IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\DBGHJEBKJEGHJKECAAKJKEGIIE
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DGCBKECAKFBGCAKECGIE
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\FBKKFBAEGDHJJJJKFBKFHCAFCB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GHDBKJKJKKJDGDGDGIDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HIDHIEGIIIECAKEBFBAA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HJJKJJDH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\IECFBKFHCAEHJJKEGDGHCGDAEG
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\JJKJDAEB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php;.
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php~
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpC:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllEGHJKECAAKJKEGIIE.
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlls)
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpn
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpm
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpS_
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phppe
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpj
unknown
 malicious
http://185.215.113.37id
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpN
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpV
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllAEHJJKEGDGHCGDAEG
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll~
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpX
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpB
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php6
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php:
unknown
 malicious
http://185.215.113.37/5
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php&
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll3
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.215.1I
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 50 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
85E000
heap
page read and write
 malicious
FF1000
unkown
page execute and read and write
 malicious
4BD0000
direct allocation
page read and write
 malicious
1CC6F000
stack
page read and write
23461000
heap
page read and write
840000
direct allocation
page read and write
6F4000
heap
page read and write
3ECE000
stack
page read and write
1CB6E000
stack
page read and write
4751000
heap
page read and write
1D354000
heap
page read and write
6F4000
heap
page read and write
1CDEE000
stack
page read and write
559000
stack
page read and write
8D1000
heap
page read and write
1082000
unkown
page execute and read and write
1506000
unkown
page execute and write copy
30CF000
stack
page read and write
4751000
heap
page read and write
61EB4000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
1D370000
heap
page read and write
8F3000
heap
page read and write
4751000
heap
page read and write
3D4F000
stack
page read and write
2F6ED000
heap
page read and write
2D4E000
stack
page read and write
1D31D000
stack
page read and write
294CF000
heap
page read and write
4751000
heap
page read and write
4751000
heap
page read and write
4751000
heap
page read and write
4760000
heap
page read and write
1D34A000
heap
page read and write
1D335000
heap
page read and write
840000
direct allocation
page read and write
29512000
heap
page read and write
1D354000
heap
page read and write
4D20000
direct allocation
page execute and read and write
1D358000
heap
page read and write
4751000
heap
page read and write
FF0000
unkown
page readonly
1D440000
trusted library allocation
page read and write
1D357000
heap
page read and write
4751000
heap
page read and write
4751000
heap
page read and write
1D354000
heap
page read and write
83E000
stack
page read and write
1D358000
heap
page read and write
4755000
heap
page read and write
6F4000
heap
page read and write
1D354000
heap
page read and write
104A000
unkown
page execute and read and write
4751000
heap
page read and write
1D370000
heap
page read and write
4750000
heap
page read and write
1D361000
heap
page read and write
2F6FD000
heap
page read and write
1CDAF000
stack
page read and write
E70000
direct allocation
page read and write
2F64F000
stack
page read and write
3D8E000
stack
page read and write
1D371000
heap
page read and write
1D354000
heap
page read and write
294B3000
heap
page read and write
428E000
stack
page read and write
1D338000
heap
page read and write
840000
direct allocation
page read and write
6F4000
heap
page read and write
840000
direct allocation
page read and write
2F6F7000
heap
page read and write
1D370000
heap
page read and write
553000
stack
page read and write
1D349000
heap
page read and write
6F4000
heap
page read and write
E90000
heap
page read and write
906000
heap
page read and write
4770000
heap
page read and write
8A3000
heap
page read and write
1D361000
heap
page read and write
13E8000
unkown
page execute and read and write
1D361000
heap
page read and write
1D21D000
stack
page read and write
4751000
heap
page read and write
840000
direct allocation
page read and write
850000
heap
page read and write
1D358000
heap
page read and write
FF0000
unkown
page read and write
6F4000
heap
page read and write
4751000
heap
page read and write
1D354000
heap
page read and write
4751000
heap
page read and write
1D358000
heap
page read and write
1D33A000
heap
page read and write
14EB000
unkown
page execute and read and write
348F000
stack
page read and write
61ECD000
direct allocation
page readonly
