IOC Report
hlyG1m5UmO.exe

loading gif

Files

File Path
Type
Category
Malicious
hlyG1m5UmO.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_1f28757f917adfc1c8aed34c13f27d652ab1ba74_77f415ec_f5d51f43-6f06-4b9b-b463-b35f79fbbb51\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_4e39193d21819bd6b87cb2ff431f9e213f49d70_77f415ec_136131a7-659e-44ce-9bdb-2394595556b2\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_4e39193d21819bd6b87cb2ff431f9e213f49d70_77f415ec_16792952-1053-4a7f-9cde-5cefa35ec46f\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_4e39193d21819bd6b87cb2ff431f9e213f49d70_77f415ec_239c737a-fe90-4848-b65f-6f08a1c0b759\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_4e39193d21819bd6b87cb2ff431f9e213f49d70_77f415ec_6b0b31c9-e8d6-4254-8819-89614cbd0de4\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_4e39193d21819bd6b87cb2ff431f9e213f49d70_77f415ec_8359e0e0-72aa-4488-9914-7cab62d1445d\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_4e39193d21819bd6b87cb2ff431f9e213f49d70_77f415ec_cede04d0-9d34-4e82-9685-76716e88a59c\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_4e39193d21819bd6b87cb2ff431f9e213f49d70_77f415ec_d363ebdb-7f3a-4eda-a89a-800a55f6cd55\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_4e39193d21819bd6b87cb2ff431f9e213f49d70_77f415ec_d432c881-a463-40c8-be88-3e0a8b8825ef\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_4e39193d21819bd6b87cb2ff431f9e213f49d70_77f415ec_d6487480-510f-4673-933e-cf8047f959ef\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_4e39193d21819bd6b87cb2ff431f9e213f49d70_77f415ec_f90b9308-b38f-4c25-8d4a-547a2ff60645\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1248.tmp.exe_93bb37d58b3b7f3fe667f9fd44322af864d427_77f415ec_2a89c714-2b8b-4233-adee-0a4847350064\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\LocalCGIDAAAKJJ.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\seed[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\ScreenUpdateSync[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\1248.tmp.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\464151\Blank.pif
PE32 executable (GUI) Intel 80386, for MS Windows
modified
 malicious
C:\ProgramData\AFIEGCAECGCAEBFHDHIEGHDAKE
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\BKFIJJEG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\BKFIJJEGHDAEBGCAKJKFHDHCFH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CAAAAFBKFIECAAKECGCAAKJECB
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\ECBAEBGHDAECBGDGCAKE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ECFCBFBG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FACWLRWHGG.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\FCAFIJJJKEGIECAKKEHI
ASCII text, with very long lines (1743), with CRLF line terminators
dropped
C:\ProgramData\FCGCFCAFIIEBGCBFCAKKJKJJKK
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JEGHDAFIDGDAAKEBFHDA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KATAXZVCPS.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\KATAXZVCPS.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1361.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:28:49 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER144D.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER146D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER166F.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:28:50 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER16FC.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER172C.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER18EF.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:28:51 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A09.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A2A.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D35.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:28:52 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E30.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E50.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2081.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:28:53 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER213D.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER215D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7085.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:29:13 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7151.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7171.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7577.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:29:14 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7614.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7673.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D95.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:29:17 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E32.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E91.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8073.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:29:17 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER821A.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER823A.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER88A1.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:29:19 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER89CB.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER89FB.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9FB.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:28:47 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB06.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB36.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB4.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Oct 10 07:28:48 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE51.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEF.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\SQRKHNBNYN.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\TQDGENUHWP.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\TTCBKWZYOC.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\XQACHMZIHU.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\XQACHMZIHU.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LocalCGIDAAAKJJ.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\464151\V
