IOC Report
Orden de compra HO-PO-376-25.exe

loading gif

Files

File Path
Type
Category
Malicious
Orden de compra HO-PO-376-25.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Orden de compra HO-PO-376-25.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Orden de compra HO-PO-376-25.exe
"C:\Users\user\Desktop\Orden de compra HO-PO-376-25.exe"
 malicious
C:\Users\user\Desktop\Orden de compra HO-PO-376-25.exe
"C:\Users\user\Desktop\Orden de compra HO-PO-376-25.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ftp.gizemetiket.com.tr
unknown
http://tempuri.org/DataSet1.xsd
unknown

Domains

Name
IP
Malicious
ftp.gizemetiket.com.tr
93.89.225.40
 malicious
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
93.89.225.40
ftp.gizemetiket.com.tr
Turkey
malicious
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Orden de compra HO-PO-376-25_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
5AE0000
trusted library section
page read and write
 malicious
2CC1000
trusted library allocation
page read and write
 malicious
2CEC000
trusted library allocation
page read and write
 malicious
4081000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
64FC000
heap
page read and write
120B000
trusted library allocation
page execute and read and write
61BD000
stack
page read and write
1473000
trusted library allocation
page execute and read and write
A32E000
stack
page read and write
68E0000
trusted library allocation
page read and write
5586000
trusted library allocation
page read and write
11D0000
heap
page read and write
6050000
trusted library allocation
page read and write
1783000
heap
page read and write
12B0000
trusted library allocation
page read and write
1496000
trusted library allocation
page execute and read and write
12AF000
heap
page read and write
7B00000
heap
page read and write
55A0000
trusted library allocation
page read and write
64E3000
heap
page read and write
13F66000
trusted library allocation
page read and write
72C0000
heap
page read and write
56E0000
trusted library allocation
page execute and read and write
671E000
stack
page read and write
11C0000
heap
page read and write
A46E000
stack
page read and write
30C6000
trusted library allocation
page read and write
58EE000
stack
page read and write
CE0000
unkown
page readonly
76F0000
trusted library allocation
page execute and read and write
3081000
trusted library allocation
page read and write
EC3000
trusted library allocation
page execute and read and write
11A0000
heap
page read and write
BD6E000
trusted library allocation
page read and write
126E000
stack
page read and write
EF8000
heap
page read and write
2B7E000
stack
page read and write
73D0000
trusted library allocation
page read and write
6887000
trusted library allocation
page read and write
2D5D000
trusted library allocation
page read and write
64E0000
heap
page read and write
149A000
trusted library allocation
page execute and read and write
2CEA000
trusted library allocation
page read and write
74EFF000
unkown
page readonly
D60000
heap
page read and write
17C7000
heap
page read and write
635E000
unkown
page read and write
1474000
trusted library allocation
page read and write
1780000
heap
page read and write
3C99000
trusted library allocation
page read and write
13F69000
trusted library allocation
page read and write
F19000
heap
page read and write
72CE000
heap
page read and write
5270000
heap
page execute and read and write
50BB000
trusted library allocation
page read and write
1790000
trusted library allocation
page read and write
A22E000
stack
page read and write
521B000
stack
page read and write
557E000
trusted library allocation
page read and write
5560000
trusted library allocation
page read and write
2CA6000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
50B0000
trusted library allocation
page read and write
2D00000
trusted library allocation
page read and write
6E7C000
stack
page read and write
1217000
heap
page read and write
55B0000
trusted library allocation
page read and write
7090000
trusted library allocation
page read and write
53FC000
stack
page read and write
1770000
trusted library allocation
page execute and read and write
60F7000
heap
page read and write
16B2000
trusted library allocation
page read and write
5100000
trusted library allocation
page read and write
311C000
trusted library allocation
page read and write
12A0000
heap
page execute and read and write
5690000
heap
page read and write
7C00000
trusted library allocation
page read and write
ECD000
trusted library allocation
page execute and read and write
