IOC Report
zyJWi2vy29.exe

loading gif

Files

File Path
Type
Category
Malicious
zyJWi2vy29.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zyJWi2vy29.exe_e0e67866dd5f1e66e4e4566bf6b7d5d6e1114c2_ee315164_bfc38dd3-3233-4c4e-8582-24b040cb3286\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\AdobeUpdaterV168.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\AdobeUpdaterV168.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_b055341c05e33d6c2334ce6d41cea915\AdobeUpdaterV168.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\AdobeUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rise2806[1].exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma2806[1].exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\meta2806[1].exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vidar2806[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Wb7RPsmWU0j98XyD1Ncm8BU.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\3f61nAONpe1PsLC0oJHy.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\6p7a7injLZJojhETBNhL.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8jZLXI789L2zXDjlm7Fx.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8x9h3ctqkpfTu0sNF0X2.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\KFCGDBAKKKFB\AAFHII
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KFCGDBAKKKFB\AFCFHD
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
modified
C:\ProgramData\KFCGDBAKKKFB\BAFCGI
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\KFCGDBAKKKFB\CAAEBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KFCGDBAKKKFB\DBKKKE
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KFCGDBAKKKFB\DGHIEC
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KFCGDBAKKKFB\IJEHID
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_3f61nAONpe1PsLC0_f82d3a92a5222e402e262757509296e8da22cb_d0580af8_479195b4-351e-49b2-a3ea-316895da9a37\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_6p7a7injLZJojhET_a1161d118d5ba59481b8f8b70c2b917ff513e_5d3d4916_32023134-29b2-48b7-9726-c0b1a833f252\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8x9h3ctqkpfTu0sN_bcd59447a98a76fb8c7cd5a1a3d8f6a156d5590_e32e0909_979e31ca-154c-4d57-aaab-bd7a35d85d31\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6087.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Jul 1 07:16:02 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6114.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER627D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9988.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Jul 1 07:16:16 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A26.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A65.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B7C.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Jul 1 07:16:17 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C39.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CA7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4E3.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Jul 1 07:16:19 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA561.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA66B.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8jZLXI789L2zXDjlm7Fx.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSIUpdaterV168.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\4E_ETy6bOOw3Login Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\5INc0tVFPkNMHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\6JTEmGBjvBASWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\70WEwl36WBWTWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\DE7o6D8KRQYZWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\KiPY9kwddw5OLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\LCD6mNT9opEeHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\Pipe5udjKZEvWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\SrAt_MHzXgCcHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\_9GToUJeg5UwWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\_uGW_ubMqm8ALogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\ehBGgoQPsbnGCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\hzBvBK8Qfe_SWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\zLzn5RU6E7dhHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\trixy3qyfLZqnmIGj\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixy3qyfLZqnmIGj\History\Firefox_fqs92o4p.default-release.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixy3qyfLZqnmIGj\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixy3qyfLZqnmIGj\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixy3qyfLZqnmIGj\screenshot.png
PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 57 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\zyJWi2vy29.exe
"C:\Users\user\Desktop\zyJWi2vy29.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea LG" /sc ONLOGON /rl HIGHEST
malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\6p7a7injLZJojhETBNhL.exe
"C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\6p7a7injLZJojhETBNhL.exe"
malicious
C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8 HR" /sc HOURLY /rl HIGHEST
malicious
C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8 LG" /sc ONLOGON /rl HIGHEST
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8x9h3ctqkpfTu0sNF0X2.exe
"C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8x9h3ctqkpfTu0sNF0X2.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a LG" /sc ONLOGON /rl HIGHEST
malicious
C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe
 malicious
C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\3f61nAONpe1PsLC0oJHy.exe
"C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\3f61nAONpe1PsLC0oJHy.exe"
malicious
C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915 HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915 LG" /sc ONLOGON /rl HIGHEST
malicious
C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe
 malicious
C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8jZLXI789L2zXDjlm7Fx.exe
"C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8jZLXI789L2zXDjlm7Fx.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 7548 -ip 7548
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 324
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8004 -s 284
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 288
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7632 -s 136
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 42 hidden processes, click here to show them.

URLs

Name
IP
Malicious
contintnetksows.shop
malicious
ellaboratepwsz.xyzu
malicious
http://77.105.132.27/rise2806.exe
77.105.132.27
 malicious
swellfrrgwwos.xyz
malicious
foodypannyjsud.shop
malicious
pedestriankodwu.xyz
malicious
http://77.105.132.27/lumma2806.exe
77.105.132.27
 malicious
towerxxuytwi.xyzd
malicious
https://195.201.251.214:9000/sqlt.dll67
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://195.201.251.214:9000/nss3.dll
unknown
http://crl.microsoft
unknown
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
unknown
https://t.me/ON
unknown
https://db-ip.com/
unknown
https://ipinfo.io/widget/demo/8.46.123.336&
unknown
https://195.201.251.214:9000/mozglue.dllge
unknown
http://www.fontbureau.com/designers
unknown
https://db-ip.com/x;
unknown
http://www.sajatypeworks.com
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://77.105.132.27/meta2806.exeL
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
unknown
https://195.201.251.214:9000/softokn3.dllgM
unknown
https://t.me/risepro_bot3320
unknown
https://discord.com/api/v9/users/
unknown
https://t.me/risepro_botisepro_bot
unknown
http://www.galapagosdesign.com/DPlease
unknown
https://t.me/risepro_botv:#
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
https://potterryisiw.shop/
unknown
https://api.ip.sb/ip
unknown
https://195.201.251.214:9000/vcruntime140.dll.
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
http://77.105.132.27/lumma2806.exeB
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://t.me/RiseProSUPPORT
unknown
https://potterryisiw.shop/apiB
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://195.201.251.214:9000/vcruntime140.dllrv:129.0)
unknown
https://195.201.251.214:9000/softokn3.dllo
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://www.carterandcone.coml
unknown
https://195.201.251.214:9000/vcruntime140.dller
unknown
https://195.201.251.214:9000/softokn3.dlle
unknown
https://potterryisiw.shop/apip
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
https://195.201.251.214:9000/x$H
unknown
https://ipinfo.io/
34.117.186.192
https://www.maxmind.com/en/locate-my-ip-address
unknown
https://db-ip.com/v
unknown
https://195.201.251.214/
unknown
https://195.201.251.214:9000/Jb
unknown
https://195.201.251.214:9000
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
http://ns.exif/1e.$A/
unknown
http://77.105.132.27/meta2806.exe/risep
unknown
https://195.201.251.214:9000170le
unknown
https://ipinfo.io:443/widget/demo/8.46.123.33
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://www.fontbureau.com/designersG
unknown
https://195.201.251.214:9000/softokn3.dlls5
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://195.201.251.214:9000/mozglue.dll
unknown
https://195.201.251.214:9000/y
unknown
https://web.telegram.org
unknown
http://www.fontbureau.com/designers?
