IOC Report
vP53Ohx5q0.exe

loading gif

Files

File Path
Type
Category
Malicious
vP53Ohx5q0.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Roaming\confuse\chargeable.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\chargeable.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\vP53Ohx5q0.exe.log
ASCII text, with CRLF line terminators
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\vP53Ohx5q0.exe
"C:\Users\user\Desktop\vP53Ohx5q0.exe"
 malicious
C:\Users\user\AppData\Roaming\confuse\chargeable.exe
"C:\Users\user\AppData\Roaming\confuse\chargeable.exe"
malicious
C:\Users\user\AppData\Roaming\confuse\chargeable.exe
C:\Users\user\AppData\Roaming\confuse\chargeable.exe
 malicious
C:\Users\user\AppData\Roaming\confuse\chargeable.exe
"C:\Users\user\AppData\Roaming\confuse\chargeable.exe"
malicious
C:\Users\user\AppData\Roaming\confuse\chargeable.exe
C:\Users\user\AppData\Roaming\confuse\chargeable.exe
 malicious
C:\Users\user\AppData\Roaming\confuse\chargeable.exe
C:\Users\user\AppData\Roaming\confuse\chargeable.exe
 malicious
C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 80

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://www.fontbureau.com/designers?
unknown
http://go.microsoft.
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://go.microsoft.LinkId=42127
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
https://www.sysinternals.com0
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
doddyfire.linkpc.net
http://www.sakkal.com
unknown
There are 19 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
doddyfire.linkpc.net
187.177.82.222

IPs

IP
Domain
Country
Malicious
187.177.82.222
doddyfire.linkpc.net
Mexico

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
confuse
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SysMain
 malicious
HKEY_CURRENT_USER
di
 malicious
HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS
 malicious
HKEY_CURRENT_USER\SOFTWARE\e1a87040f2026369a233f9ae76301b7b
[kl]

