IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BKKJKFBKKECFHJKEBKEH
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\CBKJKJDB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DBFHDHJKKJDHJJJJKEGHIDGDHD
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DGHCBAAEHCFIDGDHJEHC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FBFCAKKK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GDHIDHIEGIIIECAKEBFB
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\HDGCAAFBFBKFIDGDHJDBKECFBA
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\JJECGCBGDBKJJKEBFBFHJEBGDG
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
http://185.215.113.37/e2b1563c6670f193.php~
unknown
Http://185.215.113.37/e2b1563c6670f193.phption:
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll8
unknown
http://185.215.113.37/e2b1563c6670f193.phpr
unknown
http://185.215.113.37/e2b1563c6670f193.phpq
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
unknown
http://185.215.113.37e2b1563c6670f193.phption:
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.37/e2b1563c6670f193.phpx
unknown
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllf
unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllw
unknown
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
http://185.215.113.37/e2b1563c6670f193.phpj
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://185.215.113.37tE
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll/
unknown
http://185.215.113.37/e2b1563c6670f193.phpM
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.37/#
unknown
http://185.215.113.37/e2b1563c6670f193.phpV
unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllz
unknown
http://185.215.113.37/e2b1563c6670f193.phpZ
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
http://185.215.113.37/e2b1563c6670f193.phpB
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://ac.ecopnacl
unknown
http://185.215.113.37/e2b1563c6670f193.phpe950
unknown
http://185.215.113.37/e2b1563c6670f193.php1
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.37/e2b1563c6670f193.php3
unknown
http://185.215.113.37/e2b1563c6670f193.php:
unknown
https://support.mozilla.org
unknown
http://185.215.113.37/e2b1563c6670f193.php&
unknown
https://ac.ecop
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll.
unknown
There are 58 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
D2E000
heap
page read and write
 malicious
251000
unkown
page execute and read and write
 malicious
4BF0000
direct allocation
page read and write
 malicious
4761000
heap
page read and write
296E000
stack
page read and write
4750000
direct allocation
page read and write
1D252000
heap
page read and write
4761000
heap
page read and write
2952B000
heap
page read and write
250000
unkown
page readonly
4750000
direct allocation
page read and write
4761000
heap
page read and write
4761000
heap
page read and write
1D260000
heap
page read and write
1D274000
heap
page read and write
44CF000
stack
page read and write
D72000
heap
page read and write
4761000
heap
page read and write
9C4000
heap
page read and write
1D246000
heap
page read and write
2AF0000
heap
page read and write
4761000
heap
page read and write
1D26C000
heap
page read and write
4761000
heap
page read and write
2AF7000
heap
page read and write
474F000
stack
page read and write
4761000
heap
page read and write
30BF000
stack
page read and write
CF8000
stack
page read and write
29490000
trusted library allocation
page read and write
4761000
heap
page read and write
4761000
heap
page read and write
1D260000
heap
page read and write
1D278000
heap
page read and write
9C4000
heap
page read and write
36E000
unkown
page execute and read and write
4750000
direct allocation
page read and write
6C7EF000
unkown
page readonly
1D260000
heap
page read and write
4C2B000
stack
page read and write
F2E000
stack
page read and write
387E000
stack
page read and write
29260000
heap
page read and write
1D25C000
heap
page read and write
9C4000
heap
page read and write
4761000
heap
page read and write
4761000
heap
page read and write
1D279000
heap
page read and write
9C4000
heap
page read and write
1D230000
heap
page read and write
4761000
heap
page read and write
102F000
stack
page read and write
1D279000
heap
page read and write
2AAB000
stack
page read and write
1D257000
heap
page read and write
1D25D000
heap
page read and write
4761000
heap
page read and write
29240000
heap
page read and write
3ECE000
stack
page read and write
9C4000
heap
page read and write
1D25C000
heap
page read and write
1D260000
heap
page read and write
9C4000
heap
page read and write
6C642000
unkown
page readonly
4761000
heap
page read and write
3F5000
unkown
page execute and read and write
2D5000
unkown
page execute and read and write
1CDFF000
stack
page read and write
629000
unkown
page execute and read and write
1D260000
heap
page read and write
1D26D000
heap
page read and write
4761000
heap
page read and write
301000
unkown
page execute and read and write
1D256000
heap
page read and write
1CCFE000
stack
page read and write
2F7F000
stack
page read and write
251000
unkown
page execute and write copy
9C4000
heap
page read and write
4761000
heap
page read and write
1CCBF000
stack
page read and write
