IOC Report
V1yLpoS3XR.exe

loading gif

Files

File Path
Type
Category
Malicious
V1yLpoS3XR.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\pop3.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\start.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\svchos.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_pop3.exe_7e29265c64f1d265385031f680acc272873ee81_58ab0af3_87e616d9-d10e-43a5-9ab6-7f598bde474e\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA80.tmp.dmp
Mini DuMP crash report, 16 streams, Thu Mar 28 15:25:54 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC08.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC38.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\start.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchos.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Temp\tmp17FD.tmp.bat
DOS batch file, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
\Device\Null
ASCII text, with CRLF line terminators, with overstriking
dropped
There are 3 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\V1yLpoS3XR.exe
"C:\Users\user\Desktop\V1yLpoS3XR.exe"
 malicious
C:\Users\user\AppData\Local\Temp\pop3.exe
"C:\Users\user\AppData\Local\Temp\pop3.exe"
malicious
C:\Users\user\AppData\Local\Temp\start.exe
"C:\Users\user\AppData\Local\Temp\start.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"' & exit
malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp17FD.tmp.bat""
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "svchos" /tr '"C:\Users\user\AppData\Roaming\svchos.exe"'
malicious
C:\Users\user\AppData\Roaming\svchos.exe
C:\Users\user\AppData\Roaming\svchos.exe
 malicious
C:\Users\user\AppData\Roaming\svchos.exe
"C:\Users\user\AppData\Roaming\svchos.exe"
malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 736 -s 1044
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout 3
There are 4 hidden processes, click here to show them.

URLs

Name
IP
Malicious
leetboy.dynuddns.net
malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
https://sectigo.com/CPS0
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://ocsp.sectigo.com0
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://upx.sf.net
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
There are 22 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
blue.o7lab.me
94.156.66.112
 malicious
leetboy.dynuddns.net
185.196.11.223
 malicious

IPs

IP
Domain
Country
Malicious
94.156.66.112
blue.o7lab.me
Bulgaria
malicious
185.196.11.223
leetboy.dynuddns.net
Switzerland
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum
Version
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
ProgramId
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
FileId
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
LowerCaseLongPath
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
LongPathHash
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
Name
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
OriginalFileName
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
Publisher
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
Version
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
BinFileVersion
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
BinaryType
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
ProductName
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
ProductVersion
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
LinkDate
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
BinProductVersion
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
AppxPackageFullName
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
AppxPackageRelativeId
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
Size
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
Language
\REGISTRY\A\{cb4e5484-83d0-f1f0-f8c1-83bd3e5b4db5}\Root\InventoryApplicationFile\pop3.exe|4ae7f4a74ae5d9be
Usn
There are 10 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2190000
heap
page read and write
 malicious
2861000
trusted library allocation
page read and write
 malicious
FB2000
unkown
page readonly
 malicious
402000
remote allocation
page execute and read and write
 malicious
13811182000
trusted library allocation
page read and write
 malicious
1381147F000
trusted library allocation
page read and write
 malicious
3437000
trusted library allocation
page read and write
 malicious
5E3E000
stack
page read and write
532E000
stack
page read and write
5A34000
trusted library allocation
page read and write
3889000
trusted library allocation
page read and write
2FA0000
trusted library allocation
page read and write
191E000
stack
page read and write
2FEB000
trusted library allocation
page read and write
8F8000
stack
page read and write
17C0000
trusted library allocation
page read and write
1650000
heap
page read and write
239C000
stack
page read and write
1390000
trusted library allocation
page read and write
5A0000
heap
page read and write
2D6C000
stack
page read and write
5495000
heap
page read and write
FC2000
unkown
page readonly
51EE000
trusted library allocation
page read and write
5485000
heap
page read and write
9EF000
stack
