IOC Report
PT98765445670009.scr.exe

loading gif

Files

File Path
Type
Category
Malicious
PT98765445670009.scr.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PT98765445670009.scr.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PT98765445670009.scr.exe
"C:\Users\user\Desktop\PT98765445670009.scr.exe"
 malicious
C:\Users\user\Desktop\PT98765445670009.scr.exe
"C:\Users\user\Desktop\PT98765445670009.scr.exe"
 malicious

URLs

Name
IP
Malicious
https://reallyfreegeoip.org/xml/102.165.48.43$
unknown
http://crl.micro2G
unknown
http://checkip.dyndns.org/
193.122.6.168
https://reallyfreegeoip.org/xml/102.165.48.43
172.67.177.134
http://checkip.dyndns.org/q
unknown
https://scratchdreams.tk
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org
unknown
https://scratchdreams.tk/_send_.php?TS
104.21.27.85
http://checkip.dyndns.org
unknown
http://checkip.dyndns.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://scratchdreams.tk
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 4 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
checkip.dyndns.org
unknown
 malicious
reallyfreegeoip.org
172.67.177.134
scratchdreams.tk
104.21.27.85
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
193.122.6.168
checkip.dyndns.com
United States
172.67.177.134
reallyfreegeoip.org
United States
104.21.27.85
scratchdreams.tk
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PT98765445670009_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4034000
trusted library allocation
page read and write
 malicious
2DE1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
5585000
trusted library allocation
page read and write
2CC0000
trusted library allocation
page read and write
5571000
trusted library allocation
page read and write
10FA000
heap
page read and write
2E06000
trusted library allocation
page read and write
FCD000
heap
page read and write
14AE000
stack
page read and write
653E000
stack
page read and write
F80000
heap
page read and write
2C56000
trusted library allocation
page read and write
12E0000
trusted library allocation
page read and write
2EC0000
trusted library allocation
page read and write
1237000
trusted library allocation
page execute and read and write
12F0000
trusted library allocation
page read and write
68BE000
stack
page read and write
2ED4000
trusted library allocation
page read and write
2F56000
trusted library allocation
page read and write
2D60000
trusted library allocation
page read and write
2E30000
heap
page read and write
54C0000
trusted library allocation
page read and write
1220000
trusted library allocation
page read and write
69C8000
trusted library allocation
page read and write
556E000
trusted library allocation
page read and write
10D0000
heap
page read and write
307C000
trusted library allocation
page read and write
11F0000
trusted library allocation
page read and write
683E000
stack
page read and write
12FD000
trusted library allocation
page execute and read and write
2ADB000
trusted library allocation
page execute and read and write
2EDF000
trusted library allocation
page read and write
2F37000
trusted library allocation
page read and write
6AC0000
trusted library allocation
page execute and read and write
69E0000
trusted library allocation
page read and write
6A80000
trusted library allocation
page read and write
52D0000
heap
page read and write
69D0000
trusted library allocation
page execute and read and write
2EA8000
trusted library allocation
page read and write
3050000
trusted library allocation
page read and write
F6E000
heap
page read and write
52BD000
stack
page read and write
6EE90000
unkown
page readonly
308F000
trusted library allocation
page read and write
53BE000
stack
page read and write
55B5000
trusted library allocation
page read and write
2F71000
trusted library allocation
page read and write
6A20000
trusted library allocation
page read and write
2E2D000
trusted library allocation
page read and write
555B000
trusted library allocation
page read and write
2ABD000
trusted library allocation
page execute and read and write
F68000
heap
page read and write
3089000
trusted library allocation
page read and write
3F41000
trusted library allocation
page read and write
2AF0000
trusted library allocation
page read and write
2AC2000
trusted library allocation
page read and write
2C5B000
trusted library allocation
page read and write
113B000
heap
page read and write
104F000
heap
page read and write
55B0000
trusted library allocation
page read and write
6414000
heap
page read and write
2AD7000
trusted library allocation
page execute and read and write
2D50000
trusted library allocation
page read and write
3E09000
trusted library allocation
page read and write
1200000
trusted library allocation
page read and write
F60000
heap
page read and write
2C40000
trusted library allocation
page read and write
1230000
trusted library allocation
page read and write
F50000
heap
page read and write
1210000
trusted library allocation
page read and write
66BE000
stack
page read and write
54E0000
trusted library allocation
page read and write
134F000
stack
page read and write
5270000
heap
page execute and read and write
144F000
stack
page read and write
52C0000
trusted library allocation
page execute and read and write
3E66000
trusted library allocation
page read and write
120D000
trusted library allocation
page execute and read and write
5380000
heap
page read and write
2C76000
trusted library allocation
page read and write
69BE000
stack
page read and write
2F33000
trusted library allocation
page read and write
5576000
trusted library allocation
page read and write
2ACA000
trusted library allocation
page execute and read and write
2AD5000
trusted library allocation
page execute and read and write
66FE000
stack
page read and write
6EEAF000
unkown
page readonly
2F2B000
trusted library allocation
page read and write
2F3E000
stack
page read and write
2C7D000
trusted library allocation
page read and write
5550000
trusted library allocation
page read and write
14F0000
heap
page read and write
2C20000
heap
page execute and read and write
2CA0000
trusted library allocation
page read and write
67FE000
stack
page read and write
2F2F000
trusted library allocation
page read and write
54D9000
trusted library allocation
page read and write
2E29000
trusted library allocation
page read and write
