Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
C:\Users\user\Desktop\extract\Setup.exe
|
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
dropped
|
 |
|
|
C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-core-profile-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-core-rtlsupport-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-core-string-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-core-synch-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-core-synch-l1-2-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-core-sysinfo-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-core-timezone-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-core-util-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-crt-conio-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-crt-convert-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-crt-environment-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-crt-filesystem-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-crt-heap-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-crt-locale-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-crt-math-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-crt-multibyte-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-crt-private-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\extract\api-ms-win-crt-process-l1-1-0.dll
|
PE32+ executable (DLL) (console) x86-64, for MS Windows
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_api_24a6e77318e0bb5eb29992db4daf9eb8d15327cf_e147a954_86d35f76-f56e-4ffc-bc94-3736a8796053\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_api_6c6a6e6bf6b445970e8ef838c8696bd7b5876e0_e147a954_2d8b9a80-499f-4738-8ce7-7d8647786680\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_api_9df865fded585f94f5f016e71860a3884066_e147a954_57177326-392c-4f9b-955a-5f42c59945a9\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_api_9df865fded585f94f5f016e71860a3884066_e147a954_d0a27185-710b-4546-a743-76e98b285bfe\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB2CA.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Oct 30 00:55:16 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB31A.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB349.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC009.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Oct 30 00:55:19 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC087.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC097.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Oct 30 00:55:19 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC103.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Oct 30 00:55:20 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC105.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC172.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1D1.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1EE.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC23E.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\Desktop\cmdline.out
|
ASCII text, with CRLF line terminators
|
modified
|
||
|
C:\Users\user\Desktop\download\idverificationz.zip
|
Zip archive data, at least v2.0 to extract, compression method=deflate
|
dropped
|
||
|
C:\Users\user\Desktop\extract\ks_tyres.ini
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF, CR line terminators
|
dropped
|
There are 32 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\SysWOW64\7za.exe
|
7za x -y -pinfected -o"C:\Users\user\Desktop\extract" "C:\Users\user\Desktop\download\idverificationz.zip"
|
|
|
|
C:\Windows\System32\loaddll64.exe
|
loaddll64.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll"
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll,FlushInstructionCache
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",#1
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll,GetCurrentProcessorNumber
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll,GetCurrentProcessorNumberEx
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",FlushInstructionCache
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",GetCurrentProcessorNumber
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",GetCurrentProcessorNumberEx
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",SetThreadIdealProcessorEx
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",SetThreadContext
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",SetProcessMitigationPolicy
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",OpenProcess
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",IsProcessorFeaturePresent
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",GetThreadTimes
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",GetThreadIdealProcessorEx
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",GetThreadContext
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",GetProcessMitigationPolicy
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",GetProcessHandleCount
|
|
|
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",GetCurrentThreadStackLimits
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition
--user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://idverificationz.b-cdn.net/idverificationz.zip"
> cmdline.out 2>&1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\wget.exe
|
wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0
(Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://idverificationz.b-cdn.net/idverificationz.zip"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\extract\api-ms-win-core-processthreads-l1-1-1.dll",#1
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 2316 -s 316
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 6208 -s 312
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 6304 -s 316
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 7104 -s 316
|
There are 20 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://idverificationz.b-cdn.net/idverificationz.zip
|
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=ct
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso
|
unknown
|
||
|
http://ocsp.sectigo.com0
|
unknown
|
||
|
http://www.ezbsystems.com)
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=kr
|
unknown
|
||
|
http://forum.ezbsystems.com
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=cn
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=gr
|
unknown
|
||
|
http://www.ultraiso.com
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=de
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=tr
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=pt
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=tw
|
unknown
|
||
|
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=cz
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=he
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=pl
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=se
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=jp
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=fr
|
unknown
|
||
|
https://idverificationz.b-cdn.net/idverificationz.zipOC
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=sk
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=by
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=si
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=ar
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=et
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=es
|
unknown
|
||
|
https://sectigo.com/CPS0
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=my
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=it
|
unknown
|
||
|
https://idverificationz.b-cdn.net/idverificationz.zip
|
169.150.247.35
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=no
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=nl
|
unknown
|
||
|
http://www.ezbsystems.comhttp://www.ezbsystems.com/ultraisohttp://www.ezbsystems.com/ultraiso/order.