page read and write
2EC8000
trusted library allocation
page read and write
52C000
stack
page read and write
2F26000
trusted library allocation
page read and write
138210C7000
trusted library allocation
page read and write
2FEF000
stack
page read and write
138297AE000
heap
page read and write
4E98000
heap
page read and write
4DA0000
heap
page read and write
1074000
trusted library allocation
page read and write
1380F5C0000
heap
page read and write
14B0000
heap
page read and write
7F1A0000
trusted library allocation
page execute and read and write
7FE000
heap
page read and write
52A3000
heap
page read and write
13829970000
heap
page read and write
11C0000
trusted library allocation
page read and write
2DEE000
stack
page read and write
2E6C000
stack
page read and write
1382AB60000
trusted library allocation
page read and write
580000
heap
page read and write
51D9000
stack
page read and write
6280000
heap
page read and write
2F53000
trusted library allocation
page read and write
14A0000
trusted library allocation
page read and write
2ED4000
trusted library allocation
page read and write
13C0000
heap
page read and write
17BA000
trusted library allocation
page execute and read and write
2F07000
trusted library allocation
page read and write
7FFD9B764000
trusted library allocation
page read and write
5770000
heap
page read and write
2BEF000
stack
page read and write
7FFD9B778000
trusted library allocation
page read and write
2F3B000
trusted library allocation
page read and write
2F98000
trusted library allocation
page read and write
C87000
trusted library allocation
page execute and read and write
14DE000
stack
page read and write
2F6A000
trusted library allocation
page read and write
2EAB000
trusted library allocation
page read and write
2EF6000
trusted library allocation
page read and write
5220000
trusted library allocation
page read and write
2F28000
trusted library allocation
page read and write
2750000
heap
page read and write
2720000
heap
page read and write
730000
heap
page read and write
984000
trusted library allocation
page read and write
1380F3CF000
heap
page read and write
4CB0000
heap
page read and write
1E3FAF3000
stack
page read and write
FF5000
heap
page read and write
58B2000
heap
page read and write
FF0000
heap
page read and write
585B000
heap
page read and write
4241000
trusted library allocation
page read and write
2E60000
heap
page read and write
14AA000
trusted library allocation
page execute and read and write
53B0000
heap
page read and write
13829B55000
heap
page read and write
2EAD000
trusted library allocation
page read and write
BBE000
stack
page read and write
400000
remote allocation
page execute and read and write
4F1A000
stack
page read and write
339E000
trusted library allocation
page read and write
17B0000
trusted library allocation
page read and write
301C000
trusted library allocation
page read and write
5499000
heap
page read and write
5A65000
trusted library allocation
page read and write
51FE000
trusted library allocation
page read and write
5B70000
heap
page read and write
51E0000
trusted library allocation
page read and write
15BB000
trusted library allocation
page execute and read and write
2EEA000
trusted library allocation
page read and write
17F0000
heap
page read and write
532C000
stack
page read and write
1E402FE000
stack
page read and write
7FFD9B930000
trusted library allocation
page read and write
42F1000
trusted library allocation
page read and write
31BF000
stack
page read and write
1640000
heap
page read and write
17B7000
trusted library allocation
page execute and read and write
179D000
trusted library allocation
page execute and read and write
697F000
stack
page read and write
605000
heap
page read and write
2E71000
trusted library allocation
page read and write
175F000
stack
page read and write
1380F383000
trusted library allocation
page read and write
1490000
trusted library allocation
page read and write
2710000
heap
page execute and read and write
495D000
stack
page read and write
14F5000
heap
page read and write
138210D1000
trusted library allocation
page read and write
62FE000
stack
page read and write
2C4E000
trusted library allocation
page read and write
138297AA000
heap
page read and write
7F0000
heap
page read and write
C3E000
stack
page read and write
33C4000
trusted library allocation
page read and write
121E000
stack
page read and write
4F29000
trusted library allocation
page read and write
63FE000
stack
page read and write
3388000
trusted library allocation
page read and write
38CC000
trusted library allocation
page read and write
2FFB000
trusted library allocation
page read and write
14CE000
heap
page read and write
15B0000
trusted library allocation
page read and write
4E80000
heap
page read and write
677C000
stack
page read and write
2F7F000
trusted library allocation
page read and write
1380F478000
heap
page read and write
3200000
trusted library allocation
page read and write
2F20000
trusted library allocation
page read and write
32F1000
trusted library allocation
page read and write
14F0000
heap
page read and write
3E77000
trusted library allocation
page read and write
A8C000
heap
page read and write
