IOC Report
FATURA VE BELGELER..exe

loading gif

Files

File Path
Type
Category
Malicious
FATURA VE BELGELER..exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FATURA VE BELGELER..exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\FATURA VE BELGELER..exe
"C:\Users\user\Desktop\FATURA VE BELGELER..exe"
 malicious
C:\Users\user\Desktop\FATURA VE BELGELER..exe
"C:\Users\user\Desktop\FATURA VE BELGELER..exe"
 malicious

URLs

Name
IP
Malicious
http://tempuri.org/DataSetGen.xsd
unknown
http://checkip.dyndns.org/
132.226.247.73
http://checkip.dyndns.org/q
unknown
https://scratchdreams.tk
unknown
https://reallyfreegeoip.org/xml/191.96.227.219$
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org
unknown
https://scratchdreams.tk/_send_.php?TS
104.21.27.85
http://checkip.dyndns.org
unknown
https://reallyfreegeoip.org/xml/191.96.227.219
172.67.177.134
http://checkip.dyndns.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://scratchdreams.tk
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 4 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
checkip.dyndns.org
unknown
 malicious
reallyfreegeoip.org
172.67.177.134
scratchdreams.tk
104.21.27.85
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
172.67.177.134
reallyfreegeoip.org
United States
104.21.27.85
scratchdreams.tk
United States
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\FATURA VE BELGELER_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
2AB1000
trusted library allocation
page read and write
 malicious
2A41000
trusted library allocation
page read and write
 malicious
3C8E000
trusted library allocation
page read and write
 malicious
2D1F000
trusted library allocation
page read and write
 malicious
5400000
trusted library section
page read and write
 malicious
BD0000
heap
page read and write
EDD000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
2834000
trusted library allocation
page read and write
2B89000
trusted library allocation
page read and write
668E000
stack
page read and write
52B7000
trusted library allocation
page read and write
3AB1000
trusted library allocation
page read and write
EEA000
trusted library allocation
page execute and read and write
51F0000
heap
page execute and read and write
9D6E000
stack
page read and write
51B0000
trusted library section
page read and write
52B0000
trusted library allocation
page read and write
2C9E000
trusted library allocation
page read and write
658E000
stack
page read and write
EE0000
trusted library allocation
page read and write
2843000
trusted library allocation
page execute and read and write
67A0000
trusted library allocation
page execute and read and write
2960000
trusted library allocation
page read and write
5160000
trusted library section
page readonly
EF2000
trusted library allocation
page read and write
3AC4000
trusted library allocation
page read and write
EE6000
trusted library allocation
page execute and read and write
2B35000
trusted library allocation
page read and write
515B000
stack
page read and write
D70000
trusted library allocation
page read and write
E7F000
heap
page read and write
5190000
trusted library allocation
page execute and read and write
2C28000
trusted library allocation
page read and write
A2AE000
stack
page read and write
3A41000
trusted library allocation
page read and write
D98000
heap
page read and write
292E000
stack
page read and write
B57000
stack
page read and write
76DE000
stack
page read and write
102E000
stack
page read and write
2B32000
trusted library allocation
page read and write
52AE000
stack
page read and write
6700000
trusted library allocation
page read and write
EF5000
trusted library allocation
page execute and read and write
7F3E0000
trusted library allocation
page execute and read and write
626D000
heap
page read and write
66F0000
trusted library allocation
page read and write
2D20000
trusted library allocation
page read and write
4FB0000
trusted library allocation
page read and write
66B0000
trusted library allocation
page execute and read and write
BB0000
heap
page read and write
F20000
heap
page read and write
286A000
trusted library allocation
page execute and read and write
53ED000
stack
page read and write
4FA5000
trusted library allocation
page read and write
6690000
trusted library allocation
page execute and read and write
E51000
heap
page read and write
2B8D000
trusted library allocation
page read and write
77EA000
heap
page read and write
2872000
trusted library allocation
page read and write
2B85000
trusted library allocation
page read and write
28C0000
trusted library allocation
page read and write
284D000
trusted library allocation
page execute and read and write
2BA6000
trusted library allocation
page read and write
9DAE000
stack
