IOC Report
jNeaezBuo8.exe

loading gif

Files

File Path
Type
Category
Malicious
jNeaezBuo8.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\0TU9HPJqFrjaMH2ab2eutLT6.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\0UUxNGvo5SBoNXrhVKNnInBZ.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\1xM2kELmlEwT0ZdAXbxTFlAd.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\25hX7FI1dURDmB4jtoeQIHHK.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\4LMGAkDVX3uzZmWUtCmUEDjB.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\5gwWc5VKcUZ5WZf8qmiy07XG.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\5tBur4jOD2uiOR7o9hLJxfah.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\6MTG5E8zAXefmLFaBJ11MZso.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\6gZRu0dCotZWu6pX7Uek4x9E.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\6wWkqIVwxEWYdqEdisq9REAe.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\7eNXk0Z1HqnaBEGvizZr7Der.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\8b0TqH5XXd1pMSAXbXhjKZq0.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\92kAaDTkDhRrMy0DmXOUqiGt.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\9jWj0z9AbUQVuLDtI6HvGto1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\9qXSmkhMS5UldZUa63d4PtMK.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\9yhECDruaeRmxhVk9M6BHu8V.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Ag2Svd21FNEgI75kEgj2hict.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AtTxCqcCWwN4uzHaU4nBaNLb.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\BOEYM1Zh50nKU5eXSaSbgNyY.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\DnSoqupi4xomDvOwR3I3rI2s.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\DowpWy0co4Mzz9d9uodrpoCS.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\E6AsrxSdGpg1z4OZtZRR4Kn2.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\G2JymbeYK9WxtsgltLBhWrbm.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\GY7KNUU4SH3BfIpJRsCwtBKS.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\HnxOZG3DwW4E1SVwALrofmdk.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\J57GOKr4COSgt8vrl68ezu0X.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Jdk6KxIklqc8FORT2NpB78NQ.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\KJG8FLUALUrjvRwyv2uaCgOy.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Kug8B5xZ6LzxYK18JAPEOCZZ.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\MADz7xDiCV625yCpzFYe2ZQn.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\060[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\8025ea6a524d24d2ed329f6401df172b[1].crx
Google Chrome extension, version 2
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\grabber[1].exe
PE32+ executable (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\setup294[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\123p[1].exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Opera_109.0.5097.45_Autoupdate_x64[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Space_bake[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\rules[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\timeSync[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\6462c272[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Opera_109.0.5097.45_Autoupdate_x64[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Assistant_109.0.5097.45_Setup[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Default15_team[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Retailer_prog[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cad54ba5b01423b1af8ec10ab5719d97[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\setup[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\O3m41s0wSD5zoSObpW4Psf6J.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\OcpgtzOBHU9PeDrU4TzpzUio.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\OxxNs5ZxnbIXbeNW29miCVdc.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\PlATw6OLviQWLvksohyJaztF.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\assistant_package
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\d3dcompiler_47.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\dxcompiler.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\dxil.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\installer_helper_64.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\libEGL.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\libGLESv2.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\mojo_core.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\notification_helper.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_browser.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_crashreporter.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_elf.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_gx_splash.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\standard_themes\default_dark_theme.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\standard_themes\default_theme.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vk_swiftshader.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vulkan-1.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\win10_share_handler.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\win8_importing.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Rq807joaUQGWAAeRQkX7gdMO.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\RzN0r1s56Y6tbSxGu8g4RTFC.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\SRqTzGHU8zgpHkS9pdxLpEbq.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\SmfdhfO4sDrl5YJKMhtQ491n.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\09JXLFzEJOC5kWQEY7XIw75i.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\ZK4CNPe2v25Jrp4qNSGWaEQ7.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\eYOrtx4XT9Xlr5FknYeLBgkD.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\additional_file0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\be76331b95dfc399cd776d2fc68021e0db03cc4f.crx (copy)
Google Chrome extension, version 2
dropped
 malicious
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\opera_package
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154331\opera_package
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7zSDE38.tmp\ARP.EXE
PE32+ executable (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7zSDE38.tmp\Install.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7zSDE38.tmp\appidpolicyconverter.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7zSDE38.tmp\hh.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Opera_installer_2404200954000965480.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Opera_installer_2404200954004632668.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Opera_installer_2404200954011947204.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Opera_installer_2404200954028507540.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Opera_installer_2404200954036647596.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Opera_installer_2404200954055427752.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Opera_installer_2404200954066687816.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Opera_installer_2404200954121857980.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Opera_installer_2404200954283907356.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Qg_Appv5.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Zqicom_beta\relay.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\d73a64c2
PNG image data, 3536 x 2402, 8-bit/color RGB, non-interlaced
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u3a8.0.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u3a8.1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u4n8.0.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u4n8.1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u5vc.0.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u5vc.1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\U3ppUSZ1498Zn7mGQqxHXAOf.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\UZUmS3UT5nPu2Y8UellaIFKd.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\VqEVjVhhS60d6QE1qz683nDz.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\ZUXB5CkDapzE7efrdUFhJ892.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\bEJbb1QJjCxT3KqTjSpz7GI2.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\c7hxt59BnCQTVxfSbyanvm1E.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\clnVTfVHLSH8ULUPWfOeVu5Z.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\crQs8KoUCPX4z7Mk64XktfRP.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\dCIPcTBNISbOYlOJ88oMaC6S.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\dOSiiQGceGabOSjNPZy6ALVs.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\ej7uIDPLu0LjdGuJMOYuukWH.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\fShSvC1wFBBqHPdIyqjcnjYY.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\g0KjW1r2TroGPA35Rl4Ra3f3.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\gfs9Rn2mibclwwbSn804T4qI.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\hHsrArYG5kPtHHpnTseHq4DF.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\kRnXkLddLBiDJSWVDNmKe1N5.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\l8khAE6y8GNl60eaPnDT5SpN.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\lmiE0wDdbnNImUnFhBPggaoj.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\mBjvNDlP0V4hbaJfvUuppMZT.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\nMH85SeKZvjiaQVYVzZz29h4.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\nQUJxFtydtfiOBHb5xbWutY1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\nv8EsHGXmJg4S8V2ZqX2sGzI.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\oAOIj59FdDP9wDnCTclqbXA7.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\osSY4XCAlbCksdADVILcQqBm.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\pW8F3CFaTJ7QQfRu6XHeFjuH.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\sDS4xDJRJNjL2aJQctE1V3M1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\suFJGkt2HAaGWcZVH7RaOasE.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\tEgtSEPzimGLILHlSAKRZmcu.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\tGsxzPGBWHgVLAYn2fKHDL8e.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\ypRJy7YxyCKNParY18kjMH4H.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\yvABChPqbhjOl64NqwRk76px.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\zKW678DCl3v5blnmCqpv2mbr.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\07RmZhDspOVmIDekv4pZ1sw6.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ugjoOir0PULN4OxPQoMZSsL.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3VPa2iMX7P1wQDNVf2z0UHCM.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4cCRWRY3IREeX31JXcxkjAZy.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6LbwaTV4ujaNEJzFimesv9SO.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7ATrwg7eMFsPY7QKdMTVLpQh.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7a87So8hWHJJwWZJwrNtczOp.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8FvWCRXZagW4LvZ9VBvdUlvw.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8akbT027aAu3YRSu28eTlRZK.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9ACj6N84rJVzcF6tknrJQJbZ.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9KzHcsJDGyJnKc3ub5MNXh1H.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AhL9Pe4yq4KobzD7to7MAlC5.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ba0KxIAmyjscaC5qsgoXzs0V.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C0LuosMTkfAE8oOCsvsONoqL.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C4SCkfPpc5Eki49C3LrBTaW1.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chw7pkmcZKPpu71RpcTIqa6s.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dxw94SlwtZgqHus5Nl3FSWhO.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DytrOh4KwfZX7ueRB7vHACcm.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FQyiFAcxZpZBBREMrkEfv1M0.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\G4mnbF2IgUQO8LRK0hRh1JPA.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GXMIglGbG00I5ARFrXxsvJMe.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H7ST8f8JxfmQRozNoFlWXFlg.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HRM5JcTqRnJzFhLIQOMPA2b0.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IiDdGDvC9qlHwMmmv9KVuPjU.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ItBHWHc2Dke3rldx0tKAbF7p.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JM3MjzRo9Xrv4DzfftyB1LKX.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KsL40XG8t66m0S5Of0C4oyUR.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\L1Fp6LJC8oeNx82yQ8HaNeZh.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ly8YSN233BjhYclx9Ff4mePv.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mry6IgQEwo1gxMPOLycokamw.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OYB9Q527omPhie4YxyK0AaTl.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PesN7ayHiARNdj3VLKEFrqj4.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QKcp8E1LpgL090p8CDo4dOji.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QzUlU4h4IggSGhZ3ewlyu0eE.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RkdSdP8M6AbsQtjbHFKFouOF.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S2klfAamodatcjnlQv5oyaKC.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SWVG1kL0lKPrPDNIuDtsC6Hl.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TaRPJPIYLJcrPs8tBUyqkflO.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VLUGnmdjv91l8d6gMrFKfqeR.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WEupKmM8Zz8mO4cSPvw8CcsV.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WImPA7XprDYYmlz4GgprXq9C.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WZAIwSiQSTaYqhhMK6bnivxT.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WifTvX4UxKCPeMGMXRc1M82n.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\X6t18HcV47CVoebsiUGKYMeY.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YANLa2EvI5t8D1c8pOZTxBmu.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YtJAUnkZmQVMGJmU07OqKoTo.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Z2IVExTILUck9lboEFI5lzR0.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZBhcJR2MdXQtfeNbPU9d8lCa.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b03fQX9sEr1tB3GUUpuboPFD.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9prsCtSu1ixedNyddiCok65.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bNXYNwdZfQXFatlkglgMDv3l.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c6sF6ZIbUf4h0chyjX8GoXwd.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c77OcrlGrGXFhu6R8Wa5kcvn.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cKxUnVqhCBmD9MQvwA0lwC0o.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cP38mgOBNpNfKghWCreFe477.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\coRv2XI9jJpO3pnJKiZVajgQ.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dh5jPx9TFTPOlQlVqojM1eIF.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f5giWka2pZSrItKZYmC5Facc.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fCGnQI8NyOVempNE9ZDiLo4a.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gAtbL0EbZ2xzXkIUg0ETQphY.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gyZqZK2RetJSDXp6xLPPAoBH.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hhAlBlBcTrCM4k8GWVNeC1sK.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\i7vF1MY2TVYZqGWhHoW4RRyi.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iDVENAbt1JeeUWymbYb8ncIv.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iY0FIZ47raKfM5kVJVsKGvuZ.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j7zIyIEKrcEUmZdJXud5OHT4.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jFRXxr0ZTdTrO2gAIbyXtKJf.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jRQvvubEQ217f0QaYB8jiZhg.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jSrceS8R3jhcsMz71Q2ZCQNY.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lolFFwT29thaXbndCiyi1Gh0.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m8M3RBBHhpKlTvKP8ki1EJdF.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mCd52vFOP19CiLf03bQJ3aGc.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oSfDGpZAfb84K9s9oHVMpaER.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\odbeTBnVOB8zI2mXuiFaoxic.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pgaq2G1DSHP9NlsxZRn6KEd3.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q1P64wFhWXy4uVFNjCbfpfGr.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qJSDHpIb2rLfYeC4f96RcRNG.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\r0SkZyWO8ueOR2DvnnqX0LdO.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rKGcYQm6omHTI470fcC9Dqjo.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\s2Z5jEqquJDZANkdsQ4Hgp3s.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tAJMb7wqF4DtiHBk40vnusjy.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u17DLWYqQiMfdMKobS0HdqkF.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\upHOKOHM3Hw6eJvSyk98G5pt.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wf2Y7baU48C3dW3FJBF7V1xz.bat
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\DHD6dwSMrsUYWbjq1ydcbpSW.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\FXcxjnqlIBGnDayd_pHBiVEI.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\H5IdNZJmWFbmVKRjrzSzq_VU.exe
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\IFuSUUxv5JW4MS2vMljuonta.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\ISydF4SkTNvMTsMw0fHGm6cg.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\N6gs4eA7eEYDf77vFjOtaIRK.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\OgqrEizuQKrGmbhIuvrJL0FK.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\RDyYTnMDkCW8uIAVGFHTmr8b.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\YTPkrsvhjPQ50b0uZLG5k6S0.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\YzypULQuittVyIJ8wj4JdBvq.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\fs8UvdH7aqxSxTI4lJXRD5UK.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\hJY1ofwqBcbhUe2B304qYJQu.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\j0muh7S3p0fFGFbAmRNzniXR.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\kX1qCrGX0yxVsyVKBPTFPIvC.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\kh9bXd0Y6gx6bLu88nVllBRp.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\rxKdbi1mxdhb3gQnRtcL21w6.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Documents\SimpleAdobe\tP5pTf0jS1kLhyjqmBv_VrrP.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\09JXLFzEJOC5kWQEY7XIw75i.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\1pwXik5TSXPHdUS8qk7dav8p.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\2G9S5uF27Bt9r9VWuXwyuqad.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\68TEqrsa15uzHFWmeFosqQFP.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\6GMlnWvHlwAR5CXlzaFNIYDK.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\6Y7L0R6heobmi5sU8d9LNLQB.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\6qpTYgoDTNVfF48L3aUOwMbO.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\7h3MwjMZ6vEaBgd6kdodu3Pw.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\7v7atVhL2o2P1rhZ4wUoEeua.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\8zhaIaqIg3EHTANT2VC891Qh.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\B9cU5UhtOasu5i8g4dfVXhxb.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\BepzPmjK88swCYSybPtwWA0m.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\BlA2hw2yFa29t6yMSiP5VFSP.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\BqsqdXmriN4iGpEEJloL19dC.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\DAzvKQG6Ksqk3AfqsZxaFtPP.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\G3hPwh2bgpCY2yLq2Ud9bMvP.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\GEvJBWLsnPNlCNiw7qqanykB.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\JHNCg0JIVGbBMVNGHXYgXCki.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\KB7dlYN3AfN1oeAtjoqEId5Q.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\KRK8jWRjlROKQEVnbAEUjCvQ.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\KWuM8Zwy1b2PQLlilGvrKdff.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\KtJVXw17tLyQAhIxYU41jVqs.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\KyhbRBJPdMcoT4xv1l5OEsR2.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\L2V4vJn3M0qTTh7N5Bw7rXMb.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\LHlQIk8n23elOoT83aidvHV7.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\NUQ7j4iKPUQAfFc6iBFXCw4X.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\OOMSHFu8BfhOzlMYdVgLGKxh.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\OhUCrCHnpMj4vCBH2WFCAm31.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\SWxWPnF0GcSxZboClYn5fyJs.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\TVY35mdJttfYOhKcrk6q1H2A.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\TXqT6X30DuHmvWeCAIdAJgkl.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\Ur3375fnVQIg7Ml6s6BiIJ4X.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\UwAqjNCs7dbNbF3545Qfm9i9.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\XWFLQREP5fHqBpXFnsTti9t6.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\Y19ex8vzCbShkGSA8eqfhDzt.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\Y4gYOHhcDIL11PZ9V6Axqrm2.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\ZK4CNPe2v25Jrp4qNSGWaEQ7.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\aA7bmff6TvQfMGlBzmIXCQu1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\ayhJ6kQ8IqoRz2vLrcRuSLzw.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\bOYJAXg8qqrEFblwExl79wvd.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\cCuDz5Qaw0neUcm6E5xOvfYH.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\dJfVoxt31cguly6snQSXBF2t.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\duFxxF1UpKpUQ04rADremxoL.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\dzwthTZuxWv93PkbTJg61TP8.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\eYOrtx4XT9Xlr5FknYeLBgkD.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\eifmHtaYRvEDUaaleUykWOb3.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\euHMzz273NklU7mgrgUCkRrG.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\f4XpsIuRBAfmIOjFXF1VdkNO.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\f73ha0P54IB5rPcLdHiltLCQ.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\fS6ic3iP0LseiY8Ck7zmeGGw.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\fqT8tD2oUyudVPlyITmN6DQI.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\iPGtLilwi2RNQvmM45aBqzX6.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\j6Qvoqh3VYnq7WtxQyoPLqQ0.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\jVXD2wsYEk1ucd6lZL7tqiNC.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\m8JansxpyzuBEO97WyI6iaFf.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\mJELMFYiIOwSEHw1MspR0tMC.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\nvTtpLaPwtBzhl7WfFclESwd.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\oV9qcl4WOt6pr8Qw3ls1WbNr.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\pilT6nsQGl5Pdedeqgr7mf1I.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\qVgCKtvfJNb4NfGV6kK2PcSn.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\qyNU89bNsoji84PSVfnILP6f.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\rO91t03U6QGPgKg7iOh3SEVF.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\tBkWHcKqBZ65lLNmFWjY4rC6.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\tol5HdFnEn6VkJ5rdCz9UsIJ.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\tszCDBRJQFC2WelpK025uY5p.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\ullDNdRRARKjlRS7GvwrVXnW.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\w1LOX3XeHuEGT87oLxL6t3id.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\wZzYmE8Nz9QCUHZqOt6rEm24.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Pictures\ySPTaGUdAgM6iUd6OElZjJ8a.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Windows\System32\GroupPolicy\gpt.ini
ASCII text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\CFIECFIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DHDHCGHDHIDHCBGCBGCAEBAKEH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\ECAFHIIJJECGDHIEGDAK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\EEGWXUHVUG.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\EFOYFBOLXA.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\GRXZDKKVDB.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\IIIEBAAFBFBAKFIDBAFHDHJJEH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JEBFIIIEHCFHJKFHDHDAAFBGDB
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\JJKFBAKFBGDHIEBGDAKF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KJKJKFCB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\KKKEBKJJDGHCBGCAAKEHDBAEGH
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\MOCYNWGDZO.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_jNeaezBuo8.exe_939ea050a29b9858f09837f6d4a5ff6d4026e238_442e04c4_55fc6fea-457c-4b40-a36d-e1bd9a6e9a7a\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER11F0.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER14FF.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1704.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E74.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F23.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20C7.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER282A.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER396D.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4322.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D55.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DA1.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E7E.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FA3.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CBE.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E08.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7442.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7524.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7564.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER75E9.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7797.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7835.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER79B3.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER79D3.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7AC6.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7BB1.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A4D.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0D3.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA44C.tmp.dmp
