IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BGDBKKFHIEGDHJKECAAK
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\CBAKJKJJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DGCBAFIJDGHCAKECAEGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FHJDGHIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\FHJDGHIJDGCBAAAAAFIJDAECGH
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\GCGHJEBGHJKEBFHIJDHC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HCAAEBKEGHJKEBFHJDBFCFBKKJ
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HCAKFBGCBFHIJKECGIIJKJKJKJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IDGHDGIDAKEBAAKFCGHCBAKJDA
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll2
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.215.113.37/e2b1563c6670f193.phpQ
unknown
http://185.215.113.37/e2b1563c6670f193.phpdowsApps
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll;C
unknown
http://185.215.113.37/e2b1563c6670f193.phpinomi
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll$C
unknown
https://www.ecosia.org/newtab/
unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllt
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://185.215.113.37/e2b1563c6670f193.php1
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.37/e2b1563c6670f193.php3
unknown
http://185.215.113.37e2b1563c6670f193.phption:
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.37/e2b1563c6670f193.phpy
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlll
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 35 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
50D0000
direct allocation
page read and write
 malicious
11BE000
heap
page read and write
 malicious
1E1000
unkown
page execute and read and write
 malicious
1D6AC000
stack
page read and write
2EBB000
heap
page read and write
2FC2E000
heap
page read and write
4C41000
heap
page read and write
1D89F000
heap
page read and write
11A4000
heap
page read and write
5270000
direct allocation
page execute and read and write
5CD000
unkown
page execute and read and write
4C41000
heap
page read and write
1204000
heap
page read and write
11A4000
heap
page read and write
4C41000
heap
page read and write
61ED0000
direct allocation
page read and write
373E000
stack
page read and write
69F000
unkown
page execute and read and write
4C41000
heap
page read and write
2FB90000
trusted library allocation
page read and write
1D888000
heap
page read and write
1D876000
heap
page read and write
4C41000
heap
page read and write
12C0000
heap
page read and write
299B0000
heap
page read and write
6C6C0000
unkown
page readonly
115D000
stack
page read and write
45FF000
stack
page read and write
4C41000
heap
page read and write
49FE000
stack
page read and write
6F861000
unkown
page execute read
1D85F000
heap
page read and write
423F000
stack
page read and write
11A4000
heap
page read and write
43BE000
stack
page read and write
1D86A000
heap
page read and write
299F1000
heap
page read and write
2EB0000
heap
page read and write
2E8C000
stack
page read and write
1D878000
heap
page read and write
3D7E000
stack
page read and write
1D884000
heap
page read and write
4C41000
heap
page read and write
4C41000
heap
page read and write
397F000
stack
page read and write
1D881000
heap
page read and write
1D879000
heap
page read and write
272000
unkown
page execute and read and write
2EA0000
direct allocation
page read and write
2EF000
unkown
page execute and read and write
31FF000
stack
page read and write
1D884000
heap
page read and write
6C8A0000
unkown
page read and write
2EB7000
heap
page read and write
1D891000
heap
page read and write
4C41000
heap
page read and write
1D89C000
heap
page read and write
44BF000
stack
page read and write
4C41000
heap
page read and write
473F000
stack
page read and write
2FA8E000
stack
page read and write
6F8F2000
unkown
page readonly
3D3F000
stack
page read and write
510C000
stack
page read and write
61ECC000
direct allocation
page read and write
4C41000
heap
page read and write
4C41000
heap
page read and write
2EA0000
direct allocation
page read and write
4C41000
heap
page read and write
11A4000
heap
page read and write
11A4000
heap
page read and write
1D97A000
heap
page read and write
383F000
stack
page read and write
11A4000
heap
page read and write
1D879000
heap
page read and write
11A4000
heap
page read and write
1D879000
heap
page read and write
1D884000
heap
page read and write
3ABF000
stack
page read and write
1D88C000
heap
page read and write
4C41000
heap
page read and write
1D8A0000
heap
page read and write
1D87A000
heap
page read and write
477E000
stack
page read and write
4C41000
heap
page read and write
4C41000
heap
page read and write
1D891000
heap
page read and write
1D884000
heap
page read and write
2EA0000
direct allocation
page read and write
1D879000
heap
page read and write
48BE000
stack
page read and write
6DC000
unkown
page execute and write copy
1D868000
heap
page read and write
1D89F000
heap
page read and write
4C41000
heap
page read and write
2EA0000
direct allocation
page read and write
2FBF000
stack
page read and write
1D884000
heap
page read and write
1D884000
heap
page read and write
1D887000
heap
page read and write
1D46D000
stack
page read and write
1D884000
heap
page read and write
50D0000
