IOC Report
PO P24-1100.exe

loading gif

Files

File Path
Type
Category
Malicious
PO P24-1100.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO P24-1100.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3wmli3r0.p5s.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1u0lg1i.cy2.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mw3sbiun.1pu.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vabyxww4.fcn.ps1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PO P24-1100.exe
"C:\Users\user\Desktop\PO P24-1100.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO P24-1100.exe"
 malicious
C:\Users\user\Desktop\PO P24-1100.exe
"C:\Users\user\Desktop\PO P24-1100.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
There are 16 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mail.mbarieservicesltd.com
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
3D19000
trusted library allocation
page read and write
 malicious
2971000
trusted library allocation
page read and write
 malicious
DF0000
trusted library allocation
page read and write
3979000
trusted library allocation
page read and write
B28000
heap
page read and write
5FAF000
stack
page read and write
2BE0000
trusted library allocation
page execute and read and write
AAD000
trusted library allocation
page execute and read and write
5FF7000
heap
page read and write
2D85000
trusted library allocation
page read and write
2AE0000
trusted library allocation
page read and write
29CA000
trusted library allocation
page read and write
2806000
trusted library allocation
page read and write
5E70000
trusted library allocation
page read and write
DC2000
trusted library allocation
page read and write
51D0000
trusted library section
page readonly
2812000
trusted library allocation
page read and write
42C000
remote allocation
page execute and read and write
56B0000
heap
page read and write
27DC000
stack
page read and write
EF7000
heap
page read and write
56A0000
trusted library allocation
page read and write
2B35000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
27EE000
trusted library allocation
page read and write
2D90000
trusted library allocation
page read and write
58D0000
trusted library allocation
page execute and read and write
2BC0000
heap
page read and write
3971000
trusted library allocation
page read and write
2B0D000
trusted library allocation
page read and write
10E8000
heap
page read and write
626E000
stack
page read and write
6280000
trusted library allocation
page execute and read and write
D3E000
stack
page read and write
2B01000
trusted library allocation
page read and write
61CD000
trusted library allocation
page read and write
51FE000
stack
page read and write
A90E000
stack
page read and write
27EB000
trusted library allocation
page read and write
AF0000
heap
page read and write
5FC0000
heap
page read and write
2B80000
heap
page execute and read and write
530E000
stack
page read and write
7EDF000
stack
page read and write
A94C000
stack
page read and write
4EEC000
stack
page read and write
2BA0000
heap
page read and write
7D12000
heap
page read and write
677E000
stack
page read and write
507E000
stack
page read and write
D90000
trusted library allocation
page read and write
2790000
heap
page execute and read and write
2B06000
trusted library allocation
page read and write
5410000
trusted library section
page read and write
839000
stack
page read and write
4DEC000
stack
page read and write
E60000
heap
page read and write
AC6000
trusted library allocation
page execute and read and write
990000
heap
page read and write
D9D000
trusted library allocation
page execute and read and write
2B12000
trusted library allocation
page read and write
D94000
trusted library allocation
page read and write
2B10000
trusted library allocation
page read and write
B97000
heap
page read and write
11FF000
stack
page read and write
635E000
stack
page read and write
AD2000
trusted library allocation
page read and write
B53000
heap
page read and write
DBD000
trusted library allocation
page execute and read and write
F01000
heap
page read and write
E96000
heap
page read and write
2F8C000
trusted library allocation
page read and write
E50000
trusted library allocation
page read and write
ACA000
trusted library allocation
page execute and read and write
A55000
heap
page read and write
4F60000
trusted library allocation
page read and write
7D06000
heap
page read and write
7CE0000
heap
page read and write
52FE000
stack
page read and write
51C0000
trusted library allocation
page read and write
D40000
heap
page read and write
9ED000
stack
page read and write
7D28000
heap
page read and write
800000
unkown
page readonly
27FE000
trusted library allocation
page read and write
AA60000
trusted library allocation
page execute and read and write
2801000
trusted library allocation
page read and write
61F4000
trusted library allocation
page read and write
CF7000
stack
page read and write
622E000
trusted library allocation
page read and write
561D000
stack
page read and write
A61E000
stack
page read and write
7B5E000
stack
page read and write
296E000
stack
page read and write
AA4C000
stack
page read and write
61C7000
trusted library allocation
page read and write
2BD6000
trusted library allocation
page read and write
A40000
heap
page read and write
5160000
trusted library allocation
page read and write
78E0000
trusted library section
page read and write
DA0000
heap
page read and write
2BD0000
trusted library allocation
page read and write
E6A000
heap
page read and write
50BE000
stack
page read and write
5E80000
trusted library allocation
page execute and read and write
58C0000
trusted library allocation
page execute and read and write
88E000
unkown
page readonly
DC6000
trusted library allocation
page execute and read and write
DD2000
trusted library allocation
page read and write
2D8E000
trusted library allocation
page read and write
EA9000
heap
page read and write
10E0000
heap
