IOC Report
CR0QGWXdDl.exe

loading gif

Files

File Path
Type
Category
Malicious
CR0QGWXdDl.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AFHDAKJK
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\AFHDAKJKFCFBGCBGDHCB
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\BFIJEHCBAKFCAKFHCGDG
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\DGIJEGHDAECAKECAFCAKFCGDAE
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\EGIDAAFIEHIEHJKFHCAE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EHCBAAAF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EHCBAAAFHJDHJJKEBGHIECAKJK
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KKJKFBKKECFHJKEBKEHIDAEBKF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\CR0QGWXdDl.exe
"C:\Users\user\Desktop\CR0QGWXdDl.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCGCFCBAKK.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://46.8.231.109/c4754d4f680ead72.php
46.8.231.109
 malicious
http://46.8.231.109/?
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
46.8.231.109
 malicious
http://46.8.231.109/c4754d4f680ead72.phpry=----IEHCBAFIDAECBGCBFHJEultrelease
unknown
 malicious
http://46.8.231.109/
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
46.8.231.109
 malicious
http://46.8.231.109AZ
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
46.8.231.109
 malicious
http://46.8.231.109/c4754d4f680ead72.phpF
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.phpD
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllsi9
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
46.8.231.109
 malicious
http://46.8.231.109/c4754d4f680ead72.phpoinomi
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dllSf
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.phpZze
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllAf
unknown
 malicious
http://46.8.231.109BAKKorm-data;
unknown
 malicious
http://46.8.231.109
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
46.8.231.109
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e171
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
http://upx.sf.net
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 40 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
fp2e7a.wpc.phicdn.net
192.229.221.95
s-part-0032.t-0009.t-msedge.net
13.107.246.60

IPs

IP
Domain
Country
Malicious
46.8.231.109
unknown
Russian Federation
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
74C000
unkown
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
D47000
heap
page read and write
 malicious
AF3000
stack
page read and write
1A96E000
stack
page read and write
4E2000
remote allocation
page execute and read and write
26F90000
heap
page read and write
26FD1000
heap
page read and write
6CBC0000
unkown
page readonly
E3D000
stack
page read and write
742000
unkown
page readonly
10E0000
heap
page read and write
6CC52000
unkown
page readonly
721000
unkown
page execute read
721000
unkown
page execute read
20F43000
heap
page read and write
133E000
stack
page read and write
10B0000
heap
page read and write
4EF000
remote allocation
page execute and read and write
65C000
remote allocation
page execute and read and write
45A000
remote allocation
page execute and read and write
27032000
heap
page read and write
51E000
remote allocation
page execute and read and write
FDA000
heap
page read and write
20F3B000
heap
page read and write
6CC60000
unkown
page readonly
20F20000
heap
page read and write
107E000
stack
page read and write
10BC000
heap
page read and write
AF9000
stack
page read and write
C60000
heap
page read and write
4BD000
remote allocation
page execute and read and write
F3D000
stack
page read and write
1ABAC000
stack
page read and write
27049000
heap
page read and write
6CBC1000
unkown
page execute read
27290000
heap
page read and write
27055000
heap
page read and write
74C000
unkown
page write copy
79A000
unkown
page read and write
51B000
remote allocation
page execute and read and write
1AAAE000
stack
page read and write
64A000
remote allocation
page execute and read and write
12FF000
stack
page read and write
270FE000
stack
page read and write
271FE000
stack
page read and write
11FE000
stack
page read and write
48F000
remote allocation
page execute and read and write
20F47000
heap
page read and write
1AFB1000
heap
page read and write
79B000
unkown
page readonly
1AEA0000
heap
page read and write
61ED4000
direct allocation
page readonly
B30000
heap
page read and write
21025000
heap
page read and write
CF0000
heap
page read and write
6CDFF000
unkown
page readonly
6CC61000
unkown
page execute read
485000
remote allocation
page execute and read and write
DA2000
heap
page read and write
488000
remote allocation
page execute and read and write
720000
unkown
page readonly
1AE2D000
stack
page read and write
6CC3D000
unkown
page readonly
20F5F000
heap
page read and write
20F5B000
heap
page read and write
61EB4000
direct allocation
page read and write
1460000
heap
page read and write
1AD2E000
stack
page read and write
D40000
heap
page read and write
61ED3000
direct allocation
page read and write
492000
remote allocation
page execute and read and write
1ACEF000
stack
page read and write
5C5000
remote allocation
page execute and read and write
61ECD000
direct allocation
page readonly
20F23000
heap
page read and write
C10000
heap
page read and write
1AA6D000
stack
page read and write
1AEB0000
heap
page read and write
742000
unkown
page readonly
61ECC000
direct allocation
page read and write
FB0000
heap
page read and write
6CE40000
unkown
page read and write
20F63000
heap
page read and write
50F000
remote allocation
page execute and read and write
7CC000
stack
page read and write
6CC4E000
unkown
page read and write
D87000
heap
page read and write
61EB7000
direct allocation
page readonly
5CB000
remote allocation
page execute and read and write
720000
unkown
page readonly
10B3000
heap
page read and write
CAE000
stack
page read and write
103E000
stack
page read and write
61ED0000
direct allocation
page read and write
79B000
unkown
page readonly
1ABEE000
stack
page read and write
6CE3E000
unkown
page read and write
FDE000
heap
page read and write
61E00000
direct allocation
page execute and read and write
143F000
stack
page read and write
F3E000
stack
page read and write
61E01000
direct allocation
page execute read
C15000
heap
page read and write
D73000
heap
page read and write
5A5000
remote allocation
page execute and read and write
799000
unkown
page execute and read and write
2707B000
heap
page read and write
AFD000
stack
page read and write
FA0000
heap
page read and write
26FB0000
heap
page read and write
1A92F000
stack
page read and write
6CE45000
unkown
page readonly
FD0000
heap
page read and write
6CE3F000
unkown
page write copy
4B1000
remote allocation
page execute and read and write
C5D000
stack
page read and write
There are 107 hidden memdumps, click here to show them.