IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAKJKJDGCGDBGDHIJKJECFCFBG
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\BAAAAKJK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\CAFIEBKKJJDAKFHIDBFHJDBFBA
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DAAFBAKE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DGCAAFBFBKFIDGDHJDBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HDAKJDHIEBFIIDGDGDBA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HDAKJDHIEBFIIDGDGDBAEGCGDA
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\IJEGDBGDBFIJKECBAKFBFIDGCF
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KJDGDBFBGIDGIEBGHCGI
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllA#
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php-Y
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php%X
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllk#SL
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpq
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3G
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllq
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpIX?M
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllo
unknown
 malicious
http://185.215.113.37/Y-;M
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpUX3M
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpmX
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.372b&M
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dlla
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpEY#L
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dllU
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php=X
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpQY7L
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 44 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
132E000
heap
page read and write
 malicious
5080000
direct allocation
page read and write
 malicious
181000
unkown
page execute and read and write
 malicious
4C01000
heap
page read and write
1D69F000
heap
page read and write
1D698000
heap
page read and write
10F4000
stack
page read and write
10F8000
stack
page read and write
36FE000
stack
page read and write
1D692000
heap
page read and write
1D6BC000
heap
page read and write
3BBF000
stack
page read and write
61ECD000
direct allocation
page readonly
31BF000
stack
page read and write
41FF000
stack
page read and write
4C01000
heap
page read and write
6C88F000
unkown
page readonly
1D69F000
heap
page read and write
208000
unkown
page execute and read and write
3FBE000
stack
page read and write
36BF000
stack
page read and write
1D3DD000
stack
page read and write
4C01000
heap
page read and write
497F000
stack
page read and write
29828000
heap
page read and write
1D69A000
heap
page read and write
343F000
stack
page read and write
26F000
unkown
page execute and read and write
151F000
stack
page read and write
1310000
direct allocation
page read and write
1D69B000
heap
page read and write
1D6A0000
heap
page read and write
393F000
stack
page read and write
1D697000
heap
page read and write
1D694000
heap
page read and write
6C8CF000
unkown
page write copy
1D686000
heap
page read and write
6C6DE000
unkown
page read and write
5200000
direct allocation
page execute and read and write
4C02000
heap
page read and write
1D6A1000
heap
page read and write
1D6BC000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
297C0000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
473E000
stack
page read and write
51E0000
direct allocation
page execute and read and write
1D6A0000
heap
page read and write
2FA4B000
heap
page read and write
32FF000
stack
page read and write
2FA43000
heap
page read and write
4C01000
heap
page read and write
1D694000
heap
page read and write
1310000
direct allocation
page read and write
1D67B000
heap
page read and write
676000
unkown
page execute and read and write
1D694000
heap
page read and write
2DFE000
stack
page read and write
4C01000
heap
page read and write
212000
unkown
page execute and read and write
1D6B3000
heap
page read and write
1D69F000
heap
page read and write
1D790000
trusted library allocation
page read and write
20F000
unkown
page execute and read and write
397E000
stack
page read and write
1D69C000
heap
page read and write
3E7E000
stack
page read and write
1D6A5000
heap
page read and write
4C01000
heap
page read and write
12F0000
heap
page read and write
4D00000
trusted library allocation
page read and write
4C01000
heap
page read and write
1D6BC000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
132A000
heap
page read and write
1320000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
1D01E000
stack
page read and write
3E3F000
stack
page read and write
49BE000
stack
page read and write
1D4DC000
