IOC Report
9JtNIXVedn.exe

loading gif

Files

File Path
Type
Category
Malicious
9JtNIXVedn.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AAFIDGCFHIEHJJJJECAKKJDBAF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\CBFBGCGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\CGCAKKKEGCAKJKFIIEGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ECGDHDHJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EGDBFIIECBGDGDGDHCAK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FIDGHIIECGHDHJKFCAEGIJDGCB
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\GDBKKFHIEGDHJKECAAKKEBAFIJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\HIIIDAKKJJJKKECAKKJE
ASCII text, with very long lines (1765), with CRLF line terminators
dropped
C:\ProgramData\KKEBKJJDGHCBGCAAKEHDBAEGHD
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\9JtNIXVedn.exe
"C:\Users\user\Desktop\9JtNIXVedn.exe"
 malicious

URLs

Name
IP
Malicious
http://95.182.96.50/2
unknown
 malicious
http://95.182.96.50/fee3b98529eb4b43/nss3.dll
95.182.96.50
 malicious
http://95.182.96.50/fee3b98529eb4b43/msvcp140.dll
95.182.96.50
 malicious
http://95.182.96.50/fee3b98529eb4b43/freebl3.dll
95.182.96.50
 malicious
http://95.182.96.50/fee3b98529eb4b43/mozglue.dll
95.182.96.50
 malicious
http://95.182.96.50/fee3b98529eb4b43/sqlite3.dll
95.182.96.50
 malicious
http://95.182.96.50
unknown
 malicious
http://95.182.96.50/fee3b98529eb4b43/vcruntime140.dll
95.182.96.50
 malicious
http://95.182.96.50/2aced82320799c96.phpdus.wallet
unknown
 malicious
http://95.182.96.50/2aced82320799c96.phpge
unknown
 malicious
http://95.182.96.50/fee3b98529eb4b43/softokn3.dll
95.182.96.50
 malicious
http://95.182.96.50/
95.182.96.50
 malicious
http://95.182.96.50/2aced82320799c96.php
95.182.96.50
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://repository.certum.pl/ctsca2021.cer0A
unknown
http://vovsoft.com/blog/how-to-activate-using-license-key/openU
unknown
http://crl.certum.pl/ctsca2021.crl0o
unknown
https://duckduckgo.com/ac/?q=
unknown
http://95.182.96.50/2aced82320799c96.phpys
unknown
http://95.182.96.50/Fz
unknown
http://95.182.96.502aced82320799c96.phpsition:
unknown
http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://www.indyproject.org/
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
unknown
http://95.182.96.50/fee3b98529eb4b43/freebl3.dllrhy
unknown
http://95.182.96.50/2aced82320799c96.phpl
unknown
http://repository.certum.pl/ccsca2021.cer0
unknown
http://95.182.96.50l2
unknown
http://vovsoft.com/
unknown
http://95.182.96.50/fee3b98529eb4b43/msvcp140.dllVh
unknown
http://subca.ocsp-certum.com05
unknown
http://subca.ocsp-certum.com02
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://subca.ocsp-certum.com01
unknown
http://crl.certum.pl/ctnca2.crl0l
unknown
http://repository.certum.pl/ctnca2.cer09
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
unknown
http://ccsca2021.ocsp-certum.com05
unknown
http://95.182.96.50/2aced82320799c96.phpal
unknown
http://95.182.96.50/2aced82320799c96.php)6
unknown
http://www.certum.pl/CPS0
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://repository.certum.pl/ctnca.cer09
unknown
https://mozilla.org0/
unknown
http://95.182.96.50/2aced82320799c96.php2
unknown
http://vovsoft.com
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://crl.certum.pl/ctnca.crl0k
unknown
https://vovsoft.com/translation/
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://vovsoft.com/help/
unknown
http://vovsoft.comopenU
unknown
https://www.certum.pl/CPS0
unknown
http://vovsoft.comopenS
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://vovsoft.com/blog/credits-and-acknowledgements/open
unknown
https://api.coingecko.com/api/v3/coins/list
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://95.182.96.50/2aced82320799c96.phpV
unknown
http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/openU
unknown
https://vovsoft.com/translation/openU
unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
http://95.182.96.50/2aced82320799c96.phpare
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://api.coingecko.com/api/v3/coins/
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://support.mozilla.org
unknown
http://95.182.96.50/2aced82320799c96.phpG
unknown
http://95.182.96.50/2aced82320799c96.phpsition:
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://vovsoft.com/openU
unknown
There are 67 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
95.182.96.50
unknown
Russian Federation
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
3118000
heap
page execute and read and write
 malicious
1148000
heap
page read and write
 malicious
2DE77000
heap
page read and write
