IOC Report
5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe

loading gif

Files

File Path
Type
Category
Malicious
5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFCFHJJECAEHJJKEHIDB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BGCBGCAFIIECBFIDHIJKFBAKEG
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EBGCGHID
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GHDHJEBFBFHJECAKFCAA
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\IDAAKEHJDHJKEBFHJEGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IIIECAAKECFHIECBKJDHIJKJDH
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\JEBFIIIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe
"C:\Users\user\Desktop\5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe"
 malicious
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
 malicious

URLs

Name
IP
Malicious
http://147.45.44.221/3538548809da56b2/msvcp140.dll
147.45.44.221
 malicious
http://147.45.44.221/3538548809da56b2/vcruntime140.dll
147.45.44.221
 malicious
http://147.45.44.221/3538548809da56b2/mozglue.dll
147.45.44.221
 malicious
http://147.45.44.221
unknown
 malicious
http://147.45.44.221/3538548809da56b2/sqlite3.dll
147.45.44.221
 malicious
http://147.45.44.221/28166bd28a5d19e6.php
147.45.44.221
 malicious
http://147.45.44.221/
147.45.44.221
 malicious
http://147.45.44.221/3538548809da56b2/nss3.dll
147.45.44.221
 malicious
http://147.45.44.221/3538548809da56b2/softokn3.dll
147.45.44.221
 malicious
http://147.45.44.221/3538548809da56b2/freebl3.dll
147.45.44.221
 malicious
https://doi.org/GTB
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
http://147.45.44.221/28166bd28a5d19e6.phpD
unknown
http://147.45.44.221/28166bd28a5d19e6.php;
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://147.45.44.221b
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://147.45.44.221/28166bd28a5d19e6.phpition:
unknown
http://147.45.44.221/28166bd28a5d19e6.phpwser
unknown
http://147.45.44.221KEBFB
unknown
http://147.45.44.221/28166bd28a5d19e6.php#
unknown
http://147.45.44.221/3538548809da56b2/vcruntime140.dllW
unknown
https://ramensoftware.com/0
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
http://147.45.44.221/c
unknown
http://147.45.44.221/28166bd28a5d19e6.phpla
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://147.45.44.221/3538548809da56b2/mozglue.dll8
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17ate
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://147.45.44.221/3538548809da56b2/vcruntime140.dll6
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
http://147.45.44.221/3538548809da56b2/mozglue.dllX
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://147.45.44.221/3538548809da56b2/freebl3.dll4
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://ac.ecopnacl
unknown
http://147.45.44.221/28166bd28a5d19e6.phpc
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://147.45.44.221/28166bd28a5d19e6.phpare
unknown
http://147.45.44.221/28166bd28a5d19e6.phpW
unknown
https://support.mozilla.org
unknown
https://ac.ecop
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://147.45.44.221/3538548809da56b2/nss3.dllX
unknown
http://147.45.44.221/28166bd28a5d19e6.phpK
unknown
There are 51 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
147.45.44.221
unknown
Russian Federation
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
2750000
remote allocation
page execute and read and write
 malicious
2418000
direct allocation
page read and write
 malicious
23CA000
direct allocation
page read and write
 malicious
227A000
direct allocation
page read and write
 malicious
21D6000
direct allocation
page read and write
 malicious
29D7000
heap
page read and write
 malicious
6CA70000
unkown
page read and write
28E40000
heap
page read and write
22B67000
heap
page read and write
E70000
unkown
page readonly
1C79000
unkown
page read and write
20B0000
direct allocation
page read and write
69E000
stack
page read and write
6C87E000
unkown
page read and write
22B57000
heap
page read and write
28BF3000
heap
page read and write
6CC000
heap
page read and write
6C0000
heap
page read and write
22B63000
heap
page read and write
219C000
direct allocation
page read and write
22B67000
heap
page read and write
28EBB000
