IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKJDGDGDHDGDBFIDHDBA
ASCII text, with very long lines (1808), with CRLF line terminators
dropped
C:\ProgramData\BAKKEGCAAECAAAKFBGIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DHJEBGIEBFIJKEBFBFHIJJKEHD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\ECGIIIDA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EHCGIJDHDGDBGDGCGCFH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EHJDHJKFIECAAKFIJJKJKFHJKE
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JJJJDAAECGHDGDGCGHDBAECFHJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\KJDGDBFB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\KJKFBAFIDAEBFHJKJEBFCBFHDA
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpata
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpO
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllu
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpW
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php;
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpn
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37~(
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll%~
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dlli
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.njy8xaI_aUJp
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.mozilla.org
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 36 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
BBD000
heap
page read and write
 malicious
4DF0000
direct allocation
page read and write
 malicious
DD1000
unkown
page execute and read and write
 malicious
2F72F000
stack
page read and write
2F7D3000
heap
page read and write
295A5000
heap
page read and write
309E000
stack
page read and write
EEE000
unkown
page execute and read and write
29550000
heap
page read and write
1D436000
heap
page read and write
1CD3F000
stack
page read and write
E5F000
unkown
page execute and read and write
1D44D000
heap
page read and write
1D436000
heap
page read and write
1D435000
heap
page read and write
2F61E000
stack
page read and write
4961000
heap
page read and write
12CA000
unkown
page execute and read and write
61ECD000
direct allocation
page readonly
6CD01000
unkown
page execute read
1D440000
heap
page read and write
B10000
direct allocation
page read and write
1D426000
heap
page read and write
4961000
heap
page read and write
61ECC000
direct allocation
page read and write
F95000
unkown
page execute and read and write
4961000
heap
page read and write
C1B000
heap
page read and write
E58000
unkown
page execute and read and write
305F000
stack
page read and write
2E1F000
stack
page read and write
4961000
heap
page read and write
37DF000
stack
page read and write
1D42E000
heap
page read and write
4961000
heap
page read and write
4970000
heap
page read and write
1D44E000
heap
page read and write
2F7CD000
heap
page read and write
B10000
direct allocation
page read and write
AFE000
stack
page read and write
4961000
heap
page read and write
1D443000
heap
page read and write
4961000
heap
page read and write
1D435000
heap
page read and write
E2A000
unkown
page execute and read and write
B90000
heap
page read and write
4961000
heap
page read and write
1D437000
heap
page read and write
1D441000
heap
page read and write
B10000
direct allocation
page read and write
46DF000
stack
page read and write
295F1000
heap
page read and write
61EB7000
direct allocation
page readonly
1D43C000
heap
page read and write
2F7CF000
heap
page read and write
4F90000
direct allocation
page execute and read and write
1D44E000
heap
page read and write
1CEBE000
stack
page read and write
4E2C000
stack
page read and write
6CF7E000
unkown
page read and write
3E5E000
stack
page read and write
341F000
stack
page read and write
1D439000
heap
page read and write
4961000
heap
page read and write
1D440000
heap
page read and write
6CF80000
unkown
page read and write
369F000
stack
page read and write
4961000
heap
page read and write
1D448000
heap
page read and write
EB2000
unkown
page execute and read and write
1D53E000
heap
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
295A8000
heap
page read and write
1D43A000
heap
page read and write
9A0000
heap
page read and write
485E000
stack
page read and write
B2B000
heap
page read and write
61ED4000
direct allocation
page readonly
1D458000
heap
page read and write
B10000
direct allocation
page read and write
6CD7D000
unkown
page readonly
1D02E000
stack
page read and write
4961000
heap
page read and write
4DF0000
direct allocation
page read and write
459F000
stack
page read and write
4961000
heap
page read and write
1D42D000
heap
page read and write
1D425000
heap
page read and write
4961000
heap
page read and write
45DE000
stack
page read and write
495F000
stack
page read and write
1D44E000
heap
page read and write
EDF000
unkown
page execute and read and write
4960000
heap
page read and write
4F40000
direct allocation
page execute and read and write
1D44E000
heap
page read and write
4F70000
direct allocation
page execute and read and write
B10000