1D258000
heap
page read and write
DFD000
heap
page read and write
1D246000
heap
page read and write
1D25C000
heap
page read and write
4761000
heap
page read and write
4761000
heap
page read and write
61ED0000
direct allocation
page read and write
1D255000
heap
page read and write
9C4000
heap
page read and write
4750000
direct allocation
page read and write
2AEE000
stack
page read and write
6C830000
unkown
page read and write
2E7E000
stack
page read and write
450E000
stack
page read and write
4BF0000
direct allocation
page read and write
1D27C000
heap
page read and write
707000
unkown
page execute and read and write
CF3000
stack
page read and write
33F000
unkown
page execute and read and write
1D260000
heap
page read and write
4761000
heap
page read and write
4BF0000
direct allocation
page read and write
1D263000
heap
page read and write
4DA0000
direct allocation
page execute and read and write
1D26C000
heap
page read and write
6C63E000
unkown
page read and write
1CF3F000
stack
page read and write
1D255000
heap
page read and write
1D279000
heap
page read and write
D28000
heap
page read and write
1D246000
heap
page read and write
9C4000
heap
page read and write
4761000
heap
page read and write
1D27C000
heap
page read and write
4761000
heap
page read and write
34BE000
stack
page read and write
36FF000
stack
page read and write
1D255000
heap
page read and write
2BFF000
stack
page read and write
383F000
stack
page read and write
4761000
heap
page read and write
9C4000
heap
page read and write
373E000
stack
page read and write
9C0000
heap
page read and write
1D260000
heap
page read and write
2FBE000
stack
page read and write
1D25B000
heap
page read and write
1D260000
heap
page read and write
4761000
heap
page read and write
1D252000
heap
page read and write
43CE000
stack
page read and write
8E2000
unkown
page execute and read and write
410F000
stack
page read and write
30D000
unkown
page execute and read and write
1D260000
heap
page read and write
1CE3E000
stack
page read and write
29290000
heap
page read and write
1D27C000
heap
page read and write
1D248000
heap
page read and write
9C4000
heap
page read and write
4761000
heap
page read and write
1D245000
heap
page read and write
6C651000
unkown
page execute read
61E00000
direct allocation
page execute and read and write
4761000
heap
page read and write
29284000
heap
page read and write
460F000
stack
page read and write
3C3E000
stack
page read and write
4761000
heap
page read and write
1CF8D000
stack
page read and write
D87000
heap
page read and write
29281000
heap
page read and write
1D275000
heap
page read and write
2D8000
unkown
page execute and read and write
2929D000
heap
page read and write
9C4000
heap
page read and write
1D274000
heap
page read and write
9F0000
heap
page read and write
1D278000
heap
page read and write
4750000
direct allocation
page read and write
6C82F000
unkown
page write copy
9C4000
heap
page read and write
1D25C000
heap
page read and write
29531000
heap
page read and write
1D27C000
heap
page read and write
4761000
heap
page read and write
9C4000
heap
page read and write
4D70000
direct allocation
page execute and read and write
3D7D000
stack
page read and write
1D278000
heap
page read and write
4761000
heap
page read and write
2953F000
heap
page read and write
1D275000
heap
page read and write
4D70000
direct allocation
page execute and read and write
97C000
stack
page read and write
1D272000
heap
page read and write
6C5B1000
unkown
page execute read
333F000
stack
page read and write
400E000
stack
page read and write
29220000
heap
page read and write
6C82E000
unkown
page read and write
4750000
direct allocation
page read and write
4761000
heap
page read and write
1D257000
heap
page read and write
9C4000
heap
page read and write
2AA000
unkown
page execute and read and write
1D25D000
heap
page read and write
1D255000
heap
page read and write
1D246000
heap
page read and write
29289000
heap
page read and write
4860000
trusted library allocation
page read and write
1D23B000
heap
page read and write
4761000
heap
page read and write
4770000
heap
page read and write
CFD000
stack
page read and write
4761000
heap
page read and write
9C4000
heap
page read and write
4761000
heap
page read and write
1D252000
heap
page read and write
415000
unkown
page execute and read and write
747000
unkown
page execute and write copy
4761000
heap
page read and write
6C835000
unkown
page readonly
424F000
stack
page read and write
9C4000
heap
page read and write
1D25B000
heap
page read and write
9C4000
heap
page read and write
464E000
stack
page read and write
1D232000
heap
page read and write
2E3F000
stack
page read and write
1D26D000
heap
page read and write
4761000
heap
page read and write
250000
unkown
page read and write
2E2000
unkown
page execute and read and write
61ED4000
direct allocation
page readonly
1D25D000
heap
page read and write
4750000
direct allocation
page read and write
9C4000
heap
page read and write
1D255000
heap
page read and write
337E000
stack
page read and write
9C4000
heap
page read and write
36B000
unkown
page execute and read and write
9C4000
heap
page read and write
35FE000
stack
page read and write
3E80000
heap
page read and write
4761000
heap
page read and write
