IOC Report
zyJWi2vy29.exe

loading gif

Files

File Path
Type
Category
Malicious
zyJWi2vy29.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zyJWi2vy29.exe_e0e67866dd5f1e66e4e4566bf6b7d5d6e1114c2_ee315164_bfc38dd3-3233-4c4e-8582-24b040cb3286\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\AdobeUpdaterV168.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\AdobeUpdaterV168.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_b055341c05e33d6c2334ce6d41cea915\AdobeUpdaterV168.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\AdobeUpdaterV168.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rise2806[1].exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma2806[1].exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\meta2806[1].exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vidar2806[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Wb7RPsmWU0j98XyD1Ncm8BU.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\3f61nAONpe1PsLC0oJHy.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\6p7a7injLZJojhETBNhL.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8jZLXI789L2zXDjlm7Fx.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8x9h3ctqkpfTu0sNF0X2.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\KFCGDBAKKKFB\AAFHII
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KFCGDBAKKKFB\AFCFHD
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
modified
C:\ProgramData\KFCGDBAKKKFB\BAFCGI
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\KFCGDBAKKKFB\CAAEBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KFCGDBAKKKFB\DBKKKE
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KFCGDBAKKKFB\DGHIEC
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KFCGDBAKKKFB\IJEHID
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_3f61nAONpe1PsLC0_f82d3a92a5222e402e262757509296e8da22cb_d0580af8_479195b4-351e-49b2-a3ea-316895da9a37\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_6p7a7injLZJojhET_a1161d118d5ba59481b8f8b70c2b917ff513e_5d3d4916_32023134-29b2-48b7-9726-c0b1a833f252\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8x9h3ctqkpfTu0sN_bcd59447a98a76fb8c7cd5a1a3d8f6a156d5590_e32e0909_979e31ca-154c-4d57-aaab-bd7a35d85d31\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6087.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Jul 1 07:16:02 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6114.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER627D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9988.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Jul 1 07:16:16 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A26.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A65.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B7C.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Jul 1 07:16:17 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C39.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CA7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4E3.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Jul 1 07:16:19 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA561.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA66B.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8jZLXI789L2zXDjlm7Fx.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSIUpdaterV168.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\4E_ETy6bOOw3Login Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\5INc0tVFPkNMHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\6JTEmGBjvBASWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\70WEwl36WBWTWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\DE7o6D8KRQYZWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\KiPY9kwddw5OLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\LCD6mNT9opEeHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\Pipe5udjKZEvWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\SrAt_MHzXgCcHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\_9GToUJeg5UwWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\_uGW_ubMqm8ALogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\ehBGgoQPsbnGCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\hzBvBK8Qfe_SWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\zLzn5RU6E7dhHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\trixy3qyfLZqnmIGj\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixy3qyfLZqnmIGj\History\Firefox_fqs92o4p.default-release.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixy3qyfLZqnmIGj\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixy3qyfLZqnmIGj\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixy3qyfLZqnmIGj\screenshot.png
PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 57 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\zyJWi2vy29.exe
"C:\Users\user\Desktop\zyJWi2vy29.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea LG" /sc ONLOGON /rl HIGHEST
malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\6p7a7injLZJojhETBNhL.exe
"C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\6p7a7injLZJojhETBNhL.exe"
malicious
C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8 HR" /sc HOURLY /rl HIGHEST
malicious
C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_6a6c6289978e81e233ec951dd09be6ea\MSIUpdaterV168.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8 LG" /sc ONLOGON /rl HIGHEST
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8x9h3ctqkpfTu0sNF0X2.exe
"C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8x9h3ctqkpfTu0sNF0X2.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a LG" /sc ONLOGON /rl HIGHEST
malicious
C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe
 malicious
C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\3f61nAONpe1PsLC0oJHy.exe
"C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\3f61nAONpe1PsLC0oJHy.exe"
malicious
C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8\MSIUpdaterV168.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915 HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915 LG" /sc ONLOGON /rl HIGHEST
malicious
C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a\MSIUpdaterV168.exe
 malicious
C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe
 malicious
C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8jZLXI789L2zXDjlm7Fx.exe
"C:\Users\user\AppData\Local\Temp\span3qyfLZqnmIGj\8jZLXI789L2zXDjlm7Fx.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe
C:\ProgramData\MSIUpdaterV168_b055341c05e33d6c2334ce6d41cea915\MSIUpdaterV168.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 7548 -ip 7548
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 324
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8004 -s 284
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 288
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7632 -s 136
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 42 hidden processes, click here to show them.

