IOC Report
13w4NM6mPa

loading gif

Files

File Path
Type
Category
Malicious
13w4NM6mPa.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\promo[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Desktop\lWjPtDoy2N.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\17[1].htm
HTML document, ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\0[1].htm
HTML document, Unicode text, UTF-8 (with BOM) text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\0[1].htm
Unicode text, UTF-8 text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\1[1].htm
HTML document, Unicode text, UTF-8 (with BOM) text, with no line terminators
dropped
C:\Users\user\Desktop\IqIzor5JSF.exe
HTML document, ASCII text, with no line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\13w4NM6mPa.exe
"C:\Users\user\Desktop\13w4NM6mPa.exe"
 malicious
C:\Users\user\Desktop\lWjPtDoy2N.exe
lWjPtDoy2N.exe
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe "start /min cmd.exe "/c timeout /t 3 /nobreak & del "C:\Users\user\Desktop\lWjPtDoy2N.exe"""
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\user\Desktop\13w4NM6mPa.exe"
 malicious
C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout /t 3 /nobreak
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://38.180.21.197/stats/17/0/0
38.180.21.197
 malicious
incredibleextedwj.shop
malicious
http://38.180.21.197/stats/17/1/1
38.180.21.197
 malicious
shortsvelventysjo.shop
malicious
tolerateilusidjukl.shop
malicious
poledoverglazedkilio.shop
malicious
liabilitynighstjsko.shop
malicious
shatterbreathepsw.shop
malicious
http://38.180.21.197/archives/17
38.180.21.197
 malicious
http://38.180.21.197/archives/5
38.180.21.197
 malicious
http://38.180.21.197/stats/15/0/0
38.180.21.197
 malicious
demonstationfukewko.shop
malicious
productivelookewr.shop
malicious
alcojoldwograpciw.shop
malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://poledoverglazedkilio.shop/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://38.180.21.197/archives/15
unknown
http://ip-api.com/json
208.95.112.1
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://ocsp.rootca1.amazontrust.com0:
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://38.180.21.197/archives/17?
unknown
https://www.ecosia.org/newtab/
unknown
http://38.180.21.197/stats/17/1/1S
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://38.180.21.197/stats/15/1/1
unknown
http://38.180.21.197/stats/17/1/1I
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://pwsafe.org:
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.microsof
unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?
unknown
http://38.180.21.197/stats/17/0/0http://38.180.21.197/stats/15/0/0http://38.180.21.197/archives/5htt
unknown
https://support.mozilla.org
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
https://poledoverglazedkilio.shop/api
172.67.153.60
http://ip-api.com/jsonSOR_
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 38 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
poledoverglazedkilio.shop
172.67.153.60
 malicious
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
38.180.21.197
unknown
United States
malicious
172.67.153.60
poledoverglazedkilio.shop
United States
malicious
127.0.0.1
unknown
unknown
malicious
208.95.112.1
ip-api.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\SitronicsTeam
ZeHuilo

Memdumps

Base Address
Regiontype
Protect
Malicious
D0D000
unkown
page readonly
 malicious
4C21000
heap
page read and write
30F4000
heap
page read and write
30F4000
heap
page read and write
5439000
trusted library allocation
page read and write
C90000
heap
page read and write
542A000
trusted library allocation
page read and write
540A000
trusted library allocation
page read and write
5409000
trusted library allocation
page read and write
5409000
trusted library allocation
page read and write
540A000
trusted library allocation
page read and write
30F4000
heap
page read and write
4C21000
heap
page read and write
4C21000
heap
page read and write
4BF0000
remote allocation
page read and write
2EAB000
heap
page read and write
3205000
heap
page read and write
2EA2000
heap
page read and write
2EA2000
heap
page read and write
2EFC000
heap
page read and write
534E000
stack
page read and write
5409000
trusted library allocation
page read and write
509E000
stack
page read and write
2EA6000
heap
page read and write
541B000
trusted library allocation
page read and write
4C21000
heap
page read and write
5401000