69C0000
trusted library allocation
page read and write
3046000
trusted library allocation
page read and write
12CF000
stack
page read and write
1300000
heap
page read and write
69EF000
trusted library allocation
page read and write
2AD0000
trusted library allocation
page read and write
2E20000
trusted library allocation
page read and write
2EE3000
trusted library allocation
page read and write
EF7000
stack
page read and write
FA0000
heap
page read and write
6464000
heap
page read and write
303D000
trusted library allocation
page read and write
2EEB000
trusted library allocation
page read and write
54D4000
trusted library allocation
page read and write
1226000
trusted library allocation
page execute and read and write
2F64000
trusted library allocation
page read and write
2C6A000
trusted library allocation
page read and write
663E000
stack
page read and write
3032000
trusted library allocation
page read and write
117E000
stack
page read and write
2C71000
trusted library allocation
page read and write
2B3E000
stack
page read and write
2E00000
trusted library allocation
page read and write
54BE000
stack
page read and write
FA6000
heap
page read and write
2F3B000
trusted library allocation
page read and write
6A10000
trusted library allocation
page read and write
2C62000
trusted library allocation
page read and write
1130000
heap
page read and write
6AB0000
heap
page read and write
F3E000
stack
page read and write
2D40000
trusted library allocation
page execute and read and write
2C50000
trusted library allocation
page read and write
69F0000
trusted library allocation
page execute and read and write
6A00000
trusted library allocation
page execute and read and write
2AB0000
trusted library allocation
page read and write
5260000
trusted library allocation
page read and write
3E4A000
trusted library allocation
page read and write
2DDE000
stack
page read and write
FA3000
heap
page read and write
2AC6000
trusted library allocation
page execute and read and write
10AE000
stack
page read and write
1204000
trusted library allocation
page read and write
2FA0000
trusted library allocation
page read and write
BB7000
stack
page read and write
6EEAD000
unkown
page read and write
AB9000
stack
page read and write
2C5E000
trusted library allocation
page read and write
AB2000
unkown
page readonly
2AD2000
trusted library allocation
page read and write
1214000
trusted library allocation
page read and write
667D000
stack
page read and write
6F80000
heap
page read and write
54F0000
heap
page execute and read and write
3DE1000
trusted library allocation
page read and write
56BF000
stack
page read and write
12F3000
trusted library allocation
page execute and read and write
6400000
heap
page read and write
5554000
trusted library allocation
page read and write
503E000
stack
page read and write
2F27000
trusted library allocation
page read and write
2F90000
trusted library allocation
page read and write
FDA000
heap
page read and write
2F23000
trusted library allocation
page read and write
122A000
trusted library allocation
page execute and read and write
69CB000
trusted library allocation
page read and write
3055000
trusted library allocation
page read and write
AB0000
unkown
page readonly
3E7B000
trusted library allocation
page read and write
11BD000
stack
page read and write
F8C000
heap
page read and write
2C6E000
trusted library allocation
page read and write
F40000
heap
page read and write
3059000
trusted library allocation
page read and write
F95000
heap
page read and write
55C0000
trusted library section
page read and write
52D3000
heap
page read and write
6478000
heap
page read and write
2F1F000
trusted library allocation
page read and write
1460000
trusted library allocation
page read and write
2FAE000
trusted library allocation
page read and write
2E99000
trusted library allocation
page read and write
2FCA000
trusted library allocation
page read and write
2AC0000
trusted library allocation
page read and write
69EA000
trusted library allocation
page read and write
FED000
heap
page read and write
2C94000
trusted library allocation
page read and write
69E3000
trusted library allocation
page read and write
F90000
heap
page read and write
2EA6000
trusted library allocation
page read and write
2C1D000
stack
page read and write
14EE000
stack
page read and write
6EE91000
unkown
page execute read
2F1B000
trusted library allocation
page read and write
2CD0000
heap
page read and write
12F4000
trusted library allocation
page read and write
2C90000
trusted library allocation
page read and write
4EDE000
stack
page read and write
2F41000
trusted library allocation
page read and write
F7E000
stack
page read and write
54DE000
trusted library allocation
page read and write
645E000
heap
page read and write
2F48000
trusted library allocation
page read and write
123B000
trusted library allocation
page execute and read and write
5880000
trusted library allocation
page read and write
2EE7000
trusted library allocation
page read and write
E20000
heap
page read and write
2E18000
trusted library allocation
page read and write
3037000
trusted library allocation
page read and write
2F8D000
trusted library allocation
page read and write
3E6F000
trusted library allocation
page read and write
687E000
stack
page read and write
54D0000
trusted library allocation
page read and write
646F000
heap
page read and write
1203000
trusted library allocation
page execute and read and write
2ED6000
trusted library allocation
page read and write
1240000
heap
page read and write
10D8000
heap
page read and write
6442000
heap
page read and write
2E10000
trusted library allocation
page read and write
5500000
trusted library section
page read and write
588E000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
BDC000
stack
page read and write
5552000
trusted library allocation
page read and write
3083000
trusted library allocation
page read and write
2E25000
trusted library allocation
page read and write
1108000
heap
page read and write
69C6000
trusted library allocation
page read and write
2C30000
trusted library allocation
page execute and read and write
FD0000
heap
page read and write
5590000
trusted library allocation
page read and write
2D70000
heap
page execute and read and write
6EEA6000
unkown
page readonly
There are 223 hidden memdumps, click here to show them.