IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BFIJEHCBAKFCAKFHCGDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\CBFCFBFBFBKFIDHJKFCAFCFBKJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CBKJJEHCBAKFBFHJKFBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EBGCFBGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\FBKJKEHIJECGCBFIJEGI
ASCII text, with very long lines (1769), with CRLF line terminators
dropped
C:\ProgramData\HDAAAAFIIJDBGDGCGDAKFIDGID
SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
dropped
C:\ProgramData\HJECAAKKFHCFIECAAAKEGCFIEH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KKJKFBKK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KKKJEHCGCGDAAAKFHJKJJJDHDH
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dlln0
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpData
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllB0SJ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlld3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpn6pK
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php_
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllP0aJ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpr6
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllN3WK
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllx3YK
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpfF
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php-
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll40
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllj3KK
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpic_qt
unknown
 malicious
http://185.215.113.37H-
unknown
 malicious
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
unknown
There are 40 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
56F0000
direct allocation
page read and write
 malicious
1AEE000
heap
page read and write
 malicious
D71000
unkown
page execute and read and write
 malicious
382F000
stack
page read and write
5271000
heap
page read and write
19D4000
heap
page read and write
1DE79000
heap
page read and write
19D4000
heap
page read and write
3D6E000
stack
page read and write
1DE96000
heap
page read and write
1DE9C000
heap
page read and write
6D13E000
unkown
page read and write
1230000
unkown
page execute and read and write
1DE7F000
heap
page read and write
19D4000
heap
page read and write
45EF000
stack
page read and write
1DE7B000
heap
page read and write
300DC000
heap
page read and write
19C0000
direct allocation
page read and write
3610000
direct allocation
page read and write
2FF2E000
stack
page read and write
19D4000
heap
page read and write
372F000
stack
page read and write
19D4000
heap
page read and write
35BB000
stack
page read and write
1DE84000
heap
page read and write
3BEF000
stack
page read and write
5275000
heap
page read and write
1DE85000
heap
page read and write
1DE7F000
heap
page read and write
5271000
heap
page read and write
1DE6A000
heap
page read and write
1DE84000
heap
page read and write
5271000
heap
page read and write
44EE000
stack
page read and write
5271000
heap
page read and write
3FAF000
stack
page read and write
357F000
stack
page read and write
56B0000
trusted library allocation
page read and write
1403000
unkown
page execute and write copy
5271000
heap
page read and write
1DE86000
heap
page read and write
5271000
heap
page read and write
4FEF000
stack
page read and write
E52000
unkown
page execute and read and write
19C0000
direct allocation
page read and write
5271000
heap
page read and write
29E50000
heap
page read and write
1DE69000
heap
page read and write
5271000
heap
page read and write
1DE84000
heap
page read and write
4B2E000
stack
page read and write
6CF3D000
unkown
page readonly
4C6E000
stack
page read and write
1DA2F000
stack
page read and write
19D4000
heap
page read and write
1AEA000
heap
page read and write
5271000
heap
page read and write
1DE82000
heap
page read and write
49EE000
stack
page read and write
1BB5000
heap
page read and write
61ED3000
direct allocation
page read and write
19D4000
heap
page read and write
5271000
heap
page read and write
1DE82000
heap
page read and write
19D4000
heap
page read and write
5270000
heap
page read and write
1DE7E000
heap
page read and write
1DE87000
heap
page read and write
1BA8000
heap
page read and write
19D4000
heap
page read and write
3627000
heap
page read and write
1DE84000
heap
page read and write
1DE4D000
stack
page read and write
19C0000
direct allocation
page read and write
1DE71000
heap
page read and write
DFF000
unkown
page execute and read and write
19D4000
heap
page read and write
1DE83000
heap
page read and write
1DE84000
heap
page read and write
5271000
heap
page read and write
19D4000
heap
page read and write
E2D000
unkown
page execute and read and write
5271000
heap
page read and write
30030000
trusted library allocation
page read and write
472F000
stack
page read and write
1B49000
heap
page read and write
5880000
direct allocation
page execute and read and write
6CF52000
unkown
page readonly
44AF000
stack
page read and write
1DE86000
heap
page read and write
5271000
heap
page read and write
5271000
heap
page read and write
19D4000
heap
page read and write
5271000
heap
page read and write
5850000
direct allocation
page execute and read and write
39AE000
stack
page read and write
