IOC Report
oBMlky3Rkm7h5QK.exe

loading gif

Files

File Path
Type
Category
Malicious
oBMlky3Rkm7h5QK.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ECXXCuFHUVw.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oBMlky3Rkm7h5QK.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qZeUnR.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5byybizn.ydd.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3jirewm.svn.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mecfh0fm.v4x.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mtmfindy.l3t.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwpr00un.32k.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwyglvgr.t1g.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ybagexgq.sl0.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zqqkgmgx.t25.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmpF51D.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped
There are 9 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe
"C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\oBMlky3Rkm7h5QK.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpE1D3.tmp"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
 malicious
C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe
C:\Users\user\AppData\Roaming\ECXXCuFHUVw.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ECXXCuFHUVw" /XML "C:\Users\user\AppData\Local\Temp\tmpF51D.tmp"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
 malicious
C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe
"C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe"
malicious
C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe
"C:\Users\user\AppData\Roaming\qZeUnR\qZeUnR.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 7 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.12.205
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://mail.pacificindia.com
unknown

Domains

Name
IP
Malicious
mail.pacificindia.com
23.226.124.127
 malicious
api.ipify.org
104.26.12.205

IPs

IP
Domain
Country
Malicious
23.226.124.127
mail.pacificindia.com
United States
malicious
104.26.12.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
qZeUnR
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2571000
trusted library allocation
page read and write
 malicious
3348000
trusted library allocation
page read and write
 malicious
259C000
trusted library allocation
page read and write
 malicious
410C000
trusted library allocation
page read and write
 malicious
4A32000
trusted library allocation
page read and write
 malicious
46ED000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
3301000
trusted library allocation
page read and write
 malicious
134E000
stack
page read and write
14E2000
trusted library allocation
page read and write
BA7000
trusted library allocation
page execute and read and write
53AE000
stack
page read and write
596C000
stack
page read and write
A570000
heap
page read and write
12F8000
stack
page read and write
5BFE000
stack
page read and write
58A0000
trusted library allocation
page execute and read and write
830000
trusted library allocation
page read and write
1590000
heap
page read and write
E95000
heap
page read and write
85A000
trusted library allocation
page execute and read and write
2620000
heap
page read and write
7E0000
heap
page read and write
581D000
trusted library allocation
page read and write
2D70000
heap
page read and write
29F0000
heap
page read and write
AFA000
stack
page read and write
6BDE000
stack
page read and write
C80000
trusted library allocation
page read and write
3585000
trusted library allocation
page read and write
3236000
trusted library allocation
page read and write
1480000
trusted library allocation
page read and write
5EAE000
stack
page read and write
24C0000
trusted library allocation
page read and write
E4E000
stack
page read and write
322C000
stack
page read and write
52B0000
trusted library allocation
page read and write
EE6000
trusted library allocation
page execute and read and write
48E0000
heap
page read and write
513F000
stack
page read and write
33ED000
trusted library allocation
page read and write
3256000
trusted library allocation
page read and write
99F000
stack
page read and write
10A0000
heap
page read and write
DA6000
heap
page read and write
DFD000
heap
page read and write
14B6000
heap
page read and write
59CB000
stack
page read and write
2F5A000
heap
page read and write
5012000
trusted library allocation
page read and write
904E000
stack
page read and write
3280000
heap
page execute and read and write
14E0000
trusted library allocation
page read and write
E0D000
stack
page read and write
5902000
heap
page read and write
321E000
stack
page read and write
5E20000
heap
page read and write
102E000
heap
page read and write
C30000
heap
page read and write
4692000
trusted library allocation
page read and write
EDD000
trusted library allocation
page execute and read and write
5D00000
heap
page read and write
59F0000
heap
page read and write
2490000
trusted library allocation
page execute and read and write
690E000
stack
page read and write
2A61000
trusted library allocation
page read and write
532C000
stack
page read and write
EE0000
trusted library allocation
page read and write
29E0000
trusted library allocation
page read and write
2D50000
trusted library allocation
page read and write
42D9000
trusted library allocation
page read and write
26CF000
stack
page read and write
42B1000
trusted library allocation
page read and write
AB000
stack
page read and write
B6D000
trusted library allocation
page execute and read and write
F7F000
stack
page read and write
5B30000
heap
page execute and read and write
1937000
heap
page read and write
812000
unkown
page readonly
F60000
heap
page read and write
840000
trusted library allocation
page read and write
43B9000
trusted library allocation
page read and write
2470000
heap
page read and write
111D000
trusted library allocation
