IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKFCFBAAEHCFHJJKEHJKJDHJDG
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DBFHDBGIEBFIIDGCBFBKEBFHJD
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\FHIDAKFIJJKJJJKEBKJEHCBGDA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HDGDGHCAAKECFHJKFIJK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HIDAAKEGDBFIJJKFHCFB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IIIEBAAF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JDHIEBFHCAKEHIDGHCBA
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\JJDBAAEG
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpAAKEGDBFIJJKFHCFB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll1
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpv
unknown
 malicious
http://185.215.113.37U
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpa
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllj
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpN
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpU
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpmple-storage.jsonco(
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpI
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpmainnet
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dlld
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://ac.ecopnacl
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://ac.ecop
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 47 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
7E1000
unkown
page execute and read and write
 malicious
51A0000
direct allocation
page read and write
 malicious
145E000
heap
page read and write
 malicious
4D21000
heap
page read and write
1D7D8000
heap
page read and write
164E000
stack
page read and write
1D7FD000
heap
page read and write
499E000
stack
page read and write
1D7D6000
heap
page read and write
4D21000
heap
page read and write
6C681000
unkown
page execute read
4D21000
heap
page read and write
1D808000
heap
page read and write
6C860000
unkown
page read and write
1D802000
heap
page read and write
F60000
heap
page read and write
1414000
heap
page read and write
481F000
stack
page read and write
6C85E000
unkown
page read and write
3F5F000
stack
page read and write
1D804000
heap
page read and write
1430000
direct allocation
page read and write
391F000
stack
page read and write
1D7FC000
heap
page read and write
1D7F0000
heap
page read and write
52F0000
direct allocation
page execute and read and write
4D21000
heap
page read and write
471E000
stack
page read and write
1D7EC000
heap
page read and write
29800000
heap
page read and write
3A9E000
stack
page read and write
8CF000
unkown
page execute and read and write
83A000
unkown
page execute and read and write
1D7F0000
heap
page read and write
32DF000
stack
page read and write
1D7E4000
heap
page read and write
1D7D5000
heap
page read and write
891000
unkown
page execute and read and write
421E000
stack
page read and write
1D7ED000
heap
page read and write
23855000
heap
page read and write
1D7FC000
heap
page read and write
29C08000
heap
page read and write
1D7E7000
heap
page read and write
30DF000
stack
page read and write
4D21000
heap
page read and write
1D7F0000
heap
page read and write
3F9E000
stack
page read and write
1D7F3000
heap
page read and write
61ED0000
direct allocation
page read and write
1D7ED000
heap
page read and write
3A5F000
stack
page read and write
1D61C000
stack
page read and write
8FE000
unkown
page execute and read and write
459F000
stack
page read and write
2FB0000
direct allocation
page read and write
1D7E6000
heap
page read and write
1D7D6000
heap
page read and write
1414000
heap
page read and write
1D7FD000
heap
page read and write
1414000
heap
page read and write
1D8E0000
trusted library allocation
page read and write
1D7D6000
heap
page read and write
BC6000
unkown
page execute and read and write
2F6C000
stack
page read and write
3E5E000
stack
page read and write
4D21000
heap
page read and write
1D808000
heap
page read and write
2FC0000
direct allocation
page execute and read and write
1D808000
heap
page read and write
5300000
direct allocation
page execute and read and write
1414000
heap
page read and write
6C81F000
unkown
page readonly
1414000
heap
page read and write
6C85F000
unkown
page write copy
1D7E5000
heap
page read and write
341F000
stack
page read and write
1414000
heap
page read and write
4A9F000
stack
page read and write
1D4CF000
stack
page read and write
89D000
unkown
page execute and read and write
45DE000
stack
page read and write
1D7F0000
heap
page read and write
4D21000
heap
page read and write
865000
unkown
page execute and read and write
1D809000
heap
page read and write
29B6F000
stack
page read and write
61E00000
direct allocation
page execute and read and write
1D80C000
