IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\CAAAAFBKFIECAAKECGCAAKJECB
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\CFBFHIEB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\DGCBAFIJDGHCAKECAEGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DGDBKFBAKFBFHIECFBFIJKJKKF
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HIIIDAKKJJJKKECAKKJEGHCBKJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\JDGIECGIEBKJJJJKEGHJJJKEBA
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JKFIDGDH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KFIJJEGHDAEBGCAKJKFH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KKKEBKJJDGHCBGCAAKEH
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllr
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpse
unknown
 malicious
http://185.215.113.37/0d
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpr
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpGO
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpp
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpATE
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpo
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpH;
unknown
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpJ$S
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dlla
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dlls
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phprname
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpT
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllo
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php0
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlle
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phppey
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php(
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 44 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
52C0000
direct allocation
page read and write
 malicious
A1000
unkown
page execute and read and write
 malicious
137E000
heap
page read and write
 malicious
4E31000
heap
page read and write
1DA44000
heap
page read and write
4E31000
heap
page read and write
6C8CE000
unkown
page read and write
1DA3B000
heap
page read and write
467F000
stack
page read and write
4E31000
heap
page read and write
4E20000
direct allocation
page read and write
52FC000
stack
page read and write
34FF000
stack
page read and write
1350000
heap
page read and write
1DA44000
heap
page read and write
4E31000
heap
page read and write
1DA44000
heap
page read and write
132000
unkown
page execute and read and write
4E31000
heap
page read and write
1402000
heap
page read and write
1DA51000
heap
page read and write
1D72D000
stack
page read and write
1DA48000
heap
page read and write
32BE000
stack
page read and write
23B33000
heap
page read and write
1DA44000
heap
page read and write
1407000
heap
page read and write
1D62D000
stack
page read and write
1DA3D000
heap
page read and write
4E31000
heap
page read and write
1DA42000
heap
page read and write
1DA25000
heap
page read and write
1DA4C000
heap
page read and write
1DA47000
heap
page read and write
1DA29000
heap
page read and write
5270000
trusted library allocation
page read and write
317B000
heap
page read and write
1355000
heap
page read and write
1DA41000
heap
page read and write
1DA51000
heap
page read and write
141E000
heap
page read and write
1DA60000
heap
page read and write
33BF000
stack
page read and write
2FDA0000
heap
page read and write
4E20000
direct allocation
page read and write
4E31000
heap
page read and write
3EFF000
stack
page read and write
5420000
direct allocation
page execute and read and write
1DA61000
heap
page read and write
171E000
stack
page read and write
151000
unkown
page execute and read and write
457E000
stack
page read and write
1DA39000
heap
page read and write
4E31000
heap
page read and write
A0000
unkown
page readonly
6C8D0000
unkown
page read and write
4E31000
heap
page read and write
33FE000
stack
page read and write
1DA36000
heap
page read and write
29B92000
heap
page read and write
1DA5C000
heap
page read and write
1DA44000
heap
page read and write
1DB30000
trusted library allocation
page read and write
1DA2A000
heap
page read and write
4DFF000
stack
page read and write
3DFE000
stack
page read and write
29B50000
heap
page read and write
1DA44000
heap
page read and write
5410000
direct allocation
page execute and read and write
6C650000
unkown
page readonly
1DA51000
heap
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
752000
unkown
page execute and write copy
4E20000
direct allocation
page read and write
5440000
direct allocation
page execute and read and write
1DA2A000
heap
page read and write
FA000
unkown
page execute and read and write
1DA39000
heap
page read and write
1D76E000
stack
page read and write
4E31000
heap
page read and write
327F000
stack
page read and write
4E31000
heap
page read and write
1DA5B000
heap
page read and write
1D23E000
stack
page read and write
403F000
stack
page read and write
1DA51000
heap
page read and write
4E31000
heap
page read and write