Mini DuMP crash report, 16 streams, Sat Apr 20 09:53:56 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA67F.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA691.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6CF.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6DC.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA73B.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA819.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB5BE.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6E7.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB840.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8D2.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9A9.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD053.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0AC.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD15B.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0CD.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDF9.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF359.tmp.txt
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF71.tmp.csv
data
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFA.tmp.txt
data
dropped
C:\ProgramData\NVWZAPQSQL.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\NVWZAPQSQL.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\PALRGUCVEH.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\PWZOQIFCAN.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\VWDFPKGDUF.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\ZGGKNSUKOP.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\ZIPXYXWIOY.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\ZIPXYXWIOY.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4
Certificate, Version=3
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
data
dropped
C:\Users\user\AppData\Local\23pMxNJ8xL8sMiQ1yqjR9K8c.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\2SYOkWYTvk5LGtvF2lao7jGV.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\AGh4ngOKjyPTA1MhPSfxzINB.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\AcCKWAY2rit0NCEEiGbFUfH5.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\Eaym9owfXDILaNOlOfhlL9pL.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\FuozRGJXp2ydaW23lwZTemn8.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\HEvON99qUwgGwLduKeIY9m3g.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\JdfOLq5feVdmvpgs0LjMwnYk.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\LN0iazJKg4ouG4Cdljww54MB.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\LaMODovStv6L44RtxbPHwqiL.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\PL_Clients[1].bmp
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\crypted[1].bmp
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\imgdrive_2_1[1].bmp
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\crypted[1].bmp
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\files[1].bmp
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\setup[1].htm
HTML document, ASCII text
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\features[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\OqOO75a2wSIKDIG5IWuKGcqB.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\109.0.5097.45.manifest
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-100.png
PNG image data, 150 x 150, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-100_contrast-white.png
PNG image data, 150 x 150, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-140.png
PNG image data, 210 x 210, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-140_contrast-white.png
PNG image data, 210 x 210, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-180.png
PNG image data, 270 x 270, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-180_contrast-white.png
PNG image data, 270 x 270, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-80.png
PNG image data, 120 x 120, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\150x150Logo.scale-80_contrast-white.png
PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-100.png
PNG image data, 70 x 70, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-100_contrast-white.png
PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-140.png
PNG image data, 98 x 98, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-140_contrast-white.png
PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-180.png
PNG image data, 126 x 126, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-180_contrast-white.png
PNG image data, 126 x 126, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-80.png
PNG image data, 56 x 56, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Assets\70x70Logo.scale-80_contrast-white.png
PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\MEIPreload\manifest.json
JSON data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\MEIPreload\preloaded_data.pb
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\Resources.pri
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\files_list
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\headless_command_resources.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\headless_lib_data.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\headless_lib_strings.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\icudtl.dat
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\launcher.visualelementsmanifest.xml
ASCII text
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\bg.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\bn.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ca.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\cs.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\da.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\de.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\el.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\en-GB.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\en-US.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\es-419.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\es.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\fi.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\fil.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\fr.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\hi.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\hr.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\hu.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\id.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\it.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ja.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ko.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\lt.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\lv.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ms.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\nb.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\nl.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\pl.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\pt-BR.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\pt-PT.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ro.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ru.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\sk.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\sr.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\sv.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\sw.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\ta.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\te.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\th.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\tr.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\uk.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\vi.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\zh-CN.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\localization\zh-TW.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.exe.sig
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera.visualelementsmanifest.xml
ASCII text
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_100_percent.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_125_percent.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_150_percent.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_200_percent.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_250_percent.pak
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.licenses
ASCII text
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_autoupdate.version
ASCII text
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\opera_browser.dll.sig
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\013E742B-287B-4228-A0B9-BD617E4E02A4.ico
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\07593226-C5C5-438B-86BE-3F6361CD5B10.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\0CD5F3A0-8BF6-11E2-9E96-0800200C9A66.ico
MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\1AF2CDD0-8BF3-11E2-9E96-0800200C9A66.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\1CF37043-6733-479C-9086-7B21A2292DDA.ico
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\2A3F5C20-8BF5-11E2-9E96-0800200C9A66.ico
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\2F8F0E41-F521-45A4-9691-F664AFAFE67F.ico
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\3B6191A0-8BF3-11E2-9E96-0800200C9A66.ico
MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\3BFDFA54-5DD6-4DFF-8B6C-C1715F306D6B.ico
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\4C95ADC1-5FD9-449D-BC75-77CA217403AE.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\5BBBDD5B-EDC7-4168-9F5D-290AF826E716.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\66DD4BB6-A3BA-4B11-AF7A-F4BF23E073B2.ico
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\6D3582E1-6013-429F-BB34-C75B90CDD1F8.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\76C397A8-9E8E-4706-8203-BD2878E9C618.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\8D754F20-8BF5-11E2-9E96-0800200C9A66.ico
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\AD2FD2BD-0727-4AF7-8917-AAED8627ED47.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\B478FE0C-0761-41C3-946F-CD1340356039.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\C665D993-1B49-4C2E-962C-BEB19993BB86.ico
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\CCCED631-6DA2-4060-9824-95737E64350C.ico
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\CFCE84E5-9A95-4B3F-B8E4-3E98CF7EE6C5.ico
MS Windows icon resource - 6 icons, 16x16, 2 colors, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\CFD4BE41-4C6D-496A-ADDB-4095DFA1DD0E.ico
MS Windows icon resource - 2 icons, 16x16, 8 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\F3F34CBB-24FF-4830-9E87-1663E7A0A5EE.ico
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\F98D4D4C-8AA7-4619-A1E7-AC89B24558DD.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\FDC2CCAB-E8F9-4620-91DD-B0B67285997C.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\FF57F01A-0718-44B7-8A1F-8B15BC33A50B.ico
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\FFF3F819-B6CE-4DE6-B4E4-8E2618ABC0D9.ico
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\ab_tests.json
ASCII text, with very long lines (347)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\automatic_search_engines.json
ASCII text, with very long lines (347)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\browser.js
C source, ASCII text, with very long lines (347)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\continue_shopping.json
ASCII text, with very long lines (1971)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\default_partner_content.json
Unicode text, UTF-8 text, with very long lines (347)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\doh_providers.json
ASCII text, with very long lines (347)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\domain_suggestions.json
JSON data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\0d406bdcf61e6d381f23.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\11bbdce584eb010669fd.jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 612x365, components 3
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\28823de3046af6be5504.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\28ba6531a8d10a17962b.jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 612x365, components 3
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\2d0dbf42750207f78ffa.ttf
TrueType Font data, 15 tables, 1st "GSUB", 8 names, Microsoft, language 0x409
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\313dd08924b1b4a517bb.jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 612x365, components 3
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\37d24412e02af82ffc5c.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\3df11e64133f9949a6b2.jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 612x365, components 3
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\405e207014bf75cd59c6.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\45763c696a4442585bb4.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\5481ba37652e144d94d4.png
PNG image data, 96 x 96, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\61a42bb99a92e9c1352f.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\61c87b77a034799680ad.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\72036430436803bb8a27.jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1568x882, components 3
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\7bbffe1e039c3f8f477a.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\7d53fec23372c39c9d12.jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 612x365, components 3
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\83572bda21857cccf821.jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2160x1300, components 3
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\88a9d8b720fa47faa0f7.png
PNG image data, 96 x 96, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\8d979c64297ebab9c9d5.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\9703c15b184d8259a452.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\9b08ddabfa1c4baac551.jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2, orientation=upper-left], baseline, precision 8, 612x365, components 3
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\a298a0ac59f09aeb64eb.otf
OpenType font data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\a62d89cd4deb8790f1a2.png
PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\a9a94f26040d1d617ba5.png
PNG image data, 96 x 96, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\b2a202d6774b9d9503f9.jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=2, orientation=upper-left], baseline, precision 8, 612x365, components 3
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\b774f4633fe09bd8bd1f.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\ba5622550ada9b5ff2cd.ttf
TrueType Font data, 15 tables, 1st "GSUB", 8 names, Microsoft, language 0x409
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\cda076c0b79d73963c46.png
PNG image data, 96 x 96, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\d3098ef471597fe3c2ed.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\e393a69f0d2e035d1c42.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\f6aa4959ac4e5f072210.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\fcffb6ccd23559274e62.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\icons\logo.png
PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\icons\logo.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\index.html
HTML document, ASCII text, with very long lines (311), with no line terminators
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\index.js
ASCII text, with very long lines (65473)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\index.js.LICENSE.txt
ASCII text
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\opera_intro_extension\manifest.json
JSON data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\partner_speeddials.json
Unicode text, UTF-8 text, with very long lines (347)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\purchases-schemas.json
ASCII text, with very long lines (347)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\siteprefs.json
ASCII text, with very long lines (347)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\specific_keywords.json
Unicode text, UTF-8 text, with very long lines (5243)
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\resources\video_conference_popout.json
JSON data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\root_files_list
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\snapshot_blob.bin
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\v8_context_snapshot.bin
data
dropped
C:\Users\user\AppData\Local\Programs\Opera\109.0.5097.45\vk_swiftshader_icd.json
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\066e1178-8f48-42e3-bfd4-824b8b639462.tmp
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\2787d2e6-9404-4db6-b570-f2a1b4adc414.tmp
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\31c133dc-b4ad-446d-8a69-5a04c48ccf3b.tmp
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\additional_file1.tmp
Google Chrome extension, version 2
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\extensions_files_list
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\extra_apps
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\installer_prefs_include.json (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\installer_prefs_include.json.backup
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\installer_prefs_include.json~RF6f77f3.TMP (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\installer_prefs_include.json~RF6f7802.TMP (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\pref_default_overrides
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154021\server_tracking_data
ASCII text, with very long lines (616), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154331\5f72d3c8-3651-46a3-9fe9-4020b258cb2f.tmp
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404201154331\installer_prefs_include.json (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240420115407543.log
ASCII text, with very long lines (533)
modified
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240420115432335.log
ASCII text, with very long lines (533)
modified
C:\Users\user\AppData\Local\Temp\Zqicom_beta\somebody.rtf
data
dropped
C:\Users\user\AppData\Local\Temp\Zqicom_beta\spawn.xml
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ce2rl0e.hwr.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1p1ovkhk.54f.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_35xjibty.atq.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5aci3xwl.zia.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b2cokswd.ima.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dzr2hyku.fkf.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fp2ibe2i.ahr.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gl3i34gy.n4v.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gnibcvls.2jq.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hldswm5j.d0t.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hnqgvygd.45l.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oxztazxe.rdv.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qp10bojl.5t2.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_szmuiu5i.30n.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v3wpsttr.zhf.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vf1me1u0.bcv.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\YmxvYosqIkD3WGgGEugsGOqb.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\aiwK2P0Fl1cIEArMCknG8Xc8.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\b2NFEf9NNOHrrOJOfbafhFbt.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Local\c8NFJMLMDBLJHMdfk3CHDEaB.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
data
dropped
C:\Users\user\Documents\SimpleAdobe\EraiE9gAjnpZjbi1KlfzUCf5.exe
HTML document, Non-ISO extended-ASCII text, with very long lines (17962)
dropped
C:\Users\user\Documents\SimpleAdobe\pX6Lc7mgFLX2WPHvpZCKNPOu.exe
HTML document, Non-ISO extended-ASCII text, with very long lines (17962)
dropped
C:\Users\user\Pictures\09gwdWVOD7BhA0wyn6sTP2SG.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\3CnPiCdeLO8CgUrP4UbQAnuT.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\4bYBkn0K6Viq0whmT9GrOAT2.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\AzH3HDqfE4sJkRPVWQxgTBGK.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\FsjNHv7s5NA6IdBlB5tiEDD0.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\IIk86V9YiLn4TNjhwK5b88VE.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\MRPKgRkTLDF1UQ6oHCHgO2XR.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\NQrrqi323gUUzwpQ07ZaUtyD.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\QWg34yKRBz8JiYYvcjdOCF7u.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\TbSdEIYEOocU4YUObNRWEQIE.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\UvqvvueWaeqDSywUKVjveKLn.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\eC33Ifke2AUsZVZLjjOpDedu.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\g35TT2UeUHsZDKZA6nJGp8gx.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\j9tdOKRFunkFVu41ydteJnDU.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Users\user\Pictures\ye3UEN0w9Mq4jWow0YS4nlkv.exe
HTML document, Unicode text, UTF-8 text, with very long lines (1460)
dropped
C:\Windows\System32\GroupPolicy\Machine\Registry.pol
RAGE Package Format (RPF),
dropped
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
data
modified
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
C:\Windows\appcompat\Programs\Amcache.hve.LOG2
MS Windows registry file, NT/2000 or above
dropped
There are 629 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\jNeaezBuo8.exe
"C:\Users\user\Desktop\jNeaezBuo8.exe"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\jNeaezBuo8.exe" -Force
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
 malicious
C:\Users\user\Pictures\KB7dlYN3AfN1oeAtjoqEId5Q.exe
"C:\Users\user\Pictures\KB7dlYN3AfN1oeAtjoqEId5Q.exe"
malicious
C:\Users\user\Pictures\oV9qcl4WOt6pr8Qw3ls1WbNr.exe
"C:\Users\user\Pictures\oV9qcl4WOt6pr8Qw3ls1WbNr.exe"
malicious
C:\Users\user\Pictures\OOMSHFu8BfhOzlMYdVgLGKxh.exe
"C:\Users\user\Pictures\OOMSHFu8BfhOzlMYdVgLGKxh.exe"
malicious
C:\Users\user\Pictures\DAzvKQG6Ksqk3AfqsZxaFtPP.exe
"C:\Users\user\Pictures\DAzvKQG6Ksqk3AfqsZxaFtPP.exe"
malicious
C:\Users\user\Pictures\09JXLFzEJOC5kWQEY7XIw75i.exe
"C:\Users\user\Pictures\09JXLFzEJOC5kWQEY7XIw75i.exe" --silent --allusers=0
 malicious
C:\Users\user\Pictures\09JXLFzEJOC5kWQEY7XIw75i.exe
C:\Users\user\Pictures\09JXLFzEJOC5kWQEY7XIw75i.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x258,0x6c5be1d0,0x6c5be1dc,0x6c5be1e8
malicious
C:\Users\user\AppData\Local\Temp\u4n8.0.exe
"C:\Users\user\AppData\Local\Temp\u4n8.0.exe"
malicious
C:\Users\user\Pictures\09JXLFzEJOC5kWQEY7XIw75i.exe
"C:\Users\user\Pictures\09JXLFzEJOC5kWQEY7XIw75i.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5480 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240420115402" --session-guid=7c8aa1aa-7a32-47df-9a77-320b42f4c511 --server-tracking-blob="YjU1MjY3ZTRkZDgxZTBkNTJhNmUwZWY1OWIyZGNlZTljZjU0OTA1ZTA2Yzc0MGEwZGRjN2NiM2U1NjA4MjkxMzp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fMTIzIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNjA2ODM4LjA0NTIiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzEyMyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMzUyYWJiN2YtMWFlNC00NDNlLTgxNWEtYzU1NDc1YTYyOGE3In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=9C05000000000000
malicious
C:\Users\user\Pictures\09JXLFzEJOC5kWQEY7XIw75i.exe
C:\Users\user\Pictures\09JXLFzEJOC5kWQEY7XIw75i.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x298,0x2a8,0x2ac,0x274,0x2b0,0x6b94e1d0,0x6b94e1dc,0x6b94e1e8
malicious
C:\Users\user\Pictures\qVgCKtvfJNb4NfGV6kK2PcSn.exe
"C:\Users\user\Pictures\qVgCKtvfJNb4NfGV6kK2PcSn.exe"
malicious
C:\Users\user\Pictures\TXqT6X30DuHmvWeCAIdAJgkl.exe
"C:\Users\user\Pictures\TXqT6X30DuHmvWeCAIdAJgkl.exe"
malicious
C:\Users\user\Pictures\ZK4CNPe2v25Jrp4qNSGWaEQ7.exe
"C:\Users\user\Pictures\ZK4CNPe2v25Jrp4qNSGWaEQ7.exe" --silent --allusers=0
 malicious
C:\Users\user\Pictures\cCuDz5Qaw0neUcm6E5xOvfYH.exe
"C:\Users\user\Pictures\cCuDz5Qaw0neUcm6E5xOvfYH.exe"
malicious
C:\Users\user\Pictures\ZK4CNPe2v25Jrp4qNSGWaEQ7.exe
C:\Users\user\Pictures\ZK4CNPe2v25Jrp4qNSGWaEQ7.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0x6afce1d0,0x6afce1dc,0x6afce1e8
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
 malicious
C:\Users\user\Pictures\ayhJ6kQ8IqoRz2vLrcRuSLzw.exe
"C:\Users\user\Pictures\ayhJ6kQ8IqoRz2vLrcRuSLzw.exe"
malicious
C:\Users\user\AppData\Local\Temp\u5vc.0.exe
"C:\Users\user\AppData\Local\Temp\u5vc.0.exe"
malicious
C:\Users\user\Pictures\bOYJAXg8qqrEFblwExl79wvd.exe
"C:\Users\user\Pictures\bOYJAXg8qqrEFblwExl79wvd.exe"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
 malicious
C:\Users\user\AppData\Local\Temp\u3a8.0.exe
"C:\Users\user\AppData\Local\Temp\u3a8.0.exe"
malicious
C:\Users\user\Pictures\tBkWHcKqBZ65lLNmFWjY4rC6.exe
"C:\Users\user\Pictures\tBkWHcKqBZ65lLNmFWjY4rC6.exe"
malicious
C:\Users\user\AppData\Local\Temp\Qg_Appv5.exe
"C:\Users\user\AppData\Local\Temp\Qg_Appv5.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 3636 -ip 3636
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3636 -s 1360
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\09JXLFzEJOC5kWQEY7XIw75i.exe
"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\09JXLFzEJOC5kWQEY7XIw75i.exe" --version
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
C:\Users\user\Pictures\7h3MwjMZ6vEaBgd6kdodu3Pw.exe
"C:\Users\user\Pictures\7h3MwjMZ6vEaBgd6kdodu3Pw.exe"
C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\ZK4CNPe2v25Jrp4qNSGWaEQ7.exe
"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\ZK4CNPe2v25Jrp4qNSGWaEQ7.exe" --version
C:\Windows\System32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c6sF6ZIbUf4h0chyjX8GoXwd.bat" "
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Users\user\AppData\Local\ZUXB5CkDapzE7efrdUFhJ892.exe
"C:\Users\user\AppData\Local\ZUXB5CkDapzE7efrdUFhJ892.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Users\user\Pictures\KtJVXw17tLyQAhIxYU41jVqs.exe
"C:\Users\user\Pictures\KtJVXw17tLyQAhIxYU41jVqs.exe"
C:\Users\user\Pictures\Y19ex8vzCbShkGSA8eqfhDzt.exe
"C:\Users\user\Pictures\Y19ex8vzCbShkGSA8eqfhDzt.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Users\user\Pictures\eYOrtx4XT9Xlr5FknYeLBgkD.exe
"C:\Users\user\Pictures\eYOrtx4XT9Xlr5FknYeLBgkD.exe" --silent --allusers=0
There are 38 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://193.233.132.139/dacha/rules.exe
unknown
https://legal.opera.com/terms
unknown
https://features.opera-api2.com/6
unknown
https://desktop-netinstaller-sub.osp.opera.software/ppxBundleSipPutSignedDataMsgDllFuncNamed
unknown
https://help.opera.com/latest/
unknown
http://185.172.128.209/15f649199f40275b/freebl3.dll
unknown
https://palberryslicker.sbs/
unknown
https://policies.google.com/terms;
unknown
http://docs.oasis-open.o
unknown
https://vk.com/doc5294803_668776833?hash=0O6PF91bZH66jRdVdr0Yhs0vV73FDPMFrSckqwaaZuH&dl=PH90vp0b08Gc
unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
unknown
http://localhost:3001api/prefs/?product=$1&version=$2..