OpenPGP Public Key
dropped
C:\Users\user\AppData\Local\Temp\Accepting
ASCII text, with very long lines (971), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Accepting.bat (copy)
ASCII text, with very long lines (971), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Estimate
OpenPGP Secret Key
dropped
C:\Users\user\AppData\Local\Temp\Fires
data
dropped
C:\Users\user\AppData\Local\Temp\Heat
data
dropped
C:\Users\user\AppData\Local\Temp\Keeping
data
dropped
C:\Users\user\AppData\Local\Temp\Kingdom
data
dropped
C:\Users\user\AppData\Local\Temp\Nails
data
dropped
C:\Users\user\AppData\Local\Temp\New
data
dropped
C:\Users\user\AppData\Local\Temp\Tears
data
dropped
C:\Users\user\AppData\Local\Temp\Theaters
OpenPGP Public Key
dropped
C:\Users\user\AppData\Local\Temp\Tribute
data
dropped
C:\Users\user\AppData\Local\Temp\Zoo
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
\Device\Null
ASCII text, with CRLF line terminators
dropped
There are 92 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\hlyG1m5UmO.exe
"C:\Users\user\Desktop\hlyG1m5UmO.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Accepting Accepting.bat & Accepting.bat
 malicious
C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
malicious
C:\Windows\SysWOW64\findstr.exe
findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
malicious
C:\Windows\SysWOW64\cmd.exe
cmd /c md 464151
 malicious
C:\Windows\SysWOW64\findstr.exe
findstr /V "DHappenedWestminsterUnexpected" Heat
malicious
C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Theaters + ..\Keeping + ..\Estimate + ..\Tribute + ..\Nails + ..\Kingdom + ..\New + ..\Tears + ..\Zoo V
 malicious
C:\Users\user\AppData\Local\Temp\464151\Blank.pif
Blank.pif V
 malicious
C:\Users\user\AppData\Local\Temp\464151\Blank.pif
C:\Users\user\AppData\Local\Temp\464151\Blank.pif
 malicious
C:\Users\user\AppData\Local\Temp\1248.tmp.exe
"C:\Users\user\AppData\Local\Temp\1248.tmp.exe"
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\LocalCGIDAAAKJJ.exe"
 malicious
C:\Users\user\AppData\LocalCGIDAAAKJJ.exe
"C:\Users\user\AppData\LocalCGIDAAAKJJ.exe"
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\user\AppData\LocalCGIDAAAKJJ.exe
 malicious
C:\Windows\SysWOW64\PING.EXE
ping 2.2.2.2 -n 1 -w 3000
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\choice.exe
choice /d y /t 5
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 804
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 804
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 856
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 864
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 992
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 1000
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 1260
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 2200
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 2200
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 2348
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 2416
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 2364
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 22 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://62.204.41.176/db293a2c1b1c70c4/mozglue.dll
62.204.41.176
 malicious
http://62.204.41.176
unknown
 malicious
http://62.204.41.176/db293a2c1b1c70c4/nss3.dll
62.204.41.176
 malicious
http://62.204.41.176/db293a2c1b1c70c4/softokn3.dll
62.204.41.176
 malicious
http://62.204.41.176/db293a2c1b1c70c4/vcruntime140.dll
62.204.41.176
 malicious
http://62.204.41.176/edd20096ecef326d.php
62.204.41.176
 malicious
http://62.204.41.176/db293a2c1b1c70c4/sqlite3.dll
62.204.41.176
 malicious
http://62.204.41.176/db293a2c1b1c70c4/freebl3.dll
62.204.41.176
 malicious
http://62.204.41.176/db293a2c1b1c70c4/msvcp140.dll
62.204.41.176
 malicious
http://62.204.41.176/
62.204.41.176
 malicious
http://176.113.115.37/seed.exeO
unknown
https://duckduckgo.com/chrome_newtab
unknown
http://176.113.115.37/ScreenUpdateSync.exeP
unknown
https://duckduckgo.com/ac/?q=
unknown
https://post-to-me.com/track_prt.php?sub=&cc=DEvector
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://62.204.41.176/db293a2c1b1c70c4/vcruntime140.dll;
unknown
https://www.autoitscript.com/autoit3/
unknown
http://62.204.41.176/edd20096ecef326d.php#g
unknown
http://176.113.115.37/ScreenUpdateSync.exeprtscreen1566SOFTWARE
unknown
http://62.204.41.176/db293a2c1b1c70c4/softokn3.dllr
unknown
https://post-to-me.com/track_prt.php?sub=0&cc=DE
104.21.56.70
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://62.204.41.176/db293a2c1b1c70c4/freebl3.dllX
unknown
http://62.204.41.176/edd20096ecef326d.phpCGIDAAAKJJ.exea;
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.autoitscript.com/autoit3/J
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://62.204.41.176/edd20096ecef326d.phpE
unknown
http://62.204.41.176/db293a2c1b1c70c4/mozglue.dll:
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
https://www.ecosia.org/newtab/
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://176.113.115.37/seed.exe
176.113.115.37
http://176.113.115.37/ScreenUpdateSync.exerypt.dllemp
