IOC Report
test.exe

loading gif

Files

File Path
Type
Category
Malicious
test.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
 malicious
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
 malicious
C:\ProgramData\AEGDBAFHJJDAKEBGCFCB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EHJJKFCBGIDGHIECGCBK
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\GDHIEHJEBAAFIDHJEBGIEBFIJK
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IDGHDGIDAKEBAAKFCGHCBAKJDA
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IJKFCFHJDBKKFHIEHIDG
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJECGHJD
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KKKJKEBK
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 7, database pages 68, 1st free page 51, free pages 2, cookie 0x4a, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\json[1].json
JSON data
dropped
Chrome Cache Entry: 77
ASCII text
downloaded
Chrome Cache Entry: 78
ASCII text, with very long lines (65531)
downloaded
Chrome Cache Entry: 79
ASCII text, with very long lines (859)
downloaded
There are 16 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\test.exe
"C:\Users\user\Desktop\test.exe"
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2288,i,7698725374925482900,7061072673800453571,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2320 /prefetch:3
malicious

URLs

Name
IP
Malicious
http://45.93.20.28/
45.93.20.28
 malicious
http://45.93.20.28
unknown
 malicious
http://45.93.20.28/c66c0eade263c9a8/vcruntime140.dll
45.93.20.28
 malicious
http://45.93.20.28/c66c0eade263c9a8/msvcp140.dll
45.93.20.28
 malicious
http://45.93.20.28/c66c0eade263c9a8/freebl3.dll
45.93.20.28
 malicious
http://45.93.20.28/c66c0eade263c9a8/nss3.dll
45.93.20.28
 malicious
http://45.93.20.28/c66c0eade263c9a8/sqlite3.dll
45.93.20.28
 malicious
http://45.93.20.28/c66c0eade263c9a8/softokn3.dll
45.93.20.28
 malicious
http://45.93.20.28/85a1cacf11314eb8.php
45.93.20.28
 malicious
http://45.93.20.28/c66c0eade263c9a8/mozglue.dll
45.93.20.28
 malicious
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://45.93.20.28/c66c0eade263c9a8/softokn3.dlly
unknown
http://45.93.20.28/c66c0eade263c9a8/nss3.dllllz
unknown
http://45.93.20.28/85a1cacf11314eb8.phpCash
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
http://45.93.20.28/c66c0eade263c9a8/msvcp140.dllE
unknown
http://45.93.20.28/85a1cacf11314eb8.phpJ
unknown
http://45.93.20.28/85a1cacf11314eb8.phpexodus.conf.jsonni
unknown
http://45.93.20.28/c66c0eade263c9a8/sqlite3.dllBg
unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
http://45.93.20.28/c66c0eade263c9a8/msvcp140.dll#
unknown
http://45.93.20.28/c66c0eade263c9a8/nss3.dll;
unknown
http://45.93.20.28/85a1cacf11314eb8.phpStar
unknown
http://45.93.20.28/c66c0eade263c9a8/nss3.dll6
unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
216.58.212.132
http://45.93.20.28/85a1cacf11314eb8.php)
unknown
http://45.93.20.28/85a1cacf11314eb8.phpc_qt
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
216.58.212.132
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://45.93.20.28/c66c0eade263c9a8/msvcp140.dll1
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
http://45.93.20.28/c66c0eade263c9a8/vcruntime140.dllK
unknown
http://45.93.20.28/85a1cacf11314eb8.phps
unknown
http://45.93.20.28/c66c0eade263c9a8/nss3.dll_
unknown
http://45.93.20.28/c66c0eade263c9a8/softokn3.dll5
unknown
http://45.93.20.2885a1cacf11314eb8.phpme
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://www.google.com/async/newtab_promos
216.58.212.132
http://45.93.20.28f
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://45.93.20.28/c66c0eade263c9a8/mozglue.dlld
unknown
https://www.google.com/async/ddljson?async=ntp:2
216.58.212.132
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://45.93.20.28/85a1cacf11314eb8.phpJ:
unknown
http://45.93.20.28/c66c0eade263c9a8/softokn3.dllQ
unknown
http://45.93.20.28/c66c0eade263c9a8/nss3.dllowser
unknown
http://45.93.20.28/85a1cacf11314eb8.phpb:
unknown
http://45.93.20.28/c66c0eade263c9a8/nss3.dllata
unknown
http://45.93.20.28/85a1cacf11314eb8.phpk
unknown
https://support.mozilla.org
unknown
http://45.93.20.28/c66c0eade263c9a8/mozglue.dllXgl
unknown
http://45.93.20.28/85a1cacf11314eb8.phpdge
unknown
http://45.93.20.28/85a1cacf11314eb8.phpd
unknown
http://45.93.20.28/c66c0eade263c9a8/nss3.dllll
unknown
There are 48 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
www.google.com
216.58.212.132

