IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\EBAKKFHJDBKKEBFHDAAEBGIEGD
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EBGDAAKJJDAAKFHJKJKF
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\EGHCBKKKFHCGCBFIJEHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FCBAEHCAEGDHJKFHJKFIJKJEGH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GDBAKEGIDBGIEBFHDHJJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HIIIECAA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\IEBAAFCAFCBKFHJJJKKFHIDAAK
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\IJKFHIIEHIEGDHJJJKFIIIIDGI
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\JDBGDHII
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllw
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpC6
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllJ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllD
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpm
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpv
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpb
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpU5
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll0
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllv
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll2I
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll?
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllr
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php322
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllX
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwindow-state.json
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 43 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
A0E000
heap
page read and write
 malicious
4F80000
direct allocation
page read and write
 malicious
EC1000
unkown
page execute and read and write
 malicious
F48000
unkown
page execute and read and write
2F957000
heap
page read and write
471F000
stack
page read and write
EB0000
direct allocation
page read and write
AF6000
heap
page read and write
1D5D6000
heap
page read and write
421F000
stack
page read and write
236D2000
heap
page read and write
1D5B0000
heap
page read and write
2D9E000
heap
page read and write
EB0000
direct allocation
page read and write
4B01000
heap
page read and write
1D5DB000
heap
page read and write
29737000
heap
page read and write
F7D000
unkown
page execute and read and write
1D5C0000
heap
page read and write
296E0000
heap
page read and write
6C8CE000
unkown
page read and write
475E000
stack
page read and write
EC1000
unkown
page execute and write copy
12A2000
unkown
page execute and read and write
953000
stack
page read and write
1D5CE000
heap
page read and write
1D5BB000
heap
page read and write
1D5DC000
heap
page read and write
1D5C2000
heap
page read and write
1D2EE000
stack
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
1D5BB000
heap
page read and write
4B01000
heap
page read and write
1D5DC000
heap
page read and write
1D19E000
stack
page read and write
1D5B7000
heap
page read and write
4B01000
heap
page read and write
1CFFF000
stack
page read and write
44DE000
stack
page read and write
4B01000
heap
page read and write
6C8CF000
unkown
page write copy
4B01000
heap
page read and write
1D590000
heap
page read and write
1D5C0000
heap
page read and write
1D5DC000
heap
page read and write
2F8C0000
trusted library allocation
page read and write
5110000
direct allocation
page execute and read and write
30DE000
stack
page read and write
4B01000
heap
page read and write
1D5BF000
heap
page read and write
439E000
stack
page read and write
D4E000
stack
page read and write
1D5BF000
heap
page read and write
1D5DC000
heap
page read and write
EB0000
direct allocation
page read and write
4B01000
heap
page read and write
4F80000
direct allocation
page read and write
4B01000
heap
page read and write
449F000
stack
page read and write
2362D000
heap
page read and write
4B00000
heap
page read and write
1D59B000
heap
page read and write
2D7E000
stack
page read and write
2F95F000
heap
page read and write
4B01000
heap
page read and write
3D5E000
stack
page read and write
4AE0000
heap
page read and write
4B01000
heap
page read and write
959000
stack
page read and write
13A5000
unkown
page execute and read and write
A00000
heap
page read and write
1D5B4000
heap
page read and write
1D13E000
stack
page read and write
4B01000
heap
page read and write
FDB000
unkown
page execute and read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
3D1F000
stack
page read and write
331F000
stack
page read and write
61ED4000
direct allocation
page readonly
1D5CE000
heap
page read and write
108B000
unkown