unknown
https://potterryisiw.shop/l
unknown
https://195.201.251.214:9000/
unknown
http://77.105.132.27/rise2806.exes
unknown
http://www.tiro.com
unknown
https://ipinfo.io/widget/demo/8.46.123.332
unknown
https://api.ip.s
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://www.goodfont.co.kr
unknown
https://195.201.251.214:9000/icrosoft
unknown
http://www.typography.netD
unknown
https://195.201.251.214:9000/8(H
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
https://potterryisiw.shop/api1
unknown
https://ipinfo.io/widget/demo/8.46.123.33
34.117.186.192
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://195.201.251.214:9000/Qb
unknown
https://195.201.251.214:9000/freebl3.dllc
unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33
unknown
https://t.me/g067nDJ
unknown
https://195.201.251.214:9000/nss3.dlls0
unknown
https://db-ip.com/T
unknown
https://ipinfo.io/t_
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
https://195.201.251.214:9000/freebl3.dll
unknown
https://195.201.251.214:9000/=3%
unknown
https://195.201.251.214:9000/softokn3.dll
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
potterryisiw.shop
188.114.97.3
 malicious
t.me
149.154.167.99
 malicious
ipinfo.io
34.117.186.192
db-ip.com
104.26.4.15

IPs

IP
Domain
Country
Malicious
77.105.132.27
unknown
Russian Federation
malicious
188.114.97.3
potterryisiw.shop
European Union
malicious
149.154.167.99
t.me
United Kingdom
malicious
34.117.186.192
ipinfo.io
United States
195.201.251.214
unknown
Germany
104.26.4.15
db-ip.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_6a6c6289978e81e233ec951dd09be6ea
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_b055341c05e33d6c2334ce6d41cea915
 malicious
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
ProgramId
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
FileId
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
LowerCaseLongPath
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
LongPathHash
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Name
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
OriginalFileName
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Publisher
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Version
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
BinFileVersion
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
BinaryType
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
ProductName
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
ProductVersion
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
LinkDate
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
BinProductVersion
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
AppxPackageFullName
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
AppxPackageRelativeId
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Size
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Language
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
ProgramId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
FileId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
LowerCaseLongPath
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
LongPathHash
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Name
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
OriginalFileName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Publisher
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Version
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
BinFileVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
BinaryType
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
ProductName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
ProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
LinkDate
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
BinProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
AppxPackageFullName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
AppxPackageRelativeId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Size
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Language
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
00180010C32C0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
ProgramId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
FileId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
LowerCaseLongPath
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
LongPathHash
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Name
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
OriginalFileName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Publisher
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Version
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
BinFileVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
BinaryType
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
ProductName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
ProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
LinkDate
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
BinProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
AppxPackageFullName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
AppxPackageRelativeId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Size
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Language
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
00180010C32C0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
ProgramId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
FileId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
LowerCaseLongPath
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
LongPathHash
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Name
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
OriginalFileName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Publisher
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Version
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
BinFileVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
BinaryType
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
ProductName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
ProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
LinkDate
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
BinProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
AppxPackageFullName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
AppxPackageRelativeId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Size
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Language
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Usn
There are 77 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
F52000
unkown
page readonly
 malicious
4F4000
unkown
page read and write
 malicious
520000
unkown
page read and write
 malicious
4F4000
unkown
page read and write
 malicious
E64000
unkown
page read and write
 malicious
A5A000
heap
page read and write
AAB000
heap
page read and write
2A82000
trusted library allocation
page read and write
29CD000
trusted library allocation
page read and write
5C3F000
stack
page read and write
13AC000
heap
page read and write
55DF000
stack
page read and write
A0D000
stack
page read and write
27EE000
stack
page read and write
BE5000
heap
page read and write
6B9F000
heap
page read and write
2BB5000
trusted library allocation
page read and write
3448000
trusted library allocation
page read and write
15B1000
heap
page read and write
33C5000
trusted library allocation
page read and write
2A78000
trusted library allocation
page read and write
5C55000
heap
page read and write
8EE000
stack
page read and write
57A3000
heap
page read and write
2979000
trusted library allocation
page read and write
120000
unkown
page readonly
14C8000
heap
page read and write
1523000
trusted library allocation
page execute and read and write
33EF000
trusted library allocation
page read and write
BB0000
heap
page read and write
29E4000
trusted library allocation
page read and write
772E000
stack
page read and write
1650000
trusted library allocation
