IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\FIEHIIIJDAAAAAAKECBFBAEBKJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HCFIJKKK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HCFIJKKKKKFCAAAAFBKF
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\HCFIJKKKKKFCAAAAFBKFIECAAK
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\HIDGCFBFBFBKEBGCAFCG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IJDHCBGHJEGHJJKFHIIEHJJEBF
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\IJKFCFHJ
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KKKJKEBKFCAAECAAAAAE
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll8
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpIJKKKKKFCAAAAFBKF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpl
unknown
 malicious
http://185.215.113.37O
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dllX
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllJ
unknown
 malicious
http://185.215.113.37ECFHDB--
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpser
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/s
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllY$~
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dllk$l
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpd
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllf
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpE
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpIJKKKKKFCAAAAFBKFy
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dllI
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllr
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php4
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php3
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dlln
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 51 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
112E000
heap
page read and write
 malicious
4CD0000
direct allocation
page read and write
 malicious
361000
unkown
page execute and read and write
 malicious
3A7F000
stack
page read and write
1D332000
heap
page read and write
1D01F000
stack
page read and write
3E5000
unkown
page execute and read and write
1D34E000
heap
page read and write
1D332000
heap
page read and write
1D06E000
stack
page read and write
6C85F000
unkown
page write copy
F54000
heap
page read and write
F50000
heap
page read and write
1D340000
heap
page read and write
1D340000
heap
page read and write
11A5000
heap
page read and write
4841000
heap
page read and write
F54000
heap
page read and write
1204000
heap
page read and write
1100000
direct allocation
page read and write
1D430000
trusted library allocation
page read and write
61E01000
direct allocation
page execute read
4840000
heap
page read and write
4CD0000
direct allocation
page read and write
4841000
heap
page read and write
1D326000
heap
page read and write
1D334000
heap
page read and write
1D335000
heap
page read and write
3ABE000
stack
page read and write
61ECC000
direct allocation
page read and write
1D35C000
heap
page read and write
4841000
heap
page read and write
9FF000
unkown
page execute and write copy
4841000
heap
page read and write
1100000
direct allocation
page read and write
4841000
heap
page read and write
F54000
heap
page read and write
10AE000
stack
page read and write
1201000
heap
page read and write
47B000
unkown
page execute and read and write
45FE000
stack
page read and write
1D33D000
heap
page read and write
824000
unkown
page execute and read and write
1D359000
heap
page read and write
29330000
heap
page read and write
361000
unkown
page execute and write copy
1D340000
heap
page read and write
1D34B000
heap
page read and write
1D340000
heap
page read and write
44BE000
stack
page read and write
2DFF000
stack
page read and write
360000
unkown
page readonly
357F000
stack
page read and write
1D33C000
heap
page read and write
36BF000
stack
page read and write
447F000
stack
page read and write
3BBF000
stack
page read and write
1D33C000
heap
page read and write
2CFE000
stack
page read and write
45BF000
stack
page read and write
1D33D000
heap
page read and write
3E3F000
stack
page read and write
1D43D000
heap
page read and write
29380000
heap
page read and write
1100000
direct allocation
page read and write
9FE000
unkown
page execute and read and write
4841000
heap
page read and write
46FF000
stack
page read and write
1D347000
heap
page read and write
131E000
stack
page read and write
294D8000
heap
page read and write
29350000
heap
page read and write
10F0000
heap
page read and write
1D31B000
heap
page read and write
4841000
heap
page read and write
F54000
heap
page read and write
860000
unkown
page execute and write copy
1D346000
heap
page read and write
4CB0000
heap
page read and write
F54000
heap
page read and write
4841000
heap
page read and write
1D34D000
heap
page read and write
4841000
heap
page read and write
4841000
heap
page read and write
1100000
direct allocation
page read and write
4841000
heap
page read and write
36FE000
stack
page read and write
4841000
heap
page read and write
1D34B000
heap
page read and write
85F000
unkown
page execute and read and write