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://176.113.115.37/ScreenUpdateSync.exe#j
unknown
https://post-to-me.com/track_prt.php?sub=
unknown
http://62.204.41.176/edd20096ecef326d.phpY
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
unknown
http://176.113.115.37/ScreenUpdateSync.exe%5
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://62.204.41.176/edd20096ecef326d.phpa
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
unknown
https://api.ipify.orggSOFTWARE
unknown
https://post-to-me.com/
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
unknown
https://support.mozilla.org
unknown
http://176.113.115.37/ScreenUpdateSync.exe
unknown
http://62.204.41.176/db293a2c1b1c70c4/msvcp140.dllJ
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://176.113.115.37/
unknown
There are 50 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
tjKhgPhoLOjoHpkZoehqyy.tjKhgPhoLOjoHpkZoehqyy
unknown
 malicious
post-to-me.com
104.21.56.70

IPs

IP
Domain
Country
Malicious
2.2.2.2
unknown
France
malicious
62.204.41.176
unknown
United Kingdom
malicious
176.113.115.37
unknown
Russian Federation
104.21.56.70
post-to-me.com
United States

Registry

Path
Value
Malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
ProgramId
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
FileId
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
LowerCaseLongPath
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
LongPathHash
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
Name
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
OriginalFileName
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
Publisher
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
Version
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
BinFileVersion
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
BinaryType
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
ProductName
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
ProductVersion
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
LinkDate
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
BinProductVersion
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
AppxPackageFullName
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
AppxPackageRelativeId
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
Size
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
Language
 malicious
\REGISTRY\A\{73398da9-d0f2-0551-805e-62a659091a02}\Root\InventoryApplicationFile\1248.tmp.exe|3be1682f3cb3b7b8
Usn
 malicious
HKEY_CURRENT_USER\SOFTWARE\prtscreen
Enabled
There are 10 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page execute and read and write
 malicious
A00000
direct allocation
page execute and read and write
 malicious
2330000
direct allocation
page read and write
 malicious
6DD000
heap
page read and write
 malicious
3060000
heap
page read and write
20EA5000
heap
page read and write
42BC000
trusted library allocation
page read and write
17B2000
trusted library allocation
page read and write
2E00000
heap
page read and write
20EA7000
heap
page read and write
48A0000
heap
page read and write
2B43000
heap
page read and write
17B2000
trusted library allocation
page read and write
340F2000
heap
page read and write
2E08000
heap
page read and write
23F3000
heap
page read and write
56B000
heap
page read and write
20ECE000
heap
page read and write
512000
unkown
page readonly
148F000
trusted library allocation
page read and write
1494000
trusted library allocation
page read and write
1855000
trusted library allocation
page read and write
285A000
heap
page read and write
20EC2000
heap
page read and write
40C0000
remote allocation
page read and write
33CE000
stack
page read and write
20EA7000
heap
page read and write
1232000
trusted library allocation
page read and write
15F7000
trusted library allocation
page read and write
1465000
trusted library allocation
page read and write
434000
unkown
page write copy
17B9000
trusted library allocation
page read and write
2D46000
heap
page read and write
20EB5000
heap
page read and write
2F2E000
heap
page read and write
20EAD000
heap
page read and write
185C000
trusted library allocation
page read and write
61E00000
direct allocation
page execute and read and write
2F18000
heap
page read and write
1904000
trusted library allocation
page read and write
320000
unkown
page write copy
2E40000
heap
page read and write
1580000
trusted library allocation
page read and write
DBD000
trusted library allocation
page execute and read and write
188E000
trusted library allocation
page read and write
153F000
heap
page read and write
26F49000
heap
page read and write
577000
heap
page read and write
3870000
trusted library allocation
page read and write
4C44000
heap
page read and write
57C000
heap
page read and write
20D44000
heap
page read and write
827000
heap
page read and write
20EA5000
heap
page read and write
2859000
heap
page read and write
408000
unkown
page readonly
291C000
stack
page read and write
3771000
heap
page read and write
2F3D000
heap
page read and write
42BF000
trusted library allocation
page read and write
2B28000
heap
page read and write
4CF0000
heap
page read and write
260000
unkown
page readonly
20ECD000
heap
page read and write
825000
heap
page read and write
492000
unkown
page execute and read and write
329000
unkown
page readonly
20EA7000
heap
page read and write
20EA7000
heap
page read and write
20ECD000
heap
page read and write
20EA7000
heap
page read and write
294F000
stack
page read and write
1237000
trusted library allocation
page read and write
185B000
trusted library allocation
page read and write
23F0000
heap
page read and write
146B000
trusted library allocation
page read and write
17B3000
trusted library allocation
