IOC Report
Purchase Order.exe

loading gif

Files

File Path
Type
Category
Malicious
Purchase Order.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Purchase Order.exe
"C:\Users\user\Desktop\Purchase Order.exe"
 malicious
C:\Users\user\Desktop\Purchase Order.exe
"C:\Users\user\Desktop\Purchase Order.exe"
 malicious
C:\Users\user\Desktop\Purchase Order.exe
"C:\Users\user\Desktop\Purchase Order.exe"
 malicious

URLs

Name
IP
Malicious
http://checkip.dyndns.org/
132.226.247.73
http://us2.smtp.mailhostbox.com
unknown
http://checkip.dyndns.org/q
unknown
https://scratchdreams.tk
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org
unknown
https://scratchdreams.tk/_send_.php?TS
172.67.169.18
http://checkip.dyndns.org
unknown
http://checkip.dyndns.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://reallyfreegeoip.org/xml/102.129.152.231$
unknown
http://scratchdreams.tk
unknown
https://reallyfreegeoip.org/xml/102.129.152.231
104.21.67.152
https://reallyfreegeoip.org/xml/
unknown
There are 4 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
checkip.dyndns.org
unknown
 malicious
us2.smtp.mailhostbox.com
208.91.198.143
reallyfreegeoip.org
104.21.67.152
scratchdreams.tk
172.67.169.18
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
208.91.198.143
us2.smtp.mailhostbox.com
United States
104.21.67.152
reallyfreegeoip.org
United States
172.67.169.18
scratchdreams.tk
United States
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
38DE000
trusted library allocation
page read and write
 malicious
3262000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
2F91000
trusted library allocation
page read and write
 malicious
4B60000
trusted library allocation
page read and write
5600000
heap
page read and write
240000
unkown
page readonly
5603000
heap
page read and write
6830000
heap
page read and write
549E000
trusted library allocation
page read and write
2660000
heap
page read and write
400000
remote allocation
page execute and read and write
B7E000
stack
page read and write
303C000
trusted library allocation
page read and write
6DB0000
trusted library allocation
page read and write
3F91000
trusted library allocation
page read and write
C30000
trusted library allocation
page read and write
6E10000
heap
page read and write
1270000
heap
page read and write
14F0000
trusted library allocation
page read and write
72E4000
heap
page read and write
3045000
trusted library allocation
page read and write
688D000
heap
page read and write
6D76000
trusted library allocation
page read and write
30C8000
trusted library allocation
page read and write
135B000
heap
page read and write
72DF000
stack
page read and write
C50000
trusted library allocation
page read and write
6CB0000
trusted library allocation
page read and write
54AE000
trusted library allocation
page read and write
1520000
trusted library allocation
page execute and read and write
F20000
heap
page read and write
A26000
heap
page read and write
72E0000
heap
page read and write
6DD0000
trusted library allocation
page execute and read and write
95B000
stack
page read and write
121E000
stack
page read and write
870000
trusted library allocation
page read and write
14F7000
trusted library allocation
page execute and read and write
6D60000
trusted library allocation
page execute and read and write
2E70000
heap
page read and write
67AE000
heap
page read and write
883000
trusted library allocation
page read and write
267B000
trusted library allocation
page read and write
13AE000
stack
page read and write
3D0000
heap
page read and write
2696000
trusted library allocation
page read and write
1325000
heap
page read and write
3757000
trusted library allocation
page read and write
C20000
trusted library allocation
page execute and read and write
3042000
trusted library allocation
page read and write
31D5000
trusted library allocation
page read and write
2E2E000
stack
page read and write
31F8000
trusted library allocation
page read and write
30D8000
trusted library allocation
page read and write
26B0000
trusted library allocation
page read and write
2670000
trusted library allocation
page read and write
D6E000
stack
page read and write
1540000
heap
page read and write
4044000
trusted library allocation
page read and write
6CD0000
trusted library allocation
page read and write
321F000
trusted library allocation
page read and write
980000
heap
page read and write
1278000
heap
page read and write
84E000
stack
page read and write
54E0000
trusted library allocation
page read and write
730B000
heap
page read and write
8A2000
trusted library allocation
page read and write
682E000
stack
page read and write
9B6E000
stack
page read and write
359000
stack
page read and write
307D000
trusted library allocation
page read and write
31E9000
trusted library allocation
page read and write
3149000
trusted library allocation
page read and write
5490000
trusted library allocation
page read and write
31F3000
trusted library allocation
page read and write
8B0000
heap
page read and write
890000
trusted library allocation
page read and write
3039000
trusted library allocation
page read and write
5BBE000
trusted library allocation