unknown
http://www.opera.com
unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
unknown
https://www.opera.com/download/
unknown
https://meet.crazyfigs.top/style/060.exeo
unknown
https://www.youtube.com
unknown
http://185.172.128.209/3cd2b41cbde8fc9c.phpk0
unknown
https://gigachadfanclub.org/0459bbcc9007d32f68bcaa0a07733f6e/7725eaa6592c80f8124e769b4e8a07f7.exeD
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
unknown
http://185.172.128.209/15f649199f40275b/nss3.dll
unknown
http://185.172.128.209/3cd2b41cbde8fc9c.php-fulluser-l1-1-0
unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdmzq6hT
unknown
https://addons.opera.com
unknown
https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4ftes
unknown
http://www.avantbrowser.com)MOT-V9mm/
unknown
https://cdn.discordapp.com/attachments/1088058556286251082/1111230812579450950/TsgVtmYNoFT.zipMozill
unknown
http://185.172.128.209/15f649199f40275b/vcruntime140.dll
unknown
http://docs.oasi
unknown
https://aui-cdn.atlassian.com/
unknown
http://185.172.128.209/15f649199f40275b/softokn3.dll
unknown
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
unknown
https://turnitin.com/robot/crawlerinfo.html)cannot
unknown
http://www.exabot.com/go/robot)Opera/9.80
unknown
http://www.innosetup.com
unknown
https://features.opera-api2.com/%
unknown
https://palberryslicker.sbs/8
unknown
https://i1.wp.com
unknown
http://185.172.128.209/15f649199f40275b/mozglue.dll
unknown
https://crashpad.chromium.org/
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue1
unknown
https://addons.opera.com/en/extensions/details/dify-cashback/
unknown
https://bitbucket.org/superworkspacenb/gerge/downloads/grabber.exexe
unknown
http://185.172.128.209/iles
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue0
unknown
https://autoupdate.geo.opera.com/geolocation/
unknown
https://download5.operacdn.com/ftp/pub/.assistant/109.0.5097.45/Assistant_109.0.5097.45_Setup.exeOex
unknown
http://www.google.com/bot.html)crypto/ecdh:
unknown
https://crashstats-collector.opera.com/collector/submit
unknown
https://account.live.com/msangcwam
unknown
http://185.172.128.209/3cd2b41cbde8fc9c.phprosoft
unknown
https://desktop-netinstaller-sub.osp.opera.software/ttps://desktop-netinstaller-sub.osp.opera.softwa
unknown
http://passport.net/tb
unknown
https://opera.com/privacy
unknown
https://vimeo.com;
unknown
http://www.spidersoft.com)
unknown
http://185.172.128.203/dl.php5
unknown
http://185.172.128.209/3cd2b41cbde8fc9c.phpf3f5989aa6bdf817aeb843d5eb39on
unknown
https://www.ecosia.org/newtab/
unknown
https://bbuseruploads.s3.amazonaws.com/8b0be658-c958-47a3-96e4-fc8e5fe7c5dc/downloads/dc50f97b-477f-
unknown
https://triedchicken.net/cad54ba5b01423b1af8ec10ab5719d97.exexe9
unknown
https://addons-media.operacdn.com/media/;
unknown
https://gamemaker.io)
unknown
http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetching
unknown
http://https://_bad_pdb_file.pdb
unknown
https://triedchicken.net:80/cad54ba5b01423b1af8ec10ab5719d97.exe
unknown
https://addons-extensions.operacdn.com/
unknown
https://sun6-20.userapi.com/c909618/u5294803/docs/d24/e47db7b4d28f/PL_Clients.bmp?extra=5iTdhq7jHtGb
unknown
https://download.opera.com/download/get/?id=65635&autoupdate=1&ni=1D
unknown
https://download.opera.com/download/get/?id=65635&autoupdate=1&ni=1
unknown
https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=767__123&utm_medium=apb&utm_source=mkt&
unknown
https://gigachadfanclub.org/
unknown
http://www.google.com/feedfetcher.html)HKLM
unknown
https://baldurgatez.com/7725eaa6592c80f8124e769b4e8a07f7.exexe
unknown
https://blockchain.infoindex
unknown
https://cdn.cookielaw.org/
unknown
https://gamemaker.io/en/get.
unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
unknown
https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f/
unknown
https://gamemaker.io
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
http://185.172.128.209/15f649199f40275b/freebl3.dll.
unknown
http://Passport.NET/tb_.com
unknown
https://palberryslicker.sbs/s
unknown
http://185.172.128.209/3cd2b41cbde8fc9c.phpY7
unknown
http://www.alexa.com/help/webmasters;
unknown
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/
unknown
https://crashpad.chromium.org/bug/new
unknown
http://185.172.128.209/3cd2b41cbde8fc9c.phpd
unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
unknown
http://185.172.128.209/3cd2b41cbde8fc9c.phpL
unknown
https://features.opera-api2.com/ID
unknown
http://schemas.micro
unknown
https://login.microsoftonline.com/MSARST2.srf
unknown
http://Passport.NET/STS
unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdmenfo
unknown
https://monoblocked.com/525403/setup.exe
unknown
http://185.172.128.209/3cd2b41cbde8fc9c.phph
unknown
http://185.172.128.209/15f649199f40275b/mozglue.dllt
unknown
http://Passport.NET/tb
unknown
There are 90 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.172.128.90
unknown
Russian Federation
176.97.76.106
unknown
United Kingdom
193.233.132.234
unknown
Russian Federation
37.228.108.132
unknown
Norway
185.172.128.59
unknown
Russian Federation
172.67.161.113
unknown
United States
104.21.27.167
unknown
United States
104.21.79.77
unknown
United States
40.126.29.11
unknown
United States
104.21.90.14
unknown
United States
172.67.147.32
unknown
United States
172.67.207.236
unknown
United States
185.172.128.209
unknown
Russian Federation
107.167.96.30
unknown
United States
40.126.7.32
unknown
United States
104.20.3.235
unknown
United States
185.172.128.203
unknown
Russian Federation
172.67.132.207
unknown
United States
104.26.8.59
unknown
United States
93.186.225.194
unknown
Russian Federation
104.20.4.235
unknown
United States
172.67.19.24
unknown
United States
107.167.110.217
unknown
United States
107.167.110.216
unknown
United States
104.18.11.89
unknown
United States
104.21.91.214
unknown
United States
107.167.110.211
unknown
United States
72.21.81.240
unknown
United States
193.233.132.139
unknown
Russian Federation
220.82.134.210
unknown
Korea Republic of
34.117.186.192
unknown
United States
37.221.125.202
unknown
Lithuania
18.205.93.1
unknown
United States
193.233.132.175
unknown
Russian Federation
95.142.206.0
unknown
Russian Federation
185.26.182.111
unknown
Norway
104.21.31.124
unknown
United States
95.142.206.2
unknown
Russian Federation
95.142.206.1
unknown
Russian Federation
40.126.28.21
unknown
United States
172.67.169.89
unknown
United States
172.67.188.178
unknown
United States
185.172.128.228
unknown
Russian Federation
172.67.176.131
unknown
United States
104.76.210.217
unknown
United States
20.189.173.21
unknown
United States
5.42.66.10
unknown
Russian Federation
172.67.193.79
unknown
United States
192.229.211.108
unknown
United States
3.5.28.111
unknown
United States
104.21.4.208
unknown
United States
45.130.41.108
unknown
Russian Federation
107.167.125.189
unknown
United States
There are 43 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{615FC77F-E2C6-42A4-9206-B716C8DC7509}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions
Exclusions_Extensions
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{615FC77F-E2C6-42A4-9206-B716C8DC7509}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions
exe
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{615FC77F-E2C6-42A4-9206-B716C8DC7509}Machine\SOFTWARE\Policies\Microsoft\Windows Defender
DisableAntiSpyware
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{615FC77F-E2C6-42A4-9206-B716C8DC7509}Machine\SOFTWARE\Policies\Microsoft\Windows Defender
DisableRoutinelyTakingAction
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{615FC77F-E2C6-42A4-9206-B716C8DC7509}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{615FC77F-E2C6-42A4-9206-B716C8DC7509}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableOnAccessProtection
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{615FC77F-E2C6-42A4-9206-B716C8DC7509}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableScanOnRealtimeEnable
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{615FC77F-E2C6-42A4-9206-B716C8DC7509}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableRealtimeMonitoring
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{615FC77F-E2C6-42A4-9206-B716C8DC7509}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableIOAVProtection
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{615FC77F-E2C6-42A4-9206-B716C8DC7509}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableRawWriteNotification
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064
Blob
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance
Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\jsc_RASMANCS
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5044
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5044
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5044
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\6020
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\6020
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\6020
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7608
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7608
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7608
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8180
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8180
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8180
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\4256
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\4256
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\4256
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5812
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5812
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5812
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8748
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8748
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8748
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8400
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8400
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8400
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9780
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9780
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9780
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\4752
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\4752
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\4752
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\992
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\992
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\992
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\1852
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\1852
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\1852
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\10680
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\10680
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\10680
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9740
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9740
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9740
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7332
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7332
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7332
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5280
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5280
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5280
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7076
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7076
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7076
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\11176
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\11176
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\11176
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7108
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7108
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7108
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\11040
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\11040
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\11040
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\1520
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\1520
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\1520
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9912
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9912
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9912
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5432
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5432
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5432
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\2452
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\2452
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\2452
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8440
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8440
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8440
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9756
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9756
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9756
CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\10448
Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\10448
Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\10448
CreationTime
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
ProgramId
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
FileId
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
LowerCaseLongPath
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
LongPathHash
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
Name
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
OriginalFileName
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
Publisher
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
Version
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
BinFileVersion
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
BinaryType
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
ProductName
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
ProductVersion
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
LinkDate
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
BinProductVersion
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
AppxPackageFullName
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
AppxPackageRelativeId
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
Size
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
Language
\REGISTRY\A\{2264074e-779e-7072-5f16-67a14cb92bb6}\Root\InventoryApplicationFile\jneaezbuo8.exe|2cb4a765d57c3aff
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C
Blob
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02vnquskfpppcivc
Reason
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02gelziqvnqqscxq
DeviceId
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02gelziqvnqqscxq
Provision Saturday, April 20, 2024 11:54:25
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02gelziqvnqqscxq
AppIdList
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02gfcilbgfbgtour
Request Saturday, April 20, 2024 11:54:41
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02gfcilbgfbgtour
Response Saturday, April 20, 2024 11:54:41
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2246122658-3693405117-2476756634-1003\02gfcilbgfbgtour
Reason
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2246122658-3693405117-2476756634-1003\02gqygpvfneoenxs
DeviceId
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2246122658-3693405117-2476756634-1003\02gqygpvfneoenxs
AppIdList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02vnquskfpppcivc
AppIdList
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18
ValidDeviceId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL
GlobalDeviceUpdateTime
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02gelziqvnqqscxq
DeviceId
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18
ValidDeviceId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_USERS.DEFAULT\Software\Microsoft\AuthCookies\Live\Default\DIDC
Data
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02gelziqvnqqscxq
DeviceId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02gelziqvnqqscxq
DeviceId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2246122658-3693405117-2476756634-1003
ValidDeviceId
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2246122658-3693405117-2476756634-1003\02gfcilbgfbgtour
AppIdList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AuthCookies\Live\Default\DIDC
Data
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2246122658-3693405117-2476756634-1003\02gqygpvfneoenxs
DeviceId
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2246122658-3693405117-2476756634-1003
ValidDeviceId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AuthCookies\Live\Default\DIDC
Data
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2246122658-3693405117-2476756634-1003\02gqygpvfneoenxs
DeviceId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AuthCookies\Live\Default\DIDC
Data
HKEY_USERS.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-2246122658-3693405117-2476756634-1003\02gqygpvfneoenxs
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties
LID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AuthCookies\Live\Default\DIDC
Data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AuthCookies\Live\Default\DIDC
Data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AuthCookies\Live\Default\DIDC
Data
HKEY_CURRENT_USER\SOFTWARE\BroomCleaner
Installed
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
Servers
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
