Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
order6566546663.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\order6566546663.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\order6566546663.exe
|
"C:\Users\user\Desktop\order6566546663.exe"
|
|
|
|
C:\Users\user\Desktop\order6566546663.exe
|
"C:\Users\user\Desktop\order6566546663.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://reallyfreegeoip.org
|
unknown
|
||
|
http://checkip.dyndns.org
|
unknown
|
||
|
http://checkip.dyndns.org/
|
132.226.247.73
|
||
|
https://reallyfreegeoip.org/xml/8.46.123.189
|
104.21.48.1
|
||
|
http://checkip.dyndns.com
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://checkip.dyndns.org/q
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/8.46.123.189$
|
unknown
|
||
|
http://reallyfreegeoip.org
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
reallyfreegeoip.org
|
104.21.48.1
|
||
|
checkip.dyndns.com
|
132.226.247.73
|
||
|
checkip.dyndns.org
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
104.21.48.1
|
reallyfreegeoip.org
|
United States
|
||
|
104.21.16.1
|
unknown
|
United States
|
||
|
132.226.247.73
|
checkip.dyndns.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\order6566546663_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2E41000
|
trusted library allocation
|
page read and write
|
|
|
|
2FFA000
|
trusted library allocation
|
page read and write
|
|
|
|
402000
|
remote allocation
|
page execute and read and write
|
|
|
|
38A6000
|
trusted library allocation
|
page read and write
|
|
|
|
50CE000
|
stack
|
page read and write
|
||
|
2E3E000
|
stack
|
page read and write
|
||
|
B9D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2CA0000
|
trusted library allocation
|
page read and write
|
||
|
2F00000
|
trusted library allocation
|
page read and write
|
||
|
10E0000
|
heap
|
page read and write
|
||
|
6B60000
|
trusted library allocation
|
page read and write
|
||
|
F40000
|
trusted library allocation
|
page read and write
|
||
|
6B20000
|
trusted library allocation
|
page read and write
|
||
|
3079000
|
trusted library allocation
|
page read and write
|
||
|
EB0000
|
heap
|
page read and write
|
||
|
F8E000
|
stack
|
page read and write
|
||
|
3EA6000
|
trusted library allocation
|
page read and write
|
||
|
111E000
|
heap
|
page read and write
|
||
|
4F60000
|
trusted library section
|
page read and write
|
||
|
145A000
|
trusted library allocation
|
page execute and read and write
|
||
|
2FEC000
|
trusted library allocation
|
page read and write
|
||
|
1340000
|
heap
|
page read and write
|
||
|
6B40000
|
trusted library allocation
|
page execute and read and write
|
||
|
F40000
|
heap
|
page read and write
|
||
|
2CB0000
|
heap
|
page read and write
|
||
|
4F30000
|
trusted library allocation
|
page read and write
|
||
|
AA4000
|
heap
|
page read and write
|
||
|
6C10000
|
trusted library allocation
|
page execute and read and write
|
||
|
4F2E000
|
trusted library allocation
|
page read and write
|
||
|
56AE000
|
stack
|
page read and write
|
||
|
A9A000
|
heap
|
page read and write
|
||
|
A6E000
|
stack
|
page read and write
|
||
|
144E000
|
stack
|
page read and write
|
||
|
6630000
|
heap
|
page read and write
|
||
|
1456000
|
trusted library allocation
|
page execute and read and write
|
||
|
4F24000
|
trusted library allocation
|
page read and write
|
||
|
306E000
|
trusted library allocation
|
page read and write
|
||
|
3083000
|
trusted library allocation
|
page read and write
|
||
|
E20000
|
trusted library allocation
|
page read and write
|
||
|
6B30000
|
trusted library allocation
|
page execute and read and write
|
||
|
1100000
|
heap
|
page read and write
|
||
|
EFE000
|
stack
|
page read and write
|
||
|
2F8E000
|
trusted library allocation
|
page read and write
|
||
|
2F82000
|
trusted library allocation
