IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFBFHDBKJEGHJJJKFIIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BAAAAKJKJEBGHJKFHIDGCFCBAK
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\BKJEGDGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FCBAECGI
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GCGCFCBAKKFBFIECAEBAEBGCGD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HCFIIIJJKJKFHIDGDBAKJEBKEG
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HJEHIJEBKEBFBFHIIDHI
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JKKFIIEBKEGIEBFIJKFI
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://185.215.113.37/_
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
unknown
http://185.215.113.37e2b1563c6670f193.phption:
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.215.113.37/e2b1563c6670f193.phpy
unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dlla
unknown
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllm
unknown
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
http://185.215.113.37/e2b1563c6670f193.phpd
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://185.215.113.37n
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll7
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllA
unknown
http://185.215.113.37/e2b1563c6670f193.phpH
unknown
http://185.215.113.37/e2b1563c6670f193.phpG
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllw
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://185.215.113.37/e2b1563c6670f193.php7
unknown
http://185.215.113.37/e2b1563c6670f193.phpsimple-storage.jsonV
unknown
http://185.215.113.37/e2b1563c6670f193.phpFirefox
unknown
https://support.mozilla.org
unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll7
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.215.113.37/e2b1563c6670f193.php(
unknown
There are 49 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
FBE000
heap
page read and write
 malicious
4E50000
direct allocation
page read and write
 malicious
4A1000
unkown
page execute and read and write
 malicious
1D495000
heap
page read and write
49C1000
heap
page read and write
1D4A0000
heap
page read and write
1D485000
heap
page read and write
1D49C000
heap
page read and write
1D4A0000
heap
page read and write
2963D000
heap
page read and write
1D40D000
stack
page read and write
1D4AB000
heap
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
61E01000
direct allocation
page execute read
4A0000
unkown
page readonly
1D4AE000
heap
page read and write
1D495000
heap
page read and write
1D497000
heap
page read and write
438E000
stack
page read and write
1D49C000
heap
page read and write
49C1000
heap
page read and write
1D4B9000
heap
page read and write
29645000
heap
page read and write
1D4A0000
heap
page read and write
1D495000
heap
page read and write
EF3000
stack
page read and write
1D4AC000
heap
page read and write
358F000
stack
page read and write
398E000
stack
page read and write
55D000
unkown
page execute and read and write
49B0000
direct allocation
page read and write
1D49D000
heap
page read and write
49B0000
direct allocation
page read and write
49C1000
heap
page read and write
551000
unkown
page execute and read and write
1D495000
heap
page read and write
5BB000
unkown
page execute and read and write
1D4A0000
heap
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
10B0000
heap
page read and write
FB8000
heap
page read and write
4FB0000
direct allocation
page execute and read and write
49B0000
direct allocation
page read and write
49B0000
direct allocation
page read and write
6C681000
unkown
page execute read
49C1000
heap
page read and write
1D30D000
stack
page read and write
49C1000
heap
page read and write
1D4B9000
heap
page read and write
F20000
heap
page read and write
3E4F000
stack
page read and write
49C1000
heap
page read and write
31CF000
stack
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
49B0000
direct allocation
page read and write
49B0000
direct allocation
page read and write
49C7000
heap
page read and write
1D486000
heap
page read and write
10C0000
heap
page read and write
2963A000
heap
page read and write
1D4B2000
heap
page read and write
58F000
unkown
page execute and read and write
4FA0000
direct allocation
page execute and read and write
49C1000
heap
page read and write
1CEDF000
stack
page read and write
49C1000
heap
page read and write
6F8FE000
unkown
page read and write
980000
unkown
page execute and read and write
2F8E000
stack
page read and write
1D4B5000
heap
page read and write
1CF1D000
stack
page read and write
532000
unkown
page execute and read and write
40CF000
stack
page read and write
1D4B9000
heap
page read and write
380F000
stack
page read and write
