IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFCFHDHI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\AFCFHDHIIIECBGCAKFIJ
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\CAKEBFCFIJJKKECAKJEHDAAFIE
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\DBKKFHIEGDHJKECAAKKEBAFIJK
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\DBKKKEHDHCBFIEBFBGIDGHJJJD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\ECBGCGCGIEGCBFHIIEBF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GDBAKEGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HCAAEGIJKEGHIDGCBAEB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JDHCBAEHJJJKKFIDGHJECAFIDA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious

URLs

Name
IP
Malicious
http://185.215.113.37/
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpata
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpnfigOverlay
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll:
unknown
 malicious
http://185.215.113.372
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/nss3.dll
185.215.113.37
 malicious
http://185.215.113.37
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/mozglue.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpCoinomi
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dll
185.215.113.37
 malicious
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
185.215.113.37
 malicious
http://185.215.113.37e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phption:
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpXZ
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpf
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpR
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/freebl3.dll~
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/sqlite3.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.phpF
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/msvcp140.dll
185.215.113.37
 malicious
http://185.215.113.37/e2b1563c6670f193.php.
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dllr
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpj=c
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.php6
unknown
 malicious
http://185.215.113.37/0d60be0de163924d/softokn3.dlld
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpN=
unknown
 malicious
http://185.215.113.37/e2b1563c6670f193.phpwindow-state.json
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://ac.ecopnacl
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
https://support.mozilla.org
unknown
https://ac.ecop
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
There are 43 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.215.113.37
unknown
Portugal
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
17EE000
heap
page read and write
 malicious
E21000
unkown
page execute and read and write
 malicious
5360000
direct allocation
page read and write
 malicious
1D9CA000
heap
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
1D9DB000
heap
page read and write
1D9D0000
heap
page read and write
1D9B5000
heap
page read and write
1684000
heap
page read and write
4ED8000
heap
page read and write
1D9ED000
heap
page read and write
4ED1000
heap
page read and write
1D9C7000
heap
page read and write
4ED1000
heap
page read and write
29A12000
heap
page read and write
1684000
heap
page read and write
4ED1000
heap
page read and write
438F000
stack
page read and write
5500000
direct allocation
page execute and read and write
1D9D0000
heap
page read and write
1D5BE000
stack
page read and write
4ED1000
heap
page read and write
1D9BD000
heap
page read and write
1D9C2000
heap
page read and write
350F000
stack
page read and write
15CE000
stack
page read and write
4EF0000
heap
page read and write
2FC17000
heap
page read and write
17D0000
direct allocation
page read and write
1D56F000
stack
page read and write
1684000
heap
page read and write
4D8F000
stack
page read and write
1D9D0000
heap
page read and write
4ED1000
heap
page read and write
1D9CA000
heap
page read and write
1684000
heap
page read and write
61EB4000
direct allocation
page read and write
29990000
heap
page read and write
1D9CA000
heap
page read and write
1D9C9000
heap
page read and write
E20000
unkown
page readonly
DB0000
heap
page read and write
39CE000
stack
page read and write
1D9C8000
heap
page read and write
107E000
unkown
page execute and read and write
4ED1000
heap
page read and write
1D9D0000
heap
page read and write
6CD50000
unkown
page read and write
1D32E000
stack
page read and write
1D9CA000
heap
page read and write
1D9CE000
heap
page read and write
5360000
direct allocation
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
61ECC000
direct allocation
page read and write
17D0000
direct allocation
page read and write
2FC16000
heap
page read and write
E1E000
stack
page read and write
FE5000
unkown
page execute and read and write
1832000
heap
page read and write
1D9BD000
heap
page read and write
1D9D3000
heap
page read and write
1D9CC000
heap
page read and write
1684000
heap
page read and write
17D0000
direct allocation
page read and write
4ED1000
heap
page read and write
1684000
heap
page read and write
166B000
stack
page read and write
1D9D6000
heap
page read and write
1D9D3000
heap
page read and write
4ED1000
heap
page read and write
12DC000
unkown