page execute and read and write
1D5B4000
heap
page read and write
1D5BF000
heap
page read and write
4B01000
heap
page read and write
1D29F000
stack
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
95D000
stack
page read and write
4B01000
heap
page read and write
FCF000
unkown
page execute and read and write
4B01000
heap
page read and write
6C6E2000
unkown
page readonly
1D5B4000
heap
page read and write
4B01000
heap
page read and write
1D5B6000
heap
page read and write
FAF000
unkown
page execute and read and write
335E000
stack
page read and write
381F000
stack
page read and write
1D3ED000
stack
page read and write
6C8D0000
unkown
page read and write
9B0000
heap
page read and write
4B01000
heap
page read and write
1D5BF000
heap
page read and write
61ECD000
direct allocation
page readonly
425E000
stack
page read and write
F52000
unkown
page execute and read and write
1D5A4000
heap
page read and write
EB0000
direct allocation
page read and write
1D5CE000
heap
page read and write
3ADE000
stack
page read and write
2F9F000
stack
page read and write
1D5BF000
heap
page read and write
309F000
stack
page read and write
50D0000
direct allocation
page execute and read and write
F1A000
unkown
page execute and read and write
1D5BB000
heap
page read and write
1D5C1000
heap
page read and write
1381000
unkown
page execute and read and write
EB0000
direct allocation
page read and write
1D5BF000
heap
page read and write
9E5000
heap
page read and write
1D5BB000
heap
page read and write
1085000
unkown
page execute and read and write
3FDE000
stack
page read and write
29748000
heap
page read and write
4B01000
heap
page read and write
61E01000
direct allocation
page execute read
EB0000
direct allocation
page read and write
4B01000
heap
page read and write
29720000
heap
page read and write
3F9F000
stack
page read and write
359F000
stack
page read and write
461E000
stack
page read and write
1D6B8000
heap
page read and write
2973F000
heap
page read and write
4B01000
heap
page read and write
1D6B0000
trusted library allocation
page read and write
1D5B4000
heap
page read and write
1D5D3000
heap
page read and write
1D5B5000
heap
page read and write
1D5BF000
heap
page read and write
435F000
stack
page read and write
3E5F000
stack
page read and write
9E0000
heap
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
1D5B2000
heap
page read and write
13BF000
unkown
page execute and read and write
1065000
unkown
page execute and read and write
61ED3000
direct allocation
page read and write
1D5BF000
heap
page read and write
1D5B7000
heap
page read and write
EC0000
unkown
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
D0E000
stack
page read and write
4B01000
heap
page read and write
EC0000
unkown
page readonly
EB0000
direct allocation
page read and write
1D5BC000
heap
page read and write
1D5B2000
heap
page read and write
4B20000
heap
page read and write
1D5DC000
heap
page read and write
29743000
heap
page read and write
4B01000
heap
page read and write
1D5B5000
heap
page read and write
3C1E000
stack
page read and write
4B01000
heap
page read and write
6C8D5000
unkown
page readonly
4B01000
heap
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
1D5CE000
heap
page read and write
4B01000
heap
page read and write
1D5C0000
heap
page read and write
1D5BE000
heap
page read and write
4B01000
heap
page read and write
A6B000
heap
page read and write
4B01000
heap
page read and write
510E000
stack
page read and write
345F000
stack
page read and write
6C651000
unkown
page execute read
4FBC000
stack
page read and write
2D3C000
stack
page read and write
395F000
stack
page read and write
4B01000
heap
page read and write
1D5DC000
heap
page read and write
1D5C0000
heap
page read and write
4B01000
heap
page read and write
1D5CE000
heap
page read and write
2979B000
heap
page read and write
4B01000
heap
page read and write
1D5BF000
heap
page read and write
1D5BF000
heap
page read and write
13B1000
unkown
page execute and read and write
4B01000
heap
page read and write
399E000
stack
page read and write
F4F000
unkown
page execute and read and write
50BF000
stack
page read and write
F71000
unkown
page execute and read and write
6C650000
unkown
page readonly
4B01000
heap
page read and write
4B01000
heap
page read and write
1D5DC000
heap
page read and write
A82000
heap
page read and write
1D5B2000
heap
page read and write
4B01000
heap
page read and write
6C6CD000
unkown
page readonly
1D5B4000
heap
page read and write
61E00000
direct allocation
page execute and read and write
EB0000
direct allocation
page read and write
4B01000
heap
page read and write
2F967000
heap
page read and write
1D5A5000
heap
page read and write
