IOC Report
Iv88OQbqpE.exe

loading gif

Files

File Path
Type
Category
Malicious
Iv88OQbqpE.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\qf2iRTCbu9eZdALmXvtvP2Z.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Iv88OQbqpE.exe_1db15e3a6e74684fa8a936625e6a418453e7770_63d57179_79362258-cf48-4b7a-854e-89e9e830571c\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3DE0.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Mar 28 18:59:30 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F97.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3FB7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeKiDxAbBQnJab\Cookies\Chrome_Default.txt
ASCII text, with very long lines (369), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeKiDxAbBQnJab\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeKiDxAbBQnJab\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\7j3XXE0NDOBjHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\Exbm88Y9TX3cLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\F8sZ6bOkZYvDWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\HPb56B1Nc7ahHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\J29nIqlKGU9nCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\KP7KkCCF7bc_Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\P4GKVEeNqUNxLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\Pw3K6fcNQoliWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\UgcpneaNRPSIHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\_oyhXtkVWgI8Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\ihRnkUjPWlZhLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\qkeTrieEWSPPWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\td0mcqatEjNoCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\xhWwzNjsOR9yHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiKiDxAbBQnJab\y0YbFR0tq0pOWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 18 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Iv88OQbqpE.exe
"C:\Users\user\Desktop\Iv88OQbqpE.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7496 -s 2004

URLs

Name
IP
Malicious
http://193.233.132.167/mine/amert.exe56
unknown
 malicious
http://193.233.132.167/cost/lenin.exe
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://db-ip.com/demo/home.php?s=102.165.48.43
104.26.5.15
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://t.me/risepro_botZ6
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
unknown
https://db-ip.com/
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://t.me/RiseProSUPPORTe
unknown
http://upx.sf.net
unknown
https://t.me/RiseProSUPPORT
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://db-ip.com/demo/home.php?s=102.165.48.43x
unknown
https://db-ip.com:443/demo/home.php?s=102.165.48.43
unknown
https://www.ecosia.org/newtab/
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://193.233.132.167/mine/amert.exem
unknown
http://193.233.132.167/cost/go.exe
unknown
http://193.233.132.167/cost/lenin.exeS
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://t.me/risepro_bot
unknown
http://193.233.132.167/mine/amert.exe
unknown
https://ipinfo.io/
unknown
https://db-ip.com/demo/home.php?s=102.165.48.43f6
unknown
https://www.maxmind.com/en/locate-my-ip-address
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://193.233.132.216:57893/hera/amadka.exeer
unknown
https://ipinfo.io/widget/demo/102.165.48.43
34.117.186.192
http://www.winimage.com/zLibDll
unknown
https://ipinfo.io:443/widget/demo/102.165.48.43P
unknown
https://support.mozilla.org
unknown
http://193.233.132.216:57893/hera/amadka.exe
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://ipinfo.io/widget/demo/102.165.48.43;
unknown
https://t.me/risepro_bott
unknown
http://193.233.132.167/cost/go.exe02.165.48.43
unknown
There are 30 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ipinfo.io
34.117.186.192
db-ip.com
104.26.5.15

IPs

IP
Domain
Country
Malicious
193.233.132.74
unknown
Russian Federation
malicious
34.117.186.192
ipinfo.io
United States
104.26.5.15
db-ip.com
United States

