IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\DHCGHDHIDH.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\HDAFIIDAKJ.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_5c39e2f0624fb3ace2547e2d794ca76a89c913_e446d4ea_245f8564-d534-4b59-a8c9-ca98f78cc747\Report.wer
data
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_5c39e2f0624fb3ace2547e2d794ca76a89c913_e446d4ea_fea9f638-5ef5-4df2-b30b-be656963e699\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\userFBKFCFBFID.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\userIEHDAFHDHC.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\sql[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf75d3791d7_vrewqgq[1].exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66cf818156193_ldjfnsfd[1].exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\AAEBAFBGIDHCBFHIECFCBGHIEG
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\AEBAKJDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\AECFCAAE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CAFBGDHCBAEH\DHDAKF
SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
dropped
C:\ProgramData\EGIIJDHCGCBK\AAFIDG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\EGIIJDHCGCBK\BAAEHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EGIIJDHCGCBK\DGIJDA
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EGIIJDHCGCBK\EGIIJD
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EGIIJDHCGCBK\EGIIJD-shm
data
dropped
C:\ProgramData\EGIIJDHCGCBK\FBFCFI
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\EGIIJDHCGCBK\GIJKKK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EGIIJDHCGCBK\HJKKFI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EGIIJDHCGCBK\IJKJJK
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EGIIJDHCGCBK\IJKJJK-shm
data
dropped
C:\ProgramData\EGIIJDHCGCBK\JDBGHI
SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
dropped
C:\ProgramData\EGIIJDHCGCBK\JKFIDG
ASCII text, with very long lines (1769), with CRLF line terminators
dropped
C:\ProgramData\EGIIJDHCGCBK\KKKEBK
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GDHDAEBGCAAFIDGCGDHI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GIJEGDAKEHJECAKEGDHJDHDAFH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\IIJJDGHJKKJEBFHJDBGH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJDBAEHIJKJKEBFIEGHIDAAECB
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\KJJJKFIIIJJJECAAEHDB
ASCII text, with very long lines (1769), with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER37EE.tmp.dmp
Mini DuMP crash report, 15 streams, Wed Aug 28 22:46:47 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3918.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3938.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER74EC.tmp.dmp
Mini DuMP crash report, 15 streams, Wed Aug 28 20:55:17 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER76F1.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER775F.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHCGHDHIDH.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HDAFIIDAKJ.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userFBKFCFBFID.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userIEHDAFHDHC.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\delays.tmp
ISO-8859 text, with very long lines (65536), with no line terminators
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 54 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\userFBKFCFBFID.exe
"C:\Users\userFBKFCFBFID.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\userIEHDAFHDHC.exe
"C:\Users\userIEHDAFHDHC.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\DHCGHDHIDH.exe
"C:\ProgramData\DHCGHDHIDH.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\HDAFIIDAKJ.exe
"C:\ProgramData\HDAFIIDAKJ.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userFBKFCFBFID.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userIEHDAFHDHC.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1760
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 1704
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EGIIJDHCGCBK" & exit
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout /t 10
There are 20 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://46.8.231.109/c4754d4f680ead72.phpb
unknown
 malicious
https://t.me/iyigunl
unknown
 malicious
http://147.45.68.138/nss3.dll
147.45.68.138
 malicious
http://46.8.231.109/c4754d4f680ead72.php
46.8.231.109
 malicious
http://46.8.231.109/c4754d4f680ead72.phpnu
unknown
 malicious
https://condedqpwqm.shop/api.
