IOC Report
SecuriteInfo.com.Win32.AdwareX-gen.20631.18363.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win32.AdwareX-gen.20631.18363.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\9h4wb\37gd2d
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\9h4wb\gdtrqi
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\9h4wb\kfuaiw
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 6, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\9h4wb\m7ymoh
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\9h4wb\ozcb1d2no
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\9h4wb\s2n7gd268
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\9h4wb\u3ecje
SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\9h4wb\v3wbai
SQLite 3.x database, last written using SQLite version 3046000, file counter 6, database pages 41, 1st free page 29, free pages 1, cookie 0x25, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\9h4wb\xlng4w
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\json[1].json
JSON data
dropped
Chrome Cache Entry: 60
ASCII text
downloaded
Chrome Cache Entry: 61
ASCII text, with very long lines (65531)
downloaded
Chrome Cache Entry: 62
ASCII text, with very long lines (922)
downloaded
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.20631.18363.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.AdwareX-gen.20631.18363.exe"
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2220,i,9774722909908192130,17750005277753749404,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2160 /prefetch:3
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\9h4wb" & exit
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout /t 11

URLs

Name
IP
Malicious
https://go.f.goldenloafuae.com/
95.217.27.252
 malicious
https://go.f.goldenloafuae.com/N
unknown
https://go.f.goldenloafuae.com5
unknown
https://t.me/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://go.f.goldenloafuae.com/ozilla
unknown
https://web.telegram.org
unknown
https://t.me/l793oyir7amMozilla/5.0
unknown
https://t.me/l793oy_
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ac.ecosia.org?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://www.google.com/async/newtab_promos
142.250.186.68
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://go.f.goldenloafuae.comi
unknown
https://go.f.goldenloafuae.com/5
unknown
https://go.f.goldenloafuae.com/t
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://go.f.goldenloafuae.com/z
unknown
https://go.f.goldenloafuae.com
unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico
unknown
https://www.google.com/async/ddljson?async=ntp:2
142.250.186.68
https://go.f.goldenloafuae.comV
unknown
https://www.ecosia.org/newtab/v20
unknown
https://t.me/l793oyE
unknown
https://go.f.goldenloafuae.comX
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://go.f.goldenloafuae.com/%
unknown
https://t.me/l793oy
149.154.167.99
https://steamcommunity.com/profiles/76561199829660832
https://duckduckgo.com/chrome_newtabv20
unknown
https://go.f.goldenloafuae.com/d
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://go.f.goldenloafuae.com/g
unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
142.250.186.68
https://support.mozilla.org/products/firefoxgro.all
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
142.250.186.68
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://go.f.goldenloafuae.com/T
unknown
https://gemini.google.com/app?q=
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
https://steamcommunity.com/profiles/76561199829660832ir7amMozilla/5.0
unknown
There are 35 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
go.f.goldenloafuae.com
95.217.27.252
 malicious
t.me
149.154.167.99
www.google.com
142.250.186.68

