IOC Report
VZH3bd37Gc

loading gif

Files

File Path
Type
Category
Malicious
VZH3bd37Gc.msi
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: VMware Workspace ONE Assist, Author: VMware, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install Workspace ONE Assist Installer., Template: x64;1033, Revision Number: {FD0CDE91-FD76-4738-8B40-800BA9713AFC}, Create Time/Date: Wed Mar 27 21:55:34 2024, Last Saved Time/Date: Wed Mar 27 21:55:34 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
initial sample
C:\Windows\Installer\MSI50A5.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows, InstallShield self-extracting archive
dropped
 malicious
C:\Config.Msi\58426c.rbs
data
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Application.Agent.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Application.Communication.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Application.Localization.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Auth.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Channels.AnchorChannel.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Configuration.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Core.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Device.Sys.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Device.Tools.FileManager.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Device.Tools.RemoteControl.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Device.Tools.RemoteShell.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Device.Tools.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Device.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Diagnostics.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.MSIX.Launcher.exe
PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.MSIX.Launcher.exe.config
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Net.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Security.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Serialization.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Tools.FileManager.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Tools.RemoteControl.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Tools.RemoteShell.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Tools.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Utils.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.WPF.CustomControls.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Windows.Net.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.Windows.Utils.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\Microsoft.Bcl.AsyncInterfaces.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\Microsoft.Win32.Primitives.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\Microsoft.Win32.Registry.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\Microsoft.Win32.SystemEvents.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\Newtonsoft.Json.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\Resources\Appx\AUMIDs.txt
ASCII text, with CRLF line terminators
dropped
C:\Program Files\VMware\Workspace ONE Assist\Resources\Appx\MPAP_f7529f1a891c4c29afa0bf940c4958e4_001.provxml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Program Files\VMware\Workspace ONE Assist\Resources\Appx\f7529f1a891c4c29afa0bf940c4958e4.appxbundle
Zip archive data, at least v4.5 to extract, compression method=store
dropped
C:\Program Files\VMware\Workspace ONE Assist\Resources\Appx\f7529f1a891c4c29afa0bf940c4958e4_License1.xml
ASCII text, with very long lines (2693), with no line terminators
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.AppContext.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Buffers.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.CodeDom.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Collections.Concurrent.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Collections.NonGeneric.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Collections.Specialized.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Collections.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.ComponentModel.EventBasedAsync.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.ComponentModel.Primitives.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.ComponentModel.TypeConverter.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.ComponentModel.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Console.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Data.Common.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.Contracts.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.Debug.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.EventLog.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.FileVersionInfo.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.PerformanceCounter.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.Process.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.StackTrace.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.TextWriterTraceListener.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.Tools.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.TraceSource.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Diagnostics.Tracing.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Drawing.Primitives.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Dynamic.Runtime.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Globalization.Calendars.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Globalization.Extensions.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Globalization.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.Compression.ZipFile.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.Compression.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.FileSystem.AccessControl.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.FileSystem.DriveInfo.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.FileSystem.Primitives.