IOC Report
fXg8zgxVTF.exe

loading gif

Files

File Path
Type
Category
Malicious
fXg8zgxVTF.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFCBFIJEHDHCBGDGDGCB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CFCGIIEHIEGDGDGCAEBGDAKFCB
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\CFHDBFIEGIDGIECBKJECBKFHCA
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\FHCAFIDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\GHIJJJEG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GHIJJJEGDBFHDHJJDBAKKJJECA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HDGCGHIJKEGIECBFCBAE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IJDBGDGCGDAKFIDGIDBFIEHDHJ
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JKFCBAEHCAEGDHJKFHJK
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\fXg8zgxVTF.exe
"C:\Users\user\Desktop\fXg8zgxVTF.exe"
 malicious

URLs

Name
IP
Malicious
http://95.182.96.50/fee3b98529eb4b43/nss3.dll
95.182.96.50
 malicious
http://95.182.96.50/fee3b98529eb4b43/msvcp140.dll
95.182.96.50
 malicious
http://95.182.96.50/fee3b98529eb4b43/freebl3.dll
95.182.96.50
 malicious
http://95.182.96.50/fee3b98529eb4b43/mozglue.dll
95.182.96.50
 malicious
http://95.182.96.50/fee3b98529eb4b43/sqlite3.dll
95.182.96.50
 malicious
http://95.182.96.50/fee3b98529eb4b43/vcruntime140.dll
95.182.96.50
 malicious
http://95.182.96.50/fee3b98529eb4b43/softokn3.dll
95.182.96.50
 malicious
95.182.96.50/2aced82320799c96.php
malicious
http://95.182.96.50/
95.182.96.50
 malicious
http://95.182.96.50/2aced82320799c96.php
95.182.96.50
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
http://95.182.96.50/)
unknown
http://95.182.96.502aced82320799c96.phpsition:
unknown
http://95.182.96.50/fee3b98529eb4b43/vcruntime140.dll:SJ
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
http://95.182.96.50/2aced82320799c96.phpf
unknown
http://95.182.96.50/2aced82320799c96.phpi
unknown
http://95.182.96.50/fee3b98529eb4b43/softokn3.dllr
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://95.182.96.50/fee3b98529eb4b43/nss3.dllt
unknown
http://95.182.96.50
unknown
http://95.182.96.50/2aced82320799c96.phpzj
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://95.182.96.50/2aced82320799c96.phpEJpm
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
http://95.182.96.50/fee3b98529eb4b43/nss3.dllW
unknown
http://95.182.96.50/fee3b98529eb4b43/freebl3.dll.
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://95.182.96.50/fee3b98529eb4b43/mozglue.dll.
unknown
http://95.182.96.50/fee3b98529eb4b43/nss3.dllm
unknown
http://95.182.96.50/2aced82320799c96.phpbj
unknown
http://95.182.96.50/fee3b98529eb4b43/softokn3.dllD
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://95.182.96.50/2aced82320799c96.phpft
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
http://95.182.96.50/2aced82320799c96.phpData
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://95.182.96.50/fee3b98529eb4b43/msvcp140.dll4
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://95.182.96.50/2aced82320799c96.phpance
unknown
http://95.182.96.500
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
http://www.seriousbit.com/
unknown
http://seriousbit.com/
unknown
https://support.mozilla.org
unknown
http://95.182.96.50/2aced82320799c96.phpsition:
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
http://95.182.96.50/2aced82320799c96.phpe5
unknown
There are 47 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
95.182.96.50
unknown
Russian Federation
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
2F2F000
heap
page execute and read and write
 malicious
EB1000
heap
page read and write
 malicious
4C9000
unkown
page readonly
B19000
unkown
page readonly
2A11000
heap
page read and write
6CAB0000
unkown
page readonly
F48000
heap
page read and write
F54000
heap
page read and write
65A000
unkown
page readonly
9D4000
unkown
page readonly
304B000
heap
page execute and read and write
21A93000
heap
page read and write
8B7000
unkown
page readonly
2A11000
heap
page read and write
2FB5000
heap
page execute and read and write
860000
unkown
page readonly
