IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BKFCBFCBFBKEBFIDBKECAEBFCF
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\DGCGDBGCAAEBFIECGHDGCAAEGD
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\EBFBKKJECAKEHJJJDBAF
ASCII text, with very long lines (1808), with CRLF line terminators
dropped
C:\ProgramData\FHCAFIDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FIJJKECFCFBGDHIECAAFIIDAKK
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HIEHDHCFIJDBFHJJDBFHJKJDHI
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IJEHCGIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\JJKFBFIJJECGCAAAFCBG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KJJJDHDGDAAKECAKJDAE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllq$
unknown
 malicious
http://185.215.113.37/d
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnt
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpSession
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php~
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpoinomi
unknown
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phprowser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllS
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllW
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll/
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpb
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpa
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll#
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpR
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpirefox
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllF
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpJ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php2
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php7
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnt-L
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.njy8xaI_aUJp
unknown
https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 45 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
1D1000
unkown
page execute and read and write
 malicious
EDE000
heap
page read and write
 malicious
4BA0000
direct allocation
page read and write
 malicious
4D40000
direct allocation
page execute and read and write
1D1DF000
heap
page read and write
1CADF000
stack
page read and write
3E4E000
stack
page read and write
F5B000
heap
page read and write
298B000
heap
page read and write
45DE000
stack
page read and write
6D7000
unkown
page execute and write copy
1D1DF000
heap
page read and write
6CDC2000
unkown
page readonly
4711000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
46E0000
heap
page read and write
294A1000
heap
page read and write
1D1D6000
heap
page read and write
4711000
heap
page read and write
1D1D9000
heap
page read and write
1D1B2000
heap
page read and write
1D1EC000
heap
page read and write
1D201000
heap
page read and write
4CF0000
direct allocation
page execute and read and write
1CECF000
stack
page read and write
1D1CA000
heap
page read and write
6CD31000
unkown
page execute read
61EB4000
direct allocation
page read and write
1D1DC000
heap
page read and write
1D1EB000
heap
page read and write
4711000
heap
page read and write
1D200000
heap
page read and write
234C0000
heap
page read and write
F58000
heap
page read and write
449E000
stack
page read and write
6D8000
unkown
page execute and write copy
EDA000
heap
page read and write
F85000
heap
page read and write
2B8F000
stack
page read and write
1D1E6000
heap
page read and write
1D201000
heap
page read and write
1D1E4000
heap
page read and write
1D1F2000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D1E5000
heap
page read and write
1D1E4000
heap
page read and write
ED0000
heap
page read and write
69F000
unkown
page execute and read and write
1D1E5000
heap
page read and write
4711000
heap
page read and write
4D20000
direct allocation
page execute and read and write
4711000
heap
page read and write
1D201000
heap
page read and write
4711000
heap
page read and write
4700000
direct allocation
page read and write
CFD000
stack
page read and write
F6B000
heap
page read and write
1D1E7000
heap
page read and write
4711000
heap
page read and write
1D1F2000
heap
page read and write
380E000
stack
page read and write
3BCE000
stack
page read and write
F3D000
heap
page read and write
F6E000
heap
page read and write
1D201000
heap
page read and write
1D1E2000
heap
page read and write
4720000
heap
page read and write
1D1DD000
heap
page read and write
281000
unkown
page execute and read and write
354F000
stack
page read and write
1D201000
heap
page read and write
1D1D9000
heap
page read and write
3F8E000
stack
page read and write
1CC1F000
stack
page read and write
2F0F000
stack
page read and write
1D201000
heap
page read and write
4773000
heap
page read and write
1D1E4000
heap
page read and write
368F000
stack
page read and write
960000
heap
page read and write
435E000
stack
page read and write
304F000
stack
page read and write
4711000
heap
page read and write
293B000
stack
page read and write
2F698000
heap
page read and write
4711000
heap
page read and write
2A8F000
stack
page read and write
22A000
unkown
