IOC Report
Br_i421i2-2481-125_754864.msi

loading gif

Files

File Path
Type
Category
Malicious
Br_i421i2-2481-125_754864.msi
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {2DB5220B-06B7-4340-8D25-6BB9D51802F1}, Number of Words: 10, Subject: Acrobat Reader, Author: Acrobat Reader, Name of Creating Application: Acrobat Reader, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o Acrobat Reader., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Wed May 22 20:11:17 2024, Number of Pages: 200
initial sample
 malicious
C:\Config.Msi\4b3b29.rbs
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.1
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.10
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.100
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.101
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.102
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.103
OpenPGP Secret Key
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.104
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.105
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.106
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.107
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.109
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.11
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.110
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.111
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.112
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.113
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.114
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.115
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.116
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.117
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.118
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.119
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.12
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.120
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.121
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.122
OpenPGP Secret Key
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.123
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.124
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.125
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.126
OpenPGP Public Key
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.127
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.128
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.129
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.13
PGP Secret Sub-key -
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.130
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.131
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.132
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.133
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.134
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.14
DOS executable (COM, 0x8C-variant)
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.15
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.16
OpenPGP Public Key
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.17
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.18
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.19
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.2
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.20
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.21
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.22
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.23
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.24
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.25
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.26
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.27
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.28
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.29
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.3
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.30
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.31
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.32
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.33
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.34
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.35
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.36
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.37
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.38
OpenPGP Secret Key
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.39
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.4
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.40
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.41
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.42
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.43
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.44
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.45
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.46
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.47
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.48
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.49
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.5
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.50
COM executable for DOS
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.51
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.52
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.53
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.54
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.55
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.56