1DA44000
heap
page read and write
1DA48000
heap
page read and write
29B71000
heap
page read and write
4E31000
heap
page read and write
1DA44000
heap
page read and write
1DA51000
heap
page read and write
37BE000
stack
page read and write
4E31000
heap
page read and write
1DA44000
heap
page read and write
573000
unkown
page execute and read and write
4E31000
heap
page read and write
5450000
direct allocation
page execute and read and write
4E31000
heap
page read and write
1DA3D000
heap
page read and write
1DA60000
heap
page read and write
4E31000
heap
page read and write
4CFE000
stack
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
1DA5F000
heap
page read and write
140C000
heap
page read and write
1DA44000
heap
page read and write
42FE000
stack
page read and write
1DA0D000
stack
page read and write
4E31000
heap
page read and write
1411000
heap
page read and write
1DA44000
heap
page read and write
4E31000
heap
page read and write
133D000
stack
page read and write
1404000
heap
page read and write
407E000
stack
page read and write
1BB000
unkown
page execute and read and write
3B3F000
stack
page read and write
4E31000
heap
page read and write
1D86C000
stack
page read and write
377F000
stack
page read and write
137A000
heap
page read and write
1339000
stack
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
4E20000
direct allocation
page read and write
181E000
stack
page read and write
4E20000
direct allocation
page read and write
4E20000
direct allocation
page read and write
1DA39000
heap
page read and write
125000
unkown
page execute and read and write
4E31000
heap
page read and write
1D4DE000
stack
page read and write
4E31000
heap
page read and write
1DA41000
heap
page read and write
1DA3A000
heap
page read and write
4E31000
heap
page read and write
1DA60000
heap
page read and write
453F000
stack
page read and write
1DA4C000
heap
page read and write
1DA2A000
heap
page read and write
363F000
stack
page read and write
2FD10000
trusted library allocation
page read and write
1DA39000
heap
page read and write
43FF000
stack
page read and write
2FDAE000
heap
page read and write
1DA1F000
heap
page read and write
4E20000
direct allocation
page read and write
1DA5B000
heap
page read and write
493E000
stack
page read and write
1DA48000
heap
page read and write
1DA3D000
heap
page read and write
1DA44000
heap
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
5AB000
unkown
page execute and read and write
1DA44000
heap
page read and write
2FDB2000
heap
page read and write
1D33F000
stack
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
1DA60000
heap
page read and write
1DA48000
heap
page read and write
23BD0000
heap
page read and write
29BB3000
heap
page read and write
1DA51000
heap
page read and write
4E00000
heap
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
1407000
heap
page read and write
4E31000
heap
page read and write
1DA60000
heap
page read and write
4E31000
heap
page read and write
353E000
stack
page read and write
4E31000
heap
page read and write
4A3F000
stack
page read and write
367E000
stack
page read and write
5430000
direct allocation
page execute and read and write
61ED4000
direct allocation
page readonly
2FC0E000
stack
page read and write
265000
unkown
page execute and read and write
6C6F0000
unkown
page readonly
4E31000
heap
page read and write
1DA3B000
heap
page read and write
15D000
unkown
page execute and read and write
1DA39000
heap
page read and write
1DA39000
heap
page read and write
5460000
direct allocation
page execute and read and write
1DA40000
heap
page read and write
4E31000
heap
page read and write
492000
unkown
page execute and read and write
1DA44000
heap
page read and write
1DA60000
heap
page read and write
3B7E000
stack
page read and write
417F000
stack
page read and write
2FE000
unkown
page execute and read and write
47BF000
stack
page read and write
1DA39000
heap
page read and write
4E31000
heap
page read and write
1DA48000
heap
page read and write
1DA10000
heap
page read and write
16DE000
stack
page read and write
1DA60000
heap
page read and write
1DA47000
heap
page read and write
4A7E000
stack
page read and write
4E20000
direct allocation
page read and write
4E31000
heap
page read and write
1DA60000
heap
page read and write
61E00000
direct allocation
page execute and read and write
2FDBA000
heap
page read and write
1DA51000
heap
page read and write
1DA3B000
heap
page read and write
38FE000
stack
page read and write
1DB30000
heap
page read and write
751000
unkown
page execute and read and write
39FF000
stack
page read and write
1418000
heap
page read and write
4E30000
heap
page read and write
29BD3000
heap
page read and write
6C88F000
unkown
page readonly
1DA51000
heap
page read and write
46BE000
stack
page read and write
1370000
heap
page read and write
47FE000
stack
page read and write
1D37E000
stack
page read and write
1D5DF000
stack
page read and write
4E20000
direct allocation
page read and write
61ECC000
direct allocation
page read and write
5AC000
unkown
page execute and write copy
1DA44000
heap
page read and write
