IOC Report
GqMyzGzrFq.exe

loading gif

Files

File Path
Type
Category
Malicious
GqMyzGzrFq.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\AKKEHIECFCAAFIEBGIDAAEBFCB
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CBAKFCBFHJDHJKECAKEHIDGIJJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\FHJDBKJKFIECAAAKFBFBFBKECA
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GCGCBAEC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IDBKFHJEBAAEBGDGDBFB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IECFHDBAAECAAKFHDHIIJKFHJE
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\JKEGHDGH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\JKFCBAEHCAEGDHJKFHJK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_GqMyzGzrFq.exe_d8c1af904933105c3dc9e6cfd13d30afb1dcf13e_a2550a02_18471ed9-07de-4e7f-bf4a-1bc41c23063d\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20C0.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Mar 28 19:42:01 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER21AB.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER21DB.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 18 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\GqMyzGzrFq.exe
"C:\Users\user\Desktop\GqMyzGzrFq.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 2000

URLs

Name
IP
Malicious
http://193.233.132.241
unknown
 malicious
193.233.132.241/e64f36763e423a50.php
malicious
http://193.233.132.241/e64f36763e423a50.php
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/freebl3.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/mozglue.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/nss3.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/vcruntime140.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/softokn3.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/msvcp140.dll
193.233.132.241
 malicious
http://193.233.132.241/0c90d49aae193f2b/sqlite3.dll
193.233.132.241
 malicious
http://193.233.132.241/e64f36763e423a50.phpSl
unknown
https://duckduckgo.com/chrome_newtab
unknown
http://193.233.132.241I5w
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://193.233.132.241/0c90d49aae193f2b/sqlite3.dllL
unknown
https://duckduckgo.com/ac/?q=
unknown
http://193.233.132.241/0c90d49aae193f2b/sqlite3.dllQ?$
unknown
https://mozilla.org0/
unknown
http://193.233.132.241/e64f36763e423a50.phpT
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://193.233.132.241/e64f36763e423a50.phpH
unknown
http://193.233.132.241/e64f36763e423a50.php4;
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://193.233.132.241/0c90d49aae193f2b/freebl3.dll78
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://193.233.132.241/0c90d49aae193f2b/softokn3.dllGm
unknown
http://193.233.132.241/e64f36763e423a50.php#;
unknown
http://193.233.132.241/e64f36763e423a50.phpion:
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://193.233.132.241/e64f36763e423a50.php0
unknown
http://193.233.132.241/e64f36763e423a50.phpo
unknown
http://193.233.132.241/e64f36763e423a50.php3
unknown
http://193.233.132.241/e64f36763e423a50.php(
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://193.233.132.241/0c90d49aae193f2b/msvcp140.dlltm
unknown
http://193.233.132.241/e64f36763e423a50.php47fe6847c941f8d0c07ed97b9f4c
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
http://193.233.132.241/0c90d49aae193f2b/sqlite3.dllu?
unknown
http://193.233.132.241/e64f36763e423a50.phplk;
unknown
http://193.233.132.241/0c90d49aae193f2b/freebl3.dllU8(
unknown
https://support.mozilla.org
unknown
http://193.233.132.241/0c90d49aae193f2b/nss3.dll%8
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://193.233.132.241/0c90d49aae193f2b/vcruntime140.dlli
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 38 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
193.233.132.241
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
ProgramId
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
FileId
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
LowerCaseLongPath
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
LongPathHash
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
Name
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
OriginalFileName
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
Publisher
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
Version
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
BinFileVersion
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
BinaryType
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
ProductName
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
ProductVersion
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
LinkDate
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
BinProductVersion
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
AppxPackageFullName
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
AppxPackageRelativeId
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
Size
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
Language
\REGISTRY\A\{332376db-9294-4925-b0b9-a4cb153eebdb}\Root\InventoryApplicationFile\gqmyzgzrfq.exe|d91b13705e89324e
Usn
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
CA0000
direct allocation
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
C70000
direct allocation
page execute and read and write
 malicious
D44000
heap
page read and write
 malicious
2130C000
heap
page read and write
213DC000
heap
page read and write
212E5000
heap
page read and write
400000
unkown
page readonly
212F0000
heap
page read and write
212FB000
heap
page read and write
100F000
stack
page read and write
61ED0000
direct allocation
page read and write
212F6000
heap
page read and write
2D5BD000
heap
page read and write
417000
unkown
page write copy
DBA000
heap
page read and write
212E5000
heap