Memdumps

Base Address
Regiontype
Protect
Malicious
36D1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
1660000
heap
page execute and read and write
AB0000
heap
page read and write
931000
heap
page read and write
1517000
trusted library allocation
page execute and read and write
4F6000
stack
page read and write
4E20000
trusted library allocation
page execute and read and write
FED000
heap
page read and write
1380000
trusted library allocation
page read and write
E70000
heap
page read and write
938000
heap
page read and write
6A7E000
stack
page read and write
5100000
trusted library allocation
page read and write
897000
heap
page read and write
A32000
trusted library allocation
page execute and read and write
8E0000
heap
page read and write
EA0000
trusted library allocation
page read and write
4D33000
heap
page read and write
8D3000
heap
page read and write
531E000
stack
page read and write
FCA000
trusted library allocation
page execute and read and write
3E0000
heap
page read and write
510000
heap
page read and write
4B2E000
stack
page read and write
B9F000
stack
page read and write
4E10000
heap
page read and write
8AE000
heap
page read and write
3F84000
trusted library allocation
page read and write
810000
heap
page execute and read and write
8D6000
heap
page read and write
1B1E000
stack
page read and write
4DE0000
trusted library section
page readonly
1030000
heap
page read and write
A77000
trusted library allocation
page execute and read and write
9D0000
heap
page read and write
1369000
stack
page read and write
898000
heap
page read and write
18B0000
trusted library allocation
page read and write
1390000
heap
page read and write
8D0000
heap
page read and write
4F6A000
heap
page read and write
134E000
stack
page read and write
8E8000
heap
page read and write
126F000
stack
page read and write
FFE000
stack
page read and write
6FEE000
stack
page read and write
862000
trusted library allocation
page execute and read and write
18EC000
trusted library allocation
page execute and read and write
68CE000
stack
page read and write
4E83000
heap
page read and write
2B03000
trusted library allocation
page read and write
5B24000
trusted library section
page readonly
4D27000
heap
page read and write
4B6E000
stack
page read and write
8ED000
heap
page read and write
4D20000
heap
page read and write
8CF000
heap
page read and write
887000
heap
page read and write
853000
heap
page read and write
8B4000
heap
page read and write
14B2000
trusted library allocation
page execute and read and write
18D0000
heap
page read and write
4E94000
trusted library section
page readonly
4D33000
heap
page read and write
4D33000
heap
page read and write
8A0000
heap
page read and write
776000
heap
page read and write
935000
heap
page read and write
593E000
stack
page read and write
1366000
stack
page read and write
57FE000
stack
page read and write
4D39000
heap
page read and write
8E1000
heap
page read and write
2ADF000
trusted library allocation
page read and write
1730000
heap
page read and write
E3F000
stack
page read and write
36B000
stack
page read and write
4A5F000
stack
page read and write
6FE000
stack
page read and write
23FF000
stack
page read and write
90E000
heap
page read and write
165E000
stack
page read and write
4E40000
heap
page read and write
90E000
heap
page read and write
FBF000
stack
page read and write
829E000
stack
page read and write
53E0000
trusted library allocation
page read and write
88A000
heap
page read and write
8E0000
heap
page read and write
14A6000
trusted library allocation
page read and write
B20000
heap
page execute and read and write
760000
heap
page read and write
AFE000
stack
page read and write
1360000
heap
page read and write
8D3000
heap
page read and write
14A5000
heap
page read and write
939000
heap
page read and write
1902000
trusted library allocation
page execute and read and write
8D5000
heap
page read and write
4161000
trusted library allocation
page read and write
5080000
trusted library allocation
page execute and read and write
A40000
trusted library allocation
page read and write
27D1000
trusted library allocation
page read and write
8E4000
heap
page read and write
5BF3000
heap
page read and write
8DA000
heap
page read and write
8E3000
heap
page read and write
88A000
heap
page read and write
780000
heap
page read and write
27D8000
trusted library allocation
page read and write
195E000
stack
page read and write
10F2000
trusted library allocation
page execute and read and write
4D5A000
heap
page read and write
D30000
heap
page read and write
4D28000
heap
page read and write
A6A000
trusted library allocation
page execute and read and write
642E000
stack
page read and write
2A31000
trusted library allocation
page read and write
8DC000
heap
page read and write
A57000
trusted library allocation
page execute and read and write
A62000
trusted library allocation
page execute and read and write
861000
heap
page read and write
6530000
heap
page read and write
82DB000
stack
page read and write
93B000
heap
page read and write
18EA000
trusted library allocation
page execute and read and write
825000
heap
page read and write
26EF000
stack
page read and write
7F0000
heap
page read and write
4EC0000
heap
page read and write