page read and write
5CDD000
stack
page read and write
7360000
trusted library section
page read and write
A8EE000
stack
page read and write
890000
heap
page read and write
A32E000
stack
page read and write
59D0000
trusted library section
page readonly
227E000
stack
page read and write
56A0000
trusted library section
page read and write
1450000
trusted library allocation
page read and write
95A000
stack
page read and write
D88000
heap
page read and write
159E000
heap
page read and write
15C5000
trusted library allocation
page execute and read and write
9B62000
trusted library allocation
page read and write
46B2000
trusted library allocation
page read and write
5D0000
heap
page read and write
14E6000
trusted library allocation
page execute and read and write
2E2E000
trusted library allocation
page read and write
4A1C000
stack
page read and write
14F7000
trusted library allocation
page execute and read and write
1580000
trusted library allocation
page read and write
57F0000
trusted library allocation
page read and write
4D9F000
stack
page read and write
7690000
heap
page read and write
5ABE000
stack
page read and write
1130000
heap
page read and write
4E0E000
stack
page read and write
5840000
trusted library allocation
page read and write
5D60000
trusted library allocation
page read and write
92E0000
heap
page read and write
5816000
trusted library allocation
page read and write
690000
unkown
page readonly
2DAB000
trusted library allocation
page read and write
5A00000
trusted library allocation
page execute and read and write
5880000
heap
page read and write
3527000
trusted library allocation
page read and write
3242000
trusted library allocation
page read and write
1518000
heap
page read and write
AB3E000
stack
page read and write
15C7000
heap
page read and write
325D000
trusted library allocation
page read and write
FCD000
trusted library allocation
page execute and read and write
1460000
trusted library allocation
page read and write
100C000
heap
page read and write
33F0000
trusted library allocation
page read and write
BB0000
heap
page read and write
FBD000
trusted library allocation
page execute and read and write
B00000
heap
page read and write
4DDE000
stack
page read and write
1670000
heap
page read and write
1930000
heap
page read and write
B74000
trusted library allocation
page read and write
1916000
trusted library allocation
page read and write
3EC3000
trusted library allocation
page read and write
470000
heap
page read and write
4F50000
heap
page read and write
5880000
heap
page read and write
D30000
trusted library allocation
page execute and read and write
24B0000
trusted library allocation
page read and write
862000
trusted library allocation
page read and write
4895000
trusted library allocation
page read and write
692000
unkown
page readonly
880000
trusted library allocation
page read and write
CEE000
stack
page read and write
4E4E000
stack
page read and write
820000
trusted library allocation
page read and write
480000
heap
page read and write
5CE0000
trusted library allocation
page read and write
FD0000
heap
page read and write
110E000
trusted library allocation
page read and write
4F70000
trusted library allocation
page read and write
EE2000
trusted library allocation
page read and write
FEB000
trusted library allocation
page execute and read and write
DEB000
heap
page read and write
A7C000
stack
page read and write
DAA000
heap
page read and write
10B0000
heap
page read and write
1646000
heap
page read and write
6A70000
trusted library allocation
page read and write
B70000
trusted library allocation
page read and write
98DC000
stack
page read and write
1510000
trusted library allocation
page read and write
AA3E000
stack
page read and write
1122000
trusted library allocation
page read and write
104E000
stack
page read and write
162E000
stack
page read and write
7612000
trusted library allocation
page read and write
CF7000
stack
page read and write
B63000
trusted library allocation
page execute and read and write
3652000
trusted library allocation
page read and write
580E000
trusted library allocation
page read and write
10A0000
trusted library allocation
page execute and read and write
DFA000
heap
page read and write
523F000
stack
page read and write
3280000
trusted library allocation
page read and write
6F1E000
heap
page read and write
1497000
heap
page read and write
31EE000
stack
page read and write
1560000
heap
page read and write
FC4000
trusted library allocation
page read and write
783E000
stack
page read and write
4B1C000
stack
page read and write
15B0000
heap
page read and write
DA3000
heap
page read and write
5D67000
trusted library allocation
page read and write
2E10000
trusted library allocation
page read and write
83D000
trusted library allocation
page execute and read and write
77A0000
trusted library allocation
page read and write
2DBF000
stack
page read and write
589B000
trusted library allocation
page read and write
60AE000
stack
page read and write
1910000
trusted library allocation
page read and write
5E10000
heap
page read and write
5DBD000
stack
page read and write
7B3D000
heap
page read and write
D80000
heap
page read and write
15AD000
trusted library allocation
page execute and read and write
1598000
heap
page read and write
2830000
heap
page read and write
4812000
trusted library allocation
page read and write
2DD1000
trusted library allocation
page read and write
4889000
trusted library allocation
page read and write
6910000
heap
page read and write
59AE000
stack
page read and write
5DAD000
stack
page read and write
52D0000
trusted library allocation
page read and write
9A1E000
stack
page read and write
AC7C000
stack
page read and write
159D000
trusted library allocation
page execute and read and write
940D000
stack
page read and write
52DE000
stack
page read and write
F9F000
heap
page read and write
5D3F000
stack
page read and write
400000
remote allocation
page execute and read and write
5690000