trusted library allocation
page read and write
4C21000
heap
page read and write
4C21000
heap
page read and write
B70000
unkown
page readonly
30F4000
heap
page read and write
5600000
trusted library allocation
page read and write
2EAB000
heap
page read and write
5EE000
stack
page read and write
30F4000
heap
page read and write
2EAB000
heap
page read and write
4C21000
heap
page read and write
2EBC000
heap
page read and write
5443000
trusted library allocation
page read and write
2EA6000
heap
page read and write
2C0B000
unkown
page readonly
2BA0000
trusted library allocation
page read and write
56D7000
trusted library allocation
page read and write
2EAB000
heap
page read and write
2EA1000
heap
page read and write
4C21000
heap
page read and write
30F4000
heap
page read and write
4EFE000
stack
page read and write
B5B000
stack
page read and write
BC7000
unkown
page read and write
542B000
trusted library allocation
page read and write
2EA9000
heap
page read and write
322E000
heap
page read and write
4C21000
heap
page read and write
538F000
stack
page read and write
4C21000
heap
page read and write
5427000
trusted library allocation
page read and write
2EAB000
heap
page read and write
4C21000
heap
page read and write
2EA6000
heap
page read and write
2EA6000
heap
page read and write
2EAB000
heap
page read and write
2ECD000
heap
page read and write
30F4000
heap
page read and write
2E56000
heap
page read and write
2EA6000
heap
page read and write
2EA6000
heap
page read and write
2ED3000
heap
page read and write
347E000
stack
page read and write
2EA6000
heap
page read and write
2EC2000
heap
page read and write
2EA2000
heap
page read and write
5409000
trusted library allocation
page read and write
2EC1000
heap
page read and write
5438000
trusted library allocation
page read and write
2EAB000
heap
page read and write
4C21000
heap
page read and write
2EAB000
heap
page read and write
541B000
trusted library allocation
page read and write
4BF0000
remote allocation
page read and write
4C21000
heap
page read and write
519F000
stack
page read and write
30F4000
heap
page read and write
2EFE000
heap
page read and write
2EA6000
heap
page read and write
540A000
trusted library allocation
page read and write
4C21000
heap
page read and write
2E3A000
heap
page read and write
4C21000
heap
page read and write
2EAB000
heap
page read and write
2EBB000
heap
page read and write
543A000
trusted library allocation
page read and write
2EEA000
heap
page read and write
C3E000
stack
page read and write
30F4000
heap
page read and write
542E000
trusted library allocation
page read and write
560F000
trusted library allocation
page read and write
2EBE000
heap
page read and write
5435000
trusted library allocation
page read and write
543B000
trusted library allocation
page read and write
2EA3000
heap
page read and write
4C21000
heap
page read and write
2EAB000
heap
page read and write
543B000
trusted library allocation
page read and write
5402000
trusted library allocation
page read and write
4C21000
heap
page read and write
2C13000
heap
page read and write
543B000
trusted library allocation
page read and write
2EAB000
heap
page read and write
2EA1000
heap
page read and write
2EAB000
heap
page read and write
5408000
trusted library allocation
page read and write
2EA2000
heap
page read and write
2E4D000
heap
page read and write
2F01000
heap
page read and write
3170000
heap
page read and write
2EA2000
heap
page read and write
4C21000
heap
page read and write
2EA6000
heap
page read and write
4C21000
heap
page read and write
54CF000
stack
page read and write
5606000
trusted library allocation
page read and write
4C21000
heap
page read and write
5435000
trusted library allocation
page read and write
4C21000
heap
page read and write
2EAB000
heap
page read and write
542B000
trusted library allocation
page read and write
5441000
trusted library allocation
page read and write
2E12000
heap
page read and write
174A000
unkown
page execute read
CD0000
unkown
page readonly
2EA6000
heap
page read and write
5406000
trusted library allocation
page read and write
2EA6000
heap
page read and write
2BA0000
trusted library allocation
page read and write
2EC1000
heap
page read and write
4C21000
heap
page read and write
5408000
trusted library allocation
page read and write
30F4000
heap
page read and write
2E40000
heap
page read and write
2A5D000
unkown
page readonly
2EC4000
heap
page read and write
2A5D000
unkown
page readonly
540A000
trusted library allocation