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.FileSystem.Watcher.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.FileSystem.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.IsolatedStorage.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.MemoryMappedFiles.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.Pipes.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.UnmanagedMemoryStream.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.IO.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Linq.Expressions.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Linq.Parallel.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Linq.Queryable.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Linq.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Memory.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.Http.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.NameResolution.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.NetworkInformation.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.Ping.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.Primitives.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.Requests.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.Security.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.Sockets.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.WebHeaderCollection.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.WebSockets.Client.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Net.WebSockets.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Numerics.Vectors.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.ObjectModel.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Reflection.Extensions.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Reflection.Primitives.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Reflection.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Resources.Reader.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Resources.ResourceManager.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Resources.Writer.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.CompilerServices.Unsafe.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.CompilerServices.VisualC.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.Extensions.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.Handles.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.InteropServices.RuntimeInformation.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.InteropServices.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.Numerics.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.Serialization.Formatters.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.Serialization.Json.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.Serialization.Primitives.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.Serialization.Xml.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Runtime.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.AccessControl.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.Claims.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.Cryptography.Algorithms.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.Cryptography.Csp.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.Cryptography.Encoding.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.Cryptography.Primitives.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.Cryptography.ProtectedData.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.Cryptography.X509Certificates.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.Permissions.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.Principal.Windows.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.Principal.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Security.SecureString.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.ServiceProcess.ServiceController.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Text.Encoding.Extensions.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Text.Encoding.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Text.Encodings.Web.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Text.Json.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Text.RegularExpressions.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Threading.Overlapped.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Threading.Tasks.Extensions.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Threading.Tasks.Parallel.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Threading.Tasks.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Threading.Thread.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Threading.ThreadPool.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Threading.Timer.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Threading.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.ValueTuple.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Xml.ReaderWriter.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Xml.XDocument.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Xml.XPath.XDocument.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Xml.XPath.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Xml.XmlDocument.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\System.Xml.XmlSerializer.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\WorkspaceONE.Assist.Agent.exe
PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\WorkspaceONE.Assist.Agent.exe.config
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Program Files\VMware\Workspace ONE Assist\WorkspaceONE.Assist.Cleanup.exe
PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\WorkspaceONE.Assist.Client.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\WorkspaceONE.Assist.Client.exe.config
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Program Files\VMware\Workspace ONE Assist\WorkspaceONE.Assist.Service.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\WorkspaceONE.Assist.Service.exe.config