49B0000
direct allocation
page read and write
5AF000
unkown
page execute and read and write
6C85E000
unkown
page read and write
4FD0000
direct allocation
page execute and read and write
1CDDE000
stack
page read and write
98E000
unkown
page execute and write copy
1D1CD000
stack
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
B23000
unkown
page execute and read and write
2F4F000
stack
page read and write
49C1000
heap
page read and write
1D495000
heap
page read and write
49B0000
direct allocation
page read and write
49C1000
heap
page read and write
6C85F000
unkown
page write copy
420F000
stack
page read and write
29532000
heap
page read and write
10CB000
heap
page read and write
49C1000
heap
page read and write
6EA000
unkown
page execute and read and write
873000
unkown
page execute and read and write
1D4B5000
heap
page read and write
2BCE000
stack
page read and write
49C1000
heap
page read and write
1D4BC000
heap
page read and write
1D4AB000
heap
page read and write
6F870000
unkown
page readonly
1D4A0000
heap
page read and write
49C1000
heap
page read and write
3C0E000
stack
page read and write
1D4BC000
heap
page read and write
4FC0000
direct allocation
page execute and read and write
49C1000
heap
page read and write
13EF000
stack
page read and write
49C1000
heap
page read and write
4A1000
unkown
page execute and write copy
1D49C000
heap
page read and write
3BCF000
stack
page read and write
5BE000
unkown
page execute and read and write
474E000
stack
page read and write
49D0000
heap
page read and write
1D07E000
stack
page read and write
49B0000
direct allocation
page read and write
3F8F000
stack
page read and write
49C1000
heap
page read and write
1D495000
heap
page read and write
49C1000
heap
page read and write
1D47B000
heap
page read and write
525000
unkown
page execute and read and write
49C1000
heap
page read and write
4FE0000
direct allocation
page execute and read and write
1D4A0000
heap
page read and write
1D49D000
heap
page read and write
1D498000
heap
page read and write
370E000
stack
page read and write
3FCE000
stack
page read and write
1D4A3000
heap
page read and write
6F902000
unkown
page readonly
1D4AB000
heap
page read and write
6F8ED000
unkown
page readonly
528000
unkown
page execute and read and write
F10000
heap
page read and write
1D4B9000
heap
page read and write
FB0000
heap
page read and write
3ACE000
stack
page read and write
1D472000
heap
page read and write
470F000
stack
page read and write
460E000
stack
page read and write
4FF0000
direct allocation
page execute and read and write
4E8C000
stack
page read and write
49C1000
heap
page read and write
1D4A0000
heap
page read and write
1D4A0000
heap
page read and write
49C1000
heap
page read and write
61EB7000
direct allocation
page readonly
1D4A0000
heap
page read and write
49C1000
heap
page read and write
6FE000
unkown
page execute and read and write
1D497000
heap
page read and write
582000
unkown
page execute and read and write
394F000
stack
page read and write
1D4A0000
heap
page read and write
6C865000
unkown
page readonly
61ED4000
direct allocation
page readonly
448F000
stack
page read and write
B24000
unkown
page execute and write copy
23503000
heap
page read and write
BBC000
stack
page read and write
1D497000
heap
page read and write
484F000
stack
page read and write
49E0000
heap
page read and write
EF9000
stack
page read and write
49C1000
heap
page read and write
4F8F000
stack
page read and write
1D4B9000
heap
page read and write
61ECC000
direct allocation
page read and write
EFD000
stack
page read and write
10D0000
heap
page read and write
49C1000
heap
page read and write
49B0000
direct allocation
page read and write
49B0000
direct allocation
page read and write
49C1000
heap
page read and write
F8D000
stack
page read and write
4A0000
unkown
page read and write
49C1000
heap
page read and write
12AE000
stack
page read and write
6F871000
unkown
page execute read
49C1000
heap
page read and write
1D2CD000
stack
page read and write
1D4B9000
heap
page read and write
29543000
heap
page read and write
49C1000
heap
page read and write
61ED3000
direct allocation
page read and write
61ECD000
direct allocation
page readonly
645000
unkown
page execute and read and write
1D4AD000
heap
page read and write
344F000
stack
page read and write
1D594000
heap
page read and write
294D1000
heap
page read and write
1D4A0000
heap
page read and write
49C1000
heap
page read and write
1D492000
heap
page read and write
1D495000
heap
page read and write
1D4AD000
heap
page read and write
66B000
unkown
page execute and read and write
49C1000
heap
page read and write
29470000
heap
page read and write
98E000
unkown
page execute and read and write
5000000
