IOC Report
4c469e2cf403fea6249e835ddce23de2.exe

loading gif

Files

File Path
Type
Category
Malicious
4c469e2cf403fea6249e835ddce23de2.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\BAEBGCFIEHCFIDGCAAFB
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\CFIEBKEHCAKFCBFIDAAKJDAAFC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DHCAAEBKEGHJKEBFHJDBFCFBKK
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\EGCBFIEHIEGCAAAKKKKEGDHJDH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FHDAFIID
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IDBKKKKKFBGDGDHIDBGH
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JEHDHIEG
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KFCBAEHCAEGDHJKFHJKF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe
"C:\Users\user\Desktop\4c469e2cf403fea6249e835ddce23de2.exe"
 malicious

URLs

Name
IP
Malicious
http://45.200.148.113/2a5dc88bed850cdd/msvcp140.dll
45.200.148.113
 malicious
http://45.200.148.113/2a5dc88bed850cdd/freebl3.dll
45.200.148.113
 malicious
http://45.200.148.113/2a5dc88bed850cdd/sqlite3.dll
45.200.148.113
 malicious
http://45.200.148.113/2a5dc88bed850cdd/mozglue.dll
45.200.148.113
 malicious
http://45.200.148.113/
45.200.148.113
 malicious
http://45.200.148.113/2a5dc88bed850cdd/vcruntime140.dll
45.200.148.113
 malicious
http://45.200.148.113/2a5dc88bed850cdd/softokn3.dll
45.200.148.113
 malicious
http://45.200.148.113/0a616124ff2f2b69.php
45.200.148.113
 malicious
http://45.200.148.113/2a5dc88bed850cdd/nss3.dll
45.200.148.113
 malicious
http://45.200.148.113/X
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
http://45.200.148.113/0a616124ff2f2b69.phpO
unknown
http://www.usb-over-network.com
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://45.200.148.113/0a616124ff2f2b69.phpa
unknown
http://45.200.148.113/0a616124ff2f2b69.phpser
unknown
http://45.200.148.113/fmw
unknown
http://45.200.148.113/0a616124ff2f2b69.phpdll
unknown
http://45.200.148.113/0a616124ff2f2b69.php1
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
http://45.200.148.113/0a616124ff2f2b69.php-
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://45.200.148.113/0a616124ff2f2b69.php)
unknown
http://45.200.148.113/0a616124ff2f2b69.phpE
unknown
http://45.200.148.113/2a5dc88bed850cdd/vcruntime140.dll8bed850cdd/nss3.dll
unknown
http://45.200.148.113/0a616124ff2f2b69.php=
unknown
http://www.usb-over-network.com/usb-over-network-purchase.html?rf=usbnetclient&ver=6.0.6
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
http://45.200.148.113/2a5dc88bed850cdd/softokn3.dllb
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://45.200.148.113
unknown
http://45.200.148.113/2a5dc88bed850cdd/nss3.dll4
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://ac.ecopnacl
unknown
http://45.200.148.113/0a616124ff2f2b69.phpnomi
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17381
unknown
http://45.200.148.113DHJJ
unknown
http://45.200.148.113/0a616124ff2f2b69.phpem
unknown
http://45.200.148.113/0a616124ff2f2b69.phpp
unknown
http://45.200.148.113/0a616124ff2f2b69.phpq
unknown
http://45.200.148.113/7
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://www.usb-over-network.com?rf=usbnetclient&ver=6.0.6usbclienthelp.chmhttp://www.usb-over-networ
unknown
http://45.200.148.113/0a616124ff2f2b69.phpm
unknown
http://45.200.148.113/2a5dc88bed850cdd/nss3.dll(
unknown
http://45.200.148.113/2a5dc88bed850cdd/vcruntime140.dll1
unknown
https://support.mozilla.org
unknown
http://45.200.148.113/0a616124ff2f2b69.phpus.wallet
unknown
http://45.200.148.113/2a5dc88bed850cdd/softokn3.dllB
unknown
http://45.200.148.113/0a616124ff2f2b69.phpBGCFIEHCFIDGCAAFB
unknown
https://ac.ecop
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://45.200.148.113/0a616124ff2f2b69.phption:
unknown
There are 60 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
45.200.148.113
unknown
Seychelles
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
3D18000
heap
page execute and read and write
 malicious
1D51000
heap
page read and write
 malicious
BB7000
unkown
page readonly
FC7000
unkown
page readonly
109A000
unkown
page readonly
1094000
unkown