357D000
stack
page read and write
21CCB000
heap
page read and write
B60000
unkown
page readonly
6FEA1000
unkown
page execute read
2C48000
direct allocation
page read and write
21D02000
heap
page read and write
21D03000
heap
page read and write
21CD6000
heap
page read and write
21D67000
heap
page read and write
34880000
heap
page read and write
2D51000
heap
page read and write
21D02000
heap
page read and write
1BA3F000
stack
page read and write
1B7CE000
stack
page read and write
B6F000
unkown
page readonly
F94000
heap
page read and write
21CE2000
heap
page read and write
2D51000
heap
page read and write
21CE5000
heap
page read and write
27D64000
heap
page read and write
2D51000
heap
page read and write
337A000
heap
page execute and read and write
2C0F000
direct allocation
page read and write
1B68E000
stack
page read and write
F50000
heap
page read and write
21CE0000
heap
page read and write
21CE6000
heap
page read and write
2D51000
heap
page read and write
9E6000
unkown
page readonly
27D6C000
heap
page read and write
DE8000
unkown
page readonly
F0E000
stack
page read and write
2E9E000
stack
page read and write
14FC000
heap
page read and write
1200000
heap
page read and write
F94000
heap
page read and write
21CED000
heap
page read and write
21CD9000
heap
page read and write
F94000
heap
page read and write
21CF5000
heap
page read and write
2D51000
heap
page read and write
DF0000
heap
page read and write
21CF8000
heap
page read and write
F94000
heap
page read and write
31CA000
heap
page execute and read and write
61ED3000
direct allocation
page read and write
9C000
stack
page read and write
21CF4000
heap
page read and write
6CD51000
unkown
page execute read
2D51000
heap
page read and write
11CA000
heap
page read and write
2DE7D000
heap
page read and write
61EB4000
direct allocation
page read and write
21CF8000
heap
page read and write
11A9000
heap
page read and write
109F000
stack
page read and write
11C0000
heap
page read and write
61ED0000
direct allocation
page read and write
21CE3000
heap
page read and write
1BAAE000
stack
page read and write
F94000
heap
page read and write
1BC20000
trusted library allocation
page read and write
21CEE000
heap
page read and write
21CCA000
heap
page read and write
21D09000
heap
page read and write
123D000
heap
page read and write
34EAD000
heap
page read and write
2DE78000
heap
page read and write
21D02000
heap
page read and write
2D51000
heap
page read and write
21CDC000
heap
page read and write
F94000
heap
page read and write
2C41000
direct allocation
page read and write
21CDC000
heap
page read and write
97D000
unkown
page write copy
2C33000
direct allocation
page read and write
6FF1D000
unkown
page readonly
21CEA000
heap
page read and write
21D0E000
heap
page read and write
3228000
heap
page execute and read and write
B5B000
unkown
page readonly
61ECD000
direct allocation
page readonly
27D62000
heap
page read and write
994000
unkown
page write copy
F94000
heap
page read and write
DED000
unkown
page readonly
31D6000
heap
page execute and read and write
27D79000
heap
page read and write
21CC0000
heap
page read and write
31A1000
heap
page execute and read and write
1BA40000
heap
page read and write
32E4000
heap
page execute and read and write
21D02000
heap
page read and write
2EA0000
heap
page execute and read and write
21CF8000
heap
page read and write
21CDE000
heap
page read and write
1B64F000
stack
page read and write
347F000
stack
page read and write
31FB000
heap
page execute and read and write
61EB7000
direct allocation
page readonly
F94000
heap
page read and write
319E000
heap
page execute and read and write
34990000
heap
page read and write
21CDC000
heap
page read and write
3375000
heap
page execute and read and write
1205000
heap
page read and write
6FF2E000
unkown
page read and write
2D51000
heap
page read and write
9D9000
unkown
page read and write
21D02000
heap
page read and write
F90000
heap
page read and write
F94000
heap
page read and write
6CF30000
unkown
page read and write
9E4000
unkown
page readonly
21CE5000
heap
page read and write
2D51000
heap
page read and write
F94000
heap
page read and write
B76000
unkown
page readonly
21CE5000
heap
page read and write
2D51000
heap
page read and write
21CE6000
heap
page read and write
2D51000
heap
page read and write
21D02000
heap
page read and write
2D51000
heap
page read and write
21D02000
heap
page read and write
401000
unkown
page execute read
F94000
heap
page read and write
11C5000
heap
page read and write
1140000
heap
page read and write
133F000
stack
page read and write
2D51000
heap
page read and write
21CE4000
heap
page read and write
2D51000
heap
page read and write
2D51000