page execute and read and write
1DAC0000
trusted library allocation
page read and write
4ED1000
heap
page read and write
5510000
direct allocation
page execute and read and write
1D9C4000
heap
page read and write
4B4E000
stack
page read and write
1D9ED000
heap
page read and write
17D0000
direct allocation
page read and write
330B000
heap
page read and write
FEB000
unkown
page execute and read and write
1D9BC000
heap
page read and write
6CD0F000
unkown
page readonly
4ED1000
heap
page read and write
1D9B6000
heap
page read and write
1D9D8000
heap
page read and write
549F000
stack
page read and write
1D9ED000
heap
page read and write
4ED1000
heap
page read and write
460E000
stack
page read and write
539B000
stack
page read and write
1670000
heap
page read and write
17D0000
direct allocation
page read and write
4ED1000
heap
page read and write
1684000
heap
page read and write
23A25000
heap
page read and write
1D9CF000
heap
page read and write
32FE000
stack
page read and write
4EE0000
heap
page read and write
2FB70000
trusted library allocation
page read and write
1684000
heap
page read and write
29A52000
heap
page read and write
1D9BD000
heap
page read and write
1684000
heap
page read and write
1D9D0000
heap
page read and write
2FC0E000
heap
page read and write
1D7FD000
stack
page read and write
1D1EE000
stack
page read and write
1D9CA000
heap
page read and write
17CE000
stack
page read and write
49CF000
stack
page read and write
186A000
heap
page read and write
1D9CB000
heap
page read and write
424F000
stack
page read and write
1D9C8000
heap
page read and write
1D9ED000
heap
page read and write
3307000
heap
page read and write
1D9C8000
heap
page read and write
1684000
heap
page read and write
4ED1000
heap
page read and write
1D9B5000
heap
page read and write
1D9C4000
heap
page read and write
1D9C5000
heap
page read and write
4ED1000
heap
page read and write
1684000
heap
page read and write
299F0000
heap
page read and write
1D9C4000
heap
page read and write
3B0E000
stack
page read and write
1D9D0000
heap
page read and write
1680000
heap
page read and write
48CE000
stack
page read and write
1684000
heap
page read and write
1D9C4000
heap
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
1684000
heap
page read and write
E21000
unkown
page execute and write copy
4A0E000
stack
page read and write
DA0000
heap
page read and write
1848000
heap
page read and write
1D9A0000
heap
page read and write
384F000
stack
page read and write
4ED1000
heap
page read and write
1D9EC000
heap
page read and write
400E000
stack
page read and write
1684000
heap
page read and write
1D9C9000
heap
page read and write
4C8E000
stack
page read and write
1684000
heap
page read and write
EB2000
unkown
page execute and read and write
1D9D0000
heap
page read and write
1D9D0000
heap
page read and write
17EA000
heap
page read and write
EDD000
unkown
page execute and read and write
17E0000
heap
page read and write
F2F000
unkown
page execute and read and write
F02000
unkown
page execute and read and write
2FC09000
heap
page read and write
6CB5E000
unkown
page read and write
3E8F000
stack
page read and write
1D9C0000
heap
page read and write
1D9ED000
heap
page read and write
464E000
stack
page read and write
17D0000
direct allocation
page read and write
1316000
unkown
page execute and write copy
1684000
heap
page read and write
3ECE000
stack
page read and write
1684000
heap
page read and write
17D0000
direct allocation
page read and write
54F0000
direct allocation
page execute and read and write
4ED1000
heap
page read and write
19DE000
stack
page read and write
1684000
heap
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
330E000
heap
page read and write
4ED1000
heap
page read and write
1D9DD000
heap
page read and write
4ED1000
heap
page read and write
12FF000
unkown
page execute and read and write
1D9D0000
heap
page read and write
D53000
stack
page read and write
488F000
stack
page read and write
1D9D4000
heap
page read and write
54E0000
direct allocation
page execute and read and write
4ED1000
heap
page read and write
2FB6F000
stack
page read and write
4ED1000
heap
page read and write
1D9C8000
heap
page read and write
1D83D000
stack
page read and write
1D9CF000
heap
page read and write
1D42F000
stack
page read and write
1D6FD000
stack
page read and write
1D9B6000
heap
page read and write
FC5000
unkown
page execute and read and write
4ED1000
heap
page read and write
61ED3000
direct allocation
page read and write
17D0000
direct allocation
page read and write
1D9C5000
heap
page read and write
1684000
heap
page read and write
4ED1000
heap
page read and write
61E00000
direct allocation
page execute and read and write
388E000
stack
page read and write
299D0000
heap
page read and write
14B1000
unkown
page execute and write copy
17D0000
direct allocation
page read and write
1D9D0000
heap
page read and write
EAF000
unkown
page execute and read and write
1D9DF000
heap
page read and write
4ED1000
heap
page read and write
474F000
stack
page read and write
4ED1000
heap
page read and write
1D9B6000
heap
page read and write
4ED1000
heap
page read and write
6CD4F000
unkown
page write copy
F3E000
unkown
page execute and read and write
6CB71000
unkown
page execute read
4B0F000
stack
page read and write
4ED1000
heap
page read and write
