IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKKEHIECFCAAFIEBGIDA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GDAAKKEHDHCAAAKFCBAKKEHIEC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GHDAKKJJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GIEHJKEBAAEBGCAAEBFHJKKKEC
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\HCGDGIDGIJKKEBGDAECA
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\IJECAEHJJJKJKFIDGCBG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JEBGCBAFCGDAAKFIDGIEGDGDHI
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJJECFIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll_
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dlla
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpZ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/Z
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpW
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php)pF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll(
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllv
unknown
 malicious
http://185.215.113.37/C
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php6
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php)PG
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpla
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 38 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
771000
unkown
page execute and read and write
 malicious
5120000
direct allocation
page read and write
 malicious
149E000
heap
page read and write
 malicious
12D4000
heap
page read and write
4C91000
heap
page read and write
12D4000
heap
page read and write
4C91000
heap
page read and write
915000
unkown
page execute and read and write
12D4000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D8D7000
heap
page read and write
4C91000
heap
page read and write
127E000
stack
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
1D8EB000
heap
page read and write
1D8C9000
heap
page read and write
1585000
heap
page read and write
1D89D000
stack
page read and write
12D4000
heap
page read and write
4C80000
direct allocation
page read and write
5290000
direct allocation
page execute and read and write
1D8D8000
heap
page read and write
376E000
stack
page read and write
1D8CA000
heap
page read and write
9CE000
unkown
page execute and read and write
4C91000
heap
page read and write
1D36E000
stack
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
7F8000
unkown
page execute and read and write
13B7000
heap
page read and write
1D8F0000
heap
page read and write
7F5000
unkown
page execute and read and write
29A13000
heap
page read and write
1D8E1000
heap
page read and write
1D8BA000
heap
page read and write
29A73000
heap
page read and write
12D4000
heap
page read and write
48FE000
stack
page read and write
1D9C0000
trusted library allocation
page read and write
E12000
unkown
page execute and read and write
4C91000
heap
page read and write
1D8F1000
heap
page read and write
1D8BA000
heap
page read and write
1D8EB000
heap
page read and write
4C91000
heap
page read and write
1D8B8000
heap
page read and write
1D8D0000
heap
page read and write
61ED4000
direct allocation
page readonly
12D4000
heap
page read and write
87F000
unkown
page execute and read and write
1D8F0000
heap
page read and write
1D8C9000
heap
page read and write
1D8DB000
heap
page read and write
12D4000
heap
page read and write
FA9000
stack
page read and write
144B000
stack
page read and write
4C91000
heap
page read and write
12D4000
heap
page read and write
3DAE000
stack
page read and write
C5B000
unkown
page execute and read and write
4B7E000
stack
page read and write
52D0000
direct allocation
page execute and read and write
61ECC000
direct allocation
page read and write
4C91000
heap
page read and write
6C6B1000
unkown
page execute read
1490000
heap
page read and write
1D8D8000
heap
page read and write
4C80000
direct allocation
page read and write
3D6F000
stack
page read and write
C72000
unkown
page execute and write copy
4C80000
direct allocation
page read and write
1D8CD000
heap
page read and write
1D8F0000
heap
page read and write
23927000
heap
page read and write
148E000
stack
page read and write
302F000
stack
page read and write
5280000
direct allocation
page execute and read and write
12D4000
heap
page read and write
1D8CA000
heap
page read and write
5120000
direct allocation
page read and write
52C0000
direct allocation
page execute and read and write
34EE000
stack
page read and write
1D8D4000
heap
page read and write
1D8E1000
heap
page read and write
326E000
stack
page read and write
35EF000
stack
page read and write
48BF000
stack
page read and write
1D32E000
stack
page read and write
4C91000
heap
page read and write
362E000
stack
page read and write
2FB16000
heap
page read and write
C73000
unkown
page execute and write copy
1D8CD000
heap
page read and write
1D8D4000
heap
page read and write
12D4000
heap
page read and write
4C91000
heap
page read and write
1D8F1000
heap
page read and write
12D4000
heap
page read and write
1D8B9000
heap
page read and write
12D4000
heap
page read and write
1D8AF000