page read and write
4EB0000
trusted library allocation
page read and write
D40000
trusted library allocation
page execute and read and write
33CD000
trusted library allocation
page read and write
5270000
heap
page read and write
2B55000
trusted library allocation
page read and write
52B5000
heap
page read and write
1050000
heap
page read and write
5DB0000
trusted library allocation
page execute and read and write
2A4C000
trusted library allocation
page read and write
770000
heap
page read and write
73C000
stack
page read and write
19B12000
heap
page read and write
347A000
trusted library allocation
page read and write
5BCD000
stack
page read and write
F0B000
stack
page read and write
28EE000
stack
page read and write
990000
heap
page read and write
145000
unkown
page readonly
6B7F000
heap
page read and write
368E000
trusted library allocation
page read and write
5A70000
heap
page read and write
493D000
stack
page read and write
50D0000
trusted library allocation
page execute and read and write
5D60000
trusted library allocation
page read and write
331D000
trusted library allocation
page read and write
3880000
trusted library allocation
page read and write
29A9000
trusted library allocation
page read and write
4FC000
stack
page read and write
1030E000
stack
page read and write
4FC000
stack
page read and write
700000
unkown
page read and write
1369000
heap
page read and write
10FE000
stack
page read and write
29C3000
trusted library allocation
page read and write
6F5000
unkown
page readonly
2AF3000
trusted library allocation
page read and write
10BE000
stack
page read and write
E7F000
stack
page read and write
7E0000
heap
page read and write
C30000
heap
page read and write
6F9E000
stack
page read and write
3241000
trusted library allocation
page read and write
CD0000
heap
page read and write
AD0000
heap
page read and write
2A95000
trusted library allocation
page read and write
2A12000
trusted library allocation
page read and write
6B50000
heap
page read and write
571000
unkown
page readonly
5880000
heap
page read and write
980000
heap
page read and write
2B2D000
trusted library allocation
page read and write
4F3B000
stack
page read and write
9FE000
stack
page read and write
3640000
trusted library allocation
page read and write
20CE000
stack
page read and write
6B0000
heap
page read and write
1564000
heap
page read and write
2BBF000
trusted library allocation
page read and write
401000
remote allocation
page execute and read and write
94F000
stack
page read and write
150000
unkown
page read and write
737B000
heap
page read and write
2948000
trusted library allocation
page read and write
86D000
stack
page read and write
ACB000
heap
page read and write
4DD000
remote allocation
page execute and read and write
C0E000
stack
page read and write
2A8F000
trusted library allocation
page read and write
88A000
heap
page read and write
1A063000
heap
page read and write
2AF7000
trusted library allocation
page read and write
2290000
heap
page read and write
C40000
trusted library allocation
page read and write
284F000
trusted library allocation
page read and write
411000
remote allocation
page execute and read and write
29CB000
trusted library allocation
page read and write
B6C000
heap
page read and write
390F000
trusted library allocation
page read and write
4E71000
trusted library allocation
page read and write
CBE000
stack
page read and write
2826000
trusted library allocation
page read and write
C51000
unkown
page execute read
1050000
heap
page read and write
2AAE000
stack
page read and write
276F000
stack
page read and write
1E0000
heap
page read and write
95E000
unkown
page read and write
6B6E000
heap
page read and write
3465000
trusted library allocation
page read and write
503E000
stack
page read and write
6862000
trusted library allocation
page read and write
29DE000
trusted library allocation
page read and write
2A69000
trusted library allocation
page read and write
5055000
heap
page read and write
3650000
trusted library allocation
page read and write
124A000
heap
page read and write
36F4000
trusted library allocation
page read and write
C51000
unkown
page execute read
2833000
heap
page read and write
CF3000
trusted library allocation
page read and write
2A49000
trusted library allocation
page read and write
15B0000
heap
page read and write
26FB000
trusted library allocation
page read and write
64E000
stack
page read and write
820000
heap
page read and write
74F0000
heap
page read and write
19E7000
heap
page read and write
C46000
trusted library allocation
page execute and read and write
2A51000
trusted library allocation
page read and write
14FEE000
stack
page read and write
12D0000
heap
page read and write
470000
heap
page read and write
2B2B000
trusted library allocation
page read and write
1310000
heap
page read and write
180F000
stack
page read and write
4FDE000
stack
page read and write
364C000
trusted library allocation
page read and write
1313000
heap
page read and write
137B000
heap
page read and write
CDB000
stack
page read and write
4E8000
unkown
page readonly
33C7000
trusted library allocation
page read and write
1210000
heap
page read and write
57CC000
heap
page read and write
DE2000
stack
page read and write
344A000
trusted library allocation
page read and write
D69000
heap
page read and write
860000
heap
page read and write
200CA000
direct allocation
page readonly
29FB000
trusted library allocation
page read and write
515000
unkown
page readonly
DD6000
stack
page read and write
60E000
stack
page read and write
A78000
heap
page read and write
515000
unkown
page readonly
200CD000
direct allocation
page readonly
B5E000
heap
page read and write
14FE000
stack
page read and write
17C000
stack
page read and write
4F1000
unkown
page execute read
231F000
stack
page read and write
5CE000
stack
page read and write
74FE000
heap
page read and write
1FE80000
direct allocation
page execute and read and write
15B0000
heap
page read and write
3841000
trusted library allocation
page read and write
67A000
stack
page read and write
29C7000
trusted library allocation
page read and write
130E000
heap
page read and write
C50000
heap
page read and write
D06000
trusted library allocation
page execute and read and write
19E0000
heap
page read and write
1167000
heap
page read and write
910000
heap
page read and write
36CA000
trusted library allocation
page read and write
410000
remote allocation
page execute and read and write
29EC000
trusted library allocation
page read and write
1FFE6000
direct allocation
page execute read
DAB000
heap
page read and write
A2B000
heap
page read and write
525E000
stack
page read and write
52B000
unkown
page readonly
2E8F000
stack
page read and write
571000
unkown
page readonly
576B000
trusted library allocation
page read and write
2B4C000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
52B000
unkown
page readonly
DA6000
heap
page read and write
135D000
heap
page read and write
7F7000
stack
page read and write
598E000
stack
page read and write
5746000
heap
page read and write
2B3A000
trusted library allocation
page read and write
5C8000
remote allocation
page execute and read and write
128CE000
stack
page read and write
5368000
heap
page read and write
7351000
heap
page read and write
740000
direct allocation
page execute and read and write
C4A000
trusted library allocation
page execute and read and write
301E000
stack
page read and write
29CA000
trusted library allocation
page read and write
2B99000
trusted library allocation
page read and write
7519000
heap
page read and write
1B0000
heap
page read and write
2E0E000
unkown
page read and write
5830000
heap
page read and write
736C000
heap
page read and write
7CF000
unkown
page read and write
8EF000
stack
page read and write
B6E000
heap
page read and write
2B1D000
trusted library allocation
page read and write
1105000
heap
page read and write
9FC000
stack
page read and write
4F4000
unkown
page write copy
735B000
heap
page read and write
1700000
heap
page read and write