21A96000
heap
page read and write
2B30000
heap
page read and write
8DB000
unkown
page readonly
F67000
heap
page read and write
F6D000
heap
page read and write
1B6DE000
stack
page read and write
1BAE1000
heap
page read and write
A7D000
unkown
page readonly
21A82000
heap
page read and write
DD4000
heap
page read and write
6CD2E000
unkown
page read and write
DD4000
heap
page read and write
DD4000
heap
page read and write
9C000
stack
page read and write
DD4000
heap
page read and write
21A93000
heap
page read and write
21A6F000
heap
page read and write
65A000
unkown
page readonly
21A75000
heap
page read and write
21AF4000
heap
page read and write
1BA5E000
stack
page read and write
DD4000
heap
page read and write
21A93000
heap
page read and write
1B56E000
stack
page read and write
2F8A000
heap
page execute and read and write
2A30000
heap
page read and write
4C9000
unkown
page readonly
27B50000
heap
page read and write
59F000
unkown
page readonly
2B40000
trusted library allocation
page read and write
DD4000
heap
page read and write
21AF3000
heap
page read and write
2A11000
heap
page read and write
21A66000
heap
page read and write
AD2000
unkown
page readonly
2FE1000
heap
page execute and read and write
5B4000
unkown
page readonly
48E000
unkown
page write copy
703000
unkown
page readonly
DD4000
heap
page read and write
DD4000
heap
page read and write
F3D000
heap
page read and write
DD4000
heap
page read and write
605000
unkown
page readonly
DD4000
heap
page read and write
DD4000
heap
page read and write
DD4000
heap
page read and write
317A000
heap
page execute and read and write
21A93000
heap
page read and write
2A21000
heap
page read and write
21A85000
heap
page read and write
61EB4000
direct allocation
page read and write
21A67000
heap
page read and write
21A85000
heap
page read and write
2A11000
heap
page read and write
E5E000
stack
page read and write
2FED000
heap
page execute and read and write
21A85000
heap
page read and write
21B50000
heap
page read and write
7AD000
unkown
page readonly
353D0000
heap
page read and write
30F5000
heap
page execute and read and write
21A7D000
heap
page read and write
860000
unkown
page readonly
21A75000
heap
page read and write
F01000
heap
page read and write
D7C000
unkown
page readonly
27B53000
heap
page read and write
21A75000
heap
page read and write
DD4000
heap
page read and write
32D9000
stack
page read and write
65A000
unkown
page readonly
21A71000
heap
page read and write
21A75000
heap
page read and write
21A90000
heap
page read and write
2A11000
heap
page read and write
13D4000
heap
page read and write
318C000
heap
page execute and read and write
32DD000
stack
page read and write
21A85000
heap
page read and write
4C8000
unkown
page read and write
5A6000
unkown
page readonly
F63000
heap
page read and write
1B2EE000
stack
page read and write
7AD000
unkown
page readonly
DD4000
heap
page read and write
21A93000
heap
page read and write
2A11000
heap
page read and write
2A11000
heap
page read and write
605000
unkown
page readonly
DD4000
heap
page read and write
5B4000
unkown
page readonly
21A85000
heap
page read and write
DD4000
heap
page read and write
13DC000
heap
page read and write
21A92000
heap
page read and write
2A11000
heap
page read and write
707000
unkown
page readonly
1B3EF000
stack
page read and write
2A11000
heap
page read and write
2A11000
heap
page read and write
DD4000
heap
page read and write
21A5D000
heap
page read and write
27B10000
heap
page read and write
DD4000
heap
page read and write
48C000
unkown
page write copy
61EB7000
direct allocation
page readonly
21A67000
heap
page read and write
61E01000
direct allocation
page execute read
2A11000
heap
page read and write
1B52F000
stack
page read and write
2A11000
heap
page read and write
301F000
heap
page execute and read and write
1B66F000
stack
page read and write
2A11000
heap
page read and write
E7A000
heap
page read and write
401000
unkown
page execute read
DD4000
heap
page read and write
2A11000
heap
page read and write
6AF000
unkown
page readonly
21A75000
heap
page read and write
DD4000
heap
