU
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll7
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.37e2b1563c6670f193.phpefox
unknown
http://185.215.113.37/e2b1563c6670f193.phpAem
unknown
http://185.215.113.37/e2b1563c6670f193.phpqe=
unknown
There are 49 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
921000
unkown
page execute and read and write
 malicious
6DE000
heap
page read and write
 malicious
4B90000
direct allocation
page read and write
 malicious
4711000
heap
page read and write
E08000
unkown
page execute and read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D360000
heap
page read and write
1CD9F000
stack
page read and write
1D32A000
heap
page read and write
234FB000
heap
page read and write
1D341000
heap
page read and write
448F000
stack
page read and write
574000
stack
page read and write
4711000
heap
page read and write
6B4000
heap
page read and write
4711000
heap
page read and write
3BCF000
stack
page read and write
6B4000
heap
page read and write
1D16C000
stack
page read and write
1D344000
heap
page read and write
334E000
stack
page read and write
2A0E000
heap
page read and write
6C651000
unkown
page execute read
4711000
heap
page read and write
370E000
stack
page read and write
308F000
stack
page read and write
61EB4000
direct allocation
page read and write
6B4000
heap
page read and write
4CE0000
direct allocation
page execute and read and write
1D340000
heap
page read and write
4D10000
direct allocation
page execute and read and write
61ECD000
direct allocation
page readonly
2A0B000
heap
page read and write
1D351000
heap
page read and write
233AD000
heap
page read and write
1D33B000
heap
page read and write
B6A000
unkown
page execute and read and write
1D344000
heap
page read and write
4711000
heap
page read and write
6B4000
heap
page read and write
4D00000
direct allocation
page execute and read and write
1D342000
heap
page read and write
294C2000
heap
page read and write
3E4E000
stack
page read and write
1D344000
heap
page read and write
1D35F000
heap
page read and write
1D351000
heap
page read and write
A3E000
unkown
page execute and read and write
1D339000
heap
page read and write
6C8CF000
unkown
page write copy
6B4000
heap
page read and write
61EB7000
direct allocation
page readonly
4711000
heap
page read and write
1D34C000
heap
page read and write
1D360000
heap
page read and write
299E000
stack
page read and write
A2F000
unkown
page execute and read and write
1D32A000
heap
page read and write
4711000
heap
page read and write
1D344000
heap
page read and write
29E0000
direct allocation
page read and write
29E0000
direct allocation
page read and write
1D344000
heap
page read and write
578000
stack
page read and write
1D347000
heap
page read and write
29E0000
direct allocation
page read and write
47C000
stack
page read and write
1D339000
heap
page read and write
6C6CD000
unkown
page readonly
4711000
heap
page read and write
762000
heap
page read and write
1D361000
heap
page read and write
1D344000
heap
page read and write
1CC5F000
stack
page read and write
61E00000
direct allocation
page execute and read and write
9AF000
unkown
page execute and read and write
29E0000
direct allocation
page read and write
9D1000
unkown
page execute and read and write
44CE000
stack
page read and write
1D340000
heap
page read and write
30CE000
stack
page read and write
6B4000
heap
page read and write
1D351000
heap
page read and write
920000
unkown
page readonly
4711000
heap
page read and write
2A07000
heap
page read and write
6B4000
heap
page read and write
294A1000
heap
page read and write
6B4000
heap
page read and write
2B0F000
stack
page read and write
330F000
stack
page read and write
1D360000
heap
page read and write
1D344000
heap
page read and write
1D348000
heap
page read and write
420F000
stack
page read and write
6B4000
heap
page read and write
8CE000
stack
page read and write
6B0000
heap
page read and write
4711000
heap
page read and write
1D32A000
heap
page read and write
320E000
stack
page read and write
97A000
unkown
page execute and read and write
4CCF000
stack
page read and write
1D20D000
stack
page read and write
4711000
heap
page read and write
1D361000
heap
page read and write
4D30000
direct allocation
page execute and read and write
6B4000
heap
page read and write
1D06E000
stack
page read and write
1D32A000
heap
page read and write
4711000
heap
page read and write
35CE000
stack
page read and write
6B4000
heap
page read and write
1D33D000
heap
page read and write
1D317000
heap
page read and write
1D435000
heap
page read and write
2F6D9000
heap
page read and write
1D351000
heap
page read and write
29E0000
direct allocation
page read and write
AE5000
unkown
page execute and read and write
438E000
stack
page read and write
3A8F000
stack
page read and write
4711000
heap
page read and write