heap
page read and write
1CAD0000
heap
page read and write
1D22000
unkown
page readonly
22B67000
heap
page read and write
20CA000
direct allocation
page read and write
2088000
direct allocation
page read and write
20C0000
direct allocation
page read and write
22B67000
heap
page read and write
28EB8000
heap
page read and write
22B40000
heap
page read and write
277B000
remote allocation
page execute and read and write
280D000
remote allocation
page execute and read and write
2038000
direct allocation
page read and write
1C6CD000
stack
page read and write
1C34000
unkown
page write copy
22B4A000
heap
page read and write
22B67000
heap
page read and write
2082000
direct allocation
page read and write
22B83000
heap
page read and write
1FB0000
direct allocation
page read and write
22B67000
heap
page read and write
2032000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
218A000
direct allocation
page read and write
28C05000
heap
page read and write
3AD000
stack
page read and write
21CC000
direct allocation
page read and write
2AAE000
heap
page read and write
1CAD1000
heap
page read and write
2180000
direct allocation
page read and write
22B59000
heap
page read and write
6CA75000
unkown
page readonly
2004000
direct allocation
page read and write
22B67000
heap
page read and write
22B67000
heap
page read and write
1FB7000
direct allocation
page read and write
1C8CF000
stack
page read and write
2166000
direct allocation
page read and write
201C000
direct allocation
page read and write
1CAC0000
heap
page read and write
22B64000
heap
page read and write
20DA000
direct allocation
page read and write
610000
heap
page read and write
22B76000
heap
page read and write
1C9B000
unkown
page read and write
6CA6E000
unkown
page read and write
283F000
remote allocation
page execute and read and write
22B63000
heap
page read and write
20BE000
direct allocation
page read and write
6CD000
heap
page read and write
1C8E0000
heap
page read and write
22B67000
heap
page read and write
1C8F000
unkown
page read and write
22B76000
heap
page read and write
21FB000
direct allocation
page read and write
2164000
direct allocation
page read and write
630000
heap
page read and write
6C4000
heap
page read and write
27E2000
remote allocation
page execute and read and write
22B61000
heap
page read and write
22B5B000
heap
page read and write
1CAD1000
heap
page read and write
223A000
direct allocation
page read and write
1CB8000
unkown
page read and write
2080000
direct allocation
page read and write
2045000
direct allocation
page read and write
22B5B000
heap
page read and write
2020000
direct allocation
page read and write
28C0C000
heap
page read and write
14D5000
unkown
page readonly
1CCC000
unkown
page write copy
1F2F000
stack
page read and write
1C36000
unkown
page read and write
22B54000
heap
page read and write
22D6000
direct allocation
page read and write
6C890000
unkown
page readonly
28BF8000
heap
page read and write
22B8A000
heap
page read and write
22B62000
heap
page read and write
1C2D000
unkown
page write copy
22B89000
heap
page read and write
6FD000
stack
page read and write
2086000
direct allocation
page read and write
22B61000
heap
page read and write
20B8000
direct allocation
page read and write
22B7B000
heap
page read and write
2154000
direct allocation
page read and write
2006000
direct allocation
page read and write
1C80D000
stack
page read and write
22B8A000
heap
page read and write
1C2E000
unkown
page read and write
6C86D000
unkown
page readonly
22B4B000
heap
page read and write
209E000
direct allocation
page read and write
2500000
direct allocation
page read and write
28BB0000
heap
page read and write
61ED4000
direct allocation
page readonly
219A000
direct allocation
page read and write
21D3000
direct allocation
page read and write
1C8E000
unkown
page write copy
2040000
direct allocation
page read and write
8D0000
heap
page read and write
1E2F000
stack
page read and write
2016000
direct allocation
page read and write
225FF000
stack
page read and write
20F4000
direct allocation
page read and write
2A2F000
heap
page read and write
24DC000
direct allocation
page read and write
21B2000
direct allocation
page read and write
6C7F0000
unkown
page readonly
8C0000
direct allocation