page execute and read and write
F78000
heap
page read and write
1D201000
heap
page read and write
1D1E4000
heap
page read and write
1D1DD000
heap
page read and write
4BA0000
direct allocation
page read and write
1CC5D000
stack
page read and write
2BF000
unkown
page execute and read and write
4711000
heap
page read and write
4711000
heap
page read and write
2327D000
stack
page read and write
1D1F2000
heap
page read and write
4711000
heap
page read and write
4700000
direct allocation
page read and write
1D1000
unkown
page execute and write copy
4700000
direct allocation
page read and write
1D1E5000
heap
page read and write
4711000
heap
page read and write
6CFAF000
unkown
page write copy
1D00D000
stack
page read and write
40CE000
stack
page read and write
4711000
heap
page read and write
4700000
direct allocation
page read and write
31CE000
stack
page read and write
4D2E000
stack
page read and write
1D04D000
stack
page read and write
2E0E000
stack
page read and write
1D1C8000
heap
page read and write
1D1F2000
heap
page read and write
1D1DB000
heap
page read and write
1D1E4000
heap
page read and write
1D1DA000
heap
page read and write
1D1F8000
heap
page read and write
4730000
heap
page read and write
1D0000
unkown
page readonly
2B2000
unkown
page execute and read and write
4D20000
direct allocation
page execute and read and write
4BDB000
stack
page read and write
4710000
heap
page read and write
4711000
heap
page read and write
1D1E5000
heap
page read and write
1D1E4000
heap
page read and write
2F5FF000
stack
page read and write
358E000
stack
page read and write
1CF0D000
stack
page read and write
61ECD000
direct allocation
page readonly
6CDAD000
unkown
page readonly
2DF000
unkown
page execute and read and write
1D1DF000
heap
page read and write
5BE000
unkown
page execute and read and write
330E000
stack
page read and write
4716000
heap
page read and write
4700000
direct allocation
page read and write
4711000
heap
page read and write
6CDD1000
unkown
page execute read
4711000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
6CDBE000
unkown
page read and write
6CF6F000
unkown
page readonly
1D1E0000
heap
page read and write
4711000
heap
page read and write
1D1DA000
heap
page read and write
1D1DF000
heap
page read and write
4711000
heap
page read and write
1D1CA000
heap
page read and write
4711000
heap
page read and write
4700000
direct allocation
page read and write
1D1CA000
heap
page read and write
41CF000
stack
page read and write
1D2D3000
heap
page read and write
32CF000
stack
page read and write
4700000
direct allocation
page read and write
1D1F8000
heap
page read and write
4711000
heap
page read and write
1D1E4000
heap
page read and write
4711000
heap
page read and write
3D0D000
stack
page read and write
2EE000
unkown
page execute and read and write
CF9000
stack
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
4CDF000
stack
page read and write
1D201000
heap
page read and write
4711000
heap
page read and write
F23000
heap
page read and write
3F4F000
stack
page read and write
6C8000
unkown
page execute and read and write
6CFAE000
unkown
page read and write
1D1C8000
heap
page read and write
2F690000
heap
page read and write
1D1D6000
heap
page read and write
2F600000
trusted library allocation
page read and write
408F000
stack
page read and write
1D1F2000
heap
page read and write
4711000
heap
page read and write
1D1F8000
heap
page read and write
1D1CB000
heap
page read and write
4700000
direct allocation
page read and write
4BA0000
direct allocation
page read and write
1D1DD000
heap
page read and write
4711000
heap
page read and write
308E000
stack
page read and write
4711000
heap
page read and write
1D1DA000
heap
page read and write
100E000
stack
page read and write
340F000
stack
page read and write
1D201000
heap
page read and write
61ED3000
direct allocation
page read and write
110E000
stack
page read and write
1D1CA000
heap
page read and write
1D1C9000
heap
page read and write
2C8F000
stack
page read and write
87C000
unkown
page execute and read and write
4711000
heap
page read and write
4711000
heap
page read and write
6C1000
unkown
page execute and read and write
61E01000
direct allocation
page execute read
CF3000
stack
page read and write
4711000
heap
page read and write
1D1D8000
heap
page read and write
1D1E4000
heap
page read and write
1D1EA000
heap
page read and write
61ED0000
direct allocation
page read and write
1D1DF000
heap
page read and write
29461000
heap
page read and write
1D1F2000
heap
page read and write
4711000
heap
page read and write
1D1DD000
heap
page read and write
1D201000
heap
page read and write
2F4FE000
stack
page read and write
3E0F000
stack
page read and write
61ED4000
direct allocation
page readonly
6CD30000
unkown
page readonly
430F000
stack
page read and write
61ECC000
direct allocation
page read and write
2EB000
unkown
page execute and read and write
4711000
heap
page read and write
1D1DF000
heap
page read and write
F73000
heap
page read and write
2DCF000
stack
page read and write
23421000
heap
page read and write
1D1DA000
heap
page read and write
344E000
stack
page read and write
980000
heap
page read and write
970000
heap
page read and write
4711000
heap