1D347000
heap
page read and write
1D348000
heap
page read and write
4711000
heap
page read and write
1D02D000
stack
page read and write
90C000
stack
page read and write
3D0F000
stack
page read and write
1D336000
heap
page read and write
6B4000
heap
page read and write
61ED0000
direct allocation
page read and write
4711000
heap
page read and write
6B4000
heap
page read and write
3C0E000
stack
page read and write
3E8E000
stack
page read and write
4711000
heap
page read and write
1D340000
heap
page read and write
6B4000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D33A000
heap
page read and write
460E000
stack
page read and write
572000
stack
page read and write
4711000
heap
page read and write
1D328000
heap
page read and write
2F6D1000
heap
page read and write
1D30D000
stack
page read and write
398E000
stack
page read and write
86E000
stack
page read and write
1D35C000
heap
page read and write
29480000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
6B4000
heap
page read and write
1CB5E000
stack
page read and write
6B4000
heap
page read and write
753000
heap
page read and write
4711000
heap
page read and write
6B4000
heap
page read and write
29E0000
direct allocation
page read and write
82E000
stack
page read and write
FAF000
unkown
page execute and read and write
1D344000
heap
page read and write
1D329000
heap
page read and write
6B4000
heap
page read and write
61ED3000
direct allocation
page read and write
4711000
heap
page read and write
1D339000
heap
page read and write
1D360000
heap
page read and write
2F6E4000
heap
page read and write
4711000
heap
page read and write
29E0000
direct allocation
page read and write
4711000
heap
page read and write
4720000
heap
page read and write
4D20000
direct allocation
page execute and read and write
11BF000
stack
page read and write
6B4000
heap
page read and write
1D33D000
heap
page read and write
4730000
heap
page read and write
4711000
heap
page read and write
724000
heap
page read and write
736000
heap
page read and write
A02000
unkown
page execute and read and write
6B4000
heap
page read and write
4710000
heap
page read and write
6B4000
heap
page read and write
6DA000
heap
page read and write
1CDDE000
stack
page read and write
1D32A000
heap
page read and write
1D342000
heap
page read and write
36CF000
stack
page read and write
6B4000
heap
page read and write
6B4000
heap
page read and write
6B4000
heap
page read and write
4711000
heap
page read and write
1D351000
heap
page read and write
4711000
heap
page read and write
1D329000
heap
page read and write
1D33B000
heap
page read and write
1D360000
heap
page read and write
29E0000
direct allocation
page read and write
1D339000
heap
page read and write
1D35F000
heap
page read and write
4711000
heap
page read and write
29E0000
direct allocation
page read and write
1D348000
heap
page read and write
4711000
heap
page read and write
4B70000
heap
page read and write
4711000
heap
page read and write
6C8D5000
unkown
page readonly
29E0000
direct allocation
page read and write
1D341000
heap
page read and write
384E000
stack
page read and write
1D344000
heap
page read and write
1D344000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
394F000
stack
page read and write
23455000
heap
page read and write
61ECC000
direct allocation
page read and write
2F6DF000
heap
page read and write
6C6E2000
unkown
page readonly
1D348000
heap
page read and write
1D339000
heap
page read and write
6C650000
unkown
page readonly
1D344000
heap
page read and write
4711000
heap
page read and write
1D360000
heap
page read and write
E17000
unkown
page execute and read and write
10BE000
stack
page read and write
4711000
heap
page read and write
6B4000
heap
page read and write
380F000
stack
page read and write
1D348000
heap
page read and write
910000
heap
page read and write
6B4000
heap
page read and write
4B50000
trusted library allocation
page read and write
1D339000
heap
page read and write
1D344000
heap
page read and write
6C6F1000
unkown
page execute read
1D32A000
heap
page read and write
1D336000
heap
page read and write
1D35B000
heap
page read and write
920000
unkown
page read and write
4714000
heap
page read and write
A3B000
unkown
page execute and read and write
1D344000
heap
page read and write
4711000
heap
page read and write
1D361000
heap
page read and write
1D351000
heap
page read and write
1D33A000
heap
page read and write
1D31F000
heap
page read and write
4711000
heap
page read and write
29E0000
direct allocation
page read and write
4711000
heap
page read and write
29DE000
stack
page read and write
B7E000
unkown
page execute and read and write
4D10000
direct allocation
page execute and read and write
6C8CE000
unkown
page read and write
2E4E000
stack
page read and write
4711000
heap
page read and write
1D339000
heap
page read and write
4B90000
