IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BKJJJDHD
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CFIECBFIDGDAKFHIEHJK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DAKJDAAF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EHIIIJDAAAAAAKECBFBAEBKJJJ
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FHIDAFHCBAKFCAAKFCFCFIIJKF
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\GCFHDAKECFIDGDGDBKJD
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\JJJEBGDAFHJEBGDGIJDH
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KJEHCGDBFCBAKECBKKEBKEBFCA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/a
unknown
 malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllE
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phphN
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllW
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php_
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37m
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll-
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpus.wallet
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpI
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpH
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllw
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpEBGDAFHJEBGDGIJDH
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php9
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpHDAKECFIDGDGDBKJD
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php)
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpECBFIDGDAKFHIEHJK
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 50 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
5230000
direct allocation
page read and write
 malicious
891000
unkown
page execute and read and write
 malicious
140E000
heap
page read and write
 malicious
29880000
heap
page read and write
FF4000
heap
page read and write
FF4000
heap
page read and write
4DA1000
heap
page read and write
4C8E000
stack
page read and write
FF4000
heap
page read and write
FF4000
heap
page read and write
5380000
direct allocation
page execute and read and write
1D890000
heap
page read and write
1D89D000
heap
page read and write
1D8A9000
heap
page read and write
1D88D000
heap
page read and write
1D8A5000
heap
page read and write
1D89E000
heap
page read and write
4DA1000
heap
page read and write
4DA1000
heap
page read and write
4D90000
direct allocation
page read and write
1D89C000
heap
page read and write
FF4000
heap
page read and write
4DA1000
heap
page read and write
5230000
direct allocation
page read and write
5390000
direct allocation
page execute and read and write
29B75000
heap
page read and write
4D90000
direct allocation
page read and write
4DA1000
heap
page read and write
1D885000
heap
page read and write
4DA1000
heap
page read and write
4DA1000
heap
page read and write
4B4E000
stack
page read and write
1D890000
heap
page read and write
144F000
heap
page read and write
4DA1000
heap
page read and write
1D8AC000
heap
page read and write
44FE000
stack
page read and write
1D890000
heap
page read and write
1D876000
heap
page read and write
1D885000
heap
page read and write
1D890000
heap
page read and write
53B0000
direct allocation
page execute and read and write
536F000
stack
page read and write
4DA1000
heap
page read and write
1D88B000
heap
page read and write
FF4000
heap
page read and write
29B6D000
heap
page read and write
383F000
stack
page read and write
1D887000
heap
page read and write
1D89B000
heap
page read and write
FF4000
heap
page read and write
1D8A9000
heap
page read and write
4DA1000
heap
page read and write
FF4000
heap
page read and write
4D8F000
stack
page read and write
4D90000
direct allocation
page read and write
333F000
stack
page read and write
FF4000
heap
page read and write
FF4000
heap
page read and write
FF4000
heap
page read and write
FF4000
heap
page read and write
34BE000
stack
page read and write
FF4000
heap
page read and write
298A0000
heap
page read and write
4DA1000
heap
page read and write
35BF000
stack
page read and write
4DB0000
heap
page read and write
4DA1000
heap
page read and write
427E000
stack
page read and write
347F000
stack
page read and write
4D90000
direct allocation
page read and write
A5B000
unkown
page execute and read and write
FF4000
heap
page read and write
F2B000
unkown
page execute and write copy
1D8A2000
heap
page read and write
1D5BE000
stack
page read and write
1D6FD000
stack
page read and write
FF4000
heap
page read and write
337E000
stack
page read and write
890000
unkown
page read and write
4DA1000
heap
page read and write
1D8A9000
heap
page read and write
4C4F000
stack
page read and write
91F000
unkown
page execute and read and write
4DA1000
heap
page read and write
4DA1000
heap
page read and write
1D890000
heap
page read and write
6C81F000
unkown
page readonly
4DA1000
heap
page read and write
4DA1000
heap
page read and write
FF4000
heap
page read and write
1D885000
heap