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.57
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.58
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.59
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.6
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.60
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.61
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.62
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.63
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.64
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.65
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.66
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.67
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.68
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.69
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.7
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.70
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.71
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.72
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.73
OpenPGP Public Key
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.74
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.75
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.76
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.77
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.78
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.79
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.8
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.80
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.81
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.82
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.83
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.84
OpenPGP Secret Key
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.85
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.86
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.87
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.88
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.89
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.9
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.90
SysEx File -
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.91
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.92
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.93
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.94
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.95
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.96
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.97
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.98
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.99
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\pss43F5.ps1
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\scr43E3.ps1
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\appData\24052024.zip
data
dropped
 malicious
C:\Users\user\AppData\Local\appData\WebExperienceHostApp.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Windows\Installer\4b3b27.msi
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {2DB5220B-06B7-4340-8D25-6BB9D51802F1}, Number of Words: 10, Subject: Acrobat Reader, Author: Acrobat Reader, Name of Creating Application: Acrobat Reader, Template: ;1046, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o Acrobat Reader., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Wed May 22 20:11:17 2024, Number of Pages: 200
dropped
 malicious
C:\Windows\Installer\MSI3E49.tmp
data
dropped
 malicious
C:\ProgramData\Chrome\Application\118.0.5993.120\124.0.6367.119.manifest
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Chrome\Application\118.0.5993.120\Extensions\external_extensions_0000x.108
data
dropped
C:\ProgramData\Chrome\Application\118.0.5993.120\chrome.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\Chrome\Application\118.0.5993.120\chrome_100_percent.pak
data
dropped
C:\ProgramData\Chrome\Application\118.0.5993.120\chrome_elf.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\Chrome\Application\118.0.5993.120\chrome_pwa_launcher.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\Chrome\Application\118.0.5993.120\file.cur
MS Windows cursor resource - 1 icon, 32x32, hotspot @0x0
dropped
C:\ProgramData\Chrome\Application\118.0.5993.120\vk_swiftshader_icd.json
ASCII text, with no line terminators
dropped
C:\ProgramData\Chrome\Application\118.0.5993.120\vulkan-1.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_chrome.exe_c93e2ab35bf4e24e0cdcd22579377d3186fb6_5aba68d6_97dfc3d3-9e4c-4157-8c91-42bd7040bc82\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER25E5.tmp.dmp
Mini DuMP crash report, 14 streams, Fri May 24 19:00:17 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER26F0.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2720.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\Pro43F6.tmp
ASCII text
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4l0adzgv.f10.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eqfxtzvr.pkr.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\appData\mrt100_app.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\appData\msvcp140_app.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\appData\vcamp140_app.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\appData\vccorlib140_app.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\appData\vcomp140_app.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\appData\vcruntime140_1_app.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\appData\vcruntime140_app.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\appData\xmpp.dll
