IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFBAKKFCBFHIIEBGIDBG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BGDHDAFIDGDBGCAAFIDHIJKEHD
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\CAFBGDHCBAEHIDGCGIDAKFIIEC
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GHCAAAAK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\GHJKEHJEGCFCAKFIIJJJ
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\HJEBGHIEBFIJKECBKFHDHDAKKJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IECGIEBAEBFIIECBGCBG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JEHIJDGIEBKKFHJKJKEGDBAAAE
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\KKECFIEB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlly
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllP
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/TU
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpWf
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllF
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpR
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllb
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php/f
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllQ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllf
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllp
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllT
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 40 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
6C1000
unkown
page execute and read and write
 malicious
5090000
direct allocation
page read and write
 malicious
13CE000
heap
page read and write
 malicious
2F50000
heap
page read and write
3D1E000
stack
page read and write
4C01000
heap
page read and write
381E000
stack
page read and write
495F000
stack
page read and write
1D827000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
1D819000
heap
page read and write
4C01000
heap
page read and write
3E1F000
stack
page read and write
6C651000
unkown
page execute read
6C6E2000
unkown
page readonly
2F30000
heap
page read and write
4C01000
heap
page read and write
1D83F000
heap
page read and write
2FBAD000
heap
page read and write
1462000
heap
page read and write
23880000
heap
page read and write
4C01000
heap
page read and write
36DE000
stack
page read and write
6C650000
unkown
page readonly
1D831000
heap
page read and write
2F40000
direct allocation
page read and write
1459000
heap
page read and write
4C01000
heap
page read and write
309E000
stack
page read and write
1D81B000
heap
page read and write
1D83B000
heap
page read and write
481F000
stack
page read and write
1D828000
heap
page read and write
3F9E000
stack
page read and write
61ED4000
direct allocation
page readonly
29976000
heap
page read and write
2F40000
direct allocation
page read and write
4C01000
heap
page read and write
1D840000
heap
page read and write
50CC000
stack
page read and write
4C01000
heap
page read and write
6C8D0000
unkown
page read and write
1D01E000
stack
page read and write
1D840000
heap
page read and write
1D820000
heap
page read and write
1D824000
heap
page read and write
2FBBC000
heap
page read and write
1150000
heap
page read and write
5220000
direct allocation
page execute and read and write
32DF000
stack
page read and write
4C20000
heap
page read and write
1D827000
heap
page read and write
2F5E000
heap
page read and write
1D7F0000
heap
page read and write
1D25F000
stack
page read and write
5230000
direct allocation
page execute and read and write
305F000
stack
page read and write
10FD000
stack
page read and write
12B5000
heap
page read and write
745000
unkown
page execute and read and write
61EB4000
direct allocation
page read and write
31DE000
stack
page read and write
4C01000
heap
page read and write
2FBB3000
heap
page read and write
4C01000
heap
page read and write
5090000
direct allocation
page read and write
13C0000
heap
page read and write
4C01000
heap
page read and write
1D824000
heap
page read and write
2F40000
direct allocation
page read and write
29974000
heap
page read and write
1D83B000
heap
page read and write
1443000
heap
page read and write
61ED3000
direct allocation
page read and write
449E000
stack
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
341F000
stack
page read and write
4C01000
heap
page read and write
2EEF000
stack
page read and write
1D824000
heap
page read and write
13BF000
stack
page read and write
4C01000
heap
page read and write
13CA000
heap
page read and write
421E000
stack
page read and write
1D81A000
heap
page read and write
4C01000
heap
page read and write
3B9F000
stack
page read and write
1D828000
heap
page read and write
345E000
stack
page read and write
1D81D000
heap
page read and write
1D824000
heap
page read and write
6C8CE000
unkown
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
61ED0000
direct allocation
page read and write
1D81B000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
2F40000
direct allocation
page read and write
239C8000
heap
page read and write