page read and write
4BF0000
heap
page read and write
40C0000
remote allocation
page read and write
20E8A000
heap
page read and write
485E000
stack
page read and write
17B6000
trusted library allocation
page read and write
489F000
stack
page read and write
2F53000
heap
page read and write
17B1000
trusted library allocation
page read and write
1358000
trusted library allocation
page read and write
1ACD0000
heap
page read and write
20EAD000
heap
page read and write
2560000
heap
page read and write
2F4F000
heap
page read and write
1672000
trusted library allocation
page read and write
18A9000
trusted library allocation
page read and write
3771000
heap
page read and write
17B3000
trusted library allocation
page read and write
57C000
heap
page read and write
17B0000
trusted library allocation
page read and write
11B1000
trusted library allocation
page read and write
20DEA000
heap
page read and write
57C000
heap
page read and write
1D5000
heap
page read and write
20EA5000
heap
page read and write
FCF000
stack
page read and write
20EB4000
heap
page read and write
56B000
heap
page read and write
51E000
unkown
page execute and read and write
152C000
trusted library allocation
page read and write
E12000
heap
page read and write
1840000
trusted library allocation
page read and write
147A000
trusted library allocation
page read and write
2230000
heap
page read and write
4C1E000
heap
page read and write
530000
heap
page read and write
1479000
trusted library allocation
page read and write
152C000
trusted library allocation
page read and write
338F000
stack
page read and write
14E5000
trusted library allocation
page read and write
61ED3000
direct allocation
page read and write
61E01000
direct allocation
page execute read
9FF000
stack
page read and write
DAB000
stack
page read and write
26F44000
heap
page read and write
45A000
unkown
page execute and read and write
57C000
heap
page read and write
42BD000
trusted library allocation
page read and write
20EA7000
heap
page read and write
57C000
heap
page read and write
17B6000
trusted library allocation
page read and write
404E000
stack
page read and write
14FE000
heap
page read and write
125C000
trusted library allocation
page read and write
20EA5000
heap
page read and write
1A87E000
stack
page read and write
5C5000
unkown
page execute and read and write
580000
heap
page read and write
127E000
stack
page read and write
329000
unkown
page readonly
709000
heap
page read and write
17B1000
trusted library allocation
page read and write
488000
unkown
page execute and read and write
1090000
trusted library allocation
page read and write
9B000
stack
page read and write
6C3AE000
unkown
page read and write
810000
unkown
page readonly
33F0C000
stack
page read and write
78D000
heap
page read and write
1872000
trusted library allocation
page read and write
3771000
heap
page read and write
18DD000
trusted library allocation
page read and write
2854000
heap
page read and write
26FA3000
heap
page read and write
40FE000
stack
page read and write
1868000
trusted library allocation
page read and write
2B68000
heap
page read and write
6C3B0000
unkown
page read and write
20EAD000
heap
page read and write
14C5000
heap
page read and write
11B1000
trusted library allocation
page read and write
17BC000
trusted library allocation
page read and write
5290000
heap
page read and write
2D013000
heap
page read and write
399D000
stack
page read and write
577000
heap
page read and write
41FF000
stack
page read and write
2B6E000
heap
page read and write
11B1000
trusted library allocation
page read and write
53A0000
heap
page read and write
2853000
heap
page read and write
56B000
heap
page read and write
17B0000
trusted library allocation
page read and write
700000
heap
page read and write
408000
unkown
page readonly
81E000
stack
page read and write
17B3000
trusted library allocation
page read and write
D6E000
stack
page read and write
6C1D1000
unkown
page execute read
DDA000
heap
page read and write
E77000
heap
page read and write
198000
stack
page read and write
253D000
stack
page read and write
24FC000
stack
page read and write
4D10000
heap
page read and write
320000
unkown
page write copy
20E91000
heap
page read and write
20E8D000
heap
page read and write
1558000
heap
page read and write
16D2000
trusted library allocation
page read and write
20E99000
heap
page read and write
5CB000
unkown
page execute and read and write
14C0000
heap
page read and write
1AB7D000
stack
page read and write
2B60000
heap
page read and write
42B2000
trusted library allocation
page read and write
1858000
trusted library allocation
page read and write
2B6C000
heap
page read and write
400000
unkown
page readonly
598000
heap
page read and write
1885000
trusted library allocation
page read and write
3771000
heap
page read and write
13B1000
trusted library allocation
page read and write
DB4000
trusted library allocation
page read and write
1050000
trusted library allocation
page execute and read and write
33BD0000
heap
page read and write
2F0000
unkown
page readonly
33B4B000
stack
page read and write
14A9000
trusted library allocation
page read and write
1A8BD000
stack
page read and write
42BA000
trusted library allocation
page read and write
401000
unkown
page execute read
17BC000
trusted library allocation
page read and write
1897000
trusted library allocation
page read and write
20EA7000
heap
page read and write
2B41000
heap
page read and write
17B5000
trusted library allocation
page read and write
13B1000
trusted library allocation
page read and write
26F40000
heap
page read and write
2D0E000
stack
page read and write
2F10000
heap
page read and write
13B1000
trusted library allocation
page read and write
1854000
