IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKJKFBAFIDAEBFHJKJEBFCBFHD
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DBGIJEHI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\ECAFHIIJJECGDHIEGDAK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HDBGHDHC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HIEBAKEHDHCAKEBFBKEGCGIEBF
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IDHJEBGIEBFIJKEBFBFH
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\JKJDHDBKEBGHJJJJKEHDHJJEGH
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\KFIJJJEBGCFBGDHIDGCAEGDAAF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KJKJJJECFIEBFHIEGHJD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.374
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllA
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpm
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllX
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpt
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpy
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpK
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpY
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpmo
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dlln
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwindow-state.json?
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpfW
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php)
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 40 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
51C0000
direct allocation
page read and write
 malicious
162E000
heap
page read and write
 malicious
5E1000
unkown
page execute and read and write
 malicious
1D949000
heap
page read and write
4D41000
heap
page read and write
1D946000
heap
page read and write
4AFE000
stack
page read and write
6C88F000
unkown
page readonly
4D41000
heap
page read and write
14B4000
heap
page read and write
1D94D000
heap
page read and write
1D970000
heap
page read and write
1D958000
heap
page read and write
1D958000
heap
page read and write
1D96B000
heap
page read and write
1D949000
heap
page read and write
1490000
direct allocation
page read and write
2FB3E000
stack
page read and write
1490000
direct allocation
page read and write
1D92F000
heap
page read and write
1D949000
heap
page read and write
2FCEA000
heap
page read and write
14B4000
heap
page read and write
1D954000
heap
page read and write
4D41000
heap
page read and write
29AA3000
heap
page read and write
31FE000
stack
page read and write
1D952000
heap
page read and write
29AC0000
heap
page read and write
14B4000
heap
page read and write
61EB4000
direct allocation
page read and write
4D41000
heap
page read and write
1D96F000
heap
page read and write
140E000
stack
page read and write
1D93A000
heap
page read and write
1D954000
heap
page read and write
40FE000
stack
page read and write
1D94D000
heap
page read and write
1490000
direct allocation
page read and write
4D41000
heap
page read and write
14B4000
heap
page read and write
15BE000
stack
page read and write
4D41000
heap
page read and write
1D16E000
stack
page read and write
4D41000
heap
page read and write
3A7F000
stack
page read and write
4D41000
heap
page read and write
6FE000
unkown
page execute and read and write
F90000
heap
page read and write
1D94A000
heap
page read and write
1D948000
heap
page read and write
4D41000
heap
page read and write
1D954000
heap
page read and write
14B4000
heap
page read and write
6C8CE000
unkown
page read and write
4D41000
heap
page read and write
1D958000
heap
page read and write
6EF000
unkown
page execute and read and write
433F000
stack
page read and write
1D950000
heap
page read and write
36FE000
stack
page read and write
14B4000
heap
page read and write
1D938000
heap
page read and write
14B4000
heap
page read and write
4D41000
heap
page read and write
6C6F0000
unkown
page readonly
672000
unkown
page execute and read and write
30BF000
stack
page read and write
4D41000
heap
page read and write
668000
unkown
page execute and read and write
1D954000
heap
page read and write
1490000
direct allocation
page read and write
1D961000
heap
page read and write
181E000
stack
page read and write
1487000
heap
page read and write
3E3F000
stack
page read and write
1D954000
heap
page read and write
4D41000
heap
page read and write
1D63C000
stack
page read and write
4D41000
heap
page read and write
14B4000
heap
page read and write
1D949000
heap
page read and write
14B4000
heap
page read and write
166F000
heap
page read and write
1D954000
heap
page read and write
1D02E000
stack
page read and write
1D954000
heap
page read and write
1D957000
heap
page read and write
6C8D5000
unkown
page readonly
1D946000
heap
page read and write
66F000
unkown
page execute and read and write
1D91D000
stack
page read and write
1D954000
heap
page read and write
1D954000
heap
page read and write
14B4000
heap
page read and write
5E0000
unkown
page readonly
1D94D000
heap
page read and write
4D41000
heap
page read and write
1D954000
heap
page read and write
333E000
stack
page read and write
14B4000
heap
page read and write
343F000
stack
page read and write
14B4000
heap
page read and write
14B4000
heap
page read and write
1610000
direct allocation
page execute and read and write
29AAE000
heap
page read and write
4D41000
heap
page read and write
4D41000
heap
page read and write
AD4000
unkown
page execute and read and write
41FF000