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Program Files\VMware\Workspace ONE Assist\msvcp140.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\native\lib\linux\arm\lib_remote_shell_api.so
ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, BuildID[sha1]=db03b84a1b67d183b44f55e9194d7a7b2b7bed1f, not stripped
dropped
C:\Program Files\VMware\Workspace ONE Assist\native\lib\linux\x64\lib_remote_shell_api.so
ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=3f1a63a925512b784b7ce7e5ee0b8b07f26fabd6, not stripped
dropped
C:\Program Files\VMware\Workspace ONE Assist\native\lib\osx\RemoteLib
Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>] [arm64:Mach-O 64-bit arm64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>]
dropped
C:\Program Files\VMware\Workspace ONE Assist\native\lib\osx\x64\lib_remote_shell_api.dylib
Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|NO_REEXPORTED_DYLIBS>
dropped
C:\Program Files\VMware\Workspace ONE Assist\native\lib\osx\x64\libvpx.dylib
Mach-O 64-bit x86_64 dynamically linked shared library, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|NO_REEXPORTED_DYLIBS>
dropped
C:\Program Files\VMware\Workspace ONE Assist\native\lib\windows\DesktopDuplication.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\native\lib\windows\x64\libvpx.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\netstandard.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\vcruntime140.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\vcruntime140_1.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\winpty-agent.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\winpty-debugserver.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\winpty.NET.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\VMware\Workspace ONE Assist\winpty.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Workspace ONE Assist\Workspace ONE Assist Installer.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Mar 27 14:55:22 2024, mtime=Thu Apr 25 11:16:28 2024, atime=Wed Mar 27 14:55:22 2024, length=1603328, window=hide
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AetherPal.MSIX.Launcher.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\MSI82a9f.LOG
Unicode text, UTF-16, little-endian text, with no line terminators
dropped
C:\Windows\Installer\58426b.msi
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: VMware Workspace ONE Assist, Author: VMware, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install Workspace ONE Assist Installer., Template: x64;1033, Revision Number: {FD0CDE91-FD76-4738-8B40-800BA9713AFC}, Create Time/Date: Wed Mar 27 21:55:34 2024, Last Saved Time/Date: Wed Mar 27 21:55:34 2024, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
dropped
C:\Windows\Installer\MSI4559.tmp
data
dropped
C:\Windows\Installer\MSI50A5.tmp-\AetherPal.Diagnostics.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\Installer\MSI50A5.tmp-\AetherPal.Utils.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\Installer\MSI50A5.tmp-\AetherPal.Windows.Utils.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\Installer\MSI50A5.tmp-\AetherPal.Windows.Wix.CustomAction.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\Installer\MSI50A5.tmp-\CustomAction.config
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\Installer\MSI50A5.tmp-\Microsoft.Deployment.WindowsInstaller.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\Installer\MSI50A5.tmp-\netstandard.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Windows\Installer\SourceHash{2687F608-EC00-4F9A-B6B3-0194BAD168BB}
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Installer\inprogressinstallinfo.ipi
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Installer\{2687F608-EC00-4F9A-B6B3-0194BAD168BB}\icon.ico
MS Windows icon resource - 4 icons, 32x32, 32 bits/pixel, 48x48, 32 bits/pixel
dropped
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
C:\Windows\Temp\~DF82FB998DE190F64E.TMP
data
dropped
C:\Windows\Temp\~DF8B8E1871E2B38FFA.TMP
data
modified
C:\Windows\Temp\~DFC09A62DCD631DBC5.TMP
data
dropped
C:\Windows\Temp\~DFD0628E8D15ABD764.TMP
Composite Document File V2 Document, Cannot read section info
dropped
There are 182 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI50A5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5787937 2 AetherPal.Windows.Wix.CustomAction!AetherPal.Windows.Wix.CustomAction.CustomActions.InstallModernApp
 malicious
C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\VZH3bd37Gc.msi"
C:\Windows\System32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\System32\msiexec.exe
C:\Windows\System32\MsiExec.exe -Embedding 08351F78698DA0C0368A0A0187380C10 E Global\MSI0000
C:\Program Files\VMware\Workspace ONE Assist\AetherPal.MSIX.Launcher.exe
"C:\Program Files\VMware\Workspace ONE Assist\AetherPal.MSIX.Launcher.exe" "install" "C:\Program Files\VMware\Workspace ONE Assist\Resources"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://victoryonemedia.comhttps://github.com/chrismsimpson/MetropolisMetropolisSemi
unknown
https://github.com/chrismsimpsonhttps://github.com/chrismsimpson/MetropolisMetropolisLight
unknown
https://github.com/dotnet/runtime8
unknown
http://victoryonemedia.comhttps://github.com/chrismsimpson/MetropolisCopyright
unknown
http://aetherpal.com/deviceghttp://aetherpal.com/XMLSchema/device/TimerPolicy10
unknown
https://github.com/dotnet/roslyn/issues/46646~
unknown
https://github.com/chrismsimpsonhttps://github.com/chrismsimpson/MetropolisCopyright
unknown
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
unknown
https://www.vmware.com/help/privacy.html.
unknown
https://github.com/dotnet/runtime/issues/73124.
unknown
https://www.vmware.com/tw/help/privacy.html
unknown
http://wixtoolset.org/news/
unknown
https://www.vmware.com/help/privacy.html
unknown