52B0000
heap
page read and write
33F9000
trusted library allocation
page read and write
77D000
heap
page read and write
751E000
heap
page read and write
321000
unkown
page execute read
4C0000
heap
page read and write
80F000
stack
page read and write
86F000
unkown
page read and write
C2F000
unkown
page read and write
DCD000
stack
page read and write
550000
heap
page read and write
C75000
unkown
page readonly
5794000
heap
page read and write
321000
unkown
page execute read
2A46000
trusted library allocation
page read and write
96E000
stack
page read and write
24EE000
stack
page read and write
C50000
unkown
page readonly
E00000
trusted library allocation
page read and write
B57000
heap
page read and write
3900000
heap
page read and write
2A16000
trusted library allocation
page read and write
423000
remote allocation
page execute and read and write
421000
remote allocation
page execute and read and write
53A000
stack
page read and write
3070000
heap
page read and write
1FE88000
direct allocation
page execute read
578F000
heap
page read and write
5050000
heap
page read and write
454000
remote allocation
page execute and read and write
3463000
trusted library allocation
page read and write
5792000
trusted library allocation
page read and write
2B46000
trusted library allocation
page read and write
52D000
remote allocation
page execute and read and write
57AF000
trusted library allocation
page read and write
580000
heap
page read and write
5D68000
trusted library allocation
page read and write
7E0000
heap
page read and write
2E4E000
stack
page read and write
1524000
trusted library allocation
page read and write
C75000
unkown
page readonly
104E000
stack
page read and write
3455000
trusted library allocation
page read and write
57B000
heap
page read and write
1050000
heap
page read and write
152D000
trusted library allocation
page execute and read and write
2AF1000
trusted library allocation
page read and write
34B0000
trusted library allocation
page read and write
33C1000
trusted library allocation
page read and write
D17000
trusted library allocation
page execute and read and write
900000
heap
page read and write
52D0000
heap
page read and write
C50000
heap
page read and write
BAE000
stack
page read and write
1290000
heap
page read and write
1572000
heap
page read and write
57D000
stack
page read and write
153A000
heap
page read and write
40E000
remote allocation
page execute and read and write
E17000
heap
page read and write
1335000
heap
page read and write
1620000
heap
page read and write
960000
heap
page read and write
2420000
heap
page read and write
13E5000
heap
page read and write
A00000
heap
page read and write
4C1000
unkown
page execute read
5A20000
trusted library allocation
page read and write
1040000
heap
page read and write
320000
unkown
page readonly
4C90000
trusted library allocation
page read and write
17C000
stack
page read and write
CD0000
trusted library allocation
page read and write
271D000
trusted library allocation
page read and write
3489000
trusted library allocation
page read and write
2B21000
trusted library allocation
page read and write
3442000
trusted library allocation
page read and write
362F000
stack
page read and write
DE0000
trusted library allocation
page read and write
530000
heap
page read and write
4EC0000
trusted library allocation
page read and write
1240000
heap
page read and write
579E000
heap
page read and write
2BA6000
trusted library allocation
page read and write
C24000
trusted library allocation
page read and write
4D00000
trusted library allocation
page read and write
8FC000
stack
page read and write
153E000
heap
page read and write
2B44000
trusted library allocation
page read and write
F50000
unkown
page readonly
4D10000
trusted library allocation
page execute and read and write
3467000
trusted library allocation
page read and write
13C6000
heap
page read and write
3410000
trusted library allocation
page read and write
C51000
unkown
page execute read
3130000
heap
page execute and read and write
131A000
heap
page read and write
2A0C000
trusted library allocation
page read and write
2A4A000
trusted library allocation
page read and write
8E0000
heap
page read and write
880000
heap
page read and write
4E5E000
trusted library allocation
page read and write
121000
unkown
page execute read
30FE000
stack
page read and write
57B5000
trusted library allocation
page read and write
C80000
unkown
page read and write
2AB0000
trusted library allocation
page read and write
B0B000
heap
page read and write
9C0000
heap
page read and write
73E000
unkown
page read and write
2A65000
trusted library allocation
page read and write
2BC1000
trusted library allocation
page read and write
CE3000
trusted library allocation
page execute and read and write
84F000
stack
page read and write
D3A000
heap
page read and write
C52000
trusted library allocation
page read and write
76B000
heap
page read and write
2B0E000
trusted library allocation
page read and write
2EEB000
heap
page read and write
50E000
remote allocation
page execute and read and write
1342000
heap
page read and write
641000
remote allocation
page execute and read and write
700E000
stack
page read and write
2E9F000
unkown
page read and write
2F70000
heap
page read and write
7531000
heap
page read and write
D02000
trusted library allocation
page read and write
2AB0000
heap
page read and write
93B000
heap
page read and write
6D1000
unkown
page execute read
520000
unkown
page write copy
DCE000
heap
page read and write
CE0000
trusted library allocation
page read and write
5781000
trusted library allocation
page read and write
19F1C000
heap
page read and write
6ECE000
stack
page read and write
77B000
heap
page read and write
5A5000
heap
page read and write
445000
remote allocation
page execute and read and write
2A91000
trusted library allocation
page read and write
2C6D000
stack
page read and write
3434000
trusted library allocation
page read and write
A60000
heap
page read and write
2B2F000
trusted library allocation
page read and write
2F78000
heap
page read and write
5820000
heap
page read and write
501E000
stack
page read and write
2EA0000
heap
page read and write
19C10000
heap
page read and write
2420000
remote allocation
page read and write
2711000
trusted library allocation
page read and write
88E000
heap
page read and write
5A50000
trusted library section
page readonly
14AB000
heap
page read and write
430000
heap
page read and write
AC7000
heap
page read and write
3BDE000
stack
page read and write
860000
direct allocation
page execute and read and write
3412000
trusted library allocation
page read and write
A9A000
heap
page read and write
15CF000
heap
page read and write
2E5000
unkown
page readonly
15DB000
heap
page read and write
2A01000
trusted library allocation
page read and write
2B7C000
trusted library allocation
page read and write
2E5000
unkown
page readonly
5220000
trusted library allocation
page read and write
305D000
stack
page read and write
121000
unkown
page execute read
16F0000
trusted library allocation
page execute and read and write
C80000
unkown
page read and write
6C40000
heap
page read and write
5C50000
heap
page read and write
C5B000
trusted library allocation
page execute and read and write
2730000
heap
page read and write
5079000
heap
page read and write
870000
heap
page read and write
3348000
trusted library allocation
page read and write
1601000
heap
page read and write
22F0000
heap
page read and write
1A128000
heap
page read and write
D30000
trusted library allocation
page read and write
1A12A000
heap
page read and write
299D000
trusted library allocation
page read and write
3CDF000
stack
page read and write
731E000
stack
page read and write
D78000
heap
page read and write
96B000
heap
page read and write
C4D000
stack
page read and write
4A9000
remote allocation
page execute and read and write
1642000
trusted library allocation
page read and write
E30000
unkown
page readonly
145000
unkown
page readonly
57A1000
heap
page read and write
6B0000