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
46.8.231.109
 malicious
https://steamcommunity.com/profiles/76561199761128941
malicious
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
46.8.231.109
 malicious
http://147.45.68.138/vcruntime140.dll
147.45.68.138
 malicious
http://46.8.231.109/c4754d4f680ead72.phpC
unknown
 malicious
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exe
147.45.44.104
 malicious
http://46.8.231.109/c4754d4f680ead72.phpry=----IDHIIJJJKEGIDGCBAFIJdefaultrelease
unknown
 malicious
http://147.45.68.138/mozglue.dll
147.45.68.138
 malicious
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
46.8.231.109
 malicious
locatedblsoqp.shop
malicious
caffegclasiqwp.shop
malicious
millyscroqwp.shop
malicious
http://46.8.231.109
unknown
 malicious
http://46.8.231.109/c4754d4f680ead72.php:#
unknown
 malicious
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
46.8.231.109
 malicious
http://46.8.231.109/c4754d4f680ead72.phpw
unknown
 malicious
http://147.45.68.138/freebl3.dll
147.45.68.138
 malicious
traineiwnqo.shop
malicious
https://t.me/
unknown
 malicious
condedqpwqm.shop
malicious
http://stadiatechnologies.com/
95.164.119.162
 malicious
http://147.45.68.138/
147.45.68.138
 malicious
http://147.45.68.138/sql.dll
147.45.68.138
 malicious
http://147.45.68.138/softokn3.dll
147.45.68.138
 malicious
stagedchheiqwo.shop
malicious
stamppreewntnq.shop
malicious
http://147.45.68.138/nss3.dll&aQ~)
unknown
 malicious
evoliutwoqm.shop
malicious
http://147.45.68.138/msvcp140.dll
147.45.68.138
 malicious
http://46.8.231.109/
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
46.8.231.109
 malicious
https://t.me/iyigunlsql.dllsqlr.dllIn
unknown
 malicious
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
unknown
https://www.cloudflare.com/learning/access-management/phishing-attack/
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll_
unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll#
unknown
https://condedqpwqm.shop/api45
unknown
http://147.45.68.138/~
unknown
https://t.me/jamelwtkwnvfdhttps://steamcommunity.com/profiles/76561199761128941b
unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlli
unknown
http://46.8.231.109KFCFBFIDdata;
unknown
http://147.45.68.138:80
unknown
http://147.45.44.104/prog/66cf818156193_ldjfnsfd.exe-data;
unknown
http://stadiatechnologies.com/P_
unknown
http://stadiatechnologies.comntent-Disposition:
unknown
http://147.45.68.138/sql.dllna
unknown
https://condedqpwqm.shop/apitK
unknown
http://147.45.68.138/softokn3.dllPq
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
unknown
http://147.45.68.138:80JK
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://t.me/jamelwt#cp
unknown
http://147.45.68.138:80fa20b20dvTLLjcqfGclHNCCYSAESCTrC.exe
unknown
https://mozilla.org0/
unknown
http://stadiatechnologies.com
unknown
http://147.45.68.138:80JD
unknown
http://www.entrust.net/rpa03
unknown
http://147.45.68.138/sql.dllrrentVersion
unknown
http://147.45.68.138/4
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://147.45.68.138/8
unknown
https://www.ecosia.org/newtab/
unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dlls
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exem-data;
unknown
https://www.cloudflare.com/5xx-error-landing
unknown
http://147.45.68.138/F
unknown
http://147.45.68.138:80IJ
unknown
http://147.45.68.138/R
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
http://147.45.68.138/Y
unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll-
unknown
http://crl.entrust.net/2048ca.crl0
unknown
http://147.45.68.138/msvcp140.dlllq
unknown
https://www.entrust.net/rpa0
unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll(
unknown
https://t.me/9
unknown
https://web.telegram.org
unknown
http://ocsp.entrust.net03
unknown
http://ocsp.entrust.net02
unknown
https://condedqpwqm.shop/T
unknown
http://147.45.68.138/freebl3.dllxq
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exeF
unknown
http://147.45.44.104/prog/66cf75d3791d7_vrewqgq.exeT
unknown
http://147.45.68.138:80exe
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://crl.entrust.net/ts1ca.crl0
unknown
http://www.sqlite.org/copyright.html.
