IOC Report
URGENT ORDER.exe

loading gif

Files

File Path
Type
Category
Malicious
URGENT ORDER.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\URGENT ORDER.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\URGENT ORDER.exe
"C:\Users\user\Desktop\URGENT ORDER.exe"
 malicious

URLs

Name
IP
Malicious
http://www.google.com
unknown
http://www.google.com/t
unknown
http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgRmgZjcGLPerbEGIjDUAttsuaejjF-8
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.google.comd
unknown
https://csp.withgoogle.com/csp/gws/other-hp
unknown
https://www.google.com/recaptcha/api.js
unknown
http://www.google.com/
142.250.217.196

Domains

Name
IP
Malicious
www.google.com
142.250.217.196

IPs

IP
Domain
Country
Malicious
142.250.217.196
www.google.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\URGENT ORDER_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
5E9E000
stack
page read and write
1550000
heap
page read and write
1060000
unkown
page execute read
32C0000
trusted library allocation
page read and write
1517000
trusted library allocation
page execute and read and write
18CC000
stack
page read and write
43B5000
trusted library allocation
page read and write
15FE000
heap
page read and write
11DE000
stack
page read and write
15F0000
heap
page read and write
1680000
heap
page read and write
1B90000
heap
page read and write
F40000
heap
page read and write
14E3000
trusted library allocation
page execute and read and write
6DCE000
stack
page read and write
3428000
trusted library allocation
page read and write
1077000
unkown
page execute read
F50000
heap
page read and write
15A0000
trusted library allocation
page read and write
1530000
trusted library allocation
page read and write
342F000
trusted library allocation
page read and write
1052000
unkown
page execute read
15B0000
trusted library allocation
page read and write
32CE000
trusted library allocation
page read and write
340F000
trusted library allocation
page read and write
6968000
heap
page read and write
660E000
stack
page read and write
FB0000
heap
page read and write
43B1000
trusted library allocation
page read and write
32E5000
trusted library allocation
page read and write
3412000
trusted library allocation
page read and write
15E0000
trusted library allocation
page read and write
1098000
unkown
page readonly
694E000
stack
page read and write
1055000
unkown
page execute read
106C000
unkown
page execute read
32B6000
trusted library allocation
page read and write
15F9000
heap
page read and write
105B000
unkown
page execute read
5D9F000
stack
page read and write
32AE000
stack
page read and write
14ED000
trusted library allocation
page execute and read and write
33B1000
trusted library allocation
page read and write
1066000
unkown
page execute read
1506000
trusted library allocation
page execute and read and write
5B2E000
stack
page read and write
341B000
trusted library allocation
page read and write
1500000
trusted library allocation
page read and write
54AE000
stack
page read and write
5B90000
heap
page execute and read and write
680F000
stack
page read and write
5B6D000
stack
page read and write
18D0000
trusted library allocation
page read and write
340A000
trusted library allocation
page read and write
14E0000
trusted library allocation
page read and write
FD2000
unkown
page execute read
670E000
stack
page read and write
14F0000
trusted library allocation
page read and write
6A8E000
stack
page read and write
18E0000
heap
page read and write
6CCE000
stack
page read and write
1555000
heap
page read and write
EEB000
stack
page read and write
3418000
trusted library allocation
page read and write
1626000
heap
page read and write
1510000
trusted library allocation
page read and write
5F1E000
stack
page read and write
14E4000
trusted library allocation
page read and write
1044000
unkown
page execute read
6B0E000
stack
page read and write
15C0000
trusted library allocation
page read and write
6C8F000
stack
page read and write
3407000
trusted library allocation
page read and write
F9E000
stack
page read and write
17EE000
stack
page read and write
15D0000
heap
page read and write
1198000
stack
page read and write
59A0000
heap
page read and write
150A000
trusted library allocation
page execute and read and write
33A0000
heap
page execute and read and write
FD0000
unkown
page readonly
32F0000
trusted library allocation
page read and write
151B000
trusted library allocation
page execute and read and write
14D0000
trusted library allocation
page read and write
32C4000
trusted library allocation
page read and write
32BB000
trusted library allocation
page read and write
159E000
stack
page read and write
15B6000
trusted library allocation
page read and write
596E000
stack
page read and write
6ACF000
stack
page read and write
103E000
unkown
page execute read
32D1000
trusted library allocation
page read and write
FD2000
unkown
page execute read
5C9E000
stack
page read and write
1540000
trusted library allocation
page execute and read and write
1639000
heap
page read and write
1038000
unkown
page execute read
6950000
heap
page read and write
19EE000
stack
page read and write
1072000
unkown
page execute read
32B4000
trusted library allocation
page read and write
15E5000
trusted library allocation
page read and write
6C4E000
stack
page read and write
1B80000
trusted library allocation
page read and write
5EDE000
stack
page read and write
15C9000
trusted library allocation
page read and write
684D000
stack
page read and write
6C0F000
stack
page read and write
107D000
unkown
page execute read
16A6000
heap
page read and write
5F5E000
stack
page read and write
6992000
heap
page read and write
There are 102 hidden memdumps, click here to show them.