page read and write
2DCB0000
trusted library allocation
page read and write
6CB42000
unkown
page readonly
D7C000
unkown
page readonly
21B04000
heap
page read and write
21A85000
heap
page read and write
21A96000
heap
page read and write
61ECC000
direct allocation
page read and write
6B5000
unkown
page readonly
6AF000
unkown
page readonly
D81000
unkown
page readonly
21A85000
heap
page read and write
DD4000
heap
page read and write
DD4000
heap
page read and write
2DC9E000
stack
page read and write
2A11000
heap
page read and write
B19000
unkown
page readonly
2A11000
heap
page read and write
21A85000
heap
page read and write
DD4000
heap
page read and write
2DD4F000
heap
page read and write
A7D000
unkown
page readonly
21A72000
heap
page read and write
2A00000
heap
page read and write
401000
unkown
page execute read
21A93000
heap
page read and write
5B4000
unkown
page readonly
4C9000
unkown
page readonly
DD0000
heap
page read and write
830000
unkown
page readonly
2A11000
heap
page read and write
21A75000
heap
page read and write
3191000
heap
page execute and read and write
113F000
stack
page read and write
21A96000
heap
page read and write
877000
unkown
page readonly
2A11000
heap
page read and write
123F000
stack
page read and write
21A6F000
heap
page read and write
2A11000
heap
page read and write
6CB2D000
unkown
page readonly
6B5000
unkown
page readonly
21A75000
heap
page read and write
59F000
unkown
page readonly
21A82000
heap
page read and write
21A8E000
heap
page read and write
21A6F000
heap
page read and write
DD4000
heap
page read and write
21A93000
heap
page read and write
21A8A000
heap
page read and write
19D000
stack
page read and write
27AF0000
heap
page read and write
303F000
heap
page execute and read and write
61ED4000
direct allocation
page readonly
21A70000
heap
page read and write
2DD49000
heap
page read and write
8A8000
unkown
page readonly
2A11000
heap
page read and write
DD4000
heap
page read and write
2A10000
heap
page read and write
DD4000
heap
page read and write
6CD2F000
unkown
page write copy
3012000
heap
page execute and read and write
2B7E000
stack
page read and write
34EC9000
heap
page read and write
61ED0000
direct allocation
page read and write
21A75000
heap
page read and write
758000
unkown
page readonly
48C000
unkown
page write copy
21A8A000
heap
page read and write
8B7000
unkown
page readonly
2A11000
heap
page read and write
6B5000
unkown
page readonly
2A11000
heap
page read and write
92E000
unkown
page readonly
2DD54000
heap
page read and write
1B42E000
stack
page read and write
13D0000
heap
page read and write
2A11000
heap
page read and write
6CB3E000
unkown
page read and write
2A11000
heap
page read and write
21A85000
heap
page read and write
2A11000
heap
page read and write
88F000
unkown
page readonly
4D2000
unkown
page readonly
2A11000
heap
page read and write
21A6D000
heap
page read and write
B0A000
unkown
page readonly
27B30000
heap
page read and write
2A11000
heap
page read and write
877000
unkown
page readonly
21A87000
heap
page read and write
21A85000
heap
page read and write
F39000
heap
page read and write
2A11000
heap
page read and write
6CD35000
unkown
page readonly
21A71000
heap
page read and write
21A82000
heap
page read and write
46E000
unkown
page readonly
6CAB1000
unkown
page execute read
703000
unkown
page readonly
6CB51000
unkown
page execute read
2A11000
heap
page read and write
1B7DF000
stack
page read and write
6CB50000
unkown
page readonly
61ED3000
direct allocation
page read and write
21A6D000
heap
page read and write
830000
unkown
page readonly
2CB0000
heap
page execute and read and write
2A11000
heap
page read and write
2A11000
heap
page read and write
1BAE0000
trusted library allocation
page read and write
27BAB000
heap
page read and write
21A6D000
heap
page read and write
8B7000
unkown
page readonly
30FB000
heap
page execute and read and write
4D2000
unkown
page readonly
2A11000
heap
page read and write
2A11000
heap
page read and write
21A75000
heap
page read and write
DD4000
heap
page read and write
DA0000
heap
page read and write
2DD5C000
heap
page read and write
