IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKJDAEGCAFIIDGDGCGIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DBKEHDGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FCBAEHCAEGDHJKFHJKFIJKJEGH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FHCBGIIJKEBFCBGDBAEBGCFIEH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IEHIIIJDAAAAAAKECBFB
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\IIEHJEHDBGHIDGDGHCBGDGCBFI
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\IJEGHJECFCFCBFIDBGCG
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JDAEHJJE
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php0u
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll(Vqc
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dllPV9c
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllqw
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dlldhzc
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpe1
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllU
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllkw
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php;h
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpB
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpus.wallet
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll2w7b9
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllfw
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpre
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php8n
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php&
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 47 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
5B1000
unkown
page execute and read and write
 malicious
4AC0000
direct allocation
page read and write
 malicious
C5E000
heap
page read and write
 malicious
6C81F000
unkown
page readonly
CB9000
heap
page read and write
1D110000
heap
page read and write
6C681000
unkown
page execute read
4631000
heap
page read and write
6C865000
unkown
page readonly
1D109000
heap
page read and write
1D10B000
heap
page read and write
4C40000
direct allocation
page execute and read and write
61E01000
direct allocation
page execute read
4631000
heap
page read and write
2928E000
heap
page read and write
4AC0000
direct allocation
page read and write
3FFE000
stack
page read and write
1CB4F000
stack
page read and write
4C60000
direct allocation
page execute and read and write
4631000
heap
page read and write
4631000
heap
page read and write
D36000
heap
page read and write
4631000
heap
page read and write
61ECD000
direct allocation
page readonly
39BE000
stack
page read and write
1D0F9000
heap
page read and write
2ABF000
stack
page read and write
437F000
stack
page read and write
4631000
heap
page read and write
1D122000
heap
page read and write
1D0FA000
heap
page read and write
1D0FA000
heap
page read and write
4C30000
direct allocation
page execute and read and write
4631000
heap
page read and write
1D122000
heap
page read and write
69F000
unkown
page execute and read and write
4631000
heap
page read and write
C58000
heap
page read and write
D29000
heap
page read and write
293EF000
heap
page read and write
29350000
trusted library allocation
page read and write
4631000
heap
page read and write
28B0000
heap
page read and write
31FF000
stack
page read and write
1D108000
heap
page read and write
4730000
trusted library allocation
page read and write
1CA0F000
stack
page read and write
4631000
heap
page read and write
413E000
stack
page read and write
A97000
unkown
page execute and read and write
1CCEE000
stack
page read and write
1D114000
heap
page read and write
2BFE000
stack
page read and write
4631000
heap
page read and write
383F000
stack
page read and write
373E000
stack
page read and write
4631000
heap
page read and write
29282000
heap
page read and write
1D101000
heap
page read and write
232BE000
heap
page read and write
4631000
heap
page read and write
35BF000
stack
page read and write
1D102000
heap
page read and write
C4B000
unkown
page execute and write copy
CD6000
heap
page read and write
55E000
stack
page read and write
3FBF000
stack
page read and write
61E00000
direct allocation
page execute and read and write
5B0000
unkown
page readonly
4631000
heap
page read and write
4620000
direct allocation
page read and write
4631000
heap
page read and write
80E000
unkown
page execute and read and write
4631000
heap
page read and write
1D114000
heap
page read and write
232AD000
stack
page read and write
4600000
heap
page read and write
40FF000
stack
page read and write
4620000
direct allocation
page read and write
4AC0000
direct allocation
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