heap
page read and write
3EEE000
stack
page read and write
4C91000
heap
page read and write
322F000
stack
page read and write
1D8D4000
heap
page read and write
52A0000
direct allocation
page execute and read and write
1D8C6000
heap
page read and write
1D8D4000
heap
page read and write
4C91000
heap
page read and write
42AE000
stack
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
EAC000
stack
page read and write
1D8BA000
heap
page read and write
1D8F0000
heap
page read and write
1D5FD000
stack
page read and write
13BE000
heap
page read and write
4C80000
direct allocation
page read and write
1D8CA000
heap
page read and write
1D8C9000
heap
page read and write
1D8C9000
heap
page read and write
4B3F000
stack
page read and write
1D8BA000
heap
page read and write
B5B000
unkown
page execute and read and write
1D8EE000
heap
page read and write
1D22E000
stack
page read and write
3B2E000
stack
page read and write
43EE000
stack
page read and write
12D4000
heap
page read and write
12BE000
stack
page read and write
1D8C8000
heap
page read and write
1D8CB000
heap
page read and write
1D8BA000
heap
page read and write
82D000
unkown
page execute and read and write
1D8E1000
heap
page read and write
4C91000
heap
page read and write
312F000
stack
page read and write
7CA000
unkown
page execute and read and write
2FB13000
heap
page read and write
14E3000
heap
page read and write
12D4000
heap
page read and write
1D8D4000
heap
page read and write
C62000
unkown
page execute and read and write
FA3000
stack
page read and write
6C6B0000
unkown
page readonly
6C88E000
unkown
page read and write
3C6E000
stack
page read and write
1D8E1000
heap
page read and write
1D8D0000
heap
page read and write
6C6A2000
unkown
page readonly
6C88F000
unkown
page write copy
1D0AF000
stack
page read and write
61EB4000
direct allocation
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
6C895000
unkown
page readonly
12D4000
heap
page read and write
4C91000
heap
page read and write
1D8C6000
heap
page read and write
12D4000
heap
page read and write
157F000
heap
page read and write
12D4000
heap
page read and write
1D8D4000
heap
page read and write
1D8E1000
heap
page read and write
1210000
heap
page read and write
4C91000
heap
page read and write
38AE000
stack
page read and write
6C610000
unkown
page readonly
4C91000
heap
page read and write
6C611000
unkown
page execute read
3C2F000
stack
page read and write
1D8C9000
heap
page read and write
1D8D4000
heap
page read and write
29A7D000
heap
page read and write
52B0000
direct allocation
page execute and read and write
239C9000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D8A0000
heap
page read and write
1D8D4000
heap
page read and write
770000
unkown
page read and write
4C80000
direct allocation
page read and write
821000
unkown
page execute and read and write
1D8D2000
heap
page read and write
4C91000
heap
page read and write
12D4000
heap
page read and write
1D8D4000
heap
page read and write
1D8D0000
heap
page read and write
4C91000
heap
page read and write
13B0000
heap
page read and write
1D8E1000
heap
page read and write
29A1D000
heap
page read and write
12D4000
heap
page read and write
1D8D8000
heap
page read and write
336F000
stack
page read and write
1D8EC000
heap
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
4C80000
direct allocation
page read and write
12D4000
heap
page read and write
39AF000
stack
page read and write
12D4000
heap
page read and write
1D8BA000
heap
page read and write
1D8D8000
heap
page read and write
1D8C9000
heap
page read and write
1D8D4000
heap
page read and write
12D4000
heap
page read and write
1D0EE000
stack
page read and write
2FB1E000
heap
page read and write
1D8CD000
heap
page read and write
1D8F0000
heap
page read and write
12D4000
heap
page read and write
4C91000
heap
page read and write
14F7000
heap
page read and write
29A26000
heap
page read and write
4C91000
heap
page read and write
12D4000
heap
page read and write
157A000
heap
page read and write
1D8E1000
heap
page read and write
1D8D4000
heap
page read and write
1D8D1000
heap
page read and write
771000
unkown
page execute and write copy
1D8D1000
heap
page read and write
1D4BD000
stack
page read and write
5270000
direct allocation
page execute and read and write
1D8B9000
heap
page read and write
1CFAE000
stack
page read and write
85F000
unkown
page execute and read and write
29A11000
heap
page read and write
1D8D4000
heap
page read and write
5120000
direct allocation
page read and write
61EB7000
direct allocation
page readonly
12D4000
heap
page read and write
29A29000
heap
page read and write
12D4000
heap
page read and write
12D4000
heap
page read and write
61ECD000
direct allocation
page readonly
1D8EF000
heap
page read and write
1D8D4000
heap
page read and write
FAD000
stack
page read and write
4C91000
heap
page read and write
12D4000
heap
page read and write
4C91000
heap
page read and write
1D8E1000
heap
page read and write
1D8DC000
heap
page read and write
1D8D4000
heap
page read and write
1D8DC000
heap
page read and write
1D8D8000
heap
page read and write
12D4000
heap
