IOC Report
109__Purchase_Order.exe

loading gif

Files

File Path
Type
Category
Malicious
109__Purchase_Order.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\109__Purchase_Order.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\109__Purchase_Order.exe
"C:\Users\user\Desktop\109__Purchase_Order.exe"
 malicious
C:\Users\user\Desktop\109__Purchase_Order.exe
"C:\Users\user\Desktop\109__Purchase_Order.exe"
 malicious

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://us2.smtp.mailhostbox.com
unknown
http://www.fontbureau.com/designers?
unknown
http://tempuri.org/DataSet1.xsd
unknown
http://www.tiro.com
unknown
http://checkip.dyndns.org
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.org/q
unknown
http://www.jiyu-kobo.co.jp/
unknown
https://scratchdreams.tk
unknown
http://reallyfreegeoip.org
unknown
http://www.galapagosdesign.com/DPlease
unknown
https://reallyfreegeoip.org
unknown
http://www.fontbureau.com/designers8
unknown
https://scratchdreams.tk/_send_.php?TS
104.21.27.85
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://checkip.dyndns.com
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
https://reallyfreegeoip.org/xml/102.129.152.231$
unknown
http://scratchdreams.tk
unknown
https://reallyfreegeoip.org/xml/102.129.152.231
172.67.177.134
https://reallyfreegeoip.org/xml/
unknown
There are 30 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
checkip.dyndns.org
unknown
 malicious
us2.smtp.mailhostbox.com
208.91.199.225
reallyfreegeoip.org
172.67.177.134
scratchdreams.tk
104.21.27.85
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
193.122.6.168
checkip.dyndns.com
United States
208.91.199.225
us2.smtp.mailhostbox.com
United States
172.67.177.134
reallyfreegeoip.org
United States
104.21.27.85
scratchdreams.tk
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\109__Purchase_Order_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3081000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
435E000
trusted library allocation
page read and write
 malicious
3334000
trusted library allocation
page read and write
 malicious
3215000
trusted library allocation
page read and write
2EDB000
trusted library allocation
page execute and read and write
6EB0000
trusted library allocation
page read and write
56B2000
trusted library allocation
page read and write
6EA0000
trusted library allocation
page read and write
3243000
trusted library allocation
page read and write
6ED0000
trusted library allocation
page read and write
3251000
trusted library allocation
page read and write
4081000
trusted library allocation
page read and write
31BE000
trusted library allocation
page read and write
77C8000
trusted library allocation
page read and write
177E000
stack
page read and write
55D2000
trusted library allocation
page read and write
3148000
trusted library allocation
page read and write
5BA0000
trusted library allocation
page execute and read and write
1500000
trusted library allocation
page read and write
3234000
trusted library allocation
page read and write
2F60000
trusted library allocation
page read and write
3177000
trusted library allocation
page read and write
31D6000
trusted library allocation
page read and write
6AEE000
stack
page read and write
3163000
trusted library allocation
page read and write
6CEE000
stack
page read and write
2FEE000
trusted library allocation
page read and write
6DF4000
trusted library allocation
page read and write
5CD0000
trusted library allocation
page read and write
6AAD000
stack
page read and write
6E90000
trusted library allocation
page read and write
5CD8000
trusted library allocation
page read and write
32FA000
trusted library allocation
page read and write
1300000
heap
page read and write
31CE000
trusted library allocation
page read and write
317E000
stack
page read and write
5626000
trusted library allocation
page read and write
1547000
trusted library allocation
page execute and read and write
332E000
trusted library allocation
page read and write
5870000
trusted library allocation
page read and write
5CDB000
trusted library allocation
page read and write
764E000
heap
page read and write
326E000
trusted library allocation
page read and write
DC0000
unkown
page readonly
55AE000
trusted library allocation
page read and write
2FF0000
trusted library allocation
page execute and read and write
16F0000
trusted library allocation
page read and write
59F0000
trusted library allocation
page read and write
5632000
trusted library allocation
page read and write
13EF000
heap
page read and write
1520000
trusted library allocation
page read and write
6F20000
heap
page read and write
15A0000
heap
page read and write
55E0000
trusted library allocation
page read and write
14F0000
trusted library allocation
page read and write
7200000
trusted library allocation
page read and write
5A60000
trusted library section
page readonly
2FDE000
stack
page read and write
152A000
trusted library allocation
page execute and read and write
40ED000
trusted library allocation
page read and write
16F3000
trusted library allocation
page execute and read and write
7640000
heap
page read and write