2EDF000
trusted library allocation
page read and write
2F64000
trusted library allocation
page read and write
7FFD9B820000
trusted library allocation
page execute and read and write
26DC000
stack
page read and write
2F81000
trusted library allocation
page read and write
2E40000
trusted library allocation
page read and write
1410000
trusted library allocation
page execute and read and write
3130000
heap
page read and write
2790000
heap
page read and write
7FFD9B78D000
trusted library allocation
page execute and read and write
2F51000
trusted library allocation
page read and write
2EC6000
trusted library allocation
page read and write
311E000
stack
page read and write
1378000
trusted library allocation
page read and write
5201000
trusted library allocation
page read and write
5928000
heap
page read and write
970000
trusted library allocation
page read and write
13A5000
heap
page read and write
4F6D000
stack
page read and write
4E6A000
heap
page read and write
2F4D000
trusted library allocation
page read and write
5A44000
trusted library allocation
page read and write
2ECE000
trusted library allocation
page read and write
4CD0000
heap
page read and write
7FFD9B77D000
trusted library allocation
page execute and read and write
2B4C000
stack
page read and write
2730000
trusted library allocation
page read and write
11D0000
heap
page execute and read and write
585000
heap
page read and write
99D000
trusted library allocation
page execute and read and write
30B0000
heap
page read and write
FD0000
heap
page read and write
2EF0000
trusted library allocation
page read and write
2F9C000
trusted library allocation
page read and write
51F2000
trusted library allocation
page read and write
13829960000
heap
page execute and read and write
1E405FA000
stack
page read and write
17C7000
trusted library allocation
page execute and read and write
138110C1000
trusted library allocation
page read and write
11A2000
trusted library allocation
page read and write
60A5000
heap
page read and write
59F0000
heap
page read and write
2EF4000
trusted library allocation
page read and write
1070000
trusted library allocation
page read and write
400000
unkown
page readonly
1650000
heap
page read and write
1350000
heap
page read and write
2F4F000
trusted library allocation
page read and write
580D000
stack
page read and write
2F47000
trusted library allocation
page read and write
1380F4E3000
heap
page read and write
CC0000
heap
page read and write
7FFD9B81C000
trusted library allocation
page execute and read and write
1060000
trusted library allocation
page read and write
1600000
heap
page read and write
5E2E000
stack
page read and write
103E000
stack
page read and write
7FFD9B880000
trusted library allocation
page execute and read and write
1267000
heap
page read and write
14E5000
heap
page read and write
266E000
heap
page read and write
7FFD9B910000
trusted library allocation
page read and write
2E08000
trusted library allocation
page read and write
2F50000
heap
page read and write
200000
heap
page read and write
1260000
heap
page read and write
10C8000
heap
page read and write
FA0000
heap
page read and write
2F0F000
trusted library allocation
page read and write
5206000
trusted library allocation
page read and write
125C000
stack
page read and write
5CEE000
stack
page read and write
4E8C000
heap
page read and write
2F0E000
stack
page read and write
2AAF000
stack
page read and write
60A0000
heap
page read and write
CB0000
trusted library allocation
page execute and read and write
FEE000
stack
page read and write
2F43000
trusted library allocation
page read and write
1382B462000
heap
page read and write
107D000
trusted library allocation
page execute and read and write
1073000
trusted library allocation
page execute and read and write
26F0000
trusted library allocation
page read and write
2690000
heap
page execute and read and write
29AE000
stack
page read and write
11A0000
trusted library allocation
page read and write
2EEE000
trusted library allocation
page read and write
1380F510000
trusted library section
page readonly
9E7000
heap
page read and write
9A2000
trusted library allocation
page read and write
2F68000
trusted library allocation
page read and write
53A0000
heap
page execute and read and write
482000
unkown
page readonly
401000
unkown
page execute read
7FFD9B784000
trusted library allocation
page read and write
2BF0000
heap
page read and write
1620000
trusted library allocation
page execute and read and write
1380F2E0000
heap
page read and write
1380F3FB000
heap
page read and write
2A70000
heap
page read and write
14D000
stack
page read and write
1E3FCFF000
stack
page read and write
2EE1000
trusted library allocation
page read and write
4EDE000
stack
page read and write
2F62000
trusted library allocation
page read and write
2F6C000
trusted library allocation
page read and write
265E000
heap
page read and write
14A7000
trusted library allocation
page execute and read and write
1E3FFFC000
stack
page read and write
CC7000
heap
page read and write
4DD9000
heap
page read and write
5850000
heap
page read and write
1E404FD000
stack
page read and write
3861000
trusted library allocation
