IOC Report
BRWgvKaqbg.exe

loading gif

Files

File Path
Type
Category
Malicious
BRWgvKaqbg.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BRWgvKaqbg.exe_b6c6e8b22b35c86acca60f780f38ec328115af3_0005ee48_b107b2da-c7d6-4430-a6d2-0f523ea64a9c\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\AdobeUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\AdobeUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vidar2606[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\meta2606[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rise2606[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\ZAu2iiJBgBZikoF1oNNHtbO.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\IEGCBAAFHDHD\AEHDAK
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\IEGCBAAFHDHD\BAAEHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IEGCBAAFHDHD\BFBGDG
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IEGCBAAFHDHD\CBGCBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
modified
C:\ProgramData\IEGCBAAFHDHD\CGIDAA
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\IEGCBAAFHDHD\GCBFBG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IEGCBAAFHDHD\GIJKKK
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IEGCBAAFHDHD\JKFIDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_hhUml7ndoUuFxb5W_7c8bb9e7d4154313993856830b87ad59d2f2a36_af79d7e5_93a07a46-5643-4aea-9796-cacce3f40be0\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_pQuKvF5V8lUXfe4t_8f8a31e2ed27b79cf4645132220486dc9919971_5bc60ba8_15382b18-ce8d-4169-a942-c61da0a41211\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s7jOcwxjI7k0XEca_b8c743ab1b26314ff4eb66311a29ecf38ef3b8d_a87f9504_c293dfb7-dcd6-476b-a2f9-a26394e0cfea\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D86.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Jun 27 04:44:05 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E04.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E72.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER79D3.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Jun 27 04:44:21 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A32.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A91.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER80B9.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Jun 27 04:44:23 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8221.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8271.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8879.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Jun 27 04:44:25 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER88F7.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8937.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\47LGWxSXkkh6History
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\4wopRLcaQo0qWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\CvldljVivtL9Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\InhatOZKHAApCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\YJcoh5NNqoq7History
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\aGEJHGYaStQIHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\atr5zp8nilwZWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\bgn9REcfAHdLWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\dusa44mwY53bWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ev40y13uGHnnWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\lU8UsNjxYsOULogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\mYGOn6W5YhkUHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\nUdtXUIwk_H6Login Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\wMAXHCLX6SHhLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\y3lSsObwURehCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP\Cookies\Chrome_Default.txt
ASCII text, with very long lines (369), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP\History\Firefox_v6zchhhv.default-release.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP\screenshot.png
PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 58 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\BRWgvKaqbg.exe
"C:\Users\user\Desktop\BRWgvKaqbg.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f LG" /sc ONLOGON /rl HIGHEST
malicious
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe
"C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe"
malicious
C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
 malicious
C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 LG" /sc ONLOGON /rl HIGHEST
malicious
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe
"C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 HR" /sc HOURLY /rl HIGHEST
malicious
C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 LG" /sc ONLOGON /rl HIGHEST
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe
"C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 280
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 264
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 320
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 280
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 28 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://5.42.67.8/lumma2606.exe
5.42.67.8
 malicious
http://5.42.67.8/meta2606.exe
5.42.67.8
 malicious
https://t.me/
unknown
 malicious
http://5.42.67.8/vidar2606.exe
5.42.67.8
 malicious
