IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKECBFBAEBKJJJJKFCGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\CBGCAFII
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CBGCAFIIECBFIDHIJKFB
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\DAKEBAKFHCFHIEBFBAFBKFCAEH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DHCAECGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\EBFBKFBGIIIDGDGCFCGIIDAKFC
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\HCFIIIJJKJKFHIDGDBAKJEBKEG
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\HIDHDGDHJEGHIDGDHCGCBAKFHI
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KEBGHCBAEGDHIDGCBAEC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllr
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll1
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.113.37/e2b1563c6670f193.php37
unknown
http://185.215.113.37/e2b1563c6670f193.phpyl;
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll-
unknown
http://185.215.113.37/e2b1563c6670f193.phpm
unknown
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
http://185.215.113.37/e2b1563c6670f193.phpch
unknown
http://185.215.113.37e2b1563c6670f193.phption:
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
http://185.215.113.37/e2b1563c6670f193.php_
unknown
http://www.sqlite.org/copyright.html.
unknown
http://185.215.113.37/$5
unknown
http://185.215.113.37/e2b1563c6670f193.phpK
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.37u
unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllM
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
http://185.215.113.37/e2b1563c6670f193.php/
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllC
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
http://185.215.113.37/e2b1563c6670f193.php7
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
http://185.215.113.37/C5
unknown
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 43 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
125E000
heap
page read and write
 malicious
5110000
direct allocation
page read and write
 malicious
541000
unkown
page execute and read and write
 malicious
622000
unkown
page execute and read and write
125A000
heap
page read and write
13A0000
direct allocation
page read and write
134A000
heap
page read and write
A3D000
unkown
page execute and read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D8A9000
heap
page read and write
13A0000
direct allocation
page read and write
61ED0000
direct allocation
page read and write
1D8A6000
heap
page read and write
2FB11000
heap
page read and write
5FD000
unkown
page execute and read and write
16CE000
stack
page read and write
29A71000
heap
page read and write
4C91000
heap
page read and write
6C651000
unkown
page execute read
4C91000
heap
page read and write
6C650000
unkown
page readonly
1D89A000
heap
page read and write
1D8C1000
heap
page read and write
524F000
stack
page read and write
1D8B8000
heap
page read and write
1D8C1000
heap
page read and write
6C6CD000
unkown
page readonly
364E000
stack
page read and write
13B4000
heap
page read and write
4C90000
heap
page read and write
1D8A9000
heap
page read and write
418E000
stack
page read and write
1D8B1000
heap
page read and write
13B4000
heap
page read and write
2FAF000
stack
page read and write
1D8CC000
heap
page read and write
1D08F000
stack
page read and write
4C91000
heap
page read and write
50D0000
trusted library allocation
page read and write
1D8C1000
heap
page read and write
2FB0E000
heap
page read and write
4C91000
heap
page read and write
13A0000
direct allocation
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
6C6F1000
unkown
page execute read
404E000
stack
page read and write
1D8AB000
heap
page read and write
4C91000
heap
page read and write
61E01000
direct allocation
page execute read
12EB000
heap
page read and write
1D8C1000
heap
page read and write
61E00000
direct allocation
page execute and read and write
13B4000
heap
page read and write
4C91000
heap
page read and write
1D899000
heap
page read and write
4C91000
heap
page read and write
1D8B8000
heap
page read and write
1D8D0000
heap
page read and write
13B4000
heap
page read and write
1D0CE000
stack
page read and write
1D8C1000
heap
page read and write
13A0000
direct allocation
page read and write
324F000
stack
page read and write
314E000
stack
page read and write
4B4F000
stack
page read and write
1D8B8000
heap
page read and write
13A0000
direct allocation
page read and write
65E000
unkown
page execute and read and write
F9D000
stack
page read and write
13B4000
heap
page read and write
61EB4000
direct allocation
page read and write
705000
unkown
page execute and read and write
13B4000
heap
page read and write
5110000
direct allocation
page read and write
61ECD000
direct allocation
page readonly
4C91000
heap
page read and write
1D8C1000
heap
page read and write
3A0E000
stack
page read and write
4C91000
heap
page read and write
1D8B7000
heap
page read and write
1250000
heap
page read and write
4CB0000
heap
page read and write
1D8A9000
heap
page read and write
6C8CE000
unkown
page read and write
1D59C000
stack
page read and write
13A0000
direct allocation
page read and write
1D8B4000
heap
page read and write
4C91000
heap
page read and write
2FCB000
heap
page read and write
1D8B8000
heap
page read and write
1D5DD000
stack
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D8D0000