unknown
http://147.45.68.138:80ta
unknown
https://t.me/nLbZ
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
t.me
149.154.167.99
 malicious
condedqpwqm.shop
172.67.146.35
 malicious
stadiatechnologies.com
95.164.119.162
 malicious

IPs

IP
Domain
Country
Malicious
46.8.231.109
unknown
Russian Federation
malicious
95.164.119.162
stadiatechnologies.com
Gibraltar
malicious
172.67.146.35
condedqpwqm.shop
United States
malicious
147.45.44.104
unknown
Russian Federation
malicious
149.154.167.99
t.me
United Kingdom
malicious
147.45.68.138
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214EF-0000-0000-C000-000000000046} 0xFFFF
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProgramId
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
FileId
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LowerCaseLongPath
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LongPathHash
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Name
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
OriginalFileName
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Publisher
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Version
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinFileVersion
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinaryType
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProductName
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
ProductVersion
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
LinkDate
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
BinProductVersion
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
AppxPackageFullName
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
AppxPackageRelativeId
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Size
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Language
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
IsOsComponent
\REGISTRY\A\{533a1c42-992e-ad83-75b5-cb0ce86b785f}\Root\InventoryApplicationFile\regasm.exe|930881d2b722b2fe
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018C00E203B8920
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
There are 16 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
38B5000
trusted library allocation
page read and write
 malicious
140A000
heap
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
704E0000
unkown
page readonly
BEF000
heap
page read and write
11CE000
stack
page read and write
2FE0000
trusted library allocation
page read and write
215C5000
heap
page read and write
357E000
stack
page read and write
222C6000
direct allocation
page execute read
2E0D000
stack
page read and write
2492D000
heap
page read and write
EDB000
trusted library allocation
page execute and read and write
197CE000
stack
page read and write
FDDF000
stack
page read and write
9730000
unclassified section
page read and write
140E000
stack
page read and write
DB6000
heap
page read and write
275E000
stack
page read and write
E60000
heap
page read and write
400000
remote allocation
page execute and read and write
D6F000
stack
page read and write
33CF000
stack
page read and write
DEB000
heap
page read and write
EC7000
heap
page read and write
6CBE1000
unkown
page execute read
1E190000
heap
page read and write
1400000
trusted library allocation
page read and write
639000
remote allocation
page execute and read and write
500000
remote allocation
page execute and read and write
7BC000
stack
page read and write
FD9000
heap
page read and write
B6E000
stack
page read and write
452000
remote allocation
page execute and read and write
B9E000
stack
page read and write
1E10D000
heap
page read and write
1634000
heap
page read and write
171DF000
stack
page read and write
242C1000
direct allocation
page execute read
790000
heap
page read and write
61EB4000
direct allocation
page read and write
3FB000
stack
page read and write
1076000
heap
page read and write
A00000
heap
page read and write
12AE000
stack
page read and write
F3B000
stack
page read and write
DC8000
heap
page read and write
6CC2C000
unkown
page readonly
B70000
heap
page read and write
12B0000
heap
page read and write
5AD000
remote allocation
page execute and read and write
3042000
trusted library allocation
page execute and read and write
E02000
heap
page read and write
1255000
heap
page read and write
628000
remote allocation
page execute and read and write
B00000
heap
page read and write
2231B000
direct allocation
page readonly
16FBE000
stack
page read and write
1BD2C000
heap
page read and write
1418000
heap
page read and write
11BE000
heap
page read and write
53BE000
stack
page read and write
1138000
stack
page read and write
5D0000
unkown
page readonly
61ED3000
direct allocation
page read and write
7D0000
heap
page read and write
32CE000
stack
page read and write
215A0000
heap
page read and write
1C0ED000
stack
page read and write
853000
heap
page read and write
155F000
stack
page read and write
1000E000
stack
page read and write
4FCD000
stack
page read and write