61ECD000
direct allocation
page readonly
59F000
unkown
page readonly
EE5000
heap
page read and write
2A11000
heap
page read and write
400000
unkown
page readonly
21A5A000
heap
page read and write
2A11000
heap
page read and write
21A8A000
heap
page read and write
31DC000
stack
page read and write
21A5A000
heap
page read and write
21A85000
heap
page read and write
27B59000
heap
page read and write
21A96000
heap
page read and write
21A78000
heap
page read and write
21A72000
heap
page read and write
E1E000
stack
page read and write
2A11000
heap
page read and write
707000
unkown
page readonly
2A11000
heap
page read and write
27B47000
heap
page read and write
27B9D000
heap
page read and write
707000
unkown
page readonly
48D000
unkown
page read and write
830000
unkown
page readonly
2A11000
heap
page read and write
DD4000
heap
page read and write
2A11000
heap
page read and write
F4F000
heap
page read and write
21A93000
heap
page read and write
27B3D000
heap
page read and write
88F000
unkown
page readonly
21A6E000
heap
page read and write
2A11000
heap
page read and write
2A11000
heap
page read and write
6CCEF000
unkown
page readonly
27AD0000
heap
page read and write
D90000
heap
page read and write
2DD41000
heap
page read and write
E70000
heap
page read and write
1B95E000
stack
page read and write
2A11000
heap
page read and write
2A11000
heap
page read and write
21A6D000
heap
page read and write
21A64000
heap
page read and write
21A5B000
heap
page read and write
2A11000
heap
page read and write
30D5000
heap
page execute and read and write
D81000
unkown
page readonly
758000
unkown
page readonly
21A50000
heap
page read and write
877000
unkown
page readonly
DD4000
heap
page read and write
21A69000
heap
page read and write
88F000
unkown
page readonly
2C90000
heap
page read and write
2A11000
heap
page read and write
21A82000
heap
page read and write
349B0000
heap
page read and write
DD4000
heap
page read and write
2A11000
heap
page read and write
98F000
unkown
page readonly
703000
unkown
page readonly
21A78000
heap
page read and write
DD4000
heap
page read and write
21A78000
heap
page read and write
32D3000
stack
page read and write
DD4000
heap
page read and write
400000
unkown
page readonly
21A75000
heap
page read and write
2A11000
heap
page read and write
1B81E000
stack
page read and write
58D000
unkown
page readonly
2A11000
heap
page read and write
8DB000
unkown
page readonly
605000
unkown
page readonly
5A6000
unkown
page readonly
5A6000
unkown
page readonly
DD4000
heap
page read and write
92E000
unkown
page readonly
DD4000
heap
page read and write
58D000
unkown
page readonly
6CD30000
unkown
page read and write
E7E000
heap
page read and write
21A6F000
heap
page read and write
DD4000
heap
page read and write
AD2000
unkown
page readonly
8A8000
unkown
page readonly
2A11000
heap
page read and write
2C7F000
stack
page read and write
2DB9E000
stack
page read and write
DD4000
heap
page read and write
F42000
heap
page read and write
2A11000
heap
page read and write
21B6C000
heap
page read and write
6AF000
unkown
page readonly
27B42000
heap
page read and write
21A74000
heap
page read and write
4D2000
unkown
page readonly
46E000
unkown
page readonly
2A11000
heap
page read and write
21AF3000
heap
page read and write
2A11000
heap
page read and write
7AD000
unkown
page readonly
347B0000
heap
page read and write
58D000
unkown
page readonly
8A8000
unkown
page readonly
347BA000
heap
page read and write
758000
unkown
page readonly
21A67000
heap
page read and write
98F000
unkown
page readonly
2A11000
heap
page read and write
B0A000
unkown
page readonly
21AF3000
heap
page read and write
61E00000
direct allocation
page execute and read and write
2A11000
heap
page read and write
2A11000
heap
page read and write
21A92000
heap
page read and write
1B91D000
stack
page read and write
21A93000
heap
page read and write
2A11000
heap
page read and write
9D4000
unkown
page readonly
27B3F000
heap
page read and write
2FB8000
heap
page execute and read and write
860000
unkown
page readonly
There are 374 hidden memdumps, click here to show them.