5720000
trusted library allocation
page read and write
50C2000
trusted library allocation
page read and write
5130000
heap
page read and write
EE6000
trusted library allocation
page execute and read and write
54FC000
stack
page read and write
5A55000
heap
page read and write
68D0000
trusted library allocation
page read and write
3C71000
trusted library allocation
page read and write
6B8C000
stack
page read and write
10EC000
stack
page read and write
625E000
stack
page read and write
50D1000
trusted library allocation
page read and write
68CD000
stack
page read and write
12D0000
heap
page read and write
5730000
trusted library section
page readonly
EB0000
trusted library allocation
page read and write
5D9C000
stack
page read and write
554E000
stack
page read and write
55A5000
trusted library allocation
page read and write
F9A000
heap
page read and write
7AFE000
stack
page read and write
3CD7000
trusted library allocation
page read and write
16BB000
trusted library allocation
page execute and read and write
6F8C000
stack
page read and write
5630000
trusted library allocation
page read and write
56E0000
trusted library allocation
page read and write
148D000
trusted library allocation
page execute and read and write
5750000
heap
page execute and read and write
5564000
trusted library allocation
page read and write
EF0000
heap
page read and write
789E000
stack
page read and write
5A50000
heap
page read and write
567C000
stack
page read and write
2C5C000
stack
page read and write
1492000
trusted library allocation
page read and write
10F7000
heap
page read and write
588B000
stack
page read and write
11FB000
heap
page read and write
5740000
heap
page read and write
6532000
heap
page read and write
5581000
trusted library allocation
page read and write
16AE000
stack
page read and write
4D6E000
stack
page read and write
2B88000
trusted library allocation
page read and write
7F90000
heap
page read and write
5620000
heap
page read and write
13F6E000
trusted library allocation
page read and write
5592000
trusted library allocation
page read and write
69E0000
trusted library allocation
page execute and read and write
1202000
trusted library allocation
page read and write
3070000
heap
page execute and read and write
74EE1000
unkown
page execute read
1287000
heap
page read and write
657F000
heap
page read and write
2C71000
trusted library allocation
page read and write
D00000
heap
page read and write
73E0000
trusted library allocation
page execute and read and write
EE2000
trusted library allocation
page read and write
747E000
stack
page read and write
171E000
stack
page read and write
D92000
unkown
page readonly
F23000
heap
page read and write
7F66000
trusted library allocation
page read and write
5FE0000
trusted library allocation
page read and write
1490000
trusted library allocation
page read and write
A4AE000
stack
page read and write
50D6000
trusted library allocation
page read and write
6C0E000
stack
page read and write
74EF6000
unkown
page readonly
685E000
stack
page read and write
7F890000
trusted library allocation
page execute and read and write
147D000
trusted library allocation
page execute and read and write
5EDB000
stack
page read and write
68F0000
trusted library allocation
page execute and read and write
F6D000
heap
page read and write
6E80000
heap
page read and write
6C40000
heap
page read and write
17B0000
trusted library allocation
page read and write
68D6000
trusted library allocation
page read and write
11C5000
heap
page read and write
661E000
stack
page read and write
1200000
trusted library allocation
page read and write
EC4000
trusted library allocation
page read and write
DB5E000
trusted library allocation
page read and write
1480000
trusted library allocation
page read and write
687D000
trusted library allocation
page read and write
74EE0000
unkown
page readonly
A5AE000
stack
page read and write
61D0000
heap
page read and write
50F4000
trusted library allocation
page read and write
143E000
stack
page read and write
EE0000
trusted library allocation
page read and write
6BCE000
stack
page read and write
5DA9000
heap
page read and write
D50000
heap
page read and write
14A0000
heap
page read and write
15AF000
stack
page read and write
E7C000
stack
page read and write
7430000
trusted library allocation
page read and write
175B000
stack
page read and write
7F6E000
trusted library allocation
page read and write
5DA0000
heap
page read and write
50E2000
trusted library allocation
page read and write
74EFD000
unkown
page read and write
2D02000