stack
page read and write
1D961000
heap
page read and write
1490000
direct allocation
page read and write
4D41000
heap
page read and write
1D961000
heap
page read and write
61ED4000
direct allocation
page readonly
383E000
stack
page read and write
1490000
direct allocation
page read and write
1D951000
heap
page read and write
1490000
direct allocation
page read and write
4D41000
heap
page read and write
4D41000
heap
page read and write
665000
unkown
page execute and read and write
29AA5000
heap
page read and write
35BE000
stack
page read and write
14B4000
heap
page read and write
4D41000
heap
page read and write
1D954000
heap
page read and write
5310000
direct allocation
page execute and read and write
4D41000
heap
page read and write
4D41000
heap
page read and write
69D000
unkown
page execute and read and write
15FB000
stack
page read and write
29AA8000
heap
page read and write
1D954000
heap
page read and write
3E7E000
stack
page read and write
397E000
stack
page read and write
F2C000
stack
page read and write
2FCE4000
heap
page read and write
4D41000
heap
page read and write
1D954000
heap
page read and write
4D41000
heap
page read and write
4D41000
heap
page read and write
3D3E000
stack
page read and write
29B04000
heap
page read and write
29AA0000
heap
page read and write
14B4000
heap
page read and write
447F000
stack
page read and write
1D67E000
stack
page read and write
347E000
stack
page read and write
F80000
heap
page read and write
6C6E2000
unkown
page readonly
691000
unkown
page execute and read and write
4D41000
heap
page read and write
1D970000
heap
page read and write
6C650000
unkown
page readonly
61ED3000
direct allocation
page read and write
1D951000
heap
page read and write
1D952000
heap
page read and write
14B4000
heap
page read and write
4D41000
heap
page read and write
1600000
direct allocation
page read and write
4D41000
heap
page read and write
1D961000
heap
page read and write
5300000
direct allocation
page execute and read and write
61ECD000
direct allocation
page readonly
23A53000
heap
page read and write
4ABF000
stack
page read and write
1DA40000
trusted library allocation
page read and write
7AB000
unkown
page execute and read and write
9BD000
unkown
page execute and read and write
4D41000
heap
page read and write
14B4000
heap
page read and write
6C6CD000
unkown
page readonly
6C6DE000
unkown
page read and write
1DA41000
heap
page read and write
16F4000
heap
page read and write
4D41000
heap
page read and write
1D94A000
heap
page read and write
5190000
heap
page read and write
1D93A000
heap
page read and write
162A000
heap
page read and write
1715000
heap
page read and write
1D926000
heap
page read and write
148E000
heap
page read and write
1D3AE000
stack
page read and write
473E000
stack
page read and write
1D950000
heap
page read and write
1687000
heap
page read and write
1D958000
heap
page read and write
2FC40000
trusted library allocation
page read and write
4D41000
heap
page read and write
1490000
direct allocation
page read and write
14B4000
heap
page read and write
1D94B000
heap
page read and write
1490000
direct allocation
page read and write
1D94B000
heap
page read and write
1620000
heap
page read and write
1D96B000
heap
page read and write
29A60000
heap
page read and write
1D949000
heap
page read and write
6C2000
unkown
page execute and read and write
6C8D0000
unkown
page read and write
1600000
direct allocation
page read and write
14B4000
heap
page read and write
14B4000
heap
page read and write
51FC000
stack
page read and write
14B4000
heap
page read and write
1490000
direct allocation
page read and write
497F000
stack
page read and write
170A000
heap
page read and write
1D93A000
heap
page read and write
1D949000
heap
page read and write
37FF000
stack
page read and write
61EB7000
direct allocation
page readonly
14B4000
heap
page read and write
29B0D000
heap
page read and write
1D94A000
heap
page read and write
4D41000
heap
page read and write
1D949000
heap
page read and write
5340000
direct allocation
page execute and read and write
61ECC000
direct allocation
page read and write
14B4000
heap
page read and write
4D41000
heap
page read and write
1D935000
heap
page read and write
4D41000
heap
page read and write
4D41000
heap
page read and write
6FB000
unkown
page execute and read and write
14B4000
heap
page read and write
1D95C000
heap
page read and write
1470000
heap
page read and write
14B4000
heap
page read and write
6CF000
unkown
page execute and read and write
5E1000
unkown
page execute and write copy
1D26F000
stack
page read and write
4D41000
heap
page read and write
5180000
trusted library allocation
page read and write
4D41000
heap
page read and write
1490000
direct allocation
page read and write
14B4000
heap
page read and write
4D3F000
stack
page read and write
5350000
direct allocation
page execute and read and write
4D41000
heap
page read and write
1D96C000
heap
page read and write
3FBE000
stack
page read and write
7A5000
unkown
page execute and read and write
1D950000
heap
page read and write
AD4000
unkown
page execute and write copy
1D77E000
stack
page read and write
4D41000
heap
page read and write
1D970000
heap
page read and write
29B02000
heap
page read and write
14B4000
heap
page read and write
6C8CF000
unkown
page write copy
4D41000
heap
page read and write
4D41000
heap
page read and write
1D954000
heap
page read and write
3F7F000
stack
page read and write
