IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BGHJJDGHCBGDHIECBGIDAEHCGD
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DAKEHIJJKEGIDHIEHDAFIIDBFB
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EBAFHCBFHDHCAAKFHDGDBKFCGC
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\GDHIIIIEHCFIECAKFHJD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HDBKFHIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\HJJJJKEHCAKFBFHJKEHCFIIDAE
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IDBFHJDA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KJECFHCBKKEBAKFIJDHI
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdowsApps
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllPZ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll:Z
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpge
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllrX
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37S
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll&Z
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpPQ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpLQ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpQ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpP
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpare
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllPX
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpX
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll4Z
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpH
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php(Q
unknown
 malicious
http://185.215.113.37/)I
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll8n
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdllz
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 45 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
41000
unkown
page execute and read and write
 malicious
CCE000
heap
page read and write
 malicious
4A10000
direct allocation
page read and write
 malicious
1D1CC000
heap
page read and write
53C000
unkown
page execute and read and write
CF000
unkown
page execute and read and write
20B000
unkown
page execute and read and write
AF9000
stack
page read and write
4591000
heap
page read and write
1D1AB000
heap
page read and write
1D1D0000
heap
page read and write
7D4000
heap
page read and write
1D1AA000
heap
page read and write
3B8F000
stack
page read and write
7D4000
heap
page read and write
1D1B1000
heap
page read and write
AFD000
stack
page read and write
7D4000
heap
page read and write
CB0000
direct allocation
page read and write
1D1A9000
heap
page read and write
29331000
heap
page read and write
4B90000
direct allocation
page execute and read and write
1D07D000
stack
page read and write
29351000
heap
page read and write
1D180000
heap
page read and write
CB0000
direct allocation
page read and write
54C000
unkown
page execute and write copy
4591000
heap
page read and write
D45000
heap
page read and write
CB0000
direct allocation
page read and write
4591000
heap
page read and write
15E000
unkown
page execute and read and write
D2000
unkown
page execute and read and write
CB0000
direct allocation
page read and write
1D1B4000
heap
page read and write
3E4E000
stack
page read and write
7D4000
heap
page read and write
7D4000
heap
page read and write
1D1A6000
heap
page read and write
27DC000
stack
page read and write
4591000
heap
page read and write
BD0000
heap
page read and write
CCA000
heap
page read and write
7D4000
heap
page read and write
4591000
heap
page read and write
390F000
stack
page read and write
45A0000
heap
page read and write
1D18F000
heap
page read and write
2F52B000
heap
page read and write
23203000
heap
page read and write
1D1C1000
heap
page read and write
1D1A6000
heap
page read and write
1D1B4000
heap
page read and write
3A4F000
stack
page read and write
7D4000
heap
page read and write
61E01000
direct allocation
page execute read
4591000
heap
page read and write
2E0E000
stack
page read and write
1CFDD000
stack
page read and write
4591000
heap
page read and write
380E000
stack
page read and write
4591000
heap
page read and write
7D4000
heap
page read and write
1D1AB000
heap
page read and write
D12000
heap
page read and write
330E000
stack
page read and write
4591000
heap
page read and write
D5E000
heap
page read and write
2F490000
trusted library allocation
page read and write
2F4E000
stack
page read and write
78C000
stack
page read and write
1D1D0000
heap
page read and write
CB0000
direct allocation
page read and write
3A8E000
stack
page read and write
1D1A9000
heap
page read and write
1D1A9000
heap
page read and write
1D1A9000
heap
page read and write
D2A000
heap
page read and write
4B70000
direct allocation
page execute and read and write
4B60000
direct allocation
page execute and read and write
4591000
heap
page read and write
2334C000
heap
page read and write
7D4000
heap
page read and write
1D1AD000
heap
page read and write
15B000
unkown
page execute and read and write
D57000
heap
page read and write
7D4000
heap
page read and write
1D1B4000
heap
page read and write
4591000
heap
page read and write
1D1B4000
heap
page read and write
4591000
heap
page read and write
1D1A9000
heap
page read and write
1D2A0000
heap