IPs

IP
Domain
Country
Malicious
95.217.27.252
go.f.goldenloafuae.com
Germany
malicious
192.168.2.4
unknown
unknown
malicious
142.250.186.68
www.google.com
United States
149.154.167.99
t.me
United Kingdom
127.0.0.1
unknown
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
2FFF000
stack
page read and write
32E2000
heap
page read and write
3346000
heap
page read and write
37A6000
heap
page read and write
359D000
heap
page read and write
477F000
heap
page read and write
4122000
heap
page read and write
538000
heap
page read and write
430000
heap
page read and write
E8C000
stack
page read and write
440000
heap
page read and write
41E000
unkown
page readonly
27EE000
stack
page read and write
331D000
heap
page read and write
3C49000
heap
page read and write
3333000
heap
page read and write
3339000
heap
page read and write
37BC000
heap
page read and write
37F3000
heap
page read and write
36A0000
heap
page read and write
3936000
heap
page read and write
36A7000
heap
page read and write
3577000
heap
page read and write
4C0000
heap
page read and write
41D7000
heap
page read and write
427000
unkown
page readonly
598000
heap
page read and write
3585000
heap
page read and write
4F7000
heap
page read and write
670000
trusted library allocation
page read and write
37DF000
heap
page read and write
53D000
heap
page read and write
422000
unkown
page write copy
2BCE000
stack
page read and write
F30000
heap
page read and write
2B8C000
stack
page read and write
3303000
heap
page read and write
2D50000
remote allocation
page read and write
670000
trusted library allocation
page read and write
27AF000
stack
page read and write
35A3000
heap
page read and write
333F000
heap
page read and write
390F000
heap
page read and write
2D50000
remote allocation
page read and write
47E9000
heap
page read and write
18E000
stack
page read and write
489F000
heap
page read and write
3693000
heap
page read and write
40CD000
heap
page read and write
538000
heap
page read and write
3C81000
heap
page read and write
4F7000
heap
page read and write
5330000
heap
page read and write
18C000
stack
page read and write
412D000
heap
page read and write
3540000
heap
page read and write
3927000
heap
page read and write
37EA000
heap
page read and write
40C0000
heap
page read and write
53F000
heap
page read and write
401000
unkown
page execute read
3260000
heap
page read and write
2A8C000
stack
page read and write
3515000
heap
page read and write
3348000
heap
page read and write
3512000
heap
page read and write
41C2000
heap
page read and write
3566000
heap
page read and write
37B2000
heap
page read and write
3547000
heap
page read and write
54B000
heap
page read and write
3633000
heap
page read and write
3120000
trusted library allocation
page read and write
362C000
heap
page read and write
485E000
heap
page read and write
26AE000
stack
page read and write
34A0000
heap
page read and write
7FE000
stack
page read and write
2A3F000
stack
page read and write
4894000
heap
page read and write
3517000
heap
page read and write
19F000
stack
page read and write
3575000
heap
page read and write
356B000
heap
page read and write
3BA8000
heap
page read and write
2D8E000
stack
page read and write
3725000
heap
page read and write
51F000
heap
page read and write
332B000
heap
page read and write
355F000
heap
page read and write
2FBE000
stack
page read and write
4787000
heap
page read and write
190000
stack
page read and write
3859000
heap
page read and write
3021000
heap
page read and write
32C1000
heap
page read and write
334D000
heap
page read and write
2D50000
remote allocation
page read and write
370D000
heap
page read and write
4CF0000
heap
page read and write
47F4000
heap
page read and write
37AD000
heap
page read and write
2D20000
heap
page read and write
394B000
heap
page read and write
47C9000
heap
page read and write
3653000
heap
page read and write
3C71000
heap
page read and write
38AF000
heap
page read and write
37A0000
heap
page read and write
9B000
stack
page read and write
427000
unkown
page readonly
3713000
heap
page read and write
597000
heap
page read and write
34A2000
heap
page read and write
538000
heap
page read and write
3595000
heap
page read and write
53F000
heap
page read and write
325E000
stack
page read and write
4FE000
heap
page read and write
41CD000
heap
page read and write
51F000
heap
page read and write
3370000
heap
page read and write
4FE000
heap
page read and write
37D5000
heap
page read and write
3710000
heap
page read and write
334F000
stack
page read and write
3280000
heap
page read and write
35C3000
heap
page read and write
53A000
heap
page read and write
54C000
heap
page read and write
35CA000
heap
page read and write
47E000
heap
page read and write
384F000
heap
page read and write
546000
heap
page read and write
3C79000
heap
page read and write
3120000
trusted library allocation
page read and write
53D000
heap
page read and write
40B8000
heap
page read and write
537000
heap
page read and write
40E2000
heap
page read and write
396B000
heap
page read and write
470000
heap
page read and write
53B000
heap
page read and write
538000
heap
page read and write
3BC1000
heap
page read and write
4794000
heap
page read and write
47A000
heap
page read and write
2CCE000
stack
page read and write
345F000
stack
page read and write
34D0000
heap
page read and write
3020000
heap
page read and write
479F000
heap
page read and write
32A0000
heap
page read and write
321C000
stack
page read and write
293E000
stack
page read and write
380F000
heap
page read and write
401000
unkown
page execute read
34F2000
heap
page read and write
368B000
heap
page read and write
53B000
heap
page read and write
34B8000
heap
page read and write
A20000
heap
page read and write
2FDD000
stack
page read and write
54F000
heap
page read and write
3BD9000
heap
page read and write
256E000
stack
page read and write
358E000
heap
page read and write
4E7000
heap
page read and write
35D0000
heap
page read and write
37C9000
heap
page read and write
4A9000
heap
page read and write
35AB000
heap
page read and write
400000
unkown
page readonly
4FE000
heap
page read and write
37C7000
heap
page read and write
266F000
stack
page read and write
3010000
heap
page read and write
37C5000
heap
page read and write
3804000
heap
page read and write
38BA000
heap
page read and write
502000
heap
page read and write
19C000
stack
page read and write
3D11000
heap
page read and write
53D000
heap
page read and write
28EF000
stack
page read and write
35B2000
heap
page read and write
41E000
unkown
page readonly
357D000
heap
page read and write
4889000
heap
page read and write
2EDE000
stack
page read and write
41E2000
heap
page read and write
53F000
heap
page read and write
3BA2000
heap
page read and write
365D000
heap
page read and write
4969000
heap
page read and write
423000
unkown
page read and write
34D4000
heap
page read and write
3917000
heap
page read and write
3571000
heap
page read and write
3685000
heap
page read and write
ECC000
stack
page read and write
3021000
heap
page read and write
400000
unkown
page readonly
47BF000
heap
page read and write
4257000
heap
page read and write
38A5000
heap
page read and write
3807000
heap
page read and write
3847000
heap
page read and write
9BF000
stack
page read and write
3559000
heap
page read and write
2E8F000
stack
page read and write
365A000
heap
page read and write
37FB000
heap
page read and write
4FE000
heap
page read and write
53F000
heap
page read and write
4FE000
heap
page read and write
53A000
heap
page read and write
39E1000
heap
page read and write
545000
heap
page read and write
51F000
heap
page read and write
487F000
heap
page read and write
35BC000
heap
page read and write
37B9000
heap
page read and write
37E2000
heap
page read and write
9FC000
stack
page read and write
830000
heap
page read and write
42A2000
heap
page read and write
3956000
heap
page read and write
83A000
heap
page read and write
3905000
heap
page read and write
3613000
heap
page read and write
4197000
heap
page read and write
3553000
heap
page read and write
48A9000
heap
page read and write
590000
heap
page read and write
37CE000
heap
page read and write
53F000
heap
page read and write
4102000
heap
page read and write
4EB000
heap
page read and write
422000
unkown
page write copy
491F000
heap
page read and write
367D000
heap
page read and write
330E000
stack
page read and write
BD0000
heap
page read and write
371F000
heap
page read and write
4F7000
heap
page read and write
3021000
heap
page read and write
3323000
heap
page read and write
47A9000
heap
page read and write
3533000
heap
page read and write
3BF9000
heap
page read and write
3683000
heap
page read and write
F40000
heap
page read and write
3021000
heap
page read and write
There are 244 hidden memdumps, click here to show them.