heap
page read and write
F94000
heap
page read and write
61ECC000
direct allocation
page read and write
2D51000
heap
page read and write
B27000
unkown
page readonly
F94000
heap
page read and write
32BE000
heap
page execute and read and write
2D51000
heap
page read and write
21CF9000
heap
page read and write
2D51000
heap
page read and write
3208000
heap
page execute and read and write
F94000
heap
page read and write
21CDB000
heap
page read and write
27DC2000
heap
page read and write
21D02000
heap
page read and write
2C24000
direct allocation
page read and write
9D9000
unkown
page write copy
19C000
stack
page read and write
21D0E000
heap
page read and write
2D51000
heap
page read and write
400000
unkown
page readonly
2C2C000
direct allocation
page read and write
2DE6F000
heap
page read and write
21DC0000
heap
page read and write
2D51000
heap
page read and write
F94000
heap
page read and write
27D60000
heap
page read and write
21CE0000
heap
page read and write
F94000
heap
page read and write
21CDC000
heap
page read and write
F94000
heap
page read and write
6CF35000
unkown
page readonly
21C26000
heap
page read and write
6CF2E000
unkown
page read and write
F4E000
stack
page read and write
F94000
heap
page read and write
10B0000
trusted library allocation
page read and write
2D51000
heap
page read and write
11E6000
heap
page read and write
21CF9000
heap
page read and write
21CC3000
heap
page read and write
6CD50000
unkown
page readonly
2C16000
direct allocation
page read and write
2D51000
heap
page read and write
21CDF000
heap
page read and write
2D51000
heap
page read and write
21CF8000
heap
page read and write
2DE70000
heap
page read and write
6FEA0000
unkown
page readonly
F94000
heap
page read and write
3579000
stack
page read and write
3363000
heap
page execute and read and write
14F4000
heap
page read and write
3573000
stack
page read and write
32DE000
heap
page execute and read and write
27DA0000
heap
page read and write
21D66000
heap
page read and write
21CFA000
heap
page read and write
21CCD000
heap
page read and write
F94000
heap
page read and write
F94000
heap
page read and write
1B78E000
stack
page read and write
21CF5000
heap
page read and write
11DD000
heap
page read and write
2D50000
heap
page read and write
1BC20000
heap
page read and write
2D51000
heap
page read and write
2D51000
heap
page read and write
61ED4000
direct allocation
page readonly
6CF2F000
unkown
page write copy
2D51000
heap
page read and write
B6D000
unkown
page readonly
2D51000
heap
page read and write
97D000
unkown
page read and write
11D0000
heap
page read and write
21CF9000
heap
page read and write
2BF8000
direct allocation
page read and write
2D51000
heap
page read and write
21CCA000
heap
page read and write
11D7000
heap
page read and write
118D000
heap
page read and write
2DDD0000
trusted library allocation
page read and write
1B8CD000
stack
page read and write
21D09000
heap
page read and write
112C000
stack
page read and write
3488A000
heap
page read and write
27D7E000
heap
page read and write
21CCB000
heap
page read and write
1B93E000
stack
page read and write
27DBB000
heap
page read and write
21CE4000
heap
page read and write
27D67000
heap
page read and write
2D51000
heap
page read and write
2C3A000
direct allocation
page read and write
2D51000
heap
page read and write
21DD5000
heap
page read and write
F94000
heap
page read and write
9A4000
unkown
page read and write
21CFA000
heap
page read and write
21CF3000
heap
page read and write
2D51000
heap
page read and write
21CE2000
heap
page read and write
10EE000
stack
page read and write
97F000
unkown
page read and write
21CD7000
heap
page read and write
2D51000
heap
page read and write
1BBAE000
stack
page read and write
9DD000
unkown
page read and write
2D51000
heap
page read and write
F94000
heap
page read and write
2D60000
heap
page read and write
21CDB000
heap
page read and write
21B87000
heap
page read and write
2D51000
heap
page read and write
27D40000
heap
page read and write
27D80000
heap
page read and write
21D02000
heap
page read and write
61E01000
direct allocation
page execute read
F94000
heap
page read and write
21CE3000
heap
page read and write
2D51000
heap
page read and write
6CEEF000
unkown
page readonly
3234000
heap
page execute and read and write
F94000
heap
page read and write
6FF32000
unkown
page readonly
3173000
heap
page execute and read and write
21D0F000
heap
page read and write
27D75000
heap
page read and write
F94000
heap
page read and write
61E00000
direct allocation
page execute and read and write
14F0000
heap
page read and write
F94000
heap
page read and write
There are 258 hidden memdumps, click here to show them.