page read and write
7D4000
heap
page read and write
7D4000
heap
page read and write
1D1D1000
heap
page read and write
6C8CE000
unkown
page read and write
7D4000
heap
page read and write
1D1B7000
heap
page read and write
4591000
heap
page read and write
C8000
unkown
page execute and read and write
1D1B8000
heap
page read and write
1D17D000
stack
page read and write
1D1B4000
heap
page read and write
D5B000
heap
page read and write
54D000
unkown
page execute and write copy
1D1B1000
heap
page read and write
1D1CB000
heap
page read and write
281E000
stack
page read and write
CB0000
direct allocation
page read and write
7D4000
heap
page read and write
1CEDD000
stack
page read and write
1D1B2000
heap
page read and write
1D1B0000
heap
page read and write
4591000
heap
page read and write
1D1A9000
heap
page read and write
368F000
stack
page read and write
F1000
unkown
page execute and read and write
2830000
direct allocation
page read and write
1D1C1000
heap
page read and write
1D1D0000
heap
page read and write
1D1B4000
heap
page read and write
41000
unkown
page execute and write copy
1E5000
unkown
page execute and read and write
430F000
stack
page read and write
1D1B4000
heap
page read and write
7D4000
heap
page read and write
31CE000
stack
page read and write
1D1B4000
heap
page read and write
7D4000
heap
page read and write
7D4000
heap
page read and write
2F38E000
stack
page read and write
434E000
stack
page read and write
1CD9D000
stack
page read and write
232A5000
heap
page read and write
61ED3000
direct allocation
page read and write
1D1D0000
heap
page read and write
1D1CE000
heap
page read and write
4591000
heap
page read and write
CB0000
direct allocation
page read and write
1D1C1000
heap
page read and write
4591000
heap
page read and write
458F000
stack
page read and write
1D19A000
heap
page read and write
1D1D0000
heap
page read and write
1D1B4000
heap
page read and write
CB0000
direct allocation
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
D17000
heap
page read and write
4591000
heap
page read and write
4B80000
direct allocation
page execute and read and write
4591000
heap
page read and write
1D1C1000
heap
page read and write
4B80000
direct allocation
page execute and read and write
FD000
unkown
page execute and read and write
1D198000
heap
page read and write
37CF000
stack
page read and write
1D1AA000
heap
page read and write
1D19A000
heap
page read and write
2F0F000
stack
page read and write
1D1D0000
heap
page read and write
1D1B4000
heap
page read and write
6C6F0000
unkown
page readonly
1CC0E000
stack
page read and write
1D19A000
heap
page read and write
292B0000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
1D1C1000
heap
page read and write
2840000
heap
page read and write
1D1B8000
heap
page read and write
1D1C1000
heap
page read and write
1D1B4000
heap
page read and write
7D0000
heap
page read and write
1CB0E000
stack
page read and write
40000
unkown
page readonly
4BA0000
direct allocation
page execute and read and write
6C6DE000
unkown
page read and write
513000
unkown
page execute and read and write
340F000
stack
page read and write
1D1C1000
heap
page read and write
2847000
heap
page read and write
1D1B4000
heap
page read and write
4A4B000
stack
page read and write
1D1A9000
heap
page read and write
284E000
heap
page read and write
4591000
heap
page read and write
292D0000
heap
page read and write
4591000
heap
page read and write
54C000
unkown
page execute and read and write
1D1B4000
heap
page read and write
444F000
stack
page read and write
7D4000
heap
page read and write
304F000
stack
page read and write
49D0000
trusted library allocation
page read and write
7D4000
heap
page read and write
1CE9D000
stack
page read and write
6F2000
unkown
page execute and read and write
CB0000
direct allocation
page read and write
4591000
heap
page read and write
7D4000
heap
page read and write
1D1B8000
heap
page read and write
2F52C000
heap
page read and write
7D4000
heap
page read and write
C7D000
stack
page read and write
284B000
heap
page read and write
1D1A6000
heap
page read and write
448E000
stack
page read and write
4591000
heap
page read and write
1D1B4000
heap
page read and write
6C651000
unkown
page execute read
1D1BC000
heap
page read and write
7D4000
heap
page read and write
7D4000
heap
page read and write
CB0000
direct allocation
page read and write
4591000
heap
page read and write
4B4F000
stack
page read and write
1D1AB000
heap
page read and write
4591000
heap
page read and write
C3E000
stack
page read and write
294F000
stack
page read and write
49F0000
heap
page read and write
61EB4000
direct allocation
page read and write
1D1B8000
heap
page read and write
CB0000
direct allocation
page read and write
1D1B4000
heap
page read and write
1D1B8000
heap
page read and write
1D1A9000
heap
page read and write
7D4000
heap
page read and write
61ED4000
direct allocation
page readonly
6C8D0000
unkown
page read and write
7D4000
heap
page read and write
1D186000
heap
page read and write
36CE000
stack
page read and write
1D1AD000
heap
page read and write
4591000
heap
page read and write
1D1A8000
heap
page read and write
7D4000
heap
page read and write
1D1D0000
heap
page read and write
7D4000
heap
page read and write
354F000
stack