|
unknown
|
||
|
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=bg
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=jphttp://www.ezbsystems.com/ultraiso/order.php?u
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=fi
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=ru
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=vn
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=ro
|
unknown
|
||
|
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.htm
|
unknown
|
||
|
http://www.ezbsystems.comDVarFileInfo$
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=lt
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=dk
|
unknown
|
||
|
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=hu
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=ua
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=hr
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=lv
|
unknown
|
||
|
http://www.ezbsystems.com
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=mk
|
unknown
|
||
|
http://www.ezbsystems.com/easyboot
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=yu
|
unknown
|
||
|
http://www.ezbsystems.com/ultraiso/order.php?uilang=id
|
unknown
|
There are 47 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
idverificationz.b-cdn.net
|
169.150.247.35
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
169.150.247.35
|
idverificationz.b-cdn.net
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
ProgramId
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
FileId
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
LongPathHash
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Name
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
OriginalFileName
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Publisher
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Version
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
BinFileVersion
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
BinaryType
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
ProductName
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
ProductVersion
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
LinkDate
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
BinProductVersion
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Size
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Language
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
IsOsComponent
|
||
|
\REGISTRY\A\{f8bbfc5a-6806-ba07-e26c-b52a4c29ca81}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Usn
|
There are 10 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
AB4E17F000
|
stack
|
page read and write
|
||
|
15952235000
|
heap
|
page read and write
|
||
|
1BB507B0000
|
heap
|
page read and write
|
||
|
68D050E000
|
stack
|
page read and write
|
||
|
2F00000
|
heap
|
page read and write
|
||
|
15951FA8000
|
heap
|
page read and write
|
||
|
284501C5000
|
heap
|
page read and write
|
||
|
186E1C90000
|
heap
|
page read and write
|
||
|
1DD228D0000
|
heap
|
page read and write
|
||
|
2122E1E0000
|
heap
|
page read and write
|
||
|
A0E000
|
stack
|
page read and write
|
||
|
1BB50840000
|
heap
|
page read and write
|
||
|
1E9E68E0000
|
heap
|
page read and write
|
||
|
29948CC0000
|
heap
|
page read and write
|
||
|
2E55C970000
|
heap
|
page read and write
|
||
|
1ACC451E000
|
heap
|
page read and write
|
||
|
9D8872C000
|
stack
|
page read and write
|
||
|
D0000
|
heap
|
page read and write
|
||
|
262E8B10000
|
heap
|
page read and write
|
||
|
5243D2F000
|
stack
|
page read and write
|
||
|
197A68B5000
|
heap
|
page read and write
|
||
|
1E9E6820000
|
heap
|
page read and write
|
||
|
2122E269000
|
heap
|
page read and write
|
||
|
1160000
|
heap
|
page read and write
|
||
|
2122E5A0000
|
heap
|
page read and write
|
||
|
18462898000
