IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BGHJEBKJEGHJKECAAKJK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EHDBGDHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FBFCGIDAKECGCBGDBAFI
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IDAAFBGDBKJJJKFIIIJJJECAAE
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\IDHCGDAF
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IIEBKJECFCFBFIECBKFBKJKFBG
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KJJECGHJDBFIJJJKEHCB
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\KJJJDHDGDAAKECAKJDAEGCBKEH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllfw
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllZtLA
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllFt
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpq&
unknown
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php.dll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpE&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpmple-storage.json
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllC
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php%&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3=U
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpECGHJDBFIJJJKEHCB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllzwl
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll4
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17isual
unknown
There are 45 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
5030000
direct allocation
page read and write
 malicious
12EE000
heap
page read and write
 malicious
571000
unkown
page execute and read and write
 malicious
12C0000
direct allocation
page read and write
297C0000
heap
page read and write
1D77E000
heap
page read and write
4BB1000
heap
page read and write
1D784000
heap
page read and write
1D794000
heap
page read and write
5190000
direct allocation
page execute and read and write
31AE000
stack
page read and write
1184000
heap
page read and write
73B000
unkown
page execute and read and write
67F000
unkown
page execute and read and write
1184000
heap
page read and write
1D78B000
heap
page read and write
1D79F000
heap
page read and write
6C85E000
unkown
page read and write
10FD000
stack
page read and write
3F6E000
stack
page read and write
6C681000
unkown
page execute read
1D779000
heap
page read and write
4BB1000
heap
page read and write
41AF000
stack
page read and write
297E0000
heap
page read and write
68B000
unkown
page execute and read and write
4BB1000
heap
page read and write
A4D000
unkown
page execute and read and write
A44000
unkown
page execute and read and write
D9C000
stack
page read and write
4BB1000
heap
page read and write
12C0000
direct allocation
page read and write
442F000
stack
page read and write
1D754000
heap
page read and write
4BB1000
heap
page read and write
1184000
heap
page read and write
1D7A2000
heap
page read and write
12C0000
direct allocation
page read and write
602000
unkown
page execute and read and write
12C0000
direct allocation
page read and write
32EE000
stack
page read and write
6F871000
unkown
page execute read
1184000
heap
page read and write
1184000
heap
page read and write
946000
unkown
page execute and read and write
1180000
heap
page read and write
1184000
heap
page read and write
1184000
heap
page read and write
1D779000
heap
page read and write
4BB1000
heap
page read and write
1D781000
heap
page read and write
1D63E000
stack
page read and write
1D76A000
heap
page read and write
1D784000
heap
page read and write
65F000
unkown
page execute and read and write
2E2B000
heap
page read and write
1D76A000
heap
page read and write
1D784000
heap
page read and write
621000
unkown
page execute and read and write
1D73C000
stack
page read and write
4BB1000
heap
page read and write
4BB1000
heap
page read and write
3CAF000
stack
page read and write
352F000
stack
page read and write
1184000
heap
page read and write
1184000
heap
page read and write
1D78C000
heap
page read and write
12C0000
direct allocation
page read and write
1184000
heap
page read and write
4BB1000
heap
page read and write
4BB1000
heap
page read and write
4BB1000
heap
page read and write
299EF000
stack
page read and write
4BB1000
heap
page read and write
1184000
heap
page read and write
4BB1000
heap
page read and write
1D778000
heap
page read and write
1D7A2000
heap
page read and write
735000
unkown
page execute and read and write
1184000
heap
page read and write
5170000
direct allocation
page execute and read and write
4BB1000
heap
page read and write
1D78C000
heap
page read and write
61ED3000
direct allocation
page read and write
1D39D000
stack
page read and write
1D776000
heap
page read and write
1D76A000
heap
page read and write
570000
unkown
page readonly
6C680000
unkown
page readonly
12C0000
direct allocation
page read and write
1D780000
heap
page read and write
1184000
heap
page read and write