URLs

Name
IP
Malicious
contintnetksows.shop
malicious
ellaboratepwsz.xyzu
malicious
http://77.105.132.27/rise2806.exe
77.105.132.27
 malicious
swellfrrgwwos.xyz
malicious
foodypannyjsud.shop
malicious
pedestriankodwu.xyz
malicious
http://77.105.132.27/lumma2806.exe
77.105.132.27
 malicious
towerxxuytwi.xyzd
malicious
https://195.201.251.214:9000/sqlt.dll67
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://195.201.251.214:9000/nss3.dll
unknown
http://crl.microsoft
unknown
https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
unknown
https://t.me/ON
unknown
https://db-ip.com/
unknown
https://ipinfo.io/widget/demo/8.46.123.336&
unknown
https://195.201.251.214:9000/mozglue.dllge
unknown
http://www.fontbureau.com/designers
unknown
https://db-ip.com/x;
unknown
http://www.sajatypeworks.com
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://77.105.132.27/meta2806.exeL
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
unknown
https://195.201.251.214:9000/softokn3.dllgM
unknown
https://t.me/risepro_bot3320
unknown
https://discord.com/api/v9/users/
unknown
https://t.me/risepro_botisepro_bot
unknown
http://www.galapagosdesign.com/DPlease
unknown
https://t.me/risepro_botv:#
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
https://potterryisiw.shop/
unknown
https://api.ip.sb/ip
unknown
https://195.201.251.214:9000/vcruntime140.dll.
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
http://77.105.132.27/lumma2806.exeB
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://t.me/RiseProSUPPORT
unknown
https://potterryisiw.shop/apiB
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://195.201.251.214:9000/vcruntime140.dllrv:129.0)
unknown
https://195.201.251.214:9000/softokn3.dllo
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://www.carterandcone.coml
unknown
https://195.201.251.214:9000/vcruntime140.dller
unknown
https://195.201.251.214:9000/softokn3.dlle
unknown
https://potterryisiw.shop/apip
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
https://195.201.251.214:9000/x$H
unknown
https://ipinfo.io/
34.117.186.192
https://www.maxmind.com/en/locate-my-ip-address
unknown
https://db-ip.com/v
unknown
https://195.201.251.214/
unknown
https://195.201.251.214:9000/Jb
unknown
https://195.201.251.214:9000
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
http://ns.exif/1e.$A/
unknown
http://77.105.132.27/meta2806.exe/risep
unknown
https://195.201.251.214:9000170le
unknown
https://ipinfo.io:443/widget/demo/8.46.123.33
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://www.fontbureau.com/designersG
unknown
https://195.201.251.214:9000/softokn3.dlls5
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://195.201.251.214:9000/mozglue.dll
unknown
https://195.201.251.214:9000/y
unknown
https://web.telegram.org
unknown
http://www.fontbureau.com/designers?