trusted library allocation
page read and write
5890000
heap
page read and write
50F0000
trusted library allocation
page read and write
6C60000
trusted library allocation
page execute and read and write
79BF000
stack
page read and write
563B000
trusted library allocation
page read and write
7420000
trusted library allocation
page read and write
50BE000
trusted library allocation
page read and write
A36E000
stack
page read and write
1207000
trusted library allocation
page execute and read and write
50DD000
trusted library allocation
page read and write
2D5B000
trusted library allocation
page read and write
61C0000
heap
page read and write
FA5000
heap
page read and write
69D0000
trusted library allocation
page read and write
7FA0000
heap
page read and write
CE2000
unkown
page readonly
603B000
stack
page read and write
A1EE000
stack
page read and write
1270000
heap
page read and write
76DD000
stack
page read and write
11FE000
heap
page read and write
30CF000
trusted library allocation
page read and write
EDD000
trusted library allocation
page execute and read and write
56F0000
trusted library allocation
page read and write
16D0000
trusted library allocation
page read and write
1230000
heap
page read and write
1137000
stack
page read and write
615D000
stack
page read and write
60DC000
stack
page read and write
5088000
trusted library allocation
page read and write
5632000
trusted library allocation
page read and write
74EFD000
unkown
page read and write
6040000
trusted library allocation
page read and write
73C0000
trusted library allocation
page execute and read and write
1760000
heap
page read and write
5B00000
trusted library allocation
page read and write
99A000
stack
page read and write
675E000
stack
page read and write
558D000
trusted library allocation
page read and write
56E9000
trusted library allocation
page read and write
1205000
trusted library allocation
page execute and read and write
2CE8000
trusted library allocation
page read and write
FA2000
heap
page read and write
6880000
trusted library allocation
page read and write
79FE000
stack
page read and write
5140000
heap
page read and write
556B000
trusted library allocation
page read and write
7EEB0000
trusted library allocation
page execute and read and write
5260000
heap
page read and write
5134000
heap
page read and write
1232000
heap
page read and write
EC0000
trusted library allocation
page read and write
1290000
trusted library allocation
page execute and read and write
60F0000
heap
page read and write
1220000
trusted library allocation
page read and write
1190000
heap
page read and write
13FE000
stack
page read and write
12D7000
heap
page read and write
7436000
trusted library allocation
page read and write
16B7000
trusted library allocation
page execute and read and write
BD69000
trusted library allocation
page read and write
6C50000
heap
page read and write
708D000
stack
page read and write
1470000
trusted library allocation
page read and write
2C60000
heap
page read and write
D66000
heap
page read and write
5FDD000
stack
page read and write
BD66000
trusted library allocation
page read and write
1224000
heap
page read and write
654D000
heap
page read and write
17A0000
trusted library allocation
page read and write
EEA000
trusted library allocation
page execute and read and write
10F0000
heap
page read and write
103A000
stack
page read and write
6870000
trusted library allocation
page read and write
11F0000
heap
page read and write
2CAF000
trusted library allocation
page read and write
306F000
stack
page read and write
2CF2000
trusted library allocation
page read and write
16B0000
trusted library allocation
page read and write
F26000
heap
page read and write
7720000
trusted library section
page read and write
D4C000
stack
page read and write
11FC000
stack
page read and write
58A0000
trusted library allocation
page execute and read and write
F8F000
heap
page read and write
50CE000
trusted library allocation
page read and write
55D0000
trusted library allocation
page read and write
5610000
heap
page read and write
2CBD000
trusted library allocation
page read and write
7F69000
trusted library allocation
page read and write
1460000
trusted library allocation
page read and write
ED0000
trusted library allocation
page read and write
CF8000
stack
page read and write
17C0000
heap
page read and write
698E000
stack
page read and write
12C0000
trusted library allocation
page read and write
6C30000
trusted library allocation
page read and write
There are 272 hidden memdumps, click here to show them.