|
page read and write
|
||
|
3ECB000
|
trusted library allocation
|
page read and write
|
||
|
6693000
|
heap
|
page read and write
|
||
|
5346000
|
trusted library allocation
|
page read and write
|
||
|
B93000
|
trusted library allocation
|
page execute and read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
A97000
|
heap
|
page read and write
|
||
|
132D000
|
trusted library allocation
|
page execute and read and write
|
||
|
6AE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
E7E000
|
stack
|
page read and write
|
||
|
4ED0000
|
trusted library allocation
|
page read and write
|
||
|
2CFE000
|
stack
|
page read and write
|
||
|
2F7A000
|
trusted library allocation
|
page read and write
|
||
|
4EC0000
|
heap
|
page read and write
|
||
|
5403000
|
heap
|
page read and write
|
||
|
532E000
|
trusted library allocation
|
page read and write
|
||
|
E00000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F3A000
|
trusted library allocation
|
page read and write
|
||
|
30C5000
|
trusted library allocation
|
page read and write
|
||
|
2F86000
|
trusted library allocation
|
page read and write
|
||
|
4F55000
|
trusted library allocation
|
page read and write
|
||
|
2EE3000
|
trusted library allocation
|
page read and write
|
||
|
FDE000
|
stack
|
page read and write
|
||
|
6B23000
|
trusted library allocation
|
page read and write
|
||
|
5341000
|
trusted library allocation
|
page read and write
|
||
|
5352000
|
trusted library allocation
|
page read and write
|
||
|
38A4000
|
trusted library allocation
|
page read and write
|
||
|
5C30000
|
heap
|
page read and write
|
||
|
BB6000
|
trusted library allocation
|
page execute and read and write
|
||
|
2C17000
|
trusted library allocation
|
page execute and read and write
|
||
|
3801000
|
trusted library allocation
|
page read and write
|
||
|
4F20000
|
trusted library allocation
|
page read and write
|
||
|
2C10000
|
trusted library allocation
|
page read and write
|
||
|
133D000
|
trusted library allocation
|
page execute and read and write
|
||
|
6AFE000
|
trusted library allocation
|
page read and write
|
||
|
30B8000
|
trusted library allocation
|
page read and write
|
||
|
2EF4000
|
trusted library allocation
|
page read and write
|
||
|
694E000
|
stack
|
page read and write
|
||
|
4EEE000
|
trusted library allocation
|
page read and write
|
||
|
4ED4000
|
trusted library allocation
|
page read and write
|
||
|
B90000
|
trusted library allocation
|
page read and write
|
||
|
4F29000
|
trusted library allocation
|
page read and write
|
||
|
54B0000
|
heap
|
page read and write
|
||
|
6AD0000
|
trusted library allocation
|
page read and write
|
||
|
1108000
|
heap
|
page read and write
|
||
|
1330000
|
trusted library allocation
|
page read and write
|
||
|
113A000
|
heap
|
page read and write
|
||
|
6ACF000
|
stack
|
page read and write
|
||
|
A25000
|
heap
|
page read and write
|
||
|
662F000
|
stack
|
page read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
53CE000
|
stack
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
528E000
|
stack
|
page read and write
|
||
|
BC7000
|
trusted library allocation
|
page execute and read and write
|
||
|
F48000
|
trusted library allocation
|
page read and write
|
||
|
652E000
|
stack
|
page read and write
|
||
|
2F92000
|
trusted library allocation
|
page read and write
|
||
|
1452000
|
trusted library allocation
|
page read and write
|
||
|
4EF1000
|
trusted library allocation
|
page read and write
|
||
|
30CB000
|
trusted library allocation
|
page read and write
|
||
|
6688000
|
heap
|
page read and write
|
||
|
8F7000
|
stack
|
page read and write
|
||
|
6B2F000
|
trusted library allocation
|
page read and write
|
||
|
6B50000
|
trusted library allocation
|
page read and write
|
||
|
2F7E000
|
trusted library allocation
|
page read and write
