IOC Report
Order Details.exe

loading gif

Files

File Path
Type
Category
Malicious
Order Details.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order Details.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Order Details.exe
"C:\Users\user\Desktop\Order Details.exe"
 malicious
C:\Users\user\Desktop\Order Details.exe
"C:\Users\user\Desktop\Order Details.exe"
 malicious

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
193.122.6.168
https://reallyfreegeoip.org/xml/8.46.123.189
104.21.32.1
http://checkip.dyndns.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
https://reallyfreegeoip.org/xml/8.46.123.189$
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown

Domains

Name
IP
Malicious
reallyfreegeoip.org
104.21.32.1
checkip.dyndns.com
193.122.6.168
checkip.dyndns.org
unknown

IPs

IP
Domain
Country
Malicious
104.21.32.1
reallyfreegeoip.org
United States
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Order Details_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
3351000
trusted library allocation
page read and write
 malicious
3986000
trusted library allocation
page read and write
 malicious
351C000
trusted library allocation
page read and write
 malicious
3240000
heap
page read and write
54FF000
stack
page read and write
334E000
stack
page read and write
70B0000
trusted library allocation
page execute and read and write
579B000
trusted library allocation
page read and write
7060000
trusted library allocation
page read and write
16E0000
trusted library allocation
page read and write
13E0000
heap
page read and write
5EC0000
trusted library allocation
page read and write
5E9F000
stack
page read and write
5AF0000
heap
page execute and read and write
400000
remote allocation
page execute and read and write
17DF000
heap
page read and write
6F90000
trusted library allocation
page read and write
57BD000
trusted library allocation
page read and write
4E30000
trusted library allocation
page read and write
6E0E000
stack
page read and write
6F9E000
trusted library allocation
page read and write
3495000
trusted library allocation
page read and write
34E0000
trusted library allocation
page read and write
43D3000
trusted library allocation
page read and write
D92000
heap
page read and write
CF0000
trusted library allocation
page read and write
D78000
heap
page read and write
3234000
trusted library allocation
page read and write
A20000
heap
page read and write
F4F000
stack
page read and write
4A7E000
stack
page read and write
3591000
trusted library allocation
page read and write
6FC3000
trusted library allocation
page read and write
7000000
trusted library allocation
page read and write
16BD000
trusted library allocation
page execute and read and write
6E8E000
stack
page read and write
5044000
trusted library allocation
page read and write
2790000
heap
page read and write
5D3F000
stack
page read and write
5796000
trusted library allocation
page read and write
6FCA000
trusted library allocation
page read and write
16E5000
trusted library allocation
page execute and read and write
38E5000
trusted library allocation
page read and write
6E4E000
stack
page read and write
5920000
heap
page read and write
344D000
trusted library allocation
page read and write
35D7000
trusted library allocation
page read and write
27C0000
trusted library allocation
page read and write
195E000
stack
page read and write
B5D000
stack
page read and write
50D0000
trusted library section
page read and write
DF1000
heap
page read and write
6B56000
heap
page read and write
127A000
stack
page read and write
6C4D000
stack
page read and write
169E000
stack
page read and write
34A9000
trusted library allocation
page read and write
4FF0000
trusted library section
page read and write
CE0000
trusted library allocation
page read and write
3416000
trusted library allocation
page read and write
3443000
trusted library allocation
page read and write
16B0000
trusted library allocation
page read and write
3984000
trusted library allocation
page read and write
16D0000
trusted library allocation
page read and write
6FE0000
trusted library allocation
page execute and read and write
6F8E000
stack
page read and write
16E7000
trusted library allocation
page execute and read and write
19A0000
trusted library allocation
page execute and read and write
5D9E000
stack
page read and write
3401000
trusted library allocation
page read and write
1726000
heap
page read and write
5790000
trusted library allocation
page read and write
E30000
heap
page read and write
350E000
trusted library allocation
page read and write
579E000
trusted library allocation
page read and write
28E1000
trusted library allocation
page read and write
D2A000
trusted library allocation
page execute and read and write
4351000
trusted library allocation
page read and write
6A0E000
stack
page read and write
7B7000
stack
page read and write
3445000
trusted library allocation
page read and write
D00000
trusted library allocation
page read and write
57B1000
trusted library allocation
page read and write
6BB000
stack
page read and write
5ED0000
trusted library allocation
page execute and read and write
35A4000
trusted library allocation
page read and write
43B8000
trusted library allocation
page read and write
6FC0000
trusted library allocation
page read and write
D50000
heap
page read and write
34FF000
trusted library allocation
page read and write
35A8000
trusted library allocation
page read and write
34FB000
trusted library allocation
page read and write
277D000
stack
page read and write
27B0000
trusted library allocation
page execute and read and write
342E000
trusted library allocation
page read and write
5080000
trusted library allocation
page read and write
16B3000
trusted library allocation
page execute and read and write
16EB000
trusted library allocation
page execute and read and write
16E2000
trusted library allocation
page read and write
4E90000
trusted library allocation
page read and write
16F0000
heap
page read and write
34B6000
trusted library allocation
page read and write
3451000
trusted library allocation
page read and write
14C0000
heap
page read and write
50C0000
trusted library allocation
page read and write
6FAB000
trusted library allocation
page read and write
CF3000
trusted library allocation
page execute and read and write
26F0000
trusted library allocation
page read and write