page readonly
10E5000
unkown
page readonly
1B94000
heap
page read and write
2276A000
heap
page read and write
3F63000
heap
page execute and read and write
104F000
unkown
page readonly
109A000
unkown
page readonly
3911000
heap
page read and write
22762000
heap
page read and write
3911000
heap
page read and write
1345000
unkown
page readonly
1428000
unkown
page readonly
3911000
heap
page read and write
28800000
heap
page read and write
22762000
heap
page read and write
6C730000
unkown
page readonly
22764000
heap
page read and write
DCE000
unkown
page readonly
1397000
unkown
page readonly
61ED4000
direct allocation
page readonly
3910000
heap
page read and write
22763000
heap
page read and write
139B000
unkown
page readonly
3911000
heap
page read and write
2274B000
heap
page read and write
28988000
heap
page read and write
3911000
heap
page read and write
EA6000
unkown
page readonly
1C7DD000
heap
page read and write
EB1000
unkown
page readonly
2276E000
heap
page read and write
3DAB000
heap
page execute and read and write
3911000
heap
page read and write
22740000
heap
page read and write
61E00000
direct allocation
page execute and read and write
28990000
heap
page read and write
3911000
heap
page read and write
B4E000
unkown
page readonly
1C65D000
stack
page read and write
3880000
heap
page read and write
12C4000
unkown
page readonly
3930000
heap
page read and write
3911000
heap
page read and write
3911000
heap
page read and write
3911000
heap
page read and write
3911000
heap
page read and write
3911000
heap
page read and write
146D000
unkown
page readonly
287E0000
heap
page read and write
1090000
unkown
page readonly
22761000
heap
page read and write
9B1000
unkown
page execute read
6C8CF000
unkown
page readonly
2274B000
heap
page read and write
1C24F000
stack
page read and write
1D7B000
heap
page read and write
1B94000
heap
page read and write
6F8EE000
unkown
page read and write
1230000
unkown
page readonly
22760000
heap
page read and write
3DCA000
heap
page execute and read and write
FC7000
unkown
page readonly
28991000
heap
page read and write
2277C000
heap
page read and write
4178000
stack
page read and write
1B94000
heap
page read and write
DE3000
unkown
page readonly
22773000
heap
page read and write
3E28000
heap
page execute and read and write
E65000
unkown
page readonly
3DD6000
heap
page execute and read and write
22764000
heap
page read and write
2274E000
heap
page read and write
3DA1000
heap
page execute and read and write
D0B000
unkown
page readonly
417D000
stack
page read and write
1358000
unkown
page readonly
1358000
unkown
page readonly
61ECC000
direct allocation
page read and write
22760000
heap
page read and write
EDF000
unkown
page readonly
3F75000
heap
page execute and read and write
1F2E000
stack
page read and write
13EF000
unkown
page readonly
2274B000
heap
page read and write
BA5000
unkown
page write copy
1432000
unkown
page readonly
6F8DD000
unkown
page readonly
2274B000
heap
page read and write
1746000
unkown
page readonly
3911000
heap
page read and write
BB1000
unkown
page read and write
3911000
heap
page read and write
1300000
unkown
page readonly
22777000
heap
page read and write
DE3000
unkown
page readonly
22762000
heap
page read and write
123B000
unkown
page readonly
11A5000
unkown
page readonly
1B94000
heap
page read and write
22745000
heap
page read and write
3911000
heap
page read and write
22761000
heap
page read and write
1B94000
heap
page read and write
1B8E000
stack
page read and write
BAA000
unkown
page write copy
3850000
heap
page read and write
139B000
unkown
page readonly
11EA000
unkown
page readonly
3911000
heap
page read and write
3911000
heap
page read and write
22772000
heap
page read and write
1B94000
heap
page read and write
1127000
unkown
page readonly
10D5000
unkown
page readonly
2277C000
heap
page read and write
3911000
heap
page read and write
11A5000
unkown
page readonly
22760000
heap
page read and write
2277C000
heap
page read and write
1C38C000
stack
page read and write
22840000
heap
page read and write
1B94000
heap
page read and write
2277C000
heap
page read and write
2276B000
heap
page read and write
1401000