IPs

IP
Domain
Country
Malicious
45.93.20.28
unknown
Netherlands
malicious
192.168.2.4
unknown
unknown
malicious
216.58.212.132
www.google.com
United States
127.0.0.1
unknown
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
178E000
heap
page read and write
 malicious
AB1000
unkown
page execute and read and write
 malicious
5420000
direct allocation
page read and write
 malicious
1654000
heap
page read and write
1654000
heap
page read and write
5DC7000
heap
page read and write
C17000
unkown
page execute and read and write
5DEE000
heap
page read and write
5DF6000
heap
page read and write
55B0000
direct allocation
page execute and read and write
1139000
unkown
page execute and write copy
5DC7000
heap
page read and write
5DE1000
heap
page read and write
61ED0000
direct allocation
page read and write
4E9E000
stack
page read and write
31E0000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
5EE9000
heap
page read and write
4FA1000
heap
page read and write
F5F000
unkown
page execute and read and write
5DE1000
heap
page read and write
1138000
unkown
page execute and read and write
4FA1000
heap
page read and write
5EE0000
trusted library allocation
page read and write
6CF30000
unkown
page read and write
5DFC000
heap
page read and write
4FA1000
heap
page read and write
409F000
stack
page read and write
40DE000
stack
page read and write
185A000
heap
page read and write
5DE1000
heap
page read and write
AB0000
unkown
page read and write
184F000
heap
page read and write
F9E000
unkown
page execute and write copy
4FA1000
heap
page read and write
61ED4000
direct allocation
page readonly
1654000
heap
page read and write
5DD9000
heap
page read and write
5B0D000
stack
page read and write
5DD8000
heap
page read and write
4FA1000
heap
page read and write
C167000
heap
page read and write
5DC7000
heap
page read and write
6CEEF000
unkown
page readonly
4FA1000
heap
page read and write
4FA1000
heap
page read and write
AB1000
unkown
page execute and write copy
4FA1000
heap
page read and write
4FA1000
heap
page read and write
31E0000
direct allocation
page read and write
5DD9000
heap
page read and write
4FA1000
heap
page read and write
B7C000
unkown
page execute and read and write
BFBE000
stack
page read and write
4FA1000
heap
page read and write
5DEE000
heap
page read and write
5DE1000
heap
page read and write
5DFC000
heap
page read and write
571E000
stack
page read and write
5DE1000
heap
page read and write
CFC000
unkown
page execute and read and write
321E000
heap
page read and write
1654000
heap
page read and write
5DED000
heap
page read and write
5DE1000
heap
page read and write
5590000
direct allocation
page execute and read and write
1654000
heap
page read and write
CFA000
unkown
page read and write
15D0000
heap
page read and write
5DD6000
heap
page read and write
4FA1000
heap
page read and write
4FA1000
heap
page read and write
4C1E000
stack
page read and write
3200000
direct allocation
page read and write
6CD3E000
unkown
page read and write
545B000
stack
page read and write
5DE1000
heap
page read and write
5DEE000
heap
page read and write
175E000
stack
page read and write
595F000
stack
page read and write
3F5F000
stack
page read and write
BE50000
heap
page read and write
5DF5000
heap
page read and write
5DF6000
heap
page read and write
345E000
stack
page read and write
381E000
stack
page read and write
6CD51000
unkown
page execute read
1654000
heap
page read and write
5DC7000
heap
page read and write
5DED000
heap
page read and write
4FA1000
heap
page read and write
6CD50000
unkown
page readonly
5DF9000
heap
page read and write
4FA1000
heap
page read and write
C16F000
heap
page read and write
1654000
heap
page read and write
5DEE000
heap
page read and write
6CCB0000
unkown
page readonly
3217000
heap
page read and write
55D0000
direct allocation
page execute and read and write
4FA1000
heap
page read and write
4FA1000
heap
page read and write
31E0000
direct allocation
page read and write
331F000
stack
page read and write
5D4D000
stack
page read and write
31E0000
direct allocation
page read and write
C0BF000
stack
page read and write
481F000
stack
page read and write
5DEE000
heap
page read and write
4FA1000
heap
page read and write
5DE1000
heap
page read and write
53E0000
heap
page read and write
4FA1000
heap
page read and write
1654000
heap
page read and write
BE50000
trusted library allocation
page read and write
4FA1000
heap
page read and write
55A0000
direct allocation
page execute and read and write
31E0000
direct allocation
page read and write
