IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BFHJECAAAFHIJKFIJEGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BGCAFHCAKFBFIECAFIIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\CFIEGDAEHIEHIDHJDAAKKEHCAF
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DAFBGHCAKKFCAKEBKJKKFBAFCB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EBKEHJJD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GHIDGDHCGCBAKFHIIIII
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\JDAKJJDBGCAKKFHIJEGHCGHJKJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\JKFHIIEHIEGDHJJJKFIIIIDGID
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KFIDBAFH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll1B
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpXA
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpr
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllZ
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpTA
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlleB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpne
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php&e
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 35 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
182E000
heap
page read and write
 malicious
5590000
direct allocation
page read and write
 malicious
D21000
unkown
page execute and read and write
 malicious
5101000
heap
page read and write
E3E000
unkown
page execute and read and write
5120000
heap
page read and write
29EC1000
heap
page read and write
1DCD9000
heap
page read and write
4E6F000
stack
page read and write
1DD00000
heap
page read and write
5101000
heap
page read and write
5710000
direct allocation
page execute and read and write
50F0000
direct allocation
page read and write
61ED3000
direct allocation
page read and write
382E000
stack
page read and write
1DCF3000
heap
page read and write
190D000
heap
page read and write
1DCE0000
heap
page read and write
1DCE1000
heap
page read and write
1DD00000
heap
page read and write
4AEE000
stack
page read and write
1DCC9000
heap
page read and write
1DCCA000
heap
page read and write
5101000
heap
page read and write
5200000
trusted library allocation
page read and write
5101000
heap
page read and write
1DD00000
heap
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
1DCDA000
heap
page read and write
5101000
heap
page read and write
50F0000
direct allocation
page read and write
5101000
heap
page read and write
1DCE4000
heap
page read and write
61ED0000
direct allocation
page read and write
23D7B000
heap
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
6C6F1000
unkown
page execute read
5101000
heap
page read and write
5101000
heap
page read and write
6C6CD000
unkown
page readonly
29E62000
heap
page read and write
DAF000
unkown
page execute and read and write
1DCE4000
heap
page read and write
6C651000
unkown
page execute read
5101000
heap
page read and write
50F0000
direct allocation
page read and write
6C6E2000
unkown
page readonly
CA0000
heap
page read and write
3AAE000
stack
page read and write
1DCE9000
heap
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
1DD00000
heap
page read and write
3CEF000
stack
page read and write
1DCE4000
heap
page read and write
40EE000
stack
page read and write
300A2000
heap
page read and write
5101000
heap
page read and write
1DCDC000
heap
page read and write
5710000
direct allocation
page execute and read and write
5101000
heap
page read and write
356F000
stack
page read and write
1DCE3000
heap
page read and write
1D51E000
stack
page read and write
23EBF000
heap
page read and write
46EF000
stack
page read and write
121E000
unkown
page execute and read and write
5101000
heap
page read and write
E3B000
unkown
page execute and read and write
1DCD8000
heap
page read and write
5101000
heap
page read and write
1885000
heap
page read and write
121E000
unkown
page execute and write copy
50F0000
direct allocation
page read and write
1DCDD000
heap
page read and write
32C0000
heap
page read and write
5101000
heap
page read and write
1DCD9000
heap
page read and write
13BE000
unkown
page execute and write copy
E0F000
unkown
page execute and read and write
300AA000
heap
page read and write
50F0000
direct allocation
page read and write
1DCDB000
heap
page read and write
50F0000
direct allocation
page read and write
1DCD6000
heap
page read and write
422E000
stack
page read and write
DDD000
unkown
page execute and read and write
50F0000
direct allocation
page read and write
5101000
heap
page read and write
1DCF2000
heap
page read and write
1DCD4000
heap
page read and write
5590000
direct allocation
page read and write
1D61F000
stack
page read and write
50F0000
direct allocation
page read and write