D9A000
heap
page read and write
1212000
heap
page read and write
CFC000
stack
page read and write
955F000
stack
page read and write
6CDC5000
unkown
page readonly
DAC000
stack
page read and write
344F0000
heap
page read and write
1E171000
heap
page read and write
704FD000
unkown
page read and write
24B1000
trusted library allocation
page read and write
704FD000
unkown
page read and write
16BE000
stack
page read and write
31C0000
heap
page read and write
4A4E000
stack
page read and write
6CA50000
unkown
page readonly
2D0E000
stack
page read and write
9E0000
heap
page read and write
22256000
direct allocation
page execute read
2F9F000
stack
page read and write
DAE000
stack
page read and write
C10000
heap
page read and write
49F0000
trusted library allocation
page read and write
3100000
trusted library allocation
page read and write
FAC000
stack
page read and write
28B1000
trusted library allocation
page read and write
1B36F000
stack
page read and write
1010000
heap
page read and write
838000
heap
page read and write
1140000
heap
page read and write
ECD000
heap
page read and write
490000
remote allocation
page execute and read and write
F98000
heap
page read and write
15F0000
trusted library allocation
page read and write
42C5000
trusted library allocation
page read and write
51DD000
stack
page read and write
6CA2D000
unkown
page readonly
1410000
heap
page read and write
6CDBE000
unkown
page read and write
1E109000
heap
page read and write
990000
heap
page read and write
1235D000
stack
page read and write
1450000
heap
page read and write
9560000
unclassified section
page read and write
1624000
trusted library allocation
page read and write
6CDBF000
unkown
page write copy
28BC000
stack
page read and write
1020000
heap
page read and write
1E4A7000
heap
page read and write
1722E000
stack
page read and write
163D000
stack
page read and write
187F000
stack
page read and write
244CD000
direct allocation
page execute read
A20000
heap
page read and write
11FC000
heap
page read and write
61EB7000
direct allocation
page readonly
1E360000
heap
page read and write
22336000
direct allocation
page read and write
83D000
heap
page read and write
34B2000
trusted library allocation
page read and write
E3E000
stack
page read and write
32BE000
stack
page read and write
222FF000
direct allocation
page readonly
3E95000
trusted library allocation
page read and write
1265000
heap
page read and write
810000
heap
page read and write
6CC2E000
unkown
page read and write
1C170000
heap
page read and write
2B4F000
stack
page read and write
259F000
stack
page read and write
1E103000
heap
page read and write
11DE000
heap
page read and write
4FD000
remote allocation
page execute and read and write
3120000
heap
page execute and read and write
1452000
heap
page read and write
B5E000
stack
page read and write
2A4E000
stack
page read and write
B50000
unkown
page readonly
A93000
trusted library allocation
page execute and read and write
1E1EC000
stack
page read and write
EC0000
heap
page read and write
1E09C000
heap
page read and write
276E6000
heap
page read and write
1E367000
heap
page read and write
1140000
trusted library allocation
page read and write
4B1000
remote allocation
page execute and read and write
1740000
trusted library allocation
page execute and read and write
9F0000
heap
page execute and read and write
5A7000
remote allocation
page execute and read and write
6CBCE000
unkown
page read and write
1491E000
stack
page read and write
2450D000
direct allocation
page readonly
16FFB000
stack
page read and write
1BD8E000
heap
page read and write
B96000
heap
page read and write
1BD4E000
heap
page read and write
1953D000
stack
page read and write
2244D000
stack
page read and write
1640000
trusted library allocation
page read and write
1370000
heap
page read and write
5A5000
remote allocation
page execute and read and write
2F4F000
stack
page read and write
143E000
stack
page read and write
AED000
stack
page read and write
567000
remote allocation
page execute and read and write
6CBD2000
unkown
page readonly
333D000
heap
page read and write
EDB000
heap
page read and write
1BACE000
stack
page read and write
6CDC0000
unkown
page read and write
795000
heap
page read and write
1239E000
stack
page read and write
242C0000
direct allocation
page execute and read and write
924000
trusted library allocation
page read and write
2FDE000
stack
page read and write
910000
trusted library allocation
page read and write
1600000
heap
page read and write
27DD000
stack
page read and write
2D7DF000
stack
page read and write
2D4F000
stack
page read and write
24AE000
stack
page read and write
29F0000
heap
page read and write
D70000
heap
page read and write
D6E000
stack
page read and write
160F000
stack
page read and write
5A9000
remote allocation
page execute and read and write
1BE7B000
stack
page read and write
1BD22000
heap
page read and write
EE0000
unkown
page readonly
276C8000
heap
page read and write
13EE000
stack
