IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\EHJKFCGHIDHCBGDHJKEB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FIECBFID
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IEHJDGIDBAAFIDGCGCAKKKFBFH
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\IIECFHDBAAECAAKFHDHIIJKFHJ
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IIIEBGCBGIDHDGCAKJEBAKJJKE
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IJKJDAFHJDHIEBGCFIDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KJKFBAFIDAEBFHJKJEBF
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 12 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpT=V
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpfr
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnt
unknown
 malicious
http://185.215.113.37/0d
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php;Cl
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll7
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllAE
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll-
unknown
 malicious
http://185.215.113.37nAEJ3o
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpicO
unknown
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpa
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllC
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpe
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllO
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpR
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFBAFIDAEBFHJKJEBF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpWiy
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllo
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllk
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlle
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpes
unknown
 malicious
http://185.215.113.37/1
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpFirefox
unknown
 malicious
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecopnacl
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://ac.ecop
unknown
There are 48 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4CB0000
direct allocation
page read and write
 malicious
EC1000
unkown
page execute and read and write
 malicious
A7E000
heap
page read and write
 malicious
1D2C8000
heap
page read and write
1D2B6000
heap
page read and write
4831000
heap
page read and write
F4F000
unkown
page execute and read and write
31EE000
stack
page read and write
1D2D0000
heap
page read and write
4830000
heap
page read and write
61ECD000
direct allocation
page readonly
1D2C7000
heap
page read and write
1D2DC000
heap
page read and write
1D2C2000
heap
page read and write
1D2CC000
heap
page read and write
4831000
heap
page read and write
1D2CD000
heap
page read and write
6C865000
unkown
page readonly
4831000
heap
page read and write
4831000
heap
page read and write
FDB000
unkown
page execute and read and write
2959F000
heap
page read and write
1D2C5000
heap
page read and write
4831000
heap
page read and write
1D2CB000
heap
page read and write
1D2C2000
heap
page read and write
A40000
direct allocation
page read and write
292B0000
heap
page read and write
1D2E9000
heap
page read and write
1D2C7000
heap
page read and write
482F000
stack
page read and write
2C6B000
heap
page read and write
1D2C2000
heap
page read and write
6C81F000
unkown
page readonly
4831000
heap
page read and write
61ECC000
direct allocation
page read and write
1383000
unkown
page execute and read and write
1D2D7000
heap
page read and write
3C0000
heap
page read and write
1D2D0000
heap
page read and write
342F000
stack
page read and write
292F4000
heap
page read and write
4831000
heap
page read and write
1CEAE000
stack
page read and write
8F0000
heap
page read and write
396E000
stack
page read and write
295A4000
heap
page read and write
356F000
stack
page read and write
4834000
heap
page read and write
29306000
heap
page read and write
6F8ED000
unkown
page readonly
108B000
unkown
page execute and read and write
29353000
heap
page read and write
1D2E9000
heap
page read and write
8F4000
heap
page read and write
6F8000
stack
page read and write
1D2B6000
heap
page read and write
6C85E000
unkown
page read and write
3AAE000
stack
page read and write
4831000
heap
page read and write
A40000
direct allocation
page read and write
2C3E000
stack
page read and write
8F4000
heap
page read and write
4831000
heap
page read and write
61E00000
direct allocation
page execute and read and write
4831000
heap
page read and write
B51000
heap
page read and write
1D2EC000
heap
page read and write
F45000
unkown
page execute and read and write
A3E000
stack
page read and write
1D2DB000
heap
page read and write
1065000
unkown
page execute and read and write
8F4000
heap
page read and write
1D2E2000
heap
page read and write
1D2D0000
heap
page read and write
1D2EA000
heap
page read and write
A40000
direct allocation
page read and write
1085000
unkown
page execute and read and write
8F4000
heap
page read and write
89E000
stack
page read and write
8F4000
heap
page read and write
8F4000
heap
page read and write
8F4000
heap
page read and write
A40000
direct allocation
page read and write
8F4000
heap
page read and write
306F000
stack