page read and write
6C7F1000
unkown
page execute read
28C5C000
heap
page read and write
2FE20000
heap
page read and write
20A6000
direct allocation
page read and write
61EB4000
direct allocation
page read and write
201A000
direct allocation
page read and write
1C8B000
unkown
page read and write
28E20000
trusted library allocation
page read and write
28E1F000
stack
page read and write
1F6D000
stack
page read and write
22B6A000
heap
page read and write
285F000
remote allocation
page execute and read and write
203A000
direct allocation
page read and write
9E0000
direct allocation
page read and write
224FF000
stack
page read and write
1C58F000
stack
page read and write
22B84000
heap
page read and write
20DC000
direct allocation
page read and write
2182000
direct allocation
page read and write
810000
heap
page read and write
22B76000
heap
page read and write
28D1E000
stack
page read and write
839000
direct allocation
page read and write
28F5000
remote allocation
page execute and read and write
22B61000
heap
page read and write
22B4D000
heap
page read and write
1CB3000
unkown
page read and write
22B7B000
heap
page read and write
22B5A000
heap
page read and write
22B83000
heap
page read and write
8B0000
direct allocation
page read and write
22B64000
heap
page read and write
620000
heap
page readonly
22B84000
heap
page read and write
21CA000
direct allocation
page read and write
22B4A000
heap
page read and write
22B5A000
heap
page read and write
61ECC000
direct allocation
page read and write
2160000
direct allocation
page read and write
22B60000
heap
page read and write
2014000
direct allocation
page read and write
2F910000
heap
page read and write
27AA000
remote allocation
page execute and read and write
1C88000
unkown
page write copy
22B83000
heap
page read and write
61ED0000
direct allocation
page read and write
2198000
direct allocation
page read and write
204E000
direct allocation
page read and write
1C5CD000
stack
page read and write
6CA6F000
unkown
page write copy
6C882000
unkown
page readonly
1C88E000
stack
page read and write
22B67000
heap
page read and write
22B67000
heap
page read and write
2A70000
heap
page read and write
20A4000
direct allocation
page read and write
1C37000
unkown
page write copy
1C89000
unkown
page read and write
22B67000
heap
page read and write
DDE000
stack
page read and write
6C891000
unkown
page execute read
1CBDC000
heap
page read and write
E71000
unkown
page execute read
21B0000
direct allocation
page read and write
E1E000
stack
page read and write
21B6000
direct allocation
page read and write
22B5F000
heap
page read and write
22B76000
heap
page read and write
1C2D000
unkown
page write copy
1C8A000
unkown
page write copy
200C000
direct allocation
page read and write
453E000
stack
page read and write
D5F000
stack
page read and write
226FF000
stack
page read and write
22B67000
heap
page read and write
2104000
direct allocation
page read and write
22B67000
heap
page read and write
E70000
unkown
page readonly
1C54E000
stack
page read and write
217E000
direct allocation
page read and write
291B000
remote allocation
page execute and read and write
22B67000
heap
page read and write
28BF1000
heap
page read and write
2915000
remote allocation
page execute and read and write
22B67000
heap
page read and write
22B5A000
heap
page read and write
3A8000
stack
page read and write
227FF000
stack
page read and write
22B76000
heap
page read and write
2A65000
heap
page read and write
22BE7000
heap
page read and write
223F000
direct allocation
page read and write
27D8000
remote allocation
page execute and read and write
2056000
direct allocation
page read and write
1CCD000
unkown
page readonly
2A16000
heap
page read and write
28BD0000
heap
page read and write
276E000
remote allocation
page readonly
28EC1000
heap
page read and write
1FB4000
direct allocation
page read and write
22B84000
heap
page read and write
2196000
direct allocation
page read and write
2018000
direct allocation
page read and write
22B4B000
heap
page read and write
D9D000
stack
page read and write
17E2000
unkown
page readonly
2110000
direct allocation
page read and write
1CCD000
unkown
page readonly
2801000
remote allocation
page execute and read and write
20CC000
direct allocation