page read and write
896000
trusted library allocation
page execute and read and write
6BC7000
trusted library allocation
page read and write
6B30000
trusted library section
page read and write
6DB7000
trusted library allocation
page read and write
3034000
trusted library allocation
page read and write
4019000
trusted library allocation
page read and write
4B50000
trusted library allocation
page execute and read and write
3FB9000
trusted library allocation
page read and write
84DE000
stack
page read and write
54B1000
trusted library allocation
page read and write
9C6E000
stack
page read and write
26A2000
trusted library allocation
page read and write
512E000
stack
page read and write
2663000
heap
page read and write
6CB8000
trusted library allocation
page read and write
2C8000
unkown
page readonly
1510000
trusted library allocation
page read and write
DD5000
heap
page read and write
549B000
trusted library allocation
page read and write
3173000
trusted library allocation
page read and write
6D00000
trusted library allocation
page read and write
3175000
trusted library allocation
page read and write
2640000
trusted library allocation
page read and write
1100000
heap
page read and write
696E000
stack
page read and write
69AE000
stack
page read and write
89A000
trusted library allocation
page execute and read and write
2765000
trusted library allocation
page read and write
14F5000
trusted library allocation
page execute and read and write
C40000
heap
page execute and read and write
3094000
trusted library allocation
page read and write
87D000
trusted library allocation
page execute and read and write
30E4000
trusted library allocation
page read and write
54D0000
trusted library allocation
page read and write
873000
trusted library allocation
page execute and read and write
30FF000
trusted library allocation
page read and write
2674000
trusted library allocation
page read and write
98AE000
stack
page read and write
31DA000
trusted library allocation
page read and write
960000
heap
page read and write
14B4000
trusted library allocation
page read and write
71DE000
stack
page read and write
37A5000
trusted library allocation
page read and write
3090000
trusted library allocation
page read and write
6D05000
trusted library allocation
page read and write
4025000
trusted library allocation
page read and write
54A2000
trusted library allocation
page read and write
273D000
trusted library allocation
page read and write
3069000
trusted library allocation
page read and write
6E20000
trusted library allocation
page execute and read and write
263E000
stack
page read and write
50E0000
trusted library section
page read and write
A34000
heap
page read and write
880000
trusted library allocation
page read and write
A47000
heap
page read and write
14B3000
trusted library allocation
page execute and read and write
30DC000
trusted library allocation
page read and write
14D0000
heap
page read and write
874000
trusted library allocation
page read and write
6DE0000
trusted library allocation
page read and write
C0E000
stack
page read and write
164E000
stack
page read and write
14F2000
trusted library allocation
page read and write
65EE000
stack
page read and write
986E000
stack
page read and write
4010000
trusted library allocation
page read and write
304E000
trusted library allocation
page read and write
2E6E000
stack
page read and write
54BD000
trusted library allocation
page read and write
6AEF000
stack
page read and write
2701000
trusted library allocation
page read and write
3031000
trusted library allocation
page read and write
67A0000
heap
page read and write
5496000
trusted library allocation
page read and write
98A000
heap
page read and write
242000
unkown
page readonly
6CB6000
trusted library allocation
page read and write
91E000
stack
page read and write
4BC0000
heap
page read and write
54D4000
trusted library allocation
page read and write
56B0000
trusted library allocation
page read and write
3FF5000
trusted library allocation
page read and write
5BB0000
trusted library allocation
page read and write
54AA000
trusted library allocation
page read and write
2F80000
heap
page execute and read and write
66EE000
stack
page read and write
80E000
stack
page read and write
502E000
stack
page read and write
99F000
heap
page read and write
9B4000
heap
page read and write
321B000
trusted library allocation
page read and write
4F20000
heap
page read and write
BC0000
trusted library allocation
page read and write
14FB000
trusted library allocation
page execute and read and write
4D40000
heap
page read and write
68A0000
trusted library allocation
page execute and read and write
6CAE000
stack
page read and write
3080000
trusted library allocation
page read and write
47FC000
stack
page read and write
9C1000
heap
page read and write
6BA0000
trusted library allocation
page read and write
14CD000
trusted library allocation
page execute and read and write
68A7000
heap
page read and write
598E000
stack
page read and write
30CC000
trusted library allocation
page read and write
126E000
stack
page read and write
5470000
heap
page read and write
D89000
stack
