IOC Report
new order.exe

loading gif

Files

File Path
Type
Category
Malicious
new order.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_new order.exe_a0ae4b577917af373f82f0f155e6f5f1b3b83e3_63337e3c_36ee73ac-12c9-4d51-9463-803eac033cd6\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER97D0.tmp.dmp
Mini DuMP crash report, 16 streams, Sun Jun 30 14:35:56 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9967.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B1D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\new order.exe
"C:\Users\user\Desktop\new order.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3696 -s 1052

URLs

Name
IP
Malicious
http://checkip.dyndns.org/
158.101.44.242
 malicious
https://reallyfreegeoip.org
unknown
http://upx.sf.net
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.orgp
unknown
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
checkip.dyndns.com
158.101.44.242
 malicious
checkip.dyndns.org
unknown
 malicious
bg.microsoft.map.fastly.net
199.232.214.172
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
158.101.44.242
checkip.dyndns.com
United States
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
ProgramId
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
FileId
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
LowerCaseLongPath
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
LongPathHash
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
Name
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
OriginalFileName
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
Publisher
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
Version
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
BinFileVersion
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
BinaryType
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
ProductName
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
ProductVersion
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
LinkDate
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
BinProductVersion
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
AppxPackageFullName
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
AppxPackageRelativeId
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
Size
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
Language
 malicious
\REGISTRY\A\{0919df55-860a-04c8-49bc-e8e3d05f1caa}\Root\InventoryApplicationFile\new order.exe|d7407e4c24a219de
Usn
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
FileDirectory
There are 23 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2EF1000
trusted library allocation
page read and write
 malicious
30B4000
trusted library allocation
page read and write
 malicious
1F69F237000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
1F6AF0BA000
trusted library allocation
page read and write
 malicious
2FB8000
trusted library allocation
page read and write
1F69D150000
heap
page read and write
655D000
stack
page read and write
2FF6000
trusted library allocation
page read and write
1266000
trusted library allocation
page execute and read and write
14DE000
stack
page read and write
136C000
heap
page read and write
2FFA000
trusted library allocation
page read and write
7FFD9B920000
trusted library allocation
page read and write
1540000
heap
page read and write
303B000
trusted library allocation
page read and write
7FFD9B7AB000
trusted library allocation
page execute and read and write
51390FE000
stack
page read and write
51394FE000
stack
page read and write
1F6B6F20000
trusted library allocation
page read and write
14E0000
trusted library allocation
page execute and read and write
2FA0000
trusted library allocation
page read and write
107E000
stack
page read and write
671E000
stack
page read and write
68CA000
trusted library allocation
page read and write
7FFD9B930000
trusted library allocation
page read and write
535D000
trusted library allocation
page read and write
5A2E000
trusted library allocation
page read and write
1244000
trusted library allocation
page read and write
7FFD9B96D000
trusted library allocation
page read and write
1F69D1D3000
trusted library allocation
page read and write
1F69D27D000
heap
page read and write
68D0000
trusted library allocation
page execute and read and write
5138CF3000
stack
page read and write
12A8000
heap
page read and write
2DD0000
heap
page read and write
314F000
trusted library allocation
page read and write
51395FD000
stack
page read and write
68A0000
trusted library allocation
page read and write
1F69D030000
heap
page read and write
3F7E000
trusted library allocation
page read and write
56FD000
stack
page read and write
4FEE000
stack
page read and write
68CF000
trusted library allocation
page read and write
1F69D420000
heap
page read and write
7FFD9B7A4000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
5138EFE000
stack
page read and write
68F0000
trusted library allocation
page read and write
5370000
heap
page read and write
1F69D2E7000
heap
page read and write
1F69D130000
heap
page read and write
7FFD9B940000
trusted library allocation
page read and write
11DF000
stack
page read and write
1470000
trusted library allocation
page read and write
3172000
trusted library allocation
page read and write
7FFD9B960000
trusted library allocation
page read and write
10BE000
stack
page read and write
1F69D410000
heap
page read and write
7FFD9B790000
trusted library allocation
page read and write
7FFD9B970000
trusted library allocation
page execute and read and write
1F69D216000
heap
page read and write
1472000
trusted library allocation
page read and write
1F69CFA0000
unkown
page readonly
3F5A000
trusted library allocation
page read and write
7FFD9B780000
trusted library allocation
page read and write
1F69ED59000
heap
page read and write
1F69EEE0000
heap
page execute and read and write
2FA3000
trusted library allocation
page read and write
1F69EEF1000
trusted library allocation
page read and write
7FFD9B866000
trusted library allocation
page execute and read and write
7FFD9B836000
trusted library allocation
page read and write
1F69D27B000
heap
page read and write
2FE8000
trusted library allocation
page read and write
1520000
trusted library allocation
page read and write
304F000
trusted library allocation
page read and write
1500000
heap
page read and write
2EE0000
heap
page execute and read and write
3078000
trusted library allocation
page read and write
6DB0000
heap
page read and write
1F69EFCB000
trusted library allocation
page read and write
7FF454570000
trusted library allocation
page execute and read and write
51393FE000
stack
page read and write
3F81000
trusted library allocation
page read and write
1F69D485000
heap
page read and write
1F69D480000
heap
page read and write
7FFD9B83C000
trusted library allocation
page execute and read and write
1477000
trusted library allocation
page execute and read and write
30A6000
trusted library allocation
page read and write
