IOC Report
ORDER SPECIFICATION.exe

loading gif

Files

File Path
Type
Category
Malicious
ORDER SPECIFICATION.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ORDER SPECIFICATION.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ORDER SPECIFICATION.exe
"C:\Users\user\Desktop\ORDER SPECIFICATION.exe"
 malicious
C:\Users\user\Desktop\ORDER SPECIFICATION.exe
"C:\Users\user\Desktop\ORDER SPECIFICATION.exe"
 malicious
C:\Users\user\Desktop\ORDER SPECIFICATION.exe
"C:\Users\user\Desktop\ORDER SPECIFICATION.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.12.205
http://r3.o.lencr.org0
unknown
https://api.ipify.org
unknown
http://mail.techwiser.in
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://tempuri.org/DataSet1.xsd)Microsoft
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://r3.i.lencr.org/0
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mail.techwiser.in
162.241.123.30
 malicious
api.ipify.org
104.26.12.205

IPs

IP
Domain
Country
Malicious
162.241.123.30
mail.techwiser.in
United States
malicious
104.26.12.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ORDER SPECIFICATION_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3169000
trusted library allocation
page read and write
 malicious
3141000
trusted library allocation
page read and write
 malicious
432E000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
6C00000
trusted library allocation
page read and write
16A0000
trusted library allocation
page read and write
5A0E000
stack
page read and write
5610000
heap
page read and write
49C0000
trusted library allocation
page execute and read and write
5683000
heap
page read and write
138C000
heap
page read and write
16B0000
trusted library allocation
page read and write
5691000
heap
page read and write
45AC000
stack
page read and write
7A0000
heap
page read and write
69CF000
heap
page read and write
574F000
stack
page read and write
6A59000
heap
page read and write
400000
remote allocation
page execute and read and write
77E000
stack
page read and write
4922000
trusted library allocation
page read and write
49A0000
heap
page read and write
4940000
trusted library allocation
page read and write
A47000
trusted library allocation
page execute and read and write
16D7000
trusted library allocation
page execute and read and write
813000
trusted library allocation
page execute and read and write
83BD000
stack
page read and write
2470000
trusted library allocation
page read and write
A4B000
trusted library allocation
page execute and read and write
16D0000
trusted library allocation
page read and write
40000
unkown
page readonly
B00000
trusted library allocation
page execute and read and write
8070000
heap
page read and write
16C0000
trusted library allocation
page read and write
2F6B000
trusted library allocation
page read and write
5750000
heap
page read and write
59CC000
stack
page read and write
4960000
trusted library allocation
page read and write
1331000
heap
page read and write
72B0000
heap
page read and write
1260000
heap
page read and write
7EE000
stack
page read and write
6D67000
trusted library allocation
page read and write
4930000
trusted library allocation
page read and write
6C70000
trusted library allocation
page read and write
554E000
stack
page read and write
BB0000
heap
page read and write
564E000
stack
page read and write
16D2000
trusted library allocation
page read and write
5640000
heap
page execute and read and write
5C0E000
stack
page read and write
70E0000
trusted library allocation
page read and write
491D000
trusted library allocation
page read and write
594E000
stack
page read and write
69F5000
heap
page read and write
937000
heap
page read and write
16BD000
trusted library allocation
page execute and read and write
16DB000
trusted library allocation
page execute and read and write
4C60000
heap
page execute and read and write
2FA0000
heap
page execute and read and write
4B80000
trusted library allocation
page read and write
840000
heap
page read and write
540000
heap
page read and write
2490000
heap
page read and write
830000
trusted library allocation
page read and write
48F4000
trusted library allocation
page read and write
662E000
stack
page read and write
820000
trusted library allocation
page read and write
2FB4000
trusted library allocation
page read and write
59FE000
stack
page read and write
6C60000
trusted library allocation
page execute and read and write
560C000
stack
page read and write
6A7E000
heap
page read and write
34B1000
trusted library allocation
page read and write
48FB000
trusted library allocation
page read and write
49BB000
trusted library allocation
page read and write
4C0E000
stack
page read and write
2F6E000
trusted library allocation
page read and write
823000
trusted library allocation
page read and write
1220000
heap
page read and write
6BF8000
trusted library allocation
page read and write
8DD000
heap
page read and write
2FE0000
heap
page read and write
5B4E000
stack
page read and write
672E000
stack
page read and write
B10000
trusted library allocation
page read and write
A60000
trusted library allocation
page read and write
313D000
trusted library allocation
page read and write
620000
heap
page read and write
5670000
heap
page read and write
2F86000
trusted library allocation
page read and write
4C4E000
stack
page read and write
12C8000
heap
page read and write
AF0000
heap
page execute and read and write
12EA000
heap
page read and write
4CF0000
trusted library section
page read and write
2480000
trusted library allocation
page read and write
6C80000
trusted library allocation
page execute and read and write
528E000
stack
page read and write
817D000
stack
page read and write
4CD1000
trusted library allocation
page read and write
48F0000
trusted library allocation
page read and write
6D1F000
stack
page read and write
901000
heap
page read and write
6BEE000
stack
page read and write
30F1000
trusted library allocation
page read and write
6D60000
trusted library allocation
page read and write
24E6000
trusted library allocation
page read and write
800000
trusted library allocation
page read and write
4158000
trusted library allocation
page read and write
16A4000
trusted library allocation
