IOC Report
PO#7889296.exe

FilesProcessesURLsDomainsIPsRegistryMemdumps321010010Label

Files

File Path
Type
Category
Malicious
Download
PO#7889296.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegSvcs.exe_bd1742a62c46c3d34c9ea6f7cd9209ba27e2f3c_40336bb7_ce25130b-69e9-49ce-aaac-61d04bac2106\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F08.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Mar 27 19:53:23 2025, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4217.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER42A4.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\aut2E7E.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\flexuoseness
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PO#7889296.exe
"C:\Users\user\Desktop\PO#7889296.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\PO#7889296.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 1476

URLs

Name
IP
Malicious
http://upx.sf.net
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
158.101.44.242
http://checkip.dyndns.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
https://reallyfreegeoip.org/xml/
unknown

Domains

Name
IP
Malicious
checkip.dyndns.com
158.101.44.242
checkip.dyndns.org
unknown

IPs

IP
Domain
Country
Malicious
158.101.44.242
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
ProgramId
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
FileId
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
LowerCaseLongPath
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
LongPathHash
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
Name
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
OriginalFileName
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
Publisher
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
Version
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
BinFileVersion
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
BinaryType
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
ProductName
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
ProductVersion
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
LinkDate
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
BinProductVersion
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
AppxPackageFullName
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
AppxPackageRelativeId
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
Size
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
Language
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
IsOsComponent
\REGISTRY\A\{2a892d91-9b32-d4b2-e6b2-3a4fc5c1d17f}\Root\InventoryApplicationFile\regsvcs.exe|bc5951771b601cae
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018C00B8F8B0D2B
There are 29 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
402000
system
page execute and read and write
 malicious
3071000
trusted library allocation
page read and write
 malicious
16D0000
direct allocation
page read and write
 malicious
1986000
heap
page read and write
5650000
heap
page read and write
E04000
unkown
page readonly
54B0000
heap
page read and write
157E000
stack
page read and write
1940000
heap
page read and write
4103000
direct allocation
page read and write
584F000
stack
page read and write
42AD000
direct allocation
page read and write
12EB000
trusted library allocation
page execute and read and write
CEA000
stack
page read and write
306F000
stack
page read and write
3FE0000
direct allocation
page read and write
118E000
stack
page read and write
11A5000
heap
page read and write
17C0000
heap
page read and write
24FE000
stack
page read and write
612E000
stack
page read and write
1900000
heap
page read and write
42AD000
direct allocation
page read and write
13C2000
heap
page read and write
E04000
unkown
page readonly
431E000
direct allocation
page read and write
12BD000
trusted library allocation
page execute and read and write
42A9000
direct allocation
page read and write
1986000
heap
page read and write
15D6000
trusted library allocation
page read and write
113E000
stack
page read and write
15E0000
heap
page read and write
12E2000
trusted library allocation
page read and write
13BE000
heap
page read and write
431E000
direct allocation
page read and write
1300000
trusted library allocation
page read and write
E12000
unkown
page write copy
1986000
heap
page read and write
1A50000
heap
page read and write
59FD000
stack
page read and write
3126000
trusted library allocation
page read and write
4180000
direct allocation
page read and write
D50000
unkown
page readonly
1348000
heap
page read and write
1794000
heap
page read and write
E50000
heap
page read and write
195C000
heap
page read and write
1986000
heap
page read and write
4103000
direct allocation
page read and write
D51000
unkown
page execute read
6488000
heap
page read and write
4103000
direct allocation
page read and write
1790000
heap
page read and write
DF0000
heap
page read and write
646E000
stack
page read and write
12E7000
trusted library allocation