page read and write
A1AE000
stack
page read and write
4EA6000
trusted library allocation
page read and write
4F90000
trusted library allocation
page read and write
2B45000
trusted library allocation
page read and write
A5A000
stack
page read and write
2840000
trusted library allocation
page read and write
6730000
heap
page read and write
2CDD000
trusted library allocation
page read and write
28B0000
trusted library allocation
page read and write
4EC0000
trusted library allocation
page read and write
4E8B000
trusted library allocation
page read and write
2B49000
trusted library allocation
page read and write
EF7000
trusted library allocation
page execute and read and write
78A000
stack
page read and write
4EAD000
trusted library allocation
page read and write
620E000
stack
page read and write
2B06000
trusted library allocation
page read and write
6FE7000
trusted library allocation
page read and write
51C0000
trusted library allocation
page read and write
2B99000
trusted library allocation
page read and write
6CD0000
trusted library allocation
page read and write
2981000
trusted library allocation
page read and write
28A0000
trusted library allocation
page execute and read and write
F5E000
stack
page read and write
2B3D000
trusted library allocation
page read and write
BE0000
heap
page read and write
89DE000
stack
page read and write
6277000
heap
page read and write
2B41000
trusted library allocation
page read and write
A16E000
stack
page read and write
D39000
heap
page read and write
4F60000
heap
page read and write
4B10000
trusted library allocation
page read and write
2CB5000
trusted library allocation
page read and write
5030000
trusted library allocation
page execute and read and write
5420000
heap
page read and write
9F6E000
stack
page read and write
5000000
trusted library allocation
page read and write
285D000
trusted library allocation
page execute and read and write
4AEE000
stack
page read and write
5050000
heap
page read and write
2B79000
trusted library allocation
page read and write
4F63000
heap
page read and write
291E000
stack
page read and write
EE2000
trusted library allocation
page read and write
A06F000
stack
page read and write
2B81000
trusted library allocation
page read and write
BD0000
heap
page read and write
2BB4000
trusted library allocation
page read and write
ED0000
trusted library allocation
page read and write
6FC0000
trusted library allocation
page read and write
2C93000
trusted library allocation
page read and write
D0E000
heap
page read and write
2850000
trusted library allocation
page read and write
3B07000
trusted library allocation
page read and write
64CE000
stack
page read and write
C4E000
stack
page read and write
52D0000
heap
page execute and read and write
4FA0000
trusted library allocation
page read and write
EFB000
trusted library allocation
page execute and read and write
72C2000
trusted library allocation
page read and write
3ADA000
trusted library allocation
page read and write
3AB9000
trusted library allocation
page read and write
2BEB000
trusted library allocation
page read and write
71BE000
stack
page read and write
296B000
trusted library allocation
page read and write
4B20000
trusted library allocation
page execute and read and write
5020000
trusted library allocation
page read and write
4E8E000
trusted library allocation
page read and write
DC6000
heap
page read and write
3BA3000
trusted library allocation
page read and write
66A0000
trusted library allocation
page read and write
280E000
stack
page read and write
298D000
trusted library allocation
page read and write
2877000
trusted library allocation
page execute and read and write
52BC000
trusted library allocation
page read and write
D87000
heap
page read and write
5180000
heap
page read and write
2BFE000
trusted library allocation
page read and write
6210000
heap
page read and write
D60000
trusted library allocation
page read and write
CB0000
heap
page read and write
DAE000
heap
page read and write
5450000
heap
page read and write
6F50000
trusted library section
page read and write
3B55000
trusted library allocation
page read and write
283E000
stack
page read and write
776000
unkown
page readonly
BF7000
heap
page read and write
2BC2000
trusted library allocation
page read and write
29A0000
heap
page read and write
C90000
heap
page read and write
28D0000
heap
page execute and read and write
2A3E000
stack
page read and write
4B14000
trusted library allocation
page read and write
77DE000
stack
page read and write
67C0000
heap
page read and write
2BD0000
trusted library allocation
page read and write
2CA7000
trusted library allocation
page read and write
2B1E000
trusted library allocation
page read and write
D74000
trusted library allocation
page read and write