heap
page read and write
2824000
trusted library allocation
page read and write
5A54000
trusted library section
page readonly
782E000
stack
page read and write
1E0000
heap
page read and write
3446000
trusted library allocation
page read and write
5E1E000
stack
page read and write
16CE000
stack
page read and write
4E6E000
trusted library allocation
page read and write
222E000
stack
page read and write
5070000
heap
page read and write
C60000
heap
page read and write
5360000
heap
page read and write
CDF000
stack
page read and write
2BB0000
trusted library allocation
page read and write
5D0000
heap
page read and write
539000
remote allocation
page execute and read and write
14F8F000
stack
page read and write
57D0000
heap
page read and write
13B0000
heap
page read and write
3120000
trusted library allocation
page read and write
2BAE000
trusted library allocation
page read and write
1377000
heap
page read and write
C33000
trusted library allocation
page read and write
CD1000
unkown
page readonly
E31000
unkown
page execute read
A60000
heap
page read and write
3124000
trusted library allocation
page read and write
6D8E000
stack
page read and write
2B4A000
trusted library allocation
page read and write
A6E000
heap
page read and write
9A70000
unclassified section
page read and write
571E000
stack
page read and write
910000
heap
page read and write
AF9000
heap
page read and write
B9F000
unkown
page read and write
5731000
heap
page read and write
73D000
stack
page read and write
22EE000
stack
page read and write
527000
unkown
page read and write
2970000
trusted library allocation
page read and write
3110000
trusted library allocation
page read and write
4FD000
stack
page read and write
2A93000
trusted library allocation
page read and write
32DC000
trusted library allocation
page read and write
3648000
trusted library allocation
page read and write
39C000
stack
page read and write
F9C000
stack
page read and write
4CD0000
heap
page read and write
47C000
stack
page read and write
DDB000
heap
page read and write
120000
unkown
page readonly
C9E000
stack
page read and write
3645000
trusted library allocation
page read and write
19B1C000
heap
page read and write
D70000
direct allocation
page execute and read and write
29FD000
trusted library allocation
page read and write
350000
unkown
page read and write
15C3000
heap
page read and write
8DE000
stack
page read and write
E30000
unkown
page readonly
26B0000
trusted library allocation
page read and write
2EDE000
stack
page read and write
6B87000
heap
page read and write
690000
direct allocation
page execute and read and write
3670000
trusted library allocation
page read and write
C75000
unkown
page readonly
520000
direct allocation
page execute and read and write
23AD000
stack
page read and write
1670000
trusted library allocation
page read and write
26DD000
stack
page read and write
3652000
trusted library allocation
page read and write
226D000
stack
page read and write
323F000
stack
page read and write
3662000
trusted library allocation
page read and write
426000
remote allocation
page execute and read and write
320000
unkown
page readonly
4CF0000
trusted library allocation
page execute and read and write
4E76000
trusted library allocation
page read and write
2E0E000
stack
page read and write
212E000
stack
page read and write
CFC000
stack
page read and write
13A0000
heap
page read and write
4E8000
unkown
page readonly
70E000
stack
page read and write
200C2000
direct allocation
page read and write
FA6000
unkown
page readonly
CFD000
trusted library allocation
page execute and read and write
36CE000
trusted library allocation
page read and write
2D00000
heap
page read and write
33FF000
trusted library allocation
page read and write
1353000
heap
page read and write
341A000
trusted library allocation
page read and write
CD1000
unkown
page readonly
73F0000
heap
page read and write
5779000
heap
page read and write
263D000
stack
page read and write
BFD000
stack
page read and write
2800000
heap
page read and write
A7D000
heap
page read and write
35A000
stack
page read and write
9FD000
stack
page read and write
960000
heap
page read and write
246C000
stack
page read and write
2A1C000
trusted library allocation
page read and write
43F000
remote allocation
page execute and read and write
6B75000
heap
page read and write
2971000
trusted library allocation
page read and write
2830000
heap
page read and write
DC0000
heap
page read and write
E97000
unkown
page read and write
1280000
direct allocation
page execute and read and write
22AE000
stack
page read and write
1398000
heap
page read and write
175BE000
stack
page read and write
80E000
stack
page read and write
6F0E000
stack
page read and write
2B50000
heap
page read and write
581E000
heap
page read and write
2B5F000
trusted library allocation
page read and write
76EE000
stack
page read and write
576E000
trusted library allocation
page read and write
57C0000
trusted library allocation
page read and write
57E0000
trusted library allocation
page read and write
780000
heap
page read and write
D84000
heap
page read and write
960000
heap
page read and write
33E6000
trusted library allocation
page read and write
19DDC000
heap
page read and write
2BC3000
trusted library allocation
page read and write
CD0000
heap
page read and write
25ED000
stack
page read and write
53B000
heap
page read and write
5290000
trusted library allocation
page read and write
29EF000
trusted library allocation
page read and write
2A61000
trusted library allocation
page read and write
2DCE000
stack
page read and write
3C0000
heap
page read and write
2A18000
trusted library allocation
page read and write
578D000
trusted library allocation
page read and write
3D30000
heap
page read and write
1337000
heap
page read and write
74F7000
heap
page read and write
29C5000
trusted library allocation
page read and write
5060000
heap
page read and write
C51000
unkown
page execute read
12FA000
stack
page read and write
2A5F000
trusted library allocation
page read and write
8E0000
heap
page read and write
33C3000
trusted library allocation
page read and write
2A63000
trusted library allocation
page read and write
131F000
heap
page read and write
895000
unkown
page readonly
33F3000
trusted library allocation
page read and write
A3D000
stack
page read and write
29E0000
trusted library allocation
page read and write
121000
unkown
page execute read
5860000
trusted library allocation
page execute and read and write
5A30000
trusted library allocation
page execute and read and write
2B97000
trusted library allocation
page read and write
163D000
trusted library allocation
page execute and read and write
2A48000
trusted library allocation
page read and write
4F1000
unkown
page execute read
C5F000
stack
page read and write
1FE81000
direct allocation
page execute read
344C000
trusted library allocation
page read and write
D50000
trusted library allocation
page read and write
345000
unkown
page readonly
4D5D000
stack
page read and write
2850000
trusted library allocation
page read and write
700000
heap
page read and write
2008D000
direct allocation
page execute read
1100000
heap
page read and write
BDE000
stack
page read and write
1DC000
stack
page read and write
A60000
heap
page read and write
502000
remote allocation
page execute and read and write
2A27000
trusted library allocation
page read and write
DC000
stack
page read and write
2B61000
trusted library allocation
page read and write
C80000
unkown
page write copy
2A97000
trusted library allocation
page read and write
4BE000
stack
page read and write
D7D000
heap
page read and write
2A80000
trusted library allocation
page read and write
1611000
heap
page read and write
150000
unkown
page read and write
B1D000
heap
page read and write
3913000
trusted library allocation
page read and write
D6E000
heap
page read and write
273D000
stack
page read and write
6B79000
heap
page read and write
3491000
trusted library allocation
page read and write
51E0000
heap
page read and write
CE4000
