IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAKJEGCF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\BKFBAECBAEGDGDHIEHIJ
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\CAAAFCAKKKFBFIDGDBFHJJEHID
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\FCGIJKJJKEBGHJKFIDGCAAFCAF
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\FIJJKECFCFBGDHIECAAFIIDAKK
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GCBGCGHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GCBKECAKFBGCAKECGIEHDGHCBA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HJDBAFIECGHCBFIDGDAA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HJJECBKKECFIEBGCAKJK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllt
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllH
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpq
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpHAR)
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37R
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpb
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dlll
unknown
 malicious
http://185.215.113.37/s
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php5.c
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpN
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpR
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpE
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php6
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dlld
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 42 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4FC0000
direct allocation
page read and write
 malicious
5E1000
unkown
page execute and read and write
 malicious
13EE000
heap
page read and write
 malicious
61E00000
direct allocation
page execute and read and write
1D6F6000
heap
page read and write
12D5000
heap
page read and write
1433000
heap
page read and write
133E000
heap
page read and write
1D5D2000
heap
page read and write
2366C000
heap
page read and write
2FBE000
stack
page read and write
1D60E000
heap
page read and write
ADB000
unkown
page execute and read and write
4B31000
heap
page read and write
6C6F1000
unkown
page execute read
1D5D0000
heap
page read and write
383F000
stack
page read and write
1D5E6000
heap
page read and write
29771000
heap
page read and write
1CF3E000
stack
page read and write
1D5F7000
heap
page read and write
1D5F4000
heap
page read and write
1D613000
heap
page read and write
3EBE000
stack
page read and write
2977F000
heap
page read and write
1D5FB000
heap
page read and write
1330000
heap
page read and write
4B40000
heap
page read and write
7A5000
unkown
page execute and read and write
1D5F4000
heap
page read and write
61ED4000
direct allocation
page readonly
4B31000
heap
page read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
1D32D000
stack
page read and write
2F859000
heap
page read and write
1D600000
heap
page read and write
4B31000
heap
page read and write
2F86E000
heap
page read and write
4B31000
heap
page read and write
1D60E000
heap
page read and write
1D5F2000
heap
page read and write
1D5F5000
heap
page read and write
297CB000
heap
page read and write
2F7C0000
trusted library allocation
page read and write
4B31000
heap
page read and write
1D46E000
stack
page read and write
AD2000
unkown
page execute and read and write
1D5FC000
heap
page read and write
5140000
direct allocation
page execute and read and write
4B31000
heap
page read and write
5E0000
unkown
page read and write
29783000
heap
page read and write
10F8000
stack
page read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
668000
unkown
page execute and read and write
1D61C000
heap
page read and write
6C651000
unkown
page execute read
4B31000
heap
page read and write
1D61C000
heap
page read and write
39BE000
stack
page read and write
1D60E000
heap
page read and write
1D5FF000
heap
page read and write
1CEFF000
stack
page read and write
1D5FB000
heap
page read and write
4B20000
direct allocation
page read and write
4B20000
direct allocation
page read and write
4B31000
heap
page read and write
1D2DF000
stack
page read and write
1D5FF000
heap
page read and write
10F2000
stack
page read and write
1D606000
heap
page read and write
4B31000
heap
page read and write
45FF000
stack
page read and write
323E000
stack
page read and write
1D5F6000
heap
page read and write
1D61C000
heap
page read and write
1D600000
heap
page read and write
6C650000
unkown
page readonly
672000
unkown
page execute and read and write
4B31000
heap
page read and write
13E0000
heap
page read and write
4B31000
heap
page read and write
5E0000
unkown
page readonly
1D5FF000
heap
page read and write
14DA000
heap
page read and write
5110000
