Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
PO1038854.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO1038854.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5dkr3tbb.vhm.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dqn1tp34.0dg.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qdxuiqie.alq.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5g0fnvv.pm2.ps1
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\PO1038854.exe
|
"C:\Users\user\Desktop\PO1038854.exe"
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO1038854.exe"
|
|
|
|
C:\Users\user\Desktop\PO1038854.exe
|
"C:\Users\user\Desktop\PO1038854.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\wbem\WmiPrvSE.exe
|
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1CE0000
|
direct allocation
|
page read and write
|
|
|
|
400000
|
remote allocation
|
page execute and read and write
|
|
|
|
148B000
|
trusted library allocation
|
page execute and read and write
|
||
|
A140000
|
trusted library section
|
page read and write
|
||
|
1150000
|
heap
|
page read and write
|
||
|
5460000
|
trusted library section
|
page readonly
|
||
|
D758000
|
heap
|
page read and write
|
||
|
2F67000
|
trusted library allocation
|
page read and write
|
||
|
73C3000
|
trusted library allocation
|
page read and write
|
||
|
AC0000
|
unkown
|
page readonly
|
||
|
7530000
|
trusted library allocation
|
page execute and read and write
|
||
|
1480000
|
trusted library allocation
|
page read and write
|
||
|
3EF1000
|
trusted library allocation
|
page read and write
|
||
|
DD6E000
|
stack
|
page read and write
|
||
|
5770000
|
heap
|
page read and write
|
||
|
D34D000
|
stack
|
page read and write
|
||
|
5610000
|
heap
|
page read and write
|
||
|
7250000
|
trusted library allocation
|
page read and write
|
||
|
144F000
|
stack
|
page read and write
|
||
|
1990000
|
direct allocation
|
page execute and read and write
|
||
|
5370000
|
trusted library allocation
|
page read and write
|
||
|
DAEE000
|
stack
|
page read and write
|
||
|
11F6000
|
heap
|
page read and write
|
||
|
1470000
|
trusted library allocation
|
page read and write
|
||
|
D60F000
|
stack
|
page read and write
|
||
|
316E000
|
trusted library allocation
|
page read and write
|
||
|
474A000
|
trusted library allocation
|
page read and write
|
||
|
152E000
|
stack
|
page read and write
|
||
|
1192000
|
heap
|
page read and write
|
||
|
116F000
|
heap
|
page read and write
|
||
|
1476000
|
trusted library allocation
|
page execute and read and write
|
||
|
1454000
|
trusted library allocation
|
page read and write
|
||
|
11DD000
|
heap
|
page read and write
|
||
|
152C000
|
stack
|
page read and write
|
||
|
1AB9000
|
direct allocation
|
page execute and read and write
|
||
|
2E20000
|
trusted library allocation
|
page read and write
|
||
|
1CD8000
|
direct allocation
|
page execute and read and write
|
||
|
10E0000
|
heap
|
page read and write
|
||
|
533B000
|
trusted library allocation
|
page read and write
|
||
|
F37000
|
stack
|
page read and write
|
||
|
1630000
|
heap
|
page read and write
|
||
|
124D000
|
heap
|
page read and write
|
||
|
1237000
|
heap
|
page read and write
|
||
|
D8AE000
|
stack
|
page read and write
|
||
|
53B0000
|
trusted library allocation
|
page read and write
|
||
|
7230000
|
trusted library section
|
page read and write
|
||
|
DC2E000
|
stack
|
page read and write
|
||
|
1C5D000
|
direct allocation
|
page execute and read and write
|
||
|
196F000
|
stack
|
page read and write
|
||
|
53D3000
|
heap
|
page read and write
|
||
|
5356000
|
trusted library allocation
|
page read and write
|
||
|
D9EE000
|
stack
|
page read and write
|
||
|
587E000
|
stack
|
page read and write
|
||
|
145D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1538000
|
heap
|
page read and write
|
||
|
5400000
|
heap
|
page read and write
|
||
|
3EF9000
|
trusted library allocation
|
page read and write
|
||
|
1550000
|
heap
|
page read and write
|
||
|
B84000
|
unkown
|
page readonly
|
||
|
1ABD000
|
direct allocation
|
page execute and read and write
|
||
|
147A000
|
trusted library allocation
|
page execute and read and write
|
||
|
5334000
|
trusted library allocation
|
page read and write
|
||
|
1472000
|
trusted library allocation
|
page read and write
|
||
|
1482000
|
trusted library allocation
|
page read and write
|
||
|
5620000
|
heap
|
page execute and read and write
|
||
|
1190000
|
heap
|
page read and write
|
||
|
10BE000
|
stack
|
page read and write
|
||
|
5360000
|
trusted library allocation
|