heap
page read and write
1430000
direct allocation
page read and write
4D21000
heap
page read and write
8C2000
unkown
page execute and read and write
6F8ED000
unkown
page readonly
1D80C000
heap
page read and write
395E000
stack
page read and write
1D7EE000
heap
page read and write
985000
unkown
page execute and read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
2FD0000
heap
page read and write
4D21000
heap
page read and write
1430000
direct allocation
page read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
1414000
heap
page read and write
1414000
heap
page read and write
FDD000
stack
page read and write
1D7FC000
heap
page read and write
297C0000
heap
page read and write
7E1000
unkown
page execute and write copy
1D7D6000
heap
page read and write
2FD7000
heap
page read and write
4D21000
heap
page read and write
1D7F0000
heap
page read and write
1D804000
heap
page read and write
4D21000
heap
page read and write
52E0000
direct allocation
page execute and read and write
369F000
stack
page read and write
4D30000
heap
page read and write
1414000
heap
page read and write
1D28E000
stack
page read and write
29883000
heap
page read and write
1D7FC000
heap
page read and write
12F3000
stack
page read and write
3E1F000
stack
page read and write
1414000
heap
page read and write
4D21000
heap
page read and write
14B7000
heap
page read and write
1D7F0000
heap
page read and write
4D21000
heap
page read and write
1414000
heap
page read and write
29C0F000
heap
page read and write
1D7F0000
heap
page read and write
431F000
stack
page read and write
4D21000
heap
page read and write
1414000
heap
page read and write
449E000
stack
page read and write
1D7E2000
heap
page read and write
9A5000
unkown
page execute and read and write
1D809000
heap
page read and write
1D75D000
stack
page read and write
1430000
direct allocation
page read and write
9AB000
unkown
page execute and read and write
4D21000
heap
page read and write
445F000
stack
page read and write
1D7CB000
heap
page read and write
1D7D6000
heap
page read and write
E74000
unkown
page execute and read and write
1414000
heap
page read and write
CC3000
unkown
page execute and read and write
4D21000
heap
page read and write
A3E000
unkown
page execute and read and write
F0C000
stack
page read and write
1D809000
heap
page read and write
12F9000
stack
page read and write
1414000
heap
page read and write
485E000
stack
page read and write
29C1D000
heap
page read and write
1414000
heap
page read and write
29A1D000
stack
page read and write
1430000
direct allocation
page read and write
1D804000
heap
page read and write
4D21000
heap
page read and write
1D24F000
stack
page read and write
355F000
stack
page read and write
29821000
heap
page read and write
37DF000
stack
page read and write
1D10E000
stack
page read and write
4D21000
heap
page read and write
1D65D000
stack
page read and write
1D7E5000
heap
page read and write
1D7F7000
heap
page read and write
1D7F0000
heap
page read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
1D7E2000
heap
page read and write
1D7F0000
heap
page read and write
2FDB000
heap
page read and write
1414000
heap
page read and write
1D00E000
stack
page read and write
1D7F0000
heap
page read and write
1D808000
heap
page read and write
12FD000
stack
page read and write
1430000
direct allocation
page read and write
1414000
heap
page read and write
5300000
direct allocation
page execute and read and write
61E01000
direct allocation
page execute read
4D21000
heap
page read and write
4D21000
heap
page read and write
297E0000
heap
page read and write
4D21000
heap
page read and write
40DE000
stack
page read and write
1430000
direct allocation
page read and write
872000
unkown
page execute and read and write
4D21000
heap
page read and write
1414000
heap
page read and write
4D21000
heap
page read and write
6F8FE000
unkown
page read and write
1414000
heap
page read and write
86F000
unkown
page execute and read and write
1D51E000
stack
page read and write
F70000
heap
page read and write
5310000
direct allocation
page execute and read and write
1414000
heap
page read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
4BDF000
stack
page read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
1D7FE000
heap
page read and write
2FDE000
heap
page read and write
1414000
heap
page read and write
29C10000
heap
page read and write
1D7E5000
heap
page read and write
14D2000
heap
page read and write
2F2E000
stack
page read and write
14A2000
heap
page read and write
41DF000
stack
page read and write
4D21000
heap
page read and write
409F000
stack
page read and write
1414000
heap
page read and write
1D7E5000
heap
page read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
6F870000
unkown
page readonly
1D804000
heap
page read and write
4D21000
heap
page read and write
1D38E000
stack
