IOC Report
Purchase Order For Linear Actuator.exe

loading gif

Files

File Path
Type
Category
Malicious
Purchase Order For Linear Actuator.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_X00GI2RPISPKZHNF_fdea285d2efd4e31cd11be78abb91d9fb6fd2efe_b95f701e_8526e9a2-c9a0-4f6c-a7e7-ba3042745614\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER86B7.tmp.dmp
Mini DuMP crash report, 16 streams, Tue Oct 22 21:55:00 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER889D.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER88CC.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ozq5p4p.g35.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ccqeqfob.3ns.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hdqlvqun.rya.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xnibpavs.41c.ps1
ASCII text, with no line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Purchase Order For Linear Actuator.exe
"C:\Users\user\Desktop\Purchase Order For Linear Actuator.exe"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Purchase Order For Linear Actuator.exe" -Force
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2276 -s 1256

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
https://api.ipify.org
unknown
http://upx.sf.net
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://mail.iaa-airferight.com
unknown

Domains

Name
IP
Malicious
mail.iaa-airferight.com
46.175.148.58
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
46.175.148.58
mail.iaa-airferight.com
Ukraine
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance
Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
FileDirectory
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
ProgramId
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
FileId
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
LowerCaseLongPath
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
LongPathHash
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
Name
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
OriginalFileName
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
Publisher
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
Version
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
BinFileVersion
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
BinaryType
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
ProductName
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
ProductVersion
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
LinkDate
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
BinProductVersion
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
AppxPackageFullName
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
AppxPackageRelativeId
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
Size
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
Language
\REGISTRY\A\{001c9bcd-5e1d-ad90-0f12-7cb3f8a22a52}\Root\InventoryApplicationFile\purchase order f|69b7f2312ec92352
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018000DDABBE6B3
There are 30 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
250DDC00000
trusted library allocation
page read and write
 malicious
31BC000
trusted library allocation
page read and write
 malicious
250CC379000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
3191000
trusted library allocation
page read and write
 malicious
2F98000
trusted library allocation
page read and write
31C4000
trusted library allocation
page read and write
1357000
heap
page read and write
2DE2000
trusted library allocation
page read and write
67BF000
stack
page read and write
317F000
trusted library allocation
page read and write
7FFD344B0000
trusted library allocation
page read and write
2F60000
trusted library allocation
page execute and read and write
161F000
stack
page read and write
BA60EF3000
stack
page read and write
6EFB000
trusted library allocation
page read and write
30C6000
trusted library allocation
page read and write
250CA732000
unkown
page readonly
250CA9B0000
trusted library allocation
page read and write
7FFD343D0000
trusted library allocation
page execute and read and write
250CAA04000
heap
page read and write
250CAA37000
heap
page read and write
1265000
heap
page read and write
BA613FD000
stack
page read and write
2DE0000
trusted library allocation
page read and write
6B77000
trusted library allocation
page read and write
2F5F000
stack
page read and write
7FFD3432D000
trusted library allocation
page execute and read and write
6D2E000
stack
page read and write
31B8000
trusted library allocation
page read and write
250E4E30000
heap
page read and write
7FFD34312000
trusted library allocation
page read and write
7FFD34510000
trusted library allocation
page read and write
2DCD000
trusted library allocation
page execute and read and write
2DF5000
trusted library allocation
page execute and read and write
BA610FE000
stack
page read and write
6EF0000
trusted library allocation
page read and write
250CA9A0000
heap
page read and write
2F80000
heap
page read and write
13B9000
heap
page read and write
6F00000
trusted library allocation
page execute and read and write
7FFD344D0000
trusted library allocation
page read and write
30AB000
trusted library allocation
page read and write
13F7000
heap
page read and write
250CAB20000
trusted library section
page read and write
41A9000
trusted library allocation
page read and write
1320000
heap
page read and write
7FFD3433B000
trusted library allocation
page execute and read and write
6F40000
trusted library allocation
page execute and read and write
3141000
trusted library allocation
page read and write
6A9E000
stack
page read and write
31CA000
trusted library allocation
page read and write
250CABB0000
heap
page read and write
250CC361000
trusted library allocation
page read and write
250CA970000
trusted library allocation
page read and write
68FE000
stack
page read and write
6B80000
trusted library allocation
page read and write
30AE000
trusted library allocation
page read and write
250CA8F0000
heap
page read and write
7FFD34313000
trusted library allocation
page execute and read and write
6A40000
trusted library allocation
page read and write
3130000
heap
page execute and read and write
250CC3A8000
trusted library allocation
page read and write
7FFD344C4000
trusted library allocation
page read and write
250CA9B3000
trusted library allocation
page read and write
7FFD344C9000
trusted library allocation
page read and write
250DC367000
trusted library allocation
page read and write
7FBB0000
trusted library allocation
page execute and read and write
7FFD34330000
trusted library allocation
page read and write
1277000
heap
page read and write
7FFD3436C000