http://victoryonemedia.comhttps://github.com/chrismsimpson/MetropolisMetropolisLight
unknown
https://github.com/dotnet/core/)
unknown
https://www.att.com
unknown
https://github.com/dotnet/runtime
unknown
https://github.com/dotnet/roslyn/issues/46646
unknown
https://www.vmware.com/es/help/privacy.html
unknown
http://wixtoolset.org/releases/
unknown
https://github.com/chrismsimpsonhttps://github.com/chrismsimpson/Metropolis
unknown
https://aka.ms/dotnet-warnings/
unknown
http://aetherpal.com/XMLSchema/device/DeviceInfo10
unknown
http://wixtoolset.org
unknown
http://aetherpal.com/XMLSchema/device/SecurityPolicy10
unknown
https://github.com/dotnet/runtime&
unknown
https://aka.ms/serializationformat-binary-obsolete
unknown
https://www.gnu.org/licenses
unknown
https://aka.ms/binaryformatter
unknown
http://victoryonemedia.comhttps://github.com/chrismsimpson/MetropolisMetropolisMedium
unknown
http://aetherpal.com/XMLSchema/device/UserInterfacePolicy10
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://victoryonemedia.comhttps://github.com/chrismsimpson/Metropolis
unknown
http://victoryonemedia.comhttps://github.com/chrismsimpson/MetropolisMetropolisExtra
unknown
There are 24 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Owner
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
SessionHash
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Sequence
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Config.Msi\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\58426c.rbs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\58426c.rbsLow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47458FC39F392E34E8F5BD1109AD6E00
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CC4C415F5F7896F419FD991DC5D9C880
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9DFB010E010386948A923D3ACB52EC94
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E0E5BE02A7407F74093224A7117E5D90
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBC273361CEA1034DBFB5FDC575FF4FC
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9301E5B90522DB448BF9874196910C57
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6202AB44FD1E22446838C83D86EB613E
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4831BF97D9534C74087E30FED4282BB9
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5436783F174415A4C873013DDE26CB90
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\35CECF2F808B82B459CC9E1D2C59667D
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B34E2087C0DDDC34880582E276B6B01A
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A17D3DC4019F58E40BB4FE879D4B0098
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\207FA7250F1D7414B93DFBD62D96A8B6
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\99D27F00D25CF4841BC2ABBFEA62F74D
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B2E0B2E97BEBE7D429E89D62979CA2F9
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E372D1374A344904BACC63273B5DB4F9
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\785297361ADE5264A99A2A51A1C40D9D
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77F2234515BEED4408AC050D3A74CDCC
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB7EF9573DE9D3549A1FB51F4E626943
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B60A485A499672F418488EAC5D674159
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A61691A9A4B3AD949A046870A07160F9
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7BB2E2DE84943194E85E478AF47B2830
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\95351EAB51C1B7C4BBF9357C22ADFA8C
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\967FC3993B148CC448BF6F4BFECB8A71
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B3D060E49527234BBBDFB832F0419EF
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\44249CA6775599844B517FDFEA4CE077
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C2268662DECCB0E4A9257EE01AA6CCCC
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D4E9C1226C9DAF240A3B94D2FA5B6BCD
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6D76744B89C3C634EA352AF1A01723B1
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3899C773B15CE4A459020F208EF1B968
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\881C6F2A3BBDE9946941C63388D66100
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BB0355FE352865B4E87C3E632A550A1F
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ADDA77E0CB4F788479C4147269DB9C21
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8BB65F935088CCD42B39004F9E07B897
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\04A195DB8145B7343AB2EFBDBC2A8FAC
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A82637F7915421644B9981C822AD02E7
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\10C2567B7E272824A9BBF175B71B6AEE
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E226BBB6AFC8AD74A98F4A34AAF7AFC9
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\967CB9909E3F4A345BFB5FD685D69FCF
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C8F3703A1A5AF2C45B1C6E4C0F3DD6B6
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\910489BC6F82DFD4E970881F9E8C1BC2
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\050B032DE2759DE408CB5A64B07DB332
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C611CD82C0652B4B961E91D7867DC29
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B4CF1366F07DDD4AA1A9CC3AC467CB3
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2314DBC86AB88A1439EB7152C0ECCF8D
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34CBBE281EFE98E4981A9112D88B1ABE
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\95D46C2D94E977D40A9BCB1C6506010B
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C5E4BA48AA558C4469EE233E4ADD6A22
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\366C3BC2DD413304C94744DBF9E6E3D4
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\470EAB0169F4CAF4E8FC462DAC17685C
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\36B72B4D83D6CC94BB57339343A58A2D
