IOC Report
Purchase Order.exe

loading gif

Files

File Path
Type
Category
Malicious
Purchase Order.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Purchase Order.exe
"C:\Users\user\Desktop\Purchase Order.exe"
 malicious
C:\Users\user\Desktop\Purchase Order.exe
"C:\Users\user\Desktop\Purchase Order.exe"
 malicious

URLs

Name
IP
Malicious
http://checkip.dyndns.org/
158.101.44.242
http://us2.smtp.mailhostbox.com
unknown
http://www.microsoft.cJ
unknown
http://checkip.dyndns.org/q
unknown
https://scratchdreams.tk
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org
unknown
https://scratchdreams.tk/_send_.php?TS
104.21.27.85
http://checkip.dyndns.org
unknown
http://checkip.dyndns.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://reallyfreegeoip.org/xml/102.129.152.231$
unknown
http://scratchdreams.tk
unknown
https://reallyfreegeoip.org/xml/102.129.152.231
172.67.177.134
https://reallyfreegeoip.org/xml/
unknown
There are 5 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
checkip.dyndns.org
unknown
 malicious
us2.smtp.mailhostbox.com
208.91.199.225
reallyfreegeoip.org
172.67.177.134
scratchdreams.tk
104.21.27.85
checkip.dyndns.com
158.101.44.242