page execute and read and write
E17000
unkown
page readonly
137C000
heap
page read and write
4077000
trusted library allocation
page read and write
16B0000
heap
page read and write
136A000
heap
page read and write
13E9000
heap
page read and write
1790000
trusted library allocation
page read and write
D8B000
stack
page read and write
1934000
heap
page read and write
16EE000
stack
page read and write
17A0000
heap
page read and write
1947000
heap
page read and write
15FC000
stack
page read and write
20FE000
stack
page read and write
5505000
trusted library allocation
page read and write
3FE0000
direct allocation
page read and write
1986000
heap
page read and write
4071000
trusted library allocation
page read and write
42AD000
direct allocation
page read and write
1A31000
heap
page read and write
3FE0000
direct allocation
page read and write
E0E000
unkown
page read and write
FAE000
stack
page read and write
431E000
direct allocation
page read and write
64B2000
heap
page read and write
15CE000
stack
page read and write
12B4000
trusted library allocation
page read and write
E0E000
unkown
page write copy
1320000
trusted library allocation
page read and write
1377000
heap
page read and write
42A9000
direct allocation
page read and write
15C0000
heap
page execute and read and write
D51000
unkown
page execute read
516E000
stack
page read and write
1908000
heap
page read and write
5A3E000
stack
page read and write
42AD000
direct allocation
page read and write
1140000
heap
page read and write
E17000
unkown
page readonly
12A0000
trusted library allocation
page read and write
12E0000
trusted library allocation
page read and write
311C000
trusted library allocation
page read and write
1987000
heap
page read and write
5870000
heap
page execute and read and write
431E000
direct allocation
page read and write
431E000
direct allocation
page read and write
1946000
heap
page execute and read and write
3139000
trusted library allocation
page read and write
153E000
stack
page read and write
431E000
direct allocation
page read and write
5A7E000
stack
page read and write
1A70000
heap
page read and write
179B000
trusted library allocation
page read and write
13F3000
heap
page read and write
15DB000
stack
page read and write
3FE0000
direct allocation
page read and write
632E000
stack
page read and write
1340000
heap
page read and write
1924000
heap
page read and write
11A0000
heap
page read and write
12B3000
trusted library allocation
page execute and read and write
17C0000
heap
page read and write
4180000
direct allocation
page read and write
193F000
heap
page execute and read and write
1A30000
heap
page read and write
622E000
stack
page read and write
19A6000
heap
page read and write
311E000
trusted library allocation
page read and write
1310000
trusted library allocation
page execute and read and write
1330000
heap
page read and write
636E000
stack
page read and write
4103000
direct allocation
page read and write
3FE0000
direct allocation
page read and write
4103000
direct allocation
page read and write
42A9000
direct allocation
page read and write
194D000
heap
page read and write
3123000
trusted library allocation
page read and write
13BC000
heap
page read and write
3FE0000
direct allocation
page read and write
15D0000
trusted library allocation
page read and write
4099000
trusted library allocation
page read and write
1957000
heap
page read and write
DDF000
unkown
page readonly
DDF000
unkown
page readonly
4180000
direct allocation
page read and write
42A9000
direct allocation
page read and write
42A9000
direct allocation
page read and write
4103000
direct allocation
page read and write
4180000
direct allocation
page read and write
1947000
heap
page read and write
1A30000
heap
page read and write
6470000
heap
page read and write
135E000
heap
page read and write
13DA000
heap
page read and write
1932000
heap
page read and write
193B000
heap
page read and write
12C0000
trusted library allocation
page read and write
16A0000
heap
page read and write
12D6000
trusted library allocation
page execute and read and write
42A9000
direct allocation
page read and write
557D000
stack
page read and write
3136000
trusted library allocation
page read and write
4180000
direct allocation
page read and write
42AD000
direct allocation
page read and write
5510000
trusted library allocation
page read and write
42AD000
direct allocation
page read and write
4180000
direct allocation
page read and write
400000
system
page execute and read and write
15BE000
stack
page read and write
12D0000
trusted library allocation
page read and write
10F7000
stack
page read and write
1986000
heap
page read and write
12DA000
trusted library allocation
page execute and read and write
1A30000
heap
page read and write
1A30000
heap
page read and write
FB0000
heap
page read and write
D50000
unkown
page readonly
F6E000
stack
page read and write
1933000
heap
page read and write
15BE000
stack
page read and write
There are 166 hidden memdumps, click here to show them.