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6DC4B77770B0B9E40BE545DBF921477E
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C6F1EF7D3D8BD5B4D92363C99D4FEA1E
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9F4A9449EAE540943BBA2D9357298600
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FF8896259B2B3EE42892CD2CA67D0086
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF1EF6BF2FEA07D439C46AC7180B3C80
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\309675E9BB2534148AF0F545BA3C6F2C
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BE388C5A81EC7524D8844FCABC4FD663
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7FE0E360A6862C43A9DEE9B06E95D38
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1B17D0593E37FA8478305825FF48B235
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E293AD25286AFC47B0B76E81EB2CFCE
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6422AC027C873A643BB111805A4DD501
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8E3A80AB871D1BA4D81EDE21063F44E4
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\01FA8A7DB79522048BB6B56E4650E369
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45F93A9D0CEB8234B879058A57BA3600
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A23C9AAA5FC744442972FAFA2F5DDA4C
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCC3794792E86324FA44BA1CC9D958B8
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\886CF4B2702DD5B4C8AC13AEC019CCB9
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5935C5C35476F3A41BA6307893D0C8EE
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00B70D3C2F66FAF4CB03199AABFF25F0
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C2FDDA085FA7864DBA1E205B5B7CA9D
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2945C3307F6A8354AA0B809924B2FF20
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C63D405A5B10AE04BB3E07275873A5F1
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5CB6ED948BB5B724AA0F3EC944155D97
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\878BACA650C93014CB323B2E885CCFD4
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8D1D83AD3144830438962E5EE32A83D0
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B2A57EF2DB7D2DA40ABB05E43B7B951D
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A3684E30C9A431F4AB329EE9236E326F
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5E7B6B35E1A800D4B944444B21220E31
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EA719801A38D207498816ABDA82EDD89
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C5235B3310EE1F4C84D606EEA2D6841
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8EADEB966538B22418E42F7FE9C04F94
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C1CD7DE320BD41347BBAF6F9A196A9E4
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8764F4F79C90DDB4BA48AB7A29CB48D1
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C02C640FE3FD1B945BD0DDBB634B8795
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AAC89A2F612213144A9E28E2C9F0BC15
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F747B6A32136CA74DBE8912AB2FB89E8
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\79C64393321A2144AB535804F9ED13FA
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ED73F4F75C288EB4F9B1B1DE456AF8E4
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D1C8757A9AC3CC54B8E29EC8E254402D
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F5C3CF532C44A7144BD2D7A9A50C0FBE
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\025C2E92FDA2BF64185002D23F005803
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DAE5D73AD7181B546A160BCADFBEFAA3
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E8C486A560FF7554CA97EAED98538A7F
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C1C181427885B7408C36689BF551243
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E41A74106EF0F1459496B4545545072
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F37A7756DDBCEAB47A1414506F4A95E2
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CD7A3EAC489A6BE43858507A0F296CFB
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BA2CAD3FA4DBC5C4B9F2E41A3538B10D
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F8E0B3E1700F44D4886471FDA52A6BBF
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE7BE39D6FC2E21499D5FDEA0364AF24
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9600F4C8BA1BC0E4599C619950D55E95
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0AB1A95EB1B4F944285B7EF6F29FB639
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1713B98D27937E74EBBB6554AD1974E7
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD4470C9DA38FFB448201A22F4A8F247
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7759B309EA58FE046BE745A813D3EC26
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0AD9BF9B86693E54CB734D6A9EBFCCF5
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\99ABDC483BB73F04F997BB03480A26D4
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9B5F3E406EE81641AC74F2A76A947CD
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D594D69D75CABFE439EC5AF1175EDA1B
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2FE9363E9CEBA1A469BEF80CE2EE6A07
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A46F3F393F6042F42873D845CBE2B4B5
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BAC55CA2B2F60D44B8406A83B3A0A980
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B0A48A1C06FE82242BA01BDD3B66B13B
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94A342B9581C8C449BEB5379BE7312E2
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\43F78678471E81C4587D66B18404D97B
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50DACB4C05F775A44AD2FDA85535535B
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BA4B80A204C18604F9C78769E30C7A61
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F000BBED7D9BDE444B4FBBEB7DA2D6AF
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\74FDE2DD36FD9AD4FA1A93D26CEF0878
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CDC4999B01FD3F04A8D8BE9C27DB16FF