direct allocation
page read and write
1D444000
heap
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
1D45D000
heap
page read and write
4961000
heap
page read and write
C49000
heap
page read and write
319F000
stack
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
1D43A000
heap
page read and write
1D432000
heap
page read and write
1D440000
heap
page read and write
295AE000
heap
page read and write
C3C000
heap
page read and write
1D430000
heap
page read and write
29596000
heap
page read and write
B27000
heap
page read and write
C31000
heap
page read and write
12D9000
unkown
page execute and write copy
147D000
unkown
page execute and write copy
2D1F000
stack
page read and write
B10000
direct allocation
page read and write
4961000
heap
page read and write
1D44D000
heap
page read and write
1D440000
heap
page read and write
1CD7E000
stack
page read and write
6CD92000
unkown
page readonly
1D440000
heap
page read and write
1D435000
heap
page read and write
29570000
heap
page read and write
C2E000
heap
page read and write
6CDA0000
unkown
page readonly
1D434000
heap
page read and write
1D45D000
heap
page read and write
345E000
stack
page read and write
421E000
stack
page read and write
12D8000
unkown
page execute and read and write
1D440000
heap
page read and write
2354A000
heap
page read and write
36DE000
stack
page read and write
1D446000
heap
page read and write
B00000
heap
page read and write
F9B000
unkown
page execute and read and write
2F5E000
stack
page read and write
4961000
heap
page read and write
355F000
stack
page read and write
4961000
heap
page read and write
31DE000
stack
page read and write
1D44E000
heap
page read and write
1D432000
heap
page read and write
5AD000
stack
page read and write
1D436000
heap
page read and write
B2E000
heap
page read and write
F75000
unkown
page execute and read and write
DD0000
unkown
page readonly
4961000
heap
page read and write
1D43B000
heap
page read and write
1D436000
heap
page read and write
1D440000
heap
page read and write
1CE7F000
stack
page read and write
6CD00000
unkown
page readonly
2F7D7000
heap
page read and write
4961000
heap
page read and write
B10000
direct allocation
page read and write
1D45D000
heap
page read and write
B70000
heap
page read and write
1D435000
heap
page read and write
1D436000
heap
page read and write
DD1000
unkown
page execute and write copy
1D530000
trusted library allocation
page read and write
4F60000
direct allocation
page execute and read and write
B9E000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D458000
heap
page read and write
BFA000
heap
page read and write
41DF000
stack
page read and write
1D44E000
heap
page read and write
4961000
heap
page read and write
EEB000
unkown
page execute and read and write
1D44D000
heap
page read and write
1D2AD000
stack
page read and write
4961000
heap
page read and write
1D437000
heap
page read and write
1D420000
heap
page read and write
2959C000
heap
page read and write
12BF000
unkown
page execute and read and write
E62000
unkown
page execute and read and write
1D427000
heap
page read and write
1D42B000
heap
page read and write
1D16D000
stack
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
11B7000
unkown
page execute and read and write
E8D000
unkown
page execute and read and write
4961000
heap
page read and write
1D43C000
heap
page read and write
4961000
heap
page read and write
3E1F000
stack
page read and write
4961000
heap
page read and write
6CD8E000
unkown
page read and write
4961000
heap
page read and write
331E000
stack
page read and write
1D43A000
heap
page read and write
1D44D000
heap
page read and write
1CFBF000
stack
page read and write
C82000
heap
page read and write
B10000
direct allocation
page read and write
1D440000
heap
page read and write
4F80000
direct allocation
page execute and read and write
1D436000
heap
page read and write
4961000
heap
page read and write
1D438000
heap
page read and write
4F50000
direct allocation
page execute and read and write
3A9E000
stack
page read and write
1D43E000
heap
page read and write
3CDF000
stack
page read and write
1D442000
heap
page read and write
4961000
heap
page read and write
61ED3000
direct allocation
page read and write
1D436000
heap
page read and write
4961000
heap
page read and write
1D436000
heap
page read and write
1D441000
heap
page read and write
4961000
heap
page read and write
C43000
heap
page read and write
4961000
heap
page read and write
1D44E000
heap
page read and write
1D43B000
heap
page read and write
4FA0000
direct allocation
page execute and read and write
1D45D000
heap
page read and write
61ED0000
direct allocation
page read and write
1D440000
heap
page read and write
1D439000
heap
page read and write
EBF000
unkown
page execute and read and write
2F730000
trusted library allocation
page read and write
471E000
stack
page read and write
BE1000
heap
page read and write
4961000
heap
page read and write
1D441000
heap
page read and write
1D432000
heap
page read and write
1D426000
heap
page read and write
4961000
heap
page read and write
1D26C000
stack