http://5.42.67.8/rise2606.exe
5.42.67.8
 malicious
https://steamcommunity.com/profiles/76561199707802586
malicious
https://t.me/g067n
149.154.167.99
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://49.13.33.235:9000/msvcp140.dllA
unknown
https://duckduckgo.com/ac/?q=
unknown
https://49.13.33.235:9000/msvcp140.dllJ
unknown
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
unknown
https://49.13.33.235:9000/msvcp140.dllD
unknown
https://db-ip.com/
unknown
https://49.13.33.235:9000/al
unknown
http://5.42.67.8/vidar2606.exe3
unknown
https://t.me/risepro
unknown
https://49.13.33.235:9000/vcruntime140.dllt
unknown
http://5.42.67.8/vidar2606.exea
unknown
http://ns.exif/1
unknown
http://5.42.67.8/meta2606.exev
unknown
https://49.13.33.235:9000
unknown
https://discord.com/api/v9/users/
unknown
https://t.me/risepro_botisepro_bot
unknown
https://t.me/RiseProSUPPORT&nd
unknown
http://5.42.67.8/vidar2606.exe_
unknown
https://49.13.33.235:9000/mozglue.dllt
unknown
https://49.13.33.235:9000/softokn3.dllf
unknown
https://api.ip.sb/ip
unknown
http://5.42.67.8/rise2606.exeNp
unknown
https://49.13.33.235:9000/mozglue.dll_
unknown
https://49.13.33.235:9000/mozglue.dllc
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ipinfo.io/I
unknown
https://t.me/RiseProSUPPORT
unknown
https://www.ecosia.org/newtab/
unknown
https://49.13.33.235:9000/d7b7frosoft
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://t.me/risepro_botlater3
unknown
https://49.13.33.235/0
unknown
https://49.13.33.235:9000/
unknown
https://ipinfo.io/=
unknown
https://ipinfo.io/
34.117.186.192
https://www.maxmind.com/en/locate-my-ip-address
unknown
https://db-ip.com/x
unknown
https://ipinfo.io/widget/demo/8.46.123.33?G
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://49.13.33.235/N
unknown
https://49.13.33.235:9000/sqlt.dllb
unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33J
unknown
https://ipinfo.io:443/widget/demo/8.46.123.33
unknown
https://49.13.33.235:9000/B
unknown
https://49.13.33.235:9000/D
unknown
https://49.13.33.235:9000/vcruntime140.dllppet
unknown
https://web.telegram.org
unknown
https://49.13.33.235:9000/freebl3.dll
unknown
https://49.13.33.235:9000tel
unknown
https://db-ip.com/1
unknown
https://api.ip.s
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://49.13.33.235:9000/freebl3.dll-
unknown
https://49.13.33.235:9000aming
unknown
https://49.13.33.235:9000/nss3.dllsoft
unknown
https://49.13.33.235:9000/vcruntime140.dll
unknown
https://ipinfo.io/widget/demo/8.46.123.33
34.117.186.192
https://ipinfo.io/widget/demo/8.46.123.33j
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33
unknown
https://49.13.33.235:9000/sqlt.dll
unknown
https://49.13.33.235:9000/nss3.dll
unknown
https://49.13.33.235:9000/softokn3.dll
unknown
https://t.me/g067nry1neMozilla/5.0
unknown
http://www.sqlite.org/copyright.html.
unknown
https://49.13.33.235:9000/mozglue.dll
unknown
https://49.13.33.235:9000/vcruntime140.dllH
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://49.13.33.235:9000/nss3.dlldll
unknown
http://5.42.67.8/lumma2606.exep
unknown
https://49.13.33.235:9000/vcruntime140.dllB
unknown
https://49.13.33.235:9000/freebl3.dllt
unknown
http://upx.sf.net
unknown
https://49.13.33.235:9000/softokn3.dll;
unknown
https://49.13.33.235:9000csrss.exe
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://49.13.33.235:9000/4)
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://t.me/risepro_bot
unknown
https://49.13.33.235:9000/vcruntime140.dllhs
unknown
https://49.13.33.235:9000cal
unknown
https://49.13.33.235:9000/msvcp140.dll
unknown
https://t.K
unknown
http://5.42.67.8/vidar2606.exe-
unknown
https://49.13.33.235:9000/33.235:9000/
unknown
https://49.13.33.235:9000/vcruntime140.dlle
unknown
http://www.winimage.com/zLibDll
unknown
https://support.mozilla.org
unknown
https://db-ip.com/demo/home.php?s=8.46.123.33
104.26.4.15
http://ns.microsofo/1.2/
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
t.me
149.154.167.99
 malicious
ipinfo.io
34.117.186.192
db-ip.com
104.26.4.15

IPs

IP
Domain
Country
Malicious
5.42.67.8
unknown
Russian Federation
malicious
149.154.167.99
t.me
United Kingdom
malicious
34.117.186.192
ipinfo.io
United States
104.26.4.15
db-ip.com
United States
49.13.33.235
unknown
Germany

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7
 malicious
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
ProgramId
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
FileId
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
LowerCaseLongPath
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
LongPathHash
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
Name
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
OriginalFileName
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
Publisher
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
Version
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
BinFileVersion
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
BinaryType
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
ProductName
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
ProductVersion
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
LinkDate
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
BinProductVersion
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
AppxPackageFullName
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