trusted library allocation
page execute and read and write
7FFD344F0000
trusted library allocation
page read and write
250CAA07000
heap
page read and write
523E000
stack
page read and write
2DFB000
trusted library allocation
page execute and read and write
6DAE000
stack
page read and write
250E4C70000
heap
page read and write
30C1000
trusted library allocation
page read and write
5690000
heap
page read and write
6EEE000
stack
page read and write
250CA965000
heap
page read and write
250CA730000
unkown
page readonly
7FFD34500000
trusted library allocation
page execute and read and write
7FFD34314000
trusted library allocation
page read and write
250CA9EE000
heap
page read and write
2F70000
trusted library allocation
page read and write
1355000
heap
page read and write
2DC3000
trusted library allocation
page execute and read and write
250CC443000
trusted library allocation
page read and write
7FF479D70000
trusted library allocation
page execute and read and write
250CA7F0000
heap
page read and write
BA614FD000
stack
page read and write
7FFD343F6000
trusted library allocation
page execute and read and write
250CA9CC000
heap
page read and write
31BA000
trusted library allocation
page read and write
250CAA3C000
heap
page read and write
7FFD344E0000
trusted library allocation
page read and write
12CE000
stack
page read and write
6A4D000
trusted library allocation
page read and write
250CC427000
trusted library allocation
page read and write
BA60FFE000
stack
page read and write
6A3E000
stack
page read and write
250CA9C0000
heap
page read and write
30F0000
trusted library allocation
page read and write
7FFD343CC000
trusted library allocation
page execute and read and write
151D000
stack
page read and write
7FFD3433D000
trusted library allocation
page execute and read and write
2DDD000
trusted library allocation
page execute and read and write
7FFD343C0000
trusted library allocation
page read and write
318D000
trusted library allocation
page read and write
5680000
heap
page read and write
7FFD34310000
trusted library allocation
page read and write
13DF000
heap
page read and write
4141000
trusted library allocation
page read and write
250E4C60000
heap
page execute and read and write
1328000
heap
page read and write
2DF0000
trusted library allocation
page read and write
7FFD34320000
trusted library allocation
page read and write
31D0000
trusted library allocation
page read and write
5C30000
trusted library allocation
page read and write
306C000
stack
page read and write
56A0000
heap
page read and write
7FFD34521000
trusted library allocation
page read and write
12F0000
heap
page read and write
BA611FE000
stack
page read and write
1310000
trusted library allocation
page read and write
2DD0000
trusted library allocation
page read and write
5694000
heap
page read and write
250CAA32000
heap
page read and write
250E4CE2000
heap
page read and write
64D3000
heap
page read and write
BA616FF000
stack
page read and write
BA61AFD000
stack
page read and write
6A50000
trusted library allocation
page read and write
6F50000
heap
page read and write
30CD000
trusted library allocation
page read and write
6A57000
trusted library allocation
page read and write
BA61CFB000
stack
page read and write
10F9000
stack
page read and write
7FFD34430000
trusted library allocation
page execute and read and write
250CA9A8000
heap
page read and write
125E000
stack
page read and write
250CA910000
heap
page read and write
2DE6000
trusted library allocation
page execute and read and write
5C40000
trusted library allocation
page execute and read and write
250CAB10000
heap
page execute and read and write
6440000
heap
page read and write
250E4D03000
heap
page read and write
30BE000
trusted library allocation
page read and write
250CA960000
heap
page read and write
3176000
trusted library allocation
page read and write
7FFD34334000
trusted library allocation
page read and write
2DEA000
trusted library allocation
page execute and read and write
66BD000
stack
page read and write
134A000
heap
page read and write
250CAAA4000
heap
page read and write
250CC4EA000
trusted library allocation
page read and write
250CAA90000
heap
page read and write
6B70000
trusted library allocation
page read and write
5630000
heap
page execute and read and write
BA617FE000
stack
page read and write
30B2000
trusted library allocation
page read and write
64DE000
heap
page read and write
BA612FE000
stack
page read and write
250CAA30000
heap
page read and write
7FFD34322000
trusted library allocation
page read and write
6DEE000
stack
page read and write
3090000
trusted library allocation
page read and write
55BC000
stack
page read and write
693E000
stack
page read and write
2DF2000
trusted library allocation
page read and write
6F30000
trusted library allocation
page read and write
30E0000
trusted library allocation
page read and write
6B2E000
stack
page read and write
31B6000
trusted library allocation
page read and write
589C000
stack
page read and write
67FE000
stack
page read and write
1260000
heap
page read and write
31D4000
trusted library allocation
page read and write
7FFD3431D000
trusted library allocation
page execute and read and write
250CC431000
trusted library allocation
page read and write
6D6E000
stack
page read and write
BA615FE000
stack
page read and write
1280000
heap
page read and write
4169000
trusted library allocation
page read and write
250CABB5000
heap
page read and write
400000
remote allocation
page execute and read and write
7FFD34516000
trusted library allocation
page read and write
250CA990000
trusted library allocation
page read and write
72D0000
heap
page read and write
7FFD344FC000
trusted library allocation
page read and write
30A0000
trusted library allocation
page read and write
250E4390000
trusted library allocation
page read and write
5C38000
trusted library allocation
page read and write
2DC4000
trusted library allocation
page read and write
DD9000
stack
page read and write
6B6E000
stack
page read and write
1270000
heap
page read and write
1414000
heap
page read and write
2DC0000
trusted library allocation
page read and write
250DC361000
trusted library allocation
page read and write
250CA8D0000
heap
page read and write
7FFD344C0000
trusted library allocation
page read and write
2E5E000
stack
page read and write
2DF7000
trusted library allocation
page execute and read and write
3070000
heap
page read and write
2E10000
trusted library allocation
page read and write
BA61BFE000
stack
page read and write
7FFD343C6000
trusted library allocation
page read and write
250E4BF0000
heap
page read and write
1140000
heap
page read and write
There are 201 hidden memdumps, click here to show them.