4841000
heap
page read and write
442000
unkown
page execute and read and write
F54000
heap
page read and write
BB0000
heap
page read and write
4841000
heap
page read and write
483F000
stack
page read and write
4C80000
trusted library allocation
page read and write
4841000
heap
page read and write
4841000
heap
page read and write
4850000
heap
page read and write
1D326000
heap
page read and write
31FE000
stack
page read and write
6F870000
unkown
page readonly
4841000
heap
page read and write
1D34C000
heap
page read and write
F54000
heap
page read and write
61ED4000
direct allocation
page readonly
4841000
heap
page read and write
29374000
heap
page read and write
6F8ED000
unkown
page readonly
29440000
trusted library allocation
page read and write
4841000
heap
page read and write
4841000
heap
page read and write
61EB4000
direct allocation
page read and write
1D335000
heap
page read and write
397E000
stack
page read and write
4E50000
direct allocation
page execute and read and write
4841000
heap
page read and write
F54000
heap
page read and write
6C681000
unkown
page execute read
1D313000
heap
page read and write
F54000
heap
page read and write
4841000
heap
page read and write
1D335000
heap
page read and write
F54000
heap
page read and write
37FF000
stack
page read and write
32FF000
stack
page read and write
111B000
heap
page read and write
1D340000
heap
page read and write
4841000
heap
page read and write
294E0000
heap
page read and write
3CFF000
stack
page read and write
1187000
heap
page read and write
52B000
unkown
page execute and read and write
1100000
direct allocation
page read and write
347E000
stack
page read and write
1100000
direct allocation
page read and write
343F000
stack
page read and write
F54000
heap
page read and write
4841000
heap
page read and write
1120000
heap
page read and write
46F000
unkown
page execute and read and write
41D000
unkown
page execute and read and write
44F000
unkown
page execute and read and write
411000
unkown
page execute and read and write
1D343000
heap
page read and write
4E40000
direct allocation
page execute and read and write
1CC5F000
stack
page read and write
4E20000
direct allocation
page execute and read and write
4841000
heap
page read and write
4841000
heap
page read and write
1D335000
heap
page read and write
748000
unkown
page execute and read and write
2938D000
heap
page read and write
61ED3000
direct allocation
page read and write
40BF000
stack
page read and write
F54000
heap
page read and write
3BFE000
stack
page read and write
1D326000
heap
page read and write
4841000
heap
page read and write
1100000
direct allocation
page read and write
4841000
heap
page read and write
1178000
heap
page read and write
4841000
heap
page read and write
1D34C000
heap
page read and write
1D359000
heap
page read and write
1D335000
heap
page read and write
1D326000
heap
page read and write
F54000
heap
page read and write
4841000
heap
page read and write
1D34B000
heap
page read and write
B63000
stack
page read and write
3F2000
unkown
page execute and read and write
4841000
heap
page read and write
47E000
unkown
page execute and read and write
2BBF000
stack
page read and write
1D33B000
heap
page read and write
233A4000
heap
page read and write
2F3F000
stack
page read and write
4841000
heap
page read and write
3FBE000
stack
page read and write
1100000
direct allocation
page read and write
4841000
heap
page read and write
525000
unkown
page execute and read and write
4841000
heap
page read and write
1D340000
heap
page read and write
1D33D000
heap
page read and write
1D34D000
heap
page read and write
1D337000
heap
page read and write
3E7E000
stack
page read and write
2E3E000
stack
page read and write
F54000
heap
page read and write
1D340000
heap
page read and write
111E000
heap
page read and write
1D332000
heap
page read and write
6C85E000
unkown
page read and write
F54000
heap
page read and write
61EB7000
direct allocation
page readonly
BC0000
heap
page read and write
1D359000
heap
page read and write
F54000
heap
page read and write
1100000
direct allocation
page read and write
F54000
heap
page read and write
1100000
direct allocation
page read and write
F54000
heap
page read and write
1D340000
heap
page read and write
1100000
direct allocation
page read and write
F54000
heap
page read and write
4841000
heap
page read and write
1CF1E000
stack
page read and write
3F7F000
stack
page read and write
1D1AE000
stack
page read and write
4841000
heap
page read and write
1CC9E000
stack
page read and write
1D335000
heap
page read and write
1D325000
heap
page read and write
29310000
heap
page read and write
1D2AD000
stack
page read and write
1D340000
heap
page read and write
1172000
heap
page read and write
F54000
heap
page read and write
F54000
heap
page read and write
4E50000
direct allocation
page execute and read and write
1D359000
heap
page read and write
F54000
heap
page read and write
3D3E000
stack
page read and write
6F902000
unkown
page readonly
4856000
heap
page read and write
1D35C000
heap
page read and write
1D359000
heap
page read and write
F4E000
stack
page read and write
