IOC Report
ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe

loading gif

Files

File Path
Type
Category
Malicious
ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eumdg1we.agq.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ib5b2pti.hig.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_szrs0nhg.lhe.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdzj5ivz.twf.psm1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
"C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe"
malicious
C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
"C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://checkip.dyndns.org
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://checkip.dyndns.org/
132.226.247.73
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://checkip.dyndns.org/q
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://reallyfreegeoip.org
unknown
http://www.galapagosdesign.com/DPlease
unknown
https://reallyfreegeoip.org
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://checkip.dyndns.com
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 25 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2DED000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
387A000
trusted library allocation
page read and write
 malicious
2C21000
trusted library allocation
page read and write
 malicious
3C21000
trusted library allocation
page read and write
679E000
stack
page read and write
C6A000
trusted library allocation
page execute and read and write
671E000
stack
page read and write
6F42000
heap
page read and write
A69C000
stack
page read and write
2C57000
trusted library allocation
page read and write
5160000
heap
page read and write
CF7000
stack
page read and write
2DC9000
trusted library allocation
page read and write
2DA4000
trusted library allocation
page read and write
3986000
trusted library allocation
page read and write
645E000
heap
page read and write
727E000
stack
page read and write
2AC0000
trusted library allocation
page read and write
11D0000
heap
page read and write
7200000
trusted library allocation
page read and write
A7DE000
stack
page read and write
2AF2000
trusted library allocation
page read and write
4FF0000
heap
page execute and read and write
2BC6000
trusted library allocation
page read and write
1024000
heap
page read and write
EB0000
trusted library allocation
page read and write
3811000
trusted library allocation
page read and write
71F9000
trusted library allocation
page read and write
48EB000
stack
page read and write
2D94000
trusted library allocation
page read and write
2C6C000
trusted library allocation
page read and write
675E000
stack
page read and write
9C0000
heap
page read and write
2CE8000
trusted library allocation
page read and write
C60000
trusted library allocation
page read and write
4DBE000
stack
page read and write
113E000
stack
page read and write
2A3E000
trusted library allocation
page read and write
100B000
trusted library allocation
page execute and read and write
9D0000
heap
page read and write
2869000
trusted library allocation
page read and write
2D77000
trusted library allocation
page read and write
280E000
stack
page read and write
706E000
stack
page read and write
68B0000
trusted library allocation
page execute and read and write
2D67000
trusted library allocation
page read and write
6446000
heap
page read and write
2D12000
trusted library allocation
page read and write
9F6D000
stack
page read and write
A32E000
stack
page read and write
2E7C000
trusted library allocation
page read and write
7010000
trusted library allocation
page read and write
EAD000
trusted library allocation
page execute and read and write
2B88000
trusted library allocation
page read and write
72BE000
stack
page read and write
68C0000
trusted library allocation
page execute and read and write
EC6000
trusted library allocation
page execute and read and write
CFA000
heap
page read and write
2C04000
trusted library allocation
page read and write
6F20000
heap
page read and write
2AE3000
trusted library allocation
page read and write
8F7000
stack
page read and write
12F0000
trusted library allocation
page read and write
7180000
trusted library section
page read and write
2D6B000
trusted library allocation
page read and write
75CE000
stack
page read and write
5755000
trusted library allocation
page read and write
12DE000
stack
page read and write
4FE0000
trusted library allocation
page execute and read and write
A70000
heap
page read and write
2BB2000
trusted library allocation
page read and write
2ACF000
trusted library allocation
page read and write
2E65000
trusted library allocation
page read and write
E70000
heap
page read and write
2DBD000
trusted library allocation
page read and write
117D000
stack
page read and write
4D34000
trusted library allocation
page read and write
51B0000
heap
page read and write
2EAA000
trusted library allocation
page read and write
EBD000
trusted library allocation
page execute and read and write
1020000
trusted library allocation
page read and write
C0E000
stack
page read and write
3CB2000
trusted library allocation
page read and write
F5F000
heap
page read and write
EC0000
trusted library allocation
page read and write
C5D000
trusted library allocation
page execute and read and write
6960000
heap
page read and write
592E000
heap
page read and write
11B0000
trusted library allocation
page read and write
66DE000
stack
page read and write
C7E000
heap
page read and write
2DC4000
trusted library allocation
page read and write
3C8A000
trusted library allocation
page read and write
2A7C000
trusted library allocation
page read and write
F6A000
heap
page read and write
2ACE000
trusted library allocation