4750000
direct allocation
page read and write
1D279000
heap
page read and write
41B000
unkown
page execute and read and write
1D255000
heap
page read and write
2D3E000
stack
page read and write
4761000
heap
page read and write
4761000
heap
page read and write
9C4000
heap
page read and write
748000
unkown
page execute and write copy
4761000
heap
page read and write
35BF000
stack
page read and write
9C4000
heap
page read and write
1D350000
trusted library allocation
page read and write
61E01000
direct allocation
page execute read
116E000
stack
page read and write
414E000
stack
page read and write
347F000
stack
page read and write
3BFF000
stack
page read and write
1D27C000
heap
page read and write
61EB7000
direct allocation
page readonly
3D3F000
stack
page read and write
4D40000
direct allocation
page execute and read and write
9C4000
heap
page read and write
4AE000
unkown
page execute and read and write
4D80000
direct allocation
page execute and read and write
4750000
direct allocation
page read and write
1D260000
heap
page read and write
61ECC000
direct allocation
page read and write
4761000
heap
page read and write
6C650000
unkown
page readonly
DA5000
heap
page read and write
2DF000
unkown
page execute and read and write
6C5B0000
unkown
page readonly
49A000
unkown
page execute and read and write
2947D000
stack
page read and write
4761000
heap
page read and write
1D0CE000
stack
page read and write
4BD0000
heap
page read and write
4761000
heap
page read and write
332000
unkown
page execute and read and write
DF8000
heap
page read and write
1D274000
heap
page read and write
738000
unkown
page execute and read and write
D20000
heap
page read and write
1D26E000
heap
page read and write
730000
unkown
page execute and read and write
747000
unkown
page execute and read and write
4761000
heap
page read and write
29537000
heap
page read and write
1D260000
heap
page read and write
31FF000
stack
page read and write
1D255000
heap
page read and write
1D274000
heap
page read and write
4760000
heap
page read and write
29523000
heap
page read and write
397F000
stack
page read and write
4761000
heap
page read and write
1D26C000
heap
page read and write
4761000
heap
page read and write
4750000
direct allocation
page read and write
4761000
heap
page read and write
9C4000
heap
page read and write
9C4000
heap
page read and write
4750000
direct allocation
page read and write
4750000
direct allocation
page read and write
3FCF000
stack
page read and write
1D246000
heap
page read and write
4D2F000
stack
page read and write
1D260000
heap
page read and write
4761000
heap
page read and write
4761000
heap
page read and write
1D263000
heap
page read and write
61ED3000
direct allocation
page read and write
9C4000
heap
page read and write
323E000
stack
page read and write
9C4000
heap
page read and write
4761000
heap
page read and write
4D50000
direct allocation
page execute and read and write
9C4000
heap
page read and write
1D266000
heap
page read and write
9C4000
heap
page read and write
438F000
stack
page read and write
1D254000
heap
page read and write
39BE000
stack
page read and write
428E000
stack
page read and write
1D26C000
heap
page read and write
35F000
unkown
page execute and read and write
106E000
stack
page read and write
2AFE000
heap
page read and write
29296000
heap
page read and write
2937E000
stack
page read and write
9C4000
heap
page read and write
4761000
heap
page read and write
1D260000
heap
page read and write
1CBBE000
stack
page read and write
9C4000
heap
page read and write
4761000
heap
page read and write
61EB4000
direct allocation
page read and write
1CB7F000
stack
page read and write
9C4000
heap
page read and write
9C4000
heap
page read and write
1D353000
heap
page read and write
1D260000
heap
page read and write
1D1CD000
stack
page read and write
3E7F000
stack
page read and write
6C62D000
unkown
page readonly
4761000
heap
page read and write
4761000
heap
page read and write
4761000
heap
page read and write
4761000
heap
page read and write
1CA7E000
stack
page read and write
4761000
heap
page read and write
4761000
heap
page read and write
1D08C000
stack
page read and write
9C4000
heap
page read and write
4750000
direct allocation
page read and write
2A6F000
stack
page read and write
1D255000
heap
page read and write
30FE000
stack
page read and write
4D90000
direct allocation
page execute and read and write
9C4000
heap
page read and write
1D279000
heap
page read and write
D6E000
heap
page read and write
1D25E000
heap
page read and write
4750000
direct allocation
page read and write
61ECD000
direct allocation
page readonly
9E0000
heap
page read and write
9C4000
heap
page read and write
1D278000
heap
page read and write
4761000
heap
page read and write
4D60000
direct allocation
page execute and read and write
2CFF000
stack
page read and write
1D267000
heap
page read and write
232C0000
heap
page read and write
1D260000
heap
page read and write
3ABF000
stack
page read and write
3AFE000
stack
page read and write
2AFB000
heap
page read and write
1D278000
heap
page read and write
4761000
heap
page read and write
1D26D000
heap
page read and write
4761000
heap
page read and write
There are 358 hidden memdumps, click here to show them.