IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAKJEGCFBGDHJJJJJKJECFCFCA
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\AEGHIJEHJDHIDHIDAEHC
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\AFCBFIJE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\DHCGIDHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FCGIJKJJKEBGHJKFIDGCAAFCAF
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\GCFCFCGCGIEHIECAFCFI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HJJJDAEGIDHCBFHJJJEGIJDBGH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JEGHJKFHJJJKJJJJKEHC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KJJJDHDGDAAKECAKJDAEGCBKEH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpata
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllP
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllF
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3I5
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37:
unknown
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phprowser
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll.
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpm5
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php_
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpdll
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpv5
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllL
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phprum-LTC
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php?
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllt
unknown
 malicious
http://185.215.113.37/E
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php/
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dllp
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllj
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php9
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php55Z
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php&
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php#
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll5
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
https://cdn.epnacl
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://cdn.ep
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
There are 53 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
401000
unkown
page execute and read and write
 malicious
52F0000
direct allocation
page read and write
 malicious
13DE000
heap
page read and write
 malicious
299FB000
heap
page read and write
13B4000
heap
page read and write
1D96F000
heap
page read and write
6CD1F000
unkown
page readonly
1D54E000
stack
page read and write
4E50000
direct allocation
page read and write
1D960000
heap
page read and write
1439000
heap
page read and write
1D963000
heap
page read and write
4BCF000
stack
page read and write
A89000
unkown
page execute and write copy
52F0000
direct allocation
page read and write
13B4000
heap
page read and write
3F7E000
stack
page read and write
1D97D000
heap
page read and write
13B0000
heap
page read and write
1D95A000
heap
page read and write
1D954000
heap
page read and write
13B4000
heap
page read and write
1D946000
heap
page read and write
4E61000
heap
page read and write
1D960000
heap
page read and write
13B4000
heap
page read and write
4E61000
heap
page read and write
1D945000
heap
page read and write
542F000
stack
page read and write
1D97D000
heap
page read and write
13B4000
heap
page read and write
4E61000
heap
page read and write
13B4000
heap
page read and write
61E00000
direct allocation
page execute and read and write
51B000
unkown
page execute and read and write
4E61000
heap
page read and write
307E000
stack
page read and write
4E50000
direct allocation
page read and write
37FE000
stack
page read and write
1D960000
heap
page read and write
1D95A000
heap
page read and write
400000
unkown
page read and write
1D950000
heap
page read and write
4E61000
heap
page read and write
1D95A000
heap
page read and write
1D97D000
heap
page read and write
1D97D000
heap
page read and write
13B4000
heap
page read and write
8B4000
unkown
page execute and read and write
1D95A000
heap
page read and write
14C6000
heap
page read and write
493F000
stack
page read and write
1D963000
heap
page read and write
433E000
stack
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
1D17E000
stack
page read and write
4E4F000
stack
page read and write
47FF000
stack
page read and write
4E61000
heap
page read and write
357E000
stack
page read and write
1372000
stack
page read and write
1D952000
heap
page read and write
3F3F000
stack
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
2FC73000
heap
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
4F60000
trusted library allocation
page read and write
1D78D000
stack
page read and write
1D945000
heap
page read and write
6CD60000
unkown
page read and write
1D968000
heap
page read and write
1D8CC000
stack
page read and write
1D95A000
heap
page read and write
1D94A000
heap
page read and write
1D97D000
heap
page read and write
1D95A000
heap
page read and write
42FF000
stack
page read and write
45A000
unkown
page execute and read and write
1D960000
heap
page read and write
1465000
heap
page read and write