unkown
page readonly
22750000
heap
page read and write
3911000
heap
page read and write
6C731000
unkown
page execute read
3911000
heap
page read and write
1399000
unkown
page readonly
104B000
unkown
page readonly
22750000
heap
page read and write
22775000
heap
page read and write
6C90F000
unkown
page write copy
1160000
unkown
page readonly
1B95000
heap
page read and write
130A000
unkown
page readonly
6C90E000
unkown
page read and write
1B94000
heap
page read and write
BB7000
unkown
page readonly
3E34000
heap
page execute and read and write
28862000
heap
page read and write
227FE000
heap
page read and write
22774000
heap
page read and write
3911000
heap
page read and write
3911000
heap
page read and write
1090000
unkown
page readonly
3911000
heap
page read and write
9B0000
unkown
page readonly
1B94000
heap
page read and write
E61000
unkown
page readonly
9B1000
unkown
page execute read
22764000
heap
page read and write
3D73000
heap
page execute and read and write
2277C000
heap
page read and write
1741000
unkown
page readonly
1B94000
heap
page read and write
1CE4000
heap
page read and write
12BA000
unkown
page readonly
3911000
heap
page read and write
12BA000
unkown
page readonly
3911000
heap
page read and write
1B94000
heap
page read and write
1005000
unkown
page readonly
1432000
unkown
page readonly
3911000
heap
page read and write
9B0000
unkown
page readonly
EB1000
unkown
page readonly
22742000
heap
page read and write
F69000
unkown
page readonly
1D38000
heap
page read and write
3911000
heap
page read and write
1007000
unkown
page readonly
1C7D0000
trusted library allocation
page read and write
1B94000
heap
page read and write
3900000
heap
page read and write
22750000
heap
page read and write
1B94000
heap
page read and write
1B94000
heap
page read and write
3911000
heap
page read and write
3911000
heap
page read and write
1B94000
heap
page read and write
1B94000
heap
page read and write
3DFB000
heap
page execute and read and write
11F3000
unkown
page readonly
3911000
heap
page read and write
BB6000
unkown
page read and write
1276000
unkown
page readonly
1746000
unkown
page readonly
142A000
unkown
page readonly
104F000
unkown
page readonly
14E4000
unkown
page readonly
BA4000
unkown
page read and write
6C915000
unkown
page readonly
3E08000
heap
page execute and read and write
1CAE000
stack
page read and write
1C28E000
stack
page read and write
61ED3000
direct allocation
page read and write
22760000
heap
page read and write
1401000
unkown
page readonly
13EF000
unkown
page readonly
123B000
unkown
page readonly
3911000
heap
page read and write
2277C000
heap
page read and write
E61000
unkown
page readonly
1092000
unkown
page readonly
1230000
unkown
page readonly
2277C000
heap
page read and write
6C910000
unkown
page read and write
28996000
heap
page read and write
22750000
heap
page read and write
1B90000
heap
page read and write
F22000
unkown
page readonly
1345000
unkown
page readonly
1300000
unkown
page readonly
2276E000
heap
page read and write
1B94000
heap
page read and write
3911000
heap
page read and write
6F861000
unkown
page execute read
22764000
heap
page read and write
22765000
heap
page read and write
F30000
unkown
page readonly
116C000
unkown
page readonly
D0B000
unkown
page readonly
38CE000
stack
page read and write
1C3CD000
stack
page read and write
2F45A000
heap
page read and write
1005000
unkown
page readonly
2276A000
heap
page read and write
2277C000
heap
page read and write
1B94000
heap
page read and write
28989000
heap
page read and write
1160000
unkown
page readonly
1B94000
heap
page read and write
2274B000
heap
page read and write
3911000
heap
page read and write
227EE000
heap
page read and write
3F7A000
heap
page execute and read and write
2276E000
heap
page read and write
22762000
heap
page read and write
22771000
heap
page read and write
F24000
unkown
page readonly
3890000
trusted library allocation
page read and write
22857000
heap
page read and write
F3B000
unkown
page readonly
1C4CE000
stack
page read and write
3EBE000
heap
page execute and read and write
3911000
heap
page read and write
1B94000
heap
page read and write
2F450000
heap
