IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAKEGIJEHJDGDHJKJKKJDGCAAK
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\AEBAFBGIDHCBFHIECFCBGHIEGD
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CGDHIEGCFHCGDGCAECBG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GIEBGIIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JKJEHJKJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\KEBKJDBAAKJDGCBFHCFCGIEBFB
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\KFCAFIIDHIDGHIECGDGI
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\KKKJEBAAECBGDHIECAKJKKECFH
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\KKKKEHJKFCFCBFHIIDGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllw
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37H
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllo/
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3D
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpa
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpla
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpc
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll9)
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllY(
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdllo
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php5
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php9
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpP1c
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllk(
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 43 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
891000
unkown
page execute and read and write
 malicious
5240000
direct allocation
page read and write
 malicious
154E000
heap
page read and write
 malicious
D73000
unkown
page execute and read and write
4DB1000
heap
page read and write
1D9CD000
heap
page read and write
2FD56000
heap
page read and write
6C650000
unkown
page readonly
1D9CD000
heap
page read and write
1D9D4000
heap
page read and write
1D9D4000
heap
page read and write
1625000
heap
page read and write
D4B000
unkown
page execute and read and write
43BE000
stack
page read and write
1D9B9000
heap
page read and write
1D9A0000
heap
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D9D4000
heap
page read and write
1D30E000
stack
page read and write
3160000
heap
page read and write
4DB1000
heap
page read and write
3D7E000
stack
page read and write
FAC000
stack
page read and write
1D9CA000
heap
page read and write
1D9D4000
heap
page read and write
94D000
unkown
page execute and read and write
1D9D4000
heap
page read and write
53B0000
direct allocation
page execute and read and write
1D9D4000
heap
page read and write
61ECC000
direct allocation
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
1D40F000
stack
page read and write
49FE000
stack
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
4DA0000
direct allocation
page read and write
941000
unkown
page execute and read and write
1D9C9000
heap
page read and write
A5B000
unkown
page execute and read and write
15F1000
heap
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
1D9E1000
heap
page read and write
4DB1000
heap
page read and write
890000
unkown
page readonly
6C6E2000
unkown
page readonly
53E0000
direct allocation
page execute and read and write
44FE000
stack
page read and write
1D9AF000
heap
page read and write
29B37000
heap
page read and write
23B77000
heap
page read and write
1D9F0000
heap
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
4DA0000
direct allocation
page read and write
53A0000
direct allocation
page execute and read and write
1455000
heap
page read and write
1D9D8000
heap
page read and write
2FD5D000
heap
page read and write
1D9D4000
heap
page read and write
4DB1000
heap
page read and write
1D9C9000
heap
page read and write
1D9D4000
heap
page read and write
3AFE000
stack
page read and write
1D9DC000
heap
page read and write
D83000
unkown
page execute and write copy
4EB0000
trusted library allocation
page read and write
4DA0000
direct allocation
page read and write
153B000
stack
page read and write
1D9E1000
heap
page read and write
4DB1000
heap
page read and write
915000
unkown
page execute and read and write
1D99D000
stack
page read and write
4DB1000
heap
page read and write
1D9C9000
heap
page read and write
1D9EB000
heap
page read and write
1D9F1000
heap
page read and write
1D9EE000
heap
page read and write
4C7E000
stack
page read and write
D6C000
unkown
page execute and read and write
3FFE000
stack
page read and write
1D9EF000
heap
page read and write
36FF000
stack
page read and write
8EA000
unkown
page execute and read and write
1D6BD000
stack
page read and write
3FBF000
stack
page read and write
4DB1000
heap
page read and write
1D9E1000
heap
page read and write
4DB1000
heap
page read and write
4DA0000
direct allocation
page read and write
1D9BA000
heap
page read and write
173E000
stack
page read and write
1D9D0000
heap
page read and write
1D9BB000
heap
page read and write
317E000
heap
page read and write
1D9CA000
heap