page read and write
6DC0000
trusted library allocation
page read and write
37F3000
trusted library allocation
page read and write
5840000
heap
page execute and read and write
128E000
heap
page read and write
C60000
heap
page read and write
14E0000
trusted library allocation
page read and write
6CF0000
trusted library allocation
page execute and read and write
3701000
trusted library allocation
page read and write
1220000
heap
page read and write
269D000
trusted library allocation
page read and write
8D0000
trusted library allocation
page read and write
14A0000
trusted library allocation
page read and write
6CBB000
trusted library allocation
page read and write
310D000
trusted library allocation
page read and write
3232000
trusted library allocation
page read and write
9D6F000
stack
page read and write
3C0000
heap
page read and write
2767000
trusted library allocation
page read and write
14B0000
trusted library allocation
page read and write
1530000
trusted library allocation
page read and write
6F7000
stack
page read and write
6DC2000
trusted library allocation
page read and write
322C000
trusted library allocation
page read and write
30D0000
trusted library allocation
page read and write
6BAE000
stack
page read and write
268E000
trusted library allocation
page read and write
68B0000
trusted library allocation
page read and write
6D02000
trusted library allocation
page read and write
860000
trusted library allocation
page read and write
14C0000
trusted library allocation
page read and write
26A0000
trusted library allocation
page read and write
9BF000
heap
page read and write
F27000
heap
page read and write
9DAE000
stack
page read and write
88D000
trusted library allocation
page execute and read and write
311B000
trusted library allocation
page read and write
A41000
heap
page read and write
308C000
trusted library allocation
page read and write
4B40000
heap
page read and write
3709000
trusted library allocation
page read and write
30C4000
trusted library allocation
page read and write
F00000
trusted library allocation
page read and write
4BB0000
heap
page execute and read and write
DD0000
heap
page read and write
31E0000
trusted library allocation
page read and write
3225000
trusted library allocation
page read and write
54C2000
trusted library allocation
page read and write
9EAF000
stack
page read and write
4B80000
trusted library allocation
page read and write
2F7E000
stack
page read and write
7270000
heap
page read and write
56A0000
heap
page read and write
8B5000
heap
page read and write
12A5000
heap
page read and write
6CE4000
trusted library allocation
page read and write
14BD000
trusted library allocation
page execute and read and write
5B90000
trusted library allocation
page read and write
26F0000
heap
page read and write
54F0000
heap
page read and write
6CC0000
trusted library allocation
page execute and read and write
276A000
trusted library allocation
page read and write
4CBB000
stack
page read and write
BBE000
stack
page read and write
30F1000
trusted library allocation
page read and write
98E000
heap
page read and write
588D000
stack
page read and write
30E0000
trusted library allocation
page read and write
50D0000
trusted library allocation
page read and write
4BD0000
heap
page read and write
14E2000
trusted library allocation
page read and write
54B6000
trusted library allocation
page read and write
3051000
trusted library allocation
page read and write
10F7000
stack
page read and write
9A7000
heap
page read and write
2781000
trusted library allocation
page read and write
2691000
trusted library allocation
page read and write
5030000
trusted library allocation
page execute and read and write
892000
trusted library allocation
page read and write
4F25000
heap
page read and write
56B0000
heap
page read and write
3157000
trusted library allocation
page read and write
6D10000
trusted library allocation
page read and write
50C0000
trusted library section
page read and write
F15000
trusted library allocation
page read and write
14EA000
trusted library allocation
page execute and read and write
3088000
trusted library allocation
page read and write
69EE000
stack
page read and write
672E000
stack
page read and write
9970000
heap
page read and write
30D4000
trusted library allocation
page read and write
8A7000
trusted library allocation
page execute and read and write
14E6000
trusted library allocation
page execute and read and write
5BA0000
trusted library allocation
page execute and read and write
BC5000
trusted library allocation
page read and write
56D0000
heap
page read and write
4BA0000
trusted library section
page readonly
31FC000
trusted library allocation
page read and write
6DA0000
trusted library allocation
page read and write
275B000
trusted library allocation
page read and write
F10000
trusted library allocation
page read and write
313A000
trusted library allocation
page read and write
3137000
trusted library allocation
page read and write
8AB000
trusted library allocation
page execute and read and write
BCF000
trusted library allocation
page read and write
There are 282 hidden memdumps, click here to show them.