trusted library allocation
page read and write
340C000
trusted library allocation
page read and write
7509000
heap
page read and write
5A8F000
stack
page read and write
F70000
heap
page read and write
E10000
heap
page read and write
CD1000
unkown
page readonly
377E000
stack
page read and write
3319000
trusted library allocation
page read and write
2855000
trusted library allocation
page read and write
1309000
heap
page read and write
439000
remote allocation
page execute and read and write
38A0000
trusted library allocation
page read and write
113E000
stack
page read and write
A0E000
stack
page read and write
2A7A000
trusted library allocation
page read and write
2B95000
trusted library allocation
page read and write
7A0000
remote allocation
page read and write
2BBB000
trusted library allocation
page read and write
341D000
trusted library allocation
page read and write
2AFD000
trusted library allocation
page read and write
4B0D000
stack
page read and write
19C6B000
stack
page read and write
DA0000
heap
page read and write
5840000
trusted library allocation
page execute and read and write
8AA000
stack
page read and write
5A80000
heap
page read and write
63D000
stack
page read and write
53F0000
trusted library allocation
page execute and read and write
E31000
unkown
page execute read
5100000
trusted library allocation
page execute and read and write
F80000
heap
page read and write
6A30000
heap
page read and write
13E0000
heap
page read and write
530000
heap
page read and write
2F0E000
stack
page read and write
CED000
trusted library allocation
page execute and read and write
9FE000
stack
page read and write
14AE000
heap
page read and write
29CF000
trusted library allocation
page read and write
6C8D000
stack
page read and write
29FF000
trusted library allocation
page read and write
DD5000
heap
page read and write
3E0000
heap
page read and write
57A9000
heap
page read and write
735F000
heap
page read and write
23EE000
stack
page read and write
1440000
heap
page read and write
C00000
heap
page read and write
2A1A000
trusted library allocation
page read and write
12AE000
stack
page read and write
A5E000
heap
page read and write
2A76000
trusted library allocation
page read and write
1633000
trusted library allocation
page read and write
2B40000
trusted library allocation
page read and write
2B78000
trusted library allocation
page read and write
CF0000
heap
page read and write
25FE000
stack
page read and write
14E0D000
stack
page read and write
1130000
heap
page read and write
62FC000
stack
page read and write
19DE000
stack
page read and write
A9D000
heap
page read and write
C1F000
stack
page read and write
D10000
heap
page read and write
137E000
heap
page read and write
6F0000
heap
page read and write
2B76000
trusted library allocation
page read and write
48D000
stack
page read and write
6B0000
heap
page read and write
19B2D000
heap
page read and write
33CB000
trusted library allocation
page read and write
E9B000
unkown
page readonly
2B00000
trusted library allocation
page read and write
2B64000
trusted library allocation
page read and write
B6A000
heap
page read and write
2B8D000
trusted library allocation
page read and write
29C1000
trusted library allocation
page read and write
3427000
trusted library allocation
page read and write
19D6C000
stack
page read and write
4F0000
unkown
page readonly
4ED0000
trusted library allocation
page execute and read and write
E58000
unkown
page readonly
511B000
stack
page read and write
1657000
trusted library allocation
page execute and read and write
4E90000
trusted library allocation
page read and write
319D000
stack
page read and write
1680000
heap
page read and write
BEE000
unkown
page read and write
A7A000
stack
page read and write
585000
remote allocation
page execute and read and write
2B48000
trusted library allocation
page read and write
116D000
heap
page read and write
5771000
heap
page read and write
6840000
trusted library allocation
page read and write
14E8E000
stack
page read and write
DB4000
heap
page read and write
129B000
heap
page read and write
155E000
stack
page read and write
1452000
heap
page read and write
C70000
trusted library allocation
page read and write
3481000
trusted library allocation
page read and write
2A4E000
trusted library allocation
page read and write
29A1000
trusted library allocation
page read and write
6100000
heap
page read and write
6FC000
stack
page read and write
1040000
heap
page read and write
3497000
trusted library allocation
page read and write
5850000
trusted library allocation
page read and write
27AE000
stack
page read and write
162E000
heap
page read and write
57B0000
trusted library allocation
page read and write
1646000
trusted library allocation
page execute and read and write
515B000
stack
page read and write
19DC0000
heap
page read and write
D7F000
heap
page read and write
525D000
stack
page read and write
65E000
heap
page read and write
6B95000
heap
page read and write
709E000
stack
page read and write
5883000
heap
page read and write
643000
remote allocation
page execute and read and write
345F000
trusted library allocation
page read and write
2E5F000
stack
page read and write
2ED0000
heap
page read and write
1020E000
stack
page read and write
2A78000
trusted library allocation
page read and write
27B0000
heap
page read and write
348F000
trusted library allocation
page read and write
DBD000
heap
page read and write
422000
remote allocation
page execute and read and write
1530000
heap
page read and write
738B000
heap
page read and write
1210000
heap
page read and write
19B7D000
heap
page read and write
1200000
heap
page read and write
3450000
trusted library allocation
page read and write
8E0000
direct allocation
page execute and read and write
604C000
stack
page read and write
33E2000
trusted library allocation
page read and write
2860000
heap
page read and write
1A081000
heap
page read and write
135F000
heap
page read and write
159E000
stack
page read and write
400000
remote allocation
page execute and read and write
E9C000
stack
page read and write
2B4D000
stack
page read and write
C23000
trusted library allocation
page execute and read and write
2EC0000
heap
page read and write
E58000
unkown
page readonly
120000
unkown
page readonly
2840000
trusted library allocation
page read and write
786E000
stack
page read and write
527000
unkown
page read and write
2AF5000
trusted library allocation
page read and write
7340000
heap
page read and write
8AE000
stack
page read and write
577E000
trusted library allocation
page read and write
5C60000
heap
page read and write
2EE0000
heap
page read and write
A50000
heap
page read and write
29E6000
trusted library allocation
page read and write
1510000
trusted library allocation
page read and write
2B10000
trusted library allocation
page read and write
710000
heap
page read and write
C7F000
stack
page read and write
2B8F000
trusted library allocation
page read and write
12DA000
heap
page read and write
E9B000
unkown
page readonly
145000
unkown
page readonly
1610000
heap
page read and write
54DE000
stack
page read and write
48E000
stack
page read and write
C57000
trusted library allocation
page execute and read and write
550000
heap
page read and write
6DCE000
stack
page read and write
C3D000
trusted library allocation
page execute and read and write
4FA000
stack
page read and write
2F10000
heap
page read and write
2B81000
trusted library allocation
page read and write
150000
unkown
page write copy
D30000
heap
page read and write
4CA000
stack
page read and write
430000
remote allocation
page execute and read and write
796E000
stack
page read and write
4241000
trusted library allocation
page read and write
2008F000
direct allocation
page readonly
2B29000
trusted library allocation
page read and write
44E000
stack
page read and write
F9C000
stack
page read and write
70DE000
stack
page read and write
26F0000
trusted library allocation
page read and write
6C0000
heap
page read and write
33D0000
trusted library allocation