1DCE4000
heap
page read and write
4C2E000
stack
page read and write
472D000
stack
page read and write
3E6E000
stack
page read and write
300A1000
heap
page read and write
1DB4D000
stack
page read and write
1DCE9000
heap
page read and write
1DCDE000
heap
page read and write
E02000
unkown
page execute and read and write
45EE000
stack
page read and write
1A1F000
stack
page read and write
5101000
heap
page read and write
56F0000
direct allocation
page execute and read and write
1DCD9000
heap
page read and write
1DCDA000
heap
page read and write
5101000
heap
page read and write
3D2E000
stack
page read and write
1DCFF000
heap
page read and write
29E61000
heap
page read and write
1DCCA000
heap
page read and write
1DD00000
heap
page read and write
1DCCF000
heap
page read and write
44AE000
stack
page read and write
1DCCA000
heap
page read and write
1DA4E000
stack
page read and write
18D6000
heap
page read and write
5101000
heap
page read and write
1DD00000
heap
page read and write
1DCDC000
heap
page read and write
16F2000
stack
page read and write
29E81000
heap
page read and write
5720000
direct allocation
page execute and read and write
1DCDC000
heap
page read and write
11DD000
unkown
page execute and read and write
332E000
stack
page read and write
DA5000
unkown
page execute and read and write
1DCDA000
heap
page read and write
1107000
unkown
page execute and read and write
1873000
heap
page read and write
5101000
heap
page read and write
4D2F000
stack
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
41EF000
stack
page read and write
1DCB0000
heap
page read and write
5100000
heap
page read and write
18BB000
heap
page read and write
300A7000
heap
page read and write
D20000
unkown
page read and write
D20000
unkown
page readonly
4FEE000
stack
page read and write
61EB7000
direct allocation
page readonly
D21000
unkown
page execute and write copy
1DCD8000
heap
page read and write
1D75E000
stack
page read and write
30000000
trusted library allocation
page read and write
1DCC9000
heap
page read and write
29E64000
heap
page read and write
6C8D0000
unkown
page read and write
1DCE7000
heap
page read and write
6C6F0000
unkown
page readonly
432F000
stack
page read and write
1DCE0000
heap
page read and write
5101000
heap
page read and write
496F000
stack
page read and write
1DCD9000
heap
page read and write
5101000
heap
page read and write
1D90E000
stack
page read and write
13F0000
heap
page read and write
2FEFE000
stack
page read and write
29E7E000
heap
page read and write
EE5000
unkown
page execute and read and write
5730000
direct allocation
page execute and read and write
1DCE4000
heap
page read and write
40AF000
stack
page read and write
1DCD9000
heap
page read and write
5101000
heap
page read and write
1D8BF000
stack
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
50F0000
direct allocation
page read and write
181D000
stack
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
18BE000
heap
page read and write
1DCCA000
heap
page read and write
1DCD8000
heap
page read and write
5101000
heap
page read and write
1DCD9000
heap
page read and write
1DCE0000
heap
page read and write
17D5000
heap
page read and write
486E000
stack
page read and write
50F0000
direct allocation
page read and write
5101000
heap
page read and write
121F000
unkown
page execute and write copy
5101000
heap
page read and write
5101000
heap
page read and write
D7A000
unkown
page execute and read and write
1DE10000
trusted library allocation
page read and write
5101000
heap
page read and write
1210000
unkown
page execute and read and write
1DBAE000
stack
page read and write
F7E000
unkown
page execute and read and write
6C6DE000
unkown
page read and write
446F000
stack
page read and write
29EC4000
heap
page read and write
18C8000
heap
page read and write
1DCDD000
heap
page read and write
5740000
direct allocation
page execute and read and write
6C8CE000
unkown
page read and write
1DCB6000
heap
page read and write
1820000
heap
page read and write
1DCE7000
heap
page read and write
4BEF000
stack
page read and write
1DCD6000
heap
page read and write
5110000
heap
page read and write
5101000
heap
page read and write
1DCDD000
heap
page read and write
1DCD9000
heap
page read and write
29E20000
heap
page read and write
1DCEE000
heap
page read and write
5101000
heap
page read and write
E2F000
unkown
page execute and read and write
32EB000
heap
page read and write
436E000
stack
page read and write
3BEE000
stack
page read and write
1DCDD000
heap
page read and write
1DCBF000
heap
page read and write
571E000
stack
page read and write
16FD000
stack
page read and write
5101000
heap
page read and write
17D0000
heap
page read and write
5101000
heap
page read and write
1DD00000
heap
