IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKFCFBAAEHCFHJJKEHJK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\CAAAFCAK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EBFBFBFIIJDAKECAKKJEHCFIJK
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\FCFHJKJJJECGDHJJDHDAAAFBKF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GDBAKKKFBGDHJKFHJJJJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJDBAAEGDBKKECBGIJEBGDAEBF
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\KECGDBFCBKFIDHIDHDHIECGDHC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KFCFBFHIEBKJKFHIEBFB
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\KKECFIEB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/e2b1563c6670f193.phpm-LTC
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllRA
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpge
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/JM$n
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpimple-storage.json
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpr
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllV
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll(
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php.
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php/
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllU
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll$A
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 41 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
EDE000
heap
page read and write
 malicious
811000
unkown
page execute and read and write
 malicious
5020000
direct allocation
page read and write
 malicious
1D66A000
heap
page read and write
4B91000
heap
page read and write
FE5000
heap
page read and write
3C6F000
stack
page read and write
4B91000
heap
page read and write
1D68C000
heap
page read and write
F37000
heap
page read and write
2FA05000
heap
page read and write
1D670000
heap
page read and write
4B91000
heap
page read and write
316E000
stack
page read and write
4B91000
heap
page read and write
1D666000
heap
page read and write
4BB0000
heap
page read and write
402F000
stack
page read and write
4B91000
heap
page read and write
1D676000
heap
page read and write
8FF000
unkown
page execute and read and write
895000
unkown
page execute and read and write
143E000
stack
page read and write
1D67E000
heap
page read and write
1D656000
heap
page read and write
1D668000
heap
page read and write
6C650000
unkown
page readonly
8CD000
unkown
page execute and read and write
4B91000
heap
page read and write
29790000
heap
page read and write
1D656000
heap
page read and write
2ED0000
direct allocation
page read and write
4B91000
heap
page read and write
51A0000
direct allocation
page execute and read and write
236D4000
heap
page read and write
2ED0000
direct allocation
page read and write
1D66F000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
3F2E000
stack
page read and write
F78000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
1D66F000
heap
page read and write
61ED4000
direct allocation
page readonly
1D67E000
heap
page read and write
4B91000
heap
page read and write
92B000
unkown
page execute and read and write
2ED0000
direct allocation
page read and write
1D67D000
heap
page read and write
1D66F000
heap
page read and write
34EF000
stack
page read and write
A6E000
unkown
page execute and read and write
4B91000
heap
page read and write
ED0000
heap
page read and write
FF0000
heap
page read and write
32AE000
stack
page read and write
1D49D000
stack
page read and write
4B91000
heap
page read and write
133D000
stack
page read and write
6C8CF000
unkown
page write copy
4B91000
heap
page read and write
37AE000
stack
page read and write
F56000
heap
page read and write
2ED0000
direct allocation
page read and write
4B91000
heap
page read and write
1D66B000
heap
page read and write
1D66F000
heap
page read and write
2ED0000
direct allocation
page read and write
1D664000
heap
page read and write
1D67E000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D39D000
stack
page read and write
EDA000
heap
page read and write
2E7F000
stack
page read and write
2FA17000
heap
page read and write
6C88F000
unkown
page readonly
302E000
stack
page read and write
1D68C000
heap
page read and write
1D68B000
heap
page read and write
4B91000
heap
page read and write
9D5000
unkown
page execute and read and write
4B91000
heap
page read and write
5180000
direct allocation
page execute and read and write
1D68C000
heap
page read and write
4B91000
heap
page read and write
EB1000
unkown
page execute and write copy