page read and write
3971000
trusted library allocation
page read and write
19AFF000
stack
page read and write
5830000
heap
page read and write
2A89000
trusted library allocation
page read and write
9EA000
stack
page read and write
2AFB000
trusted library allocation
page read and write
6D1000
unkown
page execute read
283F000
stack
page read and write
84F000
stack
page read and write
2A93000
trusted library allocation
page read and write
1140000
heap
page read and write
4C0000
unkown
page readonly
B0E000
stack
page read and write
1520000
trusted library allocation
page read and write
D40000
heap
page read and write
1210000
heap
page read and write
3499000
trusted library allocation
page read and write
52B000
unkown
page readonly
424000
remote allocation
page execute and read and write
3414000
trusted library allocation
page read and write
A50000
heap
page read and write
165B000
trusted library allocation
page execute and read and write
4E8000
unkown
page readonly
2B16000
trusted library allocation
page read and write
7B0000
heap
page read and write
33DE000
trusted library allocation
page read and write
20098000
direct allocation
page readonly
3418000
trusted library allocation
page read and write
1F0000
heap
page read and write
2A67000
trusted library allocation
page read and write
164A000
trusted library allocation
page execute and read and write
3469000
trusted library allocation
page read and write
C50000
heap
page read and write
5D80000
trusted library allocation
page read and write
2A44000
trusted library allocation
page read and write
1346000
heap
page read and write
B60000
heap
page read and write
641000
remote allocation
page execute and read and write
C1F000
stack
page read and write
26BF000
trusted library allocation
page read and write
5E0000
direct allocation
page execute and read and write
7320000
heap
page read and write
CEC000
stack
page read and write
296F000
stack
page read and write
C50000
unkown
page readonly
C50000
unkown
page readonly
33E8000
trusted library allocation
page read and write
150000
unkown
page write copy
8FC000
stack
page read and write
50C0000
heap
page read and write
51F0000
heap
page read and write
145000
unkown
page readonly
31D000
stack
page read and write
1200000
heap
page read and write
19F23000
heap
page read and write
29C5000
trusted library allocation
page read and write
1324000
heap
page read and write
2B7E000
trusted library allocation
page read and write
790000
heap
page read and write
2A1E000
trusted library allocation
page read and write
85E000
stack
page read and write
5F7000
stack
page read and write
29A3000
trusted library allocation
page read and write
2E5000
unkown
page readonly
C42000
trusted library allocation
page read and write
56B000
heap
page read and write
4E54000
trusted library allocation
page read and write
29C9000
trusted library allocation
page read and write
2F17000
heap
page read and write
4F4000
unkown
page write copy
6B90000
heap
page read and write
D87000
heap
page read and write
4E7D000
trusted library allocation
page read and write
1652000
trusted library allocation
page read and write
C80000
unkown
page write copy
3A80000
heap
page read and write
1F0000
heap
page read and write
2BAC000
trusted library allocation
page read and write
E4F000
stack
page read and write
531C000
stack
page read and write
4E5000
unkown
page readonly
1057000
heap
page read and write
3952000
trusted library allocation
page read and write
5A60000
heap
page read and write
440000
heap
page read and write
C75000
unkown
page readonly
5764000
trusted library allocation
page read and write
561E000
stack
page read and write
4F00000
heap
page read and write
560000
heap
page read and write
B62000
heap
page read and write
101B0000
heap
page read and write
1445000
heap
page read and write
2B14000
trusted library allocation
page read and write
15B6000
heap
page read and write
A2E000
heap
page read and write
FEE000
stack
page read and write
795000
heap
page read and write
120000
unkown
page readonly
967000
heap
page read and write
4C1000
unkown
page execute read
A90000
heap
page read and write
50F0000
trusted library allocation
page read and write
1239000
stack
page read and write
159E000
stack
page read and write
1337000
stack
page read and write
D0A000
trusted library allocation
page execute and read and write
2AA3000
trusted library allocation
page read and write
5EE000
unkown
page read and write
92F000
stack
page read and write
4D1000
remote allocation
page execute and read and write
1752C000
stack
page read and write
4EF0000
heap
page execute and read and write
26AC000
stack
page read and write
58D000
heap
page read and write
1310000
heap
page read and write
D30000
heap
page read and write
3D0000
heap
page read and write
CC0000
trusted library allocation
page execute and read and write
5ACC000
stack
page read and write
5800000
heap
page execute and read and write
63C000
stack
page read and write
2716000
trusted library allocation
page read and write
8BE000
stack
page read and write
5786000
trusted library allocation
page read and write
53C0000
trusted library allocation
page read and write
535E000
stack
page read and write
5A0000
heap
page read and write
2A4D000
trusted library allocation
page read and write
344E000
trusted library allocation
page read and write
3100000
trusted library allocation
page read and write
A4E000
stack
page read and write
131A000
heap
page read and write
A80000
heap
page read and write
2A0C000
trusted library allocation
page read and write
52C0000
heap
page read and write
1318000
heap
page read and write
A6A000
heap
page read and write
7380000
heap
page read and write
3416000
trusted library allocation
page read and write
2A9D000
trusted library allocation
page read and write
3401000
trusted library allocation
page read and write
23FD000
stack
page read and write
5C70000
heap
page read and write
2B0E000
stack
page read and write
6D0000
unkown
page readonly
1410000
heap
page read and write
2DCE000
unkown
page read and write
D5F000
stack
page read and write
52C000
stack
page read and write
19C000
stack
page read and write
347E000
trusted library allocation
page read and write
B0D000
heap
page read and write
26C5000
trusted library allocation
page read and write
2A55000
trusted library allocation
page read and write
40D000
remote allocation
page execute and read and write
21EE000
stack
page read and write
D1B000
trusted library allocation
page execute and read and write
6E5D000
stack
page read and write
E9C000
stack
page read and write
760000
heap
page read and write
E95000
heap
page read and write
AD0000
heap
page read and write
2F5F000
stack
page read and write
D12000
trusted library allocation
page read and write
700000
unkown
page write copy
99F000
stack
page read and write
DF0000
trusted library allocation
page read and write
FE0000
heap
page read and write
ADB000
heap
page read and write
29D1000
trusted library allocation
page read and write
E6E000
stack
page read and write
5298000
trusted library allocation
page read and write
1220000
heap
page read and write
26C0000
trusted library allocation
page read and write
895000
unkown
page readonly
13C9000
heap
page read and write
26D0000
trusted library allocation
page read and write
4E5B000
trusted library allocation
page read and write
4B1000
remote allocation
page execute and read and write
387E000
stack
page read and write
750D000
heap
page read and write
521F000
stack
page read and write
1288E000
stack
page read and write
29E8000
trusted library allocation
page read and write
50B0000
heap
page read and write
540000
heap
page read and write
B19000
heap
page read and write
29E2000
trusted library allocation
page read and write
19B86000
heap
page read and write
4E8000
unkown
page readonly
6D0000
heap
page read and write
DDE000
stack
page read and write
2B42000
trusted library allocation
page read and write
A10000
trusted library allocation
page read and write
E64000
unkown
page write copy
541C000
stack
page read and write