page read and write
57CE000
stack
page read and write
570000
heap
page read and write
9B0000
heap
page read and write
119A000
trusted library allocation
page execute and read and write
1090000
heap
page read and write
2720000
trusted library allocation
page read and write
55AE000
stack
page read and write
26F5000
trusted library allocation
page read and write
7FFD9B960000
trusted library allocation
page read and write
402000
unkown
page readonly
1196000
trusted library allocation
page execute and read and write
2F2C000
trusted library allocation
page read and write
5B76000
heap
page read and write
25F8000
trusted library allocation
page read and write
5426000
heap
page read and write
7FFD9B950000
trusted library allocation
page read and write
2F0B000
trusted library allocation
page read and write
7FF49F450000
trusted library allocation
page execute and read and write
2EB6000
trusted library allocation
page read and write
2E3B000
trusted library allocation
page read and write
2EE3000
trusted library allocation
page read and write
1687000
heap
page read and write
3371000
trusted library allocation
page read and write
265E000
heap
page read and write
11A7000
trusted library allocation
page execute and read and write
684D000
stack
page read and write
2D9A000
trusted library allocation
page read and write
220000
heap
page read and write
1380F4F0000
heap
page read and write
FB0000
unkown
page readonly
1380F2C0000
heap
page read and write
263B000
heap
page read and write
1FE000
unkown
page read and write
542E000
stack
page read and write
17E0000
trusted library allocation
page read and write
2F41000
trusted library allocation
page read and write
4F20000
trusted library allocation
page read and write
983000
trusted library allocation
page execute and read and write
C8B000
trusted library allocation
page execute and read and write
674C000
stack
page read and write
1380F350000
trusted library allocation
page read and write
30A0000
trusted library allocation
page execute and read and write
31C0000
trusted library allocation
page read and write
E00000
heap
page read and write
2F49000
trusted library allocation
page read and write
265E000
heap
page read and write
1380F5C5000
heap
page read and write
2EC0000
trusted library allocation
page read and write
576E000
stack
page read and write
138297E6000
heap
page read and write
2FE8000
trusted library allocation
page read and write
2EBE000
trusted library allocation
page read and write
1380F560000
heap
page read and write
13810ED0000
heap
page read and write
14E7000
heap
page read and write
688C000
stack
page read and write
F3C000
stack
page read and write
13829780000
heap
page read and write
643C000
stack
page read and write
2F3D000
trusted library allocation
page read and write
7FFD9B780000
trusted library allocation
page read and write
663C000
stack
page read and write
9AA000
trusted library allocation
page execute and read and write
17CB000
trusted library allocation
page execute and read and write
5ABD000
stack
page read and write
C7E000
stack
page read and write
4F30000
trusted library allocation
page read and write
132E000
stack
page read and write
33D2000
trusted library allocation
page read and write
13A0000
heap
page read and write
2C54000
trusted library allocation
page read and write
2A6F000
stack
page read and write
1420000
heap
page read and write
1794000
trusted library allocation
page read and write
1380F370000
trusted library allocation
page read and write
5FAC000
stack
page read and write
2FD7000
trusted library allocation
page read and write
2ECB000
trusted library allocation
page read and write
2F05000
trusted library allocation
page read and write
5939000
heap
page read and write
58EE000
stack
page read and write
54A5000
heap
page read and write
2F4F000
stack
page read and write
7FFD9B846000
trusted library allocation
page execute and read and write
1382AB82000
trusted library allocation
page read and write
13829A70000
trusted library section
page read and write
1380F565000
heap
page read and write
296F000
stack
page read and write
266E000
heap
page read and write
FF0000
heap
page read and write
5680000
heap
page read and write
31FE000
stack
page read and write
154E000
stack
page read and write
1B0000
heap
page read and write
687E000
stack
page read and write
1E401FF000
stack
page read and write
54AE000
stack
page read and write
62BD000
stack
page read and write
2D9E000
trusted library allocation
page read and write
DCE000
stack
page read and write
98D000
trusted library allocation
page execute and read and write
648C000
stack
page read and write
2D2F000
stack
page read and write
1793000
trusted library allocation
page execute and read and write
DD0000
heap
page read and write
4315000
trusted library allocation
page read and write
2F4B000
trusted library allocation
page read and write
1484000
trusted library allocation
page read and write
5780000
heap
page execute and read and write
2630000
heap
page read and write
9B7000
heap
page read and write
52EE000
stack
page read and write
70E000
stack
page read and write
600000
heap
page read and write
9DA000
heap
page read and write
7FFD9B900000
trusted library allocation