direct allocation
page execute and read and write
1D495000
heap
page read and write
49C1000
heap
page read and write
498F000
stack
page read and write
44CE000
stack
page read and write
1D4A0000
heap
page read and write
1D4B9000
heap
page read and write
49C1000
heap
page read and write
30CE000
stack
page read and write
52F000
unkown
page execute and read and write
4E50000
direct allocation
page read and write
12EE000
stack
page read and write
320E000
stack
page read and write
334E000
stack
page read and write
1D4A0000
heap
page read and write
1D49B000
heap
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
49B0000
direct allocation
page read and write
49C1000
heap
page read and write
665000
unkown
page execute and read and write
2D0C000
stack
page read and write
45CF000
stack
page read and write
49C0000
heap
page read and write
1D492000
heap
page read and write
49C1000
heap
page read and write
1D4A0000
heap
page read and write
49C1000
heap
page read and write
10CE000
heap
page read and write
4AC0000
trusted library allocation
page read and write
1D4BC000
heap
page read and write
1D4AC000
heap
page read and write
2CCF000
stack
page read and write
36CF000
stack
page read and write
1041000
heap
page read and write
49C1000
heap
page read and write
3D0F000
stack
page read and write
1D486000
heap
page read and write
1D488000
heap
page read and write
10C7000
heap
page read and write
1D4BA000
heap
page read and write
49C1000
heap
page read and write
4FD0000
direct allocation
page execute and read and write
49C1000
heap
page read and write
3A8F000
stack
page read and write
1D486000
heap
page read and write
49C1000
heap
page read and write
101A000
heap
page read and write
61EB4000
direct allocation
page read and write
1D49D000
heap
page read and write
61E00000
direct allocation
page execute and read and write
6C81F000
unkown
page readonly
49C1000
heap
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
49B0000
direct allocation
page read and write
488E000
stack
page read and write
1D01F000
stack
page read and write
35CE000
stack
page read and write
98F000
unkown
page execute and write copy
49C1000
heap
page read and write
308F000
stack
page read and write
3E8E000
stack
page read and write
1D4B9000
heap
page read and write
1D492000
heap
page read and write
1D486000
heap
page read and write
49B0000
direct allocation
page read and write
348E000
stack
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
1D4A0000
heap
page read and write
29632000
heap
page read and write
1D4B9000
heap
page read and write
49C1000
heap
page read and write
2E4E000
stack
page read and write
4FDE000
stack
page read and write
10D5000
heap
page read and write
1D590000
trusted library allocation
page read and write
29490000
heap
page read and write
424E000
stack
page read and write
6C680000
unkown
page readonly
4E50000
direct allocation
page read and write
49C1000
heap
page read and write
1CD9F000
stack
page read and write
1D49C000
heap
page read and write
1D17F000
stack
page read and write
1D486000
heap
page read and write
1D4BC000
heap
page read and write
1D4A7000
heap
page read and write
49C1000
heap
page read and write
6C860000
unkown
page read and write
1D4A0000
heap
page read and write
29640000
heap
page read and write
4990000
heap
page read and write
410E000
stack
page read and write
1033000
heap
page read and write
1D4A6000
heap
page read and write
1D4A0000
heap
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
61ED0000
direct allocation
page read and write
49C1000
heap
page read and write
49C1000
heap
page read and write
1D4AC000
heap
page read and write
2E0F000
stack
page read and write
49C1000
heap
page read and write
1D4A3000
heap
page read and write
434F000
stack
page read and write
951000
unkown
page execute and read and write
295A0000
trusted library allocation
page read and write
1D4A0000
heap
page read and write
49C1000
heap
page read and write
1D4AD000
heap
page read and write
1004000
heap
page read and write
1D4AC000
heap
page read and write
330F000
stack
page read and write
1D4BC000
heap
page read and write
49C1000
heap
page read and write
973000
unkown
page execute and read and write
3D4E000
stack
page read and write
49C1000
heap
page read and write
1D49D000
heap
page read and write
1D497000
heap
page read and write
49C1000
heap
page read and write
384E000
stack
page read and write
49C1000
heap
page read and write
1D4A3000
heap
page read and write
1D470000
heap
page read and write
49C1000
heap
page read and write
1D494000
heap
page read and write
1D497000
heap
page read and write
294B0000
heap
page read and write
4FA000
unkown
page execute and read and write
There are 332 hidden memdumps, click here to show them.