Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
IwSPayUcGx.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_IwSPayUcGx.exe_c5fc5f7d961217a99c72b24fb7ccb16025b5aab2_5a636975_da6c2c1a-4877-49d3-814e-eb855b36617a\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE8F.tmp.dmp
|
Mini DuMP crash report, 16 streams, Thu Oct 31 19:11:03 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFE7.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF017.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\IwSPayUcGx.exe
|
"C:\Users\user\Desktop\IwSPayUcGx.exe"
|
|
|
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 4764 -s 1652
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
23.ip.gl.ply.gg
|
|
||
|
147.185.221.23
|
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ip-api.com/line/?fields=hosting
|
208.95.112.1
|
||
|
http://ip-api.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
ip-api.com
|
208.95.112.1
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.95.112.1
|
ip-api.com
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IwSPayUcGx_RASMANCS
|
FileDirectory
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
ProgramId
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
FileId
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
LongPathHash
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
Name
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
OriginalFileName
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
Publisher
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
Version
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
BinFileVersion
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
BinaryType
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
ProductName
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
ProductVersion
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
LinkDate
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
BinProductVersion
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
Size
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
Language
|
||
|
\REGISTRY\A\{2eefec0d-8cf1-eb6d-732a-30ae5dcaf256}\Root\InventoryApplicationFile\iwspayucgx.exe|62cbf5c746110e15
|
Usn
|
There are 23 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
332000
|
unkown
|
page readonly
|
|
|
|
263C000
|
trusted library allocation
|
page read and write
|
|
|
|
7FF848E20000
|
trusted library allocation
|
page read and write
|
||
|
7FE000
|
heap
|
page read and write
|
||
|
D4E000
|
stack
|
page read and write
|
||
|
7FF848D74000
|
trusted library allocation
|
page read and write
|
||
|
26C3000
|
trusted library allocation
|
page read and write
|
||
|
77C000
|
heap
|
page read and write
|
||
|
7FF848D9B000
|
trusted library allocation
|
page execute and read and write
|
||
|
AB0000
|
heap
|
page read and write
|
||
|
84F000
|
heap
|
page read and write
|
||
|
7FC000
|
heap
|
page read and write
|
||
|
2620000
|
heap
|
page execute and read and write
|
||
|
1B21E000
|
stack
|
page read and write
|
||
|
770000
|
heap
|
page read and write
|
||
|
854000
|
heap
|
page read and write
|
||
|
12631000
|
trusted library allocation
|
page read and write
|
||
|
1B441000
|
heap
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
1B11B000
|
stack
|
page read and write
|
||
|
26D9000
|
trusted library allocation
|
page read and write
|
||
|
1AF70000
|
heap
|
page execute and read and write
|
||
|
C40000
|
heap
|
page read and write
|
||
|
25EE000
|
stack
|
page read and write
|
||
|
12638000
|
trusted library allocation
|
page read and write
|
||
|
1B41E000
|
stack
|
page read and write
|
||
|
BC3000
|
trusted library allocation
|
page read and write
|
||
|
776000
|
heap
|
page read and write
|
||
|
1B420000
|
heap
|
page read and write
|
||
|
1BB5D000
|
stack
|
page read and write
|
||
|
1B31E000
|
stack
|
page read and write
|
||
|
26C6000
|
trusted library allocation
|
page read and write
|
||
|
2631000
|
trusted library allocation
|
page read and write
|
||
|
7DE000
|
heap
|
page read and write
|
||
|
7FF848E90000
|
trusted library allocation
|
page execute and read and write
|
||
|
1BA5E000
|
stack
|
page read and write
|
||
|
7A0000
|
heap
|
page read and write
|
||
|
1B85E000
|
stack
|
page read and write
|
||
|
7B3000
|
heap
|
page read and write
|
||
|
710000
|
heap
|
page read and write
|
||
|
C45000
|
heap
|
page read and write
|
||
|
384000
|
unkown
|
page readonly
|
||
|
26CC000
|
trusted library allocation
|
page read and write
|
||
|
7B0000
|
heap
|
page read and write
|
||
|
7FF848E56000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FF848D9D000
|
trusted library allocation
|
page execute and read and write
|
||
|
740000
|
heap
|
page read and write
|
||
|
A3E000
|
stack
|
page read and write
|
||
|
C30000
|
heap
|
page read and write
|
||
|
802000
|
heap
|
page read and write
|
||
|
7FF848D8D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2658000
|
trusted library allocation
|
page read and write
|
||
|
BBE000
|
stack
|
page read and write
|
||
|
7FF848D90000
|
trusted library allocation
|
page read and write
|
||
|
1ABBD000
|
stack
|
page read and write
|
||
|
26D6000
|
trusted library allocation
|
page read and write
|
||
|
79B000
|
heap
|
page read and write
|
||
|
7EA000
|
heap
|
page read and write
|
||
|
7FF848D73000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FF848D7D000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B499000
|
heap
|
page read and write
|
||
|
26E8000
|
trusted library allocation
|
page read and write
|
||
|
7FF848D80000
|
trusted library allocation
|
page read and write
|
||
|
7FF848D83000
|
trusted library allocation
|
page read and write
|
||
|
BC0000
|
trusted library allocation
|
page read and write
|
||
|
1B61B000
|
stack
|
page read and write
|
||
|
A40000
|
heap
|
page read and write
|
||
|
AA0000
|
trusted library allocation
|
page read and write
|
||
|
78F000
|
heap
|
page read and write
|
||
|
26CF000
|
trusted library allocation
|
page read and write
|
||
|
1B010000
|
heap
|
page read and write
|
||
|
342000
|
unkown
|
page readonly
|
||
|
7FF848DCC000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FF4E0580000
|
trusted library allocation
|
page execute and read and write
|
||
|
1B433000
|
heap
|
page read and write
|
||
|
7FF848F12000
|
trusted library allocation
|
page read and write
|
||
|
26D2000
|
trusted library allocation
|
page read and write
|
||
|
7FF848F20000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FF848E30000
|
trusted library allocation
|
page execute and read and write
|
||
|
85D000
|
heap
|
page read and write
|
||
|
6F4000
|
stack
|
page read and write
|
||
|
7FF848E2C000
|
trusted library allocation
|
page execute and read and write
|
||
|
330000
|
unkown
|
page readonly
|
||
|
26C9000
|
trusted library allocation
|
page read and write
|
||
|
1B95E000
|
stack
|
page read and write
|
||
|
AB5000
|
heap
|
page read and write
|
||
|
26F2000
|
trusted library allocation
|
page read and write
|
||
|
A80000
|
trusted library allocation
|
page read and write
|
||
|
330000
|
unkown
|
page readonly
|
There are 79 hidden memdumps, click here to show them.