1D930000
heap
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
407F000
stack
page read and write
1D964000
heap
page read and write
13B4000
heap
page read and write
2FC6D000
heap
page read and write
5470000
direct allocation
page execute and read and write
1D97D000
heap
page read and write
1D7CD000
stack
page read and write
4E50000
direct allocation
page read and write
13B4000
heap
page read and write
5C5000
unkown
page execute and read and write
61ED4000
direct allocation
page readonly
1D94C000
heap
page read and write
353F000
stack
page read and write
2F9C4000
heap
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
4E50000
direct allocation
page read and write
1D955000
heap
page read and write
1D946000
heap
page read and write
29980000
heap
page read and write
1D96B000
heap
page read and write
1D95B000
heap
page read and write
6CD5E000
unkown
page read and write
4E61000
heap
page read and write
36BE000
stack
page read and write
532C000
stack
page read and write
13B4000
heap
page read and write
13B4000
heap
page read and write
46BF000
stack
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
4E50000
direct allocation
page read and write
13B4000
heap
page read and write
3DFF000
stack
page read and write
52F0000
direct allocation
page read and write
13B4000
heap
page read and write
1D3FD000
stack
page read and write
317F000
stack
page read and write
1D960000
heap
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
1D958000
heap
page read and write
13B4000
heap
page read and write
127C000
stack
page read and write
4E61000
heap
page read and write
4E90000
heap
page read and write
1D94D000
heap
page read and write
29930000
heap
page read and write
4E61000
heap
page read and write
50F000
unkown
page execute and read and write
1423000
heap
page read and write
401000
unkown
page execute and write copy
8F2000
unkown
page execute and read and write
239C1000
heap
page read and write
4E50000
direct allocation
page read and write
1D967000
heap
page read and write
1D960000
heap
page read and write
13B4000
heap
page read and write
1D958000
heap
page read and write
61ECC000
direct allocation
page read and write
1D945000
heap
page read and write
13B4000
heap
page read and write
37BF000
stack
page read and write
13B4000
heap
page read and write
4E70000
heap
page read and write
6FD5D000
unkown
page readonly
6FCE1000
unkown
page execute read
1D960000
heap
page read and write
13B4000
heap
page read and write
3030000
heap
page read and write
1D954000
heap
page read and write
1D94D000
heap
page read and write
1DA5B000
heap
page read and write
1D95E000
heap
page read and write
6CB80000
unkown
page readonly
13B4000
heap
page read and write
162E000
stack
page read and write
1D957000
heap
page read and write
4E61000
heap
page read and write
1D932000
heap
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
4D4E000
stack
page read and write
176D000
stack
page read and write
5A5000
unkown
page execute and read and write
61ED3000
direct allocation
page read and write
4E50000
direct allocation
page read and write
4C0E000
stack
page read and write
38FF000
stack
page read and write
1D960000
heap
page read and write
3E3E000
stack
page read and write
A88000
unkown
page execute and read and write
1D95F000
heap
page read and write
4BD000
unkown
page execute and read and write
457F000
stack
page read and write
4E61000
heap
page read and write
1D954000
heap
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
1D960000
heap
page read and write
483E000
stack
page read and write
4E61000
heap
page read and write
65E000
unkown
page execute and read and write
13B4000
heap
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
8DC000
unkown
page execute and read and write
2F9C2000
heap
page read and write
1D95A000
heap
page read and write
4E61000
heap
page read and write
3BBE000
stack
page read and write
13B4000
heap
page read and write
1D97D000
heap
page read and write
1D95F000
heap
page read and write
1D27F000
stack
page read and write
51E000
unkown
page execute and read and write
5490000
direct allocation
page execute and read and write
1D955000
heap
page read and write
13B4000
heap
page read and write
1D97D000
heap
page read and write
4E61000
heap
page read and write
3CFE000
stack
page read and write
1D954000
heap
page read and write
1D2BE000
stack
page read and write
3A3F000
stack
page read and write
4E61000
heap
page read and write
13B4000
heap
page read and write
1D3BF000
stack
page read and write
29940000
heap
page read and write
4E61000
heap
page read and write
1D97C000
heap
page read and write
1D97D000
heap
page read and write
4E50000
direct allocation
page read and write
6CD5F000
unkown
page write copy
4E61000
heap
page read and write
41BF000
stack
page read and write
4E50000
direct allocation
page read and write
54A0000
direct allocation
page execute and read and write
4E50000
direct allocation
page read and write
4E50000
direct allocation
page read and write
1D960000
heap
page read and write
4A8F000
stack
page read and write
4E61000
heap
page read and write
1D4FF000
stack
page read and write
4E61000
heap
page read and write
400000
unkown
page readonly
4E89000
heap
page read and write
4E61000
heap
page read and write