page read and write
B52000
unkown
page readonly
11A6000
heap
page read and write
660000
heap
page read and write
E3C000
stack
page read and write
42C2000
trusted library allocation
page read and write
D85000
heap
page read and write
2770000
heap
page execute and read and write
32C1000
trusted library allocation
page read and write
61ED4000
direct allocation
page readonly
15C0000
trusted library allocation
page read and write
587000
remote allocation
page execute and read and write
4042000
trusted library allocation
page read and write
1E184000
heap
page read and write
704FD000
unkown
page read and write
5A2000
unkown
page readonly
1613000
trusted library allocation
page execute and read and write
1ABAE000
stack
page read and write
1180000
trusted library allocation
page read and write
1E4C5000
heap
page read and write
1160000
trusted library allocation
page read and write
2E4E000
stack
page read and write
34B5000
trusted library allocation
page read and write
38B2000
trusted library allocation
page read and write
103C000
stack
page read and write
EE2000
unkown
page readonly
2E91000
trusted library allocation
page read and write
307F1000
heap
page read and write
1000000
heap
page read and write
871000
heap
page read and write
6CC30000
unkown
page read and write
4CE000
remote allocation
page execute and read and write
704F6000
unkown
page readonly
5A0000
unkown
page readonly
6C9B1000
unkown
page execute read
164B000
trusted library allocation
page execute and read and write
31B0000
heap
page read and write
BDC000
heap
page read and write
14B2E000
stack
page read and write
D90000
heap
page read and write
31D4000
heap
page read and write
C0E000
stack
page read and write
27651000
heap
page read and write
1254C000
stack
page read and write
2A890000
heap
page read and write
28B2000
trusted library allocation
page execute and read and write
4ECD000
stack
page read and write
818000
heap
page read and write
1614000
trusted library allocation
page read and write
16C0000
trusted library allocation
page execute and read and write
2F0D000
stack
page read and write
7DE000
stack
page read and write
EAF000
stack
page read and write
222B5000
direct allocation
page execute read
628000
remote allocation
page execute and read and write
160E000
heap
page read and write
81E000
heap
page read and write
28FC000
stack
page read and write
923000
trusted library allocation
page execute and read and write
C7D000
heap
page read and write
1BE20000
heap
page read and write
6CA51000
unkown
page execute read
1608000
heap
page read and write
13FE000
stack
page read and write
276B2000
heap
page read and write
76C000
stack
page read and write
1B26E000
stack
page read and write
1070000
heap
page read and write
162D000
heap
page read and write
136E000
stack
page read and write
22316000
direct allocation
page readonly
1030000
heap
page read and write
367F000
stack
page read and write
FFE000
stack
page read and write
97C000
stack
page read and write
1E56E000
heap
page read and write
B0F000
stack
page read and write
14C9D000
stack
page read and write
D7E000
heap
page read and write
1E090000
heap
page read and write
70EE000
stack
page read and write
6CB40000
unkown
page readonly
28A0000
heap
page read and write
3676F000
heap
page read and write
78E000
stack
page read and write
12FB000
stack
page read and write
2D8F000
stack
page read and write
6CBBD000
unkown
page readonly
4E98D000
stack
page read and write
F21000
heap
page read and write
ACC000
heap
page read and write
A00000
heap
page read and write
1BD0F000
stack
page read and write
27692000
heap
page read and write
F00000
trusted library allocation
page execute and read and write
1E07F000
stack
page read and write
1E56C000
heap
page read and write
1E2EA000
stack
page read and write
49D0000
heap
page read and write
13F0000
heap
page read and write
F3E000
heap
page read and write
244D8000
direct allocation
page readonly
44C000
remote allocation
page execute and read and write
1620000
trusted library allocation
page read and write
24502000
direct allocation
page read and write
83F000
heap
page read and write
9D0000
heap
page read and write
1AFEF000
stack
page read and write
FE1D000
stack
page read and write
7F0000
heap
page read and write
48A0000
heap
page read and write
490000
remote allocation
page execute and read and write
6CA1E000
unkown
page execute read
A60000
heap
page read and write
2FC000
stack
page read and write
222FD000
direct allocation
page execute read
49F000
remote allocation
page execute and read and write
AA8000
heap
page read and write
2CDE000
stack
page read and write
269E000
stack
page read and write
24529000
heap
page read and write
FE70000
heap
page read and write
15FE000
stack
page read and write
291D000
stack
page read and write
DD0000
heap
page read and write
4264F000
heap
page read and write
215BC000
heap
page read and write
1626000
heap
page read and write
FCDE000
stack
page read and write
4E88B000
stack
page read and write
DDF000
heap