direct allocation
page read and write
6B4000
heap
page read and write
AC5000
unkown
page execute and read and write
4711000
heap
page read and write
2E0F000
stack
page read and write
1D33A000
heap
page read and write
6D0000
heap
page read and write
1D344000
heap
page read and write
29E0000
direct allocation
page read and write
6B4000
heap
page read and write
1D348000
heap
page read and write
3ACE000
stack
page read and write
434F000
stack
page read and write
6B4000
heap
page read and write
2C0F000
stack
page read and write
1D344000
heap
page read and write
4BCC000
stack
page read and write
2F6EC000
heap
page read and write
2D0F000
stack
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
9DD000
unkown
page execute and read and write
6C6F0000
unkown
page readonly
6C8D0000
unkown
page read and write
1D351000
heap
page read and write
1D34B000
heap
page read and write
3D4E000
stack
page read and write
1D32B000
heap
page read and write
E18000
unkown
page execute and write copy
1D35E000
heap
page read and write
1D310000
heap
page read and write
4711000
heap
page read and write
1D347000
heap
page read and write
1D344000
heap
page read and write
1D344000
heap
page read and write
AEB000
unkown
page execute and read and write
4711000
heap
page read and write
1D344000
heap
page read and write
2F63F000
stack
page read and write
1D360000
heap
page read and write
4711000
heap
page read and write
6B4000
heap
page read and write
1D344000
heap
page read and write
6C88F000
unkown
page readonly
4711000
heap
page read and write
1D348000
heap
page read and write
2F8E000
stack
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D325000
heap
page read and write
29E0000
direct allocation
page read and write
1D34C000
heap
page read and write
1D360000
heap
page read and write
1D360000
heap
page read and write
348E000
stack
page read and write
1D344000
heap
page read and write
3FCE000
stack
page read and write
6C0000
heap
page read and write
1CA1E000
stack
page read and write
1D339000
heap
page read and write
4711000
heap
page read and write
6B4000
heap
page read and write
6B4000
heap
page read and write
CFF000
unkown
page execute and read and write
5D0000
heap
page read and write
9B2000
unkown
page execute and read and write
470F000
stack
page read and write
61ED4000
direct allocation
page readonly
1D33D000
heap
page read and write
31CF000
stack
page read and write
1D351000
heap
page read and write
4711000
heap
page read and write
1CC9E000
stack
page read and write
29513000
heap
page read and write
4B90000
direct allocation
page read and write
1D351000
heap
page read and write
1D344000
heap
page read and write
1D35B000
heap
page read and write
1D351000
heap
page read and write
4711000
heap
page read and write
344F000
stack
page read and write
6B4000
heap
page read and write
FB0000
unkown
page execute and write copy
29460000
heap
page read and write
6B4000
heap
page read and write
1D339000
heap
page read and write
57D000
stack
page read and write
410E000
stack
page read and write
3F8F000
stack
page read and write
29503000
heap
page read and write
1D351000
heap
page read and write
2F640000
trusted library allocation
page read and write
2F4F000
stack
page read and write
1D360000
heap
page read and write
6B4000
heap
page read and write
4D40000
direct allocation
page execute and read and write
29E0000
direct allocation
page read and write
1D430000
trusted library allocation
page read and write
1D339000
heap
page read and write
E17000
unkown
page execute and write copy
4CF0000
direct allocation
page execute and read and write
1CEDF000
stack
page read and write
40CF000
stack
page read and write
45CF000
stack
page read and write
2A00000
heap
page read and write
294E2000
heap
page read and write
DFC000
unkown
page execute and read and write
1CF2D000
stack
page read and write
9A8000
unkown
page execute and read and write
6C6DE000
unkown
page read and write
9A5000
unkown
page execute and read and write
1D344000
heap
page read and write
424E000
stack
page read and write
4711000
heap
page read and write
6B4000
heap
page read and write
6B4000
heap
page read and write
4711000
heap
page read and write
1D344000
heap
page read and write
A0F000
unkown
page execute and read and write
1D33A000
heap
page read and write
1D336000
heap
page read and write
2F53E000
stack
page read and write
29518000
heap
page read and write
4711000
heap
page read and write
1D338000
heap
page read and write
4711000
heap
page read and write
DD9000
unkown
page execute and read and write
358F000
stack
page read and write
1D33B000
heap
page read and write
4711000
heap
page read and write
61E01000
direct allocation
page execute read
921000
unkown
page execute and write copy
4711000
heap
page read and write
1CB1F000
stack
page read and write
There are 388 hidden memdumps, click here to show them.