UUID
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
FirstInstallDate
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
ServiceVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
PGDSE
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
ServersVersion
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
OSCaption
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
OSArchitecture
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
IsAdmin
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
CPU
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
GPU
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
AV
HKEY_CURRENT_USER\SOFTWARE\Microsoft\a839a7d7
PatchTime
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules
C:\
HKEY_CURRENT_USER\SOFTWARE\Opera Software
Last Stable Install Path
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
There are 195 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4BD2000
direct allocation
page read and write
 malicious
1BCA9772000
trusted library allocation
page read and write
 malicious
1CE0000
direct allocation
page read and write
 malicious
3650000
direct allocation
page execute and read and write
 malicious
4CB2000
direct allocation
page read and write
 malicious
1C00000
direct allocation
page read and write
 malicious
1BCA9B98000
trusted library allocation
page read and write
 malicious
1C64000
heap
page read and write
 malicious
1BD0000
direct allocation
page execute and read and write
 malicious
400000
unkown
page execute and read and write
 malicious
843000
unkown
page execute and read and write
 malicious
4C42000
direct allocation
page read and write
 malicious
3680000
direct allocation
page read and write
 malicious
1B64000
heap
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
20887169000
heap
page read and write
191A3C51000
heap
page read and write
2224B000
heap
page read and write
191A398E000
heap
page read and write
191A3C67000
heap
page read and write
191A3B35000
heap
page read and write
208878CE000
heap
page read and write
11B4000
heap
page read and write
1BCA7EEC000
heap
page read and write
191A39D1000
heap
page read and write
1EA5D202000
heap
page read and write
1A2D000
unkown
page read and write
208871A0000
heap
page read and write
1B98000
heap
page read and write
191A39BC000
heap
page read and write
1BCA7E00000
heap
page read and write
191A3BE7000
heap
page read and write
9C000
stack
page read and write
FF7000
heap
page read and write
2D7B0000
direct allocation
page read and write
191A3BCC000
heap
page read and write
191A3989000
heap
page read and write
20887172000
heap
page read and write
20887130000
heap
page read and write
252B15C0000
trusted library allocation
page read and write
191A39A7000
heap
page read and write
845000
unkown
page read and write
20887133000
heap
page read and write
191A3C51000
heap
page read and write
2223C000
heap
page read and write
FE7000
heap
page read and write
20887107000
heap
page read and write
20D7000
heap
page read and write
252AF8D8000
direct allocation
page read and write
39638000
direct allocation
page read and write
130000
unkown
page readonly
907000
unkown
page readonly
252B25D7000
heap
page read and write
2D544000
direct allocation
page read and write
42C000
unkown
page write copy
20887132000
heap
page read and write
191A3BC9000
heap
page read and write
2D554000
direct allocation
page read and write
100000
unkown
page readonly
191A3BC6000
heap
page read and write
1B00000
heap
page read and write
DAB000
stack
page read and write
44EE000
stack
page read and write
401000
unkown
page execute read
7FF6B7559000
unkown
page read and write
191A44A6000
heap
page read and write
7FF848DF0000
trusted library allocation
page read and write
1305000
unkown
page read and write
7FF7B4D12000
unkown
page read and write
191A39C0000
heap
page read and write
2D93C000
direct allocation
page read and write
2FA34000
direct allocation
page read and write
2D570000
direct allocation
page read and write
191A3BC9000
heap
page read and write
7FF6B7380000
unkown
page readonly
198000
stack
page read and write
360E000
stack
page read and write
1C88000
heap
page read and write
4A900000
direct allocation
page read and write
252AF8EF000
direct allocation
page read and write
7FF6B7709000
unkown
page execute and read and write
11BF000
heap
page read and write
400000
unkown
page execute and read and write
191A3ECB000
heap
page read and write
271B33A0000
heap
page read and write
191A3B78000
heap
page read and write
FF3000
heap
page read and write
191A4D81000
heap
page read and write
191A3CA0000
heap
page read and write
1197000
heap
page read and write
191A3C33000
heap
page read and write
20887152000
heap
page read and write
191A47D8000
heap
page read and write
191A3B78000
heap
page read and write
4A8DC000
direct allocation
page read and write
191A3B66000
heap
page read and write
46D1000
heap
page read and write
191A39BC000
heap
page read and write
2D504000
direct allocation
page read and write
208878F8000
heap
page read and write
3983C000
direct allocation
page read and write
E009DFF000
stack
page read and write
7FF848FDF000
trusted library allocation
page read and write
1240000
unkown
page write copy
191A3C49000
heap
page read and write
191A40FE000
heap
page read and write
191A3B6B000
heap
page read and write
119E000
heap
page read and write
191A38F0000
trusted library allocation
page read and write
636000
unkown
page execute and read and write
20589AF0000
direct allocation
page read and write
252AF860000
direct allocation
page read and write
FF7000
heap
page read and write
252AFDA0000
heap
page read and write
2088691B000
heap
page read and write
2117C3C0000
direct allocation
page read and write
7FF6B7E40000
unkown
page readonly
B6FC2AB000
stack
page read and write
1C5E000
heap
page read and write
191A3B7C000
heap
page read and write
1C4A000
heap
page read and write
1257000
unkown
page read and write
1C3E0202000
heap
page read and write
4A924000
direct allocation
page read and write
39738000
direct allocation
page read and write
2088696E000
heap
page read and write
191A39BA000
heap
page read and write
191A3B9D000
heap
page read and write
20887915000
heap
page read and write
13D0000
heap
page read and write
39758000
direct allocation
page read and write
191A3D1A000
heap
page read and write
1C3E01B0000
heap
page read and write
2222D000
heap
page read and write
13F9000
heap
page read and write
7FF6B7381000
unkown
page execute read
1BCA7DE3000
trusted library allocation
page read and write
3448C000
direct allocation
page read and write
36B0000
heap
page read and write
2D7B4000
direct allocation
page read and write
191A3C11000
heap
page read and write
39638000
direct allocation
page read and write
20887135000
heap
page read and write
401000
unkown
page execute read
20887152000
heap
page read and write
41B000
unkown
page readonly
2D6FC000
direct allocation
page read and write
2D7B0000
direct allocation
page read and write
191A3B74000
heap
page read and write
7FF6B7562000
unkown
page read and write
2088719E000
heap
page read and write
427F000
stack
page read and write
41AE000
stack
page read and write
191A3C96000
heap
page read and write
20589AF0000
direct allocation
page read and write
191A39BC000
heap
page read and write
1EA5D100000
heap
page read and write
43B0000
remote allocation
page read and write
191A3C63000
heap
page read and write
22226000
heap
page read and write
191A3981000
heap
page read and write
1BCA7BA0000
unkown
page readonly
4401000
heap
page read and write
3921000
heap
page read and write
E6868FC000
stack
page read and write
7FF7B55F0000
unkown
page readonly
7FF848FF0000
trusted library allocation
page execute and read and write
2D438000
direct allocation
page read and write
3AAC0000
direct allocation
page read and write
191A3C49000
heap
page read and write
FD8000
heap
page read and write
3810000
heap
page read and write
208868FF000
heap
page read and write
19C000
stack
page read and write
2E5C8000
heap
page read and write
191A40F2000
heap
page read and write
191A398E000
heap
page read and write
12D4000
unkown
page read and write
397AC000
direct allocation
page read and write
191A488A000
heap
page read and write
191A39D8000
heap
page read and write
2D634000
direct allocation
page read and write
20887167000
heap
page read and write
191A3BCC000
heap
page read and write
1525000
heap
page read and write
191A1B00000
direct allocation
page read and write
4A8D4000
direct allocation
page read and write
191A3C67000
heap
page read and write
426000
unkown
page write copy
140E000
heap
page read and write
20887110000
heap
page read and write
364E000
stack
page read and write
4440000
remote allocation
page read and write
20887832000
heap
page read and write
384A000
heap
page read and write
48C0000
heap
page read and write
252AF8A4000
direct allocation
page read and write
46B000
unkown
page execute and read and write
17C0000
heap
page read and write
177E000
stack
page read and write
2D584000
direct allocation
page read and write
3720000
heap
page read and write
1BCA987D000
trusted library allocation
page read and write
420D000
stack
page read and write
20887133000
heap
page read and write
2D438000
direct allocation
page read and write
400000
unkown
page readonly
1BCB9721000
trusted library allocation
page read and write
252AF8EA000
direct allocation
page read and write
191A3B5B000
heap
page read and write
1BCC20C0000
heap
page read and write
191A39B6000
heap
page read and write
191A39CE000
heap
page read and write
7FF848E0D000
trusted library allocation
page execute and read and write
2D5A0000
direct allocation
page read and write
7FF848FC0000
trusted library allocation
page read and write
191A39C0000
heap
page read and write
1C40000
heap
page read and write
191A3C87000
heap
page read and write
400000
unkown
page readonly
364E000
stack
page read and write
1014000
heap
page read and write
426000
unkown
page write copy
20887198000
heap
page read and write
582B8000
direct allocation
page read and write
1EA5D302000
heap
page read and write
1384000
heap
page read and write
46A04000
direct allocation
page read and write
2D500000
direct allocation
page read and write
4B9E000
stack
page read and write
252B13C0000
heap
page read and write
426000
unkown
page write copy
907000
unkown
page readonly
1EA5D113000
heap
page read and write
130F000
unkown
page readonly
39754000
direct allocation
page read and write
39760000
direct allocation
page read and write
191A39A7000
heap
page read and write
191A3997000
heap
page read and write
20887110000
heap
page read and write
7FF880000000
direct allocation
page execute and read and write
20887163000
heap
page read and write
325E000
stack
page read and write
CEF000
unkown
page execute and read and write
1BAFE000
stack
page read and write
2D7B0000
direct allocation
page read and write
208868D9000
heap
page read and write
2088693C000
heap
page read and write
191A3C6F000
heap
page read and write
191A3B5B000
heap
page read and write
191A3D1A000
heap
page read and write
22225000
heap
page read and write
191A1B00000
direct allocation
page read and write
20887852000
heap
page read and write
3981C000
direct allocation
page read and write
191A3BE7000
heap
page read and write
20588186000
heap
page read and write
2088710E000
heap
page read and write
1F29000
heap
page read and write
2088710E000
heap
page read and write
22230000
heap
page read and write
18A000
unkown
page readonly
22218000
heap
page read and write
4A90C000
direct allocation
page read and write
191A3981000
heap
page read and write
191A3BC9000
heap
page read and write
7FF848E00000
trusted library allocation
page read and write
191A3FB4000
heap
page read and write
1C3A000
heap
page read and write
3AB04000
direct allocation
page read and write
191A4D46000
heap
page read and write
E009EFF000
stack
page read and write
46E6000
heap
page read and write
20887178000
heap
page read and write
1EA5D202000
heap
page read and write
20887935000
heap
page read and write
2D6F4000
direct allocation
page read and write
11CF000
heap
page read and write
1BE0000
heap
page read and write
191A3C63000
heap
page read and write
191A39BA000
heap
page read and write
2FA2C000
direct allocation
page read and write
1EA5CCA3000
heap
page read and write
2D98C000
direct allocation
page read and write
2088710E000
heap
page read and write
426000
unkown
page write copy
191A39C1000
heap
page read and write
1E0000
heap
page read and write
19C000
stack
page read and write
4820000
direct allocation
page read and write
4552000
heap
page read and write
22230000
heap
page read and write
1D58000
heap
page read and write
191A39BC000
heap
page read and write
2FA7C000
direct allocation
page read and write
100000
unkown
page readonly
3AA88000
direct allocation
page read and write
208878F4000
heap
page read and write
222B6000
heap
page read and write
191A3C11000
heap
page read and write
191A38F0000
trusted library allocation
page read and write
FE9000
heap
page read and write
191A3B4E000
heap
page read and write
3AB1C000
direct allocation
page read and write
48CF000
heap
page read and write
400000
unkown
page readonly
397C8000
direct allocation
page read and write
191A39C0000
heap
page read and write
B6FCC7E000
stack
page read and write
2117C3C0000
direct allocation
page read and write
191A3B66000
heap
page read and write
1EA5D202000
heap
page read and write
252AF8C9000
direct allocation
page read and write
FF7000
heap
page read and write
3AAC0000
direct allocation
page read and write
406D000
stack
page read and write
16FE000
stack
page read and write
191A3997000
heap
page read and write
E686AFF000
stack
page read and write
1CDD000
heap
page read and write
1EA5D102000
heap
page read and write
CA0000
unkown
page readonly
191A3F08000
heap
page read and write
39720000
direct allocation
page read and write
1DEE000
unkown
page readonly
2EB0000
heap
page read and write
191A3C49000
heap
page read and write
2DBF000
stack
page read and write
191A39D8000
heap
page read and write
20886FC0000
remote allocation
page read and write
1A50000
heap
page read and write
1D00000
heap
page read and write
E009CFA000
stack
page read and write
2224C000
heap
page read and write
20887185000
heap
page read and write
1ECB000
heap
page read and write
9C000
stack
page read and write
2D68C000
direct allocation
page read and write
7FF7B4EC1000
unkown
page execute and read and write
AA50F52000
stack
page read and write
1E91000
heap
page read and write
1C3E022B000
heap
page read and write
17C7000
heap
page read and write
1E5000
heap
page read and write
535C000
heap
page read and write
FD6000
heap
page read and write
191A39C5000
heap
page read and write
397B8000
direct allocation
page read and write
7FF71F8C0000
unkown
page readonly
7FF7B4B30000
unkown
page readonly
AA51CFD000
stack
page read and write
915000
unkown
page write copy
20887159000
heap
page read and write
252AFF56000
heap
page read and write
4870000
direct allocation
page read and write
490000
unkown
page execute and read and write
191A1B40000
remote allocation
page read and write
7FF848DFD000
trusted library allocation
page execute and read and write
20887129000
heap
page read and write
7FF848E4C000
trusted library allocation
page execute and read and write
8C0000
unkown
page readonly
126C000
stack
page read and write
1B73E000
stack
page read and write
22225000
heap
page read and write
401000
unkown
page execute read
3750000
heap
page read and write
1240000
unkown
page read and write
1110000
heap
page read and write
126D000
unkown
page read and write
191A3B51000
heap
page read and write
191A39C5000
heap
page read and write
397A4000
direct allocation
page read and write
141D000
heap
page read and write
FEB000
heap
page read and write
1BCA7D10000
heap
page read and write
191A3BE6000
heap
page read and write
3AAB8000
direct allocation
page read and write
400000
unkown
page execute and read and write
91A000
unkown
page readonly
1BCA7E06000
heap
page read and write
191A3B6A000
heap
page read and write
401000
unkown
page execute read
22224000
heap
page read and write
91A000
unkown
page readonly
22229000
heap
page read and write
43FC000
heap
page read and write
2117C3C0000
direct allocation
page read and write
208878C6000
heap
page read and write
397AC000
direct allocation
page read and write
1BCC2060000
heap
page read and write
119F000
heap
page read and write
191A3D63000
heap
page read and write
1C3E000
heap
page read and write
191A39C0000
heap
page read and write
46C6000
heap
page read and write
426000
unkown
page write copy
38A2000
heap
page read and write
AEA6B7B000
stack
page read and write
131000
unkown
page execute read
42C000
unkown
page write copy
2088693C000
heap
page read and write
194000
stack
page read and write
13E0000
heap
page read and write
39700000
direct allocation
page read and write
1F00000
heap
page read and write
837000
unkown
page readonly
191A39D8000
heap
page read and write
3620000
direct allocation
page read and write
8C1000
unkown
page execute read
2D5BC000
direct allocation
page read and write
2088710E000
heap
page read and write
3D80000
trusted library allocation
page read and write
2D5F4000
direct allocation
page read and write
397A4000
direct allocation
page read and write
1D1E000
heap
page execute and read and write
191A3BAD000
heap
page read and write
191A39D1000
heap
page read and write
41B000
unkown
page readonly
3AAF4000
direct allocation
page read and write
3060000
heap
page read and write
2117A9F0000
heap
page read and write
191A3BE6000
heap
page read and write
301E000
stack
page read and write
3E8E000
stack
page read and write
35A0000
direct allocation
page execute and read and write
20886876000
heap
page read and write
2D520000
direct allocation
page read and write
1C3E0200000
heap
page read and write
636000
unkown
page execute and read and write
