IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAEBAKKJKKEBKFIDBFBA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\AFHDAEGHDGDBGDGDAAFI
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BKECBAKF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CAKKJKKECFIDGDHIJEGDAKFBFB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CBFBKFIDHIDGHJKFBGHCFIEHJD
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EGHCAKKEGCAAFHJJJDBK
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\KFBGCAKF
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 12 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpc=0f
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnfigOverlay
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllu
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpBR
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37DJ
unknown
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpq
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phps
unknown
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpU1R
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpY
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpic
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllg
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll9
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpus.wallet
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpH
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php1
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpogZf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpER
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpesSf
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllb
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 50 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4E90000
direct allocation
page read and write
 malicious
133E000
heap
page read and write
 malicious
691000
unkown
page execute and read and write
 malicious
1D4B4000
heap
page read and write
1D4C0000
heap
page read and write
2C0E000
stack
page read and write
85B000
unkown
page execute and read and write
61ECD000
direct allocation
page readonly
4A11000
heap
page read and write
414E000
stack
page read and write
1D4BB000
heap
page read and write
1D4D9000
heap
page read and write
418E000
stack
page read and write
1D19F000
stack
page read and write
4A15000
heap
page read and write
4A11000
heap
page read and write
5000000
direct allocation
page execute and read and write
3C4F000
stack
page read and write
62D000
stack
page read and write
1D4D5000
heap
page read and write
1D4C7000
heap
page read and write
295EE000
stack
page read and write
4A11000
heap
page read and write
1D4CB000
heap
page read and write
1D4BC000
heap
page read and write
2D50000
direct allocation
page read and write
718000
unkown
page execute and read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
1D4B7000
heap
page read and write
33CE000
stack
page read and write
B91000
unkown
page execute and read and write
294F1000
heap
page read and write
12DE000
stack
page read and write
1D4C0000
heap
page read and write
3B0F000
stack
page read and write
4A11000
heap
page read and write
8DA000
unkown
page execute and read and write
2ECE000
stack
page read and write
61ED3000
direct allocation
page read and write
1D4CD000
heap
page read and write
2D50000
direct allocation
page read and write
4A11000
heap
page read and write
374F000
stack
page read and write
680000
heap
page read and write
4A11000
heap
page read and write
74D000
unkown
page execute and read and write
1D4CC000
heap
page read and write
4A11000
heap
page read and write
2D0F000
stack
page read and write
3F0E000
stack
page read and write
1D4C3000
heap
page read and write
42CE000
stack
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
1D4D9000
heap
page read and write
1D4BC000
heap
page read and write
314E000
stack
page read and write
4FD0000
direct allocation
page execute and read and write
324F000
stack
page read and write
4A11000
heap
page read and write
1D4C0000
heap
page read and write
4A11000
heap
page read and write
428E000
stack
page read and write
1D4C0000
heap
page read and write
4A11000
heap
page read and write
500E000
stack
page read and write
3ECF000
stack
page read and write
2D8E000
heap
page read and write
61EB4000
direct allocation
page read and write
77F000
unkown
page execute and read and write
1D4B7000
heap
page read and write
1D4DC000
heap
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
1D4C0000
heap
page read and write
39CF000
stack
page read and write
11D0000
heap
page read and write
1D4C0000
heap
page read and write
6F871000
unkown
page execute read
