IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKECBFBAEBKJJJJKFCGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BKJEGDGIJECGCBGCGHDGIEGCBF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FBKJKEHIJECGCBFIJEGIDBGIEC
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\GIEHJDHCBAEHJJJKKFIDGHJECA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IDHIDBAEGIIIDHJKEGDB
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\IIECFHDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IJEGDBGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\JKECFCFBGDHIECAAFIID
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlle=
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpi2Z
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpfz
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpu2V
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllw=
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpom
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll/=
unknown
 malicious
http://185.215.113.37.com
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phph
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpg
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpZ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/b.u
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php12
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php%2
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwindow-state.jsonc
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 42 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
14CE000
heap
page read and write
 malicious
4FA0000
direct allocation
page read and write
 malicious
B31000
unkown
page execute and read and write
 malicious
152A000
heap
page read and write
371F000
stack
page read and write
1559000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
1D724000
heap
page read and write
1D719000
heap
page read and write
4B40000
heap
page read and write
4B21000
heap
page read and write
6C8A0000
unkown
page read and write
6F8DD000
unkown
page readonly
34DE000
stack
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
BBF000
unkown
page execute and read and write
2FADF000
heap
page read and write
1350000
direct allocation
page read and write
6C8A5000
unkown
page readonly
4B21000
heap
page read and write
1D6FF000
heap
page read and write
238E3000
heap
page read and write
4B21000
heap
page read and write
4B20000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
136E000
heap
page read and write
4B21000
heap
page read and write
4B36000
heap
page read and write
1367000
heap
page read and write
B30000
unkown
page read and write
1D719000
heap
page read and write
3ADF000
stack
page read and write
1D731000
heap
page read and write
4B21000
heap
page read and write
1D6ED000
stack
page read and write
1D724000
heap
page read and write
1D724000
heap
page read and write
C12000
unkown
page execute and read and write
4C20000
trusted library allocation
page read and write
1D72C000
heap
page read and write
101E000
unkown
page execute and read and write
CD5000
unkown
page execute and read and write
50DF000
stack
page read and write
1D72B000
heap
page read and write
5140000
direct allocation
page execute and read and write
349F000
stack
page read and write
4B21000
heap
page read and write
1350000
direct allocation
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
1D731000
heap
page read and write
2FAD7000
heap
page read and write
1D709000
heap
page read and write
4A1E000
stack
page read and write
1D73F000
heap
page read and write
1D740000
heap
page read and write
29891000
heap
page read and write
1D813000
heap
page read and write
4B21000
heap
page read and write
C4E000
unkown
page execute and read and write
1350000
direct allocation
page read and write
30DF000
stack
page read and write
1D01F000
stack
page read and write
4B21000
heap
page read and write
1D724000
heap
page read and write
4B21000
heap
page read and write
3D5F000
stack
page read and write
15AE000
heap
page read and write
5120000
direct allocation
page execute and read and write
6F8EE000
unkown
page read and write
1360000
heap
page read and write
1350000
direct allocation
page read and write
1D740000
heap
page read and write
29850000
heap
page read and write
489F000
stack
page read and write
1D719000
heap
page read and write
1D73B000
heap
page read and write
425F000
stack
page read and write
1D724000
heap
page read and write
BB5000
unkown
page execute and read and write
1D1BE000
stack
page read and write
4B21000
heap
page read and write
1D728000
heap
page read and write
439F000
stack
page read and write
134E000
stack
page read and write
3FDF000
stack
page read and write
12CE000
stack
page read and write
2FACA000
heap
page read and write
4B21000
heap
page read and write
1D740000
heap
page read and write
1D719000
heap
page read and write
1D719000
heap
page read and write
39DE000
stack
page read and write
4B21000
heap
page read and write
1D722000
heap
page read and write
49DF000
stack
page read and write
C1F000
unkown
page execute and read and write