1DA2A000
heap
page read and write
1AF000
unkown
page execute and read and write
1DA5F000
heap
page read and write
1DA44000
heap
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
52C0000
direct allocation
page read and write
544E000
stack
page read and write
4E31000
heap
page read and write
6C6E2000
unkown
page readonly
61EB7000
direct allocation
page readonly
4E31000
heap
page read and write
61EB4000
direct allocation
page read and write
4E31000
heap
page read and write
29BDD000
heap
page read and write
3A3E000
stack
page read and write
311F000
stack
page read and write
3160000
heap
page read and write
4E50000
heap
page read and write
59D000
unkown
page execute and read and write
3CBE000
stack
page read and write
6C8CF000
unkown
page write copy
4E20000
direct allocation
page read and write
4E31000
heap
page read and write
301E000
stack
page read and write
4E31000
heap
page read and write
23A97000
heap
page read and write
4E31000
heap
page read and write
1BE000
unkown
page execute and read and write
12F000
unkown
page execute and read and write
1DA48000
heap
page read and write
443E000
stack
page read and write
1DA60000
heap
page read and write
4E31000
heap
page read and write
1DA38000
heap
page read and write
13EF000
heap
page read and write
4BBE000
stack
page read and write
3F3E000
stack
page read and write
1DA51000
heap
page read and write
2FDA8000
heap
page read and write
41BE000
stack
page read and write
6C6CD000
unkown
page readonly
42BF000
stack
page read and write
4E31000
heap
page read and write
15DE000
stack
page read and write
18F000
unkown
page execute and read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
1DA40000
heap
page read and write
61E01000
direct allocation
page execute read
4E31000
heap
page read and write
1DA51000
heap
page read and write
140C000
heap
page read and write
29B30000
heap
page read and write
1D1FF000
stack
page read and write
128000
unkown
page execute and read and write
1DA44000
heap
page read and write
4E31000
heap
page read and write
1DA29000
heap
page read and write
1D47F000
stack
page read and write
6C651000
unkown
page execute read
4E31000
heap
page read and write
1DA42000
heap
page read and write
182000
unkown
page execute and read and write
1DA44000
heap
page read and write
315C000
stack
page read and write
4E31000
heap
page read and write
1DA44000
heap
page read and write
1490000
heap
page read and write
317E000
heap
page read and write
1DA28000
heap
page read and write
1DA5E000
heap
page read and write
A1000
unkown
page execute and write copy
1DA3A000
heap
page read and write
53FF000
stack
page read and write
4E31000
heap
page read and write
61ECD000
direct allocation
page readonly
38BF000
stack
page read and write
1DA16000
heap
page read and write
123C000
stack
page read and write
3170000
heap
page read and write
4E31000
heap
page read and write
4E31000
heap
page read and write
13C3000
heap
page read and write
5440000
direct allocation
page execute and read and write
4E31000
heap
page read and write
1DA61000
heap
page read and write
1DA44000
heap
page read and write
2FD0F000
stack
page read and write
4E20000
direct allocation
page read and write
1DA39000
heap
page read and write
1DA44000
heap
page read and write
61ED3000
direct allocation
page read and write
1DA47000
heap
page read and write
6C6DE000
unkown
page read and write
4E47000
heap
page read and write
595000
unkown
page execute and read and write
48FF000
stack
page read and write
1DA61000
heap
page read and write
1DA39000
heap
page read and write
4E20000
direct allocation
page read and write
4E31000
heap
page read and write
61ED0000
direct allocation
page read and write
4E31000
heap
page read and write
6C6F1000
unkown
page execute read
1DA39000
heap
page read and write
1DA2B000
heap
page read and write
1DA3A000
heap
page read and write
1570000
heap
page read and write
1DA2A000
heap
page read and write
3177000
heap
page read and write
1DA44000
heap
page read and write
1DA60000
heap
page read and write
6C8D5000
unkown
page readonly
4E20000
direct allocation
page read and write
1333000
stack
page read and write
4B7F000
stack
page read and write
26B000
unkown
page execute and read and write
1DA36000
heap
page read and write
A0000
unkown
page read and write
4E31000
heap
page read and write
52C0000
direct allocation
page read and write
1DA3A000
heap
page read and write
1DA36000
heap
page read and write
245000
unkown
page execute and read and write
13D6000
heap
page read and write
4E40000
heap
page read and write
1DA48000
heap
page read and write
1DA51000
heap
page read and write
1D90E000
stack
page read and write
4E31000
heap
page read and write
4E20000
direct allocation
page read and write
3DBF000
stack
page read and write
3C7F000
stack
page read and write
5AB000
unkown
page execute and write copy
1DA44000
heap
page read and write
1DA4B000
heap
page read and write
4E31000
heap
page read and write
1DA40000
heap
page read and write
4CBF000
stack
page read and write
1DA2A000
heap
page read and write
There are 367 hidden memdumps, click here to show them.