2D680000
direct allocation
page read and write
1EA5D202000
heap
page read and write
26EB8000
direct allocation
page read and write
191A3B5E000
heap
page read and write
39804000
direct allocation
page read and write
FF3000
heap
page read and write
3FBD000
stack
page read and write
191A39D4000
heap
page read and write
1B15000
heap
page read and write
397D4000
direct allocation
page read and write
2FA44000
direct allocation
page read and write
7FF848FEA000
trusted library allocation
page read and write
191A1B00000
direct allocation
page read and write
191A3B76000
heap
page read and write
18A000
unkown
page readonly
1018000
heap
page read and write
191A3EDF000
heap
page read and write
1BF6000
heap
page read and write
20887183000
heap
page read and write
420000
unkown
page read and write
845000
unkown
page write copy
22225000
heap
page read and write
305E000
stack
page read and write
191A3B5B000
heap
page read and write
1DEB000
heap
page read and write
1BCA7E2B000
heap
page read and write
7FF7B4D09000
unkown
page read and write
20887129000
heap
page read and write
12E7000
unkown
page read and write
191A3C63000
heap
page read and write
12D0000
unkown
page read and write
397B8000
direct allocation
page read and write
34490000
direct allocation
page read and write
39798000
direct allocation
page read and write
FE0000
heap
page read and write
413F000
stack
page read and write
252B13CE000
heap
page read and write
20887181000
heap
page read and write
191A3B84000
heap
page read and write
4A74000
heap
page read and write
7FF78D830000
unkown
page readonly
1BCB9727000
trusted library allocation
page read and write
3CB9000
heap
page read and write
1C3E0302000
heap
page read and write
2091000
heap
page read and write
401000
unkown
page execute read
191A3FB4000
heap
page read and write
2D974000
direct allocation
page read and write
42C000
unkown
page write copy
426000
unkown
page write copy
2088691B000
heap
page read and write
11BE000
heap
page read and write
20887132000
heap
page read and write
426000
unkown
page write copy
213F000
heap
page read and write
FD4000
heap
page read and write
2D584000
direct allocation
page read and write
2D91C000
direct allocation
page read and write
39720000
direct allocation
page read and write
191A3BBE000
heap
page read and write
191A3B51000
heap
page read and write
191A39D8000
heap
page read and write
20887179000
heap
page read and write
491D000
stack
page read and write
1285000
unkown
page read and write
384A000
heap
page read and write
20887152000
heap
page read and write
191A39D1000
heap
page read and write
2D930000
direct allocation
page read and write
252B3E1F000
trusted library allocation
page read and write
39850000
direct allocation
page read and write
CCF000
unkown
page execute and read and write
252AF8B9000
direct allocation
page read and write
20887107000
heap
page read and write
FD8000
heap
page read and write
271B3370000
heap
page read and write
191A39C0000
heap
page read and write
1EDB000
heap
page read and write
34434000
direct allocation
page read and write
191A3B1E000
heap
page read and write
1BCC20B2000
heap
page read and write
20887133000
heap
page read and write
191A3EDF000
heap
page read and write
124C000
unkown
page read and write
2D7D0000
direct allocation
page read and write
191A3BC2000
heap
page read and write
196000
stack
page read and write
FF4000
heap
page read and write
3AB04000
direct allocation
page read and write
2D5D4000
direct allocation
page read and write
1FB5000
heap
page read and write
2058818C000
heap
page read and write
20887176000
heap
page read and write
191A399C000
heap
page read and write
3E80000
trusted library allocation
page read and write
191A3B74000
heap
page read and write
191A3EFE000
heap
page read and write
191A4236000
heap
page read and write
422000
unkown
page write copy
20887110000
heap
page read and write
20887915000
heap
page read and write
191A3986000
heap
page read and write
2020000
heap
page read and write
191A3C51000
heap
page read and write
20589AF0000
direct allocation
page read and write
191A4968000
heap
page read and write
42C000
unkown
page write copy
252AFF20000
heap
page read and write
2D8E8000
direct allocation
page read and write
22227000
heap
page read and write
191A39C0000
heap
page read and write
46D2000
heap
page read and write
2223A000
heap
page read and write
1DEE000
unkown
page readonly
1EC0000
heap
page read and write
252B25CD000
heap
page read and write
7FF7B4D70000
unkown
page read and write
3AA2C000
direct allocation
page read and write
67D000
heap
page read and write
191A3C9C000
heap
page read and write
271B342B000
heap
page read and write
252B2904000
heap
page read and write
191A3BE6000
heap
page read and write
43A04000
direct allocation
page read and write
2D908000
direct allocation
page read and write
125D000
unkown
page read and write
191A3B9D000
heap
page read and write
191A39C0000
heap
page read and write
7FF7B5253000
unkown
page execute read
1018000
heap
page read and write
191A39CE000
heap
page read and write
252B17B7000
trusted library allocation
page read and write
191A3EDF000
heap
page read and write
2FA60000
direct allocation
page read and write
3710000
heap
page read and write
191A5300000
heap
page read and write
43B0000
remote allocation
page read and write
2D904000
direct allocation
page read and write
3CEE000
stack
page read and write
2D6F8000
direct allocation
page read and write
1EA5D202000
heap
page read and write
2C6B8000
direct allocation
page read and write
191A3BC9000
heap
page read and write
1B3A000
heap
page read and write
252AF8B3000
direct allocation
page read and write
191A3BE6000
heap
page read and write
191A3D1A000
heap
page read and write
147000
unkown
page readonly
1371000
heap
page read and write
191A3BC2000
heap
page read and write
191A3B49000
heap
page read and write
2101000
heap
page read and write
1BCB9731000
trusted library allocation
page read and write
1C30000
heap
page read and write
3AB20000
direct allocation
page read and write
22230000
heap
page read and write
2FA14000
direct allocation
page read and write
2D4B8000
direct allocation
page read and write
7FF7B4EC5000
unkown
page execute and read and write
3680000
heap
page read and write
191A4802000
heap
page read and write
2FA6C000
direct allocation
page read and write
2D504000
direct allocation
page read and write
1BCA7DB5000
heap
page read and write
2D5AC000
direct allocation
page read and write
191A3EDF000
heap
page read and write
2D978000
direct allocation
page read and write
2D7C8000
direct allocation
page read and write
15E0000
heap
page read and write
191A3B78000
heap
page read and write
7F0000
unkown
page readonly
11C1000
heap
page read and write
20887185000
heap
page read and write
FEC000
heap
page read and write
2088694D000
heap
page read and write
4790000
direct allocation
page read and write
11B4000
heap
page read and write
39770000
direct allocation
page read and write
191A3B62000
heap
page read and write
271B3C02000
trusted library allocation
page read and write
3F8E000
stack
page read and write
1BE8E000
stack
page read and write
2EA0000
heap
page read and write
45EE000
stack
page read and write
7FF849000000
trusted library allocation
page read and write
1EC3000
heap
page read and write
191A3C9C000
heap
page read and write
7FF720380000
unkown
page readonly
7FF7B4B30000
unkown
page readonly
1A2E000
unkown
page readonly
907000
unkown
page readonly
34460000
direct allocation
page read and write
1F1F000
heap
page read and write
1F00000
heap
page read and write
7FF6B7565000
unkown
page readonly
B6FC6FE000
stack
page read and write
252AFEC1000
heap
page read and write
4C2B000
heap
page read and write
7FF7B51F0000
unkown
page execute read
191A3EDF000
heap
page read and write
20887130000
heap
page read and write
191A4577000
heap
page read and write
84A000
unkown
page readonly
20589AF0000
direct allocation
page read and write
2088716B000
heap
page read and write
41B000
unkown
page readonly
2D970000
direct allocation
page read and write
12FD000
unkown
page read and write
1145000
heap
page read and write
2088715A000
heap
page read and write
1B9BE000
stack
page read and write
1B30000
heap
page read and write
191A3B74000
heap
page read and write
20887181000
heap
page read and write
1199000
heap
page read and write
39F0000
heap
page read and write
252B19C0000
unkown
page read and write
20887131000
heap
page read and write
191A3B95000
heap
page read and write
AA517FE000
stack
page read and write
48C2000
heap
page read and write
430E000
stack
page read and write
1BCA9721000
trusted library allocation
page read and write
191A3BC6000
heap
page read and write
2117C3C0000
direct allocation
page read and write
1BCA7BA2000
unkown
page readonly
1BCA7E6D000
heap
page read and write
102F000
heap
page read and write
E009FFD000
stack
page read and write
7FF7B4F4C000
unkown
page execute and read and write
19D000
stack
page read and write
3AB00000
direct allocation
page read and write
1BCA7DF0000
heap
page read and write
2088719C000
heap
page read and write
3686000
heap
page read and write
191A3C7D000
heap
page read and write
191A3F89000
heap
page read and write
252B27AA000
heap
page read and write
191A3CB7000
heap
page read and write
2D8F4000
direct allocation
page read and write
396C0000
direct allocation
page read and write
191A3B4F000
heap
page read and write
420000
unkown
page write copy
191A399C000
heap
page read and write
39754000
direct allocation
page read and write
FC6000
heap
page read and write
401000
unkown
page execute read
FD4000
heap
page read and write
37A8000
heap
page read and write
2D990000
direct allocation
page read and write
191A3C33000
heap
page read and write
191A3BC6000
heap
page read and write
3938000
direct allocation
page read and write
271B3502000
heap
page read and write
20887155000
heap
page read and write
1A0A000
unkown
page readonly
FD6000
heap
page read and write
191A3BBE000
heap
page read and write
3C9C000
unkown
page read and write
252AFDA3000
heap
page read and write
43FC000
stack
page read and write
7FF848F10000
trusted library allocation
page execute and read and write
1C00000
heap
page read and write
8FFAEFF000
stack
page read and write
20887183000
heap
page read and write
18A000
unkown
page readonly
191A5ED2000
heap
page read and write
271B33D0000
trusted library allocation
page read and write
3E10000
trusted library allocation
page read and write
7FF6B770D000
unkown
page execute and read and write
11B4000
heap
page read and write
2D4C0000
direct allocation
page read and write
20887153000
heap
page read and write
39638000
direct allocation
page read and write
2088693C000
heap
page read and write
401000
unkown
page execute read
191A3CF1000
heap
page read and write
3C8C000
stack
page read and write
191A3C54000
heap
page read and write
B6FC3AE000
stack
page read and write
36B0000
heap
page read and write
191A3B84000
heap
page read and write
2D6F4000
direct allocation
page read and write
20887133000
heap
page read and write
191A567C000
heap
page read and write
3442C000
direct allocation
page read and write
191A3981000
heap
page read and write
191A3C6F000
heap
page read and write
FF7000
heap
page read and write
191A39A7000
heap
page read and write
191A3981000
heap
page read and write
3AA6C000
direct allocation
page read and write
191A3CF1000
heap
page read and write
5822C000
direct allocation
page read and write
1C4F000
heap
page execute and read and write
2088712D000
heap
page read and write
45F000
unkown
page execute and read and write
191A39C0000
heap
page read and write
1374000
heap
page read and write
3F8E000
stack
page read and write
396C0000
direct allocation
page read and write
2ED0000
heap
page read and write
191A3EDE000
heap
page read and write
22230000
heap
page read and write
20886902000
heap
page read and write
3F10000
direct allocation
page execute and read and write
C77000
unkown
page execute and read and write
3D80000
heap
page read and write
40BE000
stack
page read and write
1F0000
heap
page read and write
2088691B000
heap
page read and write
252B061A000
heap
page read and write
11CE000
heap
page read and write
191A5578000
heap
page read and write
393E000
stack
page read and write
191A399C000
heap
page read and write
38C0000
heap
page read and write
20887931000
heap
page read and write
191A39D1000
heap
page read and write
20887185000
heap
page read and write
191A39C0000
heap
page read and write
271B3390000
heap
page read and write
20887174000
heap
page read and write
FD8000
heap
page read and write
1FB7000
heap
page read and write
191A399C000
heap
page read and write
3C4C000
unkown
page read and write
2088715B000
heap
page read and write
7F1000
unkown
page execute read
7FF848EB0000
trusted library allocation
page execute and read and write
8C1000
unkown
page execute read
2D7B0000
direct allocation
page read and write
7FF6B7AA3000
unkown
page execute read
20887133000
heap
page read and write
13F5000
heap
page read and write
2088715B000
heap
page read and write
2224C000
heap
page read and write
1BA6F000
stack
page read and write
2FA8C000
direct allocation
page read and write
E6869FF000
stack
page read and write
2D7B0000
direct allocation
page read and write
FC6000
heap
page read and write
12D6000
unkown
page read and write
191A3BAD000
heap
page read and write
2D954000
direct allocation
page read and write
191A3C54000
heap
page read and write
406E000
stack
page read and write
2D7D4000
direct allocation
page read and write
3AAC8000
direct allocation
page read and write
1300000
unkown
page read and write
191A3B75000
heap
page read and write
191A39BC000
heap
page read and write
1FD4000
heap
page read and write
1E7000
heap
page read and write
191A3B6A000
heap
page read and write
39738000
direct allocation
page read and write
1C58000
heap
page read and write
7FF848E03000
trusted library allocation
page read and write
18A000
unkown
page readonly
191A3B62000
heap
page read and write
2088713B000
heap
page read and write
2088691B000
heap
page read and write
2088710E000
heap
page read and write
191A39D8000
heap
page read and write
4417000
heap
page read and write
4616000
heap
page read and write
FA8000
heap
page read and write
1F27000
heap
page read and write
151F000
stack
page read and write
7FF6B7511000
unkown
page readonly
CD3000
unkown
page execute and read and write
2088691B000
heap
page read and write
191A4117000
heap
page read and write
7FF6B7AA3000
unkown
page execute read
401000
unkown
page execute read
191A39D1000
heap
page read and write
191A39C5000
heap
page read and write
CE7000
unkown
page readonly
1E94000
heap
page read and write
3A09000
heap
page execute and read and write
2D560000
direct allocation
page read and write
1EEC000
heap
page read and write
1EA5D302000
heap
page read and write
4A08000
heap
page read and write
191A3984000
heap
page read and write
191A3C54000
heap
page read and write
3AA24000
direct allocation
page read and write
43F5000
heap
page read and write
295A000
heap
page read and write
41B000
unkown
page readonly
191A399C000
heap
page read and write
191A39C5000
heap
page read and write
907000
unkown
page readonly
252AF8E4000
direct allocation
page read and write
1BA0000
heap
page read and write
1B83F000
stack
page read and write
7FF880000000
direct allocation
page execute and read and write
20588160000
heap
page read and write
101000
unkown
page execute read
1A2E000
unkown
page readonly
252AF8CD000
direct allocation
page read and write
191A3C6F000
heap
page read and write
1C060000
heap
page read and write
191A4960000
heap
page read and write
20887152000
heap
page read and write
1014000
heap
page read and write
22224000
heap
page read and write
CFA000
unkown
page readonly
8C0000
unkown
page readonly
2D8F8000
direct allocation
page read and write
1F20000
heap
page read and write
20887129000
heap
page read and write
252ADB0B000
heap
page read and write
1279000
unkown
page read and write
191A3996000
heap
page read and write
191A39E8000
heap
page read and write
191A3E0D000
heap
page read and write
397D4000
direct allocation
page read and write
417E000
stack
page read and write
208878D7000
heap
page read and write
2D950000
direct allocation
page read and write
20887181000
heap
page read and write
11B4000
heap
page read and write
1A0A000
unkown
page readonly
1DED000
unkown
page read and write
20887181000
heap
page read and write
1018000
heap
page read and write
427000
unkown
page readonly
44FC000
stack
page read and write
7FF6B7A40000
unkown
page execute read
3AA78000
direct allocation
page read and write
9C000
stack
page read and write
191A39CE000
heap
page read and write
20887176000
heap
page read and write
191A3CA0000
heap
page read and write
252B1732000
trusted library allocation
page read and write
252AF8DF000
direct allocation
page read and write
1A50000
heap
page read and write
1BCB986F000
trusted library allocation
page read and write
2E5B1000
heap
page read and write
2D7B0000
direct allocation
page read and write
400000
unkown
page readonly
2D7C4000
direct allocation
page read and write
191A3BE7000
heap
page read and write
208868FF000
heap
page read and write
20887169000
heap
page read and write
3978C000
direct allocation
page read and write
191A3B92000
heap
page read and write
252B0DC1000
heap
page read and write
1B10000
heap
page read and write
2D57C000
direct allocation
page read and write
2D578000
direct allocation
page read and write
155000
unkown
page write copy
11D0000
heap
page read and write
2117C3C0000
direct allocation
page read and write
1D0E000
heap
page read and write
20887130000
heap
page read and write
5078000
direct allocation
page read and write
36E0000
direct allocation
page execute and read and write
191A3B49000
heap
page read and write
191A3EDF000
heap
page read and write
7FF7B4EB3000
unkown
page execute and read and write
3E70000
heap