page read and write
448000
remote allocation
page execute and read and write
215DC000
heap
page read and write
FECE000
stack
page read and write
4045000
trusted library allocation
page read and write
16F0000
heap
page read and write
32C2000
trusted library allocation
page execute and read and write
6BC000
stack
page read and write
27610000
heap
page read and write
6C9B9000
unkown
page execute read
FF2000
heap
page read and write
1134000
trusted library allocation
page read and write
2E8F000
stack
page read and write
48B000
remote allocation
page execute and read and write
704E1000
unkown
page execute read
2B8D000
stack
page read and write
6CA35000
unkown
page readonly
A80000
trusted library allocation
page read and write
1BFB6000
heap
page read and write
1670000
heap
page read and write
F30000
heap
page read and write
2960000
heap
page read and write
980000
trusted library allocation
page execute and read and write
22285000
direct allocation
page execute read
6CA3D000
unkown
page readonly
350E000
stack
page read and write
1B63E000
heap
page read and write
2D6DE000
stack
page read and write
222BD000
direct allocation
page execute read
1B3BD000
stack
page read and write
95B000
trusted library allocation
page execute and read and write
F10000
trusted library allocation
page read and write
EB4000
trusted library allocation
page read and write
5310000
trusted library allocation
page read and write
FFCF000
stack
page read and write
1660000
trusted library allocation
page read and write
61E01000
direct allocation
page execute read
117A000
heap
page read and write
9E0000
heap
page read and write
2FA7000
heap
page read and write
FAF000
heap
page read and write
1E0BE000
heap
page read and write
1770000
heap
page read and write
11C1000
heap
page read and write
6CA3E000
unkown
page read and write
13CF000
stack
page read and write
930000
trusted library allocation
page read and write
11D0000
heap
page read and write
16D0000
heap
page read and write
340E000
stack
page read and write
1E092000
heap
page read and write
141E000
heap
page read and write
2213A000
direct allocation
page execute read
4E61B000
stack
page read and write
ED0000
heap
page read and write
1BD3D000
heap
page read and write
1133000
trusted library allocation
page execute and read and write
ECA000
heap
page read and write
116B000
trusted library allocation
page execute and read and write
222CA000
direct allocation
page execute read
2E92000
trusted library allocation
page execute and read and write
2450A000
direct allocation
page readonly
271E000
stack
page read and write
2FA0000
heap
page read and write
1E0AC000
heap
page read and write
1BD52000
heap
page read and write
61E00000
direct allocation
page execute and read and write
159E000
stack
page read and write
493000
remote allocation
page execute and read and write
2DB0000
heap
page read and write
701F000
stack
page read and write
B90000
heap
page read and write
1E105000
heap
page read and write
1050000
heap
page read and write
BAB000
heap
page read and write
FA0000
heap
page read and write
1958D000
stack
page read and write
11D8000
heap
page read and write
86C000
stack
page read and write
2450F000
direct allocation
page readonly
400000
remote allocation
page execute and read and write
1750000
heap
page read and write
167C000
heap
page read and write
15D0000
heap
page read and write
6C9B0000
unkown
page readonly
222C4000
direct allocation
page execute read
24426000
direct allocation
page execute read
F14000
unkown
page readonly
D81000
heap
page read and write
14A1F000
stack
page read and write
470000
remote allocation
page execute and read and write
24B2000
trusted library allocation
page execute and read and write
3330000
heap
page read and write
1BF7C000
stack
page read and write
1976E000
stack
page read and write
6CA21000
unkown
page execute read
96B000
stack
page read and write
215E4000
heap
page read and write
1BB3E000
stack
page read and write
1310000
heap
page read and write
AE3000
heap
page read and write
D79000
heap
page read and write
6CC2F000
unkown
page write copy
276DC000
heap
page read and write
1170000
heap
page read and write
26DD000
stack
page read and write
934000
trusted library allocation
page read and write
143C000
heap
page read and write
13BF000
stack
page read and write
46A000
remote allocation
page execute and read and write
2DCF000
stack
page read and write
1B4BE000
stack
page read and write
22332000
direct allocation
page read and write
1710000
trusted library allocation
page read and write
244CF000
direct allocation
page readonly
287E000
stack
page read and write
1B22C000
stack
page read and write
1204000
heap
page read and write
1400000
heap
page read and write
22303000
direct allocation
page readonly
704FF000
unkown
page readonly
1E0FE000
heap
page read and write
567000
remote allocation
page execute and read and write
1260000
heap
page read and write
6CB41000
unkown
page execute read
14A7E000
stack
page read and write
6CA25000
unkown
page execute read