6C85F000
unkown
page readonly
1D724000
heap
page read and write
14B0000
direct allocation
page read and write
1350000
direct allocation
page read and write
1350000
direct allocation
page read and write
156E000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
1D721000
heap
page read and write
1D731000
heap
page read and write
1D724000
heap
page read and write
1D705000
heap
page read and write
1D72C000
heap
page read and write
4B21000
heap
page read and write
61ECC000
direct allocation
page read and write
1D731000
heap
page read and write
325E000
stack
page read and write
1D54C000
stack
page read and write
511E000
stack
page read and write
1370000
heap
page read and write
AFE000
stack
page read and write
1D740000
heap
page read and write
1350000
direct allocation
page read and write
1D716000
heap
page read and write
1D70A000
heap
page read and write
1D728000
heap
page read and write
14CA000
heap
page read and write
298FC000
heap
page read and write
4B21000
heap
page read and write
50F0000
direct allocation
page execute and read and write
1D720000
heap
page read and write
4B21000
heap
page read and write
5130000
direct allocation
page execute and read and write
1D71A000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D73C000
heap
page read and write
1D719000
heap
page read and write
1D724000
heap
page read and write
298AA000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
61ED3000
direct allocation
page read and write
1D740000
heap
page read and write
1D724000
heap
page read and write
11C8000
unkown
page execute and write copy
B8A000
unkown
page execute and read and write
6F861000
unkown
page execute read
61EB4000
direct allocation
page read and write
5100000
direct allocation
page execute and read and write
339E000
stack
page read and write
2F92E000
stack
page read and write
1D741000
heap
page read and write
4B21000
heap
page read and write
1D731000
heap
page read and write
44DF000
stack
page read and write
1D30E000
stack
page read and write
3B1E000
stack
page read and write
4B21000
heap
page read and write
6C89F000
unkown
page write copy
CFB000
unkown
page execute and read and write
50E0000
direct allocation
page execute and read and write
BED000
unkown
page execute and read and write
3D9E000
stack
page read and write
1D71D000
heap
page read and write
1D70A000
heap
page read and write
1D810000
trusted library allocation
page read and write
361E000
stack
page read and write
1D724000
heap
page read and write
1D727000
heap
page read and write
4B21000
heap
page read and write
1D724000
heap
page read and write
1D728000
heap
page read and write
4B21000
heap
page read and write
1561000
heap
page read and write
4B21000
heap
page read and write
1D71A000
heap
page read and write
2FDE000
stack
page read and write
102C000
unkown
page execute and write copy
1D728000
heap
page read and write
1D741000
heap
page read and write
298F4000
heap
page read and write
4B21000
heap
page read and write
29870000
heap
page read and write
1D44E000
stack
page read and write
A90000
heap
page read and write
465E000
stack
page read and write
11C7000
unkown
page execute and read and write
15B1000
heap
page read and write
4B21000
heap
page read and write
953000
stack
page read and write
1D724000
heap
page read and write
4B21000
heap
page read and write
14B0000
direct allocation
page read and write
1D73B000
heap
page read and write
1D724000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
6F860000
unkown
page readonly
479E000
stack
page read and write
1D727000
heap
page read and write
1015000
unkown
page execute and read and write
1D731000
heap
page read and write
1D40D000
stack
page read and write
48DE000
stack
page read and write
1D6F0000
heap
page read and write
1D740000
heap
page read and write
1350000
direct allocation
page read and write
1D15F000
stack
page read and write
130E000
stack
page read and write
429E000
stack
page read and write
9B0000
heap
page read and write
1D728000
heap
page read and write
1D716000
heap
page read and write
4B21000
heap
page read and write
1D719000
heap
page read and write
15AD000
heap
page read and write
29893000
heap
page read and write
4B21000
heap
page read and write
1D724000
heap
page read and write
311E000
stack
page read and write
959000
stack
page read and write
BC2000
unkown
page execute and read and write
4B21000
heap
page read and write
1D720000
heap
page read and write
43DE000
stack
page read and write
15A9000
heap
page read and write
1D5ED000
stack
page read and write
61E01000
direct allocation
page execute read
1D724000
heap
page read and write
298A7000
heap
page read and write
2FA30000
trusted library allocation
page read and write
2E9C000
stack
page read and write
1D71A000
heap
page read and write
29898000
heap
page read and write
1D73E000
heap
page read and write
4B21000
heap
page read and write
14AF000
stack
page read and write
1D720000
heap
page read and write
15B3000
heap
page read and write
B31000
unkown
page execute and write copy
1D728000
heap
page read and write
1D740000
heap
page read and write