1720000
heap
page read and write
2F70000
trusted library allocation
page execute and read and write
55F0000
trusted library allocation
page read and write
4225000
trusted library allocation
page read and write
13D7000
heap
page read and write
6B2E000
stack
page read and write
4114000
trusted library allocation
page read and write
59D0000
trusted library allocation
page read and write
55E4000
trusted library allocation
page read and write
2F00000
trusted library allocation
page execute and read and write
1700000
trusted library allocation
page read and write
13D7000
heap
page read and write
1560000
trusted library allocation
page read and write
32DC000
trusted library allocation
page read and write
151D000
trusted library allocation
page execute and read and write
2ED2000
trusted library allocation
page read and write
4273000
trusted library allocation
page read and write
13E4000
heap
page read and write
59FE000
trusted library allocation
page read and write
5A90000
heap
page read and write
1526000
trusted library allocation
page execute and read and write
31D2000
trusted library allocation
page read and write
155E000
stack
page read and write
69DA000
heap
page read and write
7E20000
heap
page read and write
5A80000
heap
page read and write
16E0000
trusted library allocation
page read and write
6F40000
trusted library allocation
page execute and read and write
682E000
stack
page read and write
7BEE000
stack
page read and write
318A000
trusted library allocation
page read and write
EBA000
stack
page read and write
16AE000
stack
page read and write
7E25000
heap
page read and write
2F10000
heap
page read and write
55BE000
trusted library allocation
page read and write
167E000
stack
page read and write
3322000
trusted library allocation
page read and write
2F5E000
stack
page read and write
31C2000
trusted library allocation
page read and write
59E0000
trusted library allocation
page execute and read and write
4189000
trusted library allocation
page read and write
7E30000
heap
page read and write
171A000
trusted library allocation
page execute and read and write
696F000
stack
page read and write
32E2000
trusted library allocation
page read and write
1570000
heap
page read and write
560B000
trusted library allocation
page read and write
52BC000
stack
page read and write
7230000
trusted library section
page read and write
1712000
trusted library allocation
page read and write
3179000
trusted library allocation
page read and write
7740000
trusted library section
page read and write
40A9000
trusted library allocation
page read and write
71F0000
trusted library section
page read and write
7F5E000
stack
page read and write
FD7000
stack
page read and write
151E000
stack
page read and write
2FE0000
trusted library allocation
page read and write
5A70000
heap
page read and write
6F30000
heap
page read and write
5604000
trusted library allocation
page read and write
31C6000
trusted library allocation
page read and write
56D0000
heap
page execute and read and write
1710000
trusted library allocation
page read and write
13CA000
heap
page read and write
31E4000
trusted library allocation
page read and write
58DB000
stack
page read and write
A94E000
stack
page read and write
5B0E000
stack
page read and write
5640000
trusted library allocation
page read and write
6EF0000
trusted library allocation
page read and write
7B00000
trusted library allocation
page read and write
3186000
trusted library allocation
page read and write
3065000
trusted library allocation
page read and write
2FE5000
trusted library allocation
page read and write
69D1000
heap
page read and write
31F9000
trusted library allocation
page read and write
55A0000
trusted library allocation
page read and write
3207000
trusted library allocation
page read and write
672E000
stack
page read and write
3182000
trusted library allocation
page read and write
1478000
heap
page read and write
13B0000
heap
page read and write
1513000
trusted library allocation
page read and write
3040000
trusted library allocation
page read and write
5740000
heap
page read and write
31DB000
trusted library allocation
page read and write
5621000
trusted library allocation
page read and write
41D7000
trusted library allocation
page read and write
56A0000
heap
page read and write
6DEE000
stack
page read and write
5A00000
heap
page execute and read and write
5CF0000
trusted library allocation
page read and write
2ED5000
trusted library allocation
page execute and read and write
303D000
stack
page read and write
515E000
stack
page read and write
6EE0000
trusted library allocation
page execute and read and write
1320000
heap
page read and write
A84E000
stack
page read and write
1220000
heap
page read and write
32FE000
trusted library allocation
page read and write
1310000
heap
page read and write
4107000
trusted library allocation
page read and write
69E9000
heap
page read and write
2F90000
heap
page read and write
7210000
trusted library allocation
page execute and read and write
1330000
heap
page read and write
5CE0000
trusted library allocation
page execute and read and write
525E000
stack
