IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BFHIJEBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DGDBFBFCBFBKECAAKJKFBAEBGI
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\ECFCBKJDBFIJKFHIIDAAKKKKFC
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EHDHIDAEHCFHJJJJECAA
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IJJJKEGHJKFHJKFHDHCF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KEBKJDBAAKJDGCBFHCFC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KFCAFIID
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\KKFCFBKFCFBFIDGCGDHJDBKFHC
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/e2b1563c6670f193.phpdllX
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllWP
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllAP
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll=Q
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3D
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll0R
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllsP
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpQ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll%P
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php;
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpbird
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllaQ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php7
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php_8
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 43 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
173E000
heap
page read and write
 malicious
5120000
direct allocation
page read and write
 malicious
EE1000
unkown
page execute and read and write
 malicious
4C91000
heap
page read and write
4C91000
heap
page read and write
7DC000
stack
page read and write
4C91000
heap
page read and write
FFE000
unkown
page execute and read and write
399F000
stack
page read and write
4C91000
heap
page read and write
29890000
heap
page read and write
13A8000
unkown
page execute and read and write
439F000
stack
page read and write
EE0000
unkown
page readonly
61EB4000
direct allocation
page read and write
4C97000
heap
page read and write
13D3000
unkown
page execute and read and write
1D75A000
heap
page read and write
2FA50000
trusted library allocation
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
5120000
direct allocation
page read and write
1D76E000
heap
page read and write
48DE000
stack
page read and write
1D75F000
heap
page read and write
1D75A000
heap
page read and write
411F000
stack
page read and write
3D9E000
stack
page read and write
1D750000
heap
page read and write
DCE000
stack
page read and write
EE1000
unkown
page execute and write copy
35DF000
stack
page read and write
2EBB000
stack
page read and write
2FAF5000
heap
page read and write
1D776000
heap
page read and write
4C91000
heap
page read and write
1D760000
heap
page read and write
1D75F000
heap
page read and write
2FDF000
stack
page read and write
1D752000
heap
page read and write
44DF000
stack
page read and write
4C91000
heap
page read and write
1D75F000
heap
page read and write
4C91000
heap
page read and write
1D77C000
heap
page read and write
1D75B000
heap
page read and write
1730000
heap
page read and write
1D05F000
stack
page read and write
ECE000
stack
page read and write
61ED3000
direct allocation
page read and write
4C91000
heap
page read and write
1D19F000
stack
page read and write
1D77C000
heap
page read and write
1D77C000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
F72000
unkown
page execute and read and write
1D744000
heap
page read and write
2FA4F000
stack
page read and write
3C1F000
stack
page read and write
6C850000
unkown
page readonly
1D09E000
stack
page read and write
29870000
heap
page read and write
237C2000
heap
page read and write
1D773000
heap
page read and write
FEF000
unkown
page execute and read and write
298B4000
heap
page read and write
1D746000
heap
page read and write
1085000
unkown
page execute and read and write
375E000
stack
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
1D75F000
heap
page read and write
13E2000
unkown
page execute and write copy
415E000
stack
page read and write
61EB7000
direct allocation
page readonly
23869000
heap
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
1D75F000
heap
page read and write
C10000
heap
page read and write
F3A000
unkown
page execute and read and write
451E000
stack
page read and write
1D75F000
heap
page read and write
6CA2F000
unkown
page write copy
1D732000
heap
page read and write
1D1DE000
stack
page read and write
1D754000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
4C80000
direct allocation
page read and write
1D76E000
heap
page read and write
17E9000
heap
page read and write
2EC0000
heap
page read and write
2EDE000
heap
page read and write
1585000
unkown
page execute and write copy
30DF000
stack
page read and write
1D76E000
heap
page read and write
4C91000
heap
page read and write
1D74B000
heap
page read and write
515B000
stack
page read and write
361E000
stack
page read and write
1D755000
heap
page read and write
461F000
stack
page read and write
4C91000
heap
page read and write
1D757000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
525F000
stack
page read and write
1D760000
heap
page read and write
1D77C000
heap
page read and write
6C7B0000
unkown
page readonly
49DF000
stack
page read and write
1797000
heap
page read and write
1D770000
heap
page read and write
4C91000
heap
page read and write
6CA2E000
unkown
page read and write
4C91000
heap
page read and write
5120000
direct allocation
page read and write
23906000
heap
page read and write
AF3000
stack
page read and write
13E3000
unkown
page execute and write copy
1D746000
heap
page read and write
479E000
stack
page read and write
4C91000
heap
page read and write
D8E000
stack
page read and write
1D43F000
stack
page read and write
1D76E000
heap
page read and write
6CA35000
unkown
page readonly
4A1E000
stack
page read and write
1D745000
heap
page read and write
475F000
stack
page read and write
6C842000
unkown
page readonly
1584000
unkown
page execute and read and write
4C91000
heap
page read and write
1D754000
heap
page read and write
1D5CE000
stack
page read and write
465E000
stack
page read and write
1D752000
heap
page read and write
4C91000
heap
page read and write
489F000
stack
page read and write
4C60000
heap
page read and write
52B0000
direct allocation
page execute and read and write
1D2DF000
stack
page read and write
173A000
heap
page read and write
4C91000
heap
page read and write
339E000
stack
page read and write
1781000
heap
page read and write
321F000
stack
page read and write
3FDF000
stack
page read and write