3F74000
trusted library allocation
page read and write
1243000
trusted library allocation
page execute and read and write
5520000
trusted library allocation
page read and write
2FEA000
trusted library allocation
page read and write
1F69D1A0000
trusted library allocation
page read and write
7FFD9B840000
trusted library allocation
page execute and read and write
659E000
stack
page read and write
10C0000
heap
page read and write
1260000
trusted library allocation
page read and write
125D000
trusted library allocation
page execute and read and write
5356000
trusted library allocation
page read and write
651E000
stack
page read and write
1F69ED50000
heap
page read and write
3128000
trusted library allocation
page read and write
7FFD9B934000
trusted library allocation
page read and write
3F8A000
trusted library allocation
page read and write
3146000
trusted library allocation
page read and write
2DCE000
stack
page read and write
1F69D415000
heap
page read and write
641E000
stack
page read and write
313C000
trusted library allocation
page read and write
7FFD9B7AD000
trusted library allocation
page execute and read and write
317E000
trusted library allocation
page read and write
7FFD9B7A0000
trusted library allocation
page read and write
314A000
trusted library allocation
page read and write
1262000
trusted library allocation
page read and write
2FD3000
trusted library allocation
page read and write
56B0000
heap
page execute and read and write
1F69D310000
trusted library section
page read and write
2FFE000
trusted library allocation
page read and write
679E000
stack
page read and write
303F000
trusted library allocation
page read and write
2FF2000
trusted library allocation
page read and write
124D000
trusted library allocation
page execute and read and write
12DA000
heap
page read and write
1F6AEEF1000
trusted library allocation
page read and write
5473000
heap
page read and write
65DE000
stack
page read and write
306A000
trusted library allocation
page read and write
133E000
heap
page read and write
3EF1000
trusted library allocation
page read and write
10D0000
heap
page read and write
68AB000
trusted library allocation
page read and write
7FFD9B784000
trusted library allocation
page read and write
1F69D250000
heap
page read and write
30A1000
trusted library allocation
page read and write
6990000
heap
page read and write
5351000
trusted library allocation
page read and write
129A000
heap
page read and write
2F9B000
trusted library allocation
page read and write
62E0000
heap
page read and write
68A6000
trusted library allocation
page read and write
3133000
trusted library allocation
page read and write
5362000
trusted library allocation
page read and write
1336000
heap
page read and write
1230000
trusted library allocation
page read and write
533B000
trusted library allocation
page read and write
1490000
trusted library allocation
page read and write
7FFD9B939000
trusted library allocation
page read and write
7FFD9B950000
trusted library allocation
page read and write
675E000
stack
page read and write
7FFD9B78D000
trusted library allocation
page execute and read and write
3179000
trusted library allocation
page read and write
1F69D1D0000
trusted library allocation
page read and write
14F0000
trusted library allocation
page read and write
6900000
trusted library allocation
page read and write
305D000
trusted library allocation
page read and write
51392FE000
stack
page read and write
312C000
trusted library allocation
page read and write
5138DFE000
stack
page read and write
1F69D210000
heap
page read and write
1F69D21C000
heap
page read and write
BFA000
stack
page read and write
2EDF000
stack
page read and write
7FFD9B792000
trusted library allocation
page read and write
7FFD9B783000
trusted library allocation
page execute and read and write
5470000
heap
page read and write
7FFD9B980000
trusted library allocation
page read and write
51391FC000
stack
page read and write
69B0000
trusted library allocation
page execute and read and write
1F69ED60000
heap
page read and write
7FFD9B7DC000
trusted library allocation
page execute and read and write
7FFD9B830000
trusted library allocation
page read and write
1510000
trusted library allocation
page read and write
1F6AEEF7000
trusted library allocation
page read and write
6366000
heap
page read and write
1250000
trusted library allocation
page read and write
1F69D1C0000
trusted library allocation
page read and write
7FFD9B782000
trusted library allocation
page read and write
146F000
stack
page read and write
66DE000
stack
page read and write
2FA8000
trusted library allocation
page read and write
3184000
trusted library allocation
page read and write
7FFD9B79D000
trusted library allocation
page execute and read and write
57FE000
stack
page read and write
1270000
heap
page read and write
7FFD9B8A0000
trusted library allocation
page execute and read and write
3043000
trusted library allocation
page read and write
1F69D110000
heap
page read and write
533E000
trusted library allocation
page read and write
5138FFE000
stack
page read and write
68C3000
trusted library allocation
page read and write
147B000
trusted library allocation
page execute and read and write
3047000
trusted library allocation
page read and write
5A10000
trusted library allocation
page execute and read and write
534E000
trusted library allocation
page read and write
689F000
stack
page read and write
2FBB000
trusted library allocation
page read and write
F60000
heap
page read and write
EF7000
stack
page read and write
68E0000
trusted library allocation
page execute and read and write
68C0000
trusted library allocation
page read and write
304B000
trusted library allocation
page read and write
3F19000
trusted library allocation
page read and write
1475000
trusted library allocation
page execute and read and write
5336000
trusted library allocation
page read and write
1F69D253000
heap
page read and write
534A000
trusted library allocation
page read and write
1278000
heap
page read and write
1240000
trusted library allocation
page read and write
68B0000
trusted library allocation
page execute and read and write
6960000
trusted library allocation
page read and write
1F6AF28F000
trusted library allocation
page read and write
3037000
trusted library allocation
page read and write
68A8000
trusted library allocation
page read and write
1F69EE60000
heap
page execute and read and write
10D5000
heap
page read and write
633D000
heap
page read and write
1F69D286000
heap
page read and write
1F69EF20000
trusted library allocation
page read and write
126A000
trusted library allocation
page execute and read and write
5A00000
trusted library allocation
page read and write
1F69CFA2000
unkown
page readonly
1F69D23B000
heap
page read and write
5330000
trusted library allocation
page read and write
5A20000
trusted library allocation
page read and write
11F0000
heap
page read and write
There are 216 hidden memdumps, click here to show them.