1D5CE000
heap
page read and write
2972C000
heap
page read and write
A51000
heap
page read and write
1D5DC000
heap
page read and write
1D03D000
stack
page read and write
2D9B000
heap
page read and write
4B01000
heap
page read and write
35DE000
stack
page read and write
155B000
unkown
page execute and read and write
61ED0000
direct allocation
page read and write
1D5BF000
heap
page read and write
A97000
heap
page read and write
1D52D000
stack
page read and write
29731000
heap
page read and write
FA2000
unkown
page execute and read and write
1D5B5000
heap
page read and write
4ADF000
stack
page read and write
6C6F1000
unkown
page execute read
EB0000
direct allocation
page read and write
4B01000
heap
page read and write
1D5BA000
heap
page read and write
1CEBF000
stack
page read and write
13BF000
unkown
page execute and write copy
1D5C5000
heap
page read and write
1D5DC000
heap
page read and write
C0E000
stack
page read and write
4B01000
heap
page read and write
3A9F000
stack
page read and write
1D5C6000
heap
page read and write
6C6F0000
unkown
page readonly
1D5B5000
heap
page read and write
EA0000
heap
page read and write
50E0000
direct allocation
page execute and read and write
61ECC000
direct allocation
page read and write
2F95F000
heap
page read and write
2F965000
heap
page read and write
4B01000
heap
page read and write
1D5CE000
heap
page read and write
385E000
stack
page read and write
1D5DC000
heap
page read and write
9A0000
heap
page read and write
2E9F000
stack
page read and write
1D592000
heap
page read and write
61EB4000
direct allocation
page read and write
EB0000
direct allocation
page read and write
1D5BA000
heap
page read and write
4B01000
heap
page read and write
AF8000
heap
page read and write
1D5CE000
heap
page read and write
349E000
stack
page read and write
1D5C0000
heap
page read and write
2D97000
heap
page read and write
155C000
unkown
page execute and write copy
485F000
stack
page read and write
1D5D0000
heap
page read and write
29700000
heap
page read and write
13C0000
unkown
page execute and write copy
1D42E000
stack
page read and write
4B01000
heap
page read and write
31DF000
stack
page read and write
1D5B4000
heap
page read and write
45DF000
stack
page read and write
36DF000
stack
page read and write
40DF000
stack
page read and write
4C00000
trusted library allocation
page read and write
50F0000
direct allocation
page execute and read and write
2F7BE000
stack
page read and write
FDE000
unkown
page execute and read and write
85C000
stack
page read and write
111E000
unkown
page execute and read and write
4B01000
heap
page read and write
1D5B8000
heap
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
6C6DE000
unkown
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
4B01000
heap
page read and write
3BDF000
stack
page read and write
4B01000
heap
page read and write
4B10000
heap
page read and write
4B01000
heap
page read and write
2D90000
heap
page read and write
F45000
unkown
page execute and read and write
1D5C5000
heap
page read and write
EB0000
direct allocation
page read and write
2972E000
heap
page read and write
321E000
stack
page read and write
4B01000
heap
page read and write
5120000
direct allocation
page execute and read and write
2978B000
heap
page read and write
489E000
stack
page read and write
1D5C0000
heap
page read and write
4B01000
heap
page read and write
23771000
heap
page read and write
5100000
direct allocation
page execute and read and write
1D5A6000
heap
page read and write
4B01000
heap
page read and write
E9E000
stack
page read and write
EB0000
direct allocation
page read and write
1D5CD000
heap
page read and write
1D5B7000
heap
page read and write
E4E000
stack
page read and write
4B01000
heap
page read and write
1D5CE000
heap
page read and write
EB0000
direct allocation
page read and write
6C88F000
unkown
page readonly
371E000
stack
page read and write
2F8BF000
stack
page read and write
1CEFE000
stack
page read and write
411D000
stack
page read and write
1D5BF000
heap
page read and write
1D5D3000
heap
page read and write
4B01000
heap
page read and write
499F000
stack
page read and write
1D5AB000
heap
page read and write
A4C000
heap
page read and write
A0A000
heap
page read and write
5100000
direct allocation
page execute and read and write
1D5A5000
heap
page read and write
1D5A6000
heap
page read and write
49DE000
stack
page read and write
4F80000
direct allocation
page read and write
1D5C0000
heap
page read and write
61EB7000
direct allocation
page readonly
4B01000
heap
page read and write
EB0000
direct allocation
page read and write
3E9E000
stack
page read and write
There are 338 hidden memdumps, click here to show them.