trusted library allocation
page read and write
1ADD0000
trusted library allocation
page read and write
C55000
heap
page read and write
20E99000
heap
page read and write
1668000
trusted library allocation
page read and write
6C130000
unkown
page readonly
239D000
stack
page read and write
30D7000
heap
page read and write
598000
heap
page read and write
324000
unkown
page write copy
395F000
stack
page read and write
DFD000
heap
page read and write
3258000
heap
page read and write
485000
unkown
page execute and read and write
577000
heap
page read and write
20E8B000
heap
page read and write
3771000
heap
page read and write
1A73E000
stack
page read and write
1865000
trusted library allocation
page read and write
17B3000
trusted library allocation
page read and write
20E9A000
heap
page read and write
274E000
stack
page read and write
20EA7000
heap
page read and write
57C000
heap
page read and write
185E000
trusted library allocation
page read and write
2F3C000
heap
page read and write
1409000
trusted library allocation
page read and write
6AE000
heap
page read and write
507D000
stack
page read and write
6C36F000
unkown
page readonly
1852000
trusted library allocation
page read and write
20E8E000
heap
page read and write
322E000
stack
page read and write
1594000
trusted library allocation
page read and write
125C000
trusted library allocation
page read and write
2852000
heap
page read and write
295C000
stack
page read and write
4BF1000
heap
page read and write
61EB7000
direct allocation
page readonly
20E9A000
heap
page read and write
1508000
trusted library allocation
page read and write
17B0000
trusted library allocation
page read and write
40C0000
remote allocation
page read and write
17B6000
trusted library allocation
page read and write
57C000
heap
page read and write
152C000
trusted library allocation
page read and write
6C3B5000
unkown
page readonly
26EE0000
heap
page read and write
20EB5000
heap
page read and write
33A4C000
stack
page read and write
3771000
heap
page read and write
598000
heap
page read and write
4A8F000
stack
page read and write
20EA0000
heap
page read and write
187C000
trusted library allocation
page read and write
13B1000
trusted library allocation
page read and write
146A000
trusted library allocation
page read and write
42BF000
trusted library allocation
page read and write
3771000
heap
page read and write
4CAE000
stack
page read and write
12EC000
trusted library allocation
page read and write
1590000
heap
page read and write
147A000
trusted library allocation
page read and write
17B2000
trusted library allocation
page read and write
3771000
heap
page read and write
37FC000
stack
page read and write
2851000
heap
page read and write
595000
heap
page read and write
18DF000
trusted library allocation
page read and write
2B67000
heap
page read and write
1495000
trusted library allocation
page read and write
17B0000
trusted library allocation
page read and write
568E000
stack
page read and write
26FBD000
heap
page read and write
316000
unkown
page readonly
25EE000
stack
page read and write
6C1BE000
unkown
page read and write
29C0000
heap
page read and write
20EDE000
heap
page read and write
33BE7000
heap
page read and write
53A000
heap
page read and write
2F2E000
heap
page read and write
4C25000
heap
page read and write
5A5000
unkown
page execute and read and write
17B6000
trusted library allocation
page read and write
316000
unkown
page readonly
3771000
heap
page read and write
FEB000
trusted library allocation
page execute and read and write
2560000
heap
page read and write
61ED4000
direct allocation
page readonly
20EAD000
heap
page read and write
18A8000
trusted library allocation
page read and write
6AB000
heap
page read and write
2B7F000
stack
page read and write
20EA5000
heap
page read and write
14E8000
heap
page read and write
20EA7000
heap
page read and write
670000
heap
page read and write
17BD000
trusted library allocation
page read and write
793000
heap
page read and write
17AE000
stack
page read and write
D70000
heap
page read and write
1ACC0000
heap
page read and write
17B6000
trusted library allocation
page read and write
20EA4000
heap
page read and write
13B1000
trusted library allocation
page read and write
2F4B000
heap
page read and write
3EFF000
stack
page read and write
1460000
heap
page read and write
2150000
heap
page read and write
18AB000
trusted library allocation
page read and write
400000
unkown
page readonly
20EA5000
heap
page read and write
789000
heap
page read and write
5A9000
heap
page read and write
33C55000
heap
page read and write
520000
heap
page read and write
577000
heap
page read and write
20EA7000
heap
page read and write
D84000
heap
page read and write
2F5E000
heap
page read and write
1840000
trusted library allocation
page read and write
2B5E000
heap
page read and write
20EA7000
heap
page read and write
577000
heap
page read and write
17BB000
trusted library allocation
page read and write
152B000
trusted library allocation
page read and write
261000
unkown
page execute read
104E000
stack
page read and write
401000
unkown
page execute read
1060000
trusted library allocation
page read and write
3771000
heap
page read and write
4DA0000
trusted library allocation
page read and write
5100000
heap
page execute and read and write
20E80000
heap
page read and write
17BA000
trusted library allocation
page read and write
2F5E000
heap
page read and write
29D0000
heap
page read and write
17B5000
trusted library allocation
page read and write
20EA5000
heap
page read and write
17B0000
trusted library allocation
page read and write
20E91000
heap
page read and write
42BA000
trusted library allocation
page read and write
17B2000
trusted library allocation
page read and write
1524000