page read and write
540A000
trusted library allocation
page read and write
B71000
unkown
page execute read
5657000
trusted library allocation
page read and write
4C21000
heap
page read and write
30F4000
heap
page read and write
4D75000
heap
page read and write
543A000
trusted library allocation
page read and write
5402000
trusted library allocation
page read and write
4C21000
heap
page read and write
524F000
stack
page read and write
5441000
trusted library allocation
page read and write
30F4000
heap
page read and write
2E9E000
heap
page read and write
2EA1000
heap
page read and write
D44000
unkown
page read and write
2EC8000
heap
page read and write
2EF1000
heap
page read and write
540C000
trusted library allocation
page read and write
2EAB000
heap
page read and write
30F4000
heap
page read and write
595E000
stack
page read and write
543A000
trusted library allocation
page read and write
2DB0000
heap
page read and write
2E9E000
heap
page read and write
4C21000
heap
page read and write
2ED5000
heap
page read and write
AF8000
stack
page read and write
5409000
trusted library allocation
page read and write
2EAB000
heap
page read and write
4EC000
stack
page read and write
540A000
trusted library allocation
page read and write
545C000
trusted library allocation
page read and write
2EAA000
heap
page read and write
543B000
trusted library allocation
page read and write
217E000
unkown
page execute read
2B4C000
unkown
page execute read
2F01000
heap
page read and write
4C21000
heap
page read and write
2E5E000
heap
page read and write
3150000
heap
page read and write
2EAB000
heap
page read and write
2EA6000
heap
page read and write
2E90000
heap
page read and write
2EA3000
heap
page read and write
30F4000
heap
page read and write
541A000
trusted library allocation
page read and write
2EA2000
heap
page read and write
2EAB000
heap
page read and write
4C21000
heap
page read and write
318A000
heap
page read and write
2EA6000
heap
page read and write
2EA6000
heap
page read and write
30F4000
heap
page read and write
2E33000
heap
page read and write
D1B000
unkown
page execute read
4C21000
heap
page read and write
4C21000
heap
page read and write
2EAB000
heap
page read and write
5402000
trusted library allocation
page read and write
562F000
stack
page read and write
561F000
trusted library allocation
page read and write
2EC1000
heap
page read and write
56FF000
stack
page read and write
4C21000
heap
page read and write
2EA2000
heap
page read and write
541B000
trusted library allocation
page read and write
2EA2000
heap
page read and write
2EF2000
heap
page read and write
214C000
unkown
page execute read
2ECD000
heap
page read and write
2EA1000
heap
page read and write
547B000
trusted library allocation
page read and write
4C21000
heap
page read and write
4C21000
heap
page read and write
542B000
trusted library allocation
page read and write
50F0000
heap
page read and write
5419000
trusted library allocation
page read and write
2EA6000
heap
page read and write
2EDA000
heap
page read and write
2EA6000
heap
page read and write
4D70000
heap
page read and write
5474000
trusted library allocation
page read and write
30F4000
heap
page read and write
2EBC000
heap
page read and write
4C21000
heap
page read and write
4C21000
heap
page read and write
4C21000
heap
page read and write
2EA6000
heap
page read and write
2EA6000
heap
page read and write
5401000
trusted library allocation
page read and write
2C13000
heap
page read and write
5409000
trusted library allocation
page read and write
2EAB000
heap
page read and write
57BD000
stack
page read and write
542D000
trusted library allocation
page read and write
56CF000
trusted library allocation
page read and write
2EA2000
heap
page read and write
30F4000
heap
page read and write
2EA1000
heap
page read and write
2EA2000
heap
page read and write
4C20000
heap
page read and write
2EA6000
heap
page read and write
542B000
trusted library allocation
page read and write
4C21000
heap
page read and write
2ED4000
heap
page read and write
4C21000
heap
page read and write
2EC1000
heap
page read and write
30F4000
heap
page read and write
2EAB000
heap
page read and write
2EA2000
heap
page read and write
CD0000
unkown
page readonly
5409000
trusted library allocation
page read and write
5F0000
heap
page read and write
2EA6000
heap
page read and write
174C000
unkown
page execute read
4C21000
heap
page read and write
2E2B000
heap
page read and write
2C0B000
unkown
page readonly
541B000