52FF000
stack
page read and write
40BF000
stack
page read and write
1D53D000
stack
page read and write
148B000
heap
page read and write
1D961000
heap
page read and write
1490000
direct allocation
page read and write
1490000
direct allocation
page read and write
4D41000
heap
page read and write
2FCE5000
heap
page read and write
14B4000
heap
page read and write
1D81D000
stack
page read and write
1D961000
heap
page read and write
61ED0000
direct allocation
page read and write
4D41000
heap
page read and write
1D954000
heap
page read and write
1D954000
heap
page read and write
14B0000
heap
page read and write
31BF000
stack
page read and write
ABD000
unkown
page execute and read and write
14B4000
heap
page read and write
1D958000
heap
page read and write
14B4000
heap
page read and write
C6C000
unkown
page execute and write copy
1D93A000
heap
page read and write
4D40000
heap
page read and write
4D41000
heap
page read and write
1D954000
heap
page read and write
3ABE000
stack
page read and write
1D94A000
heap
page read and write
4D41000
heap
page read and write
4D41000
heap
page read and write
437E000
stack
page read and write
61E00000
direct allocation
page execute and read and write
1D961000
heap
page read and write
29AC3000
heap
page read and write
1D920000
heap
page read and write
12F3000
stack
page read and write
45BF000
stack
page read and write
44BE000
stack
page read and write
393F000
stack
page read and write
1D957000
heap
page read and write
4D41000
heap
page read and write
1D971000
heap
page read and write
1D970000
heap
page read and write
2FCDD000
heap
page read and write
29AE4000
heap
page read and write
1D958000
heap
page read and write
AD5000
unkown
page execute and write copy
C6B000
unkown
page execute and read and write
1D949000
heap
page read and write
1D954000
heap
page read and write
14B4000
heap
page read and write
14B4000
heap
page read and write
4D41000
heap
page read and write
170F000
heap
page read and write
1D958000
heap
page read and write
1D96E000
heap
page read and write
2FC3F000
stack
page read and write
4D41000
heap
page read and write
4BFF000
stack
page read and write
2FCDC000
heap
page read and write
61E01000
direct allocation
page execute read
6C6F1000
unkown
page execute read
5E0000
unkown
page read and write
45FE000
stack
page read and write
1490000
direct allocation
page read and write
49BE000
stack
page read and write
4D41000
heap
page read and write
14B4000
heap
page read and write
3CFF000
stack
page read and write
63A000
unkown
page execute and read and write
29A80000
heap
page read and write
1D954000
heap
page read and write
1D961000
heap
page read and write
16A3000
heap
page read and write
1D3EE000
stack
page read and write
4D41000
heap
page read and write
1D4EF000
stack
page read and write
166B000
heap
page read and write
5320000
direct allocation
page execute and read and write
1D961000
heap
page read and write
29AA1000
heap
page read and write
4D41000
heap
page read and write
4D41000
heap
page read and write
14B4000
heap
page read and write
483F000
stack
page read and write
1D970000
heap
page read and write
1D961000
heap
page read and write
29ABA000
heap
page read and write
4D41000
heap
page read and write
1D939000
heap
page read and write
1D954000
heap
page read and write
1D970000
heap
page read and write
1D961000
heap
page read and write
1D95C000
heap
page read and write
1D95B000
heap
page read and write
4D41000
heap
page read and write
4D50000
heap
page read and write
1D949000
heap
page read and write
14B4000
heap
page read and write
1671000
heap
page read and write
1D94B000
heap
page read and write
1D949000
heap
page read and write
785000
unkown
page execute and read and write
29AB7000
heap
page read and write
23AF4000
heap
page read and write
AC5000
unkown
page execute and read and write
1D970000
heap
page read and write
4D41000
heap
page read and write
FFE000
stack
page read and write
1D971000
heap
page read and write
1D957000
heap
page read and write
1480000
heap
page read and write
1D96F000
heap
page read and write
423E000
stack
page read and write
12F9000
stack
page read and write
6C651000
unkown
page execute read
487E000
stack
page read and write
357F000
stack
page read and write
14B4000
heap
page read and write
1D970000
heap
page read and write
1D12F000
stack
page read and write
4D60000
heap
page read and write
1D954000
heap
page read and write
4D41000
heap
page read and write
1D946000
heap
page read and write
1D970000
heap
page read and write
1D93B000
heap
page read and write
12FD000
stack
page read and write
1D970000
heap
page read and write
1D2AE000
stack
page read and write
14B4000
heap
page read and write
4D41000
heap
page read and write
1D939000
heap
page read and write
3BBF000
stack
page read and write
46FF000
stack
page read and write
1D93A000
heap
page read and write
5330000
direct allocation
page execute and read and write
A98000
unkown
page execute and read and write
1D954000
heap
page read and write
5320000
direct allocation
page execute and read and write
36BF000
stack
page read and write
1D954000
heap
page read and write
4C3E000
stack
page read and write
146E000
stack
page read and write
239BA000
heap
page read and write
32FF000
stack
page read and write
3BFE000
stack
page read and write
83E000
unkown
page execute and read and write
1D93A000
heap
page read and write
1D971000
heap
page read and write
There are 398 hidden memdumps, click here to show them.