IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AEBKFIJE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\CFCFCAAAAFBAKEBFBAKKFCBGDH
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\FCAECAKKFBGCBGDGIEHC
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\GCGDGHCBGDHJJKECAECBAEGCBG
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\GHDBKJKJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GHDBKJKJKKJDGDGDGIDGIIDAAK
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HIDHIEGIIIECAKEBFBAAEBKFCF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HJJKJJDHCGCAECAAECFH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KFBFCAFCBKFIEBFHIDBA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdowsApps
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpxO
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll)
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpge
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phps
unknown
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpMSnh
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllgZ#i
unknown
 malicious
http://185.215.113.37b
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php4Nhh
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll;
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php8Nth
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpseVSCho
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll?Z
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlli
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 40 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
341000
unkown
page execute and read and write
 malicious
134E000
heap
page read and write
 malicious
51E0000
direct allocation
page read and write
 malicious
1434000
heap
page read and write
4D51000
heap
page read and write
45E000
unkown
page execute and read and write
1D83E000
heap
page read and write
471E000
stack
page read and write
531F000
stack
page read and write
1D84B000
heap
page read and write
5370000
direct allocation
page execute and read and write
1D836000
heap
page read and write
12F8000
stack
page read and write
1D82A000
heap
page read and write
4D51000
heap
page read and write
4A9F000
stack
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
1340000
heap
page read and write
2FB30000
trusted library allocation
page read and write
9D4000
unkown
page execute and write copy
4D51000
heap
page read and write
4D51000
heap
page read and write
3B9F000
stack
page read and write
1D824000
heap
page read and write
4D51000
heap
page read and write
4D40000
direct allocation
page read and write
4D51000
heap
page read and write
1D827000
heap
page read and write
13DF000
heap
page read and write
1D825000
heap
page read and write
1D820000
heap
page read and write
4D51000
heap
page read and write
1D828000
heap
page read and write
13A7000
heap
page read and write
340000
unkown
page readonly
4D56000
heap
page read and write
39A000
unkown
page execute and read and write
1D84C000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
1D84C000
heap
page read and write
6C6BD000
unkown
page readonly
536E000
stack
page read and write
481F000
stack
page read and write
1D824000
heap
page read and write
1D82F000
heap
page read and write
142D000
heap
page read and write
4D51000
heap
page read and write
3F5F000
stack
page read and write
4D51000
heap
page read and write
1D82F000
heap
page read and write
1D822000
heap
page read and write
1D827000
heap
page read and write
1D40E000
stack
page read and write
299BE000
heap
page read and write
6C641000
unkown
page execute read
1D82F000
heap
page read and write
1D69E000
stack
page read and write
6C6CE000
unkown
page read and write
421E000
stack
page read and write
3C5000
unkown
page execute and read and write
13C7000
heap
page read and write
1D830000
heap
page read and write
4D40000
direct allocation
page read and write
1D82F000
heap
page read and write
422000
unkown
page execute and read and write
4D51000
heap
page read and write
1D835000
heap
page read and write
305B000
heap
page read and write
3040000
heap
page read and write
4D40000
direct allocation
page read and write
6C6E1000
unkown
page execute read
6C8BE000
unkown
page read and write
4D51000
heap
page read and write
4D70000
heap
page read and write
3E1F000
stack
page read and write
1D843000
heap
page read and write
4D51000
heap
page read and write
5190000
trusted library allocation
page read and write
1D83E000
heap
page read and write
1D3AF000
stack
page read and write
83B000
unkown
page execute and read and write
12F2000
stack
page read and write
359E000
stack
page read and write
61EB7000
direct allocation
page readonly
505000
unkown
page execute and read and write