Registry

Path
Value
Malicious
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
ProgramId
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
FileId
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
LowerCaseLongPath
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
LongPathHash
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
Name
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
OriginalFileName
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
Publisher
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
Version
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
BinFileVersion
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
BinaryType
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
ProductName
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
ProductVersion
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
LinkDate
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
BinProductVersion
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
AppxPackageFullName
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
AppxPackageRelativeId
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
Size
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
Language
\REGISTRY\A\{7cea76e3-e68b-6333-19e8-7b0ba05b1a75}\Root\InventoryApplicationFile\iv88oqbqpe.exe|74aeb2210dbef404
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018C00B8F8B0D2B
There are 13 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
5CB0000
heap
page read and write
 malicious
117E000
heap
page read and write
5DD6000
heap
page read and write
5CE4000
heap
page read and write
5E51000
heap
page read and write
5CEC000
heap
page read and write
5B82000
heap
page read and write
5DC4000
heap
page read and write
335E000
stack
page read and write
5E94000
heap
page read and write
5DC4000
heap
page read and write
5E96000
heap
page read and write
4E90000
direct allocation
page execute and read and write
5CDA000
heap
page read and write
5E4D000
heap
page read and write
1220000
heap
page read and write
5CC2000
heap
page read and write
4E90000
direct allocation
page execute and read and write
5E0A000
heap
page read and write
5DCB000
heap
page read and write
5DB0000
trusted library allocation
page read and write
5E3E000
heap
page read and write
4871000
heap
page read and write
321E000
stack
page read and write
5DB1000
heap
page read and write
4871000
heap
page read and write
4EB0000
direct allocation
page execute and read and write
5DBD000
heap
page read and write
5CE4000
heap
page read and write
123B000
heap
page read and write
121F000
heap
page read and write
122A000
heap
page read and write
5CE4000
heap
page read and write
5D38000
heap
page read and write
5CC3000
heap
page read and write
4860000
direct allocation
page read and write
331F000
stack
page read and write
123B000
heap
page read and write
5E42000
heap
page read and write
4871000
heap
page read and write
5CB1000
heap
page read and write
118B000
heap
page read and write
5FB9000
heap
page read and write
5CEC000
heap
page read and write
123A000
heap
page read and write
5E4F000
heap
page read and write
5CDA000
heap
page read and write
5DD7000
heap
page read and write
122A000
heap
page read and write
5CEC000
heap
page read and write
5CDA000
heap
page read and write
5DD0000
heap
page read and write
5DF7000
heap
page read and write
3BDF000
stack
page read and write
5FB5000
heap
page read and write
5CFD000
heap
page read and write
4860000
direct allocation
page read and write
5CC6000
heap
page read and write
119D000
heap
page read and write
5DD4000
heap
page read and write
5DC6000
heap
page read and write
5CDA000
heap
page read and write
5DB1000
heap
page read and write
4F80000
direct allocation
page execute and read and write
5D18000
heap
page read and write
830000
heap
page read and write
5A1F000
stack
page read and write
1220000
heap
page read and write
5DEA000
heap
page read and write
4F60000
direct allocation
page execute and read and write
4871000
heap
page read and write
449F000
stack
page read and write
5DBB000
heap
page read and write
5CDA000
heap
page read and write
1231000
heap
page read and write
5E3E000
heap
page read and write
5CEC000
heap
page read and write
5A20000
heap
page read and write
5AD6000
heap
page read and write
5CEC000
heap
page read and write
5E63000
heap
page read and write
4F30000
direct allocation
page execute and read and write
1231000
heap
page read and write
5DB0000
heap
page read and write
122E000
heap
page read and write
4E90000
direct allocation
page execute and read and write
5DB0000
trusted library allocation
page read and write
5DE2000
heap
page read and write
5DC2000
heap
page read and write
5CC4000
heap
page read and write
3C1E000
stack
page read and write
4EC0000
direct allocation
page execute and read and write
485F000
stack
page read and write
4E90000
direct allocation
page execute and read and write
8EE000
stack
page read and write
5E62000
heap
page read and write
905000
heap
page read and write
122E000
heap
page read and write
123E000
heap
page read and write
E82000
unkown
page execute and read and write
4860000