|
heap
|
page read and write
|
||
|
68D048C000
|
stack
|
page read and write
|
||
|
186E1D10000
|
heap
|
page read and write
|
||
|
29948EA5000
|
heap
|
page read and write
|
||
|
1E9E6740000
|
heap
|
page read and write
|
||
|
39144FF000
|
stack
|
page read and write
|
||
|
29948CC8000
|
heap
|
page read and write
|
||
|
18462B40000
|
heap
|
page read and write
|
||
|
22308AA5000
|
heap
|
page read and write
|
||
|
2AEA000
|
heap
|
page read and write
|
||
|
220460D0000
|
heap
|
page read and write
|
||
|
1E9E6840000
|
heap
|
page read and write
|
||
|
AB4E07C000
|
stack
|
page read and write
|
||
|
29948BD0000
|
heap
|
page read and write
|
||
|
117E000
|
stack
|
page read and write
|
||
|
9D887AF000
|
stack
|
page read and write
|
||
|
1ACC4480000
|
heap
|
page read and write
|
||
|
47DEEFF000
|
stack
|
page read and write
|
||
|
2B20000
|
heap
|
page read and write
|
||
|
23E6CE95000
|
heap
|
page read and write
|
||
|
118B000
|
heap
|
page read and write
|
||
|
6E813DF000
|
stack
|
page read and write
|
||
|
11D8000
|
heap
|
page read and write
|
||
|
1E25D600000
|
heap
|
page read and write
|
||
|
262E8E95000
|
heap
|
page read and write
|
||
|
1E9E68F0000
|
heap
|
page read and write
|
||
|
1BB505E0000
|
heap
|
page read and write
|
||
|
151E000
|
stack
|
page read and write
|
||
|
28484A70000
|
heap
|
page read and write
|
||
|
1BB505E7000
|
heap
|
page read and write
|
||
|
B0A859F000
|
stack
|
page read and write
|
||
|
18462860000
|
heap
|
page read and write
|
||
|
22046320000
|
heap
|
page read and write
|
||
|
1170000
|
heap
|
page read and write
|
||
|
110000
|
heap
|
page read and write
|
||
|
2B1E000
|
heap
|
page read and write
|
||
|
262E8B30000
|
heap
|
page read and write
|
||
|
23E6CC10000
|
heap
|
page read and write
|
||
|
186E1CC0000
|
heap
|
page read and write
|
||
|
1185000
|
heap
|
page read and write
|
||
|
1CD42FC5000
|
heap
|
page read and write
|
||
|
11C5000
|
heap
|
page read and write
|
||
|
186E2005000
|
heap
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
1CD42D90000
|
heap
|
page read and write
|
||
|
29948BF0000
|
heap
|
page read and write
|
||
|
15951F70000
|
heap
|
page read and write
|
||
|
B0A851C000
|
stack
|
page read and write
|
||
|
2230A520000
|
heap
|
page read and write
|
||
|
A60000
|
heap
|
page read and write
|
||
|
175F000
|
stack
|
page read and write
|
||
|
1E25D2B0000
|
heap
|
page read and write
|
||
|
23E6CBE0000
|
heap
|
page read and write
|
||
|
2994A790000
|
heap
|
page read and write
|
||
|
1DD225A0000
|
heap
|
page read and write
|
||
|
22308990000
|
heap
|
page read and write
|
||
|
1ACC4785000
|
heap
|
page read and write
|
||
|
83626FF000
|
stack
|
page read and write
|
||
|
118C000
|
heap
|
page read and write
|
||
|
1E25D655000
|
heap
|
page read and write
|
||
|
1E25D650000
|
heap
|
page read and write
|
||
|
1BB50800000
|
unkown
|
page readonly
|
||
|
1E9E68F8000
|
heap
|
page read and write
|
||
|
5243DAF000
|
stack
|
page read and write
|
||
|
23E6CBF0000
|
heap
|
page read and write
|
||
|
15951FA0000
|
heap
|
page read and write
|
||
|
2844FEF0000
|
heap
|
page read and write
|
||
|
1E25D480000
|
heap
|
page read and write
|
||
|
FE4BE7F000
|
stack
|
page read and write
|
||
|
197A6670000
|
heap
|
page read and write
|
||
|
118D000
|
heap
|
page read and write
|
||
|
1DD225C0000
|
heap
|
page read and write
|
||
|
15952230000
|
heap
|
page read and write
|
||
|
99929EC000
|
stack
|
page read and write
|
||
|
220461A8000
|
heap
|
page read and write
|
||
|
262E8AF0000
|
heap
|
page read and write
|
||
|
14DE000
|
stack
|
page read and write
|
||
|
3020000
|
trusted library allocation
|
page read and write
|
||
|
DAF000
|
stack
|
page read and write
|
||
|
18462B45000
|
heap
|
page read and write
|
||
|
28484970000
|
heap
|
page read and write
|
||