1DE86000
heap
page read and write
1BAF000
heap
page read and write
1DE72000
heap
page read and write
1563000
stack
page read and write
436F000
stack
page read and write
1DE86000
heap
page read and write
1DE76000
heap
page read and write
19D4000
heap
page read and write
422F000
stack
page read and write
1DE80000
heap
page read and write
5271000
heap
page read and write
1DE87000
heap
page read and write
19D4000
heap
page read and write
1268000
unkown
page execute and write copy
19C0000
direct allocation
page read and write
1DE96000
heap
page read and write
1D8DE000
stack
page read and write
3E6F000
stack
page read and write
486F000
stack
page read and write
19C0000
direct allocation
page read and write
1DE79000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1DBAD000
stack
page read and write
19D4000
heap
page read and write
1B66000
heap
page read and write
5271000
heap
page read and write
19D4000
heap
page read and write
1DEA0000
heap
page read and write
5290000
heap
page read and write
1ADF000
stack
page read and write
1DE9F000
heap
page read and write
29F1D000
heap
page read and write
5271000
heap
page read and write
F15000
unkown
page execute and read and write
1268000
unkown
page execute and read and write
19D4000
heap
page read and write
526F000
stack
page read and write
49AF000
stack
page read and write
1DEA0000
heap
page read and write
61ECD000
direct allocation
page readonly
19D4000
heap
page read and write
5271000
heap
page read and write
1B36000
heap
page read and write
1DE50000
heap
page read and write
3620000
heap
page read and write
61E01000
direct allocation
page execute read
1DE96000
heap
page read and write
1DE85000
heap
page read and write
1DE9F000
heap
page read and write
1DF70000
trusted library allocation
page read and write
1154000
unkown
page execute and read and write
19C0000
direct allocation
page read and write
1DE96000
heap
page read and write
1D65E000
stack
page read and write
3EAE000
stack
page read and write
29EB1000
heap
page read and write
4DAE000
stack
page read and write
5271000
heap
page read and write
DCA000
unkown
page execute and read and write
5271000
heap
page read and write
1DE9E000
heap
page read and write
1402000
unkown
page execute and read and write
1DE84000
heap
page read and write
4D6F000
stack
page read and write
19D4000
heap
page read and write
29F11000
heap
page read and write
1DE9F000
heap
page read and write
F35000
unkown
page execute and read and write
61EB4000
direct allocation
page read and write
3C2E000
stack
page read and write
5271000
heap
page read and write
DF8000
unkown
page execute and read and write
1DE69000
heap
page read and write
1DF76000
heap
page read and write
E8B000
unkown
page execute and read and write
426E000
stack
page read and write
1DE6A000
heap
page read and write
5271000
heap
page read and write
43AE000
stack
page read and write
5271000
heap
page read and write
1252000
unkown
page execute and read and write
1DE79000
heap
page read and write
29E70000
heap
page read and write
5271000
heap
page read and write
572C000
stack
page read and write
1DE83000
heap
page read and write
E5F000
unkown
page execute and read and write
5860000
direct allocation
page execute and read and write
1DE7C000
heap
page read and write
61ED0000
direct allocation
page read and write
3FEE000
stack
page read and write
462E000
stack
page read and write
5271000
heap
page read and write
5830000
direct allocation
page execute and read and write
1DE96000
heap
page read and write
1DE84000
heap
page read and write
1DE86000
heap
page read and write
1DA6E000
stack
page read and write
1DD4D000
stack
page read and write
3AEE000
stack
page read and write
1B2F000
heap
page read and write
1DE7C000
heap
page read and write
5271000
heap
page read and write
6D13F000
unkown
page write copy
502E000
stack
page read and write
1DE6A000
heap
page read and write
1DE84000
heap
page read and write
190E000
stack
page read and write
5870000
direct allocation
page execute and read and write
5271000
heap
page read and write
19D4000
heap
page read and write
48AE000
stack
page read and write
1DE86000
heap
page read and write
19D4000
heap
page read and write
61EB7000
direct allocation
page readonly
156D000
stack
page read and write
1DE72000
heap
page read and write
1DE96000
heap
page read and write
1B32000
heap
page read and write
386E000
stack
page read and write
19D4000
heap
page read and write
5271000
heap
page read and write
1DE84000
heap
page read and write
19D4000
heap
page read and write
1DE68000
heap
page read and write
6CEC0000
unkown
page readonly
1D7DE000
stack
page read and write
1DE92000
heap
page read and write
1D92E000
stack
page read and write
1DE76000
heap
page read and write
5271000
heap
page read and write
1D79F000
stack
page read and write
1DE82000
heap
page read and write
19C0000
direct allocation
page read and write
1DEA0000
heap
page read and write
1D69E000
stack
page read and write
5271000
heap
page read and write
19D4000
heap
page read and write
1DE7D000
heap
page read and write
1DE82000
heap
page read and write
19C0000
direct allocation
page read and write
19C0000
direct allocation
page read and write
19D4000
heap
page read and write
35FE000
stack
page read and write
4EEE000
stack
page read and write
5271000
heap
page read and write
5271000
heap
page read and write