direct allocation
page read and write
123B000
heap
page read and write
4860000
direct allocation
page read and write
5DC2000
heap
page read and write
385E000
stack
page read and write
A4E000
stack
page read and write
5DB4000
heap
page read and write
5DBB000
heap
page read and write
5D50000
heap
page read and write
123B000
heap
page read and write
5CDA000
heap
page read and write
123B000
heap
page read and write
1234000
heap
page read and write
5CEC000
heap
page read and write
A8C000
stack
page read and write
840000
heap
page read and write
5D26000
heap
page read and write
5E42000
heap
page read and write
5CDA000
heap
page read and write
4F70000
direct allocation
page execute and read and write
5DB1000
heap
page read and write
4E4F000
stack
page read and write
5E42000
heap
page read and write
5DC5000
heap
page read and write
1140000
heap
page read and write
4D4B000
stack
page read and write
117A000
heap
page read and write
5E42000
heap
page read and write
5CEE000
heap
page read and write
5E16000
heap
page read and write
529E000
stack
page read and write
4E90000
direct allocation
page execute and read and write
5CEE000
heap
page read and write
5DB0000
trusted library allocation
page read and write
5A2E000
heap
page read and write
5DB0000
trusted library allocation
page read and write
133E000
stack
page read and write
4D00000
direct allocation
page read and write
5CDA000
heap
page read and write
4E90000
direct allocation
page execute and read and write
4E70000
direct allocation
page execute and read and write
4871000
heap
page read and write
5A20000
trusted library allocation
page read and write
5CC6000
heap
page read and write
5FB6000
heap
page read and write
4CED000
stack
page read and write
123B000
heap
page read and write
5DB1000
heap
page read and write
5CC3000
heap
page read and write
5B97000
heap
page read and write
5DB1000
heap
page read and write
5DB1000
heap
page read and write
5DB1000
heap
page read and write
5CC0000
heap
page read and write
5DBB000
heap
page read and write
5DB0000
trusted library allocation
page read and write
123B000
heap
page read and write
5CEE000
heap
page read and write
5CC2000
heap
page read and write
5E16000
heap
page read and write
31DF000
stack
page read and write
5DC7000
heap
page read and write
5CEC000
heap
page read and write
5B86000
heap
page read and write
5DB1000
heap
page read and write
561E000
stack
page read and write
AB1000
unkown
page execute and write copy
A07000
heap
page read and write
123B000
heap
page read and write
5A25000
heap
page read and write
5CE4000
heap
page read and write
4F40000
direct allocation
page execute and read and write
1220000
heap
page read and write
5DC2000
heap
page read and write
3D1F000
stack
page read and write
5FB8000
heap
page read and write
5FBE000
heap
page read and write
5DBB000
heap
page read and write
5E48000
heap
page read and write
5CED000
heap
page read and write
123B000
heap
page read and write
5CE4000
heap
page read and write
4F00000
direct allocation
page execute and read and write
5DD7000
heap
page read and write
5CEC000
heap
page read and write
58DF000
stack
page read and write
5CED000
heap
page read and write
411E000
stack
page read and write
5DB0000
trusted library allocation
page read and write
11BE000
heap
page read and write
BE3000
unkown
page write copy
5DCB000
heap
page read and write
539E000
stack
page read and write
5DD5000
heap
page read and write
123E000
heap
page read and write
5FB7000
heap
page read and write
4871000
heap
page read and write
4E90000
direct allocation
page execute and read and write
5D09000
heap
page read and write
4871000
heap
page read and write
5DB0000
trusted library allocation
page read and write
4EF0000
direct allocation
page execute and read and write
5DBD000
heap
page read and write
5CDC000
heap
page read and write
5DB0000
trusted library allocation
page read and write
4E90000
direct allocation
page execute and read and write
4CB0000
trusted library allocation
page read and write
4860000
direct allocation
page read and write
A90000
heap
page read and write
5E4F000
heap
page read and write
2F5F000
stack
page read and write
103A000
unkown
page execute and write copy
5DC2000
heap
page read and write
5D19000
heap
page read and write
359F000
stack
page read and write
4871000
heap
page read and write
5CB000
stack
page read and write
575F000
stack
page read and write
4E90000
direct allocation
page execute and read and write
381F000
stack
page read and write
4871000
heap
page read and write
5E4C000
heap
page read and write
5BE000
stack
page read and write
5DBF000
heap
page read and write
5DBB000
heap
page read and write
5E43000
heap
page read and write
35DE000
stack
page read and write
5CED000
heap
page read and write
900000
heap
page read and write
5CC2000
heap
page read and write
345F000
stack
page read and write
5ACC000
heap
page read and write
5DCE000
heap
page read and write
5DBC000
heap
page read and write
5CC4000
heap
page read and write
BDE000
unkown
page execute and read and write
114E000
heap
page read and write
4860000
direct allocation
page read and write
399E000
stack
page read and write
475E000