19B0000
trusted library allocation
page read and write
D37000
trusted library allocation
page execute and read and write
1910000
heap
page execute and read and write
509E000
trusted library allocation
page read and write
4EA0000
trusted library allocation
page read and write
6C8E000
stack
page read and write
6CCE000
stack
page read and write
3491000
trusted library allocation
page read and write
153E000
stack
page read and write
5066000
trusted library allocation
page read and write
51FE000
stack
page read and write
5090000
trusted library allocation
page read and write
504B000
trusted library allocation
page read and write
524E000
stack
page read and write
34A5000
trusted library allocation
page read and write
170E000
heap
page read and write
553E000
stack
page read and write
50C5000
trusted library allocation
page read and write
1773000
heap
page read and write
3459000
trusted library allocation
page read and write
3407000
trusted library allocation
page read and write
16A0000
trusted library allocation
page read and write
38E1000
trusted library allocation
page read and write
1900000
trusted library allocation
page read and write
57AE000
trusted library allocation
page read and write
43E9000
trusted library allocation
page read and write
16B4000
trusted library allocation
page read and write
5061000
trusted library allocation
page read and write
35E2000
trusted library allocation
page read and write
505E000
trusted library allocation
page read and write
1719000
heap
page read and write
4379000
trusted library allocation
page read and write
5040000
trusted library allocation
page read and write
D10000
heap
page read and write
4E8E000
stack
page read and write
3499000
trusted library allocation
page read and write
585D000
stack
page read and write
B10000
heap
page read and write
165F000
stack
page read and write
33F6000
trusted library allocation
page read and write
4FCA000
trusted library allocation
page read and write
340A000
trusted library allocation
page read and write
4FC0000
trusted library allocation
page read and write
57AA000
trusted library allocation
page read and write
4EA8000
trusted library allocation
page read and write
57B6000
trusted library allocation
page read and write
592000
unkown
page readonly
D7B000
heap
page read and write
6FA0000
trusted library allocation
page read and write
B00000
heap
page read and write
6B10000
heap
page read and write
5930000
heap
page read and write
6FA6000
trusted library allocation
page read and write
7590000
heap
page read and write
BD5000
heap
page read and write
4FC5000
trusted library allocation
page read and write
57F0000
trusted library allocation
page read and write
D04000
trusted library allocation
page read and write
5094000
trusted library allocation
page read and write
5075000
trusted library allocation
page read and write
349D000
trusted library allocation
page read and write
27D0000
heap
page read and write
4FE0000
heap
page execute and read and write
6FD0000
trusted library allocation
page execute and read and write
D5E000
heap
page read and write
33FE000
trusted library allocation
page read and write
BD0000
heap
page read and write
CF4000
trusted library allocation
page read and write
B9E000
stack
page read and write
348D000
trusted library allocation
page read and write
4EB0000
heap
page read and write
4E97000
trusted library allocation
page read and write
CFD000
trusted library allocation
page execute and read and write
34C4000
trusted library allocation
page read and write
6FCF000
trusted library allocation
page read and write
5923000
heap
page read and write
43DD000
trusted library allocation
page read and write
16DA000
trusted library allocation
page execute and read and write
D3B000
trusted library allocation
page execute and read and write
6FA8000
trusted library allocation
page read and write
5042000
trusted library allocation
page read and write
6FB0000
trusted library allocation
page execute and read and write
511D000
stack
page read and write
4FBE000
stack
page read and write
16D6000
trusted library allocation
page execute and read and write
43E0000
trusted library allocation
page read and write
3230000
trusted library allocation
page read and write
1377000
stack
page read and write
50A0000
trusted library allocation
page read and write
5300000
heap
page read and write
3455000
trusted library allocation
page read and write
19C0000
heap
page read and write
14F5000
heap
page read and write
6DCF000
stack
page read and write
33F9000
trusted library allocation
page read and write
57C5000
trusted library allocation
page read and write
530D000
heap
page read and write
16C0000
trusted library allocation
page read and write
273E000
stack
page read and write
199E000
stack
page read and write
D5A000
heap
page read and write
6FF0000
trusted library allocation
page read and write
590000
unkown
page readonly
2780000
heap
page execute and read and write
7090000
heap
page read and write
4FCD000
trusted library allocation
page read and write
544E000
stack
page read and write
358A000
trusted library allocation
page read and write
14F0000
heap
page read and write
5C9F000
stack
page read and write
1550000
heap
page read and write
3586000
trusted library allocation
page read and write
35AD000
trusted library allocation
page read and write
D26000
trusted library allocation
page execute and read and write
CDF000
stack
page read and write
16D2000
trusted library allocation
page read and write
16CD000
trusted library allocation
page execute and read and write
6B0E000
stack
page read and write
57C2000
trusted library allocation
page read and write
28DF000
stack
page read and write
4FD0000
trusted library allocation
page read and write
5099000
trusted library allocation
page read and write
35D0000
trusted library allocation
page read and write
34D2000
trusted library allocation
page read and write
16F8000
heap
page read and write
D85000
heap
page read and write
6B75000
heap
page read and write
34A1000
trusted library allocation
page read and write
57D0000
trusted library allocation
page read and write
35DC000
trusted library allocation
page read and write
3414000
trusted library allocation
page read and write
18EE000
stack
page read and write
3210000
heap
page read and write
359A000
trusted library allocation
page read and write
There are 233 hidden memdumps, click here to show them.