IOC Report
j1zkOQTx4q.exe

loading gif

Files

File Path
Type
Category
Malicious
j1zkOQTx4q.exe
MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\jTkI2DeqFXDxQHXHJ7lSt1A.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Temp\adobe25HiBSyPbReV\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe25HiBSyPbReV\History\Firefox_fqs92o4p.default-release.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe25HiBSyPbReV\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe25HiBSyPbReV\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe25HiBSyPbReV\screenshot.png
PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\44JkKLWCBNJ9History
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\4SpdqMeYgXg6Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\6D9jUVJ0_DSUWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\6k0OzpAvOhwWLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\B0tQxZcgttPJWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\D4TGfpPH4IPOWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\Dh4UFB9VlaROHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\Dsx8sDItJfv3Login Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\Zu2ikoLeiECZWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\cIlG5Y0qTb9_History
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\iYfCU4QVZjt3Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\xvIioM0C1FXzHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\zB0jb1wxK8VALogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi25HiBSyPbReV\zHsmPskqoA3oCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\j1zkOQTx4q.exe
"C:\Users\user\Desktop\j1zkOQTx4q.exe"
 malicious

URLs

Name
IP
Malicious
https://www.wireguard.com/
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://sectigo.com/CPS0
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://ocsp.sectigo.com0
unknown
https://db-ip.com/demo/home.php?s=102.129.152.220e
unknown
https://www.wireguard.com/D
unknown
https://db-ip.com/
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://t.me/RiseProSUPPORT
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://www.ecosia.org/newtab/
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
https://t.me/risepro_bot
unknown
https://ipinfo.io:443/widget/demo/102.129.152.220
unknown
http://5.42.66.10/download/th/Retailer_prog.exe845-4e4c-bd18-02b67a
unknown
https://db-ip.com:443/demo/home.php?s=102.129.152.220
unknown
http://5.42.66.10/download/th/Retailer_prog.exe(
unknown
https://ipinfo.io/
unknown
https://ipinfo.io/widget/demo/102.129.152.220
34.117.186.192
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://193.233.132.253/lumma2104.exe
unknown
http://5.42.66.10/download/th/Retailer_prog.exe
unknown
http://www.winimage.com/zLibDll
unknown
https://support.mozilla.org
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://db-ip.com/demo/home.php?s=102.129.152.220
172.67.75.166
http://www.winimage.com/zLibDllDpRTpR
unknown
There are 29 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ipinfo.io
34.117.186.192
db-ip.com
172.67.75.166

IPs

IP
Domain
Country
Malicious
193.233.132.226
unknown
Russian Federation
malicious
5.42.66.10
unknown
Russian Federation
34.117.186.192
ipinfo.io
United States
172.67.75.166
db-ip.com
United States