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE0864A8CE6645F40A66E56AE0A4880F
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C5AB3F33D33DB14E949DBB94A092972
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CC491C98F3481A5498E0E0C5E956CFCB
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FBBF342B0B13C94884ACE3780926339
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B3AA88B6CAEC7134895C9A4DD180F7C2
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC2837462F5BC684F84046C863BEB448
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1A015DF92182394F8C4709D8D0A8719
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\33D6C71CD3C7C5548B2AC77C88D6EA06
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C2D525D522932D4C931FA8B7EF06AB2
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6813E7757924BDA4388D4BE2711F7C76
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\80516DBE3D370864389D388AE1EAA438
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\22CFCF4D539B5F1458C0C5D84D96742F
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98298B55B67E05F46AB22D52279FA2E7
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB31B76F012045B41A34DC20B2D0B3C5
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34FD273E75498344EA46660FAE22DC1E
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\402192F9729756D4CADF3E63C7E37FDE
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02C56EB5BB7600240936D08345441C7E
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2326976E8FB60404AAE8CAC84C119125
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCCD66309A73E7D49829D6826FADB4F0
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\236FDFD6CD74BD64682A32AAC6B06465
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5868EB9770FD804FA5A970E830EB1D6
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0295AE6FBD171AA4DAC380DFF404208C
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\31B9FE587CEAFE447A2B05237807CA86
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF1CAD0DD228AE044889D48607FCF632
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D0CBAD98068AF3945B9F39F18E9EDDE1
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C10E5F292AD11A840A10C0FE817EB760
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6FE40E223183CA343934688ABD481A6B
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\18B100CA28B5B064CB9446D71906D36F
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DED81A437187F2144B586E51835700C8
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FB36A273BF2B424C80D0805558FAFD8
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0DC40ACB1974A2149A3D0C8EC5B346B0
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41ED2855DF30F9945ABEC16BB711E856
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5332F6BB8B7B767428A8B69F39D962D2
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02A571A5CDFE7634B97454C2643D4031
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EB4697668E734BF42B9C003F164EFE22
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\456CA4E823CBA7449B66E470C573BF69
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C266996352A00964FB35373E025ED4A2
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\263AD74D6890F3C4D92FBCBD4B898FFB
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A459E9A31641144D8B2BA3B7C4E6E14
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9EDC02BCF5B195A40B34A6249AB62737
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CFDBDCFEEFEB764CA2CD3BAC65FB2D2
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2CD0CA32F1EA1764FB63E6A8BDBD944A
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C79F3788B702DA478778455BED18928
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45E1257A4E63CEF4796EAC43ECFF9C42
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6D4C39A8BD69EDC47A1F8F1AC1555394
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\52C9BEF898D97ED4F9C823BFFDE73CF2
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEB9504285DA552439B4C608267C15AA
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F5009454FC252FD408FADA8433F54BE5
806F786200CEA9F46B3B1049AB1D86BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\native\lib\windows\x64\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\native\lib\windows\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\native\lib\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\native\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\Resources\Appx\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\Resources\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\native\lib\osx\x64\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\native\lib\osx\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\native\lib\linux\arm\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\native\lib\linux\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\VMware\Workspace ONE Assist\native\lib\linux\x64\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\Installer\{2687F608-EC00-4F9A-B6B3-0194BAD168BB}\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Workspace ONE Assist\
There are 180 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
13205190000
trusted library allocation
page read and write
7FFD9B4A0000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
229A68A0000
heap
page read and write
1320355A000
heap
page read and write
F7067FE000
stack
page read and write
229A6810000
unkown
page readonly
132035F8000
heap
page read and write
7FFD9B490000
trusted library allocation
page read and write
229A6B7E000
unkown
page readonly
13205190000
trusted library allocation
page read and write
7FFD9B540000
trusted library allocation
page read and write
13205380000
trusted library allocation
page read and write
7FFD9B476000
trusted library allocation
page execute and read and write
132035F3000
heap
page read and write
13203700000
heap
page read and write