page read and write
3CC000
stack
page read and write
2094000
direct allocation
page read and write
22B83000
heap
page read and write
22B5E000
heap
page read and write
61ECD000
direct allocation
page readonly
28EC0000
heap
page read and write
22B5A000
heap
page read and write
22B60000
heap
page read and write
29D0000
heap
page read and write
1FAD000
stack
page read and write
2C9E000
stack
page read and write
61E01000
direct allocation
page execute read
1C7E000
unkown
page read and write
204C000
direct allocation
page read and write
1C7A000
unkown
page write copy
22B83000
heap
page read and write
201E000
direct allocation
page read and write
20D2000
direct allocation
page read and write
27DF000
remote allocation
page execute and read and write
730000
heap
page read and write
299A000
remote allocation
page execute and read and write
28EB3000
heap
page read and write
61EB7000
direct allocation
page readonly
22B84000
heap
page read and write
1CC4000
unkown
page read and write
232E000
direct allocation
page read and write
22B7B000
heap
page read and write
1CCC000
unkown
page write copy
830000
direct allocation
page read and write
E5D000
stack
page read and write
22B65000
heap
page read and write
20BA000
direct allocation
page read and write
2122000
direct allocation
page read and write
2466000
direct allocation
page read and write
22B43000
heap
page read and write
214E000
direct allocation
page read and write
29AC000
remote allocation
page readonly
20C4000
direct allocation
page read and write
657000
heap
page read and write
1C7B000
unkown
page read and write
22B61000
heap
page read and write
2F91A000
heap
page read and write
2190000
direct allocation
page read and write
22B84000
heap
page read and write
22C46000
heap
page read and write
286B000
remote allocation
page execute and read and write
22B64000
heap
page read and write
655000
heap
page read and write
22B6A000
heap
page read and write
22B50000
heap
page read and write
21C6000
direct allocation
page read and write
22B62000
heap
page read and write
20E8000
direct allocation
page read and write
22B5A000
heap
page read and write
22B5E000
heap
page read and write
1CA3D000
stack
page read and write
1D22000
unkown
page readonly
1CBD0000
trusted library allocation
page read and write
2012000
direct allocation
page read and write
221F000
direct allocation
page read and write
C5E000
stack
page read and write
22B83000
heap
page read and write
14D5000
unkown
page readonly
650000
heap
page read and write
22B83000
heap
page read and write
27D5000
remote allocation
page execute and read and write
218C000
direct allocation
page read and write
1C7C000
unkown
page write copy
2130000
direct allocation
page read and write
61ED3000
direct allocation
page read and write
2002000
direct allocation
page read and write
8EC000
heap
page read and write
23C0000
direct allocation
page read and write
21A4000
direct allocation
page read and write
1C70E000
stack
page read and write
28BFF000
heap
page read and write
22BE8000
heap
page read and write
28C5A000
heap
page read and write
E71000
unkown
page execute read
214C000
direct allocation
page read and write
22B89000
heap
page read and write
22B67000
heap
page read and write
22B67000
heap
page read and write
22B61000
heap
page read and write
17E2000
unkown
page readonly
219E000
direct allocation
page read and write
8E0000
heap
page read and write
22B5A000
heap
page read and write
22B67000
heap
page read and write
2036000
direct allocation
page read and write
22B67000
heap
page read and write
2AA9000
heap
page read and write
657000
heap
page read and write
22B65000
heap
page read and write
2194000
direct allocation
page read and write
22B62000
heap
page read and write
2832000
remote allocation
page execute and read and write
6CA2F000
unkown
page readonly
2A6C000
heap
page read and write
20DE000
direct allocation
page read and write
3A3000
stack
page read and write
1C93E000
stack
page read and write
70E000
stack
page read and write
30330000
heap
page read and write
22B76000
heap
page read and write
36B000
stack
page read and write
22B81000
heap
page read and write
22B62000
heap
page read and write
22C8000
direct allocation
page read and write
There are 341 hidden memdumps, click here to show them.