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
41CF000
stack
page read and write
4591000
heap
page read and write
1D1D1000
heap
page read and write
1CD4F000
stack
page read and write
1D1B0000
heap
page read and write
4591000
heap
page read and write
1D1CB000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
1D1D0000
heap
page read and write
2F533000
heap
page read and write
1D1CF000
heap
page read and write
29E000
unkown
page execute and read and write
6C6CD000
unkown
page readonly
4591000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
1D1AA000
heap
page read and write
CC0000
heap
page read and write
4591000
heap
page read and write
CB0000
direct allocation
page read and write
7D4000
heap
page read and write
4590000
heap
page read and write
3BCE000
stack
page read and write
6C8CF000
unkown
page write copy
1D1C1000
heap
page read and write
6F3000
unkown
page execute and write copy
6C650000
unkown
page readonly
318F000
stack
page read and write
292F1000
heap
page read and write
4591000
heap
page read and write
1D19A000
heap
page read and write
4591000
heap
page read and write
42D000
unkown
page execute and read and write
344E000
stack
page read and write
2F48E000
stack
page read and write
AF3000
stack
page read and write
61EB7000
direct allocation
page readonly
4B50000
direct allocation
page execute and read and write
61ED0000
direct allocation
page read and write
3F4F000
stack
page read and write
1D199000
heap
page read and write
4591000
heap
page read and write
2DCF000
stack
page read and write
61ECD000
direct allocation
page readonly
7D4000
heap
page read and write
7D4000
heap
page read and write
D64000
heap
page read and write
4591000
heap
page read and write
1D1C1000
heap
page read and write
6C88F000
unkown
page readonly
394E000
stack
page read and write
1D199000
heap
page read and write
1CC4E000
stack
page read and write
1D1AD000
heap
page read and write
1D1B4000
heap
page read and write
9A000
unkown
page execute and read and write
3CCF000
stack
page read and write
308E000
stack
page read and write
7D4000
heap
page read and write
4591000
heap
page read and write
279E000
stack
page read and write
40000
unkown
page read and write
61ECC000
direct allocation
page read and write
3D0E000
stack
page read and write
1D1B8000
heap
page read and write
1D1B4000
heap
page read and write
1D1A9000
heap
page read and write
6C6E2000
unkown
page readonly
1D1AA000
heap
page read and write
1D1B0000
heap
page read and write
3E0F000
stack
page read and write
1D1B2000
heap
page read and write
7D4000
heap
page read and write
1D1C1000
heap
page read and write
29311000
heap
page read and write
4591000
heap
page read and write
1D1BC000
heap
page read and write
4591000
heap
page read and write
2A4F000
stack
page read and write
1C88E000
stack
page read and write
1D1B4000
heap
page read and write
2B8E000
stack
page read and write
4591000
heap
page read and write
1D1B7000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
358E000
stack
page read and write
CB0000
direct allocation
page read and write
7D4000
heap
page read and write
1D1B8000
heap
page read and write
CA0000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
4591000
heap
page read and write
32CF000
stack
page read and write
6C6F1000
unkown
page execute read
2B4F000
stack
page read and write
1C98F000
stack
page read and write
2F534000
heap
page read and write
4591000
heap
page read and write
1D2A0000
trusted library allocation
page read and write
1C9CE000
stack
page read and write
CB0000
direct allocation
page read and write
7D4000
heap
page read and write
1D1C1000
heap
page read and write
7D4000
heap
page read and write
1CACF000
stack
page read and write
1D1BB000
heap
page read and write
2830000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
4591000
heap
page read and write
1D1D0000
heap
page read and write
122000
unkown
page execute and read and write
4591000
heap
page read and write
420E000
stack
page read and write
3F8E000
stack
page read and write
2F53A000
heap
page read and write
45B0000
heap
page read and write
1D1D0000
heap
page read and write
1D1B4000
heap
page read and write
408F000
stack
page read and write
6C8D5000
unkown
page readonly
1D1A9000
heap
page read and write
FBE000
stack
page read and write
1D1B4000
heap
page read and write
4BB0000
direct allocation
page execute and read and write
205000
unkown
page execute and read and write
EBE000
stack
page read and write
535000
unkown
page execute and read and write
1D1D1000
heap
page read and write
12F000
unkown
page execute and read and write
1D1B4000
heap
page read and write
1D1B4000
heap
page read and write
1D195000
heap
page read and write
40CE000
stack
page read and write
7F0000
heap
page read and write
2C8F000
stack
page read and write
1D19A000
heap
page read and write
1D1CF000
heap
page read and write
1D1B4000
heap
page read and write
1D1B7000
heap
page read and write
7D4000
heap
page read and write
7D4000
heap
page read and write
C5000
unkown
page execute and read and write
14F000
unkown
page execute and read and write
2CCE000
stack
page read and write
1D19B000
heap
page read and write
4591000
heap
page read and write
1D19A000
heap
page read and write
There are 387 hidden memdumps, click here to show them.