45A000
remote allocation
page execute and read and write
3337000
heap
page read and write
216AE000
heap
page read and write
845000
heap
page read and write
1E350000
heap
page read and write
63E000
remote allocation
page execute and read and write
281D000
stack
page read and write
1641000
heap
page read and write
6CD7F000
unkown
page readonly
1B0ED000
stack
page read and write
215C7000
heap
page read and write
3C6D1000
heap
page read and write
215A3000
heap
page read and write
4CE000
remote allocation
page execute and read and write
32C0000
heap
page read and write
63B000
remote allocation
page execute and read and write
6CBF4000
unkown
page readonly
2CCE000
stack
page read and write
6CBE0000
unkown
page readonly
A94000
trusted library allocation
page read and write
15F4000
trusted library allocation
page read and write
CAC000
stack
page read and write
22163000
direct allocation
page execute read
468D000
stack
page read and write
123E000
heap
page read and write
162B000
heap
page read and write
4EBCD000
stack
page read and write
4F1000
remote allocation
page execute and read and write
1C18D000
heap
page read and write
9F0000
heap
page read and write
121E000
stack
page read and write
148DC000
stack
page read and write
962E000
stack
page read and write
CF2000
stack
page read and write
6C9E6000
unkown
page execute read
14C0000
heap
page read and write
1258D000
stack
page read and write
4D1000
remote allocation
page execute and read and write
639000
remote allocation
page execute and read and write
4C4000
remote allocation
page execute and read and write
AD4000
heap
page read and write
14D0000
trusted library allocation
page execute and read and write
3030000
heap
page execute and read and write
6C9BB000
unkown
page execute read
DDC000
stack
page read and write
458D000
stack
page read and write
4AF000
remote allocation
page execute and read and write
4AF000
remote allocation
page execute and read and write
29EF000
stack
page read and write
305E000
stack
page read and write
AA0000
heap
page read and write
27630000
heap
page read and write
1B520000
heap
page read and write
1133000
stack
page read and write
E7E000
stack
page read and write
29AD000
stack
page read and write
2DDF000
stack
page read and write
34380000
heap
page read and write
242C8000
direct allocation
page execute read
1B530000
heap
page read and write
A4E000
stack
page read and write
48B000
remote allocation
page execute and read and write
15E3000
trusted library allocation
page execute and read and write
276D6000
heap
page read and write
D8B000
heap
page read and write
15E4000
trusted library allocation
page read and write
E59000
heap
page read and write
1451000
heap
page read and write
11B0000
heap
page read and write
3E92000
trusted library allocation
page read and write
FB0000
heap
page read and write
14ACD000
stack
page read and write
11CA000
heap
page read and write
123C000
heap
page read and write
61ECC000
direct allocation
page read and write
344EC000
stack
page read and write
3041000
trusted library allocation
page read and write
AAE000
heap
page read and write
EB0000
trusted library allocation
page read and write
220F8000
direct allocation
page execute read
316D000
stack
page read and write
22326000
direct allocation
page readonly
9EE000
stack
page read and write
276AC000
heap
page read and write
308E000
stack
page read and write
2C8D000
stack
page read and write
146D000
heap
page read and write
704FD000
unkown
page read and write
9630000
heap
page read and write
1437000
heap
page read and write
5AF000
remote allocation
page execute and read and write
6CA3B000
unkown
page readonly
9A0000
heap
page read and write
AFC000
stack
page read and write
14B0000
heap
page execute and read and write
1250000
heap
page read and write
1196000
heap
page read and write
E5E000
heap
page read and write
6C9E1000
unkown
page execute read
14C2F000
stack
page read and write
1220000
heap
page read and write
7E0000
heap
page read and write
6CA28000
unkown
page execute read
1150000
heap
page read and write
14E0000
heap
page read and write
6CBEF000
unkown
page readonly
171B000
trusted library allocation
page execute and read and write
1120000
trusted library allocation
page read and write
1455000
heap
page read and write
27672000
heap
page read and write
DFC000
heap
page read and write
1670000
heap
page read and write
61ECD000
direct allocation
page readonly
11A0000
heap
page read and write
1674000
heap
page read and write
10FB000
stack
page read and write
61ED0000
direct allocation
page read and write
1144000
trusted library allocation
page read and write
5AB000
remote allocation
page execute and read and write
343EC000
stack
page read and write
2F8D000
stack
page read and write
43C000
remote allocation
page execute and read and write
1B12E000
stack
page read and write
2232B000
direct allocation
page readonly
BA0000
heap
page read and write
740000
heap
page read and write
There are 575 hidden memdumps, click here to show them.