page read and write
FE0000
heap
page read and write
1309000
unkown
page write copy
20589AF0000
direct allocation
page read and write
191A3B9D000
heap
page read and write
42C000
unkown
page write copy
1ED9000
heap
page read and write
1CDA000
heap
page read and write
401000
unkown
page execute read
AA51BFA000
stack
page read and write
191A39D8000
heap
page read and write
AA515FE000
stack
page read and write
1C3E0213000
heap
page read and write
125E000
stack
page read and write
20886870000
heap
page read and write
11D4000
heap
page read and write
4C30000
direct allocation
page read and write
39638000
direct allocation
page read and write
3971C000
direct allocation
page read and write
1244000
unkown
page read and write
37BF000
stack
page read and write
4601000
heap
page read and write
20BC000
heap
page read and write
252ADA50000
heap
page read and write
22230000
heap
page read and write
1BCA7DE0000
trusted library allocation
page read and write
400000
unkown
page readonly
20887133000
heap
page read and write
191A4494000
heap
page read and write
19D000
stack
page read and write
491D000
heap
page read and write
42C000
unkown
page write copy
1018000
heap
page read and write
426000
unkown
page write copy
397D4000
direct allocation
page read and write
413F000
stack
page read and write
3971C000
direct allocation
page read and write
20887107000
heap
page read and write
825000
unkown
page read and write
191A3CD2000
heap
page read and write
208876A0000
remote allocation
page read and write
7F1000
unkown
page execute read
46EF000
stack
page read and write
1ED0000
heap
page read and write
191A3B78000
heap
page read and write
208878B6000
heap
page read and write
39704000
direct allocation
page read and write
39720000
direct allocation
page read and write
13E0000
heap
page read and write
191A1B00000
direct allocation
page read and write
42AF000
stack
page read and write
3751000
heap
page read and write
3AB34000
direct allocation
page read and write
3F6E000
stack
page read and write
4567000
heap
page read and write
191A3997000
heap
page read and write
FEC000
heap
page read and write
20887172000
heap
page read and write
20887132000
heap
page read and write
915000
unkown
page write copy
191A3FB4000
heap
page read and write
191A3F08000
heap
page read and write
FEB000
heap
page read and write
191A3B78000
heap
page read and write
2088718A000
heap
page read and write
22230000
heap
page read and write
252ADA90000
heap
page read and write
191A3BE7000
heap
page read and write
13F9000
heap
page read and write
4F3B000
direct allocation
page read and write
191A398C000
heap
page read and write
22230000
heap
page read and write
191A3C67000
heap
page read and write
2D7B0000
direct allocation
page read and write
1BC4E000
stack
page read and write
1292000
unkown
page read and write
2D520000
direct allocation
page read and write
1C3E01D0000
heap
page read and write
20887867000
heap
page read and write
36C0000
heap
page read and write
3981C000
direct allocation
page read and write
2D6F4000
direct allocation
page read and write
20887187000
heap
page read and write
20887179000
heap
page read and write
49AC000
stack
page read and write
400000
unkown
page readonly
2088710E000
heap
page read and write
20886FC0000
remote allocation
page read and write
624000
unkown
page execute and read and write
AEA6E7E000
stack
page read and write
252B25D2000
heap
page read and write
13E4000
heap
page read and write
39754000
direct allocation
page read and write
191A4312000
heap
page read and write
47F0000
direct allocation
page read and write
B6FCA7E000
stack
page read and write
119C000
heap
page read and write
191A3B74000
heap
page read and write
191A3C51000
heap
page read and write
191A39C5000
heap
page read and write
2088691B000
heap
page read and write
191A3CF1000
heap
page read and write
2088719E000
heap
page read and write
39754000
direct allocation
page read and write
191A3B78000
heap
page read and write
191A1B00000
direct allocation
page read and write
15D0000
heap
page read and write
39704000
direct allocation
page read and write
191A44AB000
heap
page read and write
22228000
heap
page read and write
191A40F7000
heap
page read and write
B40000
unkown
page readonly
191A3B9F000
heap
page read and write
7FF848DF4000
trusted library allocation
page read and write
400000
unkown
page readonly
101000
unkown
page execute read
191A3B91000
heap
page read and write
22216000
heap
page read and write
191A1B00000
direct allocation
page read and write
252ADAD6000
heap
page read and write
22225000
heap
page read and write
AA514FE000
stack
page read and write
129E000
unkown
page read and write
CF5000
unkown
page read and write
191A39D8000
heap
page read and write
2E5BF000
heap
page read and write
191A39D8000
heap
page read and write
10FC000
stack
page read and write
4697000
heap
page read and write
3AB10000
direct allocation
page read and write
191A398C000
heap
page read and write
41B000
unkown
page readonly
118D000
heap
page read and write
2D7CC000
direct allocation
page read and write
191A1B00000
direct allocation
page read and write
191A4E8E000
heap
page read and write
4500000
remote allocation
page read and write
191A4F9A000
heap
page read and write
252B2A94000
heap
page read and write
145C000
stack
page read and write
1F47000
heap
page read and write
41B000
unkown
page readonly
191A39A6000
heap
page read and write
1018000
heap
page read and write
2D438000
direct allocation
page read and write
2D99C000
direct allocation
page read and write
191A399C000
heap
page read and write
1BCA7EFD000
heap
page read and write
2D640000
direct allocation
page read and write
1E91000
heap
page read and write
11D4000
heap
page read and write
1BCA7DD0000
trusted library allocation
page read and write
20887110000
heap
page read and write
15A000
unkown
page readonly
1CEF000
stack
page read and write
252ADAD0000
heap
page read and write
2D688000
direct allocation
page read and write
1BD8E000
stack
page read and write
20887130000
heap
page read and write
41BF000
stack
page read and write
177000
unkown
page readonly
1C3E0242000
heap
page read and write
FD6000
heap
page read and write
20887187000
heap
page read and write
1E6E000
heap
page read and write
191A3C9F000
heap
page read and write
191A3B9D000
heap
page read and write
191A3995000
heap
page read and write
1C3E01E0000
heap
page read and write
7FF6B75C0000
unkown
page read and write
4BD0000
direct allocation
page read and write
2D5D0000
direct allocation
page read and write
43EC000
stack
page read and write
22223000
heap
page read and write
191A3D10000
heap
page read and write
2D684000
direct allocation
page read and write
191A1B00000
direct allocation
page read and write
20887129000
heap
page read and write
1A2E000
unkown
page readonly
20887135000
heap
page read and write
3878000
heap
page read and write
191A3BE6000
heap
page read and write
208878D7000
heap
page read and write
20887887000
heap
page read and write
11CE000
heap
page read and write
191A3B6A000
heap
page read and write
1E60000
heap
page read and write
1EED000
heap
page read and write
1A0A000
unkown
page readonly
191A3B6C000
heap
page read and write
7FF6B7707000
unkown
page execute and read and write
41B000
unkown
page readonly
42C000
unkown
page write copy
2088712A000
heap
page read and write
126F000
unkown
page read and write
2088693C000
heap
page read and write
191A3C51000
heap
page read and write
2D570000
direct allocation
page read and write
11B0000
heap
page read and write
7FF7B4B31000
unkown
page execute read
2D680000
direct allocation
page read and write
252B0F55000
heap
page read and write
20887914000
heap
page read and write
1EEA000
heap
page read and write
20887181000
heap
page read and write
191A3C51000
heap
page read and write
422000
unkown
page write copy
1EFE000
heap
page read and write
2088712F000
heap
page read and write
1140000
heap
page read and write
7FF6B7512000
unkown
page execute and read and write
3981C000
direct allocation
page read and write
1D02000
heap
page read and write
191A3988000
heap
page read and write
191A3B6D000
heap
page read and write
1A60000
heap
page read and write
20887129000
heap
page read and write
20887133000
heap
page read and write
42C000
unkown
page write copy
191A3B66000
heap
page read and write
252AF8D0000
direct allocation
page read and write
2D7BC000
direct allocation
page read and write
4C9F000
stack
page read and write
37F0000
heap
page read and write
1700000
heap
page read and write
48BF000
heap
page read and write
20887183000
heap
page read and write
4ECB000
direct allocation
page read and write
2224C000
heap
page read and write
39738000
direct allocation
page read and write
191A3B6D000
heap
page read and write
22230000
heap
page read and write
7FF720380000
unkown
page readonly
624000
unkown
page execute and read and write
252AFE20000
heap
page read and write
2117C3C0000
direct allocation
page read and write
191A3B80000
heap
page read and write
191A3B7D000
heap
page read and write
4A940000
direct allocation
page read and write
7FF848FA5000
trusted library allocation
page read and write
22223000
heap
page read and write
2088715B000
heap
page read and write
252AF892000
direct allocation
page read and write
191A3BC6000
heap
page read and write
2036000
heap
page read and write
2088718B000
heap
page read and write
191A3B9D000
heap
page read and write
7FF7B4D07000
unkown
page execute and read and write
2117AAE6000
heap
page read and write
191A574B000
heap
page read and write
191A3984000
heap
page read and write
191A3CF1000
heap
page read and write
4437000
heap
page read and write
2D504000
direct allocation
page read and write
7FF848E1D000
trusted library allocation
page execute and read and write
7FF6B7703000
unkown
page execute and read and write
208878BC000
heap
page read and write
3690000
remote allocation
page read and write
7FF6B779C000
unkown
page execute and read and write
39758000
direct allocation
page read and write
549000
unkown
page execute and read and write
4531000
heap
page read and write
401000
unkown
page execute read
191A3BE7000
heap
page read and write
2088691B000
heap
page read and write
191A39D8000
heap
page read and write
1C0E000
heap
page read and write
1BEEE000
stack
page read and write
1C3E0950000
remote allocation
page read and write
191A3BC9000
heap
page read and write
1EC2000
heap
page read and write
1BCA80B0000
heap
page read and write
3AA7C000
direct allocation
page read and write
191A399C000
heap
page read and write
191A40FB000
heap
page read and write
AA520FE000
stack
page read and write
2088715B000
heap
page read and write
191A5C6A000
heap
page read and write
2D940000
direct allocation
page read and write
FF6000
heap
page read and write
1DFF000
stack
page read and write
2D914000
direct allocation
page read and write
5005000
direct allocation
page read and write
20887179000
heap
page read and write
13EF000
heap
page read and write
1C5E000
heap
page execute and read and write
2088691B000
heap
page read and write
252B1746000
trusted library allocation
page read and write
4611000
heap
page read and write
34444000
direct allocation
page read and write
401000
unkown
page execute read
1DEE000
unkown
page readonly
34470000
direct allocation
page read and write
7FF7B4EB5000
unkown
page execute and read and write
FD6000
heap
page read and write
191A40F5000
heap
page read and write
2117C3C0000
direct allocation
page read and write
7FF7B4EBF000
unkown
page execute and read and write
191A3BC2000
heap
page read and write
2D4C0000
direct allocation
page read and write
128E000
unkown
page read and write
42BE000
stack
page read and write
191A3B84000
heap
page read and write
20886FC0000
remote allocation
page read and write
20887176000
heap
page read and write
20887133000
heap
page read and write
1BF0000
heap
page read and write
3985C000
direct allocation
page read and write
252B0D4B000
heap
page read and write
191A3B75000
heap
page read and write
8FFADFF000
stack
page read and write
1BCA7E43000
heap
page read and write
FF3000
heap
page read and write
7FF6B7713000
unkown
page execute and read and write
4620000
heap
page read and write
282A7000
heap
page read and write
2224C000
heap
page read and write
252B2D38000
heap
page read and write
20887183000
heap
page read and write
191A39D1000
heap
page read and write
20887183000
heap
page read and write
1BCA7D30000
heap
page read and write
2D900000
direct allocation
page read and write
7FF7B4F52000
unkown
page execute and read and write
4A940000
direct allocation
page read and write
48B0000
heap
page read and write
34424000
direct allocation
page read and write
191A39C0000
heap
page read and write
191A3C49000
heap
page read and write
2D980000
direct allocation
page read and write
15A000
unkown
page readonly
426000
unkown
page write copy
403E000
stack
page read and write
2D708000
direct allocation
page read and write
2D8F0000
direct allocation
page read and write
7FF7B5253000
unkown
page execute read
1BCA9710000
heap
page execute and read and write
CE7000
unkown
page readonly
252AFDB0000
trusted library allocation
page read and write
191A3C07000
heap
page read and write
2D500000
direct allocation
page read and write
191A39D8000
heap
page read and write
1AAE000
stack
page read and write
191A3B92000
heap
page read and write
1F06000
heap
page read and write
3981C000
direct allocation
page read and write
91A000
unkown
page readonly
20887884000
heap
page read and write
1DEE000
unkown
page readonly
8C0000
unkown
page readonly
3AA14000
direct allocation
page read and write
252AF827000
direct allocation
page read and write
7FF6B7556000
unkown
page readonly
2D680000
direct allocation
page read and write
2088715A000
heap
page read and write
2D520000
direct allocation
page read and write
252ADA80000
heap
page read and write
191A3B78000
heap
page read and write
191A39CE000
heap
page read and write
282A4000
heap
page read and write
191A3B85000
heap
page read and write
2D51C000
direct allocation
page read and write
42EC000
stack
page read and write
FE0000
heap
page read and write
1D3E000
stack
page read and write
1500000
heap
page read and write
191A3C57000
heap
page read and write
3DEF000
stack
page read and write
2D920000
direct allocation
page read and write
4537000
heap
page read and write
191A1BD0000
heap
page read and write
2D95C000
direct allocation
page read and write
205881A3000
heap
page read and write
208868D9000
heap
page read and write
22236000
heap
page read and write
191A39C1000
heap
page read and write
1DEE000
unkown
page readonly
FE7000
heap
page read and write
191A4397000
heap
page read and write
7FF7B4EC7000
unkown
page execute and read and write
191A45A8000
heap
page read and write
2D578000
direct allocation
page read and write
4C40000
direct allocation
page read and write
2224C000
heap
page read and write
2FAA0000
direct allocation
page read and write
191A3D62000
heap
page read and write
3820000
heap
page read and write
AA512FE000
stack
page read and write
1B3E000
heap
page read and write
22230000
heap
page read and write
3990000
heap
page read and write
191A398C000
heap
page read and write
7FF848EA6000
trusted library allocation
page read and write
2D5D0000
direct allocation
page read and write
1BCC1EF0000
trusted library section
page read and write
344A4000
direct allocation
page read and write
43E000
unkown
page execute and read and write
1EB0000
heap
page read and write
1F20000
heap
page read and write
2FA0C000
direct allocation
page read and write
2D6F4000
direct allocation
page read and write
840000
unkown
page execute and read and write
20887130000
heap
page read and write
1BCA7DB0000
heap
page read and write
1385000
heap
page read and write
378F000
stack
page read and write
39758000
direct allocation
page read and write
252B1726000
trusted library allocation
page read and write
191A4202000
heap
page read and write
191A3EDF000
heap
page read and write
20887107000
heap
page read and write
39700000
direct allocation
page read and write
7FF848E1B000
trusted library allocation
page execute and read and write
191A3997000
heap
page read and write
1BCA80B5000
heap
page read and write
7FF6B770F000
unkown
page execute and read and write
130000
unkown
page readonly
20887904000
heap
page read and write
2117C3C0000
direct allocation
page read and write
1A0A000
unkown
page readonly
191A3BCC000
heap
page read and write
7FF6B77A2000
unkown
page execute and read and write
191A39C5000
heap
page read and write
19A0000
unkown
page readonly
3AAB0000
direct allocation
page read and write
39738000
direct allocation
page read and write
1416000
heap
page read and write
1DF0000
heap
page read and write
1E2F000
stack
page read and write
191A3BCC000
heap
page read and write
20887129000
heap
page read and write
15A000
unkown
page readonly
FEF000
heap
page read and write
447000
unkown
page execute and read and write
2D97C000
direct allocation
page read and write
191A3C1E000
heap
page read and write
191A39C9000
heap
page read and write
191A398E000
heap
page read and write
FE9000
heap
page read and write
20887169000
heap
page read and write
1C3E0A02000
trusted library allocation
page read and write
191A1B40000
remote allocation
page read and write
3EBC000
stack
page read and write
208878EB000
heap
page read and write
191A3BC6000
heap
page read and write
20886919000
heap
page read and write
1EB0000
heap
page read and write
39840000
direct allocation
page read and write
252B14C1000
heap
page read and write
1BCA7E6B000
heap
page read and write
1B4F000
heap
page execute and read and write
191A3B84000
heap
page read and write
7FF848FD0000
trusted library allocation
page read and write
1C3E0940000
trusted library allocation
page read and write
22221000
heap
page read and write
11B0000
heap
page read and write
2088715B000
heap
page read and write
442B000
heap
page read and write
155C000
stack