IPs

IP
Domain
Country
Malicious
208.91.199.225
us2.smtp.mailhostbox.com
United States
158.101.44.242
checkip.dyndns.com
United States
172.67.177.134
reallyfreegeoip.org
United States
104.21.27.85
scratchdreams.tk
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Purchase Order_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
36BE000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
2F51000
trusted library allocation
page read and write
 malicious
3232000
trusted library allocation
page read and write
 malicious
3111000
trusted library allocation
page read and write
 malicious
3FED000
trusted library allocation
page read and write
5396000
trusted library allocation
page read and write
4525000
trusted library allocation
page read and write
7C0000
heap
page read and write
4C30000
heap
page execute and read and write
53B6000
trusted library allocation
page read and write
34E1000
trusted library allocation
page read and write
49E6000
trusted library allocation
page read and write
5A3E000
stack
page read and write
AB1E000
stack
page read and write
4B63000
heap
page read and write
3090000
trusted library allocation
page read and write
4A90000
trusted library allocation
page execute and read and write
22B2000
trusted library allocation
page read and write
2290000
trusted library allocation
page read and write
6C02000
trusted library allocation
page read and write
53A2000
trusted library allocation
page read and write
22A0000
trusted library allocation
page read and write
12CE000
stack
page read and write
22B0000
trusted library allocation
page read and write
4AA0000
trusted library allocation
page read and write
5390000
trusted library allocation
page read and write
74E000
stack
page read and write
4520000
trusted library allocation
page read and write
6BF0000
trusted library allocation
page execute and read and write
1510000
trusted library allocation
page read and write
236C000
stack
page read and write
31EF000
trusted library allocation
page read and write
593E000
stack
page read and write
49C4000
trusted library allocation
page read and write
30FE000
trusted library allocation
page read and write
53AA000
trusted library allocation
page read and write
3FE1000
trusted library allocation
page read and write
6BCE000
stack
page read and write
13A0000
trusted library allocation
page read and write
31BB000
trusted library allocation
page read and write
5A90000
trusted library allocation
page execute and read and write
15C0000
heap
page read and write
13D6000
trusted library allocation
page execute and read and write
13C0000
trusted library allocation
page read and write
451E000
stack
page read and write
22C2000
trusted library allocation
page read and write
E89000
stack
page read and write
67B4000
heap
page read and write
31FA000
trusted library allocation
page read and write
664E000
stack
page read and write
30A4000
trusted library allocation
page read and write
4A15000
trusted library allocation
page read and write
22AD000
trusted library allocation
page execute and read and write
7E8000
heap
page read and write
764000
heap
page read and write
940B000
trusted library allocation
page read and write
229D000
trusted library allocation
page execute and read and write
6F5000
heap
page read and write
700000
heap
page read and write
4E80000
heap
page read and write
31A2000
trusted library allocation
page read and write
53B1000
trusted library allocation
page read and write
319D000
trusted library allocation
page read and write
7CA000
heap
page read and write
1050000
heap
page read and write
7FF000
heap
page read and write
2F40000
heap
page execute and read and write
6BD0000
trusted library allocation
page read and write
53AE000
trusted library allocation
page read and write
674F000
stack
page read and write
1520000
trusted library allocation
page execute and read and write
3F51000
trusted library allocation
page read and write
801000
heap
page read and write
AF5E000
stack
page read and write
868000
heap
page read and write
13CD000
trusted library allocation
page execute and read and write
30D5000
trusted library allocation
page read and write
4BC0000
heap
page read and write
23A0000
trusted library allocation
page read and write
2567000
trusted library allocation
page read and write
13E7000
trusted library allocation
page execute and read and write
6CD2000
trusted library allocation
page read and write
134E000
stack
page read and write
3101000
trusted library allocation
page read and write
192000
unkown
page readonly
49DE000
trusted library allocation
page read and write
53D0000
trusted library allocation
page read and write
8A5000
heap
page read and write
5A86000
trusted library allocation
page read and write
53C2000
trusted library allocation
page read and write
660E000
stack
page read and write
53D4000
trusted library allocation
page read and write
10F6000
heap
page read and write
F87000
stack
page read and write
FE5000
heap
page read and write
20E000
unkown
page readonly
5830000
heap
page execute and read and write
3047000
trusted library allocation
page read and write
1080000
trusted library allocation
page read and write
4013000
trusted library allocation
page read and write
452E000
trusted library allocation
page read and write
2F30000
trusted library allocation
page read and write
10C0000
heap
page read and write
7BE000
stack
page read and write
2293000
trusted library allocation
page execute and read and write
864000
heap
page read and write
750000
heap
page read and write
AE1F000
stack
page read and write
E5F000
stack
page read and write
130E000
stack
page read and write
3FD7000
trusted library allocation
page read and write
4E6E000
stack
page read and write
24DE000
stack
page read and write
53E0000
trusted library allocation
page read and write
AD1E000
stack
page read and write
539E000
trusted library allocation
page read and write
4A10000
trusted library allocation
page read and write
4A00000
trusted library allocation
page read and write
539B000
trusted library allocation
page read and write
22CB000
trusted library allocation
page execute and read and write
35D3000
trusted library allocation
page read and write
3F79000
trusted library allocation
page read and write
22B6000
trusted library allocation
page execute and read and write
22C7000
trusted library allocation
page execute and read and write
3054000
trusted library allocation
page read and write
456E000
stack
page read and write
13E5000
trusted library allocation
page execute and read and write
8380000
trusted library section
page read and write
1077000
trusted library allocation
page read and write
6CB0000
heap
page read and write
504E000
stack
page read and write
650E000
stack
page read and write
24E1000
trusted library allocation
page read and write
5100000
trusted library allocation
page read and write
5A88000
trusted library allocation
page read and write
1060000
trusted library allocation
page read and write
4C20000
trusted library allocation
page read and write
2280000
trusted library allocation
page read and write
3058000
trusted library allocation
page read and write
30E2000
trusted library allocation
page read and write