page read and write
1180000
trusted library allocation
page execute and read and write
26E0000
heap
page execute and read and write
2BF0000
trusted library allocation
page read and write
ED7000
trusted library allocation
page execute and read and write
ED2000
trusted library allocation
page read and write
641E000
stack
page read and write
7015000
trusted library allocation
page read and write
4E00000
trusted library allocation
page read and write
ED5000
trusted library allocation
page execute and read and write
2E78000
trusted library allocation
page read and write
4D80000
heap
page read and write
26D0000
trusted library allocation
page read and write
2AED000
trusted library allocation
page read and write
2D27000
trusted library allocation
page read and write
2811000
trusted library allocation
page read and write
68D0000
trusted library allocation
page read and write
2DC7000
trusted library allocation
page read and write
26B0000
trusted library allocation
page read and write
3C49000
trusted library allocation
page read and write
5150000
heap
page read and write
EDB000
trusted library allocation
page execute and read and write
6DF0000
heap
page read and write
54E0000
trusted library allocation
page execute and read and write
560E000
stack
page read and write
A6DE000
stack
page read and write
2E5A000
trusted library allocation
page read and write
11C0000
trusted library allocation
page read and write
4D0000
unkown
page readonly
5760000
trusted library allocation
page execute and read and write
733E000
stack
page read and write
68A2000
trusted library allocation
page read and write
4D83000
heap
page read and write
950000
heap
page read and write
575B000
trusted library allocation
page read and write
4DE0000
trusted library allocation
page read and write
1030000
trusted library allocation
page execute and read and write
2CE8000
trusted library allocation
page read and write
6F4F000
heap
page read and write
68A9000
trusted library allocation
page read and write
11B4000
trusted library allocation
page read and write
2EAF000
trusted library allocation
page read and write
A59C000
stack
page read and write
D67000
heap
page read and write
7210000
trusted library allocation
page read and write
71F0000
trusted library allocation
page read and write
F48000
heap
page read and write
A1AF000
stack
page read and write
2CE6000
trusted library allocation
page read and write
2D6F000
trusted library allocation
page read and write
CAF000
heap
page read and write
4DF0000
trusted library allocation
page execute and read and write
C62000
trusted library allocation
page read and write
7170000
trusted library allocation
page read and write
C4D000
trusted library allocation
page execute and read and write
2DD1000
trusted library allocation
page read and write
2A91000
trusted library allocation
page read and write
2A68000
trusted library allocation
page read and write
2C95000
trusted library allocation
page read and write
2AF8000
trusted library allocation
page read and write
2D3B000
trusted library allocation
page read and write
E50000
heap
page read and write
2D26000
trusted library allocation
page read and write
2ADE000
trusted library allocation
page read and write
D31000
heap
page read and write
2E81000
trusted library allocation
page read and write
5750000
trusted library allocation
page read and write
2B5F000
trusted library allocation
page read and write
2EB5000
trusted library allocation
page read and write
2D2B000
trusted library allocation
page read and write
68E0000
trusted library allocation
page read and write
9D6E000
stack
page read and write
2D16000
trusted library allocation
page read and write
4E20000
heap
page read and write
4D30000
trusted library allocation
page read and write
2700000
heap
page read and write
4D90000
trusted library allocation
page read and write
A0AD000
stack
page read and write
69D0000
trusted library allocation
page execute and read and write
2CD3000
trusted library allocation
page read and write
2D89000
trusted library allocation
page read and write
6EF0000
trusted library section
page read and write
2D7B000
trusted library allocation
page read and write
ACE000
stack
page read and write
A1ED000
stack
page read and write
3A3D000
trusted library allocation
page read and write
422000
remote allocation
page execute and read and write
2D1F000
trusted library allocation
page read and write
2C19000
trusted library allocation
page read and write
68A0000
trusted library allocation
page read and write
EA4000
trusted library allocation
page read and write
2A01000
trusted library allocation
page read and write
5EA000
stack
page read and write
EA0000
trusted library allocation
page read and write
2A2A000
trusted library allocation
page read and write
E90000
trusted library allocation
page read and write
5757000
trusted library allocation
page read and write
5900000
heap
page read and write
4D56000
trusted library allocation
page read and write
9C6E000
stack
page read and write
C97000
heap
page read and write
2AC6000
trusted library allocation
page read and write
2C43000
trusted library allocation
page read and write
2B74000
trusted library allocation
page read and write
2D79000
trusted library allocation
page read and write
CB6000
heap
page read and write
A80000
heap
page read and write
2A53000
trusted library allocation
page read and write
72FE000
stack
page read and write
5260000
heap
page read and write
6980000
heap
page read and write
2C2E000
trusted library allocation
page read and write
2DB2000
trusted library allocation
page read and write
7020000
trusted library allocation
page read and write
73BD000
stack
page read and write
2E6E000
trusted library allocation