2B05000
trusted library allocation
page read and write
15AA000
heap
page read and write
857000
trusted library allocation
page execute and read and write
2AC1000
trusted library allocation
page read and write
4D3A000
heap
page read and write
879000
heap
page read and write
8AE000
heap
page read and write
57E000
heap
page read and write
E44000
heap
page read and write
877000
heap
page read and write
570000
heap
page read and write
4CB0000
trusted library allocation
page execute and read and write
4D38000
heap
page read and write
B10000
trusted library allocation
page read and write
1160000
heap
page execute and read and write
A52000
trusted library allocation
page read and write
14F2000
trusted library allocation
page execute and read and write
8AB000
heap
page read and write
736000
stack
page read and write
851E000
stack
page read and write
8B0000
heap
page read and write
155F000
stack
page read and write
5370000
trusted library allocation
page execute and read and write
5168000
trusted library allocation
page read and write
4A9E000
stack
page read and write
8E8000
heap
page read and write
F56000
stack
page read and write
B40000
trusted library allocation
page read and write
65AE000
stack
page read and write
4E43000
heap
page read and write
491E000
stack
page read and write
899000
heap
page read and write
1530000
heap
page read and write
1150000
heap
page read and write
8BE000
stack
page read and write
14DC000
trusted library allocation
page execute and read and write
8DB000
heap
page read and write
151B000
trusted library allocation
page execute and read and write
4BDE000
stack
page read and write
57B0000
heap
page read and write
4D21000
heap
page read and write
875000
heap
page read and write
4C1E000
stack
page read and write
8E8000
heap
page read and write
8D0000
heap
page read and write
62B0000
trusted library allocation
page read and write
A3A000
trusted library allocation
page execute and read and write
899000
heap
page read and write
14E7000
trusted library allocation
page execute and read and write
A20000
trusted library allocation
page read and write
930000
heap
page read and write
4D34000
heap
page read and write
83DC000
stack
page read and write
B54000
heap
page read and write
873000
heap
page read and write
3A31000
trusted library allocation
page read and write
18D4000
heap
page read and write
88C000
heap
page read and write
156F000
heap
page read and write
500D000
stack
page read and write
9EE000
stack
page read and write
96B000
stack
page read and write
88C000
heap
page read and write
856000
heap
page read and write
770000
heap
page read and write
1A10000
heap
page execute and read and write
116C000
heap
page read and write
832000
trusted library allocation
page execute and read and write
B0E000
unkown
page read and write
9C0000
heap
page read and write
5528000
stack
page read and write
114E000
stack
page read and write
84A000
trusted library allocation
page execute and read and write
66AE000
stack
page read and write
126A000
stack
page read and write
4CAE000
stack
page read and write
172F000
stack
page read and write
14D0000
trusted library allocation
page read and write
540000
heap
page read and write
A5A000
trusted library allocation
page execute and read and write
3741000
trusted library allocation
page read and write
4DD0000
heap
page read and write
3641000
trusted library allocation
page read and write
18C2000
trusted library allocation
page execute and read and write
551E000
stack
page read and write
5BE0000
trusted library allocation
page execute and read and write
5BF0000
heap
page read and write
93D000
heap
page read and write
7B30000
heap
page read and write
93C000
heap
page read and write
C0F000
stack
page read and write
8E9000
heap
page read and write
5B10000
heap
page read and write
697E000
stack
page read and write
632E000
stack
page read and write
861000
heap
page read and write
8AB000
heap
page read and write
85A000
trusted library allocation
page execute and read and write
4E70000
heap
page read and write
726E000
stack
page read and write
8D2000
heap
page read and write
4E80000
heap
page read and write
18E0000
trusted library allocation
page read and write
8D9000
heap
page read and write
893000
heap
page read and write
5D50000
trusted library allocation
page read and write
577E000
stack
page read and write
88E000
heap
page read and write
481C000
stack
page read and write
646E000
stack
page read and write
6E80000
heap
page read and write
4D5A000
heap
page read and write
861000
heap
page read and write
51CE000
stack
page read and write
6100000
trusted library section
page read and write
8B4000
heap
page read and write
4D5A000
heap
page read and write
77E000
stack
page read and write
887000
heap
page read and write
523E000
stack
page read and write
92F000
heap
page read and write
1003000
heap
page read and write
18CA000
trusted library allocation
page execute and read and write
B30000
trusted library allocation
page execute and read and write
495E000
stack
page read and write
C1B000
stack
page read and write
93D000
heap
page read and write
9F0000
heap
page read and write
507E000
stack
page read and write
5A3E000
stack
page read and write
73E000
unkown
page read and write
5210000
heap