stack
page read and write
5CB0000
trusted library allocation
page read and write
AB0000
unkown
page read and write
5E3E000
heap
page read and write
5DCD000
heap
page read and write
4860000
direct allocation
page read and write
5CE4000
heap
page read and write
565E000
stack
page read and write
5DD5000
heap
page read and write
4871000
heap
page read and write
4CC000
stack
page read and write
5AC1000
heap
page read and write
4860000
direct allocation
page read and write
5E62000
heap
page read and write
3F9F000
stack
page read and write
4860000
direct allocation
page read and write
5DDE000
heap
page read and write
5DD7000
heap
page read and write
5CC4000
heap
page read and write
5DB1000
heap
page read and write
3A9F000
stack
page read and write
5AC3000
heap
page read and write
5CC2000
heap
page read and write
5CFD000
heap
page read and write
113E000
stack
page read and write
5DC7000
heap
page read and write
123E000
heap
page read and write
5CDA000
heap
page read and write
5DC2000
heap
page read and write
5CED000
heap
page read and write
349E000
stack
page read and write
4871000
heap
page read and write
4871000
heap
page read and write
5DEA000
heap
page read and write
5DB1000
heap
page read and write
5DEB000
heap
page read and write
5D4C000
heap
page read and write
371E000
stack
page read and write
3E5F000
stack
page read and write
5DD2000
heap
page read and write
5CE4000
heap
page read and write
309F000
stack
page read and write
5E63000
heap
page read and write
5DB1000
heap
page read and write
5E62000
heap
page read and write
5E3E000
heap
page read and write
5DC0000
heap
page read and write
E99000
unkown
page execute and write copy
5E3E000
heap
page read and write
5DC4000
heap
page read and write
5CEC000
heap
page read and write
1178000
heap
page read and write
D69000
unkown
page execute and read and write
5AC5000
heap
page read and write
E98000
unkown
page execute and read and write
5DB0000
trusted library allocation
page read and write
4F20000
direct allocation
page execute and read and write
9F0000
heap
page read and write
5E53000
heap
page read and write
4871000
heap
page read and write
4EE0000
direct allocation
page execute and read and write
5CEE000
heap
page read and write
5A25000
heap
page read and write
4871000
heap
page read and write
BE7000
unkown
page execute and read and write
4871000
heap
page read and write
5E42000
heap
page read and write
5AC6000
heap
page read and write
2CDF000
stack
page read and write
4E2D000
direct allocation
page read and write
123B000
heap
page read and write
5CED000
heap
page read and write
AB0000
unkown
page readonly
5DB5000
heap
page read and write
4F90000
direct allocation
page execute and read and write
5B7C000
heap
page read and write
122A000
heap
page read and write
5DC9000
heap
page read and write
5E0A000
heap
page read and write
5D51000
heap
page read and write
4880000
heap
page read and write
122A000
heap
page read and write
2E5E000
stack
page read and write
471F000
stack
page read and write
1234000
heap
page read and write
E98000
unkown
page execute and write copy
5DB1000
heap
page read and write
5DEA000
heap
page read and write
5DD7000
heap
page read and write
5B76000
heap
page read and write
5E55000
heap
page read and write
5DB1000
heap
page read and write
2D1E000
stack
page read and write
5DCB000
heap
page read and write
5E4F000
heap
page read and write
1195000
heap
page read and write
4871000
heap
page read and write
122E000
heap
page read and write
1217000
heap
page read and write
5DB0000
trusted library allocation
page read and write
123B000
heap
page read and write
4FB6000
heap
page read and write
2BDF000
stack
page read and write
5DC4000
heap
page read and write
5DCD000
heap
page read and write
8AD000
stack
page read and write
123B000
heap
page read and write
5D71000
heap
page read and write
123B000
heap
page read and write
122A000
heap
page read and write
4860000
direct allocation
page read and write
5DE7000
heap
page read and write
5E3E000
heap
page read and write
123B000
heap
page read and write
591E000
stack
page read and write
435F000
stack
page read and write
5E55000
heap
page read and write
395F000
stack
page read and write
5B8E000
heap
page read and write
4E90000
direct allocation
page execute and read and write
4870000
heap
page read and write
5DCB000
heap
page read and write
E4A000
unkown
page execute and read and write
123B000
heap
page read and write
5DEA000
heap
page read and write
114A000
heap
page read and write
5DBD000
heap
page read and write
5E62000
heap
page read and write
5DD5000
heap
page read and write
5DC3000
heap
page read and write
5DBB000
heap
page read and write
123B000
heap
page read and write
5B85000
heap
page read and write
1193000
heap
page read and write
4860000
direct allocation
page read and write
122D000
heap
page read and write
5CDA000
heap
page read and write
53DE000
stack
page read and write
4871000
heap
page read and write
5DBB000
heap
page read and write
5DB1000
heap
page read and write
5A28000
heap
page read and write
A00000
heap
page read and write
54DC000
stack
page read and write
5DFA000
heap
page read and write
5CB0000