unknown
https://potterryisiw.shop/l
unknown
https://195.201.251.214:9000/
unknown
http://77.105.132.27/rise2806.exes
unknown
http://www.tiro.com
unknown
https://ipinfo.io/widget/demo/8.46.123.332
unknown
https://api.ip.s
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://www.goodfont.co.kr
unknown
https://195.201.251.214:9000/icrosoft
unknown
http://www.typography.netD
unknown
https://195.201.251.214:9000/8(H
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
https://potterryisiw.shop/api1
unknown
https://ipinfo.io/widget/demo/8.46.123.33
34.117.186.192
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://195.201.251.214:9000/Qb
unknown
https://195.201.251.214:9000/freebl3.dllc
unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33
unknown
https://t.me/g067nDJ
unknown
https://195.201.251.214:9000/nss3.dlls0
unknown
https://db-ip.com/T
unknown
https://ipinfo.io/t_
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
https://195.201.251.214:9000/freebl3.dll
unknown
https://195.201.251.214:9000/=3%
unknown
https://195.201.251.214:9000/softokn3.dll
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
potterryisiw.shop
188.114.97.3
 malicious
t.me
149.154.167.99
 malicious
ipinfo.io
34.117.186.192
db-ip.com
104.26.4.15

IPs

IP
Domain
Country
Malicious
77.105.132.27
unknown
Russian Federation
malicious
188.114.97.3
potterryisiw.shop
European Union
malicious
149.154.167.99
t.me
United Kingdom
malicious
34.117.186.192
ipinfo.io
United States
195.201.251.214
unknown
Germany
104.26.4.15
db-ip.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_6a6c6289978e81e233ec951dd09be6ea
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_e08a8d55b50864bc6ca07cda5a9c96c8
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_9602278fd5a666ce6ca3a5ad676c9c5a
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV168_b055341c05e33d6c2334ce6d41cea915
 malicious
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
ProgramId
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
FileId
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
LowerCaseLongPath
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
LongPathHash
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Name
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
OriginalFileName
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Publisher
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Version
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
BinFileVersion
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
BinaryType
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
ProductName
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
ProductVersion
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
LinkDate
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
BinProductVersion
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
AppxPackageFullName
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
AppxPackageRelativeId
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Size
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Language
\REGISTRY\A\{13acc31b-f966-07bb-9c4a-21a1138c01e6}\Root\InventoryApplicationFile\zyjwi2vy29.exe|a508aa05d3db8447
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
ProgramId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
FileId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
LowerCaseLongPath
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
LongPathHash
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Name
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
OriginalFileName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Publisher
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Version
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
BinFileVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
BinaryType
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
ProductName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
ProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
LinkDate
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
BinProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
AppxPackageFullName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
AppxPackageRelativeId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Size
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Language
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\6p7a7injlzjojhet|e944ac0fb3087927
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
00180010C32C0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
ProgramId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
FileId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
LowerCaseLongPath
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
LongPathHash
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Name
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
OriginalFileName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Publisher
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Version
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
BinFileVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
BinaryType
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
ProductName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
ProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
LinkDate
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
BinProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
AppxPackageFullName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
AppxPackageRelativeId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Size
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Language
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\8x9h3ctqkpftu0sn|3d2ccbd30edd4832
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
00180010C32C0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
ProgramId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
FileId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
LowerCaseLongPath
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
LongPathHash
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Name
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
OriginalFileName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Publisher
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Version
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
BinFileVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
BinaryType
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
ProductName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
ProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
LinkDate
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
BinProductVersion
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
AppxPackageFullName
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
AppxPackageRelativeId
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Size
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Language
\REGISTRY\A\{2b3249be-8767-4bbd-a3ed-a6464d74245c}\Root\InventoryApplicationFile\3f61naonpe1pslc0|f66762bb3c364983
Usn
There are 77 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
F52000
unkown
page readonly
 malicious
4F4000
unkown
page read and write
 malicious
520000
unkown
page read and write
 malicious
4F4000
unkown
page read and write
 malicious
E64000
unkown
page read and write
 malicious
A5A000
heap
page read and write
AAB000
heap
page read and write
2A82000
trusted library allocation
page read and write
29CD000
trusted library allocation
page read and write
5C3F000
stack
page read and write
13AC000
heap
page read and write
55DF000
stack
page read and write
A0D000
stack
page read and write
27EE000
stack
page read and write
BE5000
heap
page read and write
6B9F000
heap
page read and write
2BB5000
trusted library allocation
page read and write
3448000
trusted library allocation
page read and write
15B1000
heap
page read and write
33C5000
trusted library allocation
page read and write
2A78000
trusted library allocation
page read and write
5C55000
heap
page read and write
8EE000
stack
page read and write
57A3000
heap
page read and write
2979000
trusted library allocation
page read and write
120000
unkown
page readonly
14C8000
heap
page read and write
1523000
trusted library allocation
page execute and read and write
33EF000
trusted library allocation
page read and write
BB0000
heap
page read and write
29E4000
trusted library allocation
page read and write
772E000
stack
page read and write
1650000
trusted library allocation
page read and write
4EB0000
trusted library allocation
page read and write
D40000
trusted library allocation
page execute and read and write
33CD000
trusted library allocation
page read and write
5270000
heap
page read and write
2B55000
trusted library allocation
page read and write
52B5000
heap
page read and write
1050000
heap
page read and write
5DB0000
trusted library allocation
page execute and read and write
2A4C000
trusted library allocation
page read and write
770000
heap
page read and write
73C000
stack
page read and write
19B12000
heap
page read and write
347A000
trusted library allocation
page read and write
5BCD000
stack
page read and write
F0B000
stack
page read and write
28EE000
stack
page read and write
990000
heap
page read and write
145000
unkown
page readonly
6B7F000
heap
page read and write
368E000
trusted library allocation
page read and write
5A70000
heap
page read and write
493D000
stack
page read and write
50D0000
trusted library allocation
page execute and read and write
5D60000
trusted library allocation
page read and write
331D000
trusted library allocation
page read and write
3880000
trusted library allocation
page read and write
29A9000
trusted library allocation
page read and write
4FC000
stack
page read and write
1030E000
stack
page read and write
4FC000
stack
page read and write
700000
unkown
page read and write
1369000
heap
page read and write
10FE000
stack
page read and write
29C3000
trusted library allocation
page read and write
6F5000
unkown
page readonly
2AF3000
trusted library allocation
page read and write
10BE000
stack
page read and write
E7F000
stack
page read and write
7E0000
