IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\CAFHDBGHJKFIDHJJJEBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\CBAKEBGIIDAFIDHIIECF
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GDBFCGIIIJDBGCBGIDGI
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\IIIJECAEGDHIDHJKKKKFIEGIJK
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IJJJEBFH
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IJJJEBFHDBGIECBFCBKJKKJDHJ
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KJKKKJJJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KJKKKJJJKJKFHJJJJECBFCGHJD
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phpfox
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpick
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllE
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php~
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php_U
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php=r
unknown
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpog
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCO
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll)
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpBs
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phps
unknown
 malicious
http://185.215.113.37/z
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllJ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php_
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpi
unknown
 malicious
http://185.215.113.37m
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllP
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllW
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpH
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpin
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php5
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFirefox
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php)
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 53 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
CBE000
heap
page read and write
 malicious
4AA0000
direct allocation
page read and write
 malicious
F1000
unkown
page execute and read and write
 malicious
1D22E000
heap
page read and write
1D24D000
heap
page read and write
371E000
stack
page read and write
4611000
heap
page read and write
61ECC000
direct allocation
page read and write
14A000
unkown
page execute and read and write
5A9000
unkown
page execute and read and write
1D234000
heap
page read and write
4600000
direct allocation
page read and write
1D2000
unkown
page execute and read and write
1D234000
heap
page read and write
29200000
heap
page read and write
1D234000
heap
page read and write
D33000
heap
page read and write
5CB000
unkown
page execute and read and write
4BDF000
stack
page read and write
1CC6E000
stack
page read and write
2A5F000
stack
page read and write
4611000
heap
page read and write
4611000
heap
page read and write
C25000
heap
page read and write
1D234000
heap
page read and write
30DE000
stack
page read and write
6F870000
unkown
page readonly
1D24B000
heap
page read and write
3ADE000
stack
page read and write
4611000
heap
page read and write
349E000
stack
page read and write
1D226000
heap
page read and write
1DF000
unkown
page execute and read and write
4627000
heap
page read and write
29220000
heap
page read and write
4611000
heap
page read and write
4600000
direct allocation
page read and write
435F000
stack
page read and write
1D21A000
heap
page read and write
1D234000
heap
page read and write
4ADC000
stack
page read and write
6F8ED000
unkown
page readonly
4611000
heap
page read and write
61EB4000
direct allocation
page read and write
4611000
heap
page read and write
6C640000
unkown
page readonly
1D250000
heap
page read and write
5E5000
unkown
page execute and write copy
4611000
heap
page read and write
61ED4000
direct allocation
page readonly
4611000
heap
page read and write
1D22F000
heap
page read and write
F7E000
stack
page read and write
1D24A000
heap
page read and write
4611000
heap
page read and write
345F000
stack
page read and write
395F000
stack
page read and write
6F871000
unkown
page execute read
1D20F000
heap
page read and write
292CA000
heap
page read and write
34E000
unkown
page execute and read and write
4A50000
trusted library allocation
page read and write
4611000
heap
page read and write
2E1F000
stack
page read and write
4600000
direct allocation
page read and write
2A9E000
stack
page read and write
1D22B000
heap
page read and write
3C1E000
stack
page read and write
61ED0000
direct allocation
page read and write
1D21A000
heap
page read and write
3E5F000
stack
page read and write
C6E000
stack
page read and write
1D234000
heap
page read and write
77C000
unkown
page execute and read and write
1D230000
heap
page read and write
175000