page read and write
31AF000
stack
page read and write
45AF000
stack
page read and write
1D2D0000
heap
page read and write
432F000
stack
page read and write
4DF0000
direct allocation
page execute and read and write
40EE000
stack
page read and write
8F4000
heap
page read and write
1D2D0000
heap
page read and write
8E0000
heap
page read and write
1D2D0000
heap
page read and write
1CBEF000
stack
page read and write
4DEF000
stack
page read and write
37EF000
stack
page read and write
1D3C0000
trusted library allocation
page read and write
A40000
direct allocation
page read and write
AD7000
heap
page read and write
1D2C7000
heap
page read and write
295AC000
heap
page read and write
FAF000
unkown
page execute and read and write
8F4000
heap
page read and write
F71000
unkown
page execute and read and write
8F4000
heap
page read and write
2C50000
direct allocation
page execute and read and write
61ED0000
direct allocation
page read and write
1D2E9000
heap
page read and write
1D2D3000
heap
page read and write
4DF0000
direct allocation
page execute and read and write
446F000
stack
page read and write
4831000
heap
page read and write
8F4000
heap
page read and write
FCF000
unkown
page execute and read and write
1D2EC000
heap
page read and write
1CAEE000
stack
page read and write
4831000
heap
page read and write
8F4000
heap
page read and write
1D2C5000
heap
page read and write
9FF000
stack
page read and write
8F4000
heap
page read and write
110A000
unkown
page execute and read and write
4831000
heap
page read and write
392F000
stack
page read and write
4831000
heap
page read and write
3BAF000
stack
page read and write
3B0000
heap
page read and write
8F4000
heap
page read and write
32EE000
stack
page read and write
4831000
heap
page read and write
FDE000
unkown
page execute and read and write
23330000
heap
page read and write
45EE000
stack
page read and write
4831000
heap
page read and write
41EF000
stack
page read and write
61EB4000
direct allocation
page read and write
1D2DC000
heap
page read and write
4831000
heap
page read and write
1D2A2000
heap
page read and write
EAE000
stack
page read and write
1D2C7000
heap
page read and write
2C6E000
heap
page read and write
1D23D000
stack
page read and write
1D13D000
stack
page read and write
1D2E9000
heap
page read and write
36EE000
stack
page read and write
4831000
heap
page read and write
61E01000
direct allocation
page execute read
1D2B5000
heap
page read and write
4831000
heap
page read and write
1D2DB000
heap
page read and write
1D2EC000
heap
page read and write
4831000
heap
page read and write
3A6F000
stack
page read and write
1D2C5000
heap
page read and write
1D2D0000
heap
page read and write
1558000
unkown
page execute and write copy
4831000
heap
page read and write
8F4000
heap
page read and write
F52000
unkown
page execute and read and write
4831000
heap
page read and write
422E000
stack
page read and write
6FD000
stack
page read and write
4831000
heap
page read and write
3E6E000
stack
page read and write
EC1000
unkown
page execute and write copy
111E000
unkown
page execute and read and write
1D2D0000
heap
page read and write
29599000
heap
page read and write
84D000
stack
page read and write
8F4000
heap
page read and write
EB0000
direct allocation
page execute and read and write
29500000
trusted library allocation
page read and write
8F4000
heap
page read and write
13BB000
unkown
page execute and read and write
4831000
heap
page read and write
2D6F000
stack
page read and write
4831000
heap
page read and write
2C40000
direct allocation
page execute and read and write
4831000
heap
page read and write
A60000
direct allocation
page read and write
332E000
stack
page read and write
1CD6E000
stack
page read and write
2F6F000
stack
page read and write
4831000
heap
page read and write
1D2E9000
heap
page read and write
1D2EC000
heap
page read and write
1D2C4000
heap
page read and write
13A5000
unkown
page execute and read and write
472E000
stack
page read and write
6F870000
unkown
page readonly
29591000
heap
page read and write
1CD2E000
stack
page read and write
4850000
heap
page read and write
36AF000
stack
page read and write
1D2B6000
heap
page read and write
2C60000
heap
page read and write
1D2D0000
heap
page read and write
6F902000
unkown
page readonly
A40000
direct allocation
page read and write
8F4000
heap
page read and write
1D2D3000
heap
page read and write
1D2EC000
heap
page read and write
4C70000
heap
page read and write
292F1000
heap
page read and write
2E6F000
stack
page read and write
346E000
stack
page read and write
8F4000
heap
page read and write
8F4000
heap
page read and write
61EB7000
direct allocation
page readonly
1D2C5000
heap
page read and write
4831000
heap
page read and write
EC0000
unkown
page readonly
3BEE000
stack
page read and write
1D2DB000
heap
page read and write
A40000
direct allocation
page read and write
1D2D3000
heap
page read and write
4831000
heap
page read and write
1CFAF000
stack
page read and write
A40000
direct allocation
page read and write
1D2E9000
heap
page read and write
C6F000
stack
page read and write
61ED4000
direct allocation
page readonly
8F4000
heap
page read and write
44AE000
stack
page read and write
4831000
heap