page read and write
90E000
heap
page read and write
31AF000
trusted library allocation
page read and write
14FE000
stack
page read and write
4F4D000
stack
page read and write
88B000
heap
page read and write
C40000
heap
page read and write
550000
heap
page read and write
E4E000
stack
page read and write
4D5A000
heap
page read and write
366F000
trusted library allocation
page read and write
54A0000
heap
page read and write
6130000
trusted library allocation
page read and write
4D1E000
stack
page read and write
8CF000
heap
page read and write
36CE000
trusted library allocation
page read and write
92C000
heap
page read and write
53F0000
trusted library allocation
page read and write
1D9000
stack
page read and write
888000
heap
page read and write
2741000
trusted library allocation
page read and write
877000
trusted library allocation
page execute and read and write
138F000
trusted library allocation
page read and write
1158000
heap
page read and write
740000
heap
page read and write
8D8000
heap
page read and write
1380000
heap
page read and write
840000
heap
page read and write
14BA000
trusted library allocation
page execute and read and write
2AD2000
trusted library allocation
page read and write
4E90000
trusted library section
page readonly
958000
heap
page read and write
1880000
heap
page read and write
18F0000
trusted library allocation
page read and write
4F60000
heap
page read and write
132000
unkown
page readonly
15CB000
heap
page read and write
8D7000
heap
page read and write
153E000
heap
page read and write
3D0000
heap
page read and write
567B000
stack
page read and write
8DB000
heap
page read and write
73AE000
stack
page read and write
8DB000
heap
page read and write
515000
heap
page read and write
12C0000
heap
page read and write
130000
unkown
page readonly
4E1F000
stack
page read and write
FC2000
trusted library allocation
page execute and read and write
C20000
heap
page read and write
5D80000
heap
page read and write
800000
trusted library allocation
page read and write
5010000
heap
page read and write
D20000
trusted library allocation
page read and write
5D75000
heap
page read and write
87B000
trusted library allocation
page execute and read and write
31F4000
trusted library allocation
page read and write
5B0C000
stack
page read and write
712E000
stack
page read and write
14C0000
heap
page read and write
5FF000
heap
page read and write
18F7000
trusted library allocation
page execute and read and write
14DA000
trusted library allocation
page execute and read and write
8EE000
stack
page read and write
2F81000
trusted library allocation
page read and write
7CE000
stack
page read and write
1512000
trusted library allocation
page read and write
5D90000
heap
page read and write
933000
heap
page read and write
815E000
stack
page read and write
4D21000
heap
page read and write
EB0000
heap
page read and write
5790000
trusted library allocation
page execute and read and write
899000
heap
page read and write
722F000
stack
page read and write
841E000
stack
page read and write
4D3A000
heap
page read and write
14D2000
trusted library allocation
page execute and read and write
177E000
stack
page read and write
3161000
trusted library allocation
page read and write
14A0000
trusted library allocation
page read and write
5ED000
heap
page read and write
2A80000
trusted library allocation
page read and write
13C0000
heap
page read and write
1100000
trusted library allocation
page read and write
83A000
trusted library allocation
page execute and read and write
1500000
heap
page read and write
8CF000
heap
page read and write
6190000
heap
page read and write
E50000
heap
page read and write
A4C000
trusted library allocation
page execute and read and write
578000
heap
page read and write
CF6000
stack
page read and write
FD8000
heap
page read and write
2AC000
stack
page read and write
8DA000
heap
page read and write
A72000
trusted library allocation
page read and write
57A0000
trusted library allocation
page read and write
852000
trusted library allocation
page read and write
F59000
stack
page read and write
18FA000
trusted library allocation
page execute and read and write
4CC0000
trusted library allocation
page read and write
4F50000
heap
page read and write
937000
heap
page read and write
5480000
trusted library allocation
page execute and read and write
12AE000
stack
page read and write
8AC000
heap
page read and write
FB0000
heap
page read and write
7AE000
stack
page read and write
8DF000
heap
page read and write
876000
heap
page read and write
897000
heap
page read and write
70EF000
stack
page read and write
514E000
stack
page read and write
10D6000
trusted library allocation
page execute and read and write
543D000
stack
page read and write
31D2000
trusted library allocation
page read and write
8DE000
heap
page read and write
65A000
heap
page read and write
FD0000
heap
page read and write
93D000
heap
page read and write
4D33000
heap
page read and write
639000
stack
page read and write
4FAB000
heap
page read and write
5CFD000
stack
page read and write
785000
heap
page read and write
8D2000
heap
page read and write
935000
heap
page read and write
B50000
heap
page read and write
3AD000
stack
page read and write
88B000
heap
page read and write