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI3CCD.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI3D2C.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI3D4C.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI3D6C.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI3DBC.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI435B.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
modified
C:\Windows\Installer\SourceHash{B95F3E55-F3A2-459E-ACB1-42A9918E3822}
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Installer\inprogressinstallinfo.ipi
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
C:\Windows\Temp\~DF030AC1A6B470813A.TMP
data
dropped
C:\Windows\Temp\~DF249FF4A81CEC50A5.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DF2F56BE0322273DFA.TMP
data
dropped
C:\Windows\Temp\~DF3ACE805C130034D7.TMP
data
dropped
C:\Windows\Temp\~DF45C782A85B1BC005.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DF6AC326494C7E6F0F.TMP
data
dropped
C:\Windows\Temp\~DF713A5559E2D8AB5D.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DF737FEAFB5F47DDDF.TMP
data
dropped
C:\Windows\Temp\~DFA6F00C61547C5A95.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DFCADE276437B8876E.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DFD735E1EFE24DAF39.TMP
data
dropped
C:\Windows\Temp\~DFF86D41EBB18B0485.TMP
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 179 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Br_i421i2-2481-125_754864.msi"
malicious
C:\Windows\System32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
 malicious
C:\Windows\SysWOW64\msiexec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 182CBD29A8DE3C0ACD2328E3D85CE97B
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
-NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pss43F5.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msi43E2.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scr43E3.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scr43E4.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
malicious
C:\Users\user\AppData\Local\appData\WebExperienceHostApp.exe
"C:\Users\user\AppData\Local\appData\WebExperienceHostApp.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\ProgramData\Chrome\Application\118.0.5993.120\chrome.exe
C:\ProgramData\Chrome\Application\118.0.5993.120\chrome.exe
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2500 -s 580

URLs

Name
IP
Malicious
http://pesterbdd.com/images/Pester.png
unknown
 malicious
http://nuget.org/NuGet.exe
unknown
https://crashpad.chromium.org/
unknown
https://advocaciavirtualmw.com/ProcessosAbril/processojudiciario.gov.br
unknown
http://www.apachefriends.org/f/viewforum.php?f=4
unknown
https://bost.blob.core.wi
unknown
http://schemas.xmlsoap.org/soap/encoding/
unknown
https://advocaciavirtualmw.com/ProcessosAbril/processojudiciario.gov.brFMX_STYLE
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
unknown
https://go.micro
unknown
https://crashpad.chromium.org/bug/new
unknown
http://www.movable-type.co.uk/scripts/xxtea.pdf
unknown
http://tools.ietf.org/html/rfc1321
unknown
https://contoso.com/License
unknown
https://jaspreser.dev.br/.well-known/acme-challenge/Relatorios_xls_mensal
unknown
http://schemas.xmlsoap.org/soap/envelope/
unknown
http://www.csrc.nist.gov/publications/fips/fips197/fips-197.pdf
unknown
http://www.schneier.com/paper-twofish-paper.pdf
unknown
https://contoso.com/Icon
unknown
https://bost.blo
unknown
http://www.ietf.org/rfc/rfc3447.txt
unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
unknown
http://www.schneier.com/paper-blowfish-fse.html
unknown
https://github.com/Pester/Pester
unknown
http://www.itl.nist.gov/fipspubs/fip180-1.htm
unknown
http://crl.microQ
unknown
http://csrc.nist.gov/publications/drafts/800-67-rev1/SP-800-67-rev1-2_July-2011.pdf
unknown
http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdf
unknown
http://www.apachefriends.org/f/viewforum.php?f=16
unknown
http://csrc.nist.gov/publications/drafts/fips180-4/Draft-FIPS180-4_Feb2011.pdf
unknown
http://www.borland.com/namespaces/Types
unknown
https://aka.ms/pscore6lB
unknown
http://tools.ietf.org/html/rfc4648
unknown
https://bost.blo(f
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
http://www.borland.com/namespaces/Types03
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://schemas.xmlsoap.org/soap/encoding/03
unknown
There are 30 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Owner
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
SessionHash
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Sequence
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Config.Msi\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\4b3b29.rbs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\4b3b29.rbsLow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Users\user\AppData\Roaming\Microsoft\Installer\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\6C6D806D1D1EFE84EA93068356D28D04
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\C8F7E0D08C4B68946A3723E7CD17EE4C
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\9A67AB190820F794FB0C4A7CC5BD6020
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\F89130AF293B4314DA02FD92CA534214
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\B3680D584F89FA444BCE3497635CFBCE
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\47C7E68572914D14C9B62A09F304C89C
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\0D753F396707A4640A184929109E6ACF
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\0CC61C26A19633D49B59BEC768E070E4