trusted library allocation
page read and write
5737000
trusted library allocation
page read and write
D4A000
unkown
page execute read
5452000
trusted library allocation
page read and write
541A000
trusted library allocation
page read and write
5438000
trusted library allocation
page read and write
2EA6000
heap
page read and write
580000
heap
page read and write
2EAB000
heap
page read and write
5D0C000
stack
page read and write
5404000
trusted library allocation
page read and write
540A000
trusted library allocation
page read and write
B70000
unkown
page readonly
30F4000
heap
page read and write
2C00000
heap
page read and write
4C21000
heap
page read and write
5432000
trusted library allocation
page read and write
56DF000
trusted library allocation
page read and write
52DE000
stack
page read and write
2EC6000
heap
page read and write
2EA1000
heap
page read and write
7F0000
heap
page read and write
4F3D000
stack
page read and write
541A000
trusted library allocation
page read and write
577B000
stack
page read and write
CD1000
unkown
page execute read
30F4000
heap
page read and write
79C000
stack
page read and write
5A0000
heap
page read and write
543B000
trusted library allocation
page read and write
214C000
unkown
page execute read
540A000
trusted library allocation
page read and write
2EBB000
heap
page read and write
2EA6000
heap
page read and write
318E000
heap
page read and write
4C21000
heap
page read and write
30F4000
heap
page read and write
4E00000
trusted library allocation
page read and write
4C21000
heap
page read and write
51DE000
stack
page read and write
2EAB000
heap
page read and write
5401000
trusted library allocation
page read and write
2B9F000
stack
page read and write
30F4000
heap
page read and write
30F0000
heap
page read and write
2EAB000
heap
page read and write
2EA6000
heap
page read and write
4C21000
heap
page read and write
2EAB000
heap
page read and write
547C000
trusted library allocation
page read and write
2EA1000
heap
page read and write
5637000
trusted library allocation
page read and write
2EAB000
heap
page read and write
177E000
unkown
page execute read
2EBC000
heap
page read and write
541B000
trusted library allocation
page read and write
2EA6000
heap
page read and write
543B000
trusted library allocation
page read and write
4C21000
heap
page read and write
4C21000
heap
page read and write
4C21000
heap
page read and write
2EBC000
heap
page read and write
2E3C000
heap
page read and write
2EA1000
heap
page read and write
2EC2000
heap
page read and write
503C000
stack
page read and write
2EA2000
heap
page read and write
2C13000
heap
page read and write
5BB0000
heap
page read and write
52C000
stack
page read and write
2EA6000
heap
page read and write
177E000
unkown
page execute read
5405000
trusted library allocation
page read and write
2EAB000
heap
page read and write
58BE000
stack
page read and write
89E000
stack
page read and write
2E4A000
heap
page read and write
541A000
trusted library allocation
page read and write
4BF0000
remote allocation
page read and write
5483000
trusted library allocation
page read and write
2EBB000
heap
page read and write
30F4000
heap
page read and write
4C21000
heap
page read and write
552E000
stack
page read and write
2DA0000
heap
page read and write
5800000
trusted library allocation
page read and write
4C21000
heap
page read and write
2ED5000
heap
page read and write
BCD000
unkown
page execute read
540A000
trusted library allocation
page read and write
2EA6000
heap
page read and write
5C0C000
stack
page read and write
542D000
trusted library allocation
page read and write
30FE000
stack
page read and write
5A5E000
stack
page read and write
567D000
stack
page read and write
2E3A000
heap
page read and write
542B000
trusted library allocation
page read and write
4C21000
heap
page read and write
2EAD000
heap
page read and write
30F4000
heap
page read and write
2EAB000
heap
page read and write
30F4000
heap
page read and write
30F4000
heap
page read and write
5403000
trusted library allocation
page read and write
2C13000
heap
page read and write
543B000
trusted library allocation
page read and write
B9C000
unkown
page read and write
2EBC000
heap
page read and write
2A48000
heap
page read and write
4C21000
heap
page read and write
542D000
trusted library allocation
page read and write
5463000
trusted library allocation
page read and write
4D20000
trusted library allocation
page read and write
541A000
trusted library allocation