|
||
|
1320000
|
trusted library allocation
|
page read and write
|
||
|
3091000
|
trusted library allocation
|
page read and write
|
||
|
DDE000
|
stack
|
page read and write
|
||
|
4EA0000
|
trusted library allocation
|
page read and write
|
||
|
2D30000
|
heap
|
page execute and read and write
|
||
|
4EA5000
|
trusted library allocation
|
page read and write
|
||
|
BBA000
|
trusted library allocation
|
page execute and read and write
|
||
|
2FCC000
|
trusted library allocation
|
page read and write
|
||
|
11BC000
|
heap
|
page read and write
|
||
|
2F03000
|
trusted library allocation
|
page read and write
|
||
|
3805000
|
trusted library allocation
|
page read and write
|
||
|
56B0000
|
heap
|
page execute and read and write
|
||
|
F3E000
|
stack
|
page read and write
|
||
|
DF0000
|
trusted library allocation
|
page read and write
|
||
|
4EB0000
|
trusted library allocation
|
page read and write
|
||
|
3E41000
|
trusted library allocation
|
page read and write
|
||
|
F50000
|
heap
|
page read and write
|
||
|
AB1000
|
heap
|
page read and write
|
||
|
5B0000
|
heap
|
page read and write
|
||
|
4FAD000
|
stack
|
page read and write
|
||
|
2CA4000
|
trusted library allocation
|
page read and write
|
||
|
2C80000
|
trusted library allocation
|
page execute and read and write
|
||
|
69CE000
|
stack
|
page read and write
|
||
|
A7A000
|
heap
|
page read and write
|
||
|
EA7000
|
trusted library allocation
|
page read and write
|
||
|
BCB000
|
trusted library allocation
|
page execute and read and write
|
||
|
5326000
|
trusted library allocation
|
page read and write
|
||
|
3073000
|
trusted library allocation
|
page read and write
|
||
|
6B00000
|
trusted library allocation
|
page read and write
|
||
|
4EF6000
|
trusted library allocation
|
page read and write
|
||
|
BD0000
|
heap
|
page read and write
|
||
|
698F000
|
stack
|
page read and write
|
||
|
1460000
|
heap
|
page read and write
|
||
|
E10000
|
trusted library allocation
|
page read and write
|
||
|
5320000
|
trusted library allocation
|
page read and write
|
||
|
B64000
|
heap
|
page read and write
|
||
|
4E50000
|
trusted library section
|
page read and write
|
||
|
4F05000
|
trusted library allocation
|
page read and write
|
||
|
BA4000
|
trusted library allocation
|
page read and write
|
||
|
690E000
|
stack
|
page read and write
|
||
|
2D00000
|
trusted library allocation
|
page read and write
|
||
|
2C90000
|
trusted library allocation
|
page read and write
|
||
|
2EEB000
|
trusted library allocation
|
page read and write
|
||
|
1129000
|
heap
|
page read and write
|
||
|
532B000
|
trusted library allocation
|
page read and write
|
||
|
422000
|
unkown
|
page readonly
|
||
|
4EDB000
|
trusted library allocation
|
page read and write
|
||
|
3EC1000
|
trusted library allocation
|
page read and write
|
||
|
680E000
|
stack
|
page read and write
|
||
|
2F42000
|
trusted library allocation
|
page read and write
|
||
|
2C15000
|
trusted library allocation
|
page execute and read and write
|
||
|
499E000
|
stack
|
page read and write
|
||
|
4E4E000
|
stack
|
page read and write
|
||
|
EA0000
|
trusted library allocation
|
page read and write
|
||
|
2F96000
|
trusted library allocation
|
page read and write
|
||
|
534D000
|
trusted library allocation
|
page read and write
|
||
|
677D000
|
stack
|
page read and write
|
||
|
2C1B000
|
trusted library allocation
|
page execute and read and write
|
||
|
CDE000
|
stack
|
page read and write
|
||
|
2FB1000
|
trusted library allocation
|
page read and write
|
||
|
5C2E000
|
stack
|
page read and write
|
||
|
4F10000
|
trusted library allocation
|
page read and write
|
||
|
54B000
|
stack
|
page read and write
|
||
|
6B06000
|
trusted library allocation
|
page read and write
|
||
|
4EAA000
|
trusted library allocation
|
page read and write
|
||
|