heap
page read and write
C30000
heap
page read and write
6F9E000
stack
page read and write
3241000
trusted library allocation
page read and write
CD0000
heap
page read and write
AD0000
heap
page read and write
2A95000
trusted library allocation
page read and write
2A12000
trusted library allocation
page read and write
6B50000
heap
page read and write
571000
unkown
page readonly
5880000
heap
page read and write
980000
heap
page read and write
2B2D000
trusted library allocation
page read and write
4F3B000
stack
page read and write
9FE000
stack
page read and write
3640000
trusted library allocation
page read and write
20CE000
stack
page read and write
6B0000
heap
page read and write
1564000
heap
page read and write
2BBF000
trusted library allocation
page read and write
401000
remote allocation
page execute and read and write
94F000
stack
page read and write
150000
unkown
page read and write
737B000
heap
page read and write
2948000
trusted library allocation
page read and write
86D000
stack
page read and write
ACB000
heap
page read and write
4DD000
remote allocation
page execute and read and write
C0E000
stack
page read and write
2A8F000
trusted library allocation
page read and write
88A000
heap
page read and write
1A063000
heap
page read and write
2AF7000
trusted library allocation
page read and write
2290000
heap
page read and write
C40000
trusted library allocation
page read and write
284F000
trusted library allocation
page read and write
411000
remote allocation
page execute and read and write
29CB000
trusted library allocation
page read and write
B6C000
heap
page read and write
390F000
trusted library allocation
page read and write
4E71000
trusted library allocation
page read and write
CBE000
stack
page read and write
2826000
trusted library allocation
page read and write
C51000
unkown
page execute read
1050000
heap
page read and write
2AAE000
stack
page read and write
276F000
stack
page read and write
1E0000
heap
page read and write
95E000
unkown
page read and write
6B6E000
heap
page read and write
3465000
trusted library allocation
page read and write
503E000
stack
page read and write
6862000
trusted library allocation
page read and write
29DE000
trusted library allocation
page read and write
2A69000
trusted library allocation
page read and write
5055000
heap
page read and write
3650000
trusted library allocation
page read and write
124A000
heap
page read and write
36F4000
trusted library allocation
page read and write
C51000
unkown
page execute read
2833000
heap
page read and write
CF3000
trusted library allocation
page read and write
2A49000
trusted library allocation
page read and write
15B0000
heap
page read and write
26FB000
trusted library allocation
page read and write
64E000
stack
page read and write
820000
heap
page read and write
74F0000
heap
page read and write
19E7000
heap
page read and write
C46000
trusted library allocation
page execute and read and write
2A51000
trusted library allocation
page read and write
14FEE000
stack
page read and write
12D0000
heap
page read and write
470000
heap
page read and write
2B2B000
trusted library allocation
page read and write
1310000
heap
page read and write
180F000
stack
page read and write
4FDE000
stack
page read and write
364C000
trusted library allocation
page read and write
1313000
heap
page read and write
137B000
heap
page read and write
CDB000
stack
page read and write
4E8000
unkown
page readonly
33C7000
trusted library allocation
page read and write
1210000
heap
page read and write
57CC000
heap
page read and write
DE2000
stack
page read and write
344A000
trusted library allocation
page read and write
D69000
heap
page read and write
860000
heap
page read and write
200CA000
direct allocation
page readonly
29FB000
trusted library allocation
page read and write
515000
unkown
page readonly
DD6000
stack
page read and write
60E000
stack
page read and write
A78000
heap
page read and write
515000
unkown
page readonly
200CD000
direct allocation
page readonly
B5E000
heap
page read and write
14FE000
stack
page read and write
17C000
stack
page read and write
4F1000
unkown
page execute read
231F000
stack
page read and write
5CE000
stack
page read and write
74FE000
heap
page read and write
1FE80000
direct allocation
page execute and read and write
15B0000
heap
page read and write
3841000
trusted library allocation
page read and write
67A000
stack
page read and write
29C7000
trusted library allocation
page read and write
130E000
heap
page read and write
C50000
heap
page read and write
D06000
trusted library allocation
page execute and read and write
19E0000
heap
page read and write
1167000
heap
page read and write
910000
heap
page read and write
36CA000
trusted library allocation
page read and write
410000
remote allocation
page execute and read and write
29EC000
trusted library allocation
page read and write
1FFE6000
direct allocation
page execute read
DAB000
heap
page read and write
A2B000
heap
page read and write
525E000
stack
page read and write
52B000
unkown
page readonly
2E8F000
stack
page read and write
571000
unkown
page readonly
576B000