page read and write
10D0000
trusted library allocation
page read and write
7170000
trusted library allocation
page read and write
2BD2000
trusted library allocation
page read and write
AA3000
trusted library allocation
page execute and read and write
7590000
heap
page read and write
DB0000
trusted library allocation
page read and write
2820000
trusted library allocation
page read and write
1038000
trusted library allocation
page read and write
27FA000
trusted library allocation
page read and write
B56000
heap
page read and write
DD7000
trusted library allocation
page execute and read and write
ABD000
trusted library allocation
page execute and read and write
3D11000
trusted library allocation
page read and write
51BB000
stack
page read and write
2830000
trusted library allocation
page read and write
ADB000
trusted library allocation
page execute and read and write
A50000
heap
page read and write
4E0C000
stack
page read and write
A80E000
stack
page read and write
6190000
heap
page read and write
C0B000
heap
page read and write
57BE000
stack
page read and write
2B20000
trusted library allocation
page read and write
7D3D000
heap
page read and write
61E0000
trusted library allocation
page read and write
7A8E000
stack
page read and write
E3E000
stack
page read and write
280D000
trusted library allocation
page read and write
9A0000
heap
page read and write
52CE000
stack
page read and write
61E4000
trusted library allocation
page read and write
2C00000
heap
page read and write
B10000
trusted library allocation
page execute and read and write
26D8000
trusted library allocation
page read and write
AC2000
trusted library allocation
page read and write
7190000
trusted library allocation
page read and write
29D2000
trusted library allocation
page read and write
E80000
heap
page read and write
2ADC000
stack
page read and write
5520000
trusted library allocation
page read and write
631F000
stack
page read and write
DA5000
heap
page read and write
980000
heap
page read and write
7D0B000
heap
page read and write
5527000
trusted library allocation
page read and write
4F73000
heap
page read and write
A51E000
stack
page read and write
7FC80000
trusted library allocation
page execute and read and write
BC1000
heap
page read and write
2BF0000
trusted library allocation
page read and write
2D11000
trusted library allocation
page read and write
D80000
trusted library allocation
page read and write
9D0000
heap
page read and write
AD7000
trusted library allocation
page execute and read and write
939000
stack
page read and write
569E000
stack
page read and write
2770000
trusted library allocation
page read and write
E40000
trusted library allocation
page execute and read and write
26CE000
stack
page read and write
B00000
trusted library allocation
page read and write
B49000
heap
page read and write
AC0000
trusted library allocation
page read and write
5D60000
heap
page read and write
AA4000
trusted library allocation
page read and write
5420000
heap
page execute and read and write
B3E000
heap
page read and write
B20000
heap
page read and write
2AE4000
trusted library allocation
page read and write
AA0000
trusted library allocation
page read and write
58BE000
stack
page read and write
61C0000
trusted library allocation
page read and write
E6E000
heap
page read and write
2AFE000
trusted library allocation
page read and write
A60000
heap
page read and write
5EF0000
heap
page read and write
71B2000
trusted library allocation
page read and write
10F0000
heap
page read and write
F11000
heap
page read and write
DEE000
stack
page read and write
5310000
heap
page read and write
A90000
trusted library allocation
page read and write
565E000
stack
page read and write
12FE000
stack
page read and write
4A6E000
stack
page read and write
2B60000
trusted library allocation
page read and write
9CE000
stack
page read and write
61F0000
trusted library allocation
page read and write
6220000
trusted library allocation
page read and write
BF5000
heap
page read and write
58F0000
trusted library allocation
page read and write
DCA000
trusted library allocation
page execute and read and write
27E0000
trusted library allocation
page read and write
78AD000
stack
page read and write
929000
stack
page read and write
A7BF000
stack
page read and write
27F2000
trusted library allocation
page read and write
DDB000
trusted library allocation
page execute and read and write
5510000
trusted library allocation
page read and write
5340000
heap
page read and write
2860000
heap
page read and write
61C9000
trusted library allocation
page read and write
5343000
heap
page read and write
5E60000
trusted library allocation
page read and write
E89000
heap
page read and write
2780000
trusted library allocation
page read and write
58E0000
trusted library allocation
page read and write
798E000
stack
page read and write
DC0000
trusted library allocation
page read and write
2D0F000
stack
page read and write
AB0000
trusted library allocation
page read and write
2B30000
trusted library allocation
page read and write
51E0000
trusted library allocation
page execute and read and write
2B40000
trusted library allocation
page read and write
6200000
trusted library allocation
page execute and read and write
56B5000
heap
page read and write
4F00000
heap
page execute and read and write
4F70000
heap
page read and write
D93000
trusted library allocation
page execute and read and write
AD5000
trusted library allocation
page execute and read and write
5FB0000
heap
page read and write
4F4E000
stack
page read and write
BE8000
heap
page read and write
802000
unkown
page readonly
F3B000
heap
page read and write
2824000
trusted library allocation
page read and write
5320000
heap
page read and write
EA7000
heap
page read and write
7ACE000
stack
page read and write
DB3000
trusted library allocation
page read and write
51BF000
stack
page read and write
There are 233 hidden memdumps, click here to show them.