page read and write
3B9F000
stack
page read and write
1D14E000
stack
page read and write
4D21000
heap
page read and write
4D20000
heap
page read and write
1D7F0000
heap
page read and write
5320000
direct allocation
page execute and read and write
1D7F3000
heap
page read and write
E75000
unkown
page execute and write copy
1414000
heap
page read and write
7E0000
unkown
page readonly
3CDF000
stack
page read and write
1D7F6000
heap
page read and write
1D7C2000
heap
page read and write
1D7F0000
heap
page read and write
CDB000
unkown
page execute and write copy
1D7E5000
heap
page read and write
29B70000
trusted library allocation
page read and write
435D000
stack
page read and write
1D7EC000
heap
page read and write
1414000
heap
page read and write
868000
unkown
page execute and read and write
1414000
heap
page read and write
1458000
heap
page read and write
1410000
heap
page read and write
61ECC000
direct allocation
page read and write
140E000
stack
page read and write
4D21000
heap
page read and write
1D7C0000
heap
page read and write
52DF000
stack
page read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
1D7E5000
heap
page read and write
6F902000
unkown
page readonly
1430000
direct allocation
page read and write
331E000
stack
page read and write
1414000
heap
page read and write
1D7E2000
heap
page read and write
1D7EB000
heap
page read and write
1430000
direct allocation
page read and write
6C680000
unkown
page readonly
29C17000
heap
page read and write
1D8E7000
heap
page read and write
CDA000
unkown
page execute and write copy
1D805000
heap
page read and write
1414000
heap
page read and write
2991D000
stack
page read and write
1430000
direct allocation
page read and write
61ED4000
direct allocation
page readonly
4C1E000
stack
page read and write
61ED3000
direct allocation
page read and write
6C865000
unkown
page readonly
4D21000
heap
page read and write
1430000
direct allocation
page read and write
2FB0000
direct allocation
page read and write
5160000
trusted library allocation
page read and write
1414000
heap
page read and write
61EB4000
direct allocation
page read and write
1414000
heap
page read and write
1D80C000
heap
page read and write
1420000
heap
page read and write
31DF000
stack
page read and write
1D809000
heap
page read and write
2FAE000
stack
page read and write
1D7F0000
heap
page read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
36DE000
stack
page read and write
1D7F0000
heap
page read and write
1D7ED000
heap
page read and write
4D1F000
stack
page read and write
1D80C000
heap
page read and write
CCB000
unkown
page execute and read and write
1D7FD000
heap
page read and write
29A6E000
stack
page read and write
CA1000
unkown
page execute and read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
1D7EB000
heap
page read and write
174E000
stack
page read and write
CDA000
unkown
page execute and read and write
345E000
stack
page read and write
4D21000
heap
page read and write
1414000
heap
page read and write
4D21000
heap
page read and write
1414000
heap
page read and write
1D7F0000
heap
page read and write
4D21000
heap
page read and write
1D7E5000
heap
page read and write
5170000
heap
page read and write
1414000
heap
page read and write
1430000
direct allocation
page read and write
4D21000
heap
page read and write
1430000
direct allocation
page read and write
6F871000
unkown
page execute read
4D21000
heap
page read and write
3D1E000
stack
page read and write
4D21000
heap
page read and write
1D7E7000
heap
page read and write
1D805000
heap
page read and write
4D21000
heap
page read and write
1414000
heap
page read and write
4ADE000
stack
page read and write
4D21000
heap
page read and write
1D3CE000
stack
page read and write
1D7E8000
heap
page read and write
1414000
heap
page read and write
1D7EC000
heap
page read and write
8FB000
unkown
page execute and read and write
4D21000
heap
page read and write
4D21000
heap
page read and write
1D80C000
heap
page read and write
1414000
heap
page read and write
4D21000
heap
page read and write
359E000
stack
page read and write
3BDE000
stack
page read and write
1414000
heap
page read and write
1450000
heap
page read and write
4D21000
heap
page read and write
495F000
stack
page read and write
51DC000
stack
page read and write
1D808000
heap
page read and write
7E0000
unkown
page read and write
1D7E5000
heap
page read and write
61EB7000
direct allocation
page readonly
8EF000
unkown
page execute and read and write
1D7EC000
heap
page read and write
381E000
stack
page read and write
1430000
direct allocation
page read and write
5330000
direct allocation
page execute and read and write
46DF000
stack
page read and write
1D809000
heap
page read and write
1414000
heap
page read and write
61ECD000
direct allocation
page readonly
There are 352 hidden memdumps, click here to show them.