unkown
page execute and read and write
1D226000
heap
page read and write
77D000
unkown
page execute and write copy
4611000
heap
page read and write
3F9F000
stack
page read and write
4600000
direct allocation
page read and write
1D234000
heap
page read and write
3D1F000
stack
page read and write
4AA0000
direct allocation
page read and write
1D22B000
heap
page read and write
45E0000
heap
page read and write
1D22B000
heap
page read and write
4611000
heap
page read and write
61ED3000
direct allocation
page read and write
1D228000
heap
page read and write
1D219000
heap
page read and write
1D24B000
heap
page read and write
4600000
direct allocation
page read and write
1D22F000
heap
page read and write
1D234000
heap
page read and write
1D222000
heap
page read and write
1CDCF000
stack
page read and write
1D242000
heap
page read and write
1D234000
heap
page read and write
B3D000
stack
page read and write
4611000
heap
page read and write
1D221000
heap
page read and write
4611000
heap
page read and write
1D222000
heap
page read and write
2F9E000
stack
page read and write
29511000
heap
page read and write
4AA0000
direct allocation
page read and write
4611000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D24B000
heap
page read and write
4611000
heap
page read and write
1D24B000
heap
page read and write
5D7000
unkown
page execute and read and write
1D234000
heap
page read and write
4611000
heap
page read and write
2936E000
stack
page read and write
D43000
heap
page read and write
4610000
heap
page read and write
4611000
heap
page read and write
1D230000
heap
page read and write
2BB000
unkown
page execute and read and write
4611000
heap
page read and write
6C81F000
unkown
page write copy
4C10000
direct allocation
page execute and read and write
6C7DF000
unkown
page readonly
4630000
heap
page read and write
3A9F000
stack
page read and write
BF0000
heap
page read and write
281E000
stack
page read and write
4611000
heap
page read and write
BF7000
heap
page read and write
61E01000
direct allocation
page execute read
3BDF000
stack
page read and write
385E000
stack
page read and write
4611000
heap
page read and write
1CF1C000
stack
page read and write
29261000
heap
page read and write
4611000
heap
page read and write
4C40000
direct allocation
page execute and read and write
1D05E000
stack
page read and write
2B9F000
stack
page read and write
381F000
stack
page read and write
399E000
stack
page read and write
1CF5D000
stack
page read and write
1D234000
heap
page read and write
1AD000
unkown
page execute and read and write
4611000
heap
page read and write
2F5F000
stack
page read and write
1D229000
heap
page read and write
1D221000
heap
page read and write
4611000
heap
page read and write
1D242000
heap
page read and write
1D21A000
heap
page read and write
331F000
stack
page read and write
6C825000
unkown
page readonly
31DF000
stack
page read and write
182000
unkown
page execute and read and write
1D229000
heap
page read and write
1D234000
heap
page read and write
4600000
direct allocation
page read and write
1D229000
heap
page read and write
1D242000
heap
page read and write
4600000
direct allocation
page read and write
4611000
heap
page read and write
4611000
heap
page read and write
4611000
heap
page read and write
4600000
direct allocation
page read and write
1CB6E000
stack
page read and write
335E000
stack
page read and write
1D24B000
heap
page read and write
23294000
heap
page read and write
4611000
heap
page read and write
1D234000
heap
page read and write
1D21A000
heap
page read and write
D17000
heap
page read and write
1D24B000
heap
page read and write
4611000
heap
page read and write
4611000
heap
page read and write
4600000
direct allocation
page read and write
1D0FE000
stack
page read and write
4C30000
direct allocation
page execute and read and write
1D226000
heap
page read and write
4611000
heap
page read and write
1D242000
heap
page read and write
4611000
heap
page read and write
4611000
heap
page read and write
2B5000
unkown
page execute and read and write
4611000
heap
page read and write
CB8000
heap
page read and write
295000
unkown
page execute and read and write
4611000
heap
page read and write
5E4000
unkown
page execute and read and write
4611000
heap
page read and write
20E000
unkown
page execute and read and write
4611000
heap
page read and write
411E000
stack
page read and write
4611000
heap
page read and write
2CDF000
stack
page read and write
B70000
heap
page read and write
4611000
heap
page read and write
17F000
unkown
page execute and read and write
4611000
heap
page read and write
4620000
heap
page read and write
4611000
heap
page read and write
45DF000
stack
page read and write
CB0000
heap
page read and write
4611000
heap
page read and write
1C9EF000
stack
page read and write
1FF000
