IOC Report
z2kQkLtyJW.exe

loading gif

Files

File Path
Type
Category
Malicious
z2kQkLtyJW.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\AAKEGDAKEHJDHIDHJJDAECFBKF
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BKKKEGID
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DTBZGIOOSO.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\EBAEBFIIECBGCBGDHCAF
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FBFHJJJD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KATAXZVCPS.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\KFHCAEGCBFHJDGCBFHDAFBAFII
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KJKJJEGIDBGIDGCBAFHC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_z2kQkLtyJW.exe_8ee0e32f6b2c9dbf8f12f3e73f313af0c581cd6d_61c3f149_327cd337-890a-4460-836c-a840804e879d\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1B4.tmp.dmp
Mini DuMP crash report, 14 streams, Sat May 4 22:49:39 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD29F.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2CF.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\NHPKIZUUSG.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\NHPKIZUUSG.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\QNCYCDFIJJ.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\ZBEDCJPBEY.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\ZBEDCJPBEY.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\ZSSZYEFYMU.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 24 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\z2kQkLtyJW.exe
"C:\Users\user\Desktop\z2kQkLtyJW.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 2192

URLs

Name
IP
Malicious
185.172.128.151/7043a0c6a68d9c65.php
malicious
http://185.172.128.151/7043a0c6a68d9c65.php
185.172.128.151
 malicious
http://185.172.128.151/8420e83ceb95f3af/nss3.dll
185.172.128.151
 malicious
http://185.172.128.151/8420e83ceb95f3af/softokn3.dll
185.172.128.151
 malicious
http://185.172.128.151/8420e83ceb95f3af/vcruntime140.dll
185.172.128.151
 malicious
http://185.172.128.151
unknown
 malicious
http://185.172.128.151/8420e83ceb95f3af/sqlite3.dll
185.172.128.151
 malicious
http://185.172.128.151/8420e83ceb95f3af/freebl3.dll
185.172.128.151
 malicious
http://185.172.128.151/8420e83ceb95f3af/msvcp140.dll
185.172.128.151
 malicious
http://185.172.128.151/8420e83ceb95f3af/mozglue.dll
185.172.128.151
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://185.172.128.151/7043a0c6a68d9c65.php1
unknown
https://duckduckgo.com/ac/?q=
unknown
https://mozilla.org0/
unknown
http://185.172.128.151/7043a0c6a68d9c65.phpo
unknown
http://185.172.128.151/8420e83ceb95f3af/mozglue.dllNW6
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://185.172.128.151/7043a0c6a68d9c65.phpSI
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://185.172.128.151/7043a0c6a68d9c65.php$~
unknown
https://www.ecosia.org/newtab/
unknown
http://185.172.128.151/8420e83ceb95f3af/freebl3.dllWp
unknown
http://185.172.128.151/7043a0c6a68d9c65.phprowser
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://185.172.128.151/8420e83ceb95f3af/softokn3.dlleU
unknown
http://185.172.128.151/8420e83ceb95f3af/vcruntime140.dlltx
unknown
http://185.172.128.151/7043a0c6a68d9c65.php(
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://185.172.128.151/7043a0c6a68d9c65.phpR~m
unknown
http://185.172.128.151/7043a0c6a68d9c65.phpdpoint
unknown
http://185.172.128.151/7043a0c6a68d9c65.phpkIG
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
unknown
https://support.mozilla.org
unknown
http://185.172.128.151/7043a0c6a68d9c65.php356d564feaeed72e65425727806brelease
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://www.sqlite.org/copyright.html.
unknown
http://185.172.128.151/7043a0c6a68d9c65.phpH
unknown
There are 34 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.172.128.151
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
ProgramId
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
FileId
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
LowerCaseLongPath
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
LongPathHash
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
Name
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
OriginalFileName
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
Publisher
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
Version
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
BinFileVersion
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
BinaryType
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
ProductName
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
ProductVersion
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
LinkDate
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
BinProductVersion
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
AppxPackageFullName
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
AppxPackageRelativeId
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
Size
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
Language
\REGISTRY\A\{f4fc6c3c-0df8-ecc1-916c-c42aa7f4419c}\Root\InventoryApplicationFile\z2kqkltyjw.exe|3e58c883310a0203
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2D9C000
heap
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
2C50000
direct allocation
page read and write
 malicious
2B20000
direct allocation
page execute and read and write
 malicious
6CFEE000
unkown
page read and write
2DF4000
heap
page read and write
2FEEA000
heap
page read and write
1CC0F000
stack
page read and write
624000
unkown
page execute and read and write
231E4000
heap
page read and write
2D7E000
heap
page read and write
231D9000
heap
page read and write