13B4000
heap
page read and write
4E61000
heap
page read and write
3B7F000
stack
page read and write
4E61000
heap
page read and write
7D4000
unkown
page execute and read and write
1D95C000
heap
page read and write
1D960000
heap
page read and write
8F2000
unkown
page execute and write copy
6CD65000
unkown
page readonly
141F000
heap
page read and write
303E000
heap
page read and write
61ED0000
direct allocation
page read and write
61ECD000
direct allocation
page readonly
3CBF000
stack
page read and write
1D946000
heap
page read and write
4B1000
unkown
page execute and read and write
13B4000
heap
page read and write
4D0F000
stack
page read and write
1D959000
heap
page read and write
1D96B000
heap
page read and write
4E61000
heap
page read and write
4E66000
heap
page read and write
2FC65000
heap
page read and write
4E61000
heap
page read and write
13B4000
heap
page read and write
64A000
unkown
page execute and read and write
4E61000
heap
page read and write
3037000
heap
page read and write
1D946000
heap
page read and write
4E61000
heap
page read and write
4E61000
heap
page read and write
1D958000
heap
page read and write
1D955000
heap
page read and write
1D958000
heap
page read and write
13B4000
heap
page read and write
6FCE0000
unkown
page readonly
137D000
stack
page read and write
485000
unkown
page execute and read and write
4E61000
heap
page read and write
186E000
stack
page read and write
1D97D000
heap
page read and write
13B4000
heap
page read and write
5460000
direct allocation
page execute and read and write
1D966000
heap
page read and write
1D95A000
heap
page read and write
13B4000
heap
page read and write
32FE000
stack
page read and write
443F000
stack
page read and write
4E61000
heap
page read and write
52D0000
heap
page read and write
1D960000
heap
page read and write
2FC70000
heap
page read and write
4E61000
heap
page read and write
41FE000
stack
page read and write
1D952000
heap
page read and write
13DA000
heap
page read and write
4E2000
unkown
page execute and read and write
3A7E000
stack
page read and write
61EB7000
direct allocation
page readonly
147B000
heap
page read and write
1D960000
heap
page read and write
393E000
stack
page read and write
1D946000
heap
page read and write
4E50000
direct allocation
page read and write
303B000
heap
page read and write
4E80000
heap
page read and write
1378000
stack
page read and write
1D94D000
heap
page read and write
4E61000
heap
page read and write
40BE000
stack
page read and write
4E50000
direct allocation
page read and write
4E61000
heap
page read and write
33FF000
stack
page read and write
299A0000
heap
page read and write
32BF000
stack
page read and write
1D946000
heap
page read and write
2FC68000
heap
page read and write
13B4000
heap
page read and write
2FBD0000
trusted library allocation
page read and write
1DA50000
trusted library allocation
page read and write
5480000
direct allocation
page execute and read and write
13B4000
heap
page read and write
5450000
direct allocation
page execute and read and write
13B4000
heap
page read and write
6CB81000
unkown
page execute read
31BB000
stack
page read and write
4E61000
heap
page read and write
29960000
heap
page read and write
1D954000
heap
page read and write
4E61000
heap
page read and write
29A0B000
heap
page read and write
4E61000
heap
page read and write
13B4000
heap
page read and write
1D93B000
heap
page read and write
343E000
stack
page read and write
13B4000
heap
page read and write
6FD72000
unkown
page readonly
13B4000
heap
page read and write
4E61000
heap
page read and write
8E3000
unkown
page execute and read and write
45BE000
stack
page read and write
1D960000
heap
page read and write
29A1B000
heap
page read and write
4E61000
heap
page read and write
367F000
stack
page read and write
14E0000
heap
page read and write
5470000
direct allocation
page execute and read and write
4E61000
heap
page read and write
13B4000
heap
page read and write
5440000
direct allocation
page execute and read and write
15C0000
heap
page read and write
1D959000
heap
page read and write
4E60000
heap
page read and write
4940000
heap
page read and write
1D95C000
heap
page read and write
13B4000
heap
page read and write
4ACE000
stack
page read and write
6FD6E000
unkown
page read and write
1D96D000
heap
page read and write
1D952000
heap
page read and write
2F9C0000
heap
page read and write
4E61000
heap
page read and write
498E000
stack
page read and write
46FE000
stack
page read and write
1D95A000
heap
page read and write
488000
unkown
page execute and read and write
447E000
stack
page read and write
8F3000
unkown
page execute and write copy
4E50000
direct allocation
page read and write
4E61000
heap
page read and write
5CB000
unkown
page execute and read and write
4E61000
heap
page read and write
4EF000
unkown
page execute and read and write
1D68D000
stack
page read and write
1D960000
heap
page read and write
61EB4000
direct allocation
page read and write
1D64F000
stack
page read and write
172F000
stack
page read and write
61E01000
direct allocation
page execute read
1D946000
heap
page read and write
13D0000
heap
page read and write
4E61000
heap
page read and write
There are 367 hidden memdumps, click here to show them.