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\FCCF92553A74A644195433EA35C18848
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\6D32A2A1BC8329E4095F9C4421DEFE55
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\8A379BD0A10B8E7459DD14F9C51571B1
55E3F59B2A3FE954CA1B249A19E88322
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Users\user\AppData\Roaming\Acrobat Reader\Acrobat Reader\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Users\user\AppData\Roaming\Acrobat Reader\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Users\user\AppData\Local\appData\
HKEY_CURRENT_USER\SOFTWARE\Acrobat Reader\Acrobat Reader
Version
HKEY_CURRENT_USER\SOFTWARE\Acrobat Reader\Acrobat Reader
Path
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\24\417C44EB
@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\24\417C44EB
@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
ProgramId
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
FileId
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
LowerCaseLongPath
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
LongPathHash
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
Name
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
OriginalFileName
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
Publisher
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
Version
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
BinFileVersion
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
BinaryType
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
ProductName
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
ProductVersion
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
LinkDate
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
BinProductVersion
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
AppxPackageFullName
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
AppxPackageRelativeId
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
Size
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
Language
\REGISTRY\A\{cade70b0-b3ec-4f6c-c5da-e1b110683ab2}\Root\InventoryApplicationFile\chrome.exe|224cc4ccfcb0403c
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018800E276D7437
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
There are 52 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
7FF63EF9F000
unkown
page readonly
7B00000
trusted library allocation
page read and write
6A3E000
stack
page read and write
6622D000
unkown
page read and write
7FF61949A000
unkown
page readonly
40AE000
stack
page read and write
6615F000
unkown
page write copy
9C000
stack
page read and write
150000
heap
page read and write
64183000
unkown
page execute read
65520000
unkown
page readonly
1DF000
stack
page read and write
6BA6000
heap
page read and write
4652BFD000
stack
page read and write
6616D000
unkown
page read and write
85818FF000
stack
page read and write
7FF63EFE1000
unkown
page read and write
6616A000
unkown
page write copy
65552000
unkown
page execute read
6623B000
unkown
page read and write
4DDF000
trusted library allocation
page read and write
66259000
unkown
page read and write
6C40000
trusted library allocation
page read and write
7FF61949A000
unkown
page readonly
641BC000
unkown
page execute read
7DF492510000
direct allocation
page read and write
1CDA8280000
heap
page read and write
D8000
stack
page read and write
5F0000
trusted library allocation
page read and write
7DF490450000
direct allocation
page read and write
4E9000
heap
page read and write
7FF63EF9F000
unkown
page readonly
7FFE1A467000
unkown
page readonly
1CDA9D5B000
direct allocation
page read and write
4651C33000
unkown
page readonly
6ABE000
stack
page read and write
1CDA9D2B000
direct allocation
page read and write
1CDA9DD4000
direct allocation
page read and write
7FF63EFE2000
unkown
page write copy
7FF63EFEF000
unkown
page write copy
7DF4924A0000
direct allocation
page read and write
6619A000
unkown
page read and write
7FF63EDB1000
unkown
page execute read
6621E000
unkown
page write copy
7FF63F010000
unkown
page execute read
6625E000
unkown
page read and write
661F4000
unkown
page write copy
66183000
unkown
page write copy
8581AFE000
stack
page read and write
1CDA9D8E000
direct allocation
page read and write
4654BFE000
stack
page read and write
1CDA9DAD000
direct allocation
page read and write
65521000
unkown
page execute read
1CDA846E000
heap
page read and write
22384E50000
heap
page read and write
7BBE000
stack
page read and write
1CDA9E00000
heap
page read and write
7AF0000
trusted library allocation
page read and write
61A000
trusted library allocation
page execute and read and write
6DA0000
trusted library allocation
page read and write
1CDA9DE3000
direct allocation
page read and write
66156000
unkown
page write copy
66137000
unkown
page write copy
7FF619491000
unkown
page execute read
27E0000
heap
page read and write
66175000
unkown
page read and write
6C00000
heap
page read and write
64DF4000
unkown
page execute read
7FFE1A451000
unkown
page execute read
7FF63F00F000
unkown
page readonly
455D000
stack
page read and write
1CDA9D9C000
direct allocation
page read and write
402C000
stack
page read and write
66167000
unkown
page write copy
6615A000
unkown
page write copy
22384E55000
heap
page read and write
22384BD0000
heap
page read and write
66132000
unkown
page write copy
6FA0000
trusted library allocation
page read and write
63E6A000
unkown
page write copy
85819FE000
stack
page read and write
66159000
unkown
page read and write
6C70000
trusted library allocation
page read and write
6625F000
unkown
page write copy
40EE000
stack
page read and write
1CDA842C000