71A000
unkown
page execute and read and write
14FD000
stack
page read and write
7AF000
unkown
page execute and read and write
4C01000
heap
page read and write
51CF000
stack
page read and write
1D83E000
heap
page read and write
355F000
stack
page read and write
435E000
stack
page read and write
51E0000
direct allocation
page execute and read and write
1D828000
heap
page read and write
2F40000
direct allocation
page read and write
29985000
heap
page read and write
4C01000
heap
page read and write
299B1000
heap
page read and write
1D828000
heap
page read and write
1D831000
heap
page read and write
BC7000
unkown
page execute and write copy
1D83C000
heap
page read and write
2F2B000
stack
page read and write
391F000
stack
page read and write
3A5F000
stack
page read and write
1D841000
heap
page read and write
1D80A000
heap
page read and write
6C6F0000
unkown
page readonly
2FBA5000
heap
page read and write
129D000
stack
page read and write
2DEE000
stack
page read and write
4C01000
heap
page read and write
61E01000
direct allocation
page execute read
77D000
unkown
page execute and read and write
1D841000
heap
page read and write
1D7F6000
heap
page read and write
1D80A000
heap
page read and write
4C01000
heap
page read and write
2F40000
direct allocation
page read and write
1D15E000
stack
page read and write
1D824000
heap
page read and write
445F000
stack
page read and write
409F000
stack
page read and write
3BDE000
stack
page read and write
29988000
heap
page read and write
5040000
trusted library allocation
page read and write
4C01000
heap
page read and write
45DE000
stack
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
1D11F000
stack
page read and write
4C10000
heap
page read and write
4C01000
heap
page read and write
7CF000
unkown
page execute and read and write
6C88F000
unkown
page readonly
1D831000
heap
page read and write
4C01000
heap
page read and write
359E000
stack
page read and write
4ADE000
stack
page read and write
1D910000
trusted library allocation
page read and write
1D809000
heap
page read and write
6C8CF000
unkown
page write copy
4C01000
heap
page read and write
4C01000
heap
page read and write
2F40000
direct allocation
page read and write
1D816000
heap
page read and write
1D819000
heap
page read and write
6C6CD000
unkown
page readonly
1D80A000
heap
page read and write
4C01000
heap
page read and write
B8A000
unkown
page execute and read and write
1D819000
heap
page read and write
1D81A000
heap
page read and write
4C01000
heap
page read and write
5210000
direct allocation
page execute and read and write
1D819000
heap
page read and write
1D80B000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
1D824000
heap
page read and write
1D819000
heap
page read and write
2FB0F000
stack
page read and write
51F0000
direct allocation
page execute and read and write
1D824000
heap
page read and write
4C01000
heap
page read and write
61ECD000
direct allocation
page readonly
4C01000
heap
page read and write
4C01000
heap
page read and write
BB7000
unkown
page execute and read and write
1D816000
heap
page read and write
1D831000
heap
page read and write
4BDF000
stack
page read and write
4C01000
heap
page read and write
1D81D000
heap
page read and write
4C01000
heap
page read and write
91E000
unkown
page execute and read and write
1D824000
heap
page read and write
4C01000
heap
page read and write
1D824000
heap
page read and write
1D831000
heap
page read and write
4C01000
heap
page read and write
1D840000
heap
page read and write
2392C000
heap
page read and write
1D840000
heap
page read and write
1D40D000
stack
page read and write
2F57000
heap
page read and write
1D6ED000
stack
page read and write
1D841000
heap
page read and write
1412000
heap
page read and write
D6B000
unkown
page execute and read and write
1D831000
heap
page read and write
2F40000
direct allocation
page read and write
485E000
stack
page read and write
3F5F000
stack
page read and write
61E00000
direct allocation
page execute and read and write
1D820000
heap
page read and write
1D805000
heap
page read and write
10F3000
stack
page read and write
14B2000
heap
page read and write
1D2BE000
stack
page read and write
37DF000
stack
page read and write
459F000
stack
page read and write
1CFDF000
stack
page read and write
4C01000
heap
page read and write
1D7FF000
heap
page read and write
7DE000
unkown
page execute and read and write
1D828000
heap
page read and write
1D831000
heap
page read and write
1D822000
heap
page read and write
1D816000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
1D824000
heap
page read and write
885000
unkown
page execute and read and write
431F000
stack
page read and write
6C6F1000
unkown
page execute read
1D824000
heap
page read and write
12B0000
heap
page read and write
1D824000
heap
page read and write
319F000
stack
page read and write
1D819000
heap
page read and write
1474000
heap
page read and write
61EB7000
direct allocation
page readonly
46DF000
stack
page read and write
2F5B000
heap