direct allocation
page read and write
1D880000
heap
page read and write
29A31000
heap
page read and write
4C41000
heap
page read and write
4C41000
heap
page read and write
463E000
stack
page read and write
1D850000
heap
page read and write
1D8A0000
heap
page read and write
1D74E000
stack
page read and write
6F8DD000
unkown
page readonly
1D865000
heap
page read and write
1D884000
heap
page read and write
11A4000
heap
page read and write
11A4000
heap
page read and write
1D884000
heap
page read and write
1D05F000
stack
page read and write
29D000
unkown
page execute and read and write
1D84E000
stack
page read and write
1D87B000
heap
page read and write
1217000
heap
page read and write
11A4000
heap
page read and write
30BF000
stack
page read and write
11A4000
heap
page read and write
1D09E000
stack
page read and write
11A4000
heap
page read and write
299D0000
heap
page read and write
39BE000
stack
page read and write
1D884000
heap
page read and write
4C41000
heap
page read and write
5240000
direct allocation
page execute and read and write
1D884000
heap
page read and write
11A4000
heap
page read and write
1D879000
heap
page read and write
1D86A000
heap
page read and write
23A44000
heap
page read and write
11A4000
heap
page read and write
1D879000
heap
page read and write
4C41000
heap
page read and write
2EA0000
direct allocation
page read and write
1D891000
heap
page read and write
6C85F000
unkown
page readonly
1D87D000
heap
page read and write
1D8A0000
heap
page read and write
2EA0000
direct allocation
page read and write
2CF000
unkown
page execute and read and write
4C41000
heap
page read and write
23A000
unkown
page execute and read and write
2EA0000
direct allocation
page read and write
4C41000
heap
page read and write
1E0000
unkown
page readonly
1D8A1000
heap
page read and write
11A4000
heap
page read and write
11A4000
heap
page read and write
1D884000
heap
page read and write
2EA0000
direct allocation
page read and write
11B0000
heap
page read and write
4C41000
heap
page read and write
150E000
stack
page read and write
1D884000
heap
page read and write
11A4000
heap
page read and write
1D8A1000
heap
page read and write
4C3F000
stack
page read and write
1D884000
heap
page read and write
4C41000
heap
page read and write
6DB000
unkown
page execute and write copy
6C8A5000
unkown
page readonly
3BFF000
stack
page read and write
323E000
stack
page read and write
61ECD000
direct allocation
page readonly
4C41000
heap
page read and write
154D000
stack
page read and write
4C41000
heap
page read and write
1D888000
heap
page read and write
4C41000
heap
page read and write
1D869000
heap
page read and write
1D881000
heap
page read and write
1D8A0000
heap
page read and write
238ED000
heap
page read and write
3AB000
unkown
page execute and read and write
875000
unkown
page execute and read and write
1D86A000
heap
page read and write
265000
unkown
page execute and read and write
3FBF000
stack
page read and write
3C3E000
stack
page read and write
1D89B000
heap
page read and write
1D8A0000
heap
page read and write
2EA0000
direct allocation
page read and write
11A4000
heap
page read and write
1D880000
heap
page read and write
4C41000
heap
page read and write
3FFE000
stack
page read and write
387E000
stack
page read and write
1D41F000
stack
page read and write
4C41000
heap
page read and write
11A0000
heap
page read and write
1D876000
heap
page read and write
5250000
direct allocation
page execute and read and write
30FE000
stack
page read and write
1D879000
heap
page read and write
4AFF000
stack
page read and write
40FF000
stack
page read and write
44FE000
stack
page read and write
1D891000
heap
page read and write
1D8A0000
heap
page read and write
2399E000
heap
page read and write
1232000
heap
page read and write
4C41000
heap
page read and write
1D888000
heap
page read and write
61ED4000
direct allocation
page readonly
4C41000
heap
page read and write
1D86A000
heap
page read and write
50B0000
heap
page read and write
1D86A000
heap
page read and write
1D8A0000
heap
page read and write
4C41000
heap
page read and write
1D87D000
heap
page read and write
1D1DE000
stack
page read and write
4D40000
trusted library allocation
page read and write
4C41000
heap
page read and write
1D87A000
heap
page read and write
1D887000
heap
page read and write
268000
unkown
page execute and read and write
2E90000
heap
page read and write
50D0000
direct allocation
page read and write
5250000
direct allocation
page execute and read and write
1D884000
heap
page read and write
876000
unkown
page execute and write copy
4C41000
heap
page read and write
11A4000
heap
page read and write
11A4000
heap
page read and write
1D8A0000
heap
page read and write
1E0000
unkown
page read and write
6C6C1000
unkown
page execute read
5230000
direct allocation
page execute and read and write
1D891000
heap
page read and write
4C41000
heap
page read and write
1D87D000
heap
page read and write
11A4000
heap
page read and write
2EA0000
direct allocation
page read and write
2FC28000
heap
page read and write
4C50000
heap
page read and write
5280000
direct allocation
page execute and read and write
1D87A000
heap
page read and write
6C89E000
unkown
page read and write
4C41000
heap
page read and write
2EA0000
direct allocation
page read and write
1D87B000