direct allocation
page execute and read and write
4B31000
heap
page read and write
5150000
direct allocation
page execute and read and write
4B31000
heap
page read and write
1D5F4000
heap
page read and write
3ABF000
stack
page read and write
4FFC000
stack
page read and write
1D5FF000
heap
page read and write
1465000
heap
page read and write
31FF000
stack
page read and write
4B20000
direct allocation
page read and write
473F000
stack
page read and write
2D7E000
stack
page read and write
49FE000
stack
page read and write
1449000
heap
page read and write
3D3F000
stack
page read and write
34BE000
stack
page read and write
44BF000
stack
page read and write
4B31000
heap
page read and write
30FE000
stack
page read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
61ED0000
direct allocation
page read and write
4B20000
direct allocation
page read and write
5140000
direct allocation
page execute and read and write
1D5F5000
heap
page read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
1D61C000
heap
page read and write
691000
unkown
page execute and read and write
1337000
heap
page read and write
237B8000
heap
page read and write
1D613000
heap
page read and write
4B31000
heap
page read and write
13EA000
heap
page read and write
48BE000
stack
page read and write
3FBF000
stack
page read and write
6C6CD000
unkown
page readonly
6EF000
unkown
page execute and read and write
2976E000
heap
page read and write
1D6F0000
trusted library allocation
page read and write
1D610000
heap
page read and write
12D0000
heap
page read and write
6C8D5000
unkown
page readonly
1D5FE000
heap
page read and write
1D600000
heap
page read and write
1D5E5000
heap
page read and write
1428000
heap
page read and write
1D5FB000
heap
page read and write
6C6DE000
unkown
page read and write
7AB000
unkown
page execute and read and write
12CE000
stack
page read and write
4B31000
heap
page read and write
1D61C000
heap
page read and write
1D5F4000
heap
page read and write
6C6E2000
unkown
page readonly
3FFE000
stack
page read and write
4B31000
heap
page read and write
1D61C000
heap
page read and write
1D60E000
heap
page read and write
4B31000
heap
page read and write
6CF000
unkown
page execute and read and write
4B20000
direct allocation
page read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
3D7E000
stack
page read and write
6FB000
unkown
page execute and read and write
1D60E000
heap
page read and write
1D5F0000
heap
page read and write
4B31000
heap
page read and write
1D5F7000
heap
page read and write
AEA000
unkown
page execute and write copy
4B31000
heap
page read and write
1D5FF000
heap
page read and write
4AFF000
stack
page read and write
1D56D000
stack
page read and write
4B31000
heap
page read and write
2F7F000
stack
page read and write
14A9000
heap
page read and write
147F000
heap
page read and write
1D5FA000
heap
page read and write
61EB7000
direct allocation
page readonly
132E000
stack
page read and write
35BF000
stack
page read and write
61EB4000
direct allocation
page read and write
1D600000
heap
page read and write
423F000
stack
page read and write
427E000
stack
page read and write
AE9000
unkown
page execute and write copy
514E000
stack
page read and write
4FC0000
direct allocation
page read and write
4B20000
direct allocation
page read and write
50FF000
stack
page read and write
4B31000
heap
page read and write
6C2000
unkown
page execute and read and write
C90000
unkown
page execute and write copy
4B31000
heap
page read and write
D90000
heap
page read and write
4B31000
heap
page read and write
1D60E000
heap
page read and write
1D605000
heap
page read and write
1D5E5000
heap
page read and write
1D5FF000
heap
page read and write
1D5FF000
heap
page read and write
1D5F2000
heap
page read and write
4B31000
heap
page read and write
1D605000
heap
page read and write
4B20000
direct allocation
page read and write
1D5F8000
heap
page read and write
1497000
heap
page read and write
29761000
heap
page read and write
2F866000
heap
page read and write
1D5FF000
heap
page read and write
2F861000
heap
page read and write
3BFF000
stack
page read and write
66F000
unkown
page execute and read and write
4B20000
direct allocation
page read and write
1D5F5000
heap
page read and write
1D5E4000
heap
page read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
1D60E000
heap
page read and write
30BF000
stack
page read and write
43BE000
stack
page read and write
1492000
heap
page read and write
6C8CF000
unkown
page write copy
1D42C000
stack
page read and write
4FC0000
direct allocation
page read and write
1D5F4000
heap
page read and write
149C000
heap
page read and write
4B31000
heap
page read and write
2F867000
heap
page read and write
40FF000