trusted library allocation
page read and write
36DF000
stack
page read and write
3FDE000
stack
page read and write
421F000
stack
page read and write
5DE2000
heap
page read and write
4D00000
direct allocation
page read and write
4871000
heap
page read and write
4871000
heap
page read and write
5E16000
heap
page read and write
40DF000
stack
page read and write
5DC2000
heap
page read and write
5DD1000
heap
page read and write
5E62000
heap
page read and write
45DF000
stack
page read and write
5DB3000
heap
page read and write
5E0A000
heap
page read and write
2E1F000
stack
page read and write
5DB1000
heap
page read and write
122A000
heap
page read and write
4871000
heap
page read and write
5E3E000
heap
page read and write
4871000
heap
page read and write
5DB1000
heap
page read and write
BE3000
unkown
page read and write
30DE000
stack
page read and write
1039000
unkown
page execute and read and write
5D1D000
heap
page read and write
4871000
heap
page read and write
4E90000
direct allocation
page execute and read and write
5EA0000
heap
page read and write
4E9D000
stack
page read and write
5CE4000
heap
page read and write
118D000
heap
page read and write
4EA0000
direct allocation
page execute and read and write
5DB1000
heap
page read and write
AB1000
unkown
page execute and read and write
5CEE000
heap
page read and write
E89000
unkown
page execute and read and write
122A000
heap
page read and write
425E000
stack
page read and write
5D4B000
heap
page read and write
1220000
heap
page read and write
5CEC000
heap
page read and write
4871000
heap
page read and write
1220000
heap
page read and write
5DE3000
heap
page read and write
5DC7000
heap
page read and write
5D20000
heap
page read and write
5DC2000
heap
page read and write
5CEC000
heap
page read and write
5DB2000
heap
page read and write
5DB0000
trusted library allocation
page read and write
5E0E000
heap
page read and write
5FB0000
heap
page read and write
5DBB000
heap
page read and write
5CE4000
heap
page read and write
5CC4000
heap
page read and write
4871000
heap
page read and write
5CEC000
heap
page read and write
461E000
stack
page read and write
5DB0000
trusted library allocation
page read and write
5DD1000
heap
page read and write
4871000
heap
page read and write
4FA0000
direct allocation
page execute and read and write
5DBB000
heap
page read and write
5770000
remote allocation
page read and write
5D19000
heap
page read and write
11AA000
heap
page read and write
4860000
direct allocation
page read and write
4871000
heap
page read and write
5E3E000
heap
page read and write
5DBD000
heap
page read and write
5E3D000
heap
page read and write
4E90000
direct allocation
page execute and read and write
4E60000
direct allocation
page execute and read and write
123B000
heap
page read and write
5770000
remote allocation
page read and write
4871000
heap
page read and write
4F10000
direct allocation
page execute and read and write
551E000
stack
page read and write
5DC9000
heap
page read and write
1221000
heap
page read and write
3D5E000
stack
page read and write
5E0E000
heap
page read and write
5DC4000
heap
page read and write
5DBD000
heap
page read and write
4860000
direct allocation
page read and write
5CC3000
heap
page read and write
5DBD000
heap
page read and write
5CDA000
heap
page read and write
5CEC000
heap
page read and write
4F50000
direct allocation
page execute and read and write
5DD7000
heap
page read and write
5CE4000
heap
page read and write
5CCF000
heap
page read and write
5DD7000
heap
page read and write
1230000
heap
page read and write
5A21000
heap
page read and write
5DBB000
heap
page read and write
5DEA000
heap
page read and write
2F9E000
stack
page read and write
4860000
direct allocation
page read and write
5CC2000
heap
page read and write
5DEB000
heap
page read and write
5A22000
heap
page read and write
5CE4000
heap
page read and write
5DB3000
heap
page read and write
5CDA000
heap
page read and write
4871000
heap
page read and write
4D00000
direct allocation
page read and write
4871000
heap
page read and write
5CED000
heap
page read and write
123B000
heap
page read and write
5CC2000
heap
page read and write
5CDA000
heap
page read and write
4E80000
direct allocation
page execute and read and write
120A000
heap
page read and write
57DE000
stack
page read and write
5E62000
heap
page read and write
11C3000
heap
page read and write
5DB1000
heap
page read and write
3E9E000
stack
page read and write
5DB0000
trusted library allocation
page read and write
5AC6000
heap
page read and write
5CFD000
heap
page read and write
5DE8000
heap
page read and write
5770000
remote allocation
page read and write
4871000
heap
page read and write
5DBF000
heap
page read and write
4D00000
direct allocation
page read and write
5CE4000
heap
page read and write
5E52000
heap
page read and write
5CE4000
heap
page read and write
439E000
stack
page read and write
3ADE000
stack
page read and write
5E4D000
heap
page read and write
5DC2000
heap
page read and write
44DE000
stack
page read and write
4ED0000
direct allocation
page execute and read and write
There are 513 hidden memdumps, click here to show them.