unkown
page execute and read and write
439E000
stack
page read and write
1A1000
unkown
page execute and read and write
4611000
heap
page read and write
1D228000
heap
page read and write
6F902000
unkown
page readonly
20B000
unkown
page execute and read and write
1D320000
trusted library allocation
page read and write
4611000
heap
page read and write
1D24B000
heap
page read and write
2E5E000
stack
page read and write
2D1E000
stack
page read and write
4611000
heap
page read and write
2BDE000
stack
page read and write
4611000
heap
page read and write
1D229000
heap
page read and write
29517000
heap
page read and write
4D5000
unkown
page execute and read and write
1D327000
heap
page read and write
29240000
heap
page read and write
1D21C000
heap
page read and write
4C2E000
stack
page read and write
1D22E000
heap
page read and write
29509000
heap
page read and write
35DE000
stack
page read and write
29513000
heap
page read and write
4611000
heap
page read and write
44DE000
stack
page read and write
1D234000
heap
page read and write
4611000
heap
page read and write
4611000
heap
page read and write
36DF000
stack
page read and write
4611000
heap
page read and write
1D229000
heap
page read and write
1D234000
heap
page read and write
29470000
trusted library allocation
page read and write
C20000
heap
page read and write
4611000
heap
page read and write
B33000
stack
page read and write
4611000
heap
page read and write
6C820000
unkown
page read and write
4611000
heap
page read and write
295C000
stack
page read and write
D01000
heap
page read and write
1D234000
heap
page read and write
4600000
direct allocation
page read and write
178000
unkown
page execute and read and write
F0000
unkown
page readonly
309F000
stack
page read and write
1D22F000
heap
page read and write
2946F000
stack
page read and write
1D24D000
heap
page read and write
33A000
unkown
page execute and read and write
4C20000
direct allocation
page execute and read and write
5E4000
unkown
page execute and write copy
6C81E000
unkown
page read and write
4611000
heap
page read and write
4611000
heap
page read and write
A3C000
stack
page read and write
CAE000
stack
page read and write
4611000
heap
page read and write
4611000
heap
page read and write
4600000
direct allocation
page read and write
4611000
heap
page read and write
2950B000
heap
page read and write
321E000
stack
page read and write
4611000
heap
page read and write
4600000
direct allocation
page read and write
C10000
heap
page read and write
BFE000
heap
page read and write
4611000
heap
page read and write
1D24D000
heap
page read and write
1D229000
heap
page read and write
B60000
heap
page read and write
1D234000
heap
page read and write
1D234000
heap
page read and write
6C641000
unkown
page execute read
4611000
heap
page read and write
1D229000
heap
page read and write
1CA2E000
stack
page read and write
449F000
stack
page read and write
61EB7000
direct allocation
page readonly
1CB2F000
stack
page read and write
1D234000
heap
page read and write
4611000
heap
page read and write
1D206000
heap
page read and write
1D248000
heap
page read and write
1D21A000
heap
page read and write
1D234000
heap
page read and write
F0000
unkown
page read and write
4C20000
direct allocation
page execute and read and write
4611000
heap
page read and write
4600000
direct allocation
page read and write
4C00000
direct allocation
page execute and read and write
1D200000
heap
page read and write
40DF000
stack
page read and write
B39000
stack
page read and write
1D234000
heap
page read and write
3D5E000
stack
page read and write
F1000
unkown
page execute and write copy
4611000
heap
page read and write
BDE000
stack
page read and write
1CE1E000
stack
page read and write
425E000
stack
page read and write
3E9E000
stack
page read and write
1D24F000
heap
page read and write
1D24F000
heap
page read and write
4611000
heap
page read and write
4611000
heap
page read and write
1CCCE000
stack
page read and write
4600000
direct allocation
page read and write
4611000
heap
page read and write
359F000
stack
page read and write
1D229000
heap
page read and write
421F000
stack
page read and write
1D234000
heap
page read and write
1D21A000
heap
page read and write
1D21A000
heap
page read and write
1D1FD000
stack
page read and write
1D242000
heap
page read and write
4BF0000
direct allocation
page execute and read and write
61ECD000
direct allocation
page readonly
4611000
heap
page read and write
6F8FE000
unkown
page read and write
D4E000
heap
page read and write
1D234000
heap
page read and write
3FDE000
stack
page read and write
BFB000
heap
page read and write
4C50000
direct allocation
page execute and read and write
291F000
stack
page read and write
4611000
heap
page read and write
There are 329 hidden memdumps, click here to show them.