page read and write
1E400FD000
stack
page read and write
26FE000
stack
page read and write
282E000
stack
page read and write
57EE000
stack
page read and write
133E000
stack
page read and write
2ADF000
heap
page read and write
3E71000
trusted library allocation
page read and write
2EF2000
trusted library allocation
page read and write
81F000
heap
page read and write
E07000
heap
page read and write
2F89000
trusted library allocation
page read and write
2EF8000
trusted library allocation
page read and write
2F0D000
trusted library allocation
page read and write
1192000
trusted library allocation
page read and write
3024000
trusted library allocation
page read and write
51FA000
trusted library allocation
page read and write
5BE000
stack
page read and write
412000
remote allocation
page execute and read and write
2FDA000
trusted library allocation
page read and write
C82000
trusted library allocation
page read and write
2C50000
trusted library allocation
page read and write
136E000
stack
page read and write
13829790000
heap
page read and write
13811216000
trusted library allocation
page read and write
12F9000
stack
page read and write
5AC0000
heap
page read and write
5FE000
stack
page read and write
2F11000
trusted library allocation
page read and write
51EB000
trusted library allocation
page read and write
5A59000
trusted library allocation
page read and write
1380F39C000
heap
page read and write
7FFD9B763000
trusted library allocation
page execute and read and write
5460000
heap
page read and write
1380F1E0000
heap
page read and write
6E10000
trusted library allocation
page execute and read and write
33EB000
trusted library allocation
page read and write
138290F0000
trusted library allocation
page read and write
2F83000
trusted library allocation
page read and write
6082000
heap
page read and write
2ED9000
trusted library allocation
page read and write
546D000
heap
page read and write
1382B460000
heap
page read and write
1380F3BA000
heap
page read and write
57AE000
stack
page read and write
17B2000
trusted library allocation
page read and write
19A000
stack
page read and write
7FFD9B940000
trusted library allocation
page read and write
1494000
trusted library allocation
page read and write
1380F380000
trusted library allocation
page read and write
647C000
stack
page read and write
5F0000
heap
page read and write
1380F520000
heap
page read and write
3396000
trusted library allocation
page read and write
1E3FBFE000
stack
page read and write
5865000
heap
page read and write
2F9A000
trusted library allocation
page read and write
638B000
stack
page read and write
5230000
trusted library allocation
page execute and read and write
56AE000
stack
page read and write
5BEF000
stack
page read and write
1658000
heap
page read and write
5449000
heap
page read and write
5840000
heap
page execute and read and write
490000
heap
page read and write
2E00000
trusted library allocation
page read and write
2ED0000
trusted library allocation
page read and write
5F2E000
stack
page read and write
6B7E000
stack
page read and write
3137000
heap
page read and write
1695000
heap
page read and write
1440000
heap
page read and write
93E000
stack
page read and write
14DA000
heap
page read and write
1446000
heap
page read and write
570F000
heap
page read and write
1380F530000
heap
page read and write
125C000
stack
page read and write
1080000
trusted library allocation
page read and write
9B000
stack
page read and write
7FFD9B91F000
trusted library allocation
page read and write
4CC0000
heap
page read and write
5260000
heap
page read and write
5450000
trusted library allocation
page read and write
55AE000
stack
page read and write
1780000
trusted library allocation
page read and write
148D000
trusted library allocation
page execute and read and write
5770000
trusted library allocation
page read and write
2EE7000
trusted library allocation
page read and write
5E2E000
stack
page read and write
2C44000
trusted library allocation
page read and write
12EE000
stack
page read and write
520D000
trusted library allocation
page read and write
6080000
heap
page read and write
1380F4E0000
heap
page read and write
2747000
trusted library allocation
page read and write
13821220000
trusted library allocation
page read and write
286E000
stack
page read and write
3010000
heap
page read and write
1E406FE000
stack
page read and write
2DF0000
trusted library allocation
page read and write
2F55000
trusted library allocation
page read and write
52A0000
heap
page read and write
2F85000
trusted library allocation
page read and write
25EE000
stack
page read and write
337A000
trusted library allocation
page read and write
3230000
heap
page execute and read and write
7FFD9B980000
trusted library allocation
page execute and read and write
2F70000
trusted library allocation
page read and write
300B000
trusted library allocation
page read and write
BB0000
heap
page read and write
5A70000
trusted library allocation
page read and write
2F60000
heap
page read and write
9A0000
trusted library allocation
page read and write
296F000
unkown
page read and write
14B8000
heap
page read and write
1380F152000
unkown
page readonly