stack
page read and write
11C0000
heap
page read and write
61EB4000
direct allocation
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
1310000
direct allocation
page read and write
4C01000
heap
page read and write
1D69B000
heap
page read and write
1D796000
heap
page read and write
1310000
direct allocation
page read and write
1D695000
heap
page read and write
1D6AE000
heap
page read and write
4ABF000
stack
page read and write
1D69F000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
830000
unkown
page execute and read and write
2F7B000
heap
page read and write
46FF000
stack
page read and write
1D6BC000
heap
page read and write
1D692000
heap
page read and write
1310000
direct allocation
page read and write
180000
unkown
page readonly
3A7F000
stack
page read and write
29B000
unkown
page execute and read and write
30BE000
stack
page read and write
2F77000
heap
page read and write
45BF000
stack
page read and write
2F7E000
heap
page read and write
61E00000
direct allocation
page execute and read and write
325000
unkown
page execute and read and write
12EE000
stack
page read and write
1310000
direct allocation
page read and write
1D6A0000
heap
page read and write
4C01000
heap
page read and write
6C8CE000
unkown
page read and write
51D0000
direct allocation
page execute and read and write
4C01000
heap
page read and write
181000
unkown
page execute and write copy
4C01000
heap
page read and write
423E000
stack
page read and write
1D39F000
stack
page read and write
4C01000
heap
page read and write
1D6A5000
heap
page read and write
4C01000
heap
page read and write
1D696000
heap
page read and write
345000
unkown
page execute and read and write
1D6B3000
heap
page read and write
4C00000
heap
page read and write
51C0000
direct allocation
page execute and read and write
2F50000
direct allocation
page read and write
1310000
direct allocation
page read and write
1D670000
heap
page read and write
DCC000
stack
page read and write
237AD000
heap
page read and write
4C01000
heap
page read and write
2F50000
direct allocation
page read and write
4C20000
heap
page read and write
2F98E000
stack
page read and write
11D0000
heap
page read and write
6C6F0000
unkown
page readonly
44BE000
stack
page read and write
383E000
stack
page read and write
40BF000
stack
page read and write
1D6AE000
heap
page read and write
4C01000
heap
page read and write
1D69F000
heap
page read and write
1310000
direct allocation
page read and write
4C01000
heap
page read and write
1D69F000
heap
page read and write
1387000
heap
page read and write
1D69F000
heap
page read and write
2F70000
heap
page read and write
1372000
heap
page read and write
51BF000
stack
page read and write
23D000
unkown
page execute and read and write
1D6A2000
heap
page read and write
1D6AE000
heap
page read and write
4C01000
heap
page read and write
1417000
heap
page read and write
4C01000
heap
page read and write
34B000
unkown
page execute and read and write
656000
unkown
page execute and read and write
1D29E000
stack
page read and write
4C01000
heap
page read and write
2EFF000
stack
page read and write
2F3C000
stack
page read and write
4C01000
heap
page read and write
307F000
stack
page read and write
2FA3C000
heap
page read and write
1D694000
heap
page read and write
1D695000
heap
page read and write
1310000
direct allocation
page read and write
13E4000
heap
page read and write
1D6AE000
heap
page read and write
4C01000
heap
page read and write
1D6BC000
heap
page read and write
2986B000
heap
page read and write
1D6AE000
heap
page read and write
4C01000
heap
page read and write
2FA4A000
heap
page read and write
2FA44000
heap
page read and write
13D2000
heap
page read and write
4C01000
heap
page read and write
1120000
heap
page read and write
28F000
unkown
page execute and read and write
11D5000
heap
page read and write
1310000
direct allocation
page read and write
1CEDE000
stack
page read and write
1D69F000
heap
page read and write
4C01000
heap
page read and write
1D11F000
stack
page read and write
231000
unkown
page execute and read and write
437E000
stack
page read and write
1D69F000
heap
page read and write
1D697000
heap
page read and write
3ABE000
stack
page read and write
13EA000
heap
page read and write
2F9A0000
trusted library allocation
page read and write
1D6A0000
heap
page read and write
4AFE000
stack
page read and write
119E000
stack
page read and write
4C01000
heap
page read and write
68D000
unkown
page execute and read and write
6C8D5000
unkown
page readonly
2980E000
heap
page read and write
3D3E000
stack
page read and write
4C01000
heap
page read and write
6C650000
unkown
page readonly
1D51D000
stack
page read and write
2F88E000
stack
page read and write
1D6AD000
heap
page read and write
4C01000
heap