AppxPackageRelativeId
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
Size
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
Language
\REGISTRY\A\{0b3bf5d3-6b8f-5a08-cf46-f62aca5387a1}\Root\InventoryApplicationFile\brwgvkaqbg.exe|9091b7ea9a8e08bf
Usn
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
ProgramId
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
FileId
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
LowerCaseLongPath
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
LongPathHash
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
Name
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
OriginalFileName
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
Publisher
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
Version
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
BinFileVersion
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
BinaryType
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
ProductName
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
ProductVersion
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
LinkDate
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
BinProductVersion
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
AppxPackageFullName
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
AppxPackageRelativeId
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
Size
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
Language
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\s7jocwxji7k0xeca|aa4147cb363dd358
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018800F89CE9E26
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
ProgramId
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
FileId
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
LowerCaseLongPath
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
LongPathHash
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
Name
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
OriginalFileName
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
Publisher
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
Version
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
BinFileVersion
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
BinaryType
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
ProductName
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
ProductVersion
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
LinkDate
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
BinProductVersion
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
AppxPackageFullName
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
AppxPackageRelativeId
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
Size
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
Language
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\hhuml7ndouufxb5w|f601ccd2b4ae7a94
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018800F89CE9E26
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
ProgramId
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
FileId
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
LowerCaseLongPath
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
LongPathHash
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
Name
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
OriginalFileName
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
Publisher
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
Version
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
BinFileVersion
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
BinaryType
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
ProductName
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
ProductVersion
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
LinkDate
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
BinProductVersion
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
AppxPackageFullName
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
AppxPackageRelativeId
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
Size
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
Language
\REGISTRY\A\{6df69ffa-0602-c88f-a47a-97444a3a4be1}\Root\InventoryApplicationFile\pqukvf5v8luxfe4t|2caf14951c81f54e
Usn
There are 78 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
45F000
unkown
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
C5F000
unkown
page read and write
 malicious
FC3000
heap
page read and write
 malicious
C5F000
unkown
page read and write
 malicious
BFF000
unkown
page read and write
 malicious
43F000
remote allocation
page execute and read and write
6CA0000
heap
page read and write
9F0000
heap
page read and write
CDD000
unkown
page readonly
2C8F000
trusted library allocation
page read and write
2A8F000
stack
page read and write
C6A000
unkown
page read and write
50D0000
trusted library allocation
page read and write
FE2000
heap
page read and write
2D2A000
stack
page read and write
C7D000
unkown
page readonly
50E000
stack
page read and write
2B4F000
stack
page read and write
2AAD000
trusted library allocation
page read and write
BD0000
unkown
page readonly
2CA4000
trusted library allocation
page read and write
50F0000
trusted library allocation
page read and write
2A20000
heap
page execute and read and write
A10000