29260000
heap
page read and write
4632000
heap
page read and write
1D114000
heap
page read and write
1D12B000
heap
page read and write
29287000
heap
page read and write
AAD000
unkown
page execute and read and write
AAD000
unkown
page execute and write copy
6F870000
unkown
page readonly
293F1000
heap
page read and write
1D0EF000
heap
page read and write
6F8ED000
unkown
page readonly
1E0000
heap
page read and write
4631000
heap
page read and write
CA3000
heap
page read and write
C50000
heap
page read and write
1CA4E000
stack
page read and write
427E000
stack
page read and write
1D12F000
heap
page read and write
4F2000
stack
page read and write
1D114000
heap
page read and write
1D0FA000
heap
page read and write
1D109000
heap
page read and write
1D114000
heap
page read and write
104F000
stack
page read and write
347F000
stack
page read and write
4620000
direct allocation
page read and write
4620000
direct allocation
page read and write
29BF000
stack
page read and write
4631000
heap
page read and write
D60000
heap
page read and write
4BFF000
stack
page read and write
1D10B000
heap
page read and write
1D12B000
heap
page read and write
6C860000
unkown
page read and write
6F871000
unkown
page execute read
4C4E000
stack
page read and write
4FD000
stack
page read and write
4620000
direct allocation
page read and write
1F0000
heap
page read and write
1D122000
heap
page read and write
1D114000
heap
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
1D114000
heap
page read and write
4631000
heap
page read and write
1D110000
heap
page read and write
77B000
unkown
page execute and read and write
1D114000
heap
page read and write
4631000
heap
page read and write
3C3E000
stack
page read and write
1CDEF000
stack
page read and write
1D106000
heap
page read and write
28AE000
stack
page read and write
4620000
direct allocation
page read and write
A9F000
unkown
page execute and read and write
2D3E000
stack
page read and write
4631000
heap
page read and write
755000
unkown
page execute and read and write
1D114000
heap
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
1D10B000
heap
page read and write
292E1000
heap
page read and write
6F8FE000
unkown
page read and write
4631000
heap
page read and write
661000
unkown
page execute and read and write
3ABF000
stack
page read and write
44FE000
stack
page read and write
4631000
heap
page read and write
4640000
heap
page read and write
1D12F000
heap
page read and write
1D12B000
heap
page read and write
4631000
heap
page read and write
293E9000
heap
page read and write
4631000
heap
page read and write
4C70000
direct allocation
page execute and read and write
6CB000
unkown
page execute and read and write
1CF3C000
stack
page read and write
2BBF000
stack
page read and write
1CC8E000
stack
page read and write
D70000
heap
page read and write
1D10F000
heap
page read and write
1D12B000
heap
page read and write
1D122000
heap
page read and write
4620000
direct allocation
page read and write
4631000
heap
page read and write
1D114000
heap
page read and write
61ED0000
direct allocation
page read and write
45FF000
stack
page read and write
43BE000
stack
page read and write
1CB8E000
stack
page read and write
59E000
stack
page read and write
6F902000
unkown
page readonly
28BE000
heap
page read and write
1D0FA000
heap
page read and write
1D101000
heap
page read and write
1D10F000
heap
page read and write
635000
unkown
page execute and read and write
4631000
heap
page read and write
1D114000
heap
page read and write
6C85F000
unkown
page write copy
4631000
heap
page read and write
30BE000
stack
page read and write
1D108000
heap
page read and write
2F7F000
stack
page read and write
4631000
heap
page read and write
61ECC000
direct allocation
page read and write
1D12A000
heap
page read and write
1D128000
heap
page read and write
1D0FA000
heap
page read and write
1D109000
heap
page read and write
1D114000
heap
page read and write
1D201000
heap
page read and write
4631000
heap
page read and write
C4A000
unkown
page execute and read and write
1D12D000
heap
page read and write
4620000
direct allocation
page read and write
4631000
heap
page read and write
61ED3000
direct allocation
page read and write
1D109000
heap
page read and write
4630000
heap
page read and write
999000
unkown
page execute and read and write
4631000
heap
page read and write
1D114000
heap
page read and write
36FF000
stack
page read and write
423F000
stack
page read and write
1D10F000
heap
page read and write
4620000
direct allocation
page read and write
4631000
heap
page read and write
34BE000
stack
page read and write
6BF000
unkown
page execute and read and write