4841000
heap
page read and write
4E0F000
stack
page read and write
1D340000
heap
page read and write
4841000
heap
page read and write
3BA000
unkown
page execute and read and write
1D335000
heap
page read and write
61E00000
direct allocation
page execute and read and write
F54000
heap
page read and write
360000
unkown
page read and write
31BF000
stack
page read and write
4841000
heap
page read and write
1D343000
heap
page read and write
1D33C000
heap
page read and write
5AA000
unkown
page execute and read and write
1D35C000
heap
page read and write
10EB000
stack
page read and write
4841000
heap
page read and write
1CDDE000
stack
page read and write
4841000
heap
page read and write
4E30000
direct allocation
page execute and read and write
A6C000
stack
page read and write
4D0C000
stack
page read and write
849000
unkown
page execute and read and write
2CBF000
stack
page read and write
85F000
unkown
page execute and write copy
29386000
heap
page read and write
2F7E000
stack
page read and write
4841000
heap
page read and write
4841000
heap
page read and write
B69000
stack
page read and write
1D34C000
heap
page read and write
1D340000
heap
page read and write
1D326000
heap
page read and write
1D359000
heap
page read and write
852000
unkown
page execute and read and write
393F000
stack
page read and write
1CEDF000
stack
page read and write
41FF000
stack
page read and write
1D340000
heap
page read and write
F54000
heap
page read and write
4841000
heap
page read and write
4E60000
direct allocation
page execute and read and write
F54000
heap
page read and write
F0E000
stack
page read and write
F54000
heap
page read and write
4860000
heap
page read and write
1D359000
heap
page read and write
4841000
heap
page read and write
294DA000
heap
page read and write
40FE000
stack
page read and write
F54000
heap
page read and write
1D310000
heap
page read and write
4841000
heap
page read and write
1110000
heap
page read and write
1D35C000
heap
page read and write
4841000
heap
page read and write
1D340000
heap
page read and write
294E6000
heap
page read and write
1D340000
heap
page read and write
1D34D000
heap
page read and write
1D359000
heap
page read and write
1D338000
heap
page read and write
1D35C000
heap
page read and write
1100000
direct allocation
page read and write
F54000
heap
page read and write
11FB000
heap
page read and write
1D328000
heap
page read and write
F54000
heap
page read and write
4CD0000
direct allocation
page read and write
4841000
heap
page read and write
1100000
direct allocation
page read and write
1D359000
heap
page read and write
1D16C000
stack
page read and write
F54000
heap
page read and write
1D335000
heap
page read and write
1D340000
heap
page read and write
473E000
stack
page read and write
4841000
heap
page read and write
4841000
heap
page read and write
F54000
heap
page read and write
1D34C000
heap
page read and write
4841000
heap
page read and write
294E2000
heap
page read and write
6C81F000
unkown
page readonly
4841000
heap
page read and write
4E80000
direct allocation
page execute and read and write
F54000
heap
page read and write
1D337000
heap
page read and write
437E000
stack
page read and write
1D340000
heap
page read and write
6C680000
unkown
page readonly
B6D000
stack
page read and write
1117000
heap
page read and write
F54000
heap
page read and write
4841000
heap
page read and write
3E8000
unkown
page execute and read and write
1100000
direct allocation
page read and write
1CB5E000
stack
page read and write
1D337000
heap
page read and write
1D340000
heap
page read and write
4841000
heap
page read and write
6F871000
unkown
page execute read
4841000
heap
page read and write
F54000
heap
page read and write
29379000
heap
page read and write
6C865000
unkown
page readonly
1D35A000
heap
page read and write
1D355000
heap
page read and write
105E000
stack
page read and write
4841000
heap
page read and write
1D340000
heap
page read and write
1D343000
heap
page read and write
1CD9F000
stack
page read and write
1D337000
heap
page read and write
1D337000
heap
page read and write
4841000
heap
page read and write
5BE000
unkown
page execute and read and write
1128000
heap
page read and write
61ECD000
direct allocation
page readonly
6F8FE000
unkown
page read and write
3EF000
unkown
page execute and read and write
1D355000
heap
page read and write
4841000
heap
page read and write
29371000
heap
page read and write
383E000
stack
page read and write
F54000
heap
page read and write
35BE000
stack
page read and write
1D33D000
heap
page read and write
1D352000
heap
page read and write
30BE000
stack
page read and write
6C860000
unkown
page read and write
423E000
stack
page read and write
F54000
heap
page read and write
433F000
stack
page read and write
61ED0000
direct allocation
page read and write
505000
unkown
page execute and read and write
307F000
stack
page read and write
333E000
stack
page read and write
4841000
heap
page read and write
4E70000
direct allocation
page execute and read and write
1D33C000
heap
page read and write
F54000
heap
page read and write
There are 363 hidden memdumps, click here to show them.