7FFD9B2D0000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
13203870000
trusted library allocation
page read and write
132051F0000
trusted library allocation
page read and write
229A6D20000
heap
page read and write
7FFD9B3A6000
trusted library allocation
page execute and read and write
F7083F9000
stack
page read and write
13205190000
trusted library allocation
page read and write
132051E0000
heap
page read and write
13203605000
heap
page read and write
1321D720000
trusted library allocation
page read and write
F706BFE000
stack
page read and write
13203558000
heap
page read and write
13203545000
heap
page read and write
13203520000
heap
page read and write
13205190000
trusted library allocation
page read and write
132051D0000
trusted library allocation
page read and write
229A6AA0000
heap
page read and write
229B8653000
trusted library allocation
page read and write
7FFD9B480000
trusted library allocation
page read and write
7FFD9B376000
trusted library allocation
page read and write
132051D0000
trusted library allocation
page read and write
7FFD9B47C000
trusted library allocation
page read and write
229A6812000
unkown
page readonly
7FFD9B460000
trusted library allocation
page read and write
F7063FE000
stack
page read and write
229A69AA000
heap
page read and write
229A69EC000
heap
page read and write
229A8651000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
132035F8000
heap
page read and write
229A855E000
heap
page read and write
229A69EE000
heap
page read and write
F705FF2000
stack
page read and write
229A6B72000
unkown
page readonly
B23673000
stack
page read and write
1321D700000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
7DF45ACB0000
trusted library allocation
page execute and read and write
13205190000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
7FFD9B390000
trusted library allocation
page execute and read and write
132051C0000
trusted library allocation
page read and write
229A69F7000
heap
page read and write
7FFD9B510000
trusted library allocation
page read and write
13205390000
heap
page execute and read and write
229B8657000
trusted library allocation
page read and write
B2377E000
stack
page read and write
229A6A62000
heap
page read and write
1320355B000
heap
page read and write
229A8508000
heap
page read and write
132037C0000
heap
page read and write
7FFD9B2ED000
trusted library allocation
page execute and read and write
132051D0000
trusted library allocation
page read and write
132053B0000
heap
page execute and read and write
229A6A6D000
heap
page read and write
13205190000
trusted library allocation
page read and write
13203720000
heap
page read and write
132051C0000
trusted library allocation
page read and write
229A6B10000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
1320354E000
heap
page read and write
7FFD9B537000
trusted library allocation
page read and write
13205222000
heap
page read and write
7FFD9B2DD000
trusted library allocation
page execute and read and write
7FFD9B480000
trusted library allocation
page read and write
229A69F4000
heap
page read and write
7FFD9B463000
trusted library allocation
page read and write
7FFD9B4E6000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
7FFD9B38C000
trusted library allocation
page execute and read and write
13203595000
heap
page read and write
229A6AC0000
heap
page read and write
7DF45ACC0000
trusted library allocation
page execute and read and write
7FFD9B4A0000
trusted library allocation
page execute and read and write
13205190000
trusted library allocation
page read and write
229A69B5000
heap
page read and write
132051B0000
trusted library allocation
page read and write
7FFD9B2D4000
trusted library allocation
page read and write
7FFD9B2D3000
trusted library allocation
page execute and read and write
132051F0000
trusted library allocation
page read and write
132053C1000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
7FFD9B4B4000
trusted library allocation
page read and write
7FFD9B550000
trusted library allocation
page read and write
13205200000
trusted library allocation
page read and write
13205191000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
1320520D000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
132053A0000
trusted library allocation
page read and write
7FFD9B2C2000
trusted library allocation
page read and write
1320359D000
heap
page read and write
13203552000
heap
page read and write
132051A0000
trusted library allocation
page read and write
229A8500000
heap
page read and write
13205190000
trusted library allocation
page read and write
132035EF000
heap
page read and write
13205190000
trusted library allocation
page read and write
229A6B70000
unkown
page readonly
132051F0000
trusted library allocation
page read and write
229A8640000
heap
page read and write
7FFD9B53A000
trusted library allocation
page read and write
229A6BA6000
unkown
page readonly
13203885000
heap
page read and write
13203873000
trusted library allocation
page read and write
229C0FF0000
heap
page execute and read and write
13203800000
trusted library allocation
page read and write
229A852A000
heap
page read and write
13203820000
heap
page read and write
7FFD9B2F0000
trusted library allocation
page read and write
229A6BA2000
unkown
page readonly
7FFD9B3B6000
trusted library allocation
page execute and read and write
229A8523000
heap
page read and write
7FFD9B380000
trusted library allocation
page execute and read and write
F707FFE000
stack
page read and write
7FFD9B2FD000
trusted library allocation
page execute and read and write
7FFD9B487000
trusted library allocation
page read and write
13203544000
heap
page read and write
13205190000
trusted library allocation
page read and write
13205210000
heap
page read and write
13205225000
heap
page read and write
132035EF000
heap
page read and write
13205422000
heap
page read and write
1321D710000
trusted library allocation
page read and write
132051D0000
trusted library allocation
page read and write
7FFD9B380000