page read and write
1D840000
heap
page read and write
2F40000
direct allocation
page read and write
6C6DE000
unkown
page read and write
1D840000
heap
page read and write
5200000
direct allocation
page execute and read and write
5240000
direct allocation
page execute and read and write
6C8D5000
unkown
page readonly
2997C000
heap
page read and write
4A9F000
stack
page read and write
1D824000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
1D81A000
heap
page read and write
4C00000
heap
page read and write
1D819000
heap
page read and write
41DF000
stack
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
10F9000
stack
page read and write
1D831000
heap
page read and write
7DB000
unkown
page execute and read and write
4BE0000
heap
page read and write
1D818000
heap
page read and write
15FE000
stack
page read and write
6C0000
unkown
page read and write
2FB10000
trusted library allocation
page read and write
3E5E000
stack
page read and write
1426000
heap
page read and write
395E000
stack
page read and write
1467000
heap
page read and write
140D000
heap
page read and write
2FA0E000
stack
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
40DE000
stack
page read and write
7A2000
unkown
page execute and read and write
369F000
stack
page read and write
4C01000
heap
page read and write
748000
unkown
page execute and read and write
1D80A000
heap
page read and write
BC6000
unkown
page execute and write copy
4C01000
heap
page read and write
771000
unkown
page execute and read and write
4C01000
heap
page read and write
1D822000
heap
page read and write
1D3BF000
stack
page read and write
1D824000
heap
page read and write
147A000
heap
page read and write
1D827000
heap
page read and write
1D819000
heap
page read and write
2998E000
heap
page read and write
6C1000
unkown
page execute and write copy
1D80A000
heap
page read and write
5090000
direct allocation
page read and write
4C01000
heap
page read and write
1D824000
heap
page read and write
752000
unkown
page execute and read and write
BC6000
unkown
page execute and read and write
1D820000
heap
page read and write
1D83F000
heap
page read and write
DFC000
stack
page read and write
4C01000
heap
page read and write
1D54D000
stack
page read and write
1D81A000
heap
page read and write
2F40000
direct allocation
page read and write
1D82C000
heap
page read and write
521E000
stack
page read and write
1D821000
heap
page read and write
1D824000
heap
page read and write
3CDF000
stack
page read and write
1D824000
heap
page read and write
1D824000
heap
page read and write
1D64C000
stack
page read and write
1D828000
heap
page read and write
3A9E000
stack
page read and write
1D824000
heap
page read and write
2F40000
direct allocation
page read and write
AA8000
unkown
page execute and read and write
471E000
stack
page read and write
4C01000
heap
page read and write
74F000
unkown
page execute and read and write
4C01000
heap
page read and write
1D819000
heap
page read and write
1D821000
heap
page read and write
1D82C000
heap
page read and write
1D831000
heap
page read and write
1D831000
heap
page read and write
BAF000
unkown
page execute and read and write
2F40000
direct allocation
page read and write
1D831000
heap
page read and write
1D840000
heap
page read and write
1D81B000
heap
page read and write
1D840000
heap
page read and write
29991000
heap
page read and write
1D809000
heap
page read and write
4C01000
heap
page read and write
1D824000
heap
page read and write
5210000
direct allocation
page execute and read and write
1D808000
heap
page read and write
1230000
heap
page read and write
29971000
heap
page read and write
1D828000
heap
page read and write
4C01000
heap
page read and write
88B000
unkown
page execute and read and write
4C01000
heap
page read and write
D6C000
unkown
page execute and write copy
6C0000
unkown
page readonly
4C01000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
4C01000
heap
page read and write
2F40000
direct allocation
page read and write
1D840000
heap
page read and write
61ECC000
direct allocation
page read and write
4C01000
heap
page read and write
146D000
heap
page read and write
1D7ED000
stack
page read and write
4C01000
heap
page read and write
29930000
heap
page read and write
299D1000
heap
page read and write
1D824000
heap
page read and write
1D81D000
heap
page read and write
1D819000
heap
page read and write
1D824000
heap
page read and write
499E000
stack
page read and write
4C01000
heap
page read and write
1D824000
heap
page read and write
331E000
stack
page read and write
1D80A000
heap
page read and write
4C01000
heap
page read and write
29950000
heap
page read and write
1D50D000
stack
page read and write
29972000
heap
page read and write
2F40000
direct allocation
page read and write
1D82B000
heap
page read and write
1D840000
heap
page read and write
2FBB4000
heap
page read and write
865000
unkown
page execute and read and write
1D91E000
heap
page read and write
There are 372 hidden memdumps, click here to show them.