1098000
heap
page read and write
2F6E000
trusted library allocation
page read and write
5D2D000
stack
page read and write
2740000
trusted library allocation
page read and write
31E0000
heap
page read and write
7FFD9B772000
trusted library allocation
page read and write
1380F3B3000
heap
page read and write
9E5000
heap
page read and write
60AD000
stack
page read and write
5775000
trusted library allocation
page read and write
EF9000
stack
page read and write
1E3FEFE000
stack
page read and write
7FFD9B920000
trusted library allocation
page execute and read and write
5F3E000
stack
page read and write
166E000
heap
page read and write
164E000
stack
page read and write
1380F150000
unkown
page readonly
3004000
trusted library allocation
page read and write
5EE000
stack
page read and write
15FE000
stack
page read and write
50DC000
stack
page read and write
23DE000
stack
page read and write
7FFD9B7BC000
trusted library allocation
page execute and read and write
6B8E000
stack
page read and write
9A6000
trusted library allocation
page execute and read and write
990000
trusted library allocation
page read and write
2E39000
trusted library allocation
page read and write
138110B0000
heap
page execute and read and write
15D0000
trusted library allocation
page read and write
1380F3F9000
heap
page read and write
7FFD9B816000
trusted library allocation
page read and write
2ED7000
trusted library allocation
page read and write
2E30000
trusted library allocation
page read and write
4CCB000
heap
page read and write
698E000
stack
page read and write
2FE2000
trusted library allocation
page read and write
1382B4B3000
heap
page read and write
265E000
heap
page read and write
1190000
trusted library allocation
page read and write
BFE000
stack
page read and write
17A0000
trusted library allocation
page read and write
2EBA000
trusted library allocation
page read and write
1380F390000
heap
page read and write
2F13000
trusted library allocation
page read and write
980000
trusted library allocation
page read and write
1810000
heap
page read and write
2C2E000
stack
page read and write
2F9E000
trusted library allocation
page read and write
138210C1000
trusted library allocation
page read and write
7FFD9B770000
trusted library allocation
page read and write
5780000
heap
page read and write
572E000
stack
page read and write
2B8C000
stack
page read and write
1E403FF000
stack
page read and write
4E6F000
heap
page read and write
2F22000
trusted library allocation
page read and write
2F24000
trusted library allocation
page read and write
28B2000
trusted library allocation
page read and write
344D000
trusted library allocation
page read and write
2FAE000
stack
page read and write
2EB8000
trusted library allocation
page read and write
7FFD9B762000
trusted library allocation
page read and write
7E0000
heap
page read and write
10C5000
heap
page read and write
2EEC000
trusted library allocation
page read and write
1E3FDFE000
stack
page read and write
402000
unkown
page readonly
400000
unkown
page readonly
5A56000
trusted library allocation
page read and write
603E000
stack
page read and write
161E000
stack
page read and write
401000
unkown
page execute read
1685000
heap
page read and write
7FA000
heap
page read and write
7FFD9B760000
trusted library allocation
page read and write
18FF000
stack
page read and write
285F000
stack
page read and write
11AB000
trusted library allocation
page execute and read and write
32EE000
stack
page read and write
1380F300000
heap
page read and write
7FFD9B78B000
trusted library allocation
page execute and read and write
7FFD9B962000
trusted library allocation
page read and write
B4C000
stack
page read and write
12AE000
stack
page read and write
482000
unkown
page readonly
2AEE000
stack
page read and write
4CA7000
heap
page read and write
3314000
trusted library allocation
page read and write
15B7000
trusted library allocation
page execute and read and write
CA0000
trusted library allocation
page read and write
3241000
trusted library allocation
page read and write
1380F3D2000
heap
page read and write
533E000
stack
page read and write
7FFD9B970000
trusted library allocation
page read and write
1359000
stack
page read and write
167A000
heap
page read and write
2F3F000
trusted library allocation
page read and write
13829B50000
heap
page read and write
657D000
stack
page read and write
1483000
trusted library allocation
page execute and read and write
14E0000
heap
page read and write
30D0000
heap
page execute and read and write
5390000
heap
page read and write
2EE5000
trusted library allocation
page read and write
7F290000
trusted library allocation
page execute and read and write
7FFD9B76D000
trusted library allocation
page execute and read and write
7FFD9B810000
trusted library allocation
page read and write
DF0000
trusted library allocation
page read and write
673D000
stack
page read and write
3021000
trusted library allocation
page read and write
5212000
trusted library allocation
page read and write
1630000
trusted library allocation
page read and write
BFE000
stack
page read and write
56F6000
heap
page read and write
There are 590 hidden memdumps, click here to show them.