5860000
direct allocation
page execute and read and write
1DE76000
heap
page read and write
1AE0000
heap
page read and write
19C0000
direct allocation
page read and write
1DE86000
heap
page read and write
300D4000
heap
page read and write
5271000
heap
page read and write
40EF000
stack
page read and write
5271000
heap
page read and write
1DE9F000
heap
page read and write
6CF61000
unkown
page execute read
D70000
unkown
page readonly
D71000
unkown
page execute and write copy
362E000
heap
page read and write
1DE88000
heap
page read and write
1D55E000
stack
page read and write
1DE6B000
heap
page read and write
FCE000
unkown
page execute and read and write
5840000
direct allocation
page execute and read and write
4EAF000
stack
page read and write
19C0000
direct allocation
page read and write
19D4000
heap
page read and write
19C0000
direct allocation
page read and write
1DE84000
heap
page read and write
6CF4E000
unkown
page read and write
1DE6A000
heap
page read and write
5271000
heap
page read and write
5271000
heap
page read and write
1DE7D000
heap
page read and write
516E000
stack
page read and write
5271000
heap
page read and write
5271000
heap
page read and write
5271000
heap
page read and write
1BB6000
heap
page read and write
4C2F000
stack
page read and write
19D4000
heap
page read and write
15C0000
heap
page read and write
E8E000
unkown
page execute and read and write
3002F000
stack
page read and write
1B9A000
heap
page read and write
1DE9D000
heap
page read and write
1DE6E000
heap
page read and write
19D0000
heap
page read and write
6D140000
unkown
page read and write
19B0000
heap
page read and write
5271000
heap
page read and write
3610000
direct allocation
page read and write
E21000
unkown
page execute and read and write
5271000
heap
page read and write
19D4000
heap
page read and write
1DE84000
heap
page read and write
1DE82000
heap
page read and write
1DE81000
heap
page read and write
1DE7B000
heap
page read and write
5271000
heap
page read and write
300CB000
heap
page read and write
3AAF000
stack
page read and write
5271000
heap
page read and write
1DE82000
heap
page read and write
56D0000
heap
page read and write
6D145000
unkown
page readonly
1DE9F000
heap
page read and write
1DE84000
heap
page read and write
5271000
heap
page read and write
412E000
stack
page read and write
4AEF000
stack
page read and write
5271000
heap
page read and write
5271000
heap
page read and write
23EE1000
heap
page read and write
F3B000
unkown
page execute and read and write
6CF60000
unkown
page readonly
19D4000
heap
page read and write
1569000
stack
page read and write
1DEA0000
heap
page read and write
E02000
unkown
page execute and read and write
D70000
unkown
page read and write
1DE85000
heap
page read and write
5271000
heap
page read and write
19D4000
heap
page read and write
6CEC1000
unkown
page execute read
1DE87000
heap
page read and write
5271000
heap
page read and write
1DE84000
heap
page read and write
5271000
heap
page read and write
5271000
heap
page read and write
1DE81000
heap
page read and write
1CDE000
stack
page read and write
19D4000
heap
page read and write
3D2F000
stack
page read and write
19D4000
heap
page read and write
1269000
unkown
page execute and write copy
5271000
heap
page read and write
61ECC000
direct allocation
page read and write
1DE5F000
heap
page read and write
1DE9F000
heap
page read and write
19D4000
heap
page read and write
1DE92000
heap
page read and write
1DE96000
heap
page read and write
5271000
heap
page read and write
1DE83000
heap
page read and write
19D4000
heap
page read and write
1DE96000
heap
page read and write
5271000
heap
page read and write
1DE7D000
heap
page read and write
5280000
heap
page read and write
1B9E000
heap
page read and write
194E000
stack
page read and write
15D0000
heap
page read and write
300D9000
heap
page read and write
1DE68000
heap
page read and write
5271000
heap
page read and write
300D3000
heap
page read and write
1DE7E000
heap
page read and write
19AE000
stack
page read and write
1BA3000
heap
page read and write
146C000
stack
page read and write
582F000
stack
page read and write
1DB6E000
stack
page read and write
5271000
heap
page read and write
476E000
stack
page read and write
5271000
heap
page read and write
19C0000
direct allocation
page read and write
E7F000
unkown
page execute and read and write
29E90000
heap
page read and write
1DCAD000
stack
page read and write
125A000
unkown
page execute and read and write
DF5000
unkown
page execute and read and write
19C0000
direct allocation
page read and write
5271000
heap
page read and write
1DE71000
heap
page read and write
1DE56000
heap
page read and write
19D4000
heap
page read and write
5271000
heap
page read and write
6D0FF000
unkown
page readonly
61ED4000
direct allocation
page readonly
5271000
heap
page read and write
5271000
heap
page read and write
512F000
stack
page read and write
362B000
heap
page read and write
1DE7E000
heap
page read and write
1DE7E000
heap
page read and write
396F000
stack
page read and write
1DEA0000
heap
page read and write
19D4000
heap
page read and write
1DE74000
heap
page read and write
5271000
heap
page read and write
19D4000
heap
page read and write
1DE9F000
heap
page read and write
1DE78000
heap
page read and write
There are 383 hidden memdumps, click here to show them.