direct allocation
page execute and read and write
51D000
stack
page read and write
1BE1F000
stack
page read and write
F57000
trusted library allocation
page execute and read and write
222E6000
direct allocation
page execute read
9730000
heap
page read and write
310E000
unkown
page read and write
2C7C000
trusted library allocation
page read and write
643000
unkown
page readonly
103E000
stack
page read and write
90E000
unkown
page read and write
10BA000
heap
page read and write
BD0000
unkown
page readonly
16A7000
heap
page read and write
12D0000
heap
page read and write
2C7A000
trusted library allocation
page read and write
1580000
heap
page read and write
2D1D000
stack
page read and write
11F0000
heap
page read and write
574F000
heap
page read and write
52FF000
stack
page read and write
2D30000
heap
page read and write
116F000
heap
page read and write
2B0E000
stack
page read and write
DA0000
unkown
page readonly
5510000
heap
page read and write
77E000
stack
page read and write
16AE000
heap
page read and write
237F000
stack
page read and write
EB1000
heap
page read and write
E9F000
stack
page read and write
930000
heap
page read and write
11B0000
heap
page read and write
2B20000
heap
page read and write
1BE32000
heap
page read and write
5B0000
heap
page read and write
85A000
stack
page read and write
1005000
heap
page read and write
44D000
stack
page read and write
DCF000
unkown
page read and write
EFE000
stack
page read and write
2D0F000
stack
page read and write
334E000
unkown
page read and write
4D6D000
stack
page read and write
ED5000
heap
page read and write
430000
direct allocation
page execute and read and write
4C0000
heap
page read and write
990000
heap
page read and write
5810000
heap
page read and write
1194000
heap
page read and write
22499000
heap
page read and write
2C23000
trusted library allocation
page read and write
F60000
heap
page read and write
2C55000
trusted library allocation
page read and write
1BF8B000
stack
page read and write
4C0000
heap
page read and write
1021000
heap
page read and write
1263D000
stack
page read and write
91D000
stack
page read and write
F40000
heap
page read and write
1C376000
heap
page read and write
11A3000
heap
page read and write
C30000
unkown
page readonly
621000
unkown
page execute read
54CE000
stack
page read and write
5D0000
heap
page read and write
FE0000
direct allocation
page execute and read and write
1639000
heap
page read and write
4F0000
heap
page read and write
2970000
remote allocation
page read and write
FC5000
heap
page read and write
585000
remote allocation
page execute and read and write
2CC000
stack
page read and write
590000
direct allocation
page execute and read and write
1520000
heap
page read and write
504F000
stack
page read and write
13B0000
heap
page read and write
9AF000
unkown
page read and write
4E6D000
stack
page read and write
593000
unkown
page readonly
5882000
heap
page read and write
FCE000
heap
page read and write
53B0000
heap
page read and write
96C000
stack
page read and write
543F000
stack
page read and write
620000
unkown
page readonly
4B1000
remote allocation
page execute and read and write
7280000
heap
page read and write
2A1E000
stack
page read and write
1629000
heap
page read and write
5D0000
heap
page read and write
303E000
unkown
page read and write
108A000
heap
page read and write
DD0000
trusted library allocation
page read and write
CBE000
heap
page read and write
BF3000
unkown
page readonly
5AB000
heap
page read and write
32DF000
stack
page read and write
F2D000
trusted library allocation
page execute and read and write
25FD000
stack
page read and write
2BFD000
trusted library allocation
page read and write
E85000
heap
page read and write
5C0000
heap
page read and write
621000
unkown
page execute read
5555000
heap
page read and write
310F000
unkown
page read and write
223C2000
direct allocation
page read and write
2BF7000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
5130000
heap
page read and write
2B1F000
stack
page read and write
2C74000
trusted library allocation
page read and write
1485000
heap
page read and write
439000
remote allocation
page execute and read and write
660000
direct allocation
page execute and read and write
8DE000
stack
page read and write
CBA000
heap
page read and write
430000
unkown
page readonly
AD0000
heap
page read and write
50AF000
trusted library allocation
page read and write
E76000
heap
page read and write
2D90000
heap
page read and write
22180000
direct allocation
page execute and read and write
56EF000
stack
page read and write
325F000
unkown
page read and write
523E000
stack
page read and write
9E0000
heap
page read and write
3460000
heap
page read and write
6570000
heap
page read and write
C53000
unkown
page readonly
2BE2000
trusted library allocation
page read and write
2A2F000
stack
page read and write
F40000
trusted library allocation
page read and write
325D000
stack
page read and write
1602000
heap
page read and write
FD7000
heap
page read and write
11BE000
heap
page read and write
74FE000
stack
page read and write
59F000
unkown
page write copy
CCD000
heap
page read and write
FF0000
heap
page read and write
2BFB000
trusted library allocation
page read and write
10DC000
heap
page read and write
CDD000
unkown
page readonly
5090000
trusted library allocation
page read and write
4E0D000
stack
page read and write