heap
page read and write
7FF63EDB0000
unkown
page readonly
7FF63F011000
unkown
page readonly
1CDA8420000
heap
page read and write
7FF63EFE1000
unkown
page write copy
7FF619491000
unkown
page execute read
6DB0000
trusted library allocation
page read and write
4651BFB000
stack
page read and write
7DF492250000
direct allocation
page read and write
66256000
unkown
page read and write
7FFE007A1000
unkown
page execute read
66133000
unkown
page read and write
7A00000
trusted library allocation
page read and write
7A90000
heap
page read and write
66224000
unkown
page write copy
661FE000
unkown
page read and write
80FF000
stack
page read and write
6BCD000
heap
page read and write
63B52000
unkown
page execute read
4565000
heap
page execute and read and write
4030000
trusted library allocation
page execute and read and write
49DB000
trusted library allocation
page read and write
609000
trusted library allocation
page read and write
7DF4924F0000
direct allocation
page read and write
4651C01000
unkown
page readonly
7FFE1A466000
unkown
page read and write
7FF619490000
unkown
page readonly
7DF4924C0000
direct allocation
page read and write
6F50000
trusted library allocation
page read and write
6A7E000
stack
page read and write
1CDA9DB8000
direct allocation
page read and write
66258000
unkown
page write copy
6402D000
unkown
page readonly
85816FE000
stack
page read and write
591000
heap
page read and write
4819000
trusted library allocation
page read and write
68C0000
heap
page read and write
539000
heap
page read and write
4117000
heap
page read and write
561E000
trusted library allocation
page read and write
65473000
unkown
page readonly
66162000
unkown
page write copy
1CDA9DAB000
direct allocation
page read and write
7DF490450000
direct allocation
page read and write
22384BD9000
heap
page read and write
4040000
trusted library allocation
page read and write
6F90000
trusted library allocation
page read and write
6F40000
trusted library allocation
page read and write
7FF63F010000
unkown
page execute read
1CDA9DDC000
direct allocation
page read and write
1CDA9DCD000
direct allocation
page read and write
6F0D000
stack
page read and write
6625B000
unkown
page write copy
6BC5000
heap
page read and write
7E40000
heap
page read and write
7DF492250000
direct allocation
page read and write
1CDA9CFB000
direct allocation
page read and write
65EE000
stack
page read and write
677E000
stack
page read and write
66231000
unkown
page write copy
5F4000
trusted library allocation
page read and write
449F000
stack
page read and write
6612D000
unkown
page write copy
6615D000
unkown
page read and write
6622E000
unkown
page write copy
7DF4924D4000
direct allocation
page read and write
46523F9000
unkown
page readonly
4651DEE000
unkown
page readonly
47E000
stack
page read and write
4A73000
trusted library allocation
page read and write
63152000
unkown
page execute read
7E68000
heap
page read and write
6612C000
unkown
page read and write
6BA0000
heap
page read and write
79F0000
trusted library allocation
page read and write
1CDA8405000
heap
page read and write
1CDA9D95000
direct allocation
page read and write
6616E000
unkown
page write copy
64027000
unkown
page write copy
7FFE007A0000
unkown
page readonly
7AA0000
trusted library allocation
page execute and read and write
5B0000
heap
page read and write
7DFE000
stack
page read and write
4951000
trusted library allocation
page read and write
19E000
stack
page read and write
1CDA843E000
heap
page read and write
7A8E000
stack
page read and write
66268000
unkown
page readonly
620000
trusted library allocation
page read and write
7FFE00823000
unkown
page read and write
1CDAA250000
heap
page read and write
66201000
unkown
page write copy
5B5000
heap
page read and write
6612F000
unkown
page read and write
1CDA8429000
heap
page read and write
7FF63F00F000
unkown
page readonly
22384B30000
heap
page read and write
66135000
unkown
page write copy
4B6B000
trusted library allocation
page read and write
6E4E000
stack
page read and write
49C8000
trusted library allocation
page read and write
22384A50000
heap
page read and write
6614C000
unkown
page write copy
511000
heap
page read and write
6621C000
unkown
page write copy
64DF3000
unkown
page read and write
7FF61949E000
unkown
page write copy
1CDA9D4A000
direct allocation
page read and write
4060000
heap
page read and write
1CDA9DF1000
direct allocation
page read and write
6C77000
trusted library allocation
page read and write
6C91000
heap
page read and write
7FFE00827000
unkown
page readonly
1CDA9D7F000
direct allocation
page read and write
63120000
unkown
page readonly
1CDA9DBF000
direct allocation
page read and write
66262000
unkown
page write copy
807E000
stack
page read and write
7DF491850000
direct allocation
page read and write
66239000
unkown
page read and write
1CDA8360000
heap
page read and write
49FD000
trusted library allocation
page read and write
6F70000
trusted library allocation
page read and write
66161000
unkown
page read and write
6621B000
unkown
page read and write
7FFE007F5000
unkown
page readonly
6DA7000
trusted library allocation
page read and write
85817FD000
stack
page read and write
7DF4924DD000
direct allocation
page read and write
7DF4924BE000
direct allocation
page read and write
55B1000
trusted library allocation
page read and write
7FF61949F000
unkown
page readonly
7B30000
heap
page read and write
6614B000
unkown
page read and write
490000
heap
page read and write
66240000
unkown
page read and write
4110000
heap
page read and write
7FF63EFEF000
unkown
page write copy
66136000
unkown
page read and write
7F990000
trusted library allocation
page execute and read and write