C80000
trusted library allocation
page read and write
AF7000
stack
page read and write
638F000
stack
page read and write
4E80000
trusted library allocation
page read and write
C8E000
stack
page read and write
52B9000
trusted library allocation
page read and write
66D0000
trusted library allocation
page read and write
4E9A000
trusted library allocation
page read and write
2CF0000
trusted library allocation
page read and write
77E0000
heap
page read and write
CC5000
heap
page read and write
4EE0000
trusted library allocation
page read and write
2CB1000
trusted library allocation
page read and write
D0A000
heap
page read and write
77FE000
heap
page read and write
295C000
stack
page read and write
2830000
trusted library allocation
page read and write
5415000
heap
page read and write
2CE5000
trusted library allocation
page read and write
BF0000
heap
page read and write
2CBA000
trusted library allocation
page read and write
3ACE000
trusted library allocation
page read and write
66C0000
trusted library allocation
page execute and read and write
2C0C000
trusted library allocation
page read and write
D90000
heap
page read and write
4FD0000
trusted library allocation
page read and write
63CE000
stack
page read and write
5410000
heap
page read and write
CCE000
stack
page read and write
2840000
heap
page execute and read and write
4B3E000
stack
page read and write
77A000
unkown
page readonly
5022000
trusted library allocation
page read and write
4AF0000
trusted library allocation
page read and write
50B0000
heap
page read and write
7F0000
heap
page read and write
6CC0000
trusted library allocation
page execute and read and write
2C97000
trusted library allocation
page read and write
2860000
trusted library allocation
page read and write
C9A000
heap
page read and write
5170000
heap
page read and write
2AF3000
trusted library allocation
page read and write
5053000
heap
page read and write
2B7D000
trusted library allocation
page read and write
4EA1000
trusted library allocation
page read and write
297E000
trusted library allocation
page read and write
3AA9000
trusted library allocation
page read and write
273E000
stack
page read and write
C4E000
stack
page read and write
4EB2000
trusted library allocation
page read and write
5430000
heap
page read and write
D7D000
trusted library allocation
page execute and read and write
6D2000
unkown
page readonly
4E9E000
trusted library allocation
page read and write
4C4C000
stack
page read and write
2870000
trusted library allocation
page read and write
51D0000
trusted library allocation
page read and write
66EE000
trusted library allocation
page read and write
CD0000
heap
page read and write
66AB000
trusted library allocation
page read and write
D4B000
heap
page read and write
2B91000
trusted library allocation
page read and write
CD2000
heap
page read and write
5010000
heap
page read and write
2B04000
trusted library allocation
page read and write
66E0000
trusted library allocation
page read and write
C9E000
heap
page read and write
6FCB000
trusted library allocation
page read and write
2986000
trusted library allocation
page read and write
C00000
heap
page read and write
C00000
heap
page read and write
6D0000
unkown
page readonly
51E0000
heap
page read and write
2844000
trusted library allocation
page read and write
5040000
trusted library allocation
page read and write
2B95000
trusted library allocation
page read and write
2CE9000
trusted library allocation
page read and write
2C2A000
trusted library allocation
page read and write
52C0000
trusted library allocation
page execute and read and write
6BC0000
heap
page read and write
2862000
trusted library allocation
page read and write
4F4D000
stack
page read and write
D80000
heap
page read and write
2820000
trusted library allocation
page read and write
D73000
trusted library allocation
page execute and read and write
2810000
trusted library allocation
page execute and read and write
2866000
trusted library allocation
page execute and read and write
287B000
trusted library allocation
page execute and read and write
4E86000
trusted library allocation
page read and write
2B38000
trusted library allocation
page read and write
3A69000
trusted library allocation
page read and write
2AAF000
stack
page read and write
610E000
stack
page read and write
66FB000
trusted library allocation
page read and write
53F0000
trusted library allocation
page execute and read and write
DB9000
heap
page read and write
2BEE000
trusted library allocation
page read and write
2930000
heap
page read and write
634D000
stack
page read and write
2890000
trusted library allocation
page read and write
2CE3000
trusted library allocation
page read and write
There are 259 hidden memdumps, click here to show them.