page read and write
61E01000
direct allocation
page execute read
1D6AE000
heap
page read and write
68D000
unkown
page execute and write copy
13D7000
heap
page read and write
1D6AE000
heap
page read and write
1D69E000
heap
page read and write
4C01000
heap
page read and write
1DA000
unkown
page execute and read and write
1D69A000
heap
page read and write
1D69B000
heap
page read and write
4C01000
heap
page read and write
6C651000
unkown
page execute read
4C01000
heap
page read and write
13C1000
heap
page read and write
1CFDF000
stack
page read and write
297E0000
heap
page read and write
40FE000
stack
page read and write
4C10000
heap
page read and write
4C01000
heap
page read and write
37FF000
stack
page read and write
1D692000
heap
page read and write
1310000
direct allocation
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
483F000
stack
page read and write
1D672000
heap
page read and write
51F0000
direct allocation
page execute and read and write
433F000
stack
page read and write
4C01000
heap
page read and write
447F000
stack
page read and write
1310000
direct allocation
page read and write
1D686000
heap
page read and write
1310000
direct allocation
page read and write
1D6AE000
heap
page read and write
1D69F000
heap
page read and write
4C01000
heap
page read and write
487E000
stack
page read and write
3CFF000
stack
page read and write
161E000
stack
page read and write
51E0000
direct allocation
page execute and read and write
262000
unkown
page execute and read and write
4C01000
heap
page read and write
61ECC000
direct allocation
page read and write
1D6BC000
heap
page read and write
1D694000
heap
page read and write
6C8D0000
unkown
page read and write
4C01000
heap
page read and write
23704000
heap
page read and write
1D6A2000
heap
page read and write
13DD000
heap
page read and write
831000
unkown
page execute and write copy
2F60000
direct allocation
page execute and read and write
13A1000
heap
page read and write
31FE000
stack
page read and write
1D694000
heap
page read and write
29823000
heap
page read and write
1D15E000
stack
page read and write
6C6F1000
unkown
page execute read
4C01000
heap
page read and write
1D61D000
stack
page read and write
4C01000
heap
page read and write
1D695000
heap
page read and write
1D25F000
stack
page read and write
1D6BC000
heap
page read and write
1D697000
heap
page read and write
3DE000
unkown
page execute and read and write
2980C000
heap
page read and write
4C01000
heap
page read and write
1D6A0000
heap
page read and write
205000
unkown
page execute and read and write
1D6BC000
heap
page read and write
1D6AE000
heap
page read and write
4C01000
heap
page read and write
1D6BC000
heap
page read and write
61ED3000
direct allocation
page read and write
4C01000
heap
page read and write
3BFE000
stack
page read and write
1D6A6000
heap
page read and write
1D695000
heap
page read and write
68E000
unkown
page execute and write copy
1130000
heap
page read and write
29E000
unkown
page execute and read and write
1D69B000
heap
page read and write
357F000
stack
page read and write
1D69F000
heap
page read and write
29800000
heap
page read and write
6C6CD000
unkown
page readonly
50BC000
stack
page read and write
4C01000
heap
page read and write
61ED0000
direct allocation
page read and write
45FE000
stack
page read and write
10F2000
stack
page read and write
1D6A0000
heap
page read and write
1D690000
heap
page read and write
1D6BB000
heap
page read and write
1D6B0000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
180000
unkown
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
1D69F000
heap
page read and write
1D685000
heap
page read and write
4C01000
heap
page read and write
56C000
unkown
page execute and read and write
35BE000
stack
page read and write
1D6BC000
heap
page read and write
333E000
stack
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
1D685000
heap
page read and write
61ED4000
direct allocation
page readonly
61EB7000
direct allocation
page readonly
4C01000
heap
page read and write
1D6B6000
heap
page read and write
6C6E2000
unkown
page readonly
4C01000
heap
page read and write
67F000
unkown
page execute and read and write
4BFF000
stack
page read and write
4C01000
heap
page read and write
2981F000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
29817000
heap
page read and write
4C01000
heap
page read and write
347E000
stack
page read and write
29811000
heap
page read and write
3F7F000
stack
page read and write
1310000
direct allocation
page read and write
10FD000
stack
page read and write
23852000
heap
page read and write
4C01000
heap
page read and write
1D684000
heap
page read and write
1D6A0000
heap
page read and write
1D68B000
heap
page read and write
There are 343 hidden memdumps, click here to show them.