page read and write
190000
stack
page read and write
6CC40000
unkown
page readonly
41C000
unkown
page write copy
21359000
heap
page read and write
212E2000
heap
page read and write
212F0000
heap
page read and write
6CEBE000
unkown
page read and write
212E5000
heap
page read and write
61ED3000
direct allocation
page read and write
280E000
stack
page read and write
1B121000
heap
page read and write
D67000
heap
page read and write
549000
unkown
page execute and read and write
212F6000
heap
page read and write
6CC41000
unkown
page execute read
D0B000
heap
page read and write
212E3000
heap
page read and write
6CCE1000
unkown
page execute read
D97000
heap
page read and write
3462F000
heap
page read and write
34110000
heap
page read and write
28DE000
stack
page read and write
BE7000
heap
page read and write
61ECD000
direct allocation
page readonly
212F0000
heap
page read and write
D1E000
heap
page read and write
BE0000
heap
page read and write
447000
unkown
page execute and read and write
6CE7F000
unkown
page readonly
212E7000
heap
page read and write
1AE0E000
stack
page read and write
212D6000
heap
page read and write
273C0000
heap
page read and write
2130B000
heap
page read and write
212E4000
heap
page read and write
1ABCF000
stack
page read and write
F0F000
stack
page read and write
6CCCE000
unkown
page read and write
27360000
heap
page read and write
1B121000
heap
page read and write
2D5C2000
heap
page read and write
2130C000
heap
page read and write
33FEA000
heap
page read and write
212E3000
heap
page read and write
212F0000
heap
page read and write
212DA000
heap
page read and write
2135A000
heap
page read and write
212E4000
heap
page read and write
61ED4000
direct allocation
page readonly
19A000
stack
page read and write
61EB4000
direct allocation
page read and write
1B120000
heap
page read and write
212D8000
heap
page read and write
6CCBD000
unkown
page readonly
2737D000
heap
page read and write
636000
unkown
page execute and read and write
6CCD2000
unkown
page readonly
212E5000
heap
page read and write
196000
stack
page read and write
2D51F000
stack
page read and write
C2E000
stack
page read and write
27363000
heap
page read and write
28F0000
heap
page read and write
212EA000
heap
page read and write
D1A000
heap
page read and write
212D6000
heap
page read and write
212E9000
heap
page read and write
C6E000
stack
page read and write
212E8000
heap
page read and write
212E6000
heap
page read and write
2D520000
trusted library allocation
page read and write
DC1000
heap
page read and write
1AACF000
stack
page read and write
DAF000
heap
page read and write
1A9CF000
stack
page read and write
212FE000
heap
page read and write
212FB000
heap
page read and write
27B0000
heap
page read and write
1B220000
trusted library allocation
page read and write
410000
unkown
page readonly
212FC000
heap
page read and write
212EF000
heap
page read and write
E00000
heap
page read and write
212F0000
heap
page read and write
DB4000
heap
page read and write
DC6000
heap
page read and write
212F0000
heap
page read and write
1AFAE000
stack
page read and write
27340000
heap
page read and write
2736B000
heap
page read and write
33FE0000
heap
page read and write
212F0000
heap
page read and write
624000
unkown
page execute and read and write
AE2000
unkown
page readonly
401000
unkown
page execute read
2130C000
heap
page read and write
212F0000
heap
page read and write
6CCE0000
unkown
page readonly
27374000
heap
page read and write
2118F000
heap
page read and write
212ED000
heap
page read and write
212F0000
heap
page read and write
BC0000
heap
page read and write
6CEBF000
unkown
page write copy
27380000
heap
page read and write
1AE5E000
stack
page read and write
D78000
heap
page read and write
212EA000
heap
page read and write
2130C000
heap
page read and write
D2F000
heap
page execute and read and write
212F0000
heap
page read and write
2130C000
heap
page read and write
BE7000
heap
page read and write
284E000
stack
page read and write
212FB000
heap
page read and write
61EB7000
direct allocation
page readonly
212FA000
heap
page read and write
D00000
heap
page read and write
212F0000
heap
page read and write
BE5000
heap
page read and write
1AF5D000
stack
page read and write
212EC000
heap
page read and write
212F0000
heap
page read and write
1F0000
heap
page read and write
273A0000
heap
page read and write
2D5BA000
heap
page read and write
2130C000
heap
page read and write
212E1000
heap
page read and write
27365000
heap
page read and write
212E6000
heap
page read and write
212E3000
heap
page read and write
288E000
stack
page read and write
212E5000
heap
page read and write
1B220000
heap
page read and write
212EC000
heap
page read and write
212FB000
heap
page read and write
212E8000
heap
page read and write
AE0000
unkown
page read and write
AE2000
unkown
page readonly
212F0000
heap
page read and write
212D8000
heap
page read and write
2D41E000
stack
page read and write
6CEC5000
unkown
page readonly
1AD0E000
stack
page read and write
1B0AE000
stack
page read and write
1B110000
heap
page read and write
2130C000
heap
page read and write
2D5C3000
heap
page read and write
27377000
heap
page read and write
61ECC000
direct allocation
page read and write
6CEC0000
unkown
page read and write
212F0000
heap
page read and write
212D0000
heap
page read and write
212FB000
heap
page read and write
61E00000
direct allocation
page execute and read and write
27361000
heap
page read and write
9B000
stack
page read and write
2D5B5000
heap
page read and write
212F0000
heap
page read and write
21236000
heap
page read and write
1ACCF000
stack
page read and write
D10000
heap
page read and write
61E01000
direct allocation
page execute read
212E6000
heap
page read and write
2130C000
heap
page read and write
There are 172 hidden memdumps, click here to show them.