|
2844FE90000
|
heap
|
page read and write
|
||
|
5AE2BDF000
|
stack
|
page read and write
|
||
|
29948CCE000
|
heap
|
page read and write
|
||
|
22308B58000
|
heap
|
page read and write
|
||
|
2122E250000
|
heap
|
page read and write
|
||
|
28484B80000
|
heap
|
page read and write
|
||
|
A14DE7C000
|
stack
|
page read and write
|
||
|
9E1594C000
|
stack
|
page read and write
|
||
|
23E6CE90000
|
heap
|
page read and write
|
||
|
220461A0000
|
heap
|
page read and write
|
||
|
23E6CE70000
|
heap
|
page read and write
|
||
|
23E6CC40000
|
heap
|
page read and write
|
||
|
15951F60000
|
heap
|
page read and write
|
||
|
D6000
|
heap
|
page read and write
|
||
|
161F000
|
stack
|
page read and write
|
||
|
391457F000
|
stack
|
page read and write
|
||
|
186E38B0000
|
heap
|
page read and write
|
||
|
2E55C790000
|
heap
|
page read and write
|
||
|
1180000
|
heap
|
page read and write
|
||
|
1F6636C000
|
stack
|
page read and write
|
||
|
186E1CA0000
|
heap
|
page read and write
|
||
|
2844FE70000
|
heap
|
page read and write
|
||
|
165E000
|
stack
|
page read and write
|
||
|
10FD000
|
stack
|
page read and write
|
||
|
2844FEC0000
|
unkown
|
page readonly
|
||
|
AB8000
|
heap
|
page read and write
|
||
|
2B1A000
|
heap
|
page read and write
|
||
|
1CD42FC0000
|
heap
|
page read and write
|
||
|
2B16000
|
heap
|
page read and write
|
||
|
28484B85000
|
heap
|
page read and write
|
||
|
197A6870000
|
heap
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
1BB52000000
|
heap
|
page read and write
|
||
|
18462990000
|
unkown
|
page readonly
|
||
|
197A6758000
|
heap
|
page read and write
|
||
|
1BB507D0000
|
heap
|
page read and write
|
||
|
1E9E6B65000
|
heap
|
page read and write
|
||
|
18462840000
|
heap
|
page read and write
|
||
|
18464360000
|
heap
|
page read and write
|
||
|
FAF000
|
stack
|
page read and write
|
||
|
1BB505D0000
|
heap
|
page read and write
|
||
|
197A68B0000
|
heap
|
page read and write
|
||
|
11A0000
|
heap
|
page read and write
|
||
|
186E2000000
|
heap
|
page read and write
|
||
|
9E15C7F000
|
stack
|
page read and write
|
||
|
3CC38FF000
|
stack
|
page read and write
|
||
|
AF1000
|
heap
|
page read and write
|
||
|
3CC35AC000
|
stack
|
page read and write
|
||
|
B0A887F000
|
stack
|
page read and write
|
||
|
1DD228D5000
|
heap
|
page read and write
|
||
|
2122E220000
|
heap
|
page read and write
|
||
|
1DD22678000
|
heap
|
page read and write
|
||
|
1CD42DD0000
|
heap
|
page read and write
|
||
|
2844FEF8000
|
heap
|
page read and write
|
||
|
18462890000
|
heap
|
page read and write
|
||
|
9992CFF000
|
stack
|
page read and write
|
||
|
1F6667F000
|
stack
|
page read and write
|
||
|
262E8E20000
|
heap
|
page read and write
|
||
|
47DEF7F000
|
stack
|
page read and write
|
||
|
186217F000
|
stack
|
page read and write
|
||
|
11B0000
|
trusted library allocation
|
page read and write
|
||
|
15953AF0000
|
heap
|
page read and write
|
||
|
2122E25D000
|
heap
|
page read and write
|
||
|
1ACC4510000
|
heap
|
page read and write
|
||
|
5243CAC000
|
stack
|
page read and write
|
||
|
FE4BEFF000
|
stack
|
page read and write
|
||
|
2E55CB20000
|
heap
|
page read and write
|
||
|
2122E259000
|
heap
|
page read and write
|
||
|
836267C000
|
stack
|
page read and write
|
||
|
1E25D3B0000
|
heap
|
page read and write
|
||
|
22045FD0000
|
heap
|
page read and write
|
||
|
18462760000
|
heap
|
page read and write
|
||
|
11D0000
|
heap
|
page read and write
|
||
|
9D88A7F000
|
stack
|
page read and write
|
||
|
2122E1D0000
|
heap
|
page read and write
|
||
|
391447C000
|
stack
|
page read and write
|
||
|
1190000
|
heap
|
page read and write
|
||
|
3000000
|
trusted library allocation
|
page read and write
|
||
|
2AE0000
|
heap
|
page read and write
|
||
|
47DEE7C000
|
stack
|
page read and write
|
||
|
118E000
|
heap