492000
unkown
page read and write
F9B000
heap
page read and write
BAA000
heap
page read and write
EC8000
heap
page read and write
2DC0000
heap
page read and write
16A3000
heap
page read and write
5150000
trusted library allocation
page read and write
6CD000
heap
page read and write
643000
unkown
page readonly
4BCC000
stack
page read and write
2B1D000
stack
page read and write
1BE9E000
heap
page read and write
15F3000
heap
page read and write
14D7D000
stack
page read and write
2C34000
trusted library allocation
page read and write
50B3000
heap
page read and write
593000
unkown
page readonly
1003000
heap
page read and write
2C0E000
trusted library allocation
page read and write
167F000
heap
page read and write
2E3E000
unkown
page read and write
31B0000
heap
page read and write
15B0000
heap
page read and write
51FE000
stack
page read and write
1440000
heap
page read and write
F80000
heap
page read and write
F00000
heap
page read and write
2C3E000
trusted library allocation
page read and write
628C000
stack
page read and write
CDD000
unkown
page readonly
8C0000
heap
page read and write
32C0000
heap
page read and write
F9A000
heap
page read and write
496000
unkown
page readonly
5774000
heap
page read and write
47D000
remote allocation
page execute and read and write
283D000
stack
page read and write
EA9000
heap
page read and write
9C000
stack
page read and write
5794000
heap
page read and write
28F0000
heap
page read and write
571000
unkown
page execute read
318E000
stack
page read and write
570000
unkown
page readonly
BE0000
heap
page read and write
2C7D000
stack
page read and write
2C5D000
trusted library allocation
page read and write
E00000
heap
page read and write
5200000
trusted library allocation
page execute and read and write
960000
heap
page read and write
73BE000
stack
page read and write
5E7E000
stack
page read and write
FE0000
heap
page read and write
115F000
heap
page read and write
112A000
heap
page read and write
5A60000
heap
page read and write
F23000
trusted library allocation
page execute and read and write
4D1000
remote allocation
page execute and read and write
318F000
stack
page read and write
7BD000
stack
page read and write
4F0D000
stack
page read and write
28DB000
stack
page read and write
F52000
trusted library allocation
page read and write
EE0000
heap
page read and write
57AB000
heap
page read and write
10D7000
heap
page read and write
502000
remote allocation
page execute and read and write
293D000
stack
page read and write
FFB000
stack
page read and write
1BE3C000
heap
page read and write
5515000
heap
page read and write
620000
unkown
page readonly
2BC5000
trusted library allocation
page read and write
2CF0000
heap
page read and write
CD9000
unkown
page read and write
2BD8000
trusted library allocation
page read and write
54B0000
heap
page read and write
2FDF000
stack
page read and write
670000
heap
page read and write
3310000
heap
page read and write
F90000
heap
page read and write
1607000
heap
page read and write
304E000
stack
page read and write
C31000
unkown
page execute read
11CB000
heap
page read and write
7E5000
unkown
page readonly
A3E000
heap
page read and write
2E80000
heap
page read and write
CAE000
stack
page read and write
F2D000
heap
page read and write
162E000
heap
page read and write
F46000
trusted library allocation
page execute and read and write
7E5000
unkown
page readonly
55A000
stack
page read and write
CDD000
unkown
page readonly
53C0000
heap
page execute and read and write
5054000
trusted library allocation
page read and write
15BA000
heap
page read and write
F07000
heap
page read and write
D2D000
stack
page read and write
DCF000
unkown
page write copy
910000
heap
page read and write
910000
heap
page read and write
5220000
trusted library allocation
page read and write
2ABD000
stack
page read and write
F33000
trusted library allocation
page read and write
2B8E000
stack
page read and write
10EE000
stack
page read and write
6B0000
heap
page read and write
1171000
heap
page read and write
10AF000
stack
page read and write
920000
heap
page read and write
1731D000
stack
page read and write
2C42000
trusted library allocation
page read and write
314E000
stack
page read and write
2CED000
stack
page read and write
329E000
stack
page read and write
C53000
unkown
page readonly
E90000
heap
page read and write
4C2E000
stack
page read and write
787F000
stack
page read and write
2C57000
trusted library allocation
page read and write
2C00000
heap
page read and write
55EE000
stack
page read and write
2C3A000
trusted library allocation
page read and write
11FB000
heap
page read and write
52B0000
heap
page read and write
1196000
heap
page read and write
773F000
stack
page read and write
2BDC000
trusted library allocation
page read and write
571000
unkown
page execute read
EB7000
heap
page read and write
33A0000
heap
page read and write
FE5000
heap
page read and write
2BE0000
heap
page read and write
C3B000
stack
page read and write
14D2F000
stack
page read and write
28E0000
trusted library allocation
page execute and read and write
2C96000
trusted library allocation
page read and write
576C000
heap
page read and write
113E000
stack
page read and write
CEE000
stack
page read and write
2BE5000
trusted library allocation
page read and write
52AE000
stack
page read and write
539000
remote allocation
page execute and read and write