page read and write
770000
unkown
page readonly
4C91000
heap
page read and write
4C91000
heap
page read and write
1200000
heap
page read and write
1D8E1000
heap
page read and write
61E01000
direct allocation
page execute read
1D8D4000
heap
page read and write
12D4000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
2FB05000
heap
page read and write
44EF000
stack
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D8CB000
heap
page read and write
477F000
stack
page read and write
4C90000
heap
page read and write
412F000
stack
page read and write
149A000
heap
page read and write
12D4000
heap
page read and write
4C80000
direct allocation
page read and write
47BE000
stack
page read and write
3AEF000
stack
page read and write
386F000
stack
page read and write
4C91000
heap
page read and write
1D8CB000
heap
page read and write
4C91000
heap
page read and write
33AE000
stack
page read and write
3EAF000
stack
page read and write
1D8C6000
heap
page read and write
4C80000
direct allocation
page read and write
1D5BD000
stack
page read and write
802000
unkown
page execute and read and write
1D8F0000
heap
page read and write
1D8D4000
heap
page read and write
4C80000
direct allocation
page read and write
3FEF000
stack
page read and write
4C91000
heap
page read and write
416E000
stack
page read and write
1D8B5000
heap
page read and write
935000
unkown
page execute and read and write
1D8F0000
heap
page read and write
E13000
unkown
page execute and write copy
4C7F000
stack
page read and write
452E000
stack
page read and write
1D46F000
stack
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D8D7000
heap
page read and write
C72000
unkown
page execute and read and write
12D4000
heap
page read and write
4C91000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D8F0000
heap
page read and write
1D8D4000
heap
page read and write
2FA70000
trusted library allocation
page read and write
1D8D7000
heap
page read and write
402E000
stack
page read and write
1D8E1000
heap
page read and write
4C91000
heap
page read and write
4C91000
heap
page read and write
1D8D4000
heap
page read and write
29A15000
heap
page read and write
525F000
stack
page read and write
1D8D4000
heap
page read and write
4CA0000
heap
page read and write
12D4000
heap
page read and write
C3B000
unkown
page execute and read and write
52A0000
direct allocation
page execute and read and write
4C91000
heap
page read and write
23A6D000
heap
page read and write
12D4000
heap
page read and write
1D8C9000
heap
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
4A3E000
stack
page read and write
1D8A6000
heap
page read and write
178F000
stack
page read and write
1D8F1000
heap
page read and write
6C69E000
unkown
page read and write
4C91000
heap
page read and write
299F0000
heap
page read and write
1D1EF000
stack
page read and write
1D8E1000
heap
page read and write
462F000
stack
page read and write
39EE000
stack
page read and write
1D8D8000
heap
page read and write
7FF000
unkown
page execute and read and write
168F000
stack
page read and write
1D8BB000
heap
page read and write
1D9C0000
heap
page read and write
4D90000
trusted library allocation
page read and write
467E000
stack
page read and write
1D8F0000
heap
page read and write
2FB0D000
heap
page read and write
34AF000
stack
page read and write
1D8D8000
heap
page read and write
1D8C9000
heap
page read and write
12D0000
heap
page read and write
1510000
heap
page read and write
1D8D4000
heap
page read and write
13BB000
heap
page read and write
93B000
unkown
page execute and read and write
43AF000
stack
page read and write
140E000
stack
page read and write
4C91000
heap
page read and write
29A2F000
heap
page read and write
1D8C9000
heap
page read and write
1D6FE000
stack
page read and write
1D8CA000
heap
page read and write
515B000
stack
page read and write
1D79D000
stack
page read and write
4CB0000
heap
page read and write
426F000
stack
page read and write
6C84F000
unkown
page readonly
88B000
unkown
page execute and read and write
49FF000
stack
page read and write
1D8D4000
heap
page read and write
12D4000
heap
page read and write
4C91000
heap
page read and write
1D8F0000
heap
page read and write
1D8EF000
heap
page read and write
4C91000
heap
page read and write
4C80000
direct allocation
page read and write
299D0000
heap
page read and write
1D8D2000
heap
page read and write
12D4000
heap
page read and write
5100000
heap
page read and write
61ED3000
direct allocation
page read and write
12D4000
heap
page read and write
1D8C9000
heap
page read and write
1D8D4000
heap
page read and write
61ED0000
direct allocation
page read and write
6C890000
unkown
page read and write
6C68D000
unkown
page readonly
4C91000
heap
page read and write
852000
unkown
page execute and read and write
1D8D4000
heap
page read and write
4C80000
direct allocation
page read and write
29A17000
heap
page read and write
4C91000
heap
page read and write
88E000
unkown
page execute and read and write
14DD000
heap
page read and write
372F000
stack
page read and write
4630000
heap
page read and write
There are 391 hidden memdumps, click here to show them.