page read and write
6CF7F000
unkown
page write copy
1D42E000
heap
page read and write
B10000
direct allocation
page read and write
1D440000
heap
page read and write
1D439000
heap
page read and write
C36000
heap
page read and write
295D1000
heap
page read and write
2F7C5000
heap
page read and write
1D41B000
heap
page read and write
40DE000
stack
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
1D426000
heap
page read and write
4961000
heap
page read and write
1D410000
heap
page read and write
9A5000
heap
page read and write
1D436000
heap
page read and write
409E000
stack
page read and write
61EB4000
direct allocation
page read and write
4961000
heap
page read and write
1D12F000
stack
page read and write
3F9E000
stack
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
D8E000
stack
page read and write
3BDE000
stack
page read and write
4961000
heap
page read and write
1D45D000
heap
page read and write
1D430000
heap
page read and write
1D440000
heap
page read and write
3D1E000
stack
page read and write
12D8000
unkown
page execute and write copy
29592000
heap
page read and write
391F000
stack
page read and write
4F2F000
stack
page read and write
4F7E000
stack
page read and write
4961000
heap
page read and write
1D440000
heap
page read and write
1D436000
heap
page read and write
4DF0000
direct allocation
page read and write
1D425000
heap
page read and write
4961000
heap
page read and write
C85000
heap
page read and write
4961000
heap
page read and write
395E000
stack
page read and write
1D445000
heap
page read and write
295B1000
heap
page read and write
445F000
stack
page read and write
8E0000
heap
page read and write
147C000
unkown
page execute and read and write
C80000
heap
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
AAF000
stack
page read and write
381E000
stack
page read and write
1D3AE000
stack
page read and write
DCE000
stack
page read and write
3F5F000
stack
page read and write
431F000
stack
page read and write
B9A000
heap
page read and write
32DF000
stack
page read and write
1D439000
heap
page read and write
4AC000
stack
page read and write
1D45D000
heap
page read and write
481F000
stack
page read and write
1D45D000
heap
page read and write
4980000
heap
page read and write
1D45D000
heap
page read and write
1D440000
heap
page read and write
1D45C000
heap
page read and write
1D436000
heap
page read and write
4961000
heap
page read and write
1D440000
heap
page read and write
1D440000
heap
page read and write
1D45D000
heap
page read and write
B10000
direct allocation
page read and write
1D435000
heap
page read and write
1D43D000
heap
page read and write
800000
heap
page read and write
1D434000
heap
page read and write
1D440000
heap
page read and write
B6C000
stack
page read and write
98E000
stack
page read and write
1D441000
heap
page read and write
4961000
heap
page read and write
B10000
direct allocation
page read and write
1D440000
heap
page read and write
3B9F000
stack
page read and write
1D436000
heap
page read and write
234AA000
heap
page read and write
1D440000
heap
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
4F70000
direct allocation
page execute and read and write
4961000
heap
page read and write
B10000
direct allocation
page read and write
3A5F000
stack
page read and write
1D440000
heap
page read and write
1D440000
heap
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
4961000
heap
page read and write
1D426000
heap
page read and write
4961000
heap
page read and write
1D447000
heap
page read and write
BE5000
heap
page read and write
B10000
direct allocation
page read and write
DD0000
unkown
page read and write
4961000
heap
page read and write
94E000
stack
page read and write
4961000
heap
page read and write
1D438000
heap
page read and write
102E000
unkown
page execute and read and write
6CF3F000
unkown
page readonly
235EF000
heap
page read and write
449E000
stack
page read and write
1D42D000
heap
page read and write
B20000
heap
page read and write
2F1F000
stack
page read and write
49BD000
heap
page read and write
1D45D000
heap
page read and write
1D45D000
heap
page read and write
E55000
unkown
page execute and read and write
4961000
heap
page read and write
4961000
heap
page read and write
1D440000
heap
page read and write
29591000
heap
page read and write
435E000
stack
page read and write
1D44E000
heap
page read and write
5A9000
stack
page read and write
1D440000
heap
page read and write
29594000
heap
page read and write
4961000
heap
page read and write
5A3000
stack
page read and write
6CDA1000
unkown
page execute read
E81000
unkown
page execute and read and write
61E01000
direct allocation
page execute read
4961000
heap
page read and write
1299000
unkown
page execute and read and write
1D45D000
heap
page read and write
B10000
direct allocation
page read and write
1D412000
heap
page read and write
4961000
heap
page read and write
4DA0000
trusted library allocation
page read and write
4961000
heap
page read and write
359E000
stack
page read and write
6CF85000
unkown
page readonly
There are 382 hidden memdumps, click here to show them.