trusted library allocation
page read and write
5C3E000
stack
page read and write
EF7000
trusted library allocation
page execute and read and write
5020000
trusted library allocation
page execute and read and write
663000
heap
page read and write
109C000
stack
page read and write
6BE0000
trusted library allocation
page read and write
1593000
trusted library allocation
page execute and read and write
58B0000
trusted library allocation
page read and write
80E000
stack
page read and write
43B1000
trusted library allocation
page read and write
74DE000
stack
page read and write
5863000
heap
page read and write
834000
trusted library allocation
page read and write
EB0000
trusted library allocation
page read and write
15DD000
heap
page read and write
7010000
trusted library allocation
page read and write
541E000
stack
page read and write
14EA000
trusted library allocation
page execute and read and write
5D2E000
stack
page read and write
2A50000
heap
page read and write
3521000
trusted library allocation
page read and write
AD7F000
stack
page read and write
6A8D000
trusted library allocation
page read and write
1480000
heap
page read and write
43A000
stack
page read and write
246E000
stack
page read and write
A72E000
stack
page read and write
76CD000
heap
page read and write
950E000
stack
page read and write
44A3000
trusted library allocation
page read and write
281E000
stack
page read and write
2640000
heap
page read and write
D9E000
heap
page read and write
29A0000
heap
page read and write
F87000
heap
page read and write
76A1000
heap
page read and write
323B000
trusted library allocation
page read and write
14C3000
trusted library allocation
page execute and read and write
1475000
heap
page read and write
7450000
heap
page read and write
460000
heap
page read and write
54AB000
stack
page read and write
2DB0000
trusted library allocation
page execute and read and write
64D0000
heap
page read and write
4E70000
trusted library allocation
page execute and read and write
FE0000
heap
page read and write
E90000
heap
page read and write
91CD000
stack
page read and write
24D0000
heap
page read and write
4F40000
trusted library allocation
page execute and read and write
33AE000
stack
page read and write
2D4E000
stack
page read and write
4E5E000
stack
page read and write
F5E000
stack
page read and write
86B000
trusted library allocation
page execute and read and write
1460000
trusted library allocation
page read and write
144E000
stack
page read and write
8E4E000
stack
page read and write
2A50000
heap
page read and write
6B00000
trusted library allocation
page execute and read and write
30E0000
heap
page read and write
8C2000
unkown
page readonly
15D6000
heap
page read and write
69A000
unkown
page readonly
3E75000
trusted library allocation
page read and write
8F4F000
stack
page read and write
EC3000
trusted library allocation
page execute and read and write
30C0000
heap
page read and write
14AA000
heap
page read and write
8BD6000
trusted library allocation
page read and write
6A97000
trusted library allocation
page read and write
7790000
trusted library allocation
page read and write
14BE000
stack
page read and write
6A80000
trusted library allocation
page read and write
C2E000
stack
page read and write
29DE000
stack
page read and write
EC4000
trusted library allocation
page read and write
D70000
heap
page read and write
3E27000
trusted library allocation
page read and write
15B2000
trusted library allocation
page read and write
6A85000
trusted library allocation
page read and write
24E0000
trusted library allocation
page read and write
57BE000
stack
page read and write
9A5E000
stack
page read and write
5860000
heap
page read and write
5D05000
heap
page read and write
508E000
stack
page read and write
758E000
stack
page read and write
695E000
stack
page read and write
850000
trusted library allocation
page read and write
4BFE000
stack
page read and write
1570000
trusted library allocation
page execute and read and write
3262000
trusted library allocation
page read and write
105E000
heap
page read and write
9D0000
heap
page read and write
B80000
heap
page read and write
573E000
stack
page read and write
15B0000
trusted library allocation
page read and write
140E000
stack
page read and write
57FB000
trusted library allocation
page read and write
2556000
trusted library allocation
page read and write
1116000
trusted library allocation
page read and write
92CD000
stack
page read and write
60EF000
stack
page read and write
2D3E000
stack
page read and write
7AF0000
heap
page read and write
FB3000
trusted library allocation
page execute and read and write
11AE000
stack
page read and write
2DA2000
trusted library allocation
page read and write
4FBE000
stack
page read and write
ED0000
trusted library allocation
page read and write
622E000
stack
page read and write
3251000
trusted library allocation
page read and write
6AF0000
trusted library allocation
page read and write
964E000
stack
page read and write
FC0000
heap
page read and write
14D3000
trusted library allocation
page read and write
2320000
heap
page read and write
15C7000
trusted library allocation
page execute and read and write
190C000
stack
page read and write
14C0000
trusted library allocation
page read and write
3290000
trusted library allocation
page read and write
3290000
trusted library allocation
page read and write
518E000
stack
page read and write
A56D000
stack
page read and write
3344000
trusted library allocation
page read and write
FB4000
trusted library allocation
page read and write
7060000
trusted library allocation
page execute and read and write
5030000
heap
page execute and read and write
FA1000
heap
page read and write
DF7000
heap
page read and write
6AE0000
trusted library allocation
page execute and read and write
1111000
trusted library allocation
page read and write
A6ED000
stack
page read and write
5C0000
heap
page read and write
606E000
stack
page read and write
BE0000
heