IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKJDGDGDHDGDBFIDHDBA
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\CBKJKJDBFIIDHJKEHJEH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DBKFIDAAEHIEGCBFIDBFHCGDAK
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\FBKKJEBFIDAEBFHIDAEBAAEHIJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\FIECBFID
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\GCGHCBKFCFBFHIDHDBFC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IEHJDGIDBAAFIDGCGCAKKKFBFH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JKFHIIEH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KFIDBAFHCAKFBGCBFHIJKECGII
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/e2b1563c6670f193.phpN
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllv
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllP
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php=
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpE
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlld
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpz
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpHSJ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllm
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllj
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 37 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
141E000
heap
page read and write
 malicious
5160000
direct allocation
page read and write
 malicious
1E1000
unkown
page execute and read and write
 malicious
12A0000
heap
page read and write
4CD1000
heap
page read and write
12B4000
heap
page read and write
12B4000
heap
page read and write
1D39E000
stack
page read and write
1D8B8000
heap
page read and write
2F6E000
stack
page read and write
4CD1000
heap
page read and write
12B4000
heap
page read and write
1D8AA000
heap
page read and write
4CD1000
heap
page read and write
3B3F000
stack
page read and write
1464000
heap
page read and write
FED000
stack
page read and write
1D8C4000
heap
page read and write
4BBE000
stack
page read and write
1D8C4000
heap
page read and write
12B4000
heap
page read and write
4CD1000
heap
page read and write
1D8AA000
heap
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
1D8A9000
heap
page read and write
12B4000
heap
page read and write
1D8B8000
heap
page read and write
4CC0000
direct allocation
page read and write
4CC0000
direct allocation
page read and write
363F000
stack
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
6C88E000
unkown
page read and write
52F0000
direct allocation
page execute and read and write
417F000
stack
page read and write
1D9F9000
heap
page read and write
1D5ED000
stack
page read and write
12B4000
heap
page read and write
1D8BA000
heap
page read and write
4CD1000
heap
page read and write
407E000
stack
page read and write
4CD1000
heap
page read and write
1D8BD000
heap
page read and write
1D890000
heap
page read and write
1D8B9000
heap
page read and write
4CD1000
heap
page read and write
FE9000
stack
page read and write
4CD1000
heap
page read and write
1D8B8000
heap
page read and write
6C6B1000
unkown
page execute read
1D8C4000
heap
page read and write
12B4000
heap
page read and write
3DBF000
stack
page read and write
12B4000
heap
page read and write
30BF000
stack
page read and write
1D8C4000
heap
page read and write
4CC0000
direct allocation
page read and write
1D88D000
stack
page read and write
1D8E0000
heap
page read and write
4CD1000
heap
page read and write
1D8B8000
heap
page read and write
12B4000
heap
page read and write
1D8BD000
heap
page read and write
12B4000
heap
page read and write
1D8B8000
heap
page read and write
12B4000
heap
page read and write
367E000
stack
page read and write
61ECC000
direct allocation
page read and write
23AA9000
heap
page read and write
52C0000
direct allocation
page execute and read and write
2FBF0000
trusted library allocation
page read and write
1D8D3000
heap
page read and write
61ED4000
direct allocation
page readonly
1E0000
unkown
page read and write
2FADE000
stack
page read and write
4CD1000
heap
page read and write
6E2000
unkown
page execute and write copy
3EFF000
stack
page read and write
6C88F000
unkown
page write copy
4CD0000
heap
page read and write
38BF000
stack
page read and write
4CD1000
heap
page read and write
12B4000
heap
page read and write
5160000
direct allocation
page read and write
1D78E000
stack
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
5160000
direct allocation
page read and write
4CD1000
heap
page read and write
46BE000
stack
page read and write
29A30000
heap
page read and write
29AB2000
heap
page read and write
23A000
unkown
page execute and read and write
1E0000
unkown
page readonly
1D8BC000
heap
page read and write
1D8AA000
heap
page read and write
1D8E0000
heap
page read and write
4CD1000
heap
page read and write
4B7F000
stack
page read and write
12B4000
heap
page read and write
41BE000
stack
page read and write
3CBE000
stack
page read and write
6C890000
unkown
page read and write
1D8E0000
heap
page read and write
4CC0000
direct allocation
page read and write
4CD1000
heap
page read and write
170E000
stack
page read and write
47FE000
stack
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
52E0000
direct allocation
page execute and read and write
29A71000
heap
page read and write
1D0DF000
stack
page read and write
4CD1000
heap
page read and write
31BF000
stack
page read and write
4CD1000
heap
page read and write
1D8B9000
heap
page read and write
3DFE000
stack
page read and write
1D8BD000
heap
page read and write
4CD1000
heap
page read and write
1D8B9000
heap
page read and write
34FF000
stack
page read and write
4CBF000
stack
page read and write
12B4000
heap
page read and write
4CD1000
heap
page read and write
4CC0000
direct allocation
page read and write
493E000
stack
page read and write
EEC000
stack
page read and write
1491000
heap
page read and write
1D8C4000
heap
page read and write
4CD1000
heap
page read and write
377F000
stack
page read and write
1D8C4000
heap
page read and write
2FB0000
heap
page read and write
12B4000
heap
page read and write
33FE000
stack
page read and write
12B4000
heap
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
61ECD000
direct allocation
page readonly
6E1000
unkown
page execute and read and write
3C7F000
stack
page read and write
2FAE000
stack
page read and write
47BF000
stack
page read and write
4CD1000
heap
page read and write
61EB4000
direct allocation
page read and write
1240000
heap
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
6C6B0000
unkown
page readonly
12B4000
heap
page read and write
1D8E0000
heap
page read and write
1D8B4000
heap
page read and write
3F3E000
stack
page read and write
3B7E000
stack
page read and write
1D8BC000
heap
page read and write
1D8BB000
heap
page read and write
1D8AA000
heap
page read and write
4CD1000
heap
page read and write
1D8BC000
heap
page read and write
29A92000
heap
page read and write
1D8BD000
heap
page read and write
12B4000
heap
page read and write
1D8DF000
heap
page read and write
4CD1000
heap
page read and write
453F000
stack
page read and write
6CB000
unkown
page execute and read and write
4CC0000
direct allocation
page read and write
52D0000
direct allocation
page execute and read and write
1D8B6000
heap
page read and write
4CC0000
direct allocation
page read and write
4CD1000
heap
page read and write
4CC0000
direct allocation
page read and write
1250000
heap
page read and write
1D8C0000
heap
page read and write
43FE000
stack
page read and write
2FC8F000
heap
page read and write
12B4000
heap
page read and write
1D8AA000
heap
page read and write
1D8C0000
heap
page read and write
2FC98000
heap
page read and write
12B4000
heap
page read and write
4CD1000
heap
page read and write
6C68D000
unkown
page readonly
1D62D000
stack
page read and write
4CD1000
heap
page read and write
6C610000
unkown
page readonly
141A000
heap
page read and write
4CD1000
heap
page read and write
29D000
unkown
page execute and read and write
2F2B000
stack
page read and write
1D8C7000
heap
page read and write
403F000
stack
page read and write
1CFDE000
stack
page read and write
61EB7000
direct allocation
page readonly
12B4000
heap
page read and write
6A3000
unkown
page execute and read and write
4CD1000
heap
page read and write
3A3E000
stack
page read and write
4CD1000
heap
page read and write
1D8C9000
heap
page read and write
6E1000
unkown
page execute and write copy
4CF0000
heap
page read and write
2FB7000
heap
page read and write
4A3F000
stack
page read and write
61E01000
direct allocation
page execute read
353E000
stack
page read and write
52B0000
direct allocation
page execute and read and write
12B4000
heap
page read and write
881000
unkown
page execute and write copy
1D8E0000
heap
page read and write
1D8CE000
heap
page read and write
385000
unkown
page execute and read and write
1D8BA000
heap
page read and write
1D8C7000
heap
page read and write
12B4000
heap
page read and write
1D21F000
stack
page read and write
1D8B9000
heap
page read and write
61ED0000
direct allocation
page read and write
1D8BD000
heap
page read and write
4A7E000
stack
page read and write
4CD1000
heap
page read and write
61E00000
direct allocation
page execute and read and write
4CD1000
heap
page read and write
1D8B6000
heap
page read and write
1D9F0000
trusted library allocation
page read and write
1D8B9000
heap
page read and write
12B4000
heap
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
12B4000
heap
page read and write
4CC0000
direct allocation
page read and write
42FE000
stack
page read and write
140E000
stack
page read and write
12B4000
heap
page read and write
5300000
direct allocation
page execute and read and write
12B4000
heap
page read and write
457E000
stack
page read and write
1D8B9000
heap
page read and write
1D8C4000
heap
page read and write
4DD0000
trusted library allocation
page read and write
2FC97000
heap
page read and write
4CD1000
heap
page read and write
1D896000
heap
page read and write
1D8E0000
heap
page read and write
1D8C4000
heap
page read and write
FE3000
stack
page read and write
1D25E000
stack
page read and write
1D8CE000
heap
page read and write
1D8B8000
heap
page read and write
29A51000
heap
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
443E000
stack
page read and write
1D8B9000
heap
page read and write
1D8BD000
heap
page read and write
1D8BD000
heap
page read and write
23962000
heap
page read and write
1D49F000
stack
page read and write
4CD1000
heap
page read and write
1D8E0000
heap
page read and write
12B4000
heap
page read and write
160E000
stack
page read and write
1D35E000
stack
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
4CD1000
heap
page read and write
1D8C4000
heap
page read and write
1D8E0000
heap
page read and write
1D8C3000
heap
page read and write
26F000
unkown
page execute and read and write
1D8AA000
heap
page read and write
1D8AA000
heap
page read and write
29ABB000
heap
page read and write
48FF000
stack
page read and write
1D8C9000
heap
page read and write
1D8E0000
heap
page read and write
12B0000
heap
page read and write
52E0000
direct allocation
page execute and read and write
4CD1000
heap
page read and write
1D8B8000
heap
page read and write
880000
unkown
page execute and read and write
529F000
stack
page read and write
3AB000
unkown
page execute and read and write
12B4000
heap
page read and write
1476000
heap
page read and write
12B4000
heap
page read and write
1D8C1000
heap
page read and write
6D2000
unkown
page execute and read and write
1D8BE000
heap
page read and write
1D8C2000
heap
page read and write
6C895000
unkown
page readonly
1D8C2000
heap
page read and write
1D894000
heap
page read and write
2EF000
unkown
page execute and read and write
1D8A9000
heap
page read and write
12B4000
heap
page read and write
23A0B000
heap
page read and write
1D8C0000
heap
page read and write
6C69E000
unkown
page read and write
1D8BA000
heap
page read and write
1D8B6000
heap
page read and write
1D8BE000
heap
page read and write
1D8BE000
heap
page read and write
1D8BC000
heap
page read and write
4CC0000
direct allocation
page read and write
1D8A9000
heap
page read and write
4CC0000
direct allocation
page read and write
2FBDF000
stack
page read and write
2C2000
unkown
page execute and read and write
1E1000
unkown
page execute and write copy
268000
unkown
page execute and read and write
37BE000
stack
page read and write
4CD1000
heap
page read and write
29A10000
heap
page read and write
1D8C4000
heap
page read and write
1462000
heap
page read and write
4CC0000
direct allocation
page read and write
4CD1000
heap
page read and write
4CE5000
heap
page read and write
39FF000
stack
page read and write
2FB000
unkown
page execute and read and write
13CE000
stack
page read and write
12B4000
heap
page read and write
1D11E000
stack
page read and write
2FBB000
heap
page read and write
6C84F000
unkown
page readonly
272000
unkown
page execute and read and write
5140000
heap
page read and write
1D8AA000
heap
page read and write
2FE000
unkown
page execute and read and write
6C6A2000
unkown
page readonly
1D8BD000
heap
page read and write
1D8AF000
heap
page read and write
467F000
stack
page read and write
1D8B9000
heap
page read and write
12B4000
heap
page read and write
1D8BC000
heap
page read and write
2EEE000
stack
page read and write
4CD1000
heap
page read and write
291000
unkown
page execute and read and write
4CD1000
heap
page read and write
2CF000
unkown
page execute and read and write
4CC0000
direct allocation
page read and write
6C611000
unkown
page execute read
4CD1000
heap
page read and write
12B4000
heap
page read and write
1D72C000
stack
page read and write
1D8D2000
heap
page read and write
12B4000
heap
page read and write
32BF000
stack
page read and write
4CD1000
heap
page read and write
61ED3000
direct allocation
page read and write
2FC9D000
heap
page read and write
2FC90000
heap
page read and write
1D89F000
heap
page read and write
265000
unkown
page execute and read and write
4CC0000
direct allocation
page read and write
12B4000
heap
page read and write
5C9000
unkown
page execute and read and write
4CD1000
heap
page read and write
4CE0000
heap
page read and write
1D8BA000
heap
page read and write
1D8E0000
heap
page read and write
12B4000
heap
page read and write
42BF000
stack
page read and write
519C000
stack
page read and write
38FE000
stack
page read and write
43E000
unkown
page execute and read and write
1410000
heap
page read and write
1D4ED000
stack
page read and write
33BF000
stack
page read and write
2FBE000
heap
page read and write
1D8E0000
heap
page read and write
There are 366 hidden memdumps, click here to show them.