page read and write
6C650000
unkown
page readonly
5101000
heap
page read and write
1DCE4000
heap
page read and write
4AAF000
stack
page read and write
1DCE4000
heap
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
50F0000
direct allocation
page read and write
1DCDE000
heap
page read and write
18A3000
heap
page read and write
1DCCA000
heap
page read and write
1DCEE000
heap
page read and write
DD1000
unkown
page execute and read and write
1D7BE000
stack
page read and write
29E78000
heap
page read and write
61ECD000
direct allocation
page readonly
50F0000
direct allocation
page read and write
2FFFF000
stack
page read and write
18CF000
heap
page read and write
55CC000
stack
page read and write
C4C000
stack
page read and write
1DCD8000
heap
page read and write
5101000
heap
page read and write
61EB4000
direct allocation
page read and write
1DCDC000
heap
page read and write
1DCD6000
heap
page read and write
50F0000
direct allocation
page read and write
1DCE4000
heap
page read and write
29EA1000
heap
page read and write
45AF000
stack
page read and write
50F0000
direct allocation
page read and write
18C3000
heap
page read and write
1DCE2000
heap
page read and write
396E000
stack
page read and write
482F000
stack
page read and write
16F8000
stack
page read and write
3FAE000
stack
page read and write
4D6E000
stack
page read and write
1DCDA000
heap
page read and write
3BAF000
stack
page read and write
5101000
heap
page read and write
1DCD8000
heap
page read and write
5101000
heap
page read and write
1DCCA000
heap
page read and write
3F6F000
stack
page read and write
1DD00000
heap
page read and write
DB2000
unkown
page execute and read and write
1DCDD000
heap
page read and write
1D4DF000
stack
page read and write
61E01000
direct allocation
page execute read
5101000
heap
page read and write
5700000
direct allocation
page execute and read and write
5101000
heap
page read and write
18D5000
heap
page read and write
346C000
stack
page read and write
32E7000
heap
page read and write
EC5000
unkown
page execute and read and write
6C88F000
unkown
page readonly
5114000
heap
page read and write
1DCDE000
heap
page read and write
61ED4000
direct allocation
page readonly
35AE000
stack
page read and write
18F6000
heap
page read and write
32EE000
heap
page read and write
5101000
heap
page read and write
1DCCA000
heap
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
3A6F000
stack
page read and write
5590000
direct allocation
page read and write
DA8000
unkown
page execute and read and write
1DCE4000
heap
page read and write
EEB000
unkown
page execute and read and write
3E2F000
stack
page read and write
1DCD8000
heap
page read and write
1DCE2000
heap
page read and write
5101000
heap
page read and write
1DCD9000
heap
page read and write
37EF000
stack
page read and write
5101000
heap
page read and write
1DE10000
heap
page read and write
5101000
heap
page read and write
36AF000
stack
page read and write
342F000
stack
page read and write
61ECC000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
29E40000
heap
page read and write
1DCD8000
heap
page read and write
1DCE4000
heap
page read and write
6C8D5000
unkown
page readonly
1DCAD000
stack
page read and write
29E6C000
heap
page read and write
1DCDD000
heap
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
1DD00000
heap
page read and write
1DCC9000
heap
page read and write
CB0000
heap
page read and write
13BD000
unkown
page execute and read and write
4EAE000
stack
page read and write
1DCDD000
heap
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
1DCDC000
heap
page read and write
392F000
stack
page read and write
1DCDD000
heap
page read and write
36EE000
stack
page read and write
29E75000
heap
page read and write
D1E000
stack
page read and write
56E0000
direct allocation
page execute and read and write
1DD00000
heap
page read and write
1B1E000
stack
page read and write
1202000
unkown
page execute and read and write
5101000
heap
page read and write
1DA0C000
stack
page read and write
5101000
heap
page read and write
4FAF000
stack
page read and write
29E66000
heap
page read and write
56CF000
stack
page read and write
1DCB4000
heap
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
182A000
heap
page read and write
30099000
heap
page read and write
50EF000
stack
page read and write
23E10000
heap
page read and write
1D65E000
stack
page read and write
1DD00000
heap
page read and write
5101000
heap
page read and write
6C8CF000
unkown
page write copy
1DCCA000
heap
page read and write
49AE000
stack
page read and write
5101000
heap
page read and write
32E0000
heap
page read and write
5101000
heap
page read and write
5101000
heap
page read and write
There are 357 hidden memdumps, click here to show them.