page read and write
1D1DA000
heap
page read and write
1D1DA000
heap
page read and write
2F69B000
heap
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D1B0000
heap
page read and write
29420000
heap
page read and write
1D201000
heap
page read and write
4700000
direct allocation
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
1D1DF000
heap
page read and write
4711000
heap
page read and write
445F000
stack
page read and write
1D1BF000
heap
page read and write
4711000
heap
page read and write
2CCE000
stack
page read and write
6D7000
unkown
page execute and read and write
4711000
heap
page read and write
1D0000
unkown
page read and write
4711000
heap
page read and write
1D1F2000
heap
page read and write
2987000
heap
page read and write
1D1D4000
heap
page read and write
1D1F2000
heap
page read and write
1D1F8000
heap
page read and write
3A8E000
stack
page read and write
F1F000
heap
page read and write
29440000
heap
page read and write
4810000
trusted library allocation
page read and write
1D1C9000
heap
page read and write
1D201000
heap
page read and write
1D1E3000
heap
page read and write
9EE000
stack
page read and write
1D1E4000
heap
page read and write
39B000
unkown
page execute and read and write
4700000
direct allocation
page read and write
394E000
stack
page read and write
1D1E3000
heap
page read and write
1D1F8000
heap
page read and write
262000
unkown
page execute and read and write
4711000
heap
page read and write
294C1000
heap
page read and write
4711000
heap
page read and write
1CB1E000
stack
page read and write
ECE000
stack
page read and write
1D1F2000
heap
page read and write
1D201000
heap
page read and write
2F4E000
stack
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
25F000
unkown
page execute and read and write
29481000
heap
page read and write
1D1F8000
heap
page read and write
4700000
direct allocation
page read and write
87D000
unkown
page execute and write copy
46DF000
stack
page read and write
375000
unkown
page execute and read and write
4711000
heap
page read and write
3A4F000
stack
page read and write
2F69E000
heap
page read and write
4711000
heap
page read and write
318F000
stack
page read and write
6CFB0000
unkown
page read and write
1D201000
heap
page read and write
390F000
stack
page read and write
1D1F2000
heap
page read and write
4711000
heap
page read and write
1D2D0000
trusted library allocation
page read and write
1D1D9000
heap
page read and write
4D00000
direct allocation
page execute and read and write
395000
unkown
page execute and read and write
36CE000
stack
page read and write
4711000
heap
page read and write
2F6A3000
heap
page read and write
420E000
stack
page read and write
4711000
heap
page read and write
1D1D6000
heap
page read and write
4711000
heap
page read and write
23388000
heap
page read and write
1CD5F000
stack
page read and write
4711000
heap
page read and write
1D1DD000
heap
page read and write
28FE000
stack
page read and write
1D1DB000
heap
page read and write
1D1DA000
heap
page read and write
1D1E4000
heap
page read and write
61EB7000
direct allocation
page readonly
61E00000
direct allocation
page execute and read and write
4711000
heap
page read and write
1D1DF000
heap
page read and write
1D1E4000
heap
page read and write
3CCF000
stack
page read and write
1D1E5000
heap
page read and write
4711000
heap
page read and write
258000
unkown
page execute and read and write
4711000
heap
page read and write
1D1DF000
heap
page read and write
4711000
heap
page read and write
298E000
heap
page read and write
1D201000
heap
page read and write
255000
unkown
page execute and read and write
4711000
heap
page read and write
1D1DC000
heap
page read and write
4711000
heap
page read and write
4D10000
direct allocation
page execute and read and write
90C000
stack
page read and write
1D1E4000
heap
page read and write
1D1DF000
heap
page read and write
1D201000
heap
page read and write
4711000
heap
page read and write
2337D000
stack
page read and write
6CDD0000
unkown
page readonly
459F000
stack
page read and write
4711000
heap
page read and write
37CF000
stack
page read and write
1D201000
heap
page read and write
4711000
heap
page read and write
28D000
unkown
page execute and read and write
42E000
unkown
page execute and read and write
4700000
direct allocation
page read and write
4700000
direct allocation
page read and write
4711000
heap
page read and write
4711000
heap
page read and write
3B8F000
stack
page read and write
4711000
heap
page read and write
2980000
heap
page read and write
297E000
stack
page read and write
6CFB5000
unkown
page readonly
1CDCE000
stack
page read and write
1D14D000
stack
page read and write
4D30000
direct allocation
page execute and read and write
1D1F2000
heap
page read and write
1D1DE000
heap
page read and write
1D1E1000
heap
page read and write
F80000
heap
page read and write
4711000
heap
page read and write
1D201000
heap
page read and write
1D1DA000
heap
page read and write
4700000
direct allocation
page read and write
1D201000
heap
page read and write
4310000
heap
page read and write
965000
heap
page read and write
1D1E4000
heap
page read and write
There are 370 hidden memdumps, click here to show them.