page read and write
7FD90000
trusted library allocation
page execute and read and write
4CE0000
trusted library allocation
page execute and read and write
2F1E000
stack
page read and write
68AE000
stack
page read and write
1363000
heap
page read and write
4911000
trusted library allocation
page read and write
7110000
heap
page read and write
1D9000
stack
page read and write
106A000
stack
page read and write
4BC0000
heap
page read and write
63EF000
stack
page read and write
40F1000
trusted library allocation
page read and write
134E000
heap
page read and write
4E70000
trusted library allocation
page read and write
312F000
trusted library allocation
page read and write
4B90000
trusted library allocation
page read and write
4119000
trusted library allocation
page read and write
4F7000
stack
page read and write
AAE000
stack
page read and write
24B1000
trusted library allocation
page read and write
490E000
trusted library allocation
page read and write
2F7E000
trusted library allocation
page read and write
5B0E000
stack
page read and write
1310000
heap
page read and write
814000
trusted library allocation
page read and write
BA0000
trusted library allocation
page execute and read and write
16AD000
trusted library allocation
page execute and read and write
12C0000
heap
page read and write
6BF0000
trusted library allocation
page read and write
16C2000
trusted library allocation
page read and write
4935000
trusted library allocation
page read and write
686E000
stack
page read and write
A42000
trusted library allocation
page read and write
1737000
heap
page read and write
1250000
heap
page read and write
6C10000
trusted library allocation
page read and write
317E000
trusted library allocation
page read and write
87F000
heap
page read and write
7C63000
trusted library allocation
page read and write
16C6000
trusted library allocation
page execute and read and write
135C000
heap
page read and write
42000
unkown
page readonly
248F000
trusted library allocation
page read and write
2F7A000
trusted library allocation
page read and write
6C0D000
trusted library allocation
page read and write
2F8D000
trusted library allocation
page read and write
5680000
heap
page read and write
245F000
stack
page read and write
1730000
heap
page read and write
3519000
trusted library allocation
page read and write
867000
heap
page read and write
25CC000
trusted library allocation
page read and write
3F15000
trusted library allocation
page read and write
69AD000
stack
page read and write
49B0000
trusted library allocation
page read and write
7FFE000
stack
page read and write
4B60000
trusted library allocation
page read and write
B20000
trusted library allocation
page read and write
1720000
trusted library allocation
page read and write
4CAE000
stack
page read and write
4E6E000
stack
page read and write
11D0000
heap
page read and write
1169000
stack
page read and write
2493000
heap
page read and write
670000
heap
page read and write
4CC0000
trusted library section
page read and write
2F81000
trusted library allocation
page read and write
A3E000
stack
page read and write
AEB000
stack
page read and write
676E000
stack
page read and write
810000
trusted library allocation
page read and write
8D6000
heap
page read and write
12F4000
heap
page read and write
16D5000
trusted library allocation
page execute and read and write
69B0000
heap
page read and write
1710000
trusted library allocation
page read and write
5AFE000
stack
page read and write
6C17000
trusted library allocation
page read and write
6A73000
heap
page read and write
16F0000
trusted library allocation
page read and write
66E000
stack
page read and write
2F5C000
stack
page read and write
140000
unkown
page readonly
2F72000
trusted library allocation
page read and write
24A0000
heap
page read and write
6C5E000
stack
page read and write
2580000
trusted library allocation
page read and write
2460000
trusted library allocation
page read and write
83D0000
trusted library section
page read and write
6A4D000
heap
page read and write
6AEE000
stack
page read and write
8180000
heap
page read and write
4BA0000
trusted library allocation
page execute and read and write
7120000
trusted library allocation
page execute and read and write
836000
trusted library allocation
page execute and read and write
3E2A000
trusted library allocation
page read and write
6D70000
trusted library allocation
page read and write
85F000
heap
page read and write
1690000
trusted library allocation
page read and write
84A000
heap
page read and write
82D000
trusted library allocation
page execute and read and write
16A3000
trusted library allocation
page execute and read and write
2708000
trusted library allocation
page read and write
12F6000
heap
page read and write
2705000
trusted library allocation
page read and write
5B8E000
stack
page read and write
34B9000
trusted library allocation
page read and write
83A000
trusted library allocation
page execute and read and write
16CA000
trusted library allocation
page execute and read and write
7EFB000
stack
page read and write
4916000
trusted library allocation
page read and write
50F8000
trusted library allocation
page read and write
62EE000
stack
page read and write
2F60000
trusted library allocation
page read and write
30EE000
stack
page read and write
2FB0000
trusted library allocation
page read and write
12DE000
heap
page read and write
6A41000
heap
page read and write
BA7E000
stack
page read and write
806D000
stack
page read and write
81D000
trusted library allocation
page execute and read and write
7F080000
trusted library allocation
page execute and read and write
65EE000
stack
page read and write
1700000
trusted library allocation
page execute and read and write
2FC0000
trusted library allocation
page read and write
837E000
stack
page read and write
3126000
trusted library allocation
page read and write
B6D000
stack
page read and write
3186000
trusted library allocation
page read and write
49B2000
trusted library allocation
page read and write
881000
heap
page read and write
874000
heap
page read and write
4CB0000
trusted library section
page read and write
84E000
heap
page read and write
There are 235 hidden memdumps, click here to show them.