IOC Report
LETTER OF AUTHORIZATION.exe

loading gif

Files

File Path
Type
Category
Malicious
LETTER OF AUTHORIZATION.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LETTER OF AUTHOR_329154322c784dbb2b1b7cad391c25af57eb70_fa2d1c6a_5a9197ca-ebb7-4c17-b016-25b978ac7f2a\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F83.tmp.dmp
Mini DuMP crash report, 16 streams, Sun Jun 30 14:23:53 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3188.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER31B8.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe
"C:\Users\user\Desktop\LETTER OF AUTHORIZATION.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5776 -s 1008

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://upx.sf.net
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
132.226.8.169
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.8.169

IPs

IP
Domain
Country
Malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
132.226.8.169
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS
FileDirectory
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
ProgramId
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
FileId
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
LowerCaseLongPath
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
LongPathHash
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
Name
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
OriginalFileName
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
Publisher
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
Version
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
BinFileVersion
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
BinaryType
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
ProductName
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
ProductVersion
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
LinkDate
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
BinProductVersion
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
AppxPackageFullName
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
AppxPackageRelativeId
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
Size
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
Language
\REGISTRY\A\{93f1a7f6-179e-ef65-0238-fcfbd88be99c}\Root\InventoryApplicationFile\letter of author|23927bf48ec27a40
Usn
There are 23 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
29B1000
trusted library allocation
page read and write
 malicious
11881763000
trusted library allocation
page read and write
 malicious
2B7B000
trusted library allocation
page read and write
 malicious
1189170D000
trusted library allocation
page read and write
 malicious
2AA3000
trusted library allocation
page read and write
27A3000
trusted library allocation
page execute and read and write
11881411000
trusted library allocation
page read and write
3A18000
trusted library allocation
page read and write
7FFD34929000
trusted library allocation
page read and write
6670000
heap
page read and write
65C0000
trusted library allocation
page execute and read and write
118FEED3000
trusted library allocation
page read and write
6586000
trusted library allocation
page read and write
118FEC15000
heap
page read and write
538E000
stack
page read and write
7FFD34780000
trusted library allocation
page read and write
2A8E000
trusted library allocation
page read and write
65D0000
trusted library allocation
page read and write
4ED2000
trusted library allocation
page read and write
2B01000
trusted library allocation
page read and write
EFE000
stack
page read and write
2A58000
trusted library allocation
page read and write
7FFD34950000
trusted library allocation
page read and write
118FECC2000
heap
page read and write
2A60000
trusted library allocation
page read and write
2BE8000
trusted library allocation
page read and write
27DB000
trusted library allocation
page execute and read and write
118FED6A000
heap
page read and write
4EC6000
trusted library allocation
page read and write
7FFD347CC000
trusted library allocation
page execute and read and write
118FEF00000
heap
page read and write
7FFD34820000
trusted library allocation
page read and write
27F0000
trusted library allocation
page read and write
55E0000
trusted library allocation
page read and write
6AF0000
heap
page read and write
65AF000
trusted library allocation
page read and write
7FFD34856000
trusted library allocation
page execute and read and write
29A0000
heap
page execute and read and write
2C71000
trusted library allocation
page read and write
2F0353000
stack
page read and write
118FF2A0000
trusted library section
page read and write
D9E000
stack
page read and write
7FFD34774000
trusted library allocation
page read and write
287D000
stack
page read and write
27A0000
trusted library allocation
page read and write
2F06FF000
stack
page read and write
4F9D000
stack
page read and write
6590000
trusted library allocation
page execute and read and write
DE0000
heap
page read and write
4EB2000
trusted library allocation
page read and write
C8A000
heap
page read and write
2B31000
trusted library allocation
page read and write
2AF1000
trusted library allocation
page read and write
4EBA000
trusted library allocation
page read and write
27D2000
trusted library allocation
page read and write
2C0A000
trusted library allocation
page read and write
2F0DFE000
stack
page read and write
118FECED000
heap
page read and write
27C6000
trusted library allocation
page execute and read and write
62AE000
stack
page read and write
4EE0000
trusted library allocation
page read and write
656F000
stack
page read and write
2C06000
trusted library allocation
page read and write
5050000
heap
page read and write
55F0000
trusted library allocation
page execute and read and write
3A48000
trusted library allocation
page read and write
27D7000
trusted library allocation
page execute and read and write
658B000
trusted library allocation
page read and write
4EA6000
trusted library allocation
page read and write
118FEB10000
heap
page read and write
2A5B000
trusted library allocation
page read and write
6580000
trusted library allocation
page read and write
D21000
heap
page read and write
2AB4000
trusted library allocation
page read and write
118FEEE0000
heap
page execute and read and write
2F0EFD000
stack
page read and write
65A3000
trusted library allocation
page read and write
27B0000
trusted library allocation
page read and write
39B1000
trusted library allocation
page read and write
2B5F000
trusted library allocation
page read and write
657E000
trusted library allocation
page read and write
2B3F000
trusted library allocation
page read and write
2C01000
trusted library allocation
page read and write
FFF000
stack
page read and write
11891417000
trusted library allocation
page read and write
4F10000