3CC000
stack
page read and write
FAA000
heap
page read and write
5050000
trusted library allocation
page read and write
96E000
unkown
page read and write
2DD0000
heap
page read and write
A6D000
stack
page read and write
BF3000
unkown
page readonly
4D0E000
stack
page read and write
528B000
stack
page read and write
7292000
heap
page read and write
2D0B000
heap
page read and write
81D000
stack
page read and write
2B2B000
trusted library allocation
page read and write
1C41F000
heap
page read and write
BD1000
unkown
page execute read
2C5D000
stack
page read and write
1177000
heap
page read and write
1219000
heap
page read and write
E00000
heap
page read and write
5F7F000
stack
page read and write
A9B000
stack
page read and write
577E000
heap
page read and write
31BB000
heap
page read and write
4D2D000
stack
page read and write
D37000
stack
page read and write
CD9000
unkown
page read and write
2980000
heap
page read and write
273F000
stack
page read and write
2BC8000
trusted library allocation
page read and write
4A9000
remote allocation
page execute and read and write
29FE000
stack
page read and write
5530000
heap
page read and write
10C3000
heap
page read and write
24FF000
stack
page read and write
643000
unkown
page readonly
119E000
heap
page read and write
2238D000
direct allocation
page execute read
591F000
stack
page read and write
2D00000
heap
page read and write
C30000
unkown
page readonly
100BF000
stack
page read and write
4F4E000
stack
page read and write
21EE000
stack
page read and write
2B27000
trusted library allocation
page read and write
2BB9000
trusted library allocation
page read and write
96F000
unkown
page read and write
2C12000
trusted library allocation
page read and write
150E000
stack
page read and write
290F000
stack
page read and write
C53000
unkown
page readonly
FB4000
heap
page read and write
B6E000
stack
page read and write
E20000
heap
page read and write
1BF30000
heap
page read and write
5140000
trusted library allocation
page execute and read and write
496000
unkown
page readonly
223CD000
direct allocation
page readonly
14C2E000
stack
page read and write
64F000
unkown
page write copy
620000
unkown
page readonly
11ED000
stack
page read and write
490000
heap
page read and write
5290000
trusted library section
page readonly
96E000
heap
page read and write
57DE000
heap
page read and write
305B000
heap
page read and write
2E7F000
unkown
page read and write
2BBF000
trusted library allocation
page read and write
431000
unkown
page execute read
54F0000
trusted library allocation
page read and write
15EE000
heap
page read and write
23FF000
stack
page read and write
3300000
heap
page read and write
2C61000
trusted library allocation
page read and write
4DD000
remote allocation
page execute and read and write
2C1D000
trusted library allocation
page read and write
431000
unkown
page execute read
506E000
trusted library allocation
page read and write
2C5B000
trusted library allocation
page read and write
163E000
heap
page read and write
2BBB000
trusted library allocation
page read and write
D2D000
stack
page read and write
10F8000
heap
page read and write
2B61000
trusted library allocation
page read and write
643000
unkown
page readonly
FDB000
heap
page read and write
533F000
stack
page read and write
4B0000
heap
page read and write
1013000
heap
page read and write
5A10000
heap
page read and write
1985E000
stack
page read and write
165A000
heap
page read and write
F24000
trusted library allocation
page read and write
7E5000
unkown
page readonly
2BE0000
trusted library allocation
page read and write
2BBE000
stack
page read and write
2C64000
trusted library allocation
page read and write
DA1000
unkown
page execute read
537E000
stack
page read and write
FFBE000
stack
page read and write
10FF000
stack
page read and write
52D000
remote allocation
page execute and read and write
560000
direct allocation
page execute and read and write
641000
remote allocation
page execute and read and write
2BC3000
trusted library allocation
page read and write
456000
remote allocation
page execute and read and write
2C3C000
trusted library allocation
page read and write
36A0000
heap
page read and write
2C0A000
trusted library allocation
page read and write
9720000
heap
page read and write
2B2F000
trusted library allocation
page read and write
1604000
heap
page read and write
1120000
heap
page read and write
2C25000
trusted library allocation
page read and write
445000
remote allocation
page execute and read and write
314F000
unkown
page read and write
581E000
stack
page read and write
4BD0000
heap
page read and write
A3A000
heap
page read and write
6DD000
stack
page read and write
74BE000
stack
page read and write
C30000
unkown
page readonly
505B000
trusted library allocation
page read and write
FAD000
heap
page read and write
2EA0000
heap
page read and write
2CC4000
trusted library allocation
page read and write
643000
remote allocation
page execute and read and write
169E000
heap
page read and write
7B0000
remote allocation
page read and write
54E000
stack
page read and write
DA0000
unkown
page readonly
1C0FB000
heap
page read and write
5076000
trusted library allocation
page read and write
53AF000
stack
page read and write
1644000
heap
page read and write
2B5D000
stack
page read and write
247D000
stack
page read and write
3A31000
trusted library allocation