page read and write
1D9D8000
heap
page read and write
1D9D4000
heap
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
1D9D4000
heap
page read and write
1DAC5000
heap
page read and write
4DB1000
heap
page read and write
29B00000
heap
page read and write
1D9C9000
heap
page read and write
1D9BA000
heap
page read and write
4DB1000
heap
page read and write
1D9E1000
heap
page read and write
1D9D8000
heap
page read and write
6C8CF000
unkown
page write copy
4DB1000
heap
page read and write
1D9C8000
heap
page read and write
4DA0000
direct allocation
page read and write
4DB1000
heap
page read and write
40FF000
stack
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
1D9F0000
heap
page read and write
9AE000
unkown
page execute and read and write
3177000
heap
page read and write
4DB1000
heap
page read and write
4DA0000
direct allocation
page read and write
1D9EB000
heap
page read and write
29B31000
heap
page read and write
1D9D4000
heap
page read and write
4DB1000
heap
page read and write
1D9D4000
heap
page read and write
1D9D1000
heap
page read and write
1D9F0000
heap
page read and write
6C6CD000
unkown
page readonly
6C6F0000
unkown
page readonly
4D7F000
stack
page read and write
1D9F1000
heap
page read and write
1D7FC000
stack
page read and write
1D9C9000
heap
page read and write
6C88F000
unkown
page readonly
1D9CB000
heap
page read and write
1D9C9000
heap
page read and write
1D46E000
stack
page read and write
1D9F0000
heap
page read and write
1D89E000
stack
page read and write
1D9D4000
heap
page read and write
D82000
unkown
page execute and write copy
327F000
stack
page read and write
1D9F0000
heap
page read and write
4DB1000
heap
page read and write
3170000
heap
page read and write
1D2CE000
stack
page read and write
1D9D8000
heap
page read and write
15D0000
heap
page read and write
3ABF000
stack
page read and write
315E000
stack
page read and write
53D0000
direct allocation
page execute and read and write
14FE000
stack
page read and write
1300000
heap
page read and write
4DB1000
heap
page read and write
4DD0000
heap
page read and write
6C8D0000
unkown
page read and write
477E000
stack
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
3D3F000
stack
page read and write
1D9DB000
heap
page read and write
4DB1000
heap
page read and write
53C0000
direct allocation
page execute and read and write
4DB1000
heap
page read and write
2FBBE000
stack
page read and write
29B21000
heap
page read and write
45FF000
stack
page read and write
29B3F000
heap
page read and write
1D9D7000
heap
page read and write
1D9CA000
heap
page read and write
4DB1000
heap
page read and write
1D9D2000
heap
page read and write
4DB1000
heap
page read and write
1D9BA000
heap
page read and write
4DB1000
heap
page read and write
890000
unkown
page read and write
4DC0000
heap
page read and write
4DB1000
heap
page read and write
4DA0000
direct allocation
page read and write
1D9F1000
heap
page read and write
3EBE000
stack
page read and write
4DB1000
heap
page read and write
1D9D4000
heap
page read and write
5240000
direct allocation
page read and write
437F000
stack
page read and write
922000
unkown
page execute and read and write
1D9D4000
heap
page read and write
149D000
stack
page read and write
3C3E000
stack
page read and write
413E000
stack
page read and write
1D9D4000
heap
page read and write
4DB1000
heap
page read and write
48BE000
stack
page read and write
473F000
stack
page read and write
61E01000
direct allocation
page execute read
3E7F000
stack
page read and write
ADA000
unkown
page execute and read and write
29B2C000
heap
page read and write
4DB1000
heap
page read and write
1D9F0000
heap
page read and write
1540000
heap
page read and write
1D9B5000
heap
page read and write
29B8C000
heap
page read and write
35FE000
stack
page read and write
4B3E000
stack
page read and write
3BFF000
stack
page read and write
1DAC0000
trusted library allocation
page read and write
337F000
stack
page read and write
4DA0000
direct allocation
page read and write
4DA0000
direct allocation
page read and write
373E000
stack
page read and write
49BF000
stack
page read and write
1D9C6000
heap
page read and write
4DA0000
direct allocation
page read and write
12F3000
stack
page read and write
61ED4000
direct allocation
page readonly
23ADA000
heap
page read and write
1D9D4000
heap
page read and write
4DB1000
heap
page read and write
29AE0000
heap
page read and write
4DB1000
heap
page read and write
1D9F0000
heap
page read and write
53C0000
direct allocation
page execute and read and write
39BE000
stack
page read and write
1D6FE000
stack
page read and write
53CE000
stack
page read and write
4DB1000
heap
page read and write
15FD000
heap
page read and write
61EB4000
direct allocation
page read and write
4DB1000
heap
page read and write
1605000
heap
page read and write
61EB7000
direct allocation
page readonly
1603000
heap
page read and write
4C3F000
stack
page read and write
61ED3000
direct allocation
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
1D9DC000
heap
page read and write
15C3000
heap