369F000
stack
page read and write
13DA000
heap
page read and write
4D60000
heap
page read and write
82D000
unkown
page execute and read and write
13F0000
heap
page read and write
5360000
direct allocation
page execute and read and write
4D51000
heap
page read and write
1D84C000
heap
page read and write
4D51000
heap
page read and write
499E000
stack
page read and write
4D51000
heap
page read and write
1D824000
heap
page read and write
4D40000
direct allocation
page read and write
3F9E000
stack
page read and write
4D51000
heap
page read and write
1D825000
heap
page read and write
4D51000
heap
page read and write
4ADE000
stack
page read and write
4D51000
heap
page read and write
1D12F000
stack
page read and write
1D83E000
heap
page read and write
1D55D000
stack
page read and write
13F7000
heap
page read and write
45B000
unkown
page execute and read and write
1D16E000
stack
page read and write
42F000
unkown
page execute and read and write
4BDF000
stack
page read and write
83B000
unkown
page execute and write copy
319F000
stack
page read and write
1D83E000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
1D822000
heap
page read and write
1485000
heap
page read and write
445E000
stack
page read and write
395E000
stack
page read and write
4D51000
heap
page read and write
3D2000
unkown
page execute and read and write
1D802000
heap
page read and write
3A5F000
stack
page read and write
29A01000
heap
page read and write
147E000
stack
page read and write
3CDF000
stack
page read and write
1D83D000
heap
page read and write
4D51000
heap
page read and write
309B000
stack
page read and write
2389E000
heap
page read and write
1D822000
heap
page read and write
1D830000
heap
page read and write
4C1E000
stack
page read and write
4D51000
heap
page read and write
1D82F000
heap
page read and write
36DE000
stack
page read and write
6C87F000
unkown
page readonly
29A06000
heap
page read and write
133E000
stack
page read and write
303F000
stack
page read and write
1D82F000
heap
page read and write
4D40000
direct allocation
page read and write
1D2AD000
stack
page read and write
2F3E000
stack
page read and write
299A2000
heap
page read and write
521C000
stack
page read and write
1D830000
heap
page read and write
4D51000
heap
page read and write
1395000
heap
page read and write
1D83E000
heap
page read and write
485E000
stack
page read and write
1D800000
heap
page read and write
3F1000
unkown
page execute and read and write
134A000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
1D82B000
heap
page read and write
1D84C000
heap
page read and write
2394F000
heap
page read and write
4D51000
heap
page read and write
59E000
unkown
page execute and read and write
61ECC000
direct allocation
page read and write
1417000
heap
page read and write
4D51000
heap
page read and write
355F000
stack
page read and write
409F000
stack
page read and write
4D51000
heap
page read and write
5380000
direct allocation
page execute and read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
44F000
unkown
page execute and read and write
1D830000
heap
page read and write
31DE000
stack
page read and write
4D40000
direct allocation
page read and write
3A9E000
stack
page read and write
51E0000
direct allocation
page read and write
4D51000
heap
page read and write
1D84C000
heap
page read and write
801000
unkown
page execute and read and write
299A4000
heap
page read and write
1D82B000
heap
page read and write
41DF000
stack
page read and write
4D51000
heap
page read and write
1D82F000
heap
page read and write
5350000
direct allocation
page execute and read and write
4D51000
heap
page read and write
1D824000
heap
page read and write
4D51000
heap
page read and write
1D846000
heap
page read and write
F4C000
stack
page read and write
4D51000
heap
page read and write
345E000
stack
page read and write
299AC000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
83C000
unkown
page execute and write copy
1D830000
heap
page read and write
1D82B000
heap
page read and write
1D82F000
heap
page read and write
4D51000
heap
page read and write
1D831000
heap
page read and write
4D1F000
stack
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
431F000
stack
page read and write
4D20000
heap
page read and write
391F000
stack
page read and write
3D1E000
stack
page read and write
13C3000
heap
page read and write
3050000
heap
page read and write
4D50000
heap
page read and write
459F000
stack
page read and write
4D40000
direct allocation
page read and write
13F6000
heap
page read and write
1D83E000
heap
page read and write
12FD000
stack
page read and write
2FBD3000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
29960000
heap
page read and write
61ED3000
direct allocation
page read and write
2FBD1000
heap
page read and write
1D926000
heap
page read and write
4D51000
heap
page read and write
1D830000
heap
page read and write
1D82E000
heap
page read and write
3E5E000
stack
page read and write
9D3000
unkown
page execute and read and write
51E0000
direct allocation
page read and write
341F000
stack
page read and write
4D51000
heap
page read and write
3BDE000
stack
page read and write
1480000
heap
page read and write
6C6E0000
unkown
page readonly
32DF000
stack
page read and write
45DE000
stack
page read and write
4D40000
direct allocation
page read and write
1D84C000
heap
page read and write
4D40000
direct allocation
page read and write
4D51000
heap
page read and write
61ECD000
direct allocation
page readonly
1D82F000
heap
page read and write
449E000
stack
page read and write
4D51000
heap
page read and write
1D835000
heap
page read and write
5330000
direct allocation
page execute and read and write
4D51000
heap
page read and write
50B000
unkown
page execute and read and write
1D840000
heap
page read and write
4D40000
direct allocation
page read and write
4D51000
heap
page read and write
13E4000
heap
page read and write
1D65D000
stack
page read and write
4D51000
heap
page read and write
299B5000
heap
page read and write
2FB2F000
stack
page read and write
61EB4000
direct allocation
page read and write
1D825000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
37DF000
stack
page read and write
381E000
stack
page read and write
165E000
stack
page read and write
1D26F000
stack
page read and write
6C8BF000
unkown
page write copy
2FBC9000
heap
page read and write
4D40000
direct allocation
page read and write
1D830000
heap
page read and write
1D84C000
heap
page read and write
1D50F000
stack
page read and write
1D826000
heap
page read and write
1D843000
heap
page read and write
4D40000
direct allocation
page read and write
1D815000
heap
page read and write
1D80B000
heap
page read and write
1D79C000
stack
page read and write
1D83E000
heap
page read and write
46DF000
stack
page read and write
1D920000
trusted library allocation
page read and write
1D815000
heap
page read and write
1D83E000
heap
page read and write
5340000
direct allocation
page execute and read and write
299A6000
heap
page read and write
13E9000
heap
page read and write
4D51000
heap
page read and write
5360000
direct allocation
page execute and read and write
1D832000
heap
page read and write
1D82B000
heap
page read and write
3FD000
unkown
page execute and read and write
FB0000
heap
page read and write
40DE000
stack
page read and write
1D84C000
heap
page read and write
2FA2E000
stack
page read and write
72A000
unkown
page execute and read and write
1D82C000
heap
page read and write
1D824000
heap
page read and write
1D84C000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
3C8000
unkown
page execute and read and write
3057000
heap
page read and write
1D82F000
heap
page read and write
6C8C0000
unkown
page read and write
331E000
stack
page read and write
12F4000
stack
page read and write
340000
unkown
page read and write
4D40000
direct allocation
page read and write
175E000
stack
page read and write
435E000
stack
page read and write
6C8C5000
unkown
page readonly
5390000
direct allocation
page execute and read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
1D83E000
heap
page read and write
1D825000
heap
page read and write
61ED4000
direct allocation
page readonly
138F000
heap
page read and write
1D824000
heap
page read and write
3CF000
unkown
page execute and read and write
4D51000
heap
page read and write
2FBD7000
heap
page read and write
1D81B000
heap
page read and write
341000
unkown
page execute and write copy
299B8000
heap
page read and write
2FBCB000
heap
page read and write
239FF000
heap
page read and write
FA0000
heap
page read and write
61E01000
direct allocation
page execute read
825000
unkown
page execute and read and write
1D82F000
heap
page read and write
4D51000
heap
page read and write
4D51000
heap
page read and write
6C640000
unkown
page readonly
305E000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D84C000
heap
page read and write
4D51000
heap
page read and write
29980000
heap
page read and write
495F000
stack
page read and write
4D40000
direct allocation
page read and write
1D827000
heap
page read and write
1D814000
heap
page read and write
1D816000
heap
page read and write
4E5000
unkown
page execute and read and write
61ED0000
direct allocation
page read and write
1D82A000
heap
page read and write
1D816000
heap
page read and write
4D51000
heap
page read and write
1D82F000
heap
page read and write
6C6D2000
unkown
page readonly
There are 348 hidden memdumps, click here to show them.