1D4C0000
heap
page read and write
6EA000
unkown
page execute and read and write
2D4C000
stack
page read and write
4A11000
heap
page read and write
388F000
stack
page read and write
855000
unkown
page execute and read and write
61E00000
direct allocation
page execute and read and write
BA1000
unkown
page execute and write copy
1D4CB000
heap
page read and write
360F000
stack
page read and write
1D4B5000
heap
page read and write
1D4DC000
heap
page read and write
297AF000
heap
page read and write
6C85F000
unkown
page write copy
722000
unkown
page execute and read and write
3B4E000
stack
page read and write
1D4B5000
heap
page read and write
297AB000
heap
page read and write
4A11000
heap
page read and write
1D2ED000
stack
page read and write
1D4A6000
heap
page read and write
4A11000
heap
page read and write
3D8F000
stack
page read and write
4A11000
heap
page read and write
1D4C0000
heap
page read and write
4A10000
heap
page read and write
2D50000
direct allocation
page read and write
4A11000
heap
page read and write
2D70000
direct allocation
page read and write
454E000
stack
page read and write
1D4D9000
heap
page read and write
61ED0000
direct allocation
page read and write
297A7000
heap
page read and write
364E000
stack
page read and write
1D4D9000
heap
page read and write
5010000
direct allocation
page execute and read and write
1D32E000
stack
page read and write
4FE0000
direct allocation
page execute and read and write
715000
unkown
page execute and read and write
2D50000
direct allocation
page read and write
690000
unkown
page readonly
71F000
unkown
page execute and read and write
4A11000
heap
page read and write
1CDFE000
stack
page read and write
1D4A8000
heap
page read and write
61ED4000
direct allocation
page readonly
5000000
direct allocation
page execute and read and write
DBE000
stack
page read and write
2D87000
heap
page read and write
1419000
heap
page read and write
1D4B5000
heap
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
23526000
heap
page read and write
4A11000
heap
page read and write
3A0E000
stack
page read and write
691000
unkown
page execute and write copy
4A11000
heap
page read and write
4A11000
heap
page read and write
2D8B000
heap
page read and write
4E50000
trusted library allocation
page read and write
1CDBF000
stack
page read and write
4A11000
heap
page read and write
1D09E000
stack
page read and write
741000
unkown
page execute and read and write
1D4C0000
heap
page read and write
2D50000
direct allocation
page read and write
1310000
heap
page read and write
2D50000
direct allocation
page read and write
4A11000
heap
page read and write
1D4CD000
heap
page read and write
1D4D9000
heap
page read and write
6C865000
unkown
page readonly
1D4BD000
heap
page read and write
A81000
unkown
page execute and read and write
4A11000
heap
page read and write
1D4D5000
heap
page read and write
4A11000
heap
page read and write
1D4C0000
heap
page read and write
835000
unkown
page execute and read and write
1D4CC000
heap
page read and write
4A11000
heap
page read and write
1D4B5000
heap
page read and write
4A11000
heap
page read and write
38CE000
stack
page read and write
1330000
heap
page read and write
1D4C0000
heap
page read and write
4A11000
heap
page read and write
13C0000
heap
page read and write
2D80000
heap
page read and write
4A11000
heap
page read and write
6F8ED000
unkown
page readonly
1D4CC000
heap
page read and write
4A11000
heap
page read and write
1D4DC000
heap
page read and write
52C000
stack
page read and write
350E000
stack
page read and write
490E000
stack
page read and write
1D4B5000
heap
page read and write
4A11000
heap
page read and write
13B4000
heap
page read and write
690000
unkown
page read and write
1D4B7000
heap
page read and write
61ECC000
direct allocation
page read and write
2D50000
direct allocation
page read and write
1D4BD000
heap
page read and write
48CF000
stack
page read and write
2D70000
direct allocation
page read and write
2D50000
direct allocation
page read and write
4FF0000
direct allocation
page execute and read and write
7AE000
unkown
page execute and read and write
2955A000
heap
page read and write
6C85E000
unkown
page read and write
6C81F000
unkown
page readonly
D4B000
unkown
page execute and read and write
1D4B5000
heap
page read and write
5020000
direct allocation
page execute and read and write
1D49B000
heap
page read and write
4A11000
heap
page read and write
BA0000
unkown
page execute and read and write
628000
stack
page read and write
1D4D9000
heap
page read and write
2D50000
direct allocation
page read and write
4A11000
heap
page read and write
310F000
stack
page read and write
1338000
heap