4C91000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D75F000
heap
page read and write
298CE000
heap
page read and write
4C91000
heap
page read and write
1D76E000
heap
page read and write
6C7B1000
unkown
page execute read
385F000
stack
page read and write
12BB000
unkown
page execute and read and write
4C5F000
stack
page read and write
389E000
stack
page read and write
4C91000
heap
page read and write
1D33E000
stack
page read and write
298B2000
heap
page read and write
1D76E000
heap
page read and write
4C91000
heap
page read and write
3E9F000
stack
page read and write
17F0000
heap
page read and write
1D754000
heap
page read and write
1D859000
heap
page read and write
61ECD000
direct allocation
page readonly
4C91000
heap
page read and write
10AB000
unkown
page execute and read and write
C8E000
stack
page read and write
1D730000
heap
page read and write
1D75F000
heap
page read and write
429D000
stack
page read and write
325E000
stack
page read and write
1D58C000
stack
page read and write
6C851000
unkown
page execute read
4C91000
heap
page read and write
2EDB000
heap
page read and write
AF9000
stack
page read and write
1D765000
heap
page read and write
335F000
stack
page read and write
4C91000
heap
page read and write
2ED7000
heap
page read and write
4C91000
heap
page read and write
F9D000
unkown
page execute and read and write
5280000
direct allocation
page execute and read and write
6C83E000
unkown
page read and write
4C91000
heap
page read and write
1D754000
heap
page read and write
C40000
heap
page read and write
2FAEF000
heap
page read and write
1D75B000
heap
page read and write
10A5000
unkown
page execute and read and write
4C91000
heap
page read and write
311E000
stack
page read and write
6C9EF000
unkown
page readonly
4C91000
heap
page read and write
1D761000
heap
page read and write
5290000
direct allocation
page execute and read and write
1D77C000
heap
page read and write
3B1E000
stack
page read and write
4C91000
heap
page read and write
1D755000
heap
page read and write
1D755000
heap
page read and write
401E000
stack
page read and write
1D754000
heap
page read and write
1D757000
heap
page read and write
EE0000
unkown
page read and write
2FAF5000
heap
page read and write
4C91000
heap
page read and write
17F6000
heap
page read and write
1D766000
heap
page read and write
1D77B000
heap
page read and write
1D76E000
heap
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
3C5E000
stack
page read and write
1D756000
heap
page read and write
4CB0000
heap
page read and write
4C80000
direct allocation
page read and write
1D757000
heap
page read and write
1D765000
heap
page read and write
1D755000
heap
page read and write
4C91000
heap
page read and write
1D762000
heap
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
1D760000
heap
page read and write
2F94E000
stack
page read and write
1D752000
heap
page read and write
1D6CD000
stack
page read and write
F91000
unkown
page execute and read and write
298BC000
heap
page read and write
13E2000
unkown
page execute and read and write
4D90000
trusted library allocation
page read and write
1D75E000
heap
page read and write
AFD000
stack
page read and write
FCF000
unkown
page execute and read and write
1D758000
heap
page read and write
2FAED000
heap
page read and write
1D75F000
heap
page read and write
F6F000
unkown
page execute and read and write
4C90000
heap
page read and write
1D77C000
heap
page read and write
C45000
heap
page read and write
4C80000
direct allocation
page read and write
4C80000
direct allocation
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
61ED0000
direct allocation
page read and write
4C91000
heap
page read and write
371F000
stack
page read and write
1D75F000
heap
page read and write
1D760000
heap
page read and write
B30000
heap
page read and write
1D754000
heap
page read and write
1D75B000
heap
page read and write
1D75F000
heap
page read and write
298C9000
heap
page read and write
61ED4000
direct allocation
page readonly
4C91000
heap
page read and write
34DE000
stack
page read and write
4C91000
heap
page read and write
1D75F000
heap
page read and write
4C91000
heap
page read and write
3D5F000
stack
page read and write
6CA30000
unkown
page read and write
1D773000
heap
page read and write
4B1F000
stack
page read and write
4C91000
heap
page read and write
52A0000
direct allocation
page execute and read and write
FC2000
unkown
page execute and read and write
4C80000
direct allocation
page read and write
F65000
unkown
page execute and read and write
61ECC000
direct allocation
page read and write
52A0000
direct allocation
page execute and read and write
1D77C000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D745000
heap
page read and write
298C5000
heap
page read and write
39DE000
stack
page read and write
3EDE000
stack
page read and write
52C0000
direct allocation
page execute and read and write
1D73B000
heap
page read and write
4C91000
heap
page read and write
1D76E000
heap
page read and write
2ED0000
heap
page read and write
1D77C000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D850000
trusted library allocation
page read and write
1D75C000
heap
page read and write
52AE000
stack
page read and write
6C82D000
unkown
page readonly
2FAE7000
heap
page read and write
298B7000
heap
page read and write
1D77C000
heap
page read and write
298B1000
heap
page read and write
5270000
direct allocation
page execute and read and write
61E01000
direct allocation
page execute read
349F000
stack
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
17B5000
heap
page read and write
17C2000
heap
page read and write
1D75B000
heap
page read and write
1D48D000
stack
page read and write
4C91000
heap
page read and write
FFB000
unkown
page execute and read and write
17E4000
heap
page read and write
F68000
unkown
page execute and read and write
1D760000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D76E000
heap
page read and write
1D760000
heap
page read and write
3ADF000
stack
page read and write
17DF000
heap
page read and write
13CB000
unkown
page execute and read and write
2E7E000
stack
page read and write
43DE000
stack
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
4C91000
heap
page read and write
113E000
unkown
page execute and read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D76D000
heap
page read and write
4C80000
direct allocation
page read and write
425F000
stack
page read and write
4C91000
heap
page read and write
1D760000
heap
page read and write
4CA0000
heap
page read and write
1D77C000
heap
page read and write
4C91000
heap
page read and write
4B5E000
stack
page read and write
There are 339 hidden memdumps, click here to show them.