|
page read and write
|
||
|
22046420000
|
heap
|
page read and write
|
||
|
1ACC6040000
|
heap
|
page read and write
|
||
|
1DD228A0000
|
heap
|
page read and write
|
||
|
28484940000
|
heap
|
page read and write
|
||
|
22308A70000
|
heap
|
page read and write
|
||
|
1DD224C0000
|
heap
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
1F663EF000
|
stack
|
page read and write
|
||
|
1E25D488000
|
heap
|
page read and write
|
||
|
1ACC4518000
|
heap
|
page read and write
|
||
|
13DE000
|
stack
|
page read and write
|
||
|
D43B07C000
|
stack
|
page read and write
|
||
|
9CC000
|
stack
|
page read and write
|
||
|
68D058E000
|
stack
|
page read and write
|
||
|
1CD42DC0000
|
unkown
|
page readonly
|
||
|
262E8E90000
|
heap
|
page read and write
|
||
|
15952170000
|
heap
|
page read and write
|
||
|
1ACC4780000
|
heap
|
page read and write
|
||
|
3CC39FF000
|
stack
|
page read and write
|
||
|
262E8AE0000
|
heap
|
page read and write
|
||
|
2E55C990000
|
heap
|
page read and write
|
||
|
220460B0000
|
heap
|
page read and write
|
||
|
2E55CB25000
|
heap
|
page read and write
|
||
|
6E8167F000
|
stack
|
page read and write
|
||
|
1BB50845000
|
heap
|
page read and write
|
||
|
284501C0000
|
heap
|
page read and write
|
||
|
197A6850000
|
heap
|
page read and write
|
||
|
186E1D18000
|
heap
|
page read and write
|
||
|
29948AF0000
|
heap
|
page read and write
|
||
|
2E55CAB0000
|
heap
|
page read and write
|
||
|
23E6CC48000
|
heap
|
page read and write
|
||
|
5AE2B5F000
|
stack
|
page read and write
|
||
|
2844FD90000
|
heap
|
page read and write
|
||
|
28486460000
|
heap
|
page read and write
|
||
|
364567C000
|
stack
|
page read and write
|
||
|
9E159CE000
|
stack
|
page read and write
|
||
|
197A6750000
|
heap
|
page read and write
|
||
|
22046425000
|
heap
|
page read and write
|
||
|
262E8B38000
|
heap
|
page read and write
|
||
|
9992C7F000
|
stack
|
page read and write
|
||
|
A14DF7F000
|
stack
|
page read and write
|
||
|
29948EA0000
|
heap
|
page read and write
|
||
|
1CD42D70000
|
heap
|
page read and write
|
||
|
2E55C7A8000
|
heap
|
page read and write
|
||
|
5AE2ADC000
|
stack
|
page read and write
|
||
|
22308AB0000
|
heap
|
page read and write
|
||
|
284518A0000
|
heap
|
page read and write
|
||
|
2DDF000
|
stack
|
page read and write
|
||
|
6E8135C000
|
stack
|
page read and write
|
||
|
2B22000
|
heap
|
page read and write
|
||
|
1CD448C0000
|
heap
|
page read and write
|
||
|
36456FF000
|
stack
|
page read and write
|
||
|
DFC000
|
stack
|
page read and write
|
||
|
1ACC44B0000
|
heap
|
page read and write
|
||
|
A4E000
|
stack
|
page read and write
|
||
|
2AED000
|
heap
|
page read and write
|
||
|
28484977000
|
heap
|
page read and write
|
||
|
186207C000
|
stack
|
page read and write
|
||
|
22308B50000
|
heap
|
page read and write
|
||
|
1CD42C90000
|
heap
|
page read and write
|
||
|
11C0000
|
heap
|
page read and write
|
||
|
18620FF000
|
stack
|
page read and write
|
||
|
1E9E6B60000
|
heap
|
page read and write
|
||
|
D43B17F000
|
stack
|
page read and write
|
||
|
2E55C7A0000
|
heap
|
page read and write
|
||
|
2E30000
|
heap
|
page read and write
|
||
|
22308AA0000
|
heap
|
page read and write
|
||
|
28484860000
|
heap
|
page read and write
|
||
|
A14DEFF000
|
stack
|
page read and write
|
||
|
836277F000
|
stack
|
page read and write
|
||
|
1DD22670000
|
heap
|
page read and write
|
||
|
1CD42DD8000
|
heap
|
page read and write
|
||
|
D43B0FF000
|
stack
|
page read and write
|
||
|
AB0000
|
heap
|
page read and write
|
||
|
FE4BBEC000
|
stack
|
page read and write
|
||
|
1E25D390000
|
heap
|
page read and write
|
||
|
1ACC4490000
|
heap
|
page read and write
|
||
|
197A8140000
|
heap
|
page read and write
|
||
|
AB4E0FF000
|
stack
|
page read and write
|
There are 256 hidden memdumps, click here to show them.