page read and write
2EA2000
heap
page read and write
2EAB000
heap
page read and write
562F000
trusted library allocation
page read and write
4C21000
heap
page read and write
5438000
trusted library allocation
page read and write
5401000
trusted library allocation
page read and write
2EAB000
heap
page read and write
2EA6000
heap
page read and write
5402000
trusted library allocation
page read and write
2EA6000
heap
page read and write
30F4000
heap
page read and write
528E000
stack
page read and write
2EA6000
heap
page read and write
2E00000
heap
page read and write
CC0000
heap
page read and write
313E000
stack
page read and write
30F4000
heap
page read and write
5402000
trusted library allocation
page read and write
5406000
trusted library allocation
page read and write
C7E000
stack
page read and write
5436000
trusted library allocation
page read and write
2E6F000
heap
page read and write
2EBD000
heap
page read and write
5430000
trusted library allocation
page read and write
2EC8000
heap
page read and write
2A40000
heap
page read and write
5409000
trusted library allocation
page read and write
2EA6000
heap
page read and write
2EAB000
heap
page read and write
4C21000
heap
page read and write
2EA2000
heap
page read and write
4C21000
heap
page read and write
541B000
trusted library allocation
page read and write
540A000
trusted library allocation
page read and write
30F4000
heap
page read and write
5406000
trusted library allocation
page read and write
53CD000
stack
page read and write
2DFE000
stack
page read and write
30F4000
heap
page read and write
4C21000
heap
page read and write
2C13000
heap
page read and write
2B4C000
unkown
page execute read
B9E000
unkown
page execute read
2EA1000
heap
page read and write
2EAB000
heap
page read and write
4C01000
trusted library allocation
page read and write
2EAB000
heap
page read and write
541B000
trusted library allocation
page read and write
2C02000
heap
page read and write
31D3000
heap
page read and write
D10000
unkown
page read and write
2EA2000
heap
page read and write
2EE2000
heap
page read and write
337E000
stack
page read and write
544B000
trusted library allocation
page read and write
2EAB000
heap
page read and write
4C21000
heap
page read and write
7D0000
heap
page read and write
4440000
heap
page read and write
4C21000
heap
page read and write
2EA6000
heap
page read and write
514E000
stack
page read and write
2EA6000
heap
page read and write
2EAB000
heap
page read and write
541F000
trusted library allocation
page read and write
2EA6000
heap
page read and write
3180000
heap
page read and write
4C21000
heap
page read and write
4C21000
heap
page read and write
2EA6000
heap
page read and write
2EA6000
heap
page read and write
15CD000
unkown
page execute read
30F4000
heap
page read and write
2EA5000
heap
page read and write
B8E000
unkown
page readonly
29BF000
stack
page read and write
4C21000
heap
page read and write
5402000
trusted library allocation
page read and write
2EAB000
heap
page read and write
174C000
unkown
page execute read
83F000
stack
page read and write
2EAB000
heap
page read and write
5402000
trusted library allocation
page read and write
2EAB000
heap
page read and write
5D4E000
stack
page read and write
56A7000
trusted library allocation
page read and write
2EA2000
heap
page read and write
4C21000
heap
page read and write
2D4B000
stack
page read and write
4C21000
heap
page read and write
30F4000
heap
page read and write
4C21000
heap
page read and write
2EAB000
heap
page read and write
2EE9000
heap
page read and write
543B000
trusted library allocation
page read and write
2EA2000
heap
page read and write
2EA6000
heap
page read and write
B20000
heap
page read and write
4C30000
heap
page read and write
2EA6000
heap
page read and write
542D000
trusted library allocation
page read and write
5404000
trusted library allocation
page read and write
2EAB000
heap
page read and write
2EA1000
heap
page read and write
217E000
unkown
page execute read
576F000
trusted library allocation
page read and write
5402000
trusted library allocation
page read and write
2EAB000
heap
page read and write
5438000
trusted library allocation
page read and write
2EA6000
heap
page read and write
31EE000
heap
page read and write
2BED000
stack
page read and write
2EA6000
heap
page read and write
5E4F000
stack
page read and write
2EA6000
heap
page read and write
5400000
trusted library allocation
page read and write
There are 483 hidden memdumps, click here to show them.