heap
page read and write
11A4000
heap
page read and write
1D884000
heap
page read and write
6F860000
unkown
page readonly
1D56D000
stack
page read and write
1D884000
heap
page read and write
11A4000
heap
page read and write
1D2DE000
stack
page read and write
4C41000
heap
page read and write
4C41000
heap
page read and write
333F000
stack
page read and write
2E4E000
stack
page read and write
11A4000
heap
page read and write
35BF000
stack
page read and write
105C000
stack
page read and write
61EB7000
direct allocation
page readonly
4C41000
heap
page read and write
1D8A0000
heap
page read and write
4C41000
heap
page read and write
1D86A000
heap
page read and write
291000
unkown
page execute and read and write
5220000
direct allocation
page execute and read and write
43E000
unkown
page execute and read and write
1CF5E000
stack
page read and write
1201000
heap
page read and write
11A4000
heap
page read and write
1D869000
heap
page read and write
2EBE000
heap
page read and write
4C41000
heap
page read and write
1159000
stack
page read and write
1D88C000
heap
page read and write
49BF000
stack
page read and write
140E000
stack
page read and write
1D5AD000
stack
page read and write
1E1000
unkown
page execute and write copy
13A0000
heap
page read and write
4C41000
heap
page read and write
34BE000
stack
page read and write
1153000
stack
page read and write
4C41000
heap
page read and write
2FB8F000
stack
page read and write
6C89F000
unkown
page write copy
4C41000
heap
page read and write
11A4000
heap
page read and write
1D87B000
heap
page read and write
2EA0000
direct allocation
page read and write
1D882000
heap
page read and write
1D884000
heap
page read and write
1D891000
heap
page read and write
29A4E000
heap
page read and write
520F000
stack
page read and write
3AFE000
stack
page read and write
427E000
stack
page read and write
11BA000
heap
page read and write
413E000
stack
page read and write
1D88B000
heap
page read and write
1D879000
heap
page read and write
1D970000
trusted library allocation
page read and write
2EA0000
direct allocation
page read and write
1D879000
heap
page read and write
4C41000
heap
page read and write
2C2000
unkown
page execute and read and write
1D888000
heap
page read and write
1D89B000
heap
page read and write
11A4000
heap
page read and write
2FE000
unkown
page execute and read and write
1D891000
heap
page read and write
29A11000
heap
page read and write
4C41000
heap
page read and write
1D891000
heap
page read and write
2FC33000
heap
page read and write
5260000
direct allocation
page execute and read and write
4C41000
heap
page read and write
6F8EE000
unkown
page read and write
4C41000
heap
page read and write
61EB4000
direct allocation
page read and write
2FC3B000
heap
page read and write
2EA0000
direct allocation
page read and write
6CC000
unkown
page execute and read and write
1D887000
heap
page read and write
4C41000
heap
page read and write
1D880000
heap
page read and write
61E00000
direct allocation
page execute and read and write
4C41000
heap
page read and write
11A4000
heap
page read and write
1D86B000
heap
page read and write
3A5000
unkown
page execute and read and write
385000
unkown
page execute and read and write
1D884000
heap
page read and write
11A4000
heap
page read and write
487F000
stack
page read and write
1D891000
heap
page read and write
11A4000
heap
page read and write
4C40000
heap
page read and write
11A4000
heap
page read and write
1D856000
heap
page read and write
11A4000
heap
page read and write
61E01000
direct allocation
page execute read
337E000
stack
page read and write
1D891000
heap
page read and write
4B3E000
stack
page read and write
2FB000
unkown
page execute and read and write
1D888000
heap
page read and write
1D891000
heap
page read and write
437F000
stack
page read and write
4C41000
heap
page read and write
1D19F000
stack
page read and write
4C41000
heap
page read and write
35FE000
stack
page read and write
11A4000
heap
page read and write
4C41000
heap
page read and write
1D888000
heap
page read and write
1D8A0000
heap
page read and write
1D882000
heap
page read and write
11A4000
heap
page read and write
36FF000
stack
page read and write
1D31E000
stack
page read and write
164E000
stack
page read and write
29A51000
heap
page read and write
1D8A1000
heap
page read and write
1D876000
heap
page read and write
4C41000
heap
page read and write
1D89E000
heap
page read and write
1D888000
heap
page read and write
1D884000
heap
page read and write
1D884000
heap
page read and write
1D879000
heap
page read and write
1D884000
heap
page read and write
6C5000
unkown
page execute and read and write
3E7F000
stack
page read and write
61ED3000
direct allocation
page read and write
347F000
stack
page read and write
1D87A000
heap
page read and write
3EBE000
stack
page read and write
4C41000
heap
page read and write
11A4000
heap
page read and write
4C41000
heap
page read and write
11A4000
heap
page read and write
1D884000
heap
page read and write
6DB000
unkown
page execute and read and write
4C41000
heap
page read and write
4C41000
heap
page read and write
4C41000
heap
page read and write
11A4000
heap
page read and write
2FC20000
heap
page read and write
26F000
unkown
page execute and read and write
There are 384 hidden memdumps, click here to show them.