page read and write
2FEB000
stack
page read and write
1D885000
heap
page read and write
D8F000
unkown
page execute and write copy
1D882000
heap
page read and write
1D2EF000
stack
page read and write
4DA1000
heap
page read and write
1D8A9000
heap
page read and write
5230000
direct allocation
page read and write
29B7B000
heap
page read and write
1D32E000
stack
page read and write
44BF000
stack
page read and write
4DA1000
heap
page read and write
1D890000
heap
page read and write
29AD0000
trusted library allocation
page read and write
FF4000
heap
page read and write
298C0000
heap
page read and write
1D890000
heap
page read and write
C71000
unkown
page execute and read and write
1D88C000
heap
page read and write
4D90000
direct allocation
page read and write
1D893000
heap
page read and write
1D887000
heap
page read and write
4DA1000
heap
page read and write
1D89D000
heap
page read and write
1D8A9000
heap
page read and write
4DA1000
heap
page read and write
5210000
heap
page read and write
FF4000
heap
page read and write
4D90000
direct allocation
page read and write
1D8AA000
heap
page read and write
9AE000
unkown
page execute and read and write
2FAE000
stack
page read and write
1D8AC000
heap
page read and write
1D88C000
heap
page read and write
FF4000
heap
page read and write
A35000
unkown
page execute and read and write
4DA1000
heap
page read and write
1D42F000
stack
page read and write
4DA0000
heap
page read and write
4DA1000
heap
page read and write
3AFE000
stack
page read and write
2FFB000
heap
page read and write
4DA1000
heap
page read and write
FF4000
heap
page read and write
61ED0000
direct allocation
page read and write
1D876000
heap
page read and write
4B0F000
stack
page read and write
2FF7000
heap
page read and write
6C85E000
unkown
page read and write
4DA1000
heap
page read and write
4DA1000
heap
page read and write
FF4000
heap
page read and write
61ED4000
direct allocation
page readonly
FF4000
heap
page read and write
1D885000
heap
page read and write
4DA1000
heap
page read and write
1D6BD000
stack
page read and write
423F000
stack
page read and write
D8E000
unkown
page execute and write copy
3C3E000
stack
page read and write
1D8AC000
heap
page read and write
4DA1000
heap
page read and write
1D89C000
heap
page read and write
323E000
stack
page read and write
3FFE000
stack
page read and write
4DA1000
heap
page read and write
4DA1000
heap
page read and write
AEE000
unkown
page execute and read and write
4DA1000
heap
page read and write
2FF0000
heap
page read and write
51E0000
trusted library allocation
page read and write
FF4000
heap
page read and write
4DA1000
heap
page read and write
1D1AF000
stack
page read and write
ADA000
unkown
page execute and read and write
49BF000
stack
page read and write
1D887000
heap
page read and write
387E000
stack
page read and write
6C860000
unkown
page read and write
FF4000
heap
page read and write
1D88D000
heap
page read and write
1D890000
heap
page read and write
4DA1000
heap
page read and write
35FE000
stack
page read and write
941000
unkown
page execute and read and write
36FF000
stack
page read and write
4DA1000
heap
page read and write
1D893000
heap
page read and write
61ED3000
direct allocation
page read and write
1D7FC000
stack
page read and write
6C85F000
unkown
page write copy
4DA1000
heap
page read and write
53D0000
direct allocation
page execute and read and write
1D897000
heap
page read and write
94D000
unkown
page execute and read and write
1D876000
heap
page read and write
97F000
unkown
page execute and read and write
1D8A9000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1D893000
heap
page read and write
29B71000
heap
page read and write
1D885000
heap
page read and write
61ECD000
direct allocation
page readonly
487F000
stack
page read and write
1D86B000
heap
page read and write
FF4000
heap
page read and write
1D890000
heap
page read and write
FF4000
heap
page read and write
1D0AE000
stack
page read and write
473F000
stack
page read and write
12F8000
stack
page read and write
6C865000
unkown
page readonly
53B0000
direct allocation
page execute and read and write
4DA1000
heap
page read and write
FF4000
heap
page read and write
477E000
stack
page read and write
FF4000
heap
page read and write
1D860000
heap
page read and write
1D88D000
heap
page read and write
29B69000
heap
page read and write
A55000
unkown
page execute and read and write
915000
unkown
page execute and read and write
1D890000
heap
page read and write
413E000
stack
page read and write
238F6000
heap
page read and write
1D890000
heap
page read and write
1D88C000
heap
page read and write
3E7F000
stack
page read and write
61E01000
direct allocation
page execute read
D52000
unkown
page execute and read and write
1400000
heap
page read and write
1D8A9000
heap
page read and write
1D89D000
heap
page read and write
4DA1000
heap
page read and write
4DA1000
heap
page read and write
43BE000
stack
page read and write
FF4000
heap
page read and write
4DC0000
heap