4651C38000
unkown
page readonly
3FD8000
trusted library allocation
page read and write
6E8E000
stack
page read and write
1CDA9D86000
direct allocation
page read and write
6613A000
unkown
page write copy
600000
trusted library allocation
page read and write
85813D8000
stack
page read and write
7FF619490000
unkown
page readonly
6FB0000
trusted library allocation
page read and write
625000
trusted library allocation
page execute and read and write
661F2000
unkown
page read and write
66146000
unkown
page write copy
66235000
unkown
page read and write
451E000
stack
page read and write
661CA000
unkown
page write copy
6BB0000
heap
page read and write
1E0000
heap
page read and write
6621D000
unkown
page read and write
45A0000
heap
page execute and read and write
7B7D000
stack
page read and write
7DF4924A0000
direct allocation
page read and write
46533FE000
unkown
page readonly
6626A000
unkown
page readonly
6DF5000
trusted library allocation
page read and write
6B91000
heap
page read and write
63121000
unkown
page execute read
490E000
trusted library allocation
page read and write
7FF63EFFB000
unkown
page readonly
43E000
stack
page read and write
5FD000
trusted library allocation
page execute and read and write
689C000
unkown
page read and write
52B000
heap
page read and write
4651C7B000
unkown
page readonly
7FF61949F000
unkown
page readonly
1CDA9D24000
direct allocation
page read and write
7A4D000
stack
page read and write
6F80000
trusted library allocation
page read and write
1CDA9CF4000
direct allocation
page read and write
2780000
trusted library allocation
page read and write
49EB000
trusted library allocation
page read and write
6C50000
trusted library allocation
page execute and read and write
7FF63EFFB000
unkown
page readonly
6C30000
heap
page execute and read and write
64BBC000
unkown
page execute read
80BE000
stack
page read and write
4B8000
heap
page read and write
27D0000
heap
page readonly
6ECE000
stack
page read and write
66169000
unkown
page read and write
66166000
unkown
page read and write
66223000
unkown
page read and write
5E0000
trusted library allocation
page read and write
1CDA9D0D000
direct allocation
page read and write
6BED000
heap
page read and write
6619B000
unkown
page write copy
7DF490E50000
direct allocation
page read and write
45B1000
trusted library allocation
page read and write
27E9000
heap
page read and write
7E3E000
stack
page read and write
27CE000
stack
page read and write
6F30000
trusted library allocation
page read and write
66138000
unkown
page read and write
622000
trusted library allocation
page read and write
1CDAA493000
direct allocation
page read and write
6D90000
trusted library allocation
page read and write
5F3000
trusted library allocation
page execute and read and write
6F60000
trusted library allocation
page read and write
6B30000
heap
page read and write
4B0000
heap
page read and write
7FF63F011000
unkown
page readonly
22384B60000
heap
page read and write
63ED9000
unkown
page write copy
49C5000
trusted library allocation
page read and write
66177000
unkown
page write copy
6F20000
trusted library allocation
page read and write
6401D000
unkown
page write copy
4652191000
unkown
page readonly
66155000
unkown
page read and write
1CDA9DC6000
direct allocation
page read and write
1CDA8400000
heap
page read and write
7FFE1A450000
unkown
page readonly
7DF491850000
direct allocation
page read and write
6BB4000
heap
page read and write
4DC000
heap
page read and write
6FC0000
trusted library allocation
page read and write
6FD0000
trusted library allocation
page read and write
1CDA9DA3000
direct allocation
page read and write
1CDA9D54000
direct allocation
page read and write
4653BFE000
stack
page read and write
49D9000
trusted library allocation
page read and write
7DF490E50000
direct allocation
page read and write
4A4F000
trusted library allocation
page read and write
4651C7F000
unkown
page readonly
7AE0000
trusted library allocation
page read and write
7FF63EFF0000
unkown
page read and write
66230000
unkown
page read and write
55D9000
trusted library allocation
page read and write
1CDA8380000
heap
page read and write
1CDA9CC0000
direct allocation
page read and write
66145000
unkown
page read and write
6B80000
heap
page read and write
3FD0000
trusted library allocation
page read and write
67BA000
stack
page read and write
69FC000
stack
page read and write
3FCF000
stack
page read and write
6FE0000
trusted library allocation
page execute and read and write
1CDA9D37000
direct allocation
page read and write
49E7000
trusted library allocation
page read and write
7FF61949E000
unkown
page read and write
6E09000
trusted library allocation
page read and write
661C9000
unkown
page read and write
1CDA9D69000
direct allocation
page read and write
7FF63EDB0000
unkown
page readonly
46553FE000
unkown
page readonly
1CDA83D0000
direct allocation
page execute and read and write
7DF4924A0000
direct allocation
page read and write
6F10000
trusted library allocation
page read and write
44DE000
stack
page read and write
7FFE1A461000
unkown
page readonly
8581BFE000
stack
page read and write
79C0000
heap
page read and write
4706000
trusted library allocation
page read and write
7FF63EDB1000
unkown
page execute read
6E00000
trusted library allocation
page read and write
1CDA9D78000
direct allocation
page read and write
6402F000
unkown
page readonly
4613000
trusted library allocation
page read and write
4560000
heap
page execute and read and write
7E60000
heap
page read and write
65F52000
unkown
page execute read
1CDA9D14000
direct allocation
page read and write
There are 346 hidden memdumps, click here to show them.