page read and write
7AB000
unkown
page execute and read and write
297A5000
heap
page read and write
61EB7000
direct allocation
page readonly
2E8F000
stack
page read and write
4A11000
heap
page read and write
1D5B0000
trusted library allocation
page read and write
29490000
heap
page read and write
1D4B2000
heap
page read and write
1CF3E000
stack
page read and write
1384000
heap
page read and write
4A11000
heap
page read and write
338F000
stack
page read and write
34CF000
stack
page read and write
1CEFF000
stack
page read and write
D50000
heap
page read and write
1D4BD000
heap
page read and write
6C681000
unkown
page execute read
4A11000
heap
page read and write
468E000
stack
page read and write
294D0000
heap
page read and write
1D4BC000
heap
page read and write
4A11000
heap
page read and write
1D4C3000
heap
page read and write
1D1EE000
stack
page read and write
DFD000
stack
page read and write
4A11000
heap
page read and write
1D4BD000
heap
page read and write
1D4A5000
heap
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
1D4BC000
heap
page read and write
300E000
stack
page read and write
4A11000
heap
page read and write
2979D000
heap
page read and write
1D4D9000
heap
page read and write
464F000
stack
page read and write
450F000
stack
page read and write
2D50000
direct allocation
page read and write
440E000
stack
page read and write
6F870000
unkown
page readonly
61E01000
direct allocation
page execute read
2D50000
direct allocation
page read and write
1D490000
heap
page read and write
1D4C0000
heap
page read and write
1D4CB000
heap
page read and write
2FCF000
stack
page read and write
1D4A6000
heap
page read and write
1D4B7000
heap
page read and write
6F8FE000
unkown
page read and write
6C860000
unkown
page read and write
1D4DC000
heap
page read and write
4A11000
heap
page read and write
6F902000
unkown
page readonly
328E000
stack
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
1D4C6000
heap
page read and write
1D4A6000
heap
page read and write
1D4C0000
heap
page read and write
4A11000
heap
page read and write
47CE000
stack
page read and write
4A11000
heap
page read and write
1D4A6000
heap
page read and write
4A11000
heap
page read and write
1D4DC000
heap
page read and write
1D4B5000
heap
page read and write
1D4C0000
heap
page read and write
1D42D000
stack
page read and write
1D4C0000
heap
page read and write
1D4CE000
heap
page read and write
1D4D9000
heap
page read and write
623000
stack
page read and write
4A11000
heap
page read and write
1D4D2000
heap
page read and write
4A11000
heap
page read and write
378E000
stack
page read and write
6C680000
unkown
page readonly
1D4B2000
heap
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
294B0000
heap
page read and write
2D50000
direct allocation
page read and write
4FCF000
stack
page read and write
2D50000
direct allocation
page read and write
1D4B2000
heap
page read and write
1D4A6000
heap
page read and write
29700000
trusted library allocation
page read and write
3DCE000
stack
page read and write
1D4CC000
heap
page read and write
4A30000
heap
page read and write
1381000
heap
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
1D03F000
stack
page read and write
B8A000
unkown
page execute and read and write
4A0F000
stack
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
772000
unkown
page execute and read and write
1D4B7000
heap
page read and write
1D5B6000
heap
page read and write
296EF000
stack
page read and write
1D4C0000
heap
page read and write
4A20000
heap
page read and write
1397000
heap
page read and write
1D492000
heap
page read and write
1D4CD000
heap
page read and write
3C8E000
stack
page read and write
404E000
stack
page read and write
BA0000
unkown
page execute and write copy
1D4C0000
heap
page read and write
2D50000
direct allocation
page read and write
1D4C3000
heap
page read and write
400F000
stack
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
B61000
unkown
page execute and read and write
4A11000
heap
page read and write
D4C000
unkown
page execute and write copy
1D4DA000
heap
page read and write
79F000
unkown
page execute and read and write
11D5000
heap
page read and write
1D4B5000
heap
page read and write
478F000
stack
page read and write
4A11000
heap
page read and write
4A11000
heap
page read and write
1D4B8000
heap
page read and write
4A11000
heap
page read and write
43CF000
stack
page read and write
1300000
heap
page read and write
8EE000
unkown
page execute and read and write
1D4C0000
heap
page read and write
4ECB000
stack
page read and write
1D4D9000
heap
page read and write
11CE000
stack
page read and write
There are 334 hidden memdumps, click here to show them.