2B75000
heap
page read and write
1CB0F000
stack
page read and write
231E4000
heap
page read and write
400000
unkown
page readonly
61E01000
direct allocation
page execute read
2FEE0000
heap
page read and write
231FB000
heap
page read and write
231FB000
heap
page read and write
231F0000
heap
page read and write
2D10000
heap
page read and write
231D9000
heap
page read and write
231D8000
heap
page read and write
23262000
heap
page read and write
61EB7000
direct allocation
page readonly
2940D000
heap
page read and write
61ECC000
direct allocation
page read and write
549000
unkown
page execute and read and write
231D6000
heap
page read and write
231FE000
heap
page read and write
2D87000
heap
page execute and read and write
2D6E000
stack
page read and write
2E5D000
heap
page read and write
4930000
heap
page read and write
231D8000
heap
page read and write
6D1E5000
unkown
page readonly
6D19F000
unkown
page readonly
231D8000
heap
page read and write
1CD0F000
stack
page read and write
1CE8E000
stack
page read and write
447000
unkown
page execute and read and write
231EF000
heap
page read and write
2940C000
heap
page read and write
1F0000
heap
page read and write
29407000
heap
page read and write
231C6000
heap
page read and write
9B000
stack
page read and write
61EB4000
direct allocation
page read and write
40E000
unkown
page readonly
231E0000
heap
page read and write
231D3000
heap
page read and write
231E0000
heap
page read and write
231FE000
heap
page read and write
2AF0000
unkown
page readonly
6CFDD000
unkown
page readonly
6D001000
unkown
page execute read
2B77000
heap
page read and write
29404000
heap
page read and write
432000
unkown
page write copy
48CE000
stack
page read and write
2AF0000
unkown
page readonly
29230000
heap
page read and write
2F430000
trusted library allocation
page read and write
293FF000
heap
page read and write
231C6000
heap
page read and write
231E0000
heap
page read and write
231FE000
heap
page read and write
2FD0000
heap
page read and write
6CFF2000
unkown
page readonly
23262000
heap
page read and write
231D8000
heap
page read and write
304FA000
heap
page read and write
231D9000
heap
page read and write
231D4000
heap
page read and write
1CE4E000
stack
page read and write
2FDB000
heap
page read and write
231EB000
heap
page read and write
2B70000
heap
page read and write
231DD000
heap
page read and write
231EF000
heap
page read and write
231F1000
heap
page read and write
231FE000
heap
page read and write
31B0000
heap
page read and write
2D70000
heap
page read and write
231D3000
heap
page read and write
1D151000
heap
page read and write
1D150000
heap
page read and write
1D140000
heap
page read and write
231E0000
heap
page read and write
231E5000
heap
page read and write
29271000
heap
page read and write
231DC000
heap
page read and write
2D7A000
heap
page read and write
23263000
heap
page read and write
2B77000
heap
page read and write
1CFCE000
stack
page read and write
2CDE000
stack
page read and write
636000
unkown
page execute and read and write
231FE000
heap
page read and write
231E0000
heap
page read and write
231C5000
heap
page read and write
231C0000
heap
page read and write
231E0000
heap
page read and write
61ECD000
direct allocation
page readonly
231FE000
heap
page read and write
6CF60000
unkown
page readonly
6D000000
unkown
page readonly
1D250000
trusted library allocation
page read and write
231DB000
heap
page read and write
199000
stack
page read and write
231EF000
heap
page read and write
231FB000
heap
page read and write
401000
unkown
page execute read
231FE000
heap
page read and write
231FE000
heap
page read and write
6D1DE000
unkown
page read and write
2F480000
heap
page read and write
292D2000
heap
page read and write
231EB000
heap
page read and write
31AE000
stack
page read and write
231CA000
heap
page read and write
2C9E000
stack
page read and write
231EB000
heap
page read and write
29250000
heap
page read and write
231C7000
heap
page read and write
231E0000
heap
page read and write
1D25F000
heap
page read and write
61ED3000
direct allocation
page read and write
61E00000
direct allocation
page execute and read and write
1CA0F000
stack
page read and write
1D151000
heap
page read and write
231E3000
heap
page read and write
231C6000
heap
page read and write
231F0000
heap
page read and write
2F6F000
stack
page read and write
231F0000
heap
page read and write
231E0000
heap
page read and write
231E0000
heap
page read and write
30A00000
heap
page read and write
231FE000
heap
page read and write
23262000
heap
page read and write
231D0000
heap
page read and write
231DC000
heap
page read and write
231F0000
heap
page read and write
2FAE000
stack
page read and write
231D9000
heap
page read and write
231DD000
heap
page read and write
231FB000
heap
page read and write
231F0000
heap
page read and write
232C5000
heap
page read and write
41C000
unkown
page readonly
231F1000
heap
page read and write
231D9000
heap
page read and write
231D6000
heap
page read and write
231D9000
heap
page read and write
6D1DF000
unkown
page write copy
231C7000
heap
page read and write
231D3000
heap
page read and write
490E000
stack
page read and write
1CF8E000
stack
page read and write
2DD7000
heap
page read and write
231E0000
heap
page read and write
2B10000
heap
page read and write
231FB000
heap
page read and write
61ED4000
direct allocation
page readonly
231E0000
heap
page read and write
231F0000
heap
page read and write
6CF61000
unkown
page execute read
61ED0000
direct allocation
page read and write
1D0CD000
stack
page read and write
6D1E0000
unkown
page read and write
1CD4E000
stack
page read and write
193000
stack
page read and write
There are 164 hidden memdumps, click here to show them.