42AF000
stack
page read and write
442E000
stack
page read and write
1D670000
heap
page read and write
1D665000
heap
page read and write
51A0000
direct allocation
page execute and read and write
4B91000
heap
page read and write
456E000
stack
page read and write
4B91000
heap
page read and write
61E01000
direct allocation
page execute read
4B91000
heap
page read and write
810000
unkown
page readonly
4B91000
heap
page read and write
452F000
stack
page read and write
2ED0000
direct allocation
page read and write
2EBC000
stack
page read and write
4B91000
heap
page read and write
515F000
stack
page read and write
297F2000
heap
page read and write
406E000
stack
page read and write
312F000
stack
page read and write
1D667000
heap
page read and write
4B91000
heap
page read and write
1D66B000
heap
page read and write
2FA0D000
heap
page read and write
3B6E000
stack
page read and write
F72000
heap
page read and write
1D68C000
heap
page read and write
4B91000
heap
page read and write
2EE0000
heap
page read and write
2F95E000
stack
page read and write
F6D000
heap
page read and write
3DAF000
stack
page read and write
505B000
stack
page read and write
1D667000
heap
page read and write
810000
unkown
page read and write
29832000
heap
page read and write
2ED0000
direct allocation
page read and write
2ED0000
direct allocation
page read and write
4B91000
heap
page read and write
1D660000
heap
page read and write
4B91000
heap
page read and write
D02000
unkown
page execute and read and write
4B91000
heap
page read and write
1D667000
heap
page read and write
8C1000
unkown
page execute and read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
1D0EE000
stack
page read and write
1D66B000
heap
page read and write
6C651000
unkown
page execute read
CD5000
unkown
page execute and read and write
2D7E000
stack
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
1D0AF000
stack
page read and write
2382A000
heap
page read and write
2EC0000
heap
page read and write
47AF000
stack
page read and write
F1E000
heap
page read and write
4B91000
heap
page read and write
3A2E000
stack
page read and write
1D655000
heap
page read and write
2ED0000
direct allocation
page read and write
F23000
heap
page read and write
2ED0000
direct allocation
page read and write
7D4000
stack
page read and write
2FEF000
stack
page read and write
51D0000
direct allocation
page execute and read and write
1D4DD000
stack
page read and write
41AE000
stack
page read and write
7D2000
stack
page read and write
61ECD000
direct allocation
page readonly
4BA0000
heap
page read and write
1D664000
heap
page read and write
7DD000
stack
page read and write
47EE000
stack
page read and write
4B91000
heap
page read and write
38EE000
stack
page read and write
1D67E000
heap
page read and write
2ED0000
direct allocation
page read and write
1D655000
heap
page read and write
4B91000
heap
page read and write
1D66F000
heap
page read and write
297D0000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
1D664000
heap
page read and write
2ED0000
direct allocation
page read and write
1CF6F000
stack
page read and write
1D769000
heap
page read and write
1D1EF000
stack
page read and write
1D66F000
heap
page read and write
4B91000
heap
page read and write
1D670000
heap
page read and write
1D654000
heap
page read and write
F7F000
heap
page read and write
4B91000
heap
page read and write
F84000
heap
page read and write
2FA1F000
heap
page read and write
5020000
direct allocation
page read and write
4B91000
heap
page read and write
326F000
stack
page read and write
1CFAE000
stack
page read and write
61EB4000
direct allocation
page read and write
352E000
stack
page read and write
1D642000
heap
page read and write
38AF000
stack
page read and write
4B91000
heap
page read and write
1D67E000
heap
page read and write
4B70000
heap
page read and write
1D671000
heap
page read and write
CF9000
unkown
page execute and read and write
4B91000
heap
page read and write
33EE000
stack
page read and write
1D670000
heap
page read and write
D10000
unkown
page execute and read and write
1D680000
heap
page read and write
2ED0000
direct allocation
page read and write
2EEE000
heap
page read and write
1D662000
heap
page read and write
7D8000
stack
page read and write
2F85E000
stack
page read and write
29812000
heap
page read and write
1D664000
heap
page read and write
51C0000
direct allocation
page execute and read and write
1D662000
heap
page read and write
4B91000
heap
page read and write
466F000
stack
page read and write
4B91000
heap
page read and write
51AE000
stack
page read and write
2ED0000
direct allocation