heap
page read and write
1553000
heap
page read and write
577000
heap
page read and write
2D40000
heap
page read and write
155C000
heap
page read and write
221E000
stack
page read and write
11B1000
trusted library allocation
page read and write
1671000
trusted library allocation
page read and write
17B0000
trusted library allocation
page read and write
26F4E000
heap
page read and write
595000
heap
page read and write
820000
heap
page read and write
71E000
heap
page read and write
37BF000
stack
page read and write
20EA7000
heap
page read and write
577000
heap
page read and write
3AFE000
stack
page read and write
17B1000
trusted library allocation
page read and write
3771000
heap
page read and write
84F000
stack
page read and write
14E0000
heap
page read and write
1866000
trusted library allocation
page read and write
558E000
stack
page read and write
FDA000
trusted library allocation
page execute and read and write
3771000
heap
page read and write
DB0000
trusted library allocation
page read and write
3771000
heap
page read and write
98F000
stack
page read and write
1AA3D000
stack
page read and write
17BF000
trusted library allocation
page read and write
1ACD1000
heap
page read and write
FE7000
trusted library allocation
page execute and read and write
1859000
trusted library allocation
page read and write
1858000
trusted library allocation
page read and write
185B000
trusted library allocation
page read and write
18A4000
trusted library allocation
page read and write
11B1000
trusted library allocation
page read and write
13B1000
trusted library allocation
page read and write
184D000
trusted library allocation
page read and write
3771000
heap
page read and write
324000
unkown
page write copy
18A1000
trusted library allocation
page read and write
11B1000
trusted library allocation
page read and write
40B000
unkown
page read and write
1882000
trusted library allocation
page read and write
61EB4000
direct allocation
page read and write
26F46000
heap
page read and write
2D01B000
heap
page read and write
2D023000
heap
page read and write
64A000
unkown
page execute and read and write
20EA1000
heap
page read and write
57C000
heap
page read and write
57C000
heap
page read and write
17BD000
trusted library allocation
page read and write
4F4000
unkown
page readonly
20EC3000
heap
page read and write
56B000
heap
page read and write
A80000
heap
page read and write
56B000
heap
page read and write
36BE000
stack
page read and write
4BD000
unkown
page execute and read and write
2220000
heap
page read and write
24BC000
stack
page read and write
1410000
heap
page read and write
188D000
trusted library allocation
page read and write
6C1D0000
unkown
page readonly
2912000
heap
page read and write
554E000
stack
page read and write
4EF000
unkown
page execute and read and write
1896000
trusted library allocation
page read and write
4E2000
unkown
page execute and read and write
20EA7000
heap
page read and write
61ECC000
direct allocation
page read and write
18A5000
trusted library allocation
page read and write
598000
heap
page read and write
1AB3E000
stack
page read and write
2D000000
heap
page read and write
20E8B000
heap
page read and write
537E000
stack
page read and write
20E99000
heap
page read and write
17B0000
trusted library allocation
page read and write
4C6F000
stack
page read and write
580000
heap
page read and write
2855000
heap
page read and write
23ED000
stack
page read and write
20EC3000
heap
page read and write
20ECD000
heap
page read and write
11EF000
trusted library allocation
page read and write
3A9C000
stack
page read and write
14AE000
stack
page read and write
38FC000
stack
page read and write
6B3000
heap
page execute and read and write
20E99000
heap
page read and write
3050000
heap
page read and write
320000
unkown
page write copy
20E91000
heap
page read and write
C20000
heap
page read and write
20EA3000
heap
page read and write
17B3000
trusted library allocation
page read and write
20EC3000
heap
page read and write
401000
unkown
page execute read
580000
heap
page read and write
26F42000
heap
page read and write
20EA5000
heap
page read and write
12C5000
trusted library allocation
page read and write
C10000
heap
page read and write
479F000
stack
page read and write
577000
heap
page read and write
24FE000
stack
page read and write
20E9D000
heap
page read and write
20EAD000
heap
page read and write
21DE000
stack
page read and write
57C000
heap
page read and write
598000
heap
page read and write
598000
heap
page read and write
17B4000
trusted library allocation
page read and write
4D2F000
heap
page read and write
594C000
stack
page read and write
580E000
stack
page read and write
FD7000
trusted library allocation
page execute and read and write
186D000
trusted library allocation
page read and write
10A0000
heap
page read and write
2B6E000
heap
page read and write
284F000
stack
page read and write
5A5000
heap
page read and write
42BC000
trusted library allocation
page read and write
33E0C000
stack
page read and write
20EA5000
heap
page read and write
56B000
heap
page read and write
13B1000
trusted library allocation
page read and write
2190000
heap
page read and write
340F000
stack
page read and write
20E82000
heap
page read and write
4F4000
unkown
page readonly
3771000
heap
page read and write
29C6000
heap
page read and write
20E8E000
heap
page read and write
3771000
heap
page read and write
3771000
heap
page read and write
30D0000
heap
page read and write
1495000
trusted library allocation
page read and write
2B5E000
heap
page read and write
56B000
heap
page read and write
20EA5000
heap
page read and write
4CEF000
stack
page read and write
3771000
heap
page read and write
1553000
heap
page read and write
400000
unkown