3095000
|
trusted library allocation
|
page read and write
|
||
|
FF5000
|
heap
|
page read and write
|
||
|
6B10000
|
trusted library allocation
|
page execute and read and write
|
||
|
4EAD000
|
trusted library allocation
|
page read and write
|
||
|
2F3E000
|
trusted library allocation
|
page read and write
|
||
|
70C0000
|
heap
|
page read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
67BE000
|
stack
|
page read and write
|
||
|
11F1000
|
heap
|
page read and write
|
||
|
1450000
|
trusted library allocation
|
page read and write
|
||
|
A7E000
|
heap
|
page read and write
|
||
|
6AF0000
|
trusted library allocation
|
page read and write
|
||
|
2FBE000
|
trusted library allocation
|
page read and write
|
||
|
53BD000
|
stack
|
page read and write
|
||
|
2EE8000
|
trusted library allocation
|
page read and write
|
||
|
2F8A000
|
trusted library allocation
|
page read and write
|
||
|
2FA3000
|
trusted library allocation
|
page read and write
|
||
|
A20000
|
heap
|
page read and write
|
||
|
2F1B000
|
trusted library allocation
|
page read and write
|
||
|
12FE000
|
stack
|
page read and write
|
||
|
3E69000
|
trusted library allocation
|
page read and write
|
||
|
4F51000
|
trusted library allocation
|
page read and write
|
||
|
2D20000
|
trusted library allocation
|
page read and write
|
||
|
B94000
|
trusted library allocation
|
page read and write
|
||
|
F90000
|
heap
|
page read and write
|
||
|
EF7000
|
stack
|
page read and write
|
||
|
2EF0000
|
trusted library allocation
|
page read and write
|
||
|
6BF0000
|
heap
|
page read and write
|
||
|
5400000
|
heap
|
page read and write
|
||
|
538F000
|
stack
|
page read and write
|
||
|
1310000
|
trusted library allocation
|
page read and write
|
||
|
6B0B000
|
trusted library allocation
|
page read and write
|
||
|
2F46000
|
trusted library allocation
|
page read and write
|
||
|
2C12000
|
trusted library allocation
|
page read and write
|
||
|
2801000
|
trusted library allocation
|
page read and write
|
||
|
30BF000
|
trusted library allocation
|
page read and write
|
||
|
1323000
|
trusted library allocation
|
page execute and read and write
|
||
|
2C30000
|
trusted library allocation
|
page read and write
|
||
|
5B2F000
|
stack
|
page read and write
|
||
|
6BC0000
|
trusted library allocation
|
page read and write
|
||
|
533E000
|
trusted library allocation
|
page read and write
|
||
|
2F32000
|
trusted library allocation
|
page read and write
|
||
|
30FC000
|
trusted library allocation
|
page read and write
|
||
|
A0E000
|
stack
|
page read and write
|
||
|
669B000
|
heap
|
page read and write
|
||
|
BA0000
|
trusted library allocation
|
page read and write
|
||
|
508E000
|
stack
|
page read and write
|
||
|
4FDE000
|
stack
|
page read and write
|
||
|
27FF000
|
stack
|
page read and write
|
||
|
2FE8000
|
trusted library allocation
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
1324000
|
trusted library allocation
|
page read and write
|
||
|
308C000
|
trusted library allocation
|
page read and write
|
||
|
E30000
|
heap
|
page execute and read and write
|
||
|
4ED2000
|
trusted library allocation
|
page read and write
|
||
|
E90000
|
heap
|
page execute and read and write
|
||
|
420000
|
unkown
|
page readonly
|
||
|
AB5000
|
heap
|
page read and write
|
||
|
2F30000
|
trusted library allocation
|
page read and write
|
||
|
2C7E000
|
stack
|
page read and write
|
||
|
6B2A000
|
trusted library allocation
|
page read and write
|
||
|
B80000
|
trusted library allocation
|
page read and write
|
||
|
BD9000
|
stack
|
page read and write
|
||
|
3ED7000
|
trusted library allocation
|
page read and write
|
||
|
533A000
|
trusted library allocation
|
page read and write
|
||
|
6B08000
|
trusted library allocation
|
page read and write
|
There are 230 hidden memdumps, click here to show them.