page read and write
6C680000
unkown
page readonly
46EF000
stack
page read and write
1D2DE000
heap
page read and write
1D2DC000
heap
page read and write
1D2DD000
heap
page read and write
382E000
stack
page read and write
1D2CD000
heap
page read and write
6F2000
stack
page read and write
4831000
heap
page read and write
29300000
heap
page read and write
4831000
heap
page read and write
30AE000
stack
page read and write
29290000
heap
page read and write
6F871000
unkown
page execute read
1D2B6000
heap
page read and write
35AE000
stack
page read and write
1D3C6000
heap
page read and write
13BB000
unkown
page execute and write copy
4831000
heap
page read and write
1D2E5000
heap
page read and write
F48000
unkown
page execute and read and write
1D2C5000
heap
page read and write
4CEB000
stack
page read and write
A70000
heap
page read and write
4831000
heap
page read and write
294FF000
stack
page read and write
4831000
heap
page read and write
1D2D6000
heap
page read and write
1D2B8000
heap
page read and write
FA2000
unkown
page execute and read and write
2C67000
heap
page read and write
1D2AB000
heap
page read and write
13AE000
unkown
page execute and read and write
A40000
direct allocation
page read and write
AF3000
heap
page read and write
4831000
heap
page read and write
3D2E000
stack
page read and write
1D2C5000
heap
page read and write
1D2DD000
heap
page read and write
4831000
heap
page read and write
AC6000
heap
page read and write
1D2D0000
heap
page read and write
8F4000
heap
page read and write
2930D000
heap
page read and write
8F4000
heap
page read and write
293FE000
stack
page read and write
8DC000
stack
page read and write
1D2DD000
heap
page read and write
8F4000
heap
page read and write
8F4000
heap
page read and write
A40000
direct allocation
page read and write
3FAE000
stack
page read and write
1D2E9000
heap
page read and write
8F4000
heap
page read and write
1557000
unkown
page execute and read and write
1D2E5000
heap
page read and write
1D2CC000
heap
page read and write
2BFF000
stack
page read and write
B4C000
heap
page read and write
4831000
heap
page read and write
4831000
heap
page read and write
35C000
stack
page read and write
1D2CC000
heap
page read and write
292D0000
heap
page read and write
1D2DC000
heap
page read and write
4831000
heap
page read and write
4831000
heap
page read and write
4831000
heap
page read and write
4831000
heap
page read and write
12A3000
unkown
page execute and read and write
1D0FC000
stack
page read and write
292F9000
heap
page read and write
4831000
heap
page read and write
A40000
direct allocation
page read and write
1D2D0000
heap
page read and write
B53000
heap
page read and write
8F4000
heap
page read and write
1CFFD000
stack
page read and write
EC0000
unkown
page read and write
8F4000
heap
page read and write
4840000
heap
page read and write
4831000
heap
page read and write
1D2C5000
heap
page read and write
1D2CD000
heap
page read and write
1D2E9000
heap
page read and write
4831000
heap
page read and write
61ED3000
direct allocation
page read and write
436E000
stack
page read and write
3E2F000
stack
page read and write
4831000
heap
page read and write
1D2D0000
heap
page read and write
1CE6F000
stack
page read and write
1D2D0000
heap
page read and write
1D2CD000
heap
page read and write
3CEF000
stack
page read and write
8F4000
heap
page read and write
6C860000
unkown
page read and write
1D2E9000
heap
page read and write
4831000
heap
page read and write
4831000
heap
page read and write
8F4000
heap
page read and write
4C70000
trusted library allocation
page read and write
6C85F000
unkown
page write copy
3F6F000
stack
page read and write
80D000
stack
page read and write
1D2D0000
heap
page read and write
4831000
heap
page read and write
4831000
heap
page read and write
A78000
heap
page read and write
6C681000
unkown
page execute read
4831000
heap
page read and write
4831000
heap
page read and write
4831000
heap
page read and write
1D2D0000
heap
page read and write
4831000
heap
page read and write
4831000
heap
page read and write
1D2D0000
heap
page read and write
8F4000
heap
page read and write
A40000
direct allocation
page read and write
4E10000
direct allocation
page execute and read and write
40AF000
stack
page read and write
1D2CC000
heap
page read and write
1CC2E000
stack
page read and write
8F4000
heap
page read and write
4831000
heap
page read and write
8F4000
heap
page read and write
4831000
heap
page read and write
8F4000
heap
page read and write
4E00000
direct allocation
page execute and read and write
1D2D0000
heap
page read and write
A60000
direct allocation
page read and write
F7D000
unkown
page execute and read and write
8F4000
heap
page read and write
13BC000
unkown
page execute and write copy
1D2D0000
heap
page read and write
1D2C7000
heap
page read and write
A40000
direct allocation
page read and write
4831000
heap
page read and write
1D2A0000
heap
page read and write
1D2C5000
heap
page read and write
1D2B6000
heap
page read and write
8F4000
heap
page read and write
F1A000
unkown
page execute and read and write
A40000
direct allocation
page read and write
6F8FE000
unkown
page read and write
There are 364 hidden memdumps, click here to show them.