stack
page read and write
4B31000
heap
page read and write
387E000
stack
page read and write
14A4000
heap
page read and write
785000
unkown
page execute and read and write
1D5FF000
heap
page read and write
4B31000
heap
page read and write
463E000
stack
page read and write
333F000
stack
page read and write
4B31000
heap
page read and write
1D61C000
heap
page read and write
4B20000
direct allocation
page read and write
4B31000
heap
page read and write
477E000
stack
page read and write
4B20000
direct allocation
page read and write
2976C000
heap
page read and write
49BF000
stack
page read and write
4B31000
heap
page read and write
6C88F000
unkown
page readonly
9C8000
unkown
page execute and read and write
665000
unkown
page execute and read and write
61ECD000
direct allocation
page readonly
1D5F5000
heap
page read and write
1D5E2000
heap
page read and write
4B20000
direct allocation
page read and write
63A000
unkown
page execute and read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
29788000
heap
page read and write
1D600000
heap
page read and write
1D600000
heap
page read and write
6FE000
unkown
page execute and read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
4B30000
heap
page read and write
1D61C000
heap
page read and write
413E000
stack
page read and write
1D60E000
heap
page read and write
1D61B000
heap
page read and write
3AFE000
stack
page read and write
133B000
heap
page read and write
DFE000
stack
page read and write
1D5F7000
heap
page read and write
36FF000
stack
page read and write
69D000
unkown
page execute and read and write
3C3E000
stack
page read and write
44FE000
stack
page read and write
35FE000
stack
page read and write
4B20000
direct allocation
page read and write
AE9000
unkown
page execute and read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
10FD000
stack
page read and write
4B31000
heap
page read and write
1D5FF000
heap
page read and write
61E01000
direct allocation
page execute read
1D5F2000
heap
page read and write
4C30000
trusted library allocation
page read and write
1D17F000
stack
page read and write
4B31000
heap
page read and write
1D03F000
stack
page read and write
4B31000
heap
page read and write
1D5FF000
heap
page read and write
1D5DB000
heap
page read and write
4B31000
heap
page read and write
1D5EB000
heap
page read and write
1D60E000
heap
page read and write
4B31000
heap
page read and write
138E000
stack
page read and write
1D61C000
heap
page read and write
347F000
stack
page read and write
D80000
heap
page read and write
61ECC000
direct allocation
page read and write
AAD000
unkown
page execute and read and write
2370E000
heap
page read and write
4B31000
heap
page read and write
4B20000
direct allocation
page read and write
1D5E6000
heap
page read and write
6C6F0000
unkown
page readonly
83E000
unkown
page execute and read and write
1D5FA000
heap
page read and write
4B31000
heap
page read and write
1D5FF000
heap
page read and write
13D0000
heap
page read and write
4B31000
heap
page read and write
29777000
heap
page read and write
1D60D000
heap
page read and write
373E000
stack
page read and write
4B00000
heap
page read and write
4B31000
heap
page read and write
1D600000
heap
page read and write
4B31000
heap
page read and write
1D5F4000
heap
page read and write
337E000
stack
page read and write
4B31000
heap
page read and write
5130000
direct allocation
page execute and read and write
1D07E000
stack
page read and write
487F000
stack
page read and write
4B31000
heap
page read and write
C8F000
unkown
page execute and read and write
4B31000
heap
page read and write
1D601000
heap
page read and write
437F000
stack
page read and write
6C8D0000
unkown
page read and write
1D5FB000
heap
page read and write
13CC000
stack
page read and write
3E7F000
stack
page read and write
D2C000
stack
page read and write
4B31000
heap
page read and write
5E1000
unkown
page execute and write copy
6C8CE000
unkown
page read and write
1D61C000
heap
page read and write
4B31000
heap
page read and write
4B50000
heap
page read and write
1D616000
heap
page read and write
5160000
direct allocation
page execute and read and write
4B31000
heap
page read and write
61ED3000
direct allocation
page read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
4B31000
heap
page read and write
2E7F000
stack
page read and write
29740000
heap
page read and write
1D602000
heap
page read and write
4B20000
direct allocation
page read and write
5120000
direct allocation
page execute and read and write
1D1DE000
stack
page read and write
29720000
heap
page read and write
4B31000
heap
page read and write
397F000
stack
page read and write
There are 340 hidden memdumps, click here to show them.