Memdumps

Base Address
Regiontype
Protect
Malicious
6420000
heap
page read and write
 malicious
1A21000
heap
page read and write
 malicious
62F0000
trusted library allocation
page read and write
32C1000
heap
page read and write
699000
unkown
page execute and read and write
32C1000
heap
page read and write
1820000
heap
page read and write
64A2000
heap
page read and write
64BB000
heap
page read and write
32C1000
heap
page read and write
64B1000
heap
page read and write
6450000
heap
page read and write
64BB000
heap
page read and write
646D000
heap
page read and write
62F0000
trusted library allocation
page read and write
1660000
heap
page read and write
648E000
heap
page read and write
178E000
heap
page read and write
644F000
heap
page read and write
79C000
unkown
page execute and read and write
540000
unkown
page execute and read and write
62F0000
trusted library allocation
page read and write
C59000
unkown
page execute and read and write
6484000
heap
page read and write
6451000
heap
page read and write
6489000
heap
page read and write
6484000
heap
page read and write
1B1F000
stack
page read and write
6480000
heap
page read and write
6489000
heap
page read and write
1844000
heap
page read and write
6484000
heap
page read and write
7145000
heap
page read and write
32C1000
heap
page read and write
646D000
heap
page read and write
7A0000
unkown
page execute and read and write
647D000
heap
page read and write
1710000
direct allocation
page read and write
6464000
heap
page read and write
6410000
heap
page read and write
62F0000
trusted library allocation
page read and write
641C000
heap
page read and write
6463000
heap
page read and write
33DA000
heap
page read and write
64CF000
heap
page read and write
179A000
heap
page read and write
64CB000
heap
page read and write
6484000
heap
page read and write
32C1000
heap
page read and write
6466000
heap
page read and write
32C1000
heap
page read and write
644F000
heap
page read and write
6451000
heap
page read and write
401000
unkown
page execute and write copy
6489000
heap
page read and write
17A6000
heap
page read and write
660F000
stack
page read and write
6484000
heap
page read and write
1710000
direct allocation
page read and write
32C1000
heap
page read and write
6440000
heap
page read and write
32C1000
heap
page read and write
6420000
heap
page read and write
37A0000
heap
page read and write
5E1E000
stack
page read and write
32C1000
heap
page read and write
644F000
heap
page read and write
6464000
heap
page read and write
64D7000
heap
page read and write
64CB000
heap
page read and write
64C4000
heap
page read and write
6484000
heap
page read and write
1710000
direct allocation
page read and write
1844000
heap
page read and write
64A0000
heap
page read and write
646B000
heap
page read and write
1710000
direct allocation
page read and write
7AA000
unkown
page execute and read and write
6489000
heap
page read and write
400000
unkown
page readonly
649F000
heap
page read and write
5DB0000
remote allocation
page read and write
6489000
heap
page read and write
32D0000
heap
page read and write
163B000
unkown
page execute and read and write
32C1000
heap
page read and write
32C1000
heap
page read and write
6420000
heap
page read and write
32C1000
heap
page read and write
1710000
direct allocation
page read and write
9B000
stack
page read and write
1920000
heap
page read and write
648F000
heap
page read and write
5C7E000
stack
page read and write
64C5000
heap
page read and write
649B000
heap
page read and write
645D000
heap
page read and write
32C1000
heap
page read and write
64C5000
heap
page read and write
32C1000
heap
page read and write
644F000
heap
page read and write
64C5000
heap
page read and write
177D000
heap
page read and write
6433000
heap
page read and write
6484000
heap
page read and write
644F000
heap
page read and write
6449000
heap
page read and write
647D000
heap
page read and write
6441000
heap
page read and write
1710000
direct allocation
page read and write
152F000
unkown
page readonly
64BA000
heap
page read and write
64C5000
heap
page read and write
1768000
heap
page read and write
644F000
heap
page read and write
6451000
heap
page read and write
1844000
heap
page read and write
32C1000
heap
page read and write
6465000
heap
page read and write
1727000
heap
page read and write
643A000
heap
page read and write
62F0000
trusted library allocation
page read and write
1844000
heap
page read and write
1710000
direct allocation
page read and write
6481000
heap
page read and write
1844000
heap
page read and write
62F0000
trusted library allocation
page read and write
648E000
heap
page read and write
16F000
stack
page read and write
1710000
direct allocation
page read and write
32C1000
heap
page read and write
6495000
heap
page read and write
33D7000
heap
page read and write
64B1000
heap
page read and write
64C5000
heap
page read and write
32C1000
heap
page read and write
6513000
heap
page read and write
1844000
heap
page read and write
64A7000
heap
page read and write
6494000
heap
page read and write
649C000
heap
page read and write
6495000
heap
page read and write
649A000
heap
page read and write
64AF000
heap
page read and write
6454000
heap
page read and write
6420000
heap
page read and write
1756000
heap
page read and write
176A000
heap
page read and write
64C5000
heap
page read and write
64D7000
heap
page read and write
32C1000
heap
page read and write
16DE000
stack
page read and write
646B000
heap
page read and write
645C000
heap
page read and write
32C1000
heap
page read and write
1A29000
heap
page read and write
646B000
heap
page read and write
61EE000
stack
page read and write
644D000
heap
page read and write
619F000
stack
page read and write
33E0000
trusted library allocation
page read and write
1710000
direct allocation
page read and write
32C1000
heap
page read and write
645C000
heap
page read and write
32C1000
heap
page read and write
6461000
heap
page read and write
1812000
heap
page read and write
1844000
heap
page read and write
32C1000
heap
page read and write
1921000
heap
page read and write
62F0000
trusted library allocation
page read and write
175B000
heap
page read and write
1710000
direct allocation
page read and write
33DD000
heap
page read and write
6C30000
heap
page read and write
32C1000
heap
page read and write
6441000
heap
page read and write
1930000
heap
page read and write
64A0000
heap
page read and write
64CF000
heap
page read and write
6432000
heap
page read and write
646D000
heap
page read and write
64C5000
heap
page read and write