page read and write
3CAE000
stack
page read and write
1D683000
heap
page read and write
1D66E000
heap
page read and write
1D64B000
heap
page read and write
1D66F000
heap
page read and write
1D662000
heap
page read and write
147E000
stack
page read and write
811000
unkown
page execute and write copy
1D68C000
heap
page read and write
43EF000
stack
page read and write
362F000
stack
page read and write
1D66F000
heap
page read and write
1D665000
heap
page read and write
1D664000
heap
page read and write
1D66A000
heap
page read and write
6C8CE000
unkown
page read and write
FE0000
heap
page read and write
1D34F000
stack
page read and write
1D675000
heap
page read and write
4A6E000
stack
page read and write
4B91000
heap
page read and write
1D683000
heap
page read and write
1D760000
trusted library allocation
page read and write
4B91000
heap
page read and write
6C6F0000
unkown
page readonly
6DC000
stack
page read and write
61ED3000
direct allocation
page read and write
91F000
unkown
page execute and read and write
1D66F000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
1D640000
heap
page read and write
89F000
unkown
page execute and read and write
61EB7000
direct allocation
page readonly
6C8D0000
unkown
page read and write
1D67E000
heap
page read and write
1D66B000
heap
page read and write
1D67E000
heap
page read and write
3B2F000
stack
page read and write
2FA13000
heap
page read and write
BF8000
unkown
page execute and read and write
33AF000
stack
page read and write
4B91000
heap
page read and write
5020000
direct allocation
page read and write
4FD0000
trusted library allocation
page read and write
6C6DE000
unkown
page read and write
1D66C000
heap
page read and write
1D665000
heap
page read and write
42EE000
stack
page read and write
4B91000
heap
page read and write
5170000
direct allocation
page execute and read and write
6C8D5000
unkown
page readonly
4B91000
heap
page read and write
4B91000
heap
page read and write
1D670000
heap
page read and write
4B91000
heap
page read and write
D11000
unkown
page execute and write copy
8F2000
unkown
page execute and read and write
1D675000
heap
page read and write
3DEE000
stack
page read and write
1D670000
heap
page read and write
3EEF000
stack
page read and write
2F970000
trusted library allocation
page read and write
4B91000
heap
page read and write
492E000
stack
page read and write
4A2F000
stack
page read and write
4B91000
heap
page read and write
4B6F000
stack
page read and write
1D5DC000
stack
page read and write
4BA5000
heap
page read and write
366E000
stack
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
1D66F000
heap
page read and write
1D68C000
heap
page read and write
61ECC000
direct allocation
page read and write
157F000
stack
page read and write
1D68C000
heap
page read and write
1D665000
heap
page read and write
2EEB000
heap
page read and write
6C6E2000
unkown
page readonly
92E000
unkown
page execute and read and write
46AE000
stack
page read and write
1D68C000
heap
page read and write
1D68C000
heap
page read and write
86A000
unkown
page execute and read and write
D10000
unkown
page execute and write copy
4B91000
heap
page read and write
297B0000
heap
page read and write
1D67E000
heap
page read and write
4B90000
heap
page read and write
51B0000
direct allocation
page execute and read and write
1D65B000
heap
page read and write
4B91000
heap
page read and write
1D67E000
heap
page read and write
416F000
stack
page read and write
4B91000
heap
page read and write
5190000
direct allocation
page execute and read and write
1D24E000
stack
page read and write
12D0000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
1D66F000
heap
page read and write
1D664000
heap
page read and write
61ED0000
direct allocation
page read and write
4B91000
heap
page read and write
6C6F1000
unkown
page execute read
39EF000
stack
page read and write
9B5000
unkown
page execute and read and write
2377E000
heap
page read and write
376F000
stack
page read and write
4B91000
heap
page read and write
1D670000
heap
page read and write
1D68C000
heap
page read and write
1D686000
heap
page read and write
9DB000
unkown
page execute and read and write
898000
unkown
page execute and read and write
8A2000
unkown
page execute and read and write
1D66F000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
2EE7000
heap
page read and write
4B91000
heap
page read and write
48EF000
stack
page read and write
1D672000
heap
page read and write
4B91000
heap
page read and write
6C6CD000
unkown
page readonly
EB0000
unkown
page execute and read and write
There are 337 hidden memdumps, click here to show them.