page read and write
115A000
heap
page read and write
2238F000
direct allocation
page readonly
D8C000
stack
page read and write
2CBF000
trusted library allocation
page read and write
12FC000
stack
page read and write
1510000
heap
page read and write
BBD000
heap
page read and write
7C0000
heap
page read and write
763E000
stack
page read and write
107D000
heap
page read and write
585000
remote allocation
page execute and read and write
621000
unkown
page execute read
BD1000
unkown
page execute read
75FE000
stack
page read and write
58BA000
heap
page read and write
1BE4D000
heap
page read and write
400000
heap
page read and write
A30000
heap
page read and write
2B7D000
stack
page read and write
50E000
remote allocation
page execute and read and write
C80000
direct allocation
page execute and read and write
5520000
heap
page read and write
CF7000
stack
page read and write
10AB000
heap
page read and write
DE9000
heap
page read and write
9E5000
heap
page read and write
123F000
stack
page read and write
2F9E000
stack
page read and write
E80000
heap
page read and write
F65000
unkown
page readonly
5071000
trusted library allocation
page read and write
777E000
stack
page read and write
1360000
heap
page read and write
F4A000
heap
page read and write
2C10000
trusted library allocation
page read and write
453000
unkown
page readonly
620000
unkown
page readonly
EDE000
heap
page read and write
33B0000
heap
page read and write
96A000
heap
page read and write
6E5000
heap
page read and write
3390000
heap
page read and write
223CF000
direct allocation
page readonly
570000
unkown
page readonly
2CCD000
stack
page read and write
DC0000
heap
page read and write
BAE000
heap
page read and write
B7C000
stack
page read and write
5230000
trusted library allocation
page execute and read and write
BB0000
heap
page read and write
DE0000
heap
page read and write
5777000
heap
page read and write
2C8B000
trusted library allocation
page read and write
2B23000
trusted library allocation
page read and write
5082000
trusted library allocation
page read and write
1C358000
heap
page read and write
735000
unkown
page readonly
B9C000
stack
page read and write
453000
unkown
page readonly
C8C000
stack
page read and write
331B000
heap
page read and write
3050000
heap
page read and write
C5F000
unkown
page write copy
507D000
trusted library allocation
page read and write
F8E000
heap
page read and write
2BE7000
trusted library allocation
page read and write
3420000
heap
page read and write
1609000
heap
page read and write
4BCE000
stack
page read and write
F50000
heap
page read and write
595E000
stack
page read and write
400000
remote allocation
page execute and read and write
54D0000
trusted library allocation
page read and write
2C59000
trusted library allocation
page read and write
5764000
heap
page read and write
9820000
unclassified section
page read and write
9A0000
heap
page read and write
50B0000
heap
page read and write
1C08C000
stack
page read and write
E7B000
heap
page read and write
1173000
heap
page read and write
F20000
heap
page read and write
BFC000
stack
page read and write
F4E000
stack
page read and write
1267D000
stack
page read and write
EE0000
heap
page read and write
DA1000
unkown
page execute read
52C0000
heap
page read and write
1188000
heap
page read and write
FA8000
heap
page read and write
15FD000
heap
page read and write
5757000
heap
page read and write
BFF000
unkown
page write copy
48E000
stack
page read and write
2BB3000
trusted library allocation
page read and write
5745000
heap
page read and write
1BE5E000
heap
page read and write
6BB000
heap
page read and write
1C211000
heap
page read and write
FC9000
heap
page read and write
FA0000
heap
page read and write
2BDE000
trusted library allocation
page read and write
31EF000
stack
page read and write
5A5E000
stack
page read and write
64F000
unkown
page read and write
2B7F000
stack
page read and write
14CD000
stack
page read and write
58E000
stack
page read and write
31A0000
heap
page read and write
C31000
unkown
page execute read
8FD000
stack
page read and write
52A0000
heap
page read and write
2BC1000
trusted library allocation
page read and write
6EA2000
trusted library allocation
page read and write
19C000
stack
page read and write
22188000
direct allocation
page execute read
760000
heap
page read and write
AB0000
heap
page read and write
223EE000
heap
page read and write
2D30000
heap
page read and write
BFF000
stack
page read and write
4E0000
heap
page read and write
2AC0000
heap
page read and write
2C27000
trusted library allocation
page read and write
2DA0000
heap
page read and write
161F000
heap
page read and write
2D5A000
stack
page read and write
F5B000
trusted library allocation
page execute and read and write
160D000
heap
page read and write
11AE000
stack
page read and write
533E000
stack
page read and write
DC3000
unkown
page readonly
DEE000
stack
page read and write
F3D000
trusted library allocation
page execute and read and write
1018000
heap
page read and write
729D000
heap
page read and write
2D70000
heap
page read and write
1515000
heap
page read and write
35BE000
stack
page read and write
588000
remote allocation
page execute and read and write
51BE000
stack
page read and write
90D000
stack
page read and write
2C72000
trusted library allocation
page read and write
172BC000
stack