4BB1000
heap
page read and write
4BB1000
heap
page read and write
14DF000
stack
page read and write
2DFB000
stack
page read and write
1D785000
heap
page read and write
1D779000
heap
page read and write
2381B000
heap
page read and write
1100000
heap
page read and write
4BB1000
heap
page read and write
36AE000
stack
page read and write
1D794000
heap
page read and write
BF1000
unkown
page execute and read and write
12C0000
direct allocation
page read and write
1D779000
heap
page read and write
1D787000
heap
page read and write
1D750000
heap
page read and write
1D77E000
heap
page read and write
6F870000
unkown
page readonly
1D4DE000
stack
page read and write
5F5000
unkown
page execute and read and write
1184000
heap
page read and write
A5C000
unkown
page execute and read and write
1D76A000
heap
page read and write
306E000
stack
page read and write
1D76C000
heap
page read and write
1D77E000
heap
page read and write
1D785000
heap
page read and write
6C81F000
unkown
page readonly
1184000
heap
page read and write
1D77B000
heap
page read and write
45AE000
stack
page read and write
1184000
heap
page read and write
4BB1000
heap
page read and write
1D78B000
heap
page read and write
1D76A000
heap
page read and write
4BB1000
heap
page read and write
3BAE000
stack
page read and write
1184000
heap
page read and write
61E00000
direct allocation
page execute and read and write
5180000
direct allocation
page execute and read and write
570000
unkown
page read and write
571000
unkown
page execute and write copy
4BB1000
heap
page read and write
1D77E000
heap
page read and write
4BB1000
heap
page read and write
366F000
stack
page read and write
10F3000
stack
page read and write
4BB1000
heap
page read and write
1D7A2000
heap
page read and write
1CFCE000
stack
page read and write
68E000
unkown
page execute and read and write
4BB1000
heap
page read and write
51A0000
direct allocation
page execute and read and write
1D77E000
heap
page read and write
4BB1000
heap
page read and write
4BB1000
heap
page read and write
2E2E000
heap
page read and write
4BB1000
heap
page read and write
61ED4000
direct allocation
page readonly
1184000
heap
page read and write
1D8A0000
trusted library allocation
page read and write
1D7A2000
heap
page read and write
2E00000
direct allocation
page read and write
1D783000
heap
page read and write
1D784000
heap
page read and write
1D7A2000
heap
page read and write
2E20000
heap
page read and write
6F902000
unkown
page readonly
12C0000
direct allocation
page read and write
1D780000
heap
page read and write
1D780000
heap
page read and write
1184000
heap
page read and write
1184000
heap
page read and write
3DEF000
stack
page read and write
1D8AF000
heap
page read and write
4BB1000
heap
page read and write
33EF000
stack
page read and write
4BB1000
heap
page read and write
1184000
heap
page read and write
12E0000
heap
page read and write
4BB1000
heap
page read and write
37AF000
stack
page read and write
1D0CF000
stack
page read and write
446E000
stack
page read and write
1D794000
heap
page read and write
1D7A2000
heap
page read and write
12C0000
direct allocation
page read and write
6F8FE000
unkown
page read and write
3A6E000
stack
page read and write
1D780000
heap
page read and write
1D7A2000
heap
page read and write
297A0000
heap
page read and write
3B6F000
stack
page read and write
12C0000
direct allocation
page read and write
29A94000
heap
page read and write
2DBE000
stack
page read and write
482E000
stack
page read and write
1333000
heap
page read and write
A5D000
unkown
page execute and write copy
1D77E000
heap
page read and write
4BB1000
heap
page read and write
2E27000
heap
page read and write
4BB1000
heap
page read and write
1CF8F000
stack
page read and write
46EE000
stack
page read and write
12C0000
direct allocation
page read and write
116E000
stack
page read and write
6C85F000
unkown
page write copy
1D7A2000
heap
page read and write
46AF000
stack
page read and write
4BB1000
heap
page read and write
1D24E000
stack
page read and write
4BB1000
heap
page read and write
29842000
heap
page read and write
4BB1000
heap
page read and write
4A6F000
stack
page read and write
4BB1000
heap
page read and write
4BB1000
heap
page read and write
6F8ED000
unkown
page readonly
4BB1000
heap
page read and write
456F000
stack
page read and write
61ED0000
direct allocation
page read and write
1D7A2000
heap
page read and write
4BB1000
heap
page read and write
4BB1000
heap
page read and write
A21000
unkown
page execute and read and write
1184000
heap
page read and write
3A2F000
stack
page read and write
492F000
stack
page read and write
4BB1000
heap
page read and write
1CE8E000
stack
page read and write
4FF0000
trusted library allocation
page read and write
1D794000
heap
page read and write
5000000
heap
page read and write
32AF000
stack
page read and write
61E01000
direct allocation
page execute read
61ECC000
direct allocation
page read and write