6CF2E000
unkown
page read and write
5DDF000
heap
page read and write
17D3000
heap
page read and write
4FA1000
heap
page read and write
1654000
heap
page read and write
55A0000
direct allocation
page execute and read and write
5DD6000
heap
page read and write
19BE000
stack
page read and write
431F000
stack
page read and write
CFA000
unkown
page write copy
B34000
unkown
page execute and read and write
3A9E000
stack
page read and write
4FA1000
heap
page read and write
C0C0000
trusted library allocation
page read and write
4FA1000
heap
page read and write
4FA1000
heap
page read and write
5DE3000
heap
page read and write
5DDD000
heap
page read and write
5DFC000
heap
page read and write
1654000
heap
page read and write
321B000
heap
page read and write
1654000
heap
page read and write
5DEE000
heap
page read and write
5006000
heap
page read and write
4FA1000
heap
page read and write
5DFC000
heap
page read and write
5DF6000
heap
page read and write
319E000
stack
page read and write
5DDD000
heap
page read and write
4FA1000
heap
page read and write
5DDB000
heap
page read and write
5DDF000
heap
page read and write
31E0000
direct allocation
page read and write
14F3000
stack
page read and write
4FA1000
heap
page read and write
4FA1000
heap
page read and write
C161000
heap
page read and write
1654000
heap
page read and write
359E000
stack
page read and write
4FA1000
heap
page read and write
499E000
stack
page read and write
1802000
heap
page read and write
5DD3000
heap
page read and write
B65000
unkown
page execute and read and write
555F000
stack
page read and write
5DEE000
heap
page read and write
F8F000
unkown
page execute and read and write
4FA1000
heap
page read and write
1654000
heap
page read and write
5DC7000
heap
page read and write
55C0000
direct allocation
page execute and read and write
31E0000
direct allocation
page read and write
5DB0000
heap
page read and write
459F000
stack
page read and write
471E000
stack
page read and write
56DF000
stack
page read and write
163E000
stack
page read and write
4FA1000
heap
page read and write
1788000
heap
page read and write
5DDF000
heap
page read and write
6CF35000
unkown
page readonly
5DE1000
heap
page read and write
182B000
heap
page read and write
5DE1000
heap
page read and write
1654000
heap
page read and write
4D1F000
stack
page read and write
1654000
heap
page read and write
4FA1000
heap
page read and write
5DE1000
heap
page read and write
1654000
heap
page read and write
1654000
heap
page read and write
3BDE000
stack
page read and write
BE50000
trusted library allocation
page read and write
5DF6000
heap
page read and write
5DE1000
heap
page read and write
5DDB000
heap
page read and write
4D5E000
stack
page read and write
5DFC000
heap
page read and write
1860000
heap
page read and write
1654000
heap
page read and write
1654000
heap
page read and write
5DE1000
heap
page read and write
495F000
stack
page read and write
37DF000
stack
page read and write
5DD3000
heap
page read and write
4FA1000
heap
page read and write
5DE1000
heap
page read and write
445F000
stack
page read and write
3CDF000
stack
page read and write
3E1F000
stack
page read and write
1654000
heap
page read and write
5DD9000
heap
page read and write
4FA1000
heap
page read and write
4FA1000
heap
page read and write
1654000
heap
page read and write
14F8000
stack
page read and write
1867000
heap
page read and write
5C0C000
stack
page read and write
4FA1000
heap
page read and write
45DD000
stack
page read and write
BEFD000
heap
page read and write
61ECD000
direct allocation
page readonly
3E5E000
stack
page read and write
1654000
heap
page read and write
1834000
heap
page read and write
5DD9000
heap
page read and write
31E0000
direct allocation
page read and write
31E0000
direct allocation
page read and write
3F9E000
stack
page read and write
5ABF000
stack
page read and write
581E000
stack
page read and write
BE70000
heap
page read and write
BEF2000
heap
page read and write
AB0000
unkown
page readonly
5DDA000
heap
page read and write
31E0000
direct allocation
page read and write
5DEE000
heap
page read and write
4FA1000
heap
page read and write
4FA1000
heap
page read and write
6CD42000
unkown
page readonly
1654000
heap
page read and write
4FA1000
heap
page read and write
5DD5000
heap
page read and write
3A5F000
stack
page read and write
5570000
direct allocation
page execute and read and write
3200000
direct allocation
page read and write
4FA1000
heap
page read and write
5DDB000
heap
page read and write
41DF000
stack