1D33A000
heap
page read and write
4751000
heap
page read and write
944000
heap
page read and write
6C6F1000
unkown
page execute read
6F4000
heap
page read and write
1D34B000
heap
page read and write
6C6E2000
unkown
page readonly
6C650000
unkown
page readonly
1D17C000
stack
page read and write
1D354000
heap
page read and write
1D34B000
heap
page read and write
6F4000
heap
page read and write
61ED3000
direct allocation
page read and write
1D34D000
heap
page read and write
1D357000
heap
page read and write
6C6DE000
unkown
page read and write
35CF000
stack
page read and write
16B1000
unkown
page execute and write copy
2F6F5000
heap
page read and write
384F000
stack
page read and write
6F4000
heap
page read and write
6F4000
heap
page read and write
4751000
heap
page read and write
E9E000
heap
page read and write
2D0F000
stack
page read and write
89F000
heap
page read and write
14F5000
unkown
page execute and read and write
2F650000
trusted library allocation
page read and write
1D07E000
stack
page read and write
840000
direct allocation
page read and write
1D361000
heap
page read and write
6F4000
heap
page read and write
1D36F000
heap
page read and write
1505000
unkown
page execute and write copy
1CB2F000
stack
page read and write
1D354000
heap
page read and write
1D348000
heap
page read and write
73E000
stack
page read and write
6F4000
heap
page read and write
F9F000
stack
page read and write
4751000
heap
page read and write
4751000
heap
page read and write
1D34A000
heap
page read and write
6F4000
heap
page read and write
1D36E000
heap
page read and write
1D36B000
heap
page read and write
10A1000
unkown
page execute and read and write
4751000
heap
page read and write
6F0000
heap
page read and write
1D371000
heap
page read and write
107F000
unkown
page execute and read and write
1D370000
heap
page read and write
4751000
heap
page read and write
39CE000
stack
page read and write
124E000
unkown
page execute and read and write
1D361000
heap
page read and write
1D354000
heap
page read and write
6F4000
heap
page read and write
4751000
heap
page read and write
1D370000
heap
page read and write
E70000
direct allocation
page read and write
294F2000
heap
page read and write
840000
direct allocation
page read and write
1D354000
heap
page read and write
6F4000
heap
page read and write
10AD000
unkown
page execute and read and write
6F4000
heap
page read and write
4D50000
direct allocation
page execute and read and write
8EC000
heap
page read and write
1D354000
heap
page read and write
324E000
stack
page read and write
6E0000
heap
page read and write
4751000
heap
page read and write
61ED0000
direct allocation
page read and write
294B1000
heap
page read and write
4751000
heap
page read and write
4751000
heap
page read and write
1D370000
heap
page read and write
4751000
heap
page read and write
61EB7000
direct allocation
page readonly
4751000
heap
page read and write
4751000
heap
page read and write
1505000
unkown
page execute and read and write
1D358000
heap
page read and write
1D358000
heap
page read and write
690000
heap
page read and write
6F4000
heap
page read and write
6F4000
heap
page read and write
1D349000
heap
page read and write
1CA2E000
stack
page read and write
4751000
heap
page read and write
6C8CE000
unkown
page read and write
6C6CD000
unkown
page readonly
4D20000
direct allocation
page execute and read and write
460F000
stack
page read and write
1D35C000
heap
page read and write
61ED4000
direct allocation
page readonly
6F4000
heap
page read and write
3C0F000
stack
page read and write
1D361000
heap
page read and write
85A000
heap
page read and write
6C8D5000
unkown
page readonly
1D36C000
heap
page read and write
6C6F0000
unkown
page readonly
320F000
stack
page read and write
4751000
heap
page read and write
4751000
heap
page read and write
FDB000
stack
page read and write
29490000
heap
page read and write
1D349000
heap
page read and write
44CF000
stack
page read and write
61ECC000
direct allocation
page read and write
1D33A000
heap
page read and write
6F4000
heap
page read and write
2E8E000
stack
page read and write
1D349000
heap
page read and write
294BD000
heap
page read and write
1D32F000
heap
page read and write
1D350000
heap
page read and write
2FCE000
stack
page read and write
900000
heap
page read and write
1D346000
heap
page read and write
4751000
heap
page read and write
4D0F000
stack
page read and write
4B90000
heap
page read and write
1CCAE000
stack
page read and write
6F4000
heap
page read and write
1D352000
heap
page read and write
414E000
stack
page read and write
3B0E000
stack
page read and write
1D370000
heap
page read and write
4751000
heap
page read and write
4751000
heap
page read and write
1D361000
heap
page read and write
1D349000
heap
page read and write
424F000
stack
page read and write
233BF000
heap
page read and write
1D346000
heap
page read and write
840000
direct allocation
page read and write
1D350000
heap
page read and write
4751000
heap
page read and write
1D354000
heap
page read and write
34CE000
stack
page read and write
1D361000
heap
page read and write
1D349000
heap
page read and write
1D370000
heap
page read and write
4751000
heap
page read and write
1CEEF000
stack
page read and write
294B5000
heap
page read and write
8F9000
heap
page read and write
1D371000
heap
page read and write
310E000
stack
page read and write
1D349000
heap
page read and write
1D349000
heap
page read and write
11BB000
unkown
page execute and read and write
294C9000
heap
page read and write
45C000
