IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAFHIIDH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\AAFHIIDHJEBFBFIDAKFBAFCBFI
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\AFCBKFHJJJKKFHIDAAKF
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\BAKJKFHCAEGDHIDGDHDAKEGHCG
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EHCFBFBAEBKJKEBGCAEHCFCBAE
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\GDBKJDGIJECFIEBFIDHC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HIIEBAFCBKFIDGCAKKKF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JKJEHJKJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll2
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlls
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll.
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37S
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllH
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll(
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpO
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpJ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php2
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllH
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php0%u
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php(
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 40 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
6E1000
unkown
page execute and read and write
 malicious
163E000
heap
page read and write
 malicious
5250000
direct allocation
page read and write
 malicious
6E0000
unkown
page read and write
34CF000
stack
page read and write
490E000
stack
page read and write
1D868000
heap
page read and write
4DD1000
heap
page read and write
428F000
stack
page read and write
1D86F000
heap
page read and write
61E01000
direct allocation
page execute read
13D0000
heap
page read and write
1D856000
heap
page read and write
3100000
heap
page read and write
1D875000
heap
page read and write
3C8E000
stack
page read and write
1D867000
heap
page read and write
4DD1000
heap
page read and write
6C660000
unkown
page readonly
48CF000
stack
page read and write
1D5AD000
stack
page read and write
1D7ED000
stack
page read and write
772000
unkown
page execute and read and write
4DD1000
heap
page read and write
7EF000
unkown
page execute and read and write
4DD1000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1620000
direct allocation
page read and write
1D965000
heap
page read and write
3F0E000
stack
page read and write
16D5000
heap
page read and write
1D856000
heap
page read and write
1620000
direct allocation
page read and write
61ED3000
direct allocation
page read and write
1683000
heap
page read and write
1620000
direct allocation
page read and write
4DD1000
heap
page read and write
147E000
stack
page read and write
D59000
unkown
page execute and read and write
1620000
direct allocation
page read and write
4DD1000
heap
page read and write
1600000
heap
page read and write
4DD1000
heap
page read and write
1D86A000
heap
page read and write
1D86B000
heap
page read and write
4DD1000
heap
page read and write
4DD1000
heap
page read and write
4DD1000
heap
page read and write
1D87E000
heap
page read and write
1D87E000
heap
page read and write
6E0000
unkown
page readonly
4DD1000
heap
page read and write
23A12000
heap
page read and write
1D864000
heap
page read and write
6C8E5000
unkown
page readonly
4DD1000
heap
page read and write
2FA20000
trusted library allocation
page read and write
BCA000
unkown
page execute and write copy
1D42E000
stack
page read and write
2397B000
heap
page read and write
1D86E000
heap
page read and write
16D0000
heap
page read and write
1D867000
heap
page read and write
4DD1000
heap
page read and write
1D960000
trusted library allocation
page read and write
16E4000
heap
page read and write
BC9000
unkown
page execute and read and write
1D86F000
heap
page read and write
7FE000
unkown
page execute and read and write
1D864000
heap
page read and write
2FABB000
heap
page read and write
1D883000
heap
page read and write
1D872000
heap
page read and write
528C000
stack
page read and write
4DE0000
heap
page read and write
4DD1000
heap
page read and write
4DD1000
heap
page read and write
1D876000
heap
page read and write
BC9000
unkown
page execute and write copy
4B4F000
stack
page read and write
53D0000
direct allocation
page execute and read and write
15BE000
stack
page read and write
4DD1000
heap
page read and write
2FAC7000
heap
page read and write
5390000
direct allocation
page execute and read and write
16E2000
heap
page read and write
7C2000
unkown
page execute and read and write
1D86F000
heap
page read and write
4DD1000
heap
page read and write
4DD1000
heap
page read and write
1D85B000
heap
page read and write
29A2D000
heap
page read and write
6C701000
unkown
page execute read
30F0000
direct allocation
page execute and read and write
1620000
direct allocation
page read and write
39CF000
stack
page read and write
4DD1000
heap
page read and write
6C6F2000
unkown
page readonly
1D88C000
heap
page read and write
1D871000
heap
page read and write
4DD1000
heap
page read and write
1D88C000
heap
page read and write
1D864000
heap
page read and write
73A000
unkown
page execute and read and write
450F000
stack
page read and write
3C4F000
stack
page read and write
F9C000
stack
page read and write
1D86F000
heap
page read and write
314C000
stack
page read and write
1D865000
heap
page read and write
3B0F000
stack
page read and write
1D875000
heap
page read and write
4DD1000
heap
page read and write
7FB000
unkown
page execute and read and write
468E000
stack
page read and write
2FABF000
heap
page read and write
1D87D000
heap
page read and write
1D86A000
heap
page read and write
1D865000
heap
page read and write
1D88C000
heap
page read and write
3D8F000
stack
page read and write
4DD1000
heap
page read and write
350E000
stack
page read and write
1D6EE000
stack
page read and write
6C89F000
unkown
page readonly
1D870000
heap
page read and write
29A22000
heap
page read and write
4DD1000
heap
page read and write
1D840000
heap
page read and write
1D870000
heap
page read and write
1D865000
heap
page read and write
8AB000
unkown
page execute and read and write
4DD1000
heap
page read and write
1D870000
heap
page read and write
454E000
stack
page read and write
4ED0000
trusted library allocation
page read and write
6C700000
unkown
page readonly
BB9000
unkown
page execute and read and write
4DD1000
heap
page read and write
182F000
stack
page read and write
478F000
stack
page read and write
4DD1000
heap
page read and write
61ECD000
direct allocation
page readonly
1D88C000
heap
page read and write
1D855000
heap
page read and write
1D87E000
heap
page read and write
4DD1000
heap
page read and write
414F000
stack
page read and write
BB2000
unkown
page execute and read and write
4DD1000
heap
page read and write
338F000
stack
page read and write
1D870000
heap
page read and write
1D88B000
heap
page read and write
1620000
direct allocation
page read and write
6E1000
unkown
page execute and write copy
310B000
heap
page read and write
4DD1000
heap
page read and write
1620000
direct allocation
page read and write
1D88C000
heap
page read and write
4DD1000
heap
page read and write
1D870000
heap
page read and write
1D87E000
heap
page read and write
4DD1000
heap
page read and write
374F000
stack
page read and write
464F000
stack
page read and write
4DD1000
heap
page read and write
42CE000
stack
page read and write
440D000
stack
page read and write
1D864000
heap
page read and write
328E000
stack
page read and write
29980000
heap
page read and write
6C661000
unkown
page execute read
4DD1000
heap
page read and write
1620000
direct allocation
page read and write
79D000
unkown
page execute and read and write
4A4E000
stack
page read and write
16DC000
heap
page read and write
14B5000
heap
page read and write
6C8DF000
unkown
page write copy
4DD1000
heap
page read and write
4DD1000
heap
page read and write
1685000
heap
page read and write
418E000
stack
page read and write
299C0000
heap
page read and write
4DCF000
stack
page read and write
4DD1000
heap
page read and write
43CF000
stack
page read and write
1D88C000
heap
page read and write
1704000
heap
page read and write
1D866000
heap
page read and write
47CE000
stack
page read and write
1D870000
heap
page read and write
765000
unkown
page execute and read and write
400F000
stack
page read and write
30E0000
direct allocation
page read and write
1D854000
heap
page read and write
4DD1000
heap
page read and write
1D86F000
heap
page read and write
4DD1000
heap
page read and write
6C6EE000
unkown
page read and write
4DD1000
heap
page read and write
1D0AE000
stack
page read and write
30CF000
stack
page read and write
3B4E000
stack
page read and write
4DD1000
heap
page read and write
4DD1000
heap
page read and write
364E000
stack
page read and write
6C8E0000
unkown
page read and write
4DD1000
heap
page read and write
1D88C000
heap
page read and write
238D9000
heap
page read and write
1D32E000
stack
page read and write
1D1EE000
stack
page read and write
1D46E000
stack
page read and write
4DD1000
heap
page read and write
4DD1000
heap
page read and write
1D855000
heap
page read and write
1D880000
heap
page read and write
1D88C000
heap
page read and write