1D9ED000
heap
page read and write
C5C000
stack
page read and write
478E000
stack
page read and write
4ED1000
heap
page read and write
4FD0000
trusted library allocation
page read and write
17D0000
direct allocation
page read and write
54E0000
direct allocation
page execute and read and write
428E000
stack
page read and write
1D2EF000
stack
page read and write
1D9D0000
heap
page read and write
1684000
heap
page read and write
4C4F000
stack
page read and write
1D9ED000
heap
page read and write
1D9ED000
heap
page read and write
4ED1000
heap
page read and write
6CD4E000
unkown
page read and write
1684000
heap
page read and write
29A56000
heap
page read and write
4ED1000
heap
page read and write
4ECF000
stack
page read and write
5340000
heap
page read and write
1D9C2000
heap
page read and write
374E000
stack
page read and write
4ED0000
heap
page read and write
1684000
heap
page read and write
1D9C2000
heap
page read and write
1684000
heap
page read and write
5360000
direct allocation
page read and write
1D9B6000
heap
page read and write
1684000
heap
page read and write
1684000
heap
page read and write
EA5000
unkown
page execute and read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
1D93C000
stack
page read and write
54D0000
direct allocation
page execute and read and write
3D4F000
stack
page read and write
4ED1000
heap
page read and write
414E000
stack
page read and write
D59000
stack
page read and write
F3B000
unkown
page execute and read and write
17D0000
direct allocation
page read and write
61E01000
direct allocation
page execute read
1D46E000
stack
page read and write
1D9D0000
heap
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
1684000
heap
page read and write
1D9ED000
heap
page read and write
6CB4D000
unkown
page readonly
1D9D0000
heap
page read and write
1D9ED000
heap
page read and write
2FA6E000
stack
page read and write
299B0000
heap
page read and write
1309000
unkown
page execute and read and write
1684000
heap
page read and write
1684000
heap
page read and write
F0F000
unkown
page execute and read and write
61ED0000
direct allocation
page read and write
1D9D0000
heap
page read and write
1684000
heap
page read and write
1684000
heap
page read and write
1684000
heap
page read and write
1316000
unkown
page execute and read and write
1D9CA000
heap
page read and write
4ED1000
heap
page read and write
1DAC0000
heap
page read and write
4ED1000
heap
page read and write
1D9CA000
heap
page read and write
1D9CC000
heap
page read and write
6CD55000
unkown
page readonly
1D6BF000
stack
page read and write
4ED1000
heap
page read and write
1684000
heap
page read and write
1D9B6000
heap
page read and write
370F000
stack
page read and write
1684000
heap
page read and write
1830000
heap
page read and write
EA8000
unkown
page execute and read and write
1D9CA000
heap
page read and write
29A32000
heap
page read and write
43CE000
stack
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
2FC11000
heap
page read and write
1684000
heap
page read and write
1D9A2000
heap
page read and write
3300000
heap
page read and write
162E000
stack
page read and write
6CB70000
unkown
page readonly
1684000
heap
page read and write
1D9DB000
heap
page read and write
1D9C4000
heap
page read and write
E7A000
unkown
page execute and read and write
178E000
stack
page read and write
44CF000
stack
page read and write
6CAD1000
unkown
page execute read
1D9D0000
heap
page read and write
410F000
stack
page read and write
61ECD000
direct allocation
page readonly
1684000
heap
page read and write
6CAD0000
unkown
page readonly
ED1000
unkown
page execute and read and write
54B0000
direct allocation
page execute and read and write
360F000
stack
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
D5D000
stack
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
14B0000
unkown
page execute and read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
1D9D7000
heap
page read and write
4ED1000
heap
page read and write
3C4E000
stack
page read and write
17D0000
direct allocation
page read and write
E20000
unkown
page read and write
1D9BA000
heap
page read and write
1684000
heap
page read and write
3ACF000
stack
page read and write
1D9B6000
heap
page read and write
3D8E000
stack
page read and write
3C0F000
stack
page read and write
1D9B6000
heap
page read and write
17D0000
direct allocation
page read and write
450E000
stack
page read and write
4DCE000
stack
page read and write
11FF000
unkown
page execute and read and write
1D9AB000
heap
page read and write
32BE000
stack
page read and write
3FCF000
stack
page read and write
1317000
unkown
page execute and write copy
4ED1000
heap
page read and write
17D0000
direct allocation
page read and write
4ED1000
heap
page read and write
1D9CA000
heap
page read and write
4ED1000
heap
page read and write
398F000
stack
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
4ED1000
heap
page read and write
327F000
stack
page read and write
1D9B5000
heap
page read and write
61EB7000
direct allocation
page readonly
61ED4000
direct allocation
page readonly
340F000
stack
page read and write
54C0000
direct allocation
page execute and read and write
4ED1000
heap
page read and write
1D9C5000
heap
page read and write
6CB62000
unkown
page readonly
There are 363 hidden memdumps, click here to show them.