trusted library allocation
page read and write
2B4C000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
52B000
unkown
page readonly
DA6000
heap
page read and write
135D000
heap
page read and write
7F7000
stack
page read and write
598E000
stack
page read and write
5746000
heap
page read and write
2B3A000
trusted library allocation
page read and write
5C8000
remote allocation
page execute and read and write
128CE000
stack
page read and write
5368000
heap
page read and write
7351000
heap
page read and write
740000
direct allocation
page execute and read and write
C4A000
trusted library allocation
page execute and read and write
301E000
stack
page read and write
29CA000
trusted library allocation
page read and write
2B99000
trusted library allocation
page read and write
7519000
heap
page read and write
1B0000
heap
page read and write
2E0E000
unkown
page read and write
5830000
heap
page read and write
736C000
heap
page read and write
7CF000
unkown
page read and write
8EF000
stack
page read and write
B6E000
heap
page read and write
2B1D000
trusted library allocation
page read and write
1105000
heap
page read and write
9FC000
stack
page read and write
4F4000
unkown
page write copy
735B000
heap
page read and write
1700000
heap
page read and write
52B0000
heap
page read and write
33F9000
trusted library allocation
page read and write
77D000
heap
page read and write
751E000
heap
page read and write
321000
unkown
page execute read
4C0000
heap
page read and write
80F000
stack
page read and write
86F000
unkown
page read and write
C2F000
unkown
page read and write
DCD000
stack
page read and write
550000
heap
page read and write
C75000
unkown
page readonly
5794000
heap
page read and write
321000
unkown
page execute read
2A46000
trusted library allocation
page read and write
96E000
stack
page read and write
24EE000
stack
page read and write
C50000
unkown
page readonly
E00000
trusted library allocation
page read and write
B57000
heap
page read and write
3900000
heap
page read and write
2A16000
trusted library allocation
page read and write
423000
remote allocation
page execute and read and write
421000
remote allocation
page execute and read and write
53A000
stack
page read and write
3070000
heap
page read and write
1FE88000
direct allocation
page execute read
578F000
heap
page read and write
5050000
heap
page read and write
454000
remote allocation
page execute and read and write
3463000
trusted library allocation
page read and write
5792000
trusted library allocation
page read and write
2B46000
trusted library allocation
page read and write
52D000
remote allocation
page execute and read and write
57AF000
trusted library allocation
page read and write
580000
heap
page read and write
5D68000
trusted library allocation
page read and write
7E0000
heap
page read and write
2E4E000
stack
page read and write
1524000
trusted library allocation
page read and write
C75000
unkown
page readonly
104E000
stack
page read and write
3455000
trusted library allocation
page read and write
57B000
heap
page read and write
1050000
heap
page read and write
152D000
trusted library allocation
page execute and read and write
2AF1000
trusted library allocation
page read and write
34B0000
trusted library allocation
page read and write
33C1000
trusted library allocation
page read and write
D17000
trusted library allocation
page execute and read and write
900000
heap
page read and write
52D0000
heap
page read and write
C50000
heap
page read and write
BAE000
stack
page read and write
1290000
heap
page read and write
1572000
heap
page read and write
57D000
stack
page read and write
153A000
heap
page read and write
40E000
remote allocation
page execute and read and write
E17000
heap
page read and write
1335000
heap
page read and write
1620000
heap
page read and write
960000
heap
page read and write
2420000
heap
page read and write
13E5000
heap
page read and write
A00000
heap
page read and write
4C1000
unkown
page execute read
5A20000
trusted library allocation
page read and write
1040000
heap
page read and write
320000
unkown
page readonly
4C90000
trusted library allocation
page read and write
17C000
stack
page read and write
CD0000
trusted library allocation
page read and write
271D000
trusted library allocation
page read and write
3489000
trusted library allocation
page read and write
2B21000
trusted library allocation
page read and write
3442000
trusted library allocation
page read and write
362F000
stack
page read and write
DE0000
trusted library allocation
page read and write
530000
heap
page read and write
4EC0000
trusted library allocation
page read and write
1240000
heap
page read and write
579E000
heap
page read and write
2BA6000
trusted library allocation
page read and write
C24000
trusted library allocation
page read and write
4D00000
trusted library allocation
page read and write
8FC000
stack
page read and write
153E000
heap
page read and write
2B44000
trusted library allocation
page read and write
F50000
unkown
page readonly
4D10000
trusted library allocation
page execute and read and write
3467000
trusted library allocation