trusted library allocation
page read and write
F7077FE000
stack
page read and write
13205190000
trusted library allocation
page read and write
13203620000
heap
page read and write
229A8525000
heap
page read and write
7FFD9B470000
trusted library allocation
page read and write
132051D0000
trusted library allocation
page read and write
7FFD9B2FB000
trusted library allocation
page execute and read and write
1320355A000
heap
page read and write
F707BFE000
stack
page read and write
13205190000
trusted library allocation
page read and write
132153C1000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
229A6986000
heap
page read and write
229A6BC0000
heap
page read and write
1320356C000
heap
page read and write
7FFD9B2E2000
trusted library allocation
page read and write
229A6B50000
heap
page execute and read and write
132051F0000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
B238FC000
stack
page read and write
229A6A7E000
heap
page read and write
229A6A79000
heap
page read and write
7FFD9B2D5000
trusted library allocation
page read and write
7FFD9B32C000
trusted library allocation
page execute and read and write
B236FE000
stack
page read and write
13205190000
trusted library allocation
page read and write
7FFD9B2C4000
trusted library allocation
page read and write
7FFD9B499000
trusted library allocation
page read and write
13203569000
heap
page read and write
13203549000
heap
page read and write
132051A0000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
7FF4CDD60000
trusted library allocation
page execute and read and write
7FFD9B474000
trusted library allocation
page execute and read and write
132051B0000
trusted library allocation
page read and write
13203850000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
229A8542000
heap
page read and write
132153CE000
trusted library allocation
page read and write
7FFD9B2C3000
trusted library allocation
page execute and read and write
13205190000
trusted library allocation
page read and write
229A69C3000
heap
page read and write
132051A0000
trusted library allocation
page read and write
229A69A0000
heap
page read and write
B237FE000
stack
page read and write
7FFD9B470000
trusted library allocation
page read and write
229A8538000
heap
page read and write
132153C9000
trusted library allocation
page read and write
7FFD9B530000
trusted library allocation
page read and write
229A8549000
heap
page read and write
13203569000
heap
page read and write
229A6A80000
heap
page read and write
13203830000
trusted library allocation
page read and write
7FFD9B3E0000
trusted library allocation
page execute and read and write
229A6B30000
trusted library allocation
page read and write
13203605000
heap
page read and write
229B8651000
trusted library allocation
page read and write
7FFD9B4D9000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
229A6980000
heap
page read and write
13205190000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
132051F0000
trusted library allocation
page read and write
7FFD9B4D1000
trusted library allocation
page read and write
7FFD9B3F0000
trusted library allocation
page execute and read and write
13203840000
heap
page readonly
13205190000
trusted library allocation
page read and write
7FFD9B370000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
1320359A000
heap
page read and write
229A6BA0000
unkown
page readonly
1320356C000
heap
page read and write
7FFD9B490000
trusted library allocation
page read and write
7FFD9B4F0000
trusted library allocation
page read and write
229A6D25000
heap
page read and write
1321D730000
trusted library allocation
page read and write
132051A0000
trusted library allocation
page read and write
13203825000
heap
page read and write
132051D0000
trusted library allocation
page read and write
132035FB000
heap
page read and write
13203880000
heap
page read and write
13205190000
trusted library allocation
page read and write
7FFD9B49E000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
229A8518000
heap
page read and write
132051D0000
trusted library allocation
page read and write
7FFD9B46D000
trusted library allocation
page execute and read and write
7FFD9B520000
trusted library allocation
page read and write
7FFD9B505000
trusted library allocation
page read and write
132035DA000
heap
page read and write
13203558000
heap
page read and write
229A6BC5000
heap
page read and write
B2387C000
stack
page read and write
13203595000
heap
page read and write
229A69C1000
heap
page read and write
229A6B60000
trusted library allocation
page read and write
F706FFD000
stack
page read and write
132051D0000
trusted library allocation
page read and write
7FFD9B2E0000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
13203528000
heap
page read and write
F7073FF000
stack
page read and write
13205190000
trusted library allocation
page read and write
7FFD9B520000
trusted library allocation
page read and write
7FFD9B2CD000
trusted library allocation
page execute and read and write
7FFD9B478000
trusted library allocation
page execute and read and write
132035CC000
heap
page read and write
13205200000
trusted library allocation
page read and write
13203860000
trusted library allocation
page read and write
132051D0000
trusted library allocation
page read and write
13203552000
heap
page read and write
1320359D000
heap
page read and write
7DF45ACA0000
trusted library allocation
page execute and read and write
13205190000
trusted library allocation
page read and write
13205380000
trusted library allocation
page read and write
7FFD9B2D2000
trusted library allocation
page read and write
229A8531000
heap
page read and write
13205190000
trusted library allocation
page read and write
13205200000
trusted library allocation
page read and write
229A6816000
unkown
page readonly
1320359A000
heap
page read and write
13205190000
trusted library allocation
page read and write
13205190000
trusted library allocation
page read and write
There are 260 hidden memdumps, click here to show them.