trusted library allocation
page read and write
6148000
heap
page read and write
4ECD000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
2F0AFD000
stack
page read and write
2B6D000
trusted library allocation
page read and write
2F07FE000
stack
page read and write
2F08FF000
stack
page read and write
27C0000
trusted library allocation
page read and write
65A0000
trusted library allocation
page read and write
65B0000
trusted library allocation
page execute and read and write
6153000
heap
page read and write
7FFD34830000
trusted library allocation
page execute and read and write
4B4E000
stack
page read and write
DD0000
trusted library allocation
page read and write
4EA0000
trusted library allocation
page read and write
27C2000
trusted library allocation
page read and write
3A3C000
trusted library allocation
page read and write
27A4000
trusted library allocation
page read and write
27AD000
trusted library allocation
page execute and read and write
6179000
heap
page read and write
6570000
trusted library allocation
page read and write
2F0CFF000
stack
page read and write
118FEDB0000
trusted library allocation
page read and write
7FFD3479D000
trusted library allocation
page execute and read and write
118918E1000
trusted library allocation
page read and write
2F0BFE000
stack
page read and write
2B09000
trusted library allocation
page read and write
AF7000
stack
page read and write
7FFD3479B000
trusted library allocation
page execute and read and write
2B16000
trusted library allocation
page read and write
2A76000
trusted library allocation
page read and write
B50000
heap
page read and write
298F000
stack
page read and write
2F09FE000
stack
page read and write
646E000
stack
page read and write
27D0000
trusted library allocation
page read and write
118FED90000
trusted library allocation
page read and write
622E000
stack
page read and write
7FFD34940000
trusted library allocation
page read and write
7FFD34770000
trusted library allocation
page read and write
2880000
heap
page read and write
4F30000
heap
page execute and read and write
642E000
stack
page read and write
2B24000
trusted library allocation
page read and write
7FF405610000
trusted library allocation
page execute and read and write
4EAB000
trusted library allocation
page read and write
2BF7000
trusted library allocation
page read and write
4E90000
trusted library allocation
page read and write
7FFD3495D000
trusted library allocation
page read and write
B75000
heap
page read and write
2AAC000
trusted library allocation
page read and write
7FFD34772000
trusted library allocation
page read and write
DA0000
heap
page read and write
2B05000
trusted library allocation
page read and write
DF0000
heap
page read and write
2AED000
trusted library allocation
page read and write
7FFD34790000
trusted library allocation
page read and write
C96000
heap
page read and write
C68000
heap
page read and write
626E000
stack
page read and write
7FFD34970000
trusted library allocation
page read and write
7FFD34910000
trusted library allocation
page read and write
B70000
heap
page read and write
7FFD34826000
trusted library allocation
page read and write
65AA000
trusted library allocation
page read and write
3A33000
trusted library allocation
page read and write
4EBE000
trusted library allocation
page read and write
63AE000
stack
page read and write
27CA000
trusted library allocation
page execute and read and write
7FFD3482C000
trusted library allocation
page execute and read and write
7FFD34930000
trusted library allocation
page read and write
118FEA80000
unkown
page readonly
118FECF4000
heap
page read and write
B00000
heap
page read and write
11881440000
trusted library allocation
page read and write
27D5000
trusted library allocation
page execute and read and write
2B5B000
trusted library allocation
page read and write
27BD000
trusted library allocation
page execute and read and write
D4F000
heap
page read and write
118FECAB000
heap
page read and write
11891411000
trusted library allocation
page read and write
4EAE000
trusted library allocation
page read and write
118FEC40000
heap
page read and write
2990000
trusted library allocation
page execute and read and write
616C000
heap
page read and write
5043000
heap
page read and write
2C34000
trusted library allocation
page read and write
2AF5000
trusted library allocation
page read and write
6690000
trusted library allocation
page execute and read and write
118FEA82000
unkown
page readonly
2BE3000
trusted library allocation
page read and write
7FFD34924000
trusted library allocation
page read and write
118FEF05000
heap
page read and write
118FEC80000
heap
page read and write
2C2E000
trusted library allocation
page read and write
2A63000
trusted library allocation
page read and write
6640000
trusted library allocation
page read and write
799000
stack
page read and write
615C000
heap
page read and write
283E000
stack
page read and write
2AB0000
trusted library allocation
page read and write
6588000
trusted library allocation
page read and write
118FEC8C000
heap
page read and write
65E0000
trusted library allocation
page read and write
2C40000
trusted library allocation
page read and write
2AF9000
trusted library allocation
page read and write
C60000
heap
page read and write
CC5000
heap
page read and write
4EF0000
trusted library allocation
page read and write
118FECC0000
heap
page read and write
7FFD3478D000
trusted library allocation
page execute and read and write
7FFD34794000
trusted library allocation
page read and write
7FFD34773000
trusted library allocation
page execute and read and write
60F0000
heap
page read and write
60EE000
stack
page read and write
118FF480000
trusted library allocation
page read and write
118FEC20000
heap
page read and write
2AFD000
trusted library allocation
page read and write
2C3A000
trusted library allocation
page read and write
118FF440000
heap
page read and write
7FFD34920000
trusted library allocation
page read and write
39D9000
trusted library allocation
page read and write
5040000
heap
page read and write
118FF3E0000
heap
page execute and read and write
7FFD34960000
trusted library allocation
page execute and read and write
2BEE000
trusted library allocation
page read and write
4EC1000
trusted library allocation
page read and write
7FFD34782000
trusted library allocation
page read and write
63EE000
stack
page read and write
118FEED0000
trusted library allocation
page read and write
7FFD34890000
trusted library allocation
page execute and read and write
118FEBF0000
heap
page read and write
5FEE000
stack
page read and write
B4E000
stack
page read and write
118FECEB000
heap
page read and write
118FEC10000
heap
page read and write
118FFB10000
heap
page read and write
7FFD3477D000
trusted library allocation
page execute and read and write
There are 215 hidden memdumps, click here to show them.