1D741000
heap
page read and write
6C89E000
unkown
page read and write
1573000
heap
page read and write
B20000
heap
page read and write
415E000
stack
page read and write
85C000
stack
page read and write
1D724000
heap
page read and write
29895000
heap
page read and write
FEE000
unkown
page execute and read and write
61EB7000
direct allocation
page readonly
1D728000
heap
page read and write
2989E000
heap
page read and write
1D724000
heap
page read and write
1D731000
heap
page read and write
95D000
stack
page read and write
1D70A000
heap
page read and write
4B21000
heap
page read and write
1350000
direct allocation
page read and write
1D719000
heap
page read and write
3C5E000
stack
page read and write
1D71A000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
389E000
stack
page read and write
4B21000
heap
page read and write
298B0000
heap
page read and write
1D70A000
heap
page read and write
155C000
heap
page read and write
4B21000
heap
page read and write
1D71B000
heap
page read and write
1D71D000
heap
page read and write
3C1F000
stack
page read and write
1D724000
heap
page read and write
F15000
unkown
page execute and read and write
61ED4000
direct allocation
page readonly
4B21000
heap
page read and write
D8E000
unkown
page execute and read and write
1D71B000
heap
page read and write
1D70B000
heap
page read and write
1350000
direct allocation
page read and write
335F000
stack
page read and write
4B21000
heap
page read and write
CF5000
unkown
page execute and read and write
3E9F000
stack
page read and write
1D740000
heap
page read and write
1D71B000
heap
page read and write
4B21000
heap
page read and write
4FDC000
stack
page read and write
1D716000
heap
page read and write
C3F000
unkown
page execute and read and write
2FA2F000
stack
page read and write
6C6C1000
unkown
page execute read
102B000
unkown
page execute and write copy
5110000
direct allocation
page execute and read and write
1350000
direct allocation
page read and write
1D70A000
heap
page read and write
155D000
heap
page read and write
C4B000
unkown
page execute and read and write
399F000
stack
page read and write
35DF000
stack
page read and write
2E5F000
stack
page read and write
475F000
stack
page read and write
1D718000
heap
page read and write
1D2BF000
stack
page read and write
4B21000
heap
page read and write
1CF1E000
stack
page read and write
4B21000
heap
page read and write
1547000
heap
page read and write
13A5000
heap
page read and write
2FAD2000
heap
page read and write
4B21000
heap
page read and write
B30000
unkown
page readonly
1D722000
heap
page read and write
1350000
direct allocation
page read and write
461F000
stack
page read and write
6F8F2000
unkown
page readonly
4B21000
heap
page read and write
1D724000
heap
page read and write
4B21000
heap
page read and write
1D721000
heap
page read and write
1566000
heap
page read and write
2F9F000
stack
page read and write
1CEDF000
stack
page read and write
401E000
stack
page read and write
1350000
direct allocation
page read and write
4B21000
heap
page read and write
1512000
heap
page read and write
1D731000
heap
page read and write
1558000
heap
page read and write
4B21000
heap
page read and write
4B1F000
stack
page read and write
1D724000
heap
page read and write
1D727000
heap
page read and write
BE1000
unkown
page execute and read and write
1350000
direct allocation
page read and write
4B21000
heap
page read and write
1D70A000
heap
page read and write
4B21000
heap
page read and write
6C6C0000
unkown
page readonly
1D724000
heap
page read and write
411F000
stack
page read and write
4B21000
heap
page read and write
1D724000
heap
page read and write
13A0000
heap
page read and write
4B21000
heap
page read and write
2FAD8000
heap
page read and write
1D740000
heap
page read and write
3EDE000
stack
page read and write
4B21000
heap
page read and write
136B000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
BB8000
unkown
page execute and read and write
4B30000
heap
page read and write
385F000
stack
page read and write
2383F000
heap
page read and write
5110000
direct allocation
page execute and read and write
1D719000
heap
page read and write
4B21000
heap
page read and write
4B21000
heap
page read and write
14C0000
heap
page read and write
1D731000
heap
page read and write
4B21000
heap
page read and write
1D73F000
heap
page read and write
1D709000
heap
page read and write
1D6F6000
heap
page read and write
1D724000
heap
page read and write
1D731000
heap
page read and write
1D708000
heap
page read and write
321F000
stack
page read and write
102B000
unkown
page execute and read and write
1D05E000
stack
page read and write
61ED0000
direct allocation
page read and write
1D71D000
heap
page read and write
1D731000
heap
page read and write
1D719000
heap
page read and write
375E000
stack
page read and write
2378E000
heap
page read and write
1D740000
heap
page read and write
451E000
stack
page read and write
61ECD000
direct allocation
page readonly
4B21000
heap
page read and write
There are 377 hidden memdumps, click here to show them.