5F0000
heap
page read and write
5280000
heap
page read and write
3656000
trusted library allocation
page read and write
2660000
heap
page execute and read and write
721E000
stack
page read and write
52B000
unkown
page readonly
1640000
trusted library allocation
page read and write
1462000
heap
page read and write
2E5000
unkown
page readonly
C50000
unkown
page readonly
3431000
trusted library allocation
page read and write
6F5000
unkown
page readonly
285E000
stack
page read and write
2841000
trusted library allocation
page read and write
345D000
trusted library allocation
page read and write
5767000
heap
page read and write
2BAA000
trusted library allocation
page read and write
9C000
stack
page read and write
66D000
heap
page read and write
21CD000
stack
page read and write
6B69000
heap
page read and write
7326000
heap
page read and write
295E000
stack
page read and write
2BA4000
trusted library allocation
page read and write
CA0000
heap
page read and write
2B93000
trusted library allocation
page read and write
4F20000
trusted library allocation
page read and write
91B000
stack
page read and write
CEE000
unkown
page read and write
B17000
heap
page read and write
DEC000
stack
page read and write
A70000
heap
page read and write
2A7E000
trusted library allocation
page read and write
309E000
stack
page read and write
7513000
heap
page read and write
6B62000
heap
page read and write
4F10000
trusted library allocation
page execute and read and write
350000
unkown
page write copy
2919000
trusted library allocation
page read and write
294F000
trusted library allocation
page read and write
2BB2000
trusted library allocation
page read and write
6F9000
stack
page read and write
2EE0000
heap
page read and write
1446000
heap
page read and write
89D000
heap
page read and write
2B91000
trusted library allocation
page read and write
6C4E000
heap
page read and write
2BDC000
trusted library allocation
page read and write
14CD000
heap
page read and write
5CB0000
heap
page read and write
930000
heap
page read and write
4E50000
trusted library allocation
page read and write
2CCF000
stack
page read and write
4F0000
unkown
page readonly
BE0000
heap
page read and write
9AD000
stack
page read and write
4EE0000
heap
page execute and read and write
1034D000
stack
page read and write
3478000
trusted library allocation
page read and write
19B3E000
heap
page read and write
D60000
heap
page read and write
4C0000
unkown
page readonly
291D000
trusted library allocation
page read and write
27EC000
stack
page read and write
4A6000
remote allocation
page execute and read and write
131D000
heap
page read and write
C3A000
stack
page read and write
2A6C000
trusted library allocation
page read and write
33FB000
trusted library allocation
page read and write
150000
unkown
page write copy
1220000
heap
page read and write
2AA0000
trusted library allocation
page read and write
33FD000
trusted library allocation
page read and write
CD1000
unkown
page readonly
B12000
heap
page read and write
D60000
trusted library allocation
page read and write
57A0000
trusted library allocation
page read and write
3495000
trusted library allocation
page read and write
69E000
unkown
page read and write
425000
remote allocation
page execute and read and write
6D0000
unkown
page readonly
2B72000
trusted library allocation
page read and write
1D0000
heap
page read and write
127E000
stack
page read and write
9AE000
stack
page read and write
2A10000
trusted library allocation
page read and write
4E82000
trusted library allocation
page read and write
33E4000
trusted library allocation
page read and write
150000
unkown
page write copy
AA8000
heap
page read and write
3461000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
3403000
trusted library allocation
page read and write
5040000
trusted library section
page readonly
2ECE000
stack
page read and write
1617000
heap
page read and write
3370000
trusted library allocation
page read and write
C2D000
trusted library allocation
page execute and read and write
2A34000
trusted library allocation
page read and write
2A97000
trusted library allocation
page read and write
1160000
heap
page read and write
7503000
heap
page read and write
910000
heap
page read and write
2AF9000
trusted library allocation
page read and write
630000
remote allocation
page execute and read and write
8AF000
unkown
page read and write
2BC5000
trusted library allocation
page read and write
5B3E000
stack
page read and write
121000
unkown
page execute read
2B12000
trusted library allocation
page read and write
4C0000
unkown
page readonly
5200000
trusted library allocation
page read and write
4C1000
unkown
page execute read
345000
unkown
page readonly
4CE0000
heap
page read and write
2B9B000
trusted library allocation
page read and write
9AF000
stack
page read and write
71DE000
stack
page read and write
A20000
heap
page read and write
D97000
heap
page read and write
26F4000
trusted library allocation
page read and write
3660000
trusted library allocation
page read and write
C20000
trusted library allocation
page read and write
200CF000
direct allocation
page readonly
2A14000
trusted library allocation
page read and write
4C0000
unkown
page readonly
A6D000
heap
page read and write
FE0000
heap
page read and write
33C9000
trusted library allocation
page read and write
12B0000
heap
page read and write
5364000
heap
page read and write
161E000
heap
page read and write
3126000
trusted library allocation
page read and write
68E000
stack
page read and write
51F0000
heap
page read and write
4C5D000
stack
page read and write
3444000
trusted library allocation
page read and write
29BC000
trusted library allocation
page read and write
297B000
trusted library allocation
page read and write
2200000
remote allocation
page read and write
2944000
trusted library allocation
page read and write
269E000
stack
page read and write
16D0000
heap
page read and write
33E0000
trusted library allocation
page read and write
870000
heap
page read and write
AFC000
heap
page read and write
570000
heap
page read and write
26E0000
heap
page read and write
B07000
heap
page read and write
5720000
heap
page read and write
740000
direct allocation
page execute and read and write
650000
heap
page read and write
6800000
trusted library allocation
page execute and read and write
13BC000
heap
page read and write
1346000
heap
page read and write
4C1000
unkown
page execute read
2B74000
trusted library allocation
page read and write
4A0000
direct allocation
page execute and read and write
5760000
trusted library allocation
page read and write
352E000
stack
page read and write
511E000
stack
page read and write
9ED000
stack
page read and write
509E000
heap
page read and write
400000
heap
page read and write
B49000
heap
page read and write
572C000
heap
page read and write
29F3000
trusted library allocation
page read and write
D00000
trusted library allocation
page read and write
1614000
heap
page read and write
256D000
stack
page read and write
570000
heap
page read and write
2A99000
trusted library allocation
page read and write
346B000
trusted library allocation
page read and write
57BE000
heap
page read and write
E90000
heap
page read and write
1361000
heap
page read and write
7364000
heap
page read and write
A47000
heap
page read and write
27F0000
heap
page execute and read and write
82E000
unkown
page read and write
6F5E000
stack
page read and write
92F000
unkown
page read and write
270E000
trusted library allocation
page read and write
241D000
stack
page read and write
A62000
heap
page read and write
26E3000
heap
page read and write
1327000
heap
page read and write
65A000
heap
page read and write
1361000
heap
page read and write
2820000
trusted library allocation
page read and write
26E0000
heap
page read and write
D70000
heap
page read and write
3493000
trusted library allocation
page read and write
4E5000
unkown
page readonly
2B7A000
trusted library allocation
page read and write
There are 1194 hidden memdumps, click here to show them.