page readonly
4B1000
unkown
page execute and read and write
260000
unkown
page readonly
20EAD000
heap
page read and write
580000
heap
page read and write
20EB5000
heap
page read and write
2D010000
heap
page read and write
17B7000
trusted library allocation
page read and write
2F54000
heap
page read and write
14CA000
trusted library allocation
page read and write
20E9E000
heap
page read and write
1553000
trusted library allocation
page read and write
193000
stack
page read and write
2855000
heap
page read and write
C50000
heap
page read and write
11B1000
trusted library allocation
page read and write
124A000
trusted library allocation
page read and write
17B2000
trusted library allocation
page read and write
2F32000
heap
page read and write
42BC000
trusted library allocation
page read and write
582000
heap
page read and write
580000
heap
page read and write
2198000
heap
page read and write
20E97000
heap
page read and write
1000000
trusted library allocation
page read and write
2F0000
unkown
page readonly
26F57000
heap
page read and write
29BF000
stack
page read and write
6C1AD000
unkown
page readonly
26FAA000
heap
page read and write
18DE000
trusted library allocation
page read and write
3771000
heap
page read and write
E6E000
heap
page read and write
56CE000
stack
page read and write
1894000
trusted library allocation
page read and write
2E0F000
stack
page read and write
3771000
heap
page read and write
3157000
heap
page read and write
61ECD000
direct allocation
page readonly
3771000
heap
page read and write
305C000
stack
page read and write
20EA3000
heap
page read and write
57C000
heap
page read and write
42BD000
trusted library allocation
page read and write
50F000
unkown
page execute and read and write
232F000
stack
page read and write
2ECF000
stack
page read and write
15FD000
trusted library allocation
page read and write
20EA0000
heap
page read and write
3771000
heap
page read and write
17B6000
trusted library allocation
page read and write
32CE000
heap
page read and write
6A0000
heap
page read and write
16EB000
trusted library allocation
page read and write
17B0000
trusted library allocation
page read and write
580000
heap
page read and write
2F5E000
heap
page read and write
2B61000
heap
page read and write
31FD000
heap
page read and write
2D8F000
stack
page read and write
2F4B000
heap
page read and write
2340000
heap
page read and write
590F000
stack
page read and write
26F60000
heap
page read and write
2F30000
heap
page read and write
17B6000
trusted library allocation
page read and write
1AC7D000
stack
page read and write
13B1000
trusted library allocation
page read and write
51B000
unkown
page execute and read and write
8AC000
stack
page read and write
385E000
stack
page read and write
20EC3000
heap
page read and write
461000
unkown
page read and write
17B2000
trusted library allocation
page read and write
20EA7000
heap
page read and write
5A4C000
stack
page read and write
4BBD000
stack
page read and write
1888000
trusted library allocation
page read and write
3460000
heap
page read and write
42BF000
trusted library allocation
page read and write
2B41000
heap
page read and write
3250000
heap
page read and write
20EC2000
heap
page read and write
41F000
unkown
page read and write
2E8E000
stack
page read and write
4B90000
heap
page read and write
145E000
stack
page read and write
17B3000
trusted library allocation
page read and write
26F20000
heap
page read and write
1A63E000
stack
page read and write
40B000
unkown
page write copy
2F5E000
heap
page read and write
285A000
heap
page read and write
12A0000
heap
page read and write
2D01A000
heap
page read and write
1414000
trusted library allocation
page read and write
1421000
trusted library allocation
page read and write
2B45000
heap
page read and write
2F4B000
heap
page read and write
DC0000
trusted library allocation
page read and write
2B20000
heap
page read and write
20E8B000
heap
page read and write
42B6000
trusted library allocation
page read and write
17B0000
trusted library allocation
page read and write
2B81000
trusted library allocation
page read and write
146B000
trusted library allocation
page read and write
DD0000
heap
page read and write
13B1000
trusted library allocation
page read and write
57CE000
stack
page read and write
2F4B000
heap
page read and write
2DF0000
heap
page read and write
20F80000
heap
page read and write
3A20000
trusted library allocation
page read and write
3771000
heap
page read and write
400000
remote allocation
page execute and read and write
25F0000
heap
page read and write
5A9000
heap
page read and write
3B81000
trusted library allocation
page read and write
260000
unkown
page readonly
20EA3000
heap
page read and write
25AE000
stack
page read and write
53E000
heap
page read and write
1580000
trusted library allocation
page read and write
6C131000
unkown
page execute read
598000
heap
page read and write
1858000
trusted library allocation
page read and write
3110000
heap
page read and write
1883000
trusted library allocation
page read and write
3230000
heap
page read and write
DDE000
heap
page read and write
569000
heap
page read and write
1845000
trusted library allocation
page read and write
17B9000
trusted library allocation
page read and write
20E9E000
heap
page read and write
47DE000
stack
page read and write
20EAC000
heap
page read and write
2855000
heap
page read and write
1898000
trusted library allocation
page read and write
6C1C2000
unkown
page readonly
17B7000
trusted library allocation
page read and write
184B000
trusted library allocation
page read and write
E05000
heap
page read and write
20EA7000
heap
page read and write
142B000
trusted library allocation
page read and write
17B8000
trusted library allocation