heap
page read and write
454E000
stack
page read and write
6C8CF000
unkown
page write copy
13B4000
heap
page read and write
F93000
stack
page read and write
1D8C1000
heap
page read and write
1D8B4000
heap
page read and write
BD5000
unkown
page execute and read and write
12A0000
heap
page read and write
12D2000
heap
page read and write
1D8AA000
heap
page read and write
5290000
direct allocation
page execute and read and write
1D8D0000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D8AA000
heap
page read and write
61ED3000
direct allocation
page read and write
1D8B4000
heap
page read and write
300B000
stack
page read and write
1D8D0000
heap
page read and write
4C91000
heap
page read and write
12A2000
heap
page read and write
1D8B8000
heap
page read and write
29A25000
heap
page read and write
4C91000
heap
page read and write
414F000
stack
page read and write
13B0000
heap
page read and write
1D89B000
heap
page read and write
1D8A8000
heap
page read and write
59A000
unkown
page execute and read and write
4C91000
heap
page read and write
13B4000
heap
page read and write
13B4000
heap
page read and write
1D8C1000
heap
page read and write
3F0E000
stack
page read and write
1D8B4000
heap
page read and write
4C91000
heap
page read and write
5D2000
unkown
page execute and read and write
1D8BC000
heap
page read and write
1D8A9000
heap
page read and write
2FC0000
heap
page read and write
1D8B0000
heap
page read and write
4C91000
heap
page read and write
490E000
stack
page read and write
13A0000
direct allocation
page read and write
1D8D1000
heap
page read and write
A2F000
unkown
page execute and read and write
1D8D1000
heap
page read and write
65B000
unkown
page execute and read and write
450F000
stack
page read and write
4C91000
heap
page read and write
1D8BB000
heap
page read and write
1D8AD000
heap
page read and write
1D8B1000
heap
page read and write
4C91000
heap
page read and write
13B4000
heap
page read and write
1D89A000
heap
page read and write
1390000
heap
page read and write
3C8E000
stack
page read and write
478F000
stack
page read and write
2FA70000
trusted library allocation
page read and write
15CE000
stack
page read and write
6C88F000
unkown
page readonly
13B4000
heap
page read and write
4C91000
heap
page read and write
299F0000
heap
page read and write
1D8B4000
heap
page read and write
1D899000
heap
page read and write
50F0000
heap
page read and write
13B4000
heap
page read and write
70B000
unkown
page execute and read and write
1D20E000
stack
page read and write
1D8B7000
heap
page read and write
1D8B4000
heap
page read and write
1D89A000
heap
page read and write
13B4000
heap
page read and write
468E000
stack
page read and write
1D8C1000
heap
page read and write
48CF000
stack
page read and write
338F000
stack
page read and write
4C91000
heap
page read and write
1D8B4000
heap
page read and write
1D8CF000
heap
page read and write
5270000
direct allocation
page execute and read and write
540000
unkown
page readonly
13B4000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D8B4000
heap
page read and write
52B0000
direct allocation
page execute and read and write
A3E000
unkown
page execute and write copy
79E000
unkown
page execute and read and write
4C91000
heap
page read and write
34CF000
stack
page read and write
378E000
stack
page read and write
1CF8E000
stack
page read and write
6C8D5000
unkown
page readonly
3B0F000
stack
page read and write
29A1C000
heap
page read and write
1D886000
heap
page read and write
13B4000
heap
page read and write
1D77E000
stack
page read and write
13B4000
heap
page read and write
13A0000
direct allocation
page read and write
1D8C1000
heap
page read and write
514C000
stack
page read and write
4C91000
heap
page read and write
29A28000
heap
page read and write
1D89A000
heap
page read and write
5C5000
unkown
page execute and read and write
3ECF000
stack
page read and write
13B4000
heap
page read and write
13A0000
direct allocation
page read and write
3B4E000
stack
page read and write
13B4000
heap
page read and write
4C91000
heap
page read and write
1D8B0000
heap
page read and write
29A12000
heap
page read and write
13A0000
direct allocation
page read and write
13B4000
heap
page read and write
4C91000
heap
page read and write
1D8B2000
heap
page read and write
1D8B4000
heap
page read and write
1D8A9000
heap
page read and write
29A11000
heap
page read and write
13B4000
heap
page read and write
1D8B4000
heap
page read and write
1D8B4000
heap
page read and write
4C91000
heap
page read and write
1D8B4000
heap
page read and write
1D8D1000
heap
page read and write
A03000
unkown
page execute and read and write
4C91000
heap
page read and write
1D1CF000
stack
page read and write
1D8D0000
heap
page read and write
360F000
stack
page read and write
64F000
unkown
page execute and read and write
13B4000
heap
page read and write
4C91000
heap
page read and write
1D88F000
heap
page read and write
1D44F000
stack
page read and write
310F000
stack
page read and write
4C91000
heap
page read and write
A3D000
unkown
page execute and write copy
1D8B4000
heap
page read and write
4C8F000
stack
page read and write
1D8A9000
heap
page read and write
52A0000
direct allocation
page execute and read and write
5260000
direct allocation
page execute and read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D8B4000
heap
page read and write