31C4000
trusted library allocation
page read and write
67E0000
trusted library allocation
page read and write
1400000
heap
page read and write
190000
unkown
page readonly
22E0000
trusted library allocation
page read and write
23D0000
heap
page read and write
1070000
trusted library allocation
page read and write
13EB000
trusted library allocation
page execute and read and write
4D60000
heap
page read and write
B05E000
stack
page read and write
30C7000
trusted library allocation
page read and write
50F0000
trusted library section
page read and write
AF1F000
stack
page read and write
104E000
stack
page read and write
4A80000
heap
page read and write
13DA000
trusted library allocation
page execute and read and write
2390000
trusted library allocation
page execute and read and write
6ACE000
stack
page read and write
13BD000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
300D000
trusted library allocation
page read and write
6718000
heap
page read and write
22A3000
trusted library allocation
page read and write
5590000
heap
page read and write
4D39000
trusted library allocation
page read and write
49CB000
trusted library allocation
page read and write
31A8000
trusted library allocation
page read and write
96EE000
stack
page read and write
6A0F000
stack
page read and write
1182000
heap
page read and write
AB5E000
stack
page read and write
FE0000
heap
page read and write
2FFF000
trusted library allocation
page read and write
4FFE000
heap
page read and write
3019000
trusted library allocation
page read and write
54E3000
heap
page read and write
88E000
heap
page read and write
3FBC000
trusted library allocation
page read and write
3045000
trusted library allocation
page read and write
2521000
trusted library allocation
page read and write
31ED000
trusted library allocation
page read and write
13D0000
trusted library allocation
page read and write
2FFC000
trusted library allocation
page read and write
710E000
stack
page read and write
6BA0000
trusted library allocation
page read and write
6BE4000
trusted library allocation
page read and write
688D000
stack
page read and write
1000000
heap
page read and write
4FF0000
heap
page read and write
6700000
heap
page read and write
67A5000
heap
page read and write
2370000
heap
page read and write
3050000
trusted library allocation
page read and write
2F10000
heap
page read and write
1530000
heap
page read and write
309C000
trusted library allocation
page read and write
13E2000
trusted library allocation
page read and write
6900000
trusted library allocation
page execute and read and write
3016000
trusted library allocation
page read and write
890000
heap
page read and write
760000
heap
page read and write
6C76000
trusted library allocation
page read and write
4BC5000
heap
page read and write
31B1000
trusted library allocation
page read and write
30A0000
trusted library allocation
page read and write
3537000
trusted library allocation
page read and write
6A4F000
stack
page read and write
3585000
trusted library allocation
page read and write
694E000
stack
page read and write
3007000
trusted library allocation
page read and write
3031000
trusted library allocation
page read and write
4BB0000
heap
page read and write
4A40000
trusted library allocation
page read and write
34E9000
trusted library allocation
page read and write
5A80000
trusted library allocation
page read and write
232E000
stack
page read and write
31E7000
trusted library allocation
page read and write
5110000
trusted library section
page read and write
690E000
stack
page read and write
11B0000
heap
page read and write
4D30000
trusted library allocation
page read and write
4C0C000
stack
page read and write
85D000
heap
page read and write
5820000
trusted library allocation
page read and write
5810000
trusted library allocation
page execute and read and write
30AC000
trusted library allocation
page read and write
68CF000
stack
page read and write
13B0000
trusted library allocation
page read and write
4BA0000
trusted library section
page readonly
157E000
stack
page read and write
30B9000
trusted library allocation
page read and write
308C000
trusted library allocation
page read and write
6C10000
trusted library allocation
page read and write
6CC0000
trusted library allocation
page execute and read and write
610000
heap
page read and write
22C0000
trusted library allocation
page read and write
5400000
trusted library allocation
page read and write
49ED000
trusted library allocation
page read and write
7160000
heap
page read and write
22BA000
trusted library allocation
page execute and read and write
4E70000
heap
page read and write
2E6F000
stack
page read and write
67D0000
trusted library allocation
page execute and read and write
49F2000
trusted library allocation
page read and write
3A7000
stack
page read and write
2AA000
stack
page read and write
467C000
stack
page read and write
4C10000
trusted library allocation
page execute and read and write
5A8B000
trusted library allocation
page read and write
6CD0000
trusted library allocation
page execute and read and write
13E0000
trusted library allocation
page read and write
7F5000
heap
page read and write
546E000
stack
page read and write
66D0000
heap
page read and write
3004000
trusted library allocation
page read and write
305C000
trusted library allocation
page read and write
6F0000
heap
page read and write
53BD000
trusted library allocation
page read and write
3098000
trusted library allocation
page read and write
4D40000
trusted library allocation
page execute and read and write
2550000
trusted library allocation
page read and write
10EA000
heap
page read and write
49E1000
trusted library allocation
page read and write
4EA4000
heap
page read and write
4B90000
heap
page read and write
9BF000
stack
page read and write
23B0000
trusted library allocation
page read and write
2294000
trusted library allocation
page read and write
13B4000
trusted library allocation
page read and write
54E0000
heap
page read and write
313B000
trusted library allocation
page read and write
3094000
trusted library allocation
page read and write
13B3000
trusted library allocation
page execute and read and write
23C0000
heap
page execute and read and write
13D2000
trusted library allocation
page read and write
1090000
trusted library allocation
page read and write
30A8000
trusted library allocation
page read and write
6C00000
trusted library allocation
page read and write
582E000
trusted library allocation
page read and write
31F4000
trusted library allocation
page read and write
6750000
heap
page read and write
6C05000
trusted library allocation
page read and write
54D0000
trusted library allocation
page read and write
7CE000
heap
page read and write
4B70000
trusted library allocation
page read and write
4A20000
trusted library allocation
page read and write
10C8000
heap
page read and write
31C0000
trusted library allocation
page read and write
49C0000
trusted library allocation
page read and write
15BE000
stack
page read and write
253F000
trusted library allocation
page read and write
4B60000
heap
page read and write
There are 283 hidden memdumps, click here to show them.