page read and write
13C6000
heap
page read and write
3410000
trusted library allocation
page read and write
C51000
unkown
page execute read
3130000
heap
page execute and read and write
131A000
heap
page read and write
2A0C000
trusted library allocation
page read and write
2A4A000
trusted library allocation
page read and write
8E0000
heap
page read and write
880000
heap
page read and write
4E5E000
trusted library allocation
page read and write
121000
unkown
page execute read
30FE000
stack
page read and write
57B5000
trusted library allocation
page read and write
C80000
unkown
page read and write
2AB0000
trusted library allocation
page read and write
B0B000
heap
page read and write
9C0000
heap
page read and write
73E000
unkown
page read and write
2A65000
trusted library allocation
page read and write
2BC1000
trusted library allocation
page read and write
CE3000
trusted library allocation
page execute and read and write
84F000
stack
page read and write
D3A000
heap
page read and write
C52000
trusted library allocation
page read and write
76B000
heap
page read and write
2B0E000
trusted library allocation
page read and write
2EEB000
heap
page read and write
50E000
remote allocation
page execute and read and write
1342000
heap
page read and write
641000
remote allocation
page execute and read and write
700E000
stack
page read and write
2E9F000
unkown
page read and write
2F70000
heap
page read and write
7531000
heap
page read and write
D02000
trusted library allocation
page read and write
2AB0000
heap
page read and write
93B000
heap
page read and write
6D1000
unkown
page execute read
520000
unkown
page write copy
DCE000
heap
page read and write
CE0000
trusted library allocation
page read and write
5781000
trusted library allocation
page read and write
19F1C000
heap
page read and write
6ECE000
stack
page read and write
77B000
heap
page read and write
5A5000
heap
page read and write
445000
remote allocation
page execute and read and write
2A91000
trusted library allocation
page read and write
2C6D000
stack
page read and write
3434000
trusted library allocation
page read and write
A60000
heap
page read and write
2B2F000
trusted library allocation
page read and write
2F78000
heap
page read and write
5820000
heap
page read and write
501E000
stack
page read and write
2EA0000
heap
page read and write
19C10000
heap
page read and write
2420000
remote allocation
page read and write
2711000
trusted library allocation
page read and write
88E000
heap
page read and write
5A50000
trusted library section
page readonly
14AB000
heap
page read and write
430000
heap
page read and write
AC7000
heap
page read and write
3BDE000
stack
page read and write
860000
direct allocation
page execute and read and write
3412000
trusted library allocation
page read and write
A9A000
heap
page read and write
15CF000
heap
page read and write
2E5000
unkown
page readonly
15DB000
heap
page read and write
2A01000
trusted library allocation
page read and write
2B7C000
trusted library allocation
page read and write
2E5000
unkown
page readonly
5220000
trusted library allocation
page read and write
305D000
stack
page read and write
121000
unkown
page execute read
16F0000
trusted library allocation
page execute and read and write
C80000
unkown
page read and write
6C40000
heap
page read and write
5C50000
heap
page read and write
C5B000
trusted library allocation
page execute and read and write
2730000
heap
page read and write
5079000
heap
page read and write
870000
heap
page read and write
3348000
trusted library allocation
page read and write
1601000
heap
page read and write
22F0000
heap
page read and write
1A128000
heap
page read and write
D30000
trusted library allocation
page read and write
1A12A000
heap
page read and write
299D000
trusted library allocation
page read and write
3CDF000
stack
page read and write
731E000
stack
page read and write
D78000
heap
page read and write
96B000
heap
page read and write
C4D000
stack
page read and write
4A9000
remote allocation
page execute and read and write
1642000
trusted library allocation
page read and write
E30000
unkown
page readonly
145000
unkown
page readonly
57A1000
heap
page read and write
6B0000
heap
page read and write
2824000
trusted library allocation
page read and write
5A54000
trusted library section
page readonly
782E000
stack
page read and write
1E0000
heap
page read and write
3446000
trusted library allocation
page read and write
5E1E000
stack
page read and write
16CE000
stack
page read and write
4E6E000
trusted library allocation
page read and write
222E000
stack
page read and write
5070000
heap
page read and write
C60000
heap
page read and write
5360000
heap
page read and write
CDF000
stack
page read and write
2BB0000
trusted library allocation
page read and write
5D0000
heap
page read and write
539000
remote allocation
page execute and read and write
14F8F000
stack
page read and write
57D0000
heap
page read and write
13B0000
heap
page read and write
3120000
trusted library allocation
page read and write
2BAE000
trusted library allocation
page read and write
1377000
heap
page read and write