541E000
stack
page read and write
88CE000
stack
page read and write
736F000
stack
page read and write
329D000
trusted library allocation
page read and write
2C3F000
stack
page read and write
4D33000
heap
page read and write
1510000
trusted library allocation
page read and write
892000
heap
page read and write
BDE000
stack
page read and write
819E000
stack
page read and write
3217000
trusted library allocation
page read and write
4D10000
heap
page read and write
6EE000
stack
page read and write
E0E000
stack
page read and write
10D2000
trusted library allocation
page execute and read and write
1000000
heap
page read and write
157C000
heap
page read and write
8E4000
heap
page read and write
935000
heap
page read and write
61A0000
heap
page read and write
67CE000
stack
page read and write
113E000
stack
page read and write
87E000
stack
page read and write
1035000
heap
page read and write
1B50000
heap
page read and write
4D2B000
heap
page read and write
8DC000
heap
page read and write
4DBB000
stack
page read and write
54EC000
stack
page read and write
8ED000
heap
page read and write
8DB000
heap
page read and write
8D5000
heap
page read and write
A4A000
trusted library allocation
page execute and read and write
5AF000
heap
page read and write
15A7000
heap
page read and write
904000
heap
page read and write
4D5A000
heap
page read and write
1050000
heap
page read and write
10DC000
trusted library allocation
page execute and read and write
10D0000
trusted library allocation
page read and write
110B000
trusted library allocation
page execute and read and write
1185000
heap
page read and write
E5A000
stack
page read and write
6FB000
stack
page read and write
8D8000
heap
page read and write
60F0000
heap
page read and write
5D70000
heap
page read and write
155E000
stack
page read and write
A42000
trusted library allocation
page execute and read and write
5590000
unclassified section
page read and write
8DB000
heap
page read and write
84C000
trusted library allocation
page execute and read and write
14B0000
heap
page read and write
8D2000
heap
page read and write
1107000
trusted library allocation
page execute and read and write
18E2000
trusted library allocation
page execute and read and write
E40000
heap
page read and write
4D5A000
heap
page read and write
879000
heap
page read and write
656E000
stack
page read and write
15D7000
heap
page read and write
898000
heap
page read and write
640000
heap
page read and write
842000
trusted library allocation
page execute and read and write
4AD0000
heap
page read and write
961000
heap
page read and write
4FA9000
heap
page read and write
4F6F000
heap
page read and write
5021000
heap
page read and write
5BD0000
heap
page read and write
533E000
stack
page read and write
4F0B000
stack
page read and write
6F3000
stack
page read and write
6AFE000
stack
page read and write
400000
remote allocation
page execute and read and write
8CF000
heap
page read and write
5780000
trusted library allocation
page read and write
58FE000
stack
page read and write
93E000
heap
page read and write
5360000
trusted library allocation
page read and write
739000
stack
page read and write
887000
heap
page read and write
8DA000
heap
page read and write
14A0000
heap
page read and write
191B000
trusted library allocation
page execute and read and write
4641000
trusted library allocation
page read and write
CF9000
stack
page read and write
8AE000
heap
page read and write
1910000
trusted library allocation
page read and write
3F81000
trusted library allocation
page read and write
4EC5000
heap
page read and write
7F0000
heap
page read and write
898000
heap
page read and write
6152000
trusted library allocation
page read and write
92C000
heap
page read and write
1150000
heap
page read and write
820000
heap
page read and write
840000
trusted library allocation
page read and write
EB5000
heap
page read and write
A7B000
trusted library allocation
page execute and read and write
547C000
stack
page read and write
4DC5000
heap
page read and write
8E9000
heap
page read and write
67A0000
trusted library allocation
page execute and read and write
518E000
stack
page read and write
4F9000
stack
page read and write
14EA000
trusted library allocation
page execute and read and write
187F000
stack
page read and write
7B0000
heap
page read and write
86A000
trusted library allocation
page execute and read and write
190A000
trusted library allocation
page execute and read and write
1350000
heap
page read and write
1917000
trusted library allocation
page execute and read and write
61AE000
heap
page read and write
5B20000
trusted library section
page readonly
61B3000
heap
page read and write
8ED000
heap
page read and write
5D30000
heap
page read and write
805F000
stack
page read and write
27CE000
trusted library allocation
page read and write
4D34000
heap
page read and write
6ABD000
stack
page read and write
4DC0000
heap
page read and write
4C6E000
stack
page read and write
11C1000
heap
page read and write
18F2000
trusted library allocation
page read and write
14FA000
trusted library allocation
page execute and read and write
8ED000
heap
page read and write
8EF000
heap
page read and write
There are 512 hidden memdumps, click here to show them.