47CE000
stack
page read and write
1D8A9000
heap
page read and write
29A31000
heap
page read and write
1D895000
heap
page read and write
1D8CB000
heap
page read and write
2FCE000
heap
page read and write
1D8B4000
heap
page read and write
6C6F0000
unkown
page readonly
13B4000
heap
page read and write
62F000
unkown
page execute and read and write
5290000
direct allocation
page execute and read and write
388F000
stack
page read and write
2391C000
heap
page read and write
1D8C1000
heap
page read and write
350E000
stack
page read and write
1D8A9000
heap
page read and write
1D49D000
stack
page read and write
4C91000
heap
page read and write
F99000
stack
page read and write
4C91000
heap
page read and write
1D9AE000
heap
page read and write
29A16000
heap
page read and write
158E000
stack
page read and write
4C91000
heap
page read and write
A25000
unkown
page execute and read and write
1D8AD000
heap
page read and write
13B4000
heap
page read and write
13B4000
heap
page read and write
33CE000
stack
page read and write
2FB00000
heap
page read and write
1D8A6000
heap
page read and write
1D8B4000
heap
page read and write
13A0000
direct allocation
page read and write
13B4000
heap
page read and write
1D8B8000
heap
page read and write
4C91000
heap
page read and write
1D8BC000
heap
page read and write
39CF000
stack
page read and write
5CF000
unkown
page execute and read and write
138E000
stack
page read and write
61ED4000
direct allocation
page readonly
1D8D0000
heap
page read and write
1D89A000
heap
page read and write
1D8A9000
heap
page read and write
1D898000
heap
page read and write
1D8AA000
heap
page read and write
2EAE000
stack
page read and write
4C91000
heap
page read and write
5280000
direct allocation
page execute and read and write
4C91000
heap
page read and write
13B4000
heap
page read and write
E9C000
stack
page read and write
13A0000
direct allocation
page read and write
1D8D0000
heap
page read and write
6C8D0000
unkown
page read and write
1D8B2000
heap
page read and write
13B4000
heap
page read and write
23A6C000
heap
page read and write
1D9A0000
trusted library allocation
page read and write
4CA0000
heap
page read and write
5F1000
unkown
page execute and read and write
1D8AB000
heap
page read and write
1D8B7000
heap
page read and write
13B4000
heap
page read and write
4C91000
heap
page read and write
61ECC000
direct allocation
page read and write
43CE000
stack
page read and write
1D8CE000
heap
page read and write
13B4000
heap
page read and write
1D8AA000
heap
page read and write
4A0F000
stack
page read and write
4C91000
heap
page read and write
29A2E000
heap
page read and write
1D8D0000
heap
page read and write
428F000
stack
page read and write
4C91000
heap
page read and write
3D8F000
stack
page read and write
4C91000
heap
page read and write
541000
unkown
page execute and write copy
4C91000
heap
page read and write
13B4000
heap
page read and write
29A14000
heap
page read and write
12B6000
heap
page read and write
1D8AD000
heap
page read and write
42CE000
stack
page read and write
1D30E000
stack
page read and write
1D8CB000
heap
page read and write
2FB08000
heap
page read and write
400F000
stack
page read and write
13B4000
heap
page read and write
440E000
stack
page read and write
29A51000
heap
page read and write
3C4F000
stack
page read and write
1D8B4000
heap
page read and write
1D880000
heap
page read and write
4C91000
heap
page read and write
92D000
unkown
page execute and read and write
4C91000
heap
page read and write
2FC7000
heap
page read and write
4C91000
heap
page read and write
1D8A9000
heap
page read and write
1D8A6000
heap
page read and write
6C6E2000
unkown
page readonly
13B4000
heap
page read and write
1D8B8000
heap
page read and write
1D8CF000
heap
page read and write
1D8B4000
heap
page read and write
6E5000
unkown
page execute and read and write
4C91000
heap
page read and write
FF0000
heap
page read and write
5C8000
unkown
page execute and read and write
1D34E000
stack
page read and write
1D87D000
stack
page read and write
1D89A000
heap
page read and write
374F000
stack
page read and write
1D8B4000
heap
page read and write
2FB09000
heap
page read and write
1D6DD000
stack
page read and write
4B8E000
stack
page read and write
6C6DE000
unkown
page read and write
239BE000
heap
page read and write
1D8D0000
heap
page read and write
4C91000
heap
page read and write
61EB7000
direct allocation
page readonly
1D8B4000
heap
page read and write
13B4000
heap
page read and write
464F000
stack
page read and write
38CE000
stack
page read and write
13B4000
heap
page read and write
1D8B4000
heap
page read and write
540000
unkown
page read and write
5110000
direct allocation
page read and write
1200000
heap
page read and write
13B4000
heap
page read and write
4C91000
heap
page read and write
299D0000
heap
page read and write
4C91000
heap
page read and write
1D8B4000
heap
page read and write
13A0000
direct allocation
page read and write
1D8B0000
heap
page read and write
13B4000
heap
page read and write
1D8AB000
heap
page read and write
4C91000
heap
page read and write
3DCE000
stack
page read and write
4A4E000
stack
page read and write
1D8B4000
heap
page read and write
328E000
stack
page read and write
13A0000
direct allocation
page read and write
13B4000
heap
page read and write
1D8D0000
heap
page read and write
There are 388 hidden memdumps, click here to show them.