page read and write
1D9B9000
heap
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
1D9A6000
heap
page read and write
D82000
unkown
page execute and read and write
15A8000
heap
page read and write
34BE000
stack
page read and write
1D9E1000
heap
page read and write
4DB0000
heap
page read and write
1D9C9000
heap
page read and write
1D9CB000
heap
page read and write
4DB1000
heap
page read and write
4DB1000
heap
page read and write
C6E000
unkown
page execute and read and write
4DB1000
heap
page read and write
1D9D7000
heap
page read and write
61ED0000
direct allocation
page read and write
972000
unkown
page execute and read and write
1D9D7000
heap
page read and write
1D1CE000
stack
page read and write
1D9D8000
heap
page read and write
1D9B8000
heap
page read and write
1D9E1000
heap
page read and write
53F0000
direct allocation
page execute and read and write
183E000
stack
page read and write
1D9E1000
heap
page read and write
4DA0000
direct allocation
page read and write
1D9F0000
heap
page read and write
1D9E1000
heap
page read and write
1D9C9000
heap
page read and write
F15000
unkown
page execute and read and write
1D9D4000
heap
page read and write
1D9D4000
heap
page read and write
12F9000
stack
page read and write
12FD000
stack
page read and write
6C8CE000
unkown
page read and write
423F000
stack
page read and write
1D9D8000
heap
page read and write
2FD64000
heap
page read and write
1D9CD000
heap
page read and write
23A34000
heap
page read and write
A55000
unkown
page execute and read and write
1D9C6000
heap
page read and write
1D9E1000
heap
page read and write
487F000
stack
page read and write
1630000
heap
page read and write
1D9D4000
heap
page read and write
1594000
heap
page read and write
2FCBE000
stack
page read and write
1D9C9000
heap
page read and write
1D56F000
stack
page read and write
9AB000
unkown
page execute and read and write
5390000
direct allocation
page execute and read and write
99F000
unkown
page execute and read and write
6C651000
unkown
page execute read
397F000
stack
page read and write
1D9D0000
heap
page read and write
4DB1000
heap
page read and write
144E000
stack
page read and write
6C6DE000
unkown
page read and write
29B43000
heap
page read and write
4DA0000
direct allocation
page read and write
1D9D0000
heap
page read and write
6C8D5000
unkown
page readonly
4DB1000
heap
page read and write
1D9D4000
heap
page read and write
4DB1000
heap
page read and write
1D9D4000
heap
page read and write
4DB1000
heap
page read and write
1D9D2000
heap
page read and write
4DB1000
heap
page read and write
1D5BD000
stack
page read and write
1D9D1000
heap
page read and write
4DB1000
heap
page read and write
30DF000
stack
page read and write
4DB1000
heap
page read and write
311E000
stack
page read and write
6C6F1000
unkown
page execute read
891000
unkown
page execute and write copy
1D9E1000
heap
page read and write
29B48000
heap
page read and write
4DB1000
heap
page read and write
1D9C9000
heap
page read and write
1D9BA000
heap
page read and write
4DB1000
heap
page read and write
463E000
stack
page read and write
4DB1000
heap
page read and write
15F6000
heap
page read and write
61ECD000
direct allocation
page readonly
97F000
unkown
page execute and read and write
5240000
direct allocation
page read and write
4DB1000
heap
page read and write
1D9EF000
heap
page read and write
4AFF000
stack
page read and write
15EC000
heap
page read and write
1D9BA000
heap
page read and write
1D9EC000
heap
page read and write
4DB1000
heap
page read and write
F16000
unkown
page execute and write copy
154A000
heap
page read and write
1D9CA000
heap
page read and write
4DB1000
heap
page read and write
2FCC0000
trusted library allocation
page read and write
2FD65000
heap
page read and write
1450000
heap
page read and write
4DB1000
heap
page read and write
347F000
stack
page read and write
527C000
stack
page read and write
4DB1000
heap
page read and write
387E000
stack
page read and write
427E000
stack
page read and write
4DA0000
direct allocation
page read and write
2FD5E000
heap
page read and write
537F000
stack
page read and write
1D9E1000
heap
page read and write
1D9F0000
heap
page read and write
A35000
unkown
page execute and read and write
AEE000
unkown
page execute and read and write
4DB1000
heap
page read and write
1D9C6000
heap
page read and write
44BE000
stack
page read and write
4DB1000
heap
page read and write
1D9F0000
heap
page read and write
29B2E000
heap
page read and write
13E0000
heap
page read and write
1D9CB000
heap
page read and write
1D9BA000
heap
page read and write
1D9D4000
heap
page read and write
91F000
unkown
page execute and read and write
4DB1000
heap
page read and write
918000
unkown
page execute and read and write
317B000
heap
page read and write
35BF000
stack
page read and write
1D18F000
stack
page read and write
1D9D8000
heap
page read and write
383F000
stack
page read and write
4DA0000
direct allocation
page read and write
4D80000
heap
page read and write
There are 372 hidden memdumps, click here to show them.