page read and write
1453000
heap
page read and write
5ADE000
heap
page read and write
55A6000
trusted library allocation
page read and write
5743000
heap
page read and write
2ED7000
trusted library allocation
page execute and read and write
6970000
heap
page read and write
2ED0000
trusted library allocation
page read and write
32D7000
trusted library allocation
page read and write
2F70000
heap
page execute and read and write
3050000
trusted library allocation
page read and write
56C0000
trusted library allocation
page execute and read and write
31CA000
trusted library allocation
page read and write
7A6E000
stack
page read and write
1427000
heap
page read and write
FB7000
stack
page read and write
14EE000
stack
page read and write
31BC000
trusted library allocation
page read and write
3131000
trusted library allocation
page read and write
6EC7000
trusted library allocation
page read and write
154B000
trusted library allocation
page execute and read and write
31DA000
trusted library allocation
page read and write
5CD6000
trusted library allocation
page read and write
2F60000
heap
page read and write
55C1000
trusted library allocation
page read and write
7220000
trusted library allocation
page read and write
55C6000
trusted library allocation
page read and write
32EC000
trusted library allocation
page read and write
5AF0000
heap
page read and write
6EC0000
trusted library allocation
page read and write
5610000
trusted library allocation
page read and write
6E00000
trusted library allocation
page execute and read and write
4125000
trusted library allocation
page read and write
561E000
trusted library allocation
page read and write
3070000
heap
page execute and read and write
170D000
trusted library allocation
page execute and read and write
1240000
heap
page read and write
58E0000
heap
page read and write
3231000
trusted library allocation
page read and write
7262000
trusted library allocation
page read and write
314B000
trusted library allocation
page read and write
4112000
trusted library allocation
page read and write
139E000
stack
page read and write
13BE000
heap
page read and write
13A8000
heap
page read and write
5750000
heap
page read and write
1537000
heap
page read and write
1510000
trusted library allocation
page read and write
144D000
heap
page read and write
5600000
trusted library allocation
page read and write
1716000
trusted library allocation
page execute and read and write
2F5E000
stack
page read and write
13BE000
heap
page read and write
7240000
trusted library allocation
page read and write
5A5E000
stack
page read and write
32F5000
trusted library allocation
page read and write
5AB9000
heap
page read and write
A74F000
stack
page read and write
145E000
heap
page read and write
56B0000
trusted library allocation
page read and write
7E00000
trusted library allocation
page read and write
3200000
trusted library allocation
page read and write
5AA0000
heap
page read and write
55AB000
trusted library allocation
page read and write
686E000
stack
page read and write
5660000
trusted library allocation
page read and write
2EF0000
trusted library allocation
page read and write
55B2000
trusted library allocation
page read and write
1504000
trusted library allocation
page read and write
A64E000
stack
page read and write
7AFE000
stack
page read and write
3329000
trusted library allocation
page read and write
1530000
heap
page read and write
150D000
trusted library allocation
page execute and read and write
2F63000
heap
page read and write
EDA000
stack
page read and write
567D000
stack
page read and write
318E000
trusted library allocation
page read and write
13A0000
heap
page read and write
2F80000
trusted library allocation
page read and write
DC2000
unkown
page readonly
1503000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
137E000
stack
page read and write
31DE000
trusted library allocation
page read and write
55CD000
trusted library allocation
page read and write
7AAE000
stack
page read and write
3060000
trusted library allocation
page read and write
13F2000
heap
page read and write
805F000
stack
page read and write
1540000
trusted library allocation
page read and write
6E92000
trusted library allocation
page read and write
16FD000
trusted library allocation
page execute and read and write
16F4000
trusted library allocation
page read and write
1542000
trusted library allocation
page read and write
6C2E000
stack
page read and write
55BA000
trusted library allocation
page read and write
4181000
trusted library allocation
page read and write
5A95000
heap
page read and write
51BC000
stack
page read and write
13B8000
heap
page read and write
562D000
trusted library allocation
page read and write
6E16000
trusted library allocation
page read and write
3140000
trusted library allocation
page read and write
5AB0000
heap
page read and write
3181000
trusted library allocation
page read and write
148C000
heap
page read and write
6E95000
trusted library allocation
page read and write
31E9000
trusted library allocation
page read and write
307E000
stack
page read and write
There are 272 hidden memdumps, click here to show them.