page read and write
252AF590000
heap
page read and write
4ADC000
stack
page read and write
400000
unkown
page readonly
191A39D8000
heap
page read and write
191A3B8E000
heap
page read and write
2DB80000
direct allocation
page read and write
1F57000
heap
page read and write
1A30000
heap
page read and write
4A930000
direct allocation
page read and write
252AF5E0000
heap
page read and write
252B2CED000
heap
page read and write
2D7B0000
direct allocation
page read and write
FF3000
heap
page read and write
191A3981000
heap
page read and write
19BF000
stack
page read and write
39758000
direct allocation
page read and write
2031000
heap
page read and write
7FF7B4D06000
unkown
page readonly
461B000
heap
page read and write
39798000
direct allocation
page read and write
417E000
stack
page read and write
1C97000
heap
page read and write
2088694D000
heap
page read and write
2088710F000
heap
page read and write
20887133000
heap
page read and write
191A3BCC000
heap
page read and write
252AF87E000
direct allocation
page read and write
191A3B9E000
heap
page read and write
252AF8C2000
direct allocation
page read and write
191A39CE000
heap
page read and write
2D4B8000
direct allocation
page read and write
1C1E000
heap
page execute and read and write
20887199000
heap
page read and write
43E000
unkown
page execute and read and write
4440000
remote allocation
page read and write
20887904000
heap
page read and write
191A446A000
heap
page read and write
2223B000
heap
page read and write
3AAE0000
direct allocation
page read and write
191A3BE6000
heap
page read and write
1BCC2020000
heap
page read and write
1BCA7DA0000
trusted library allocation
page read and write
39638000
direct allocation
page read and write
3821000
heap
page read and write
1018000
heap
page read and write
43A50000
direct allocation
page read and write
191A3B81000
heap
page read and write
252ADADC000
heap
page read and write
2088715A000
heap
page read and write
13F9000
heap
page read and write
208878C2000
heap
page read and write
20887175000
heap
page read and write
1EE0000
heap
page read and write
191A3B9D000
heap
page read and write
7FF6B76AE000
unkown
page execute and read and write
42C000
unkown
page write copy
20887157000
heap
page read and write
B6FCF7E000
unkown
page readonly
1EA5D202000
heap
page read and write
3440C000
direct allocation
page read and write
1014000
heap
page read and write
1710000
heap
page read and write
3610000
direct allocation
page read and write
1C164000
heap
page read and write
12FF000
unkown
page write copy
20887904000
heap
page read and write
7FF848DF3000
trusted library allocation
page execute and read and write
400000
unkown
page readonly
191A3BCC000
heap
page read and write
1BFED000
stack
page read and write
16FE000
stack
page read and write
1E3F000
stack
page read and write
42C000
unkown
page write copy
7FF880030000
direct allocation
page execute and read and write
191A420A000
heap
page read and write
252AFD40000
trusted library allocation
page read and write
1A2E000
unkown
page readonly
191A3C96000
heap
page read and write
20588130000
heap
page read and write
400000
unkown
page execute and read and write
4500000
remote allocation
page read and write
11A6000
heap
page read and write
191A3F8A000
heap
page read and write
1EA5D302000
heap
page read and write
22498844000
heap
page read and write
39758000
direct allocation
page read and write
191A5EB2000
heap
page read and write
191A4CF4000
heap
page read and write
400000
unkown
page execute and read and write
1507000
heap
page read and write
12C2000
unkown
page read and write
3AA0C000
direct allocation
page read and write
58004000
direct allocation
page read and write
191A39C5000
heap
page read and write
2088715B000
heap
page read and write
2D7B0000
direct allocation
page read and write
39820000
direct allocation
page read and write
22225000
heap
page read and write
3978C000
direct allocation
page read and write
915000
unkown
page write copy
2D6F4000
direct allocation
page read and write
1EA5CCA3000
heap
page read and write
2088788A000
heap
page read and write
2088788A000
heap
page read and write
191A39CF000
heap
page read and write
7FF6B7705000
unkown
page execute and read and write
119E000
heap
page read and write
20886894000
heap
page read and write
20887179000
heap
page read and write
191A39D4000
heap
page read and write
208878ED000
heap
page read and write
1018000
heap
page read and write
CF5000
unkown
page write copy
1B8E000
stack
page read and write
2088717C000
heap
page read and write
191A39D1000
heap
page read and write
2D438000
direct allocation
page read and write
1A09000
unkown
page read and write
2222A000
heap
page read and write
191A3B91000
heap
page read and write
191A3BE6000
heap
page read and write
2088717C000
heap
page read and write
1EA5CC4F000
heap
page read and write
2D994000
direct allocation
page read and write
20887107000
heap
page read and write
1FA7000
heap
page read and write
191A3B51000
heap
page read and write
7FF6B7380000
unkown
page readonly
3821000
heap
page read and write
2D988000
direct allocation
page read and write
20589AF0000
direct allocation
page read and write
AA516FB000
stack
page read and write
2D938000
direct allocation
page read and write
191A39D8000
heap
page read and write
39638000
direct allocation
page read and write
191A3BCC000
heap
page read and write
41B000
unkown
page readonly
400000
unkown
page readonly
1A50000
heap
page read and write
38FE000
stack
page read and write
426000
unkown
page write copy
1014000
heap
page read and write
8FFACFC000
stack
page read and write
20887152000
heap
page read and write
208878D0000
heap
page read and write
1BCA7D50000
heap
page read and write
1B95000
heap
page read and write
20887183000
heap
page read and write
2222C000
heap
page read and write
4A60000
heap
page read and write
20887914000
heap
page read and write
437D000
unkown
page read and write
191A3C63000
heap
page read and write
20886880000
heap
page read and write
39744000
direct allocation
page read and write
1BBFF000
stack
page read and write
2D964000
direct allocation
page read and write
191A4E2D000
heap
page read and write
191A3C7D000
heap
page read and write
220D9000
heap
page read and write
2059000
heap
page read and write
1B90000
heap
page read and write
1C22000
heap
page read and write
19D000
stack
page read and write
2088694D000
heap
page read and write
2D7B0000
direct allocation
page read and write
191A3B51000
heap
page read and write
1A0A000
unkown
page readonly
191A39CF000
heap
page read and write
3AA9C000
direct allocation
page read and write
4A950000
direct allocation
page read and write
377A000
heap
page read and write
FD1000
heap
page read and write
2D9A4000
direct allocation
page read and write
282A2000
heap
page read and write
191A3C51000
heap
page read and write
22230000
heap
page read and write
39720000
direct allocation
page read and write
1F0000
heap
page read and write
3AA38000
direct allocation
page read and write
191A3B9E000
heap
page read and write
1A2D000
unkown
page read and write
2088710E000
heap
page read and write
11A2000
heap
page read and write
191A39B7000
heap
page read and write
2088717C000
heap
page read and write
1F0000
heap
page read and write
191A3C9F000
heap
page read and write
34454000
direct allocation
page read and write
191A3CA0000
heap
page read and write
1EB0000
heap
page read and write
191A3B51000
heap
page read and write
FB1000
heap
page read and write
4690000
heap
page read and write
4A07000
heap
page read and write
7FF6B7715000
unkown
page execute and read and write
397C8000
direct allocation
page read and write
20887925000
heap
page read and write
2D694000
direct allocation
page read and write
252AF89E000
direct allocation
page read and write
191A4317000
heap
page read and write
2E5B9000
heap
page read and write
1290000
unkown
page read and write
22230000
heap
page read and write
20589AF0000
direct allocation
page read and write
191A3BC6000
heap
page read and write
2D92C000
direct allocation
page read and write
20887185000
heap
page read and write
2117C3A0000
heap
page read and write
191A3974000
heap
page read and write
84A000
unkown
page readonly
1CC2000
heap
page read and write
191A3C67000
heap
page read and write
2088790E000
heap
page read and write
1C3E0950000
remote allocation
page read and write
191A463E000
heap
page read and write
20887914000
heap
page read and write
191A3B61000
heap
page read and write
252AF852000
direct allocation
page read and write
191A399C000
heap
page read and write
20887186000
heap
page read and write
19D000
stack
page read and write
2D958000
direct allocation
page read and write
1120000
heap
page read and write
4E5B000
direct allocation
page read and write
191A3EDF000
heap
page read and write
185000
unkown
page write copy
3AA68000
direct allocation
page read and write
39840000
direct allocation
page read and write
191A398C000
heap
page read and write
3985C000
direct allocation
page read and write
2D590000
direct allocation
page read and write
2DC0000
heap
page read and write
1327000
heap
page read and write
400000
unkown
page readonly
22228000
heap
page read and write
2088719E000
heap
page read and write
1418000
heap
page read and write
191A3B4D000
heap
page read and write
1B40000
heap
page read and write
191A3BC5000
heap
page read and write
1A2E000
unkown
page readonly
1CB1000
heap
page read and write
20887132000
heap
page read and write
191A4597000
heap
page read and write
213C000
heap
page read and write
20589AF0000
direct allocation
page read and write
20E1000
heap
page read and write
252B14D7000
heap
page read and write
191A3BC6000
heap
page read and write
401000
unkown
page execute read
1276000
unkown
page read and write
191A3D62000
heap
page read and write
7FF7B4D15000
unkown
page readonly
191A3B24000
heap
page read and write
191A3B5B000
heap
page read and write
7FF848DF2000
trusted library allocation
page read and write
252B0DDD000
heap
page read and write
368E000
stack
page read and write
191A39C5000
heap
page read and write
1B7E000
stack
page read and write
1F57000
heap
page read and write
2D638000
direct allocation
page read and write
252AFD20000
heap
page read and write
2D570000
direct allocation
page read and write
155000
unkown
page read and write
191A3B51000
heap
page read and write
2221A000
heap
page read and write
191A3C9C000
heap
page read and write
3E2E000
stack
page read and write
7FF848EAC000
trusted library allocation
page execute and read and write
191A3BC9000
heap
page read and write
20887133000
heap
page read and write
2D7B0000
direct allocation
page read and write
1B70000
heap
page read and write
4440000
remote allocation
page read and write
1BB4000
heap
page read and write
39720000
direct allocation
page read and write
660000
heap
page read and write
1D0A000
heap
page read and write
FE0000
heap
page read and write
26E2C000
direct allocation
page read and write
2088719D000
heap
page read and write
2D96C000
direct allocation
page read and write
191A3C51000
heap
page read and write
7FF6B7711000
unkown
page execute and read and write
7FF78D493000
unkown
page execute read
191A398C000
heap
page read and write
191A3997000
heap
page read and write
2D928000
direct allocation
page read and write
191A3B84000
heap
page read and write
191A39CE000
heap
page read and write
12BE000
stack
page read and write
5008000
direct allocation
page read and write
252ADA40000
heap
page read and write
191A3BC6000
heap
page read and write
2D924000
direct allocation
page read and write
13CF000
heap
page read and write
34401000
direct allocation
page read and write
CF6000
unkown
page execute and read and write
1EA5CC38000
heap
page read and write
3630000
heap
page read and write
FEB000
heap
page read and write
2D944000
direct allocation
page read and write
191A3CD2000
heap
page read and write
1E10000
heap
page read and write
41B000
unkown
page readonly
4619000
heap
page read and write
37D0000
heap
page read and write
2D604000
direct allocation
page read and write
7FF6B75C2000
unkown
page execute and read and write
2088693C000
heap
page read and write
2088716E000
heap
page read and write
7FF4E9AD0000
trusted library allocation
page execute and read and write
7FF848FE2000
trusted library allocation
page read and write
3AAAC000
direct allocation
page read and write
191A39E8000
heap
page read and write
1B30000
heap
page read and write
20D0000
heap
page read and write
2088710E000
heap
page read and write
1FD0000
heap
page read and write
191A3C63000
heap
page read and write
252B259F000
heap
page read and write
FF5000
heap
page read and write
2088712E000
heap
page read and write
2D6F4000
direct allocation
page read and write
1BABF000
stack
page read and write
2D948000
direct allocation
page read and write
1311000
unkown
page readonly
7FF6B770B000
unkown
page execute and read and write
191A3B42000
heap
page read and write
9B000
stack
page read and write
11BE000
heap
page read and write
2D910000
direct allocation
page read and write
12AC000
unkown
page read and write
2D7B0000
direct allocation
page read and write
9C000
stack
page read and write
208868F3000
heap
page read and write
7FF7B4CC1000
unkown
page readonly
191A3C63000
heap
page read and write
191A3DAF000
heap
page read and write
FE9000
heap
page read and write
191A399C000
heap
page read and write
196000
stack
page read and write
2088710E000
heap
page read and write
41B000
unkown
page readonly
1EA5CCA3000
heap
page read and write
20887680000
remote allocation
page read and write
2D7B8000
direct allocation
page read and write
4A07000
heap
page read and write
403E000
stack
page read and write
20887130000
heap
page read and write
191A3CF1000
heap
page read and write
7FF7B4EB7000
unkown
page execute and read and write
2D7B0000
direct allocation
page read and write
191A39D1000
heap
page read and write
1B87E000
stack
page read and write
191A3BCC000
heap
page read and write
1EA5000
heap
page read and write
1EA5CC4F000
heap
page read and write
1B50000
heap
page read and write
2D6F4000
direct allocation
page read and write
13E9000
heap
page read and write
1C050000
heap
page read and write
2088693C000
heap
page read and write
3F2D000
stack
page read and write
3978C000
direct allocation
page read and write
3AA8C000
direct allocation
page read and write
191A3B74000
heap
page read and write
2222A000
heap
page read and write
20887176000
heap
page read and write
3AA40000
direct allocation
page read and write
271B3441000
heap
page read and write
2D710000
direct allocation
page read and write
400000
unkown
page readonly
2D5F0000
direct allocation
page read and write
2117C4B0000
heap
page read and write
208878D1000
heap
page read and write
191A3B4F000
heap
page read and write
3E8E000
stack
page read and write
22230000
heap
page read and write
4800000
direct allocation
page read and write
191A3998000
heap
page read and write
7FF71F8C0000
unkown
page readonly
191A4AF0000
heap
page read and write
2D594000
direct allocation
page read and write
FD1000
heap
page read and write
20B0000
heap
page read and write
7FF7B4EBD000
unkown
page execute and read and write
14FE000
stack
page read and write
2D7B0000
direct allocation
page read and write
41B000
unkown
page readonly
2117ABE0000
heap
page read and write
41B000
unkown
page readonly
20887153000
heap
page read and write
1A09000
unkown
page read and write
20887169000
heap
page read and write
39790000
direct allocation
page read and write
191A39CE000
heap
page read and write
FEB000
heap
page read and write
1FB0000
heap
page read and write
2D538000
direct allocation
page read and write
397D4000
direct allocation
page read and write
2088712C000
heap
page read and write
39798000
direct allocation
page read and write
22226000
heap
page read and write
39700000
direct allocation
page read and write
2D63C000
direct allocation
page read and write
271B3413000
heap
page read and write
191A3B71000
heap
page read and write
191A38F0000
trusted library allocation
page read and write
191A3CF1000
heap
page read and write
191A3B84000
heap
page read and write
2FA70000
direct allocation
page read and write
136C000
stack
page read and write
2034000
heap
page read and write
2088713B000
heap
page read and write
191A3D63000
heap
page read and write
2088693A000
heap
page read and write
208868D9000
heap
page read and write
416F000
stack
page read and write
11B0000
heap
page read and write
42C000
unkown
page write copy
4500000
remote allocation
page read and write
7FF848FA0000
trusted library allocation
page read and write
2D804000
direct allocation
page read and write
915000
unkown
page write copy
2FA5C000
direct allocation
page read and write
7FF880030000
direct allocation
page execute and read and write
191A3B9C000
heap
page read and write
191A3B7C000
heap
page read and write
1B10000
heap
page read and write
2088719E000
heap
page read and write
4690000
heap
page read and write
2088719E000
heap
page read and write
1EA5CCA8000
heap
page read and write
3983C000
direct allocation
page read and write
191A3BE7000
heap
page read and write
3AA38000
direct allocation
page read and write
252B14D7000
heap
page read and write
191A5105000
heap
page read and write
42C000
unkown
page write copy
2FA90000
direct allocation
page read and write
CA1000
unkown
page execute read
11B0000
heap
page read and write
2D6F4000
direct allocation
page read and write
191A3B92000
heap
page read and write
20E7000
heap
page read and write
2088710E000
heap
page read and write
AA519FE000
stack
page read and write
AA518FE000
stack
page read and write
4694000
heap
page read and write
191A3998000
heap
page read and write
1018000
heap
page read and write
41B000
unkown
page readonly
2D998000
direct allocation
page read and write
20589BC0000
heap
page read and write
191A3CCA000
heap
page read and write
191A3C86000
heap
page read and write
3AAB8000
direct allocation