page read and write
1879000
trusted library allocation
page read and write
6C3AF000
unkown
page write copy
4CBE000
stack
page read and write
20E9F000
heap
page read and write
186D000
trusted library allocation
page read and write
2A70000
heap
page read and write
2DCE000
stack
page read and write
3771000
heap
page read and write
7DE000
stack
page read and write
31DE000
stack
page read and write
1883000
trusted library allocation
page read and write
578000
heap
page read and write
2B5E000
heap
page read and write
20E91000
heap
page read and write
15FE000
trusted library allocation
page read and write
11B1000
trusted library allocation
page read and write
65C000
unkown
page execute and read and write
1899000
trusted library allocation
page read and write
DB3000
trusted library allocation
page execute and read and write
13FA000
stack
page read and write
33F0000
heap
page read and write
1551000
heap
page read and write
290E000
stack
page read and write
26F00000
heap
page read and write
20E96000
heap
page read and write
26F5B000
heap
page read and write
2D021000
heap
page read and write
186E000
trusted library allocation
page read and write
2B5E000
heap
page read and write
1080000
heap
page execute and read and write
141F000
trusted library allocation
page read and write
580000
heap
page read and write
20ECD000
heap
page read and write
285A000
heap
page read and write
580000
heap
page read and write
73C000
heap
page read and write
2D02B000
heap
page read and write
9A7000
stack
page read and write
29C0000
heap
page read and write
1878000
trusted library allocation
page read and write
812000
unkown
page readonly
20EB4000
heap
page read and write
3771000
heap
page read and write
19A000
stack
page read and write
580000
heap
page read and write
1892000
trusted library allocation
page read and write
2850000
heap
page read and write
1A9BD000
stack
page read and write
17B1000
trusted library allocation
page read and write
157F000
trusted library allocation
page read and write
20E99000
heap
page read and write
2F0000
unkown
page readonly
20EAD000
heap
page read and write
577000
heap
page read and write
56B000
heap
page read and write
88E000
stack
page read and write
316000
unkown
page readonly
324000
unkown
page write copy
20E9A000
heap
page read and write
309C000
stack
page read and write
33C2D000
heap
page read and write
577000
heap
page read and write
1F0000
heap
page read and write
5A5000
heap
page read and write
32DF000
stack
page read and write
3771000
heap
page read and write
598000
heap
page read and write
2E47000
heap
page read and write
3771000
heap
page read and write
481F000
stack
page read and write
20EA7000
heap
page read and write
381F000
stack
page read and write
2300000
heap
page read and write
61ED0000
direct allocation
page read and write
3771000
heap
page read and write
580000
heap
page read and write
187F000
trusted library allocation
page read and write
20ECF000
heap
page read and write
261000
unkown
page execute read
432000
unkown
page readonly
261000
unkown
page execute read
3771000
heap
page read and write
3771000
heap
page read and write
580000
heap
page read and write
2F0E000
stack
page read and write
30AE000
stack
page read and write
20EA7000
heap
page read and write
530E000
stack
page read and write
13B1000
trusted library allocation
page read and write
E58000
heap
page read and write
3F4E000
stack
page read and write
48F000
unkown
page execute and read and write
20E99000
heap
page read and write
17B9000
trusted library allocation
page read and write
1A77D000
stack
page read and write
147A000
trusted library allocation
page read and write
3065000
heap
page read and write
188D000
trusted library allocation
page read and write
17B9000
trusted library allocation
page read and write
D84000
heap
page read and write
3771000
heap
page read and write
140D000
trusted library allocation
page read and write
155C000
heap
page read and write
3771000
heap
page read and write
20E97000
heap
page read and write
3771000
heap
page read and write
2F4E000
heap
page read and write
17B5000
trusted library allocation
page read and write
3A20000
trusted library allocation
page read and write
3771000
heap
page read and write
3100000
heap
page read and write
187F000
trusted library allocation
page read and write
1853000
trusted library allocation
page read and write
3771000
heap
page read and write
1D0000
heap
page read and write
468C000
stack
page read and write
74E000
stack
page read and write
1ADD9000
heap
page read and write
5840000
heap
page read and write
20EB5000
heap
page read and write
20EA7000
heap
page read and write
DA0000
trusted library allocation
page read and write
42BA000
trusted library allocation
page read and write
1895000
trusted library allocation
page read and write
20EA7000
heap
page read and write
42B1000
trusted library allocation
page read and write
329000
unkown
page readonly
17B4000
trusted library allocation
page read and write
2DEE000
stack
page read and write
1871000
trusted library allocation
page read and write
2904000
heap
page read and write
2304000
heap
page read and write
13B1000
trusted library allocation
page read and write
33BDE000
heap
page read and write
56B000
heap
page read and write
13B1000
trusted library allocation
page read and write
18AF000
stack
page read and write
190A000
trusted library allocation
page read and write
18EE000
trusted library allocation
page read and write
17BB000
trusted library allocation
page read and write
20EA7000
heap
page read and write
2B70000
heap
page read and write
98000
stack
page read and write
23FC000
heap
page read and write
18A3000
trusted library allocation
page read and write
There are 789 hidden memdumps, click here to show them.