page read and write
FF4000
heap
page read and write
1D890000
heap
page read and write
1D876000
heap
page read and write
16AE000
stack
page read and write
1482000
heap
page read and write
FBC000
stack
page read and write
4DA1000
heap
page read and write
31FF000
stack
page read and write
1D56F000
stack
page read and write
6F8FE000
unkown
page read and write
12F3000
stack
page read and write
1D890000
heap
page read and write
6C680000
unkown
page readonly
1D8AC000
heap
page read and write
1D896000
heap
page read and write
918000
unkown
page execute and read and write
4DA1000
heap
page read and write
45FF000
stack
page read and write
6F8ED000
unkown
page readonly
1D890000
heap
page read and write
437F000
stack
page read and write
FF4000
heap
page read and write
4D90000
direct allocation
page read and write
922000
unkown
page execute and read and write
1D862000
heap
page read and write
D7E000
unkown
page execute and read and write
526B000
stack
page read and write
4D90000
direct allocation
page read and write
1D888000
heap
page read and write
1D885000
heap
page read and write
FF0000
heap
page read and write
299BE000
stack
page read and write
6F902000
unkown
page readonly
1D885000
heap
page read and write
4D90000
direct allocation
page read and write
4DA1000
heap
page read and write
373E000
stack
page read and write
1D88D000
heap
page read and write
166E000
stack
page read and write
4D90000
direct allocation
page read and write
1D890000
heap
page read and write
3ABF000
stack
page read and write
890000
unkown
page readonly
FF4000
heap
page read and write
1D1EE000
stack
page read and write
1D89B000
heap
page read and write
6F871000
unkown
page execute read
3D7E000
stack
page read and write
1D887000
heap
page read and write
9AB000
unkown
page execute and read and write
4DA1000
heap
page read and write
1D882000
heap
page read and write
FF4000
heap
page read and write
397F000
stack
page read and write
4A0E000
stack
page read and write
6F870000
unkown
page readonly
4D90000
direct allocation
page read and write
1D88C000
heap
page read and write
4DA1000
heap
page read and write
FF4000
heap
page read and write
2992B000
heap
page read and write
4DA1000
heap
page read and write
99F000
unkown
page execute and read and write
1D89C000
heap
page read and write
4DA1000
heap
page read and write
1D8A9000
heap
page read and write
3EBE000
stack
page read and write
4DA1000
heap
page read and write
F2A000
unkown
page execute and read and write
4DA1000
heap
page read and write
4DA1000
heap
page read and write
17AE000
stack
page read and write
D8E000
unkown
page execute and read and write
1D876000
heap
page read and write
29860000
heap
page read and write
1D875000
heap
page read and write
29ABF000
stack
page read and write
39BE000
stack
page read and write
61EB4000
direct allocation
page read and write
1D89C000
heap
page read and write
1D89B000
heap
page read and write
1408000
heap
page read and write
1D884000
heap
page read and write
4D90000
direct allocation
page read and write
4DA1000
heap
page read and write
4DA1000
heap
page read and write
1451000
heap
page read and write
D77000
unkown
page execute and read and write
61EB7000
direct allocation
page readonly
FF4000
heap
page read and write
1466000
heap
page read and write
3BFF000
stack
page read and write
1D46E000
stack
page read and write
53A0000
direct allocation
page execute and read and write
972000
unkown
page execute and read and write
2FFE000
heap
page read and write
8EA000
unkown
page execute and read and write
53C0000
direct allocation
page execute and read and write
1320000
heap
page read and write
1D890000
heap
page read and write
1D8A9000
heap
page read and write
1D882000
heap
page read and write
156E000
stack
page read and write
48BE000
stack
page read and write
61ECC000
direct allocation
page read and write
6C681000
unkown
page execute read
49C0000
heap
page read and write
4DA1000
heap
page read and write
3FBF000
stack
page read and write
40FF000
stack
page read and write
1D890000
heap
page read and write
4DA1000
heap
page read and write
4DA1000
heap
page read and write
1D8AC000
heap
page read and write
1D98D000
heap
page read and write
1D878000
heap
page read and write
1D890000
heap
page read and write
4D90000
direct allocation
page read and write
1D887000
heap
page read and write
4DA1000
heap
page read and write
FF4000
heap
page read and write
4DA1000
heap
page read and write
1D8A5000
heap
page read and write
4DA1000
heap
page read and write
1D980000
trusted library allocation
page read and write
30FF000
stack
page read and write
4DA1000
heap
page read and write
891000
unkown
page execute and write copy
4DA1000
heap
page read and write
4D90000
direct allocation
page read and write
463E000
stack
page read and write
FF4000
heap
page read and write
3D3F000
stack
page read and write
1500000
heap
page read and write
12FD000
stack
page read and write
4DA1000
heap
page read and write
There are 356 hidden memdumps, click here to show them.