page read and write
2D6F4000
direct allocation
page read and write
3610000
heap
page read and write
11A9000
heap
page read and write
191A4462000
heap
page read and write
22222000
heap
page read and write
20887132000
heap
page read and write
191A3BC6000
heap
page read and write
2117C3C0000
direct allocation
page read and write
FEC000
heap
page read and write
66B000
heap
page read and write
191A3B5B000
heap
page read and write
2D538000
direct allocation
page read and write
20887904000
heap
page read and write
20887183000
heap
page read and write
20887153000
heap
page read and write
2088694D000
heap
page read and write
1C061000
heap
page read and write
B41000
unkown
page execute read
252B1A6C000
unkown
page read and write
252AFEC7000
heap
page read and write
43E000
unkown
page execute and read and write
2088715B000
heap
page read and write
316F000
stack
page read and write
FE6000
heap
page read and write
20588180000
heap
page read and write
3850000
heap
page read and write
191A3C57000
heap
page read and write
1B30000
heap
page read and write
22230000
heap
page read and write
191A3D62000
heap
page read and write
2088712E000
heap
page read and write
20887133000
heap
page read and write
39820000
direct allocation
page read and write
191A39D8000
heap
page read and write
191A3995000
heap
page read and write
43B0000
remote allocation
page read and write
4770000
direct allocation
page read and write
41B000
unkown
page readonly
1028000
unkown
page execute read
191A3B78000
heap
page read and write
2D690000
direct allocation
page read and write
2088712E000
heap
page read and write
252B14C0000
heap
page read and write
1014000
heap
page read and write
191A50DB000
heap
page read and write
252B3E01000
trusted library allocation
page read and write
1D1D000
heap
page read and write
1EA5CC4F000
heap
page read and write
191A3C9C000
heap
page read and write
1EFE000
heap
page read and write
11A6000
heap
page read and write
7FF7B4EB9000
unkown
page execute and read and write
252ADB01000
heap
page read and write
191A3BE6000
heap
page read and write
7FF7B4E5E000
unkown
page execute and read and write
191A39BC000
heap
page read and write
427F000
stack
page read and write
2222F000
heap
page read and write
2D90C000
direct allocation
page read and write
191A39BA000
heap
page read and write
401000
unkown
page execute read
191A3C6F000
heap
page read and write
3750000
direct allocation
page read and write
2D534000
direct allocation
page read and write
22230000
heap
page read and write
20589AF0000
direct allocation
page read and write
191A3CA0000
heap
page read and write
2117AAEC000
heap
page read and write
191A39C5000
heap
page read and write
191A3BE6000
heap
page read and write
191A39D8000
heap
page read and write
191A3B9F000
heap
page read and write
39638000
direct allocation
page read and write
22230000
heap
page read and write
1CC8000
heap
page read and write
423000
unkown
page read and write
3AA01000
direct allocation
page read and write
191A45EF000
heap
page read and write
397C8000
direct allocation
page read and write
1BCA7ECB000
heap
page read and write
13F5000
heap
page read and write
2224C000
heap
page read and write
191A4E0D000
heap
page read and write
191A39C0000
heap
page read and write
191A3CC0000
heap
page read and write
191A40F4000
heap
page read and write
20887187000
heap
page read and write
CA0000
unkown
page readonly
271B3402000
heap
page read and write
2117AAE9000
heap
page read and write
8C1000
unkown
page execute read
3AA4C000
direct allocation
page read and write
FE7000
heap
page read and write
20B7000
heap
page read and write
4407000
heap
page read and write
1BCA7E40000
heap
page read and write
2D9A0000
direct allocation
page read and write
2D8FC000
direct allocation
page read and write
39A1000
heap
page read and write
3977C000
direct allocation
page read and write
2D704000
direct allocation
page read and write
22236000
heap
page read and write
39738000
direct allocation
page read and write
8C0000
unkown
page readonly
1ED7000
heap
page read and write
3AAC0000
direct allocation
page read and write
7FF7B4CC2000
unkown
page execute and read and write
20589AF0000
direct allocation
page read and write
2FAA4000
direct allocation
page read and write
1A2E000
unkown
page readonly
123B000
unkown
page execute read
7F0000
unkown
page readonly
7FF848FB0000
trusted library allocation
page read and write
CFA000
unkown
page readonly
252AF899000
direct allocation
page read and write
191A3C6F000
heap
page read and write
20887842000
heap
page read and write
271B3400000
heap
page read and write
1BBE000
stack
page read and write
191A39CE000
heap
page read and write
39804000
direct allocation
page read and write
1FA0000
trusted library allocation
page read and write
191A39C0000
heap
page read and write
252ADA85000
heap
page read and write
20887130000
heap
page read and write
397E000
stack
page read and write
1C160000
trusted library allocation
page read and write
191A3B42000
heap
page read and write
192000
stack
page read and write
191A3B84000
heap
page read and write
FE9000
heap
page read and write
191A3B7C000
heap
page read and write
2031000
heap
page read and write
FD3000
heap
page read and write
91A000
unkown
page readonly
2088715B000
heap
page read and write
39720000
direct allocation
page read and write
191A3E6C000
heap
page read and write
191A399C000
heap
page read and write
191A399E000
heap
page read and write
191A3B51000
heap
page read and write
2E5C0000
heap
page read and write
1BDE000
stack
page read and write
397AC000
direct allocation
page read and write
12B2000
unkown
page read and write
426000
unkown
page write copy
191A3C6F000
heap
page read and write
AA513FE000
stack
page read and write
252B17CE000
unkown
page read and write
1EA5CC4F000
heap
page read and write
191A3BE6000
heap
page read and write
7FF78CD70000
unkown
page readonly
20887181000
heap
page read and write
191A399C000
heap
page read and write
1C4E000
heap
page read and write
191A3D63000
heap
page read and write
2088715A000
heap
page read and write
196000
stack
page read and write
2D9A8000
direct allocation
page read and write
191A3C10000
heap
page read and write
2D968000
direct allocation
page read and write
9C000
stack
page read and write
36DF000
stack
page read and write
381F000
stack
page read and write
191A3B4E000
heap
page read and write
3930000
direct allocation
page read and write
2088712D000
heap
page read and write
FE9000
heap
page read and write
2088693C000
heap
page read and write
4A8E4000
direct allocation
page read and write
20887129000
heap
page read and write
20887130000
heap
page read and write
191A4BF4000
heap
page read and write
191A3BFE000
heap
page read and write
191A3C67000
heap
page read and write
2FA01000
direct allocation
page read and write
191A39C5000
heap
page read and write
13C1000
heap
page read and write
3870000
remote allocation
page read and write
2FA24000
direct allocation
page read and write
401000
unkown
page execute read
1EA5D202000
heap
page read and write
126A000
unkown
page read and write
115F000
heap
page read and write
B6FCB7E000
unkown
page readonly
1AC0000
heap
page read and write
191A3BE7000
heap
page read and write
7FF848E14000
trusted library allocation
page read and write
1ED9000
heap
page read and write
208868F3000
heap
page read and write
191A3B9E000
heap
page read and write
191A39D1000
heap
page read and write
191A3C7D000
heap
page read and write
191A3B5E000
heap
page read and write
AA51FFE000
stack
page read and write
1B97F000
stack
page read and write
7FF7B55F0000
unkown
page readonly
191A1B40000
remote allocation
page read and write
191A3BC9000
heap
page read and write
1BCC1AA8000
heap
page read and write
20887133000
heap
page read and write
FE6000
heap
page read and write
39754000
direct allocation
page read and write
FE0000
heap
page read and write
2088693A000
heap
page read and write
191A39D1000
heap
page read and write
191A1B00000
direct allocation
page read and write
22226000
heap
page read and write
191A3B9E000
heap
page read and write
191A1BB9000
heap
page read and write
3AA38000
direct allocation
page read and write
5075000
direct allocation
page read and write
13CB000
heap
page read and write
38BF000
stack
page read and write
1014000
heap
page read and write
1BCC1750000
trusted library allocation
page read and write
20887140000
heap
page read and write
7FF6B7717000
unkown
page execute and read and write
208868E6000
heap
page read and write
2117C3C0000
direct allocation
page read and write
34414000
direct allocation
page read and write
20887130000
heap
page read and write
1EE2000
heap
page read and write
400000
unkown
page readonly
2088696E000
heap
page read and write
8C1000
unkown
page execute read
2D960000
direct allocation
page read and write
43F0000
heap
page read and write
20887152000
heap
page read and write
20887153000
heap
page read and write
2D70C000
direct allocation
page read and write
B6FCD7E000
unkown
page readonly
191A3E16000
heap
page read and write
2088693C000
heap
page read and write
7FF7B4EC3000
unkown
page execute and read and write
1418000
heap
page read and write
2D680000
direct allocation
page read and write
2D918000
direct allocation
page read and write
119E000
heap
page read and write
38A2000
heap
page read and write
2088717E000
heap
page read and write
191A3995000
heap
page read and write
191A39C9000
heap
page read and write
2FA54000
direct allocation
page read and write
2088715B000
heap
page read and write
191A39C5000
heap
page read and write
191A457E000
heap
page read and write
1BCA97D8000
trusted library allocation
page read and write
191A3B84000
heap
page read and write
3445C000
direct allocation
page read and write
2F1E000
stack
page read and write
396B8000
direct allocation
page read and write
191A3CF1000
heap
page read and write
2D934000
direct allocation
page read and write
2223B000
heap
page read and write
177000
unkown
page readonly
1416000
heap
page read and write
1CDD000
heap
page read and write
22216000
heap
page read and write
2E10000
heap
page read and write
39850000
direct allocation
page read and write
7FF6B7557000
unkown
page execute and read and write
7FF71FFE3000
unkown
page execute read
1C0A000
heap
page read and write
1018000
heap
page read and write
191A39CB000
heap
page read and write
102F000
heap
page read and write
191A3C51000
heap
page read and write
11B4000
heap
page read and write
1014000
heap
page read and write
191A3999000
heap
page read and write
AEA6FFE000
unkown
page readonly
13F9000
heap
page read and write
1C98000
heap
page read and write
2117AAE0000
heap
page read and write
1BD4E000
stack
page read and write
ACD000
unkown
page execute and read and write
191A39CB000
heap
page read and write
2090000
heap
page read and write
5F0000
heap
page read and write
185000
unkown
page write copy
35A0000
direct allocation
page execute and read and write
191A39CF000
heap
page read and write
7FF71FFE3000
unkown
page execute read
191A39D1000
heap
page read and write
3AA60000
direct allocation
page read and write
1ED0000
heap
page read and write
2117C3C0000
direct allocation
page read and write
7FF848E10000
trusted library allocation
page read and write
191A3BE6000
heap
page read and write
AEA6F7E000
stack
page read and write
520000
heap
page read and write
FF4000
heap
page read and write
1C3E0221000
heap
page read and write
1BCC2050000
heap
page execute and read and write
2C62C000
direct allocation
page read and write
3616000
heap
page read and write
1320000
heap
page read and write
2223E000
heap
page read and write
1E6A000
heap
page read and write
20887133000
heap
page read and write
3878000
heap
page read and write
208878B9000
heap
page read and write
43BF000
stack
page read and write
205881A0000
heap
page read and write
39720000
direct allocation
page read and write
191A39CF000
heap
page read and write
426000
unkown
page write copy
1271000
unkown
page read and write
191A3BCC000
heap
page read and write
2D7B0000
direct allocation
page read and write
2FA40000
direct allocation
page read and write
20887680000
remote allocation
page read and write
191A3BC9000
heap
page read and write
191A3CF1000
heap
page read and write
191A54F8000
heap
page read and write
C7A000
unkown
page execute and read and write
2D700000
direct allocation
page read and write
191A3B6A000
heap
page read and write
1EC2000
heap
page read and write
36BB000
heap
page read and write
2030000
heap
page read and write
39D0000
heap
page read and write
191A3B7C000
heap
page read and write
427000
unkown
page readonly
2D594000
direct allocation
page read and write
191A3B55000
heap
page read and write
2088710E000
heap
page read and write
1C3E000
stack
page read and write
191A39BC000
heap
page read and write
191A3B74000
heap
page read and write
20887914000
heap
page read and write
191A3C51000
heap
page read and write
500000
heap
page read and write
22223000
heap
page read and write
4653000
heap
page read and write
1B75000
heap
page read and write
22173000
heap
page read and write
191A3B89000
heap
page read and write
1DEE000
unkown
page readonly
1EFE000
heap
page read and write
837000
unkown
page readonly
2D4C0000
direct allocation
page read and write
2224C000
heap
page read and write
2223B000
heap
page read and write
2063000
heap
page read and write
7FF848ED6000
trusted library allocation
page execute and read and write
1C3E0950000
remote allocation
page read and write
1EE2000
heap
page read and write
1D87000
heap
page read and write
2222C000
heap
page read and write
2080000
trusted library allocation
page read and write
191A3BCC000
heap
page read and write
191A3C96000
heap
page read and write
2D7B0000
direct allocation
page read and write
191A3C67000
heap
page read and write
2088712B000
heap
page read and write
20887189000
heap
page read and write
7FF848F90000
trusted library allocation
page read and write
1C27000
heap
page read and write
7FF848FAA000
trusted library allocation
page read and write
7FF7B4EBB000
unkown
page execute and read and write
191A4DAB000
heap
page read and write
B6FCE7E000
stack
page read and write
191A4117000
heap
page read and write
39820000
direct allocation
page read and write
271B3422000
heap
page read and write
493E000
heap
page read and write
39B0000
direct allocation
page read and write
3AB00000
direct allocation
page read and write
3878000
heap
page read and write
191A1B00000
direct allocation
page read and write
191A420C000
heap
page read and write
39738000
direct allocation
page read and write
2D94C000
direct allocation
page read and write
1F1F000
heap
page read and write
1A2D000
unkown
page read and write
39758000
direct allocation
page read and write
2088689B000
heap
page read and write
191A40F7000
heap
page read and write
191A4FD5000
heap
page read and write
191A3BC6000
heap
page read and write
1F1F000
heap
page read and write
43C0A000
direct allocation
page read and write
7FF848EA0000
trusted library allocation
page read and write
191A3BE7000
heap
page read and write
3446C000
direct allocation
page read and write
20887127000
heap
page read and write
2D7C0000
direct allocation
page read and write
2088783C000
heap
page read and write
347D0000
heap
page read and write
344A0000
direct allocation
page read and write
400000
unkown
page readonly
20589AF0000
direct allocation
page read and write
CA1000
unkown
page execute read
1B45000
heap
page read and write
20887175000
heap
page read and write
252B19BD000
heap
page read and write
140E000
heap
page read and write
20887110000
heap
page read and write
20588120000
heap
page read and write
20887904000
heap
page read and write
34440000
direct allocation
page read and write
4CB0000
direct allocation
page read and write
1C21000
heap
page read and write
7FF6B7E40000
unkown
page readonly
570000
heap
page read and write
1ECC000
heap
page read and write
39758000
direct allocation
page read and write
131000
unkown
page execute read
1C1C000
heap
page read and write
252AF834000
direct allocation
page read and write
1297000
unkown
page read and write
191A3B4D000
heap
page read and write
3820000
heap
page read and write
20887110000
heap
page read and write
15C0000
heap
page read and write
FD9000
heap
page read and write
1248000
unkown
page read and write
20887152000
heap
page read and write
2D590000
direct allocation
page read and write
12AE000
unkown
page read and write
252AF5B0000
direct allocation
page execute and read and write
20887914000
heap
page read and write
191A3B9D000
heap
page read and write
191A3976000
heap
page read and write
191A3C9C000
heap
page read and write
191A3E20000
heap
page read and write
191A3B92000
heap
page read and write
12AA000
unkown
page read and write
7FF7B4D72000
unkown
page execute and read and write
252AF578000
direct allocation
page read and write
4A918000
direct allocation
page read and write
20887153000
heap
page read and write
2D8E4000
direct allocation
page read and write
9C000
stack
page read and write
2D438000
direct allocation
page read and write
2088712E000
heap
page read and write
39754000
direct allocation
page read and write
1DEE000
unkown
page readonly
252AF83A000
direct allocation
page read and write
140E000
heap
page read and write
FF5000
heap
page read and write
39704000
direct allocation
page read and write
1BCA7C30000
heap
page read and write
147000
unkown
page readonly
191A3CA0000
heap
page read and write
20887156000
heap
page read and write
2F87000
heap
page read and write
FF2000
heap
page read and write
2D984000
direct allocation
page read and write
252AF866000
direct allocation
page read and write
FE0000
heap
page read and write
191A39C5000
heap
page read and write
2088715B000
heap
page read and write
2D8EC000
direct allocation
page read and write
2D538000
direct allocation
page read and write
3447C000
direct allocation
page read and write
There are 2258 hidden memdumps, click here to show them.