1D794000
heap
page read and write
1D785000
heap
page read and write
1184000
heap
page read and write
12E8000
heap
page read and write
4BD0000
heap
page read and write
1D77E000
heap
page read and write
40AE000
stack
page read and write
7CE000
unkown
page execute and read and write
15DE000
stack
page read and write
10F9000
stack
page read and write
1D49D000
stack
page read and write
1184000
heap
page read and write
4BB1000
heap
page read and write
1184000
heap
page read and write
1184000
heap
page read and write
1D77E000
heap
page read and write
61EB7000
direct allocation
page readonly
29A8E000
heap
page read and write
12C0000
direct allocation
page read and write
1D79B000
heap
page read and write
1D779000
heap
page read and write
4BB1000
heap
page read and write
4BB1000
heap
page read and write
1D10E000
stack
page read and write
1184000
heap
page read and write
1D784000
heap
page read and write
12C0000
direct allocation
page read and write
4BB1000
heap
page read and write
38EF000
stack
page read and write
1D794000
heap
page read and write
1184000
heap
page read and write
4BB1000
heap
page read and write
1D7A2000
heap
page read and write
1D769000
heap
page read and write
5FF000
unkown
page execute and read and write
47EF000
stack
page read and write
1D7A2000
heap
page read and write
1D79B000
heap
page read and write
1184000
heap
page read and write
1D78D000
heap
page read and write
1D773000
heap
page read and write
356E000
stack
page read and write
506B000
stack
page read and write
BF2000
unkown
page execute and write copy
4BC0000
heap
page read and write
4BB1000
heap
page read and write
1D7A2000
heap
page read and write
41EE000
stack
page read and write
1D79D000
heap
page read and write
1D7A2000
heap
page read and write
5F8000
unkown
page execute and read and write
406F000
stack
page read and write
5190000
direct allocation
page execute and read and write
1184000
heap
page read and write
2E00000
direct allocation
page read and write
4BB1000
heap
page read and write
5CA000
unkown
page execute and read and write
1D76A000
heap
page read and write
1D779000
heap
page read and write
1D7A2000
heap
page read and write
A5C000
unkown
page execute and write copy
299F0000
trusted library allocation
page read and write
1D78B000
heap
page read and write
29A94000
heap
page read and write
DF0000
heap
page read and write
3CEE000
stack
page read and write
29780000
heap
page read and write
1364000
heap
page read and write
6C860000
unkown
page read and write
342E000
stack
page read and write
1D779000
heap
page read and write
1184000
heap
page read and write
1D76A000
heap
page read and write
4BAF000
stack
page read and write
4BB1000
heap
page read and write
1D75F000
heap
page read and write
4BB0000
heap
page read and write
1D780000
heap
page read and write
715000
unkown
page execute and read and write
4AAE000
stack
page read and write
1D776000
heap
page read and write
1D5DD000
stack
page read and write
29A8C000
heap
page read and write
3F2F000
stack
page read and write
496E000
stack
page read and write
652000
unkown
page execute and read and write
1D77C000
heap
page read and write
4BB1000
heap
page read and write
1D20F000
stack
page read and write
62D000
unkown
page execute and read and write
4BB1000
heap
page read and write
4BB1000
heap
page read and write
2E10000
direct allocation
page execute and read and write
1184000
heap
page read and write
298EE000
stack
page read and write
4BB1000
heap
page read and write
1D7A2000
heap
page read and write
12B0000
heap
page read and write
1184000
heap
page read and write
302F000
stack
page read and write
1184000
heap
page read and write
2F2F000
stack
page read and write
4BB1000
heap
page read and write
61ECD000
direct allocation
page readonly
4BB1000
heap
page read and write
1D794000
heap
page read and write
1184000
heap
page read and write
1346000
heap
page read and write
29A86000
heap
page read and write
1D776000
heap
page read and write
1184000
heap
page read and write
61EB4000
direct allocation
page read and write
4BB1000
heap
page read and write
6C865000
unkown
page readonly
3E2E000
stack
page read and write
1D756000
heap
page read and write
1D78B000
heap
page read and write
1184000
heap
page read and write
1D34F000
stack
page read and write
12C0000
direct allocation
page read and write
37EE000
stack
page read and write
1D784000
heap
page read and write
432E000
stack
page read and write
51B0000
direct allocation
page execute and read and write
1D784000
heap
page read and write
42EE000
stack
page read and write
4BB1000
heap
page read and write
316F000
stack
page read and write
516F000
stack
page read and write
4BB1000
heap
page read and write
4BB1000
heap
page read and write
1D7A2000
heap
page read and write
1D794000
heap
page read and write
4BB1000
heap
page read and write
129E000
stack
page read and write
392E000
stack
page read and write
There are 355 hidden memdumps, click here to show them.