page read and write
2C44000
trusted library allocation
page read and write
B5F000
stack
page read and write
33BB000
heap
page read and write
5C8000
remote allocation
page execute and read and write
2CA8000
trusted library allocation
page read and write
50A0000
trusted library allocation
page read and write
72A1000
heap
page read and write
2DD0000
heap
page read and write
E04000
heap
page read and write
2D3B000
heap
page read and write
C31000
unkown
page execute read
5710000
heap
page read and write
2C7A000
stack
page read and write
929000
stack
page read and write
FE6000
heap
page read and write
329A000
stack
page read and write
BD0000
heap
page read and write
5FE000
stack
page read and write
1C41D000
heap
page read and write
F90000
heap
page read and write
630000
heap
page read and write
2A10000
trusted library allocation
page read and write
2BF3000
trusted library allocation
page read and write
22181000
direct allocation
page execute read
72A8000
heap
page read and write
50BE000
stack
page read and write
41D000
stack
page read and write
72AE000
heap
page read and write
618C000
stack
page read and write
45F000
unkown
page write copy
571B000
heap
page read and write
2C7E000
trusted library allocation
page read and write
621000
unkown
page execute read
2DDE000
unkown
page read and write
F20000
trusted library allocation
page read and write
2C5F000
trusted library allocation
page read and write
F27000
heap
page read and write
50C5000
trusted library allocation
page read and write
C7D000
unkown
page readonly
ED3000
heap
page read and write
C5F000
unkown
page write copy
2CE0000
heap
page read and write
505E000
trusted library allocation
page read and write
EBE000
heap
page read and write
53E000
stack
page read and write
2C17000
trusted library allocation
page read and write
2BF9000
trusted library allocation
page read and write
FE0000
heap
page read and write
547B000
stack
page read and write
FF60000
heap
page read and write
EFC000
stack
page read and write
64F000
unkown
page read and write
2C8D000
trusted library allocation
page read and write
1168000
heap
page read and write
2C91000
trusted library allocation
page read and write
292E000
stack
page read and write
2A31000
trusted library allocation
page read and write
2C40000
trusted library allocation
page read and write
10D4000
heap
page read and write
EC2000
heap
page read and write
1200000
direct allocation
page execute and read and write
54A0000
heap
page read and write
72B6000
heap
page read and write
100FD000
stack
page read and write
F70000
trusted library allocation
page read and write
1C218000
heap
page read and write
5650000
trusted library allocation
page execute and read and write
7E5000
unkown
page readonly
735000
unkown
page readonly
D9F000
stack
page read and write
72C8000
heap
page read and write
338F000
unkown
page read and write
2D0A000
stack
page read and write
E14000
heap
page read and write
830000
heap
page read and write
1C0C0000
heap
page read and write
4A6000
remote allocation
page execute and read and write
6E0000
remote allocation
page read and write
1040000
heap
page read and write
34C000
stack
page read and write
2A00000
trusted library allocation
page read and write
50C0000
trusted library allocation
page read and write
2D90000
heap
page read and write
2C47000
trusted library allocation
page read and write
9AE000
stack
page read and write
CB0000
heap
page read and write
5A0000
heap
page read and write
10F0000
heap
page read and write
2BDA000
trusted library allocation
page read and write
2BBD000
trusted library allocation
page read and write
10F7000
heap
page read and write
CCA000
unkown
page read and write
D83000
stack
page read and write
2CA6000
trusted library allocation
page read and write
C79000
unkown
page read and write
2C93000
trusted library allocation
page read and write
C31000
unkown
page execute read
620000
heap
page read and write
2D80000
heap
page read and write
2C3D000
stack
page read and write
107A000
heap
page read and write
83B000
heap
page read and write
30F0000
heap
page read and write
2F4D000
stack
page read and write
1470000
heap
page read and write
DC3000
unkown
page readonly
430000
unkown
page readonly
35FF000
stack
page read and write
440000
heap
page read and write
223CA000
direct allocation
page readonly
280F000
stack
page read and write
31C000
stack
page read and write
C30000
unkown
page readonly
59F000
unkown
page read and write
14BBE000
stack
page read and write
1090000
heap
page read and write
DA0000
heap
page read and write
5AC000
stack
page read and write
C53000
unkown
page readonly
2A0D000
stack
page read and write
5A65000
heap
page read and write
F4A000
trusted library allocation
page execute and read and write
F42000
trusted library allocation
page read and write
22398000
direct allocation
page readonly
198DE000
stack
page read and write
64F000
unkown
page write copy
1F0000
heap
page read and write
BA0000
heap
page read and write
2BD6000
trusted library allocation
page read and write
CCA000
unkown
page read and write
7289000
heap
page read and write
1480000
heap
page read and write
2C14000
trusted library allocation
page read and write
F65000
unkown
page readonly
EFC000
stack
page read and write
C6F000
stack
page read and write
F1E000
stack
page read and write
11F0000
heap
page read and write
There are 726 hidden memdumps, click here to show them.