stack
page read and write
29470000
heap
page read and write
55D000
stack
page read and write
1078000
unkown
page execute and read and write
4751000
heap
page read and write
400E000
stack
page read and write
4751000
heap
page read and write
1D354000
heap
page read and write
23509000
heap
page read and write
1D361000
heap
page read and write
E80000
direct allocation
page execute and read and write
338E000
stack
page read and write
43CE000
stack
page read and write
6C651000
unkown
page execute read
1D354000
heap
page read and write
E5E000
stack
page read and write
4D30000
direct allocation
page execute and read and write
1D34B000
heap
page read and write
840000
direct allocation
page read and write
4751000
heap
page read and write
1D35B000
heap
page read and write
1D349000
heap
page read and write
410F000
stack
page read and write
E9B000
heap
page read and write
6F4000
heap
page read and write
10D2000
unkown
page execute and read and write
4751000
heap
page read and write
6F4000
heap
page read and write
D1E000
stack
page read and write
1D354000
heap
page read and write
840000
direct allocation
page read and write
1CF3D000
stack
page read and write
1D354000
heap
page read and write
1D361000
heap
page read and write
3C4E000
stack
page read and write
4751000
heap
page read and write
1D326000
heap
page read and write
1D33A000
heap
page read and write
1D361000
heap
page read and write
1195000
unkown
page execute and read and write
FF1000
unkown
page execute and write copy
294C6000
heap
page read and write
4751000
heap
page read and write
840000
direct allocation
page read and write
10FF000
unkown
page execute and read and write
8B7000
heap
page read and write
450E000
stack
page read and write
4751000
heap
page read and write
1D370000
heap
page read and write
1D354000
heap
page read and write
2BCF000
stack
page read and write
4751000
heap
page read and write
1D354000
heap
page read and write
1075000
unkown
page execute and read and write
4751000
heap
page read and write
E97000
heap
page read and write
1D35C000
heap
page read and write
6F4000
heap
page read and write
2F54E000
stack
page read and write
1D354000
heap
page read and write
1D33A000
heap
page read and write
4C0C000
stack
page read and write
110B000
unkown
page execute and read and write
6C8CF000
unkown
page write copy
374E000
stack
page read and write
10DF000
unkown
page execute and read and write
4751000
heap
page read and write
6F4000
heap
page read and write
1D36B000
heap
page read and write
1D33A000
heap
page read and write
370F000
stack
page read and write
1D354000
heap
page read and write
4751000
heap
page read and write
4751000
heap
page read and write
2F8F000
stack
page read and write
4751000
heap
page read and write
1D34D000
heap
page read and write
6F4000
heap
page read and write
11B5000
unkown
page execute and read and write
840000
direct allocation
page read and write
1D36F000
heap
page read and write
4751000
heap
page read and write
4751000
heap
page read and write
4850000
trusted library allocation
page read and write
5B0000
heap
page read and write
4751000
heap
page read and write
840000
direct allocation
page read and write
6F4000
heap
page read and write
1D34A000
heap
page read and write
1D320000
heap
page read and write
4751000
heap
page read and write
4751000
heap
page read and write
4D40000
direct allocation
page execute and read and write
6F4000
heap
page read and write
2E4F000
stack
page read and write
8EE000
heap
page read and write
1D349000
heap
page read and write
1D34D000
heap
page read and write
1D351000
heap
page read and write
334F000
stack
page read and write
FE0000
direct allocation
page execute and read and write
840000
direct allocation
page read and write
4751000
heap
page read and write
398F000
stack
page read and write
1D350000
heap
page read and write
294B7000
heap
page read and write
4751000
heap
page read and write
6F4000
heap
page read and write
6F4000
heap
page read and write
1D445000
heap
page read and write
3FCF000
stack
page read and write
4751000
heap
page read and write
1D352000
heap
page read and write
E1E000
stack
page read and write
6F4000
heap
page read and write
1D346000
heap
page read and write
3E8E000
stack
page read and write
3ACF000
stack
page read and write
14C8000
unkown
page execute and read and write
4751000
heap
page read and write
1D33B000
heap
page read and write
464E000
stack
page read and write
1D351000
heap
page read and write
61E01000
direct allocation
page execute read
16B0000
unkown
page execute and read and write
6C8D0000
unkown
page read and write
1D03D000
stack
page read and write
6F4000
heap
page read and write
6F4000
heap
page read and write
6F4000
heap
page read and write
1D357000
heap
page read and write
1D354000
heap
page read and write
294D2000
heap
page read and write
1D354000
heap
page read and write
4751000
heap
page read and write
360E000
stack
page read and write
6C88F000
unkown
page readonly
474F000
stack
page read and write
2F6EF000
heap
page read and write
388E000
stack
page read and write
1D370000
heap
page read and write
4D10000
direct allocation
page execute and read and write
1D34A000
heap
page read and write
4751000
heap
page read and write
1D354000
heap
page read and write
4751000
heap
page read and write
438F000
stack
page read and write
2C0E000
stack
page read and write
1D339000
heap
page read and write
1D358000
heap
page read and write
1D339000
heap
page read and write
4751000
heap
page read and write
There are 395 hidden memdumps, click here to show them.