page read and write
5940000
heap
page read and write
2DCD000
trusted library allocation
page read and write
529E000
stack
page read and write
FF2000
heap
page read and write
2C81000
trusted library allocation
page read and write
9F70000
heap
page read and write
2D63000
trusted library allocation
page read and write
4D4E000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
3CA5000
trusted library allocation
page read and write
29FC000
trusted library allocation
page read and write
C70000
heap
page read and write
64A6000
heap
page read and write
2CBF000
trusted library allocation
page read and write
2D50000
trusted library allocation
page read and write
1310000
heap
page read and write
631E000
stack
page read and write
4D5D000
trusted library allocation
page read and write
C50000
trusted library allocation
page read and write
2D5F000
trusted library allocation
page read and write
58F0000
heap
page read and write
3839000
trusted library allocation
page read and write
50C0000
trusted library section
page readonly
F3E000
stack
page read and write
E76000
heap
page read and write
655E000
stack
page read and write
C53000
trusted library allocation
page read and write
65DE000
stack
page read and write
2AA5000
trusted library allocation
page read and write
C43000
trusted library allocation
page execute and read and write
2DC1000
trusted library allocation
page read and write
716E000
stack
page read and write
2CFD000
trusted library allocation
page read and write
2CAA000
trusted library allocation
page read and write
E6E000
stack
page read and write
51B3000
heap
page read and write
A50000
heap
page read and write
2D23000
trusted library allocation
page read and write
4DD0000
heap
page read and write
2DA8000
trusted library allocation
page read and write
CB2000
heap
page read and write
4DE2000
trusted library allocation
page read and write
2D8E000
trusted library allocation
page read and write
C30000
trusted library allocation
page read and write
2B10000
heap
page execute and read and write
A86000
heap
page read and write
E4E000
stack
page read and write
5190000
heap
page read and write
6420000
heap
page read and write
9E6E000
stack
page read and write
69F0000
trusted library allocation
page read and write
3CBB000
trusted library allocation
page read and write
2B9D000
trusted library allocation
page read and write
2ADA000
trusted library allocation
page read and write
1190000
heap
page read and write
6F3F000
heap
page read and write
BCE000
stack
page read and write
2E5E000
trusted library allocation
page read and write
2EA3000
trusted library allocation
page read and write
1057000
heap
page read and write
26F0000
trusted library allocation
page read and write
39E2000
trusted library allocation
page read and write
2D73000
trusted library allocation
page read and write
6940000
trusted library allocation
page read and write
6F10000
heap
page read and write
1007000
trusted library allocation
page execute and read and write
F77000
heap
page read and write
2D01000
trusted library allocation
page read and write
C66000
trusted library allocation
page execute and read and write
A2EE000
stack
page read and write
49EC000
stack
page read and write
3819000
trusted library allocation
page read and write
2ACB000
trusted library allocation
page read and write
2B36000
trusted library allocation
page read and write
FCC000
heap
page read and write
6A12000
trusted library allocation
page read and write
5500000
heap
page execute and read and write
50BB000
stack
page read and write
2AE1000
trusted library allocation
page read and write
6DFE000
heap
page read and write
EA3000
trusted library allocation
page execute and read and write
26C0000
trusted library allocation
page read and write
2B0D000
trusted library allocation
page read and write
F40000
heap
page read and write
1040000
trusted library allocation
page read and write
6F38000
heap
page read and write
51A0000
trusted library allocation
page read and write
515D000
stack
page read and write
ECA000
trusted library allocation
page execute and read and write
C40000
trusted library allocation
page read and write
4818000
trusted library allocation
page read and write
659E000
stack
page read and write
689E000
stack
page read and write
EC2000
trusted library allocation
page read and write
959000
stack
page read and write
7230000
trusted library allocation
page execute and read and write
2C1F000
stack
page read and write
5195000
heap
page read and write
26D5000
trusted library allocation
page read and write
A42F000
stack
page read and write
2B4A000
trusted library allocation
page read and write
4D51000
trusted library allocation
page read and write
7FC10000
trusted library allocation
page execute and read and write
C44000
trusted library allocation
page read and write
54F0000
trusted library allocation
page read and write
2B21000
trusted library allocation
page read and write
2ABA000
trusted library allocation
page read and write
4D2000
unkown
page readonly
A30000
heap
page read and write
2A15000
trusted library allocation
page read and write
64BB000
heap
page read and write
3CAF000
trusted library allocation
page read and write
54FD000
trusted library allocation
page read and write
E0E000
stack
page read and write
4D3B000
trusted library allocation
page read and write
2BDB000
trusted library allocation
page read and write
2D65000
trusted library allocation
page read and write
11A0000
trusted library allocation
page read and write
26AE000
stack
page read and write
1002000
trusted library allocation
page read and write
2AE6000
trusted library allocation
page read and write
1050000
heap
page read and write
There are 324 hidden memdumps, click here to show them.