page read and write
|
||
|
7268000
|
trusted library allocation
|
page read and write
|
||
|
1070000
|
heap
|
page read and write
|
||
|
D26D000
|
stack
|
page read and write
|
||
|
115E000
|
heap
|
page read and write
|
||
|
D730000
|
heap
|
page read and write
|
||
|
7642000
|
trusted library allocation
|
page read and write
|
||
|
5420000
|
trusted library allocation
|
page read and write
|
||
|
F85000
|
heap
|
page read and write
|
||
|
DB2E000
|
stack
|
page read and write
|
||
|
14E0000
|
heap
|
page read and write
|
||
|
E3A000
|
stack
|
page read and write
|
||
|
D22D000
|
stack
|
page read and write
|
||
|
1453000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E00000
|
trusted library allocation
|
page execute and read and write
|
||
|
14A0000
|
trusted library allocation
|
page read and write
|
||
|
2DFF000
|
stack
|
page read and write
|
||
|
5330000
|
trusted library allocation
|
page read and write
|
||
|
1C41000
|
direct allocation
|
page execute and read and write
|
||
|
7260000
|
trusted library allocation
|
page read and write
|
||
|
1487000
|
trusted library allocation
|
page execute and read and write
|
||
|
13D0000
|
heap
|
page read and write
|
||
|
713E000
|
stack
|
page read and write
|
||
|
576E000
|
stack
|
page read and write
|
||
|
D9AF000
|
stack
|
page read and write
|
||
|
5351000
|
trusted library allocation
|
page read and write
|
||
|
186E000
|
stack
|
page read and write
|
||
|
1B2E000
|
direct allocation
|
page execute and read and write
|
||
|
DC6E000
|
stack
|
page read and write
|
||
|
5665000
|
heap
|
page read and write
|
||
|
4FEC000
|
stack
|
page read and write
|
||
|
2EF1000
|
trusted library allocation
|
page read and write
|
||
|
11F1000
|
heap
|
page read and write
|
||
|
1E20000
|
heap
|
page read and write
|
||
|
73C0000
|
trusted library allocation
|
page read and write
|
||
|
5880000
|
heap
|
page read and write
|
||
|
5470000
|
heap
|
page read and write
|
||
|
6F40000
|
heap
|
page read and write
|
||
|
5414000
|
trusted library allocation
|
page read and write
|
||
|
73BE000
|
stack
|
page read and write
|
||
|
56AC000
|
stack
|
page read and write
|
||
|
2E10000
|
trusted library allocation
|
page read and write
|
||
|
1140000
|
trusted library allocation
|
page read and write
|
||
|
1557000
|
heap
|
page read and write
|
||
|
535D000
|
trusted library allocation
|
page read and write
|
||
|
DEAC000
|
stack
|
page read and write
|
||
|
136D000
|
stack
|
page read and write
|
||
|
DDAB000
|
stack
|
page read and write
|
||
|
5430000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E30000
|
heap
|
page execute and read and write
|
||
|
146D000
|
trusted library allocation
|
page execute and read and write
|
||
|
5380000
|
trusted library allocation
|
page read and write
|
||
|
534E000
|
trusted library allocation
|
page read and write
|
||
|
7140000
|
trusted library section
|
page read and write
|
||
|
2E48000
|
trusted library allocation
|
page read and write
|
||
|
1460000
|
trusted library allocation
|
page read and write
|
||
|
5640000
|
trusted library allocation
|
page read and write
|
||
|
7270000
|
trusted library allocation
|
page execute and read and write
|
||
|
F80000
|
heap
|
page read and write
|
||
|
58B0000
|
heap
|
page read and write
|
||
|
F90000
|
heap
|
page read and write
|
||
|
1530000
|
heap
|
page read and write
|
||
|
5390000
|
trusted library allocation
|
page read and write
|
||
|
2EE0000
|
heap
|
page read and write
|
||
|
D50E000
|
stack
|
page read and write
|
||
|
5630000
|
trusted library allocation
|
page execute and read and write
|
||
|
DFAE000
|
stack
|
page read and write
|
||
|
5890000
|
heap
|
page read and write
|
||
|
5980000
|
trusted library allocation
|
page read and write
|
||
|
112E000
|
stack
|
page read and write
|
||
|
126D000
|
stack
|
page read and write
|
||
|
182E000
|
stack
|
page read and write
|
||
|
1530000
|
heap
|
page read and write
|
||
|
73D0000
|
trusted library allocation
|
page read and write
|
||
|
72BE000
|
stack
|
page read and write
|
||
|
AC2000
|
unkown
|
page readonly
|
||
|
53D0000
|
heap
|
page read and write
|
||
|
14B0000
|
heap
|
page read and write
|
||
|
1450000
|
trusted library allocation
|
page read and write
|
||
|
14EE000
|
stack
|
page read and write
|
||
|
1C56000
|
direct allocation
|
page execute and read and write
|
||
|
5660000
|
heap
|
page read and write
|
||
|
134F000
|
stack
|
page read and write
|
||
|
5410000
|
trusted library allocation
|
page read and write
|
There are 141 hidden memdumps, click here to show them.