337E000
stack
page read and write
4C20000
direct allocation
page execute and read and write
4631000
heap
page read and write
1D109000
heap
page read and write
1D109000
heap
page read and write
1D12B000
heap
page read and write
1D0E0000
heap
page read and write
28BB000
heap
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
1CF7E000
stack
page read and write
1D12B000
heap
page read and write
D23000
heap
page read and write
323E000
stack
page read and write
1D114000
heap
page read and write
3EBE000
stack
page read and write
2FBE000
stack
page read and write
F4F000
stack
page read and write
D1E000
heap
page read and write
4F8000
stack
page read and write
1D114000
heap
page read and write
1D114000
heap
page read and write
1D109000
heap
page read and write
4631000
heap
page read and write
5B1000
unkown
page execute and write copy
6C680000
unkown
page readonly
4631000
heap
page read and write
1D114000
heap
page read and write
1D12D000
heap
page read and write
4620000
direct allocation
page read and write
1D130000
heap
page read and write
A75000
unkown
page execute and read and write
4C50000
direct allocation
page execute and read and write
29240000
heap
page read and write
1CE3D000
stack
page read and write
66D000
unkown
page execute and read and write
4631000
heap
page read and write
1D0FC000
heap
page read and write
1D12B000
heap
page read and write
4631000
heap
page read and write
1D102000
heap
page read and write
2929B000
heap
page read and write
1D200000
trusted library allocation
page read and write
30FE000
stack
page read and write
4631000
heap
page read and write
4C10000
direct allocation
page execute and read and write
1D114000
heap
page read and write
4AFC000
stack
page read and write
D44000
heap
page read and write
3E7F000
stack
page read and write
1D106000
heap
page read and write
286C000
stack
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
1D114000
heap
page read and write
60A000
unkown
page execute and read and write
29294000
heap
page read and write
1D0E2000
heap
page read and write
638000
unkown
page execute and read and write
3AFE000
stack
page read and write
4620000
direct allocation
page read and write
D40000
heap
page read and write
4F4000
stack
page read and write
1D122000
heap
page read and write
6CE000
unkown
page execute and read and write
D30000
heap
page read and write
4631000
heap
page read and write
D75000
heap
page read and write
1D114000
heap
page read and write
3D7E000
stack
page read and write
282E000
stack
page read and write
1D114000
heap
page read and write
61ED4000
direct allocation
page readonly
4631000
heap
page read and write
387E000
stack
page read and write
6C85E000
unkown
page read and write
4631000
heap
page read and write
44BF000
stack
page read and write
4650000
heap
page read and write
4C40000
direct allocation
page execute and read and write
293E1000
heap
page read and write
642000
unkown
page execute and read and write
1D114000
heap
page read and write
4631000
heap
page read and write
775000
unkown
page execute and read and write
18C000
stack
page read and write
4620000
direct allocation
page read and write
61EB7000
direct allocation
page readonly
1D109000
heap
page read and write
4631000
heap
page read and write
61EB4000
direct allocation
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
4620000
direct allocation
page read and write
5B0000
unkown
page read and write
692000
unkown
page execute and read and write
3BFF000
stack
page read and write
397F000
stack
page read and write
3D3E000
stack
page read and write
333F000
stack
page read and write
4631000
heap
page read and write
1D106000
heap
page read and write
63F000
unkown
page execute and read and write
1D10E000
heap
page read and write
4631000
heap
page read and write
35FE000
stack
page read and write
28B7000
heap
page read and write
293E9000
heap
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
1D07D000
stack
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
4620000
direct allocation
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
1D10E000
heap
page read and write
29220000
heap
page read and write
4631000
heap
page read and write
1D114000
heap
page read and write
1D0FA000
heap
page read and write
2CFF000
stack
page read and write
2E7E000
stack
page read and write
4631000
heap
page read and write
231AE000
stack
page read and write
4631000
heap
page read and write
4631000
heap
page read and write
2E3F000
stack
page read and write
AAE000
unkown
page execute and write copy
4631000
heap
page read and write
1D12D000
heap
page read and write
1D0FA000
heap
page read and write
There are 336 hidden memdumps, click here to show them.