C33000
trusted library allocation
page read and write
CD1000
unkown
page readonly
E31000
unkown
page execute read
A60000
heap
page read and write
3124000
trusted library allocation
page read and write
6D8E000
stack
page read and write
2B4A000
trusted library allocation
page read and write
A6E000
heap
page read and write
9A70000
unclassified section
page read and write
571E000
stack
page read and write
910000
heap
page read and write
AF9000
heap
page read and write
B9F000
unkown
page read and write
5731000
heap
page read and write
73D000
stack
page read and write
22EE000
stack
page read and write
527000
unkown
page read and write
2970000
trusted library allocation
page read and write
3110000
trusted library allocation
page read and write
4FD000
stack
page read and write
2A93000
trusted library allocation
page read and write
32DC000
trusted library allocation
page read and write
3648000
trusted library allocation
page read and write
39C000
stack
page read and write
F9C000
stack
page read and write
4CD0000
heap
page read and write
47C000
stack
page read and write
DDB000
heap
page read and write
120000
unkown
page readonly
C9E000
stack
page read and write
3645000
trusted library allocation
page read and write
19B1C000
heap
page read and write
D70000
direct allocation
page execute and read and write
29FD000
trusted library allocation
page read and write
350000
unkown
page read and write
15C3000
heap
page read and write
8DE000
stack
page read and write
E30000
unkown
page readonly
26B0000
trusted library allocation
page read and write
2EDE000
stack
page read and write
6B87000
heap
page read and write
690000
direct allocation
page execute and read and write
3670000
trusted library allocation
page read and write
C75000
unkown
page readonly
520000
direct allocation
page execute and read and write
23AD000
stack
page read and write
1670000
trusted library allocation
page read and write
26DD000
stack
page read and write
3652000
trusted library allocation
page read and write
226D000
stack
page read and write
323F000
stack
page read and write
3662000
trusted library allocation
page read and write
426000
remote allocation
page execute and read and write
320000
unkown
page readonly
4CF0000
trusted library allocation
page execute and read and write
4E76000
trusted library allocation
page read and write
2E0E000
stack
page read and write
212E000
stack
page read and write
CFC000
stack
page read and write
13A0000
heap
page read and write
4E8000
unkown
page readonly
70E000
stack
page read and write
200C2000
direct allocation
page read and write
FA6000
unkown
page readonly
CFD000
trusted library allocation
page execute and read and write
36CE000
trusted library allocation
page read and write
2D00000
heap
page read and write
33FF000
trusted library allocation
page read and write
1353000
heap
page read and write
341A000
trusted library allocation
page read and write
CD1000
unkown
page readonly
73F0000
heap
page read and write
5779000
heap
page read and write
263D000
stack
page read and write
BFD000
stack
page read and write
2800000
heap
page read and write
A7D000
heap
page read and write
35A000
stack
page read and write
9FD000
stack
page read and write
960000
heap
page read and write
246C000
stack
page read and write
2A1C000
trusted library allocation
page read and write
43F000
remote allocation
page execute and read and write
6B75000
heap
page read and write
2971000
trusted library allocation
page read and write
2830000
heap
page read and write
DC0000
heap
page read and write
E97000
unkown
page read and write
1280000
direct allocation
page execute and read and write
22AE000
stack
page read and write
1398000
heap
page read and write
175BE000
stack
page read and write
80E000
stack
page read and write
6F0E000
stack
page read and write
2B50000
heap
page read and write
581E000
heap
page read and write
2B5F000
trusted library allocation
page read and write
76EE000
stack
page read and write
576E000
trusted library allocation
page read and write
57C0000
trusted library allocation
page read and write
57E0000
trusted library allocation
page read and write
780000
heap
page read and write
D84000
heap
page read and write
960000
heap
page read and write
33E6000
trusted library allocation
page read and write
19DDC000
heap
page read and write
2BC3000
trusted library allocation
page read and write
CD0000
heap
page read and write
25ED000
stack
page read and write
53B000
heap
page read and write
5290000
trusted library allocation
page read and write
29EF000
trusted library allocation
page read and write
2A61000
trusted library allocation
page read and write
2DCE000
stack
page read and write
3C0000
heap
page read and write
2A18000
trusted library allocation
page read and write
578D000
trusted library allocation
page read and write
3D30000
heap
page read and write
1337000
heap
page read and write
74F7000
heap
page read and write
29C5000
trusted library allocation
page read and write
5060000
heap
page read and write
C51000
unkown
page execute read
12FA000
stack
page read and write
2A5F000
trusted library allocation
page read and write