page read and write
3911000
heap
page read and write
1C75D000
stack
page read and write
3911000
heap
page read and write
3911000
heap
page read and write
3911000
heap
page read and write
DCE000
unkown
page readonly
22773000
heap
page read and write
F30000
unkown
page readonly
1B94000
heap
page read and write
1092000
unkown
page readonly
FAD000
unkown
page readonly
3911000
heap
page read and write
3911000
heap
page read and write
1CB0000
heap
page read and write
3915000
heap
page read and write
22768000
heap
page read and write
1B94000
heap
page read and write
22779000
heap
page read and write
2277B000
heap
page read and write
1B94000
heap
page read and write
111B000
unkown
page readonly
22762000
heap
page read and write
22763000
heap
page read and write
202E000
stack
page read and write
BA4000
unkown
page write copy
142A000
unkown
page readonly
22775000
heap
page read and write
13E3000
unkown
page readonly
3DA8000
heap
page execute and read and write
22764000
heap
page read and write
10D5000
unkown
page readonly
227EF000
heap
page read and write
3911000
heap
page read and write
1B40000
heap
page read and write
3911000
heap
page read and write
F69000
unkown
page readonly
6F8F2000
unkown
page readonly
2F966000
heap
page read and write
2276E000
heap
page read and write
1CEC000
heap
page read and write
3911000
heap
page read and write
F24000
unkown
page readonly
1B94000
heap
page read and write
3911000
heap
page read and write
130A000
unkown
page readonly
1397000
unkown
page readonly
61EB7000
direct allocation
page readonly
287C0000
heap
page read and write
104B000
unkown
page readonly
1C60F000
stack
page read and write
4173000
stack
page read and write
1AFC000
stack
page read and write
3911000
heap
page read and write
1D30000
heap
page read and write
61ED0000
direct allocation
page read and write
F3B000
unkown
page readonly
1C50E000
stack
page read and write
E1C000
unkown
page readonly
EDF000
unkown
page readonly
EA6000
unkown
page readonly
1B94000
heap
page read and write
146D000
unkown
page readonly
1B94000
heap
page read and write
407F000
stack
page read and write
11EA000
unkown
page readonly
11F3000
unkown
page readonly
22764000
heap
page read and write
22760000
heap
page read and write
3911000
heap
page read and write
1B94000
heap
page read and write
3AA0000
heap
page execute and read and write
E65000
unkown
page readonly
17DC000
stack
page read and write
1B94000
heap
page read and write
61E01000
direct allocation
page execute read
1741000
unkown
page readonly
1B94000
heap
page read and write
116C000
unkown
page readonly
1D96000
heap
page read and write
13E3000
unkown
page readonly
BA8000
unkown
page read and write
3911000
heap
page read and write
14E4000
unkown
page readonly
1094000
unkown
page readonly
3EDE000
heap
page execute and read and write
2274D000
heap
page read and write
61EB4000
direct allocation
page read and write
1B94000
heap
page read and write
3EE4000
heap
page execute and read and write
3911000
heap
page read and write
22768000
heap
page read and write
2275A000
heap
page read and write
3911000
heap
page read and write
B4E000
unkown
page readonly
1399000
unkown
page readonly
3911000
heap
page read and write
10E5000
unkown
page readonly
1276000
unkown
page readonly
E1C000
unkown
page readonly
3920000
heap
page read and write
1007000
unkown
page readonly
2FE70000
heap
page read and write
3911000
heap
page read and write
1428000
unkown
page readonly
3A4B000
stack
page read and write
F22000
unkown
page readonly
288F0000
trusted library allocation
page read and write
3911000
heap
page read and write
3911000
heap
page read and write
1B94000
heap
page read and write
12C4000
unkown
page readonly
3A8E000
stack
page read and write
3911000
heap
page read and write
111B000
unkown
page readonly
1B94000
heap
page read and write
6F860000
unkown
page readonly
FAD000
unkown
page readonly
61ECD000
direct allocation
page readonly
1CE0000
heap
page read and write
1127000
unkown
page readonly
1B94000
heap
page read and write
3D9E000
heap
page execute and read and write
3911000
heap
page read and write
There are 369 hidden memdumps, click here to show them.