page read and write
4FA1000
heap
page read and write
1654000
heap
page read and write
1654000
heap
page read and write
4F9F000
stack
page read and write
5DB3000
heap
page read and write
6CD2D000
unkown
page readonly
391F000
stack
page read and write
1654000
heap
page read and write
5DF6000
heap
page read and write
F87000
unkown
page execute and read and write
1654000
heap
page read and write
BE90000
heap
page read and write
5DDC000
heap
page read and write
4E5F000
stack
page read and write
4FA1000
heap
page read and write
369F000
stack
page read and write
4FA1000
heap
page read and write
1803000
heap
page read and write
5DDC000
heap
page read and write
4FA1000
heap
page read and write
4FA1000
heap
page read and write
5DFC000
heap
page read and write
11F0000
heap
page read and write
395E000
stack
page read and write
4FA1000
heap
page read and write
1654000
heap
page read and write
5580000
direct allocation
page execute and read and write
61E01000
direct allocation
page execute read
31E0000
direct allocation
page read and write
4FA1000
heap
page read and write
59BE000
stack
page read and write
1654000
heap
page read and write
4FA0000
heap
page read and write
5DFC000
heap
page read and write
4FA1000
heap
page read and write
4FA1000
heap
page read and write
341F000
stack
page read and write
5DBB000
heap
page read and write
18BE000
stack
page read and write
5DFC000
heap
page read and write
4FB0000
heap
page read and write
1654000
heap
page read and write
1780000
heap
page read and write
1844000
heap
page read and write
17E9000
heap
page read and write
31E0000
direct allocation
page read and write
421E000
stack
page read and write
31DC000
stack
page read and write
1650000
heap
page read and write
4FA1000
heap
page read and write
4FA1000
heap
page read and write
61EB4000
direct allocation
page read and write
E84000
unkown
page execute and read and write
1654000
heap
page read and write
3B9F000
stack
page read and write
4FA1000
heap
page read and write
5DDF000
heap
page read and write
184E000
heap
page read and write
61ECC000
direct allocation
page read and write
46DF000
stack
page read and write
F9E000
unkown
page execute and read and write
4FA1000
heap
page read and write
4BDF000
stack
page read and write
1654000
heap
page read and write
5DDD000
heap
page read and write
4FC0000
heap
page read and write
485E000
stack
page read and write
5DFC000
heap
page read and write
5DC9000
heap
page read and write
C15B000
heap
page read and write
449E000
stack
page read and write
3210000
heap
page read and write
355F000
stack
page read and write
1654000
heap
page read and write
4FB5000
heap
page read and write
31E0000
direct allocation
page read and write
3D1E000
stack
page read and write
F9F000
unkown
page execute and write copy
C153000
heap
page read and write
36DE000
stack
page read and write
5DF6000
heap
page read and write
4FA1000
heap
page read and write
31E0000
direct allocation
page read and write
6CCB1000
unkown
page execute read
5DE0000
heap
page read and write
6CF2F000
unkown
page write copy
4FA1000
heap
page read and write
1654000
heap
page read and write
4FA1000
heap
page read and write
1849000
heap
page read and write
5DC7000
heap
page read and write
5DFC000
heap
page read and write
BEB1000
heap
page read and write
1654000
heap
page read and write
3200000
direct allocation
page read and write
1654000
heap
page read and write
585E000
stack
page read and write
5DEE000
heap
page read and write
1770000
heap
page read and write
61ED3000
direct allocation
page read and write
5DD3000
heap
page read and write
4FA1000
heap
page read and write
4ADE000
stack
page read and write
119C000
stack
page read and write
5DEE000
heap
page read and write
5DD6000
heap
page read and write
5DD8000
heap
page read and write
CE8000
unkown
page execute and read and write
435E000
stack
page read and write
4FA1000
heap
page read and write
1853000
heap
page read and write
5DFC000
heap
page read and write
5DFC000
heap
page read and write
1654000
heap
page read and write
5DC7000
heap
page read and write
5DD9000
heap
page read and write
4FA1000
heap
page read and write
4A9F000
stack
page read and write
55AE000
stack
page read and write
61EB7000
direct allocation
page readonly
53E0000
trusted library allocation
page read and write
5DE1000
heap
page read and write
5DDF000
heap
page read and write
5C4E000
stack
page read and write
183D000
heap
page read and write
5DDF000
heap
page read and write
1837000
heap
page read and write
There are 364 hidden memdumps, click here to show them.