646D000
heap
page read and write
6442000
heap
page read and write
32C1000
heap
page read and write
62F0000
trusted library allocation
page read and write
64CB000
heap
page read and write
646D000
heap
page read and write
64AC000
heap
page read and write
6433000
heap
page read and write
6471000
heap
page read and write
62F0000
trusted library allocation
page read and write
64B2000
heap
page read and write
6418000
heap
page read and write
648F000
heap
page read and write
62F0000
trusted library allocation
page read and write
62F0000
trusted library allocation
page read and write
64C5000
heap
page read and write
32C1000
heap
page read and write
1A39000
heap
page read and write
646B000
heap
page read and write
6461000
heap
page read and write
646D000
heap
page read and write
32C1000
heap
page read and write
6474000
heap
page read and write
401000
unkown
page execute read
32C1000
heap
page read and write
6463000
heap
page read and write
644D000
heap
page read and write
5AFE000
stack
page read and write
6489000
heap
page read and write
609E000
stack
page read and write
1710000
direct allocation
page read and write
32C1000
heap
page read and write
59FE000
stack
page read and write
64AB000
heap
page read and write
67D000
unkown
page execute and read and write
64B6000
heap
page read and write
6495000
heap
page read and write
644B000
heap
page read and write
6419000
heap
page read and write
6461000
heap
page read and write
649B000
heap
page read and write
635E000
stack
page read and write
641C000
heap
page read and write
62F0000
trusted library allocation
page read and write
64AA000
heap
page read and write
175F000
heap
page read and write
6C3A000
heap
page read and write
62F8000
heap
page read and write
64D6000
heap
page read and write
64A2000
heap
page read and write
1710000
direct allocation
page read and write
5F1F000
stack
page read and write
646D000
heap
page read and write
6463000
heap
page read and write
32C1000
heap
page read and write
400000
unkown
page readonly
177F000
heap
page read and write
646B000
heap
page read and write
1710000
direct allocation
page read and write
1710000
direct allocation
page read and write
6461000
heap
page read and write
64A2000
heap
page read and write
1710000
direct allocation
page read and write
7D1000
unkown
page execute and read and write
1720000
heap
page read and write
62F0000
trusted library allocation
page read and write
64B1000
heap
page read and write
62F0000
trusted library allocation
page read and write
5B3E000
stack
page read and write
647D000
heap
page read and write
17F9000
heap
page read and write
6411000
heap
page read and write
32C1000
heap
page read and write
32C1000
heap
page read and write
32C1000
heap
page read and write
57CB000
heap
page read and write
6464000
heap
page read and write
6420000
heap
page read and write
32C1000
heap
page read and write
1840000
heap
page read and write
32C1000
heap
page read and write
6484000
heap
page read and write
649F000
heap
page read and write
32C1000
heap
page read and write
545000
unkown
page readonly
648E000
heap
page read and write
6461000
heap
page read and write
1781000
heap
page read and write
646B000
heap
page read and write
163B000
unkown
page execute and write copy
649B000
heap
page read and write
1787000
heap
page read and write
6462000
heap
page read and write
62F0000
trusted library allocation
page read and write
6442000
heap
page read and write
1844000
heap
page read and write
16F0000
heap
page read and write
1770000
heap
page read and write
6488000
heap
page read and write
6451000
heap
page read and write
64D7000
heap
page read and write
78A000
unkown
page execute and read and write
6489000
heap
page read and write
32C1000
heap
page read and write
A65000
unkown
page execute read
62EF000
stack
page read and write
32C1000
heap
page read and write
6489000
heap
page read and write
17FF000
heap
page read and write
174C000
heap
page read and write
1748000
heap
page read and write
64AC000
heap
page read and write
6477000
heap
page read and write
6484000
heap
page read and write
5F5E000
stack
page read and write
649B000
heap
page read and write
6473000
heap
page read and write
6482000
heap
page read and write
6432000
heap
page read and write
648B000
heap
page read and write
5DB0000
remote allocation
page read and write
64CF000
heap
page read and write
1844000
heap
page read and write
6484000
heap
page read and write
6466000
heap
page read and write
1763000
heap
page read and write
6428000
heap
page read and write
1710000
direct allocation
page read and write
33D0000
heap
page read and write
830000
unkown
page execute and read and write
64C5000
heap
page read and write
6473000
heap
page read and write
32C1000
heap
page read and write
647D000
heap
page read and write
32C1000
heap
page read and write
32C0000
heap
page read and write
646B000
heap
page read and write
67B000
unkown
page execute and read and write
515000
unkown
page readonly
6484000
heap
page read and write
32C1000
heap
page read and write
163C000
unkown
page write copy
32C1000
heap
page read and write
1844000
heap
page read and write
1710000
direct allocation
page read and write
645B000
heap
page read and write
1690000
heap
page read and write
6484000
heap
page read and write
401000
unkown
page execute and write copy
6464000
heap
page read and write
6484000
heap
page read and write
32C1000
heap
page read and write
605B000
stack
page read and write
32C1000
heap
page read and write
3720000
direct allocation
page read and write
649B000
heap
page read and write
163C000
unkown
page write copy
645D000
heap
page read and write
32C1000
heap
page read and write
644D000
heap
page read and write
6494000
heap
page read and write
6466000
heap
page read and write
32C1000
heap
page read and write
6464000
heap
page read and write
5C3D000
stack
page read and write
645E000
heap
page read and write
648E000
heap
page read and write
32C1000
heap
page read and write
5D7D000
stack
page read and write
6451000
heap
page read and write
5DB0000
remote allocation
page read and write
62F0000
trusted library allocation
page read and write
64CA000
heap
page read and write
6463000
heap
page read and write
32C1000
heap
page read and write
646B000
heap
page read and write
32C1000
heap
page read and write
6461000
heap
page read and write
1818000
heap
page read and write
64AF000
heap
page read and write
1751000
heap
page read and write
64AC000
heap
page read and write
6438000
heap
page read and write
644F000
heap
page read and write
There are 357 hidden memdumps, click here to show them.