1D2EF000
stack
page read and write
404E000
stack
page read and write
4B8E000
stack
page read and write
B8F000
unkown
page execute and read and write
1620000
direct allocation
page read and write
1D87E000
heap
page read and write
1D86F000
heap
page read and write
4DD1000
heap
page read and write
1D864000
heap
page read and write
885000
unkown
page execute and read and write
1D87E000
heap
page read and write
1D84B000
heap
page read and write
1D86B000
heap
page read and write
310E000
heap
page read and write
1620000
direct allocation
page read and write
1D867000
heap
page read and write
4DF0000
heap
page read and write
4DD1000
heap
page read and write
AB8000
unkown
page execute and read and write
4DD1000
heap
page read and write
1630000
heap
page read and write
4DD1000
heap
page read and write
6C8DE000
unkown
page read and write
4DD1000
heap
page read and write
1D865000
heap
page read and write
1D886000
heap
page read and write
1D862000
heap
page read and write
4DD1000
heap
page read and write
143E000
stack
page read and write
768000
unkown
page execute and read and write
61ED0000
direct allocation
page read and write
1D86F000
heap
page read and write
378E000
stack
page read and write
1D87E000
heap
page read and write
1D56F000
stack
page read and write
324F000
stack
page read and write
12FD000
stack
page read and write
4DD1000
heap
page read and write
3A0E000
stack
page read and write
4DD1000
heap
page read and write
4DD1000
heap
page read and write
1D86F000
heap
page read and write
3DCE000
stack
page read and write
4DD1000
heap
page read and write
15FE000
stack
page read and write
61ED4000
direct allocation
page readonly
1D860000
heap
page read and write
1D862000
heap
page read and write
1D862000
heap
page read and write
2FACD000
heap
page read and write
4DD1000
heap
page read and write
61EB4000
direct allocation
page read and write
4DD1000
heap
page read and write
61EB7000
direct allocation
page readonly
1D86B000
heap
page read and write
1D86C000
heap
page read and write
1D86F000
heap
page read and write
2FAC3000
heap
page read and write
1D86F000
heap
page read and write
76F000
unkown
page execute and read and write
53C0000
direct allocation
page execute and read and write
38CE000
stack
page read and write
1620000
direct allocation
page read and write
1D6AD000
stack
page read and write
4DD1000
heap
page read and write
53A0000
direct allocation
page execute and read and write
163A000
heap
page read and write
6C6DD000
unkown
page readonly
4DD1000
heap
page read and write
16B4000
heap
page read and write
33CE000
stack
page read and write
12F3000
stack
page read and write
16CB000
heap
page read and write
1D883000
heap
page read and write
61ECC000
direct allocation
page read and write
1D87E000
heap
page read and write
360F000
stack
page read and write
4DD1000
heap
page read and write
4DD1000
heap
page read and write
1D86F000
heap
page read and write
93E000
unkown
page execute and read and write
53B0000
direct allocation
page execute and read and write
791000
unkown
page execute and read and write
1D88C000
heap
page read and write
388F000
stack
page read and write
4CCE000
stack
page read and write
4A0F000
stack
page read and write
1D86B000
heap
page read and write
4DD1000
heap
page read and write
8A5000
unkown
page execute and read and write
4DD1000
heap
page read and write
30E0000
direct allocation
page read and write
1D88C000
heap
page read and write
4DD1000
heap
page read and write
1D86F000
heap
page read and write
1D87E000
heap
page read and write
4C8F000
stack
page read and write
4DD1000
heap
page read and write
299A0000
heap
page read and write
1620000
direct allocation
page read and write
1620000
direct allocation
page read and write
4DD1000
heap
page read and write
3107000
heap
page read and write
4DD1000
heap
page read and write
1D842000
heap
page read and write
538F000
stack
page read and write
1D1AF000
stack
page read and write
7CF000
unkown
page execute and read and write
4DD1000
heap
page read and write
1699000
heap
page read and write
1D870000
heap
page read and write
1D864000
heap
page read and write
4DD0000
heap
page read and write
4DD1000
heap
page read and write
12F9000
stack
page read and write
16C5000
heap
page read and write
14B0000
heap
page read and write
14A0000
heap
page read and write
FF0000
heap
page read and write
1620000
direct allocation
page read and write
D5A000
unkown
page execute and write copy
3ECF000
stack
page read and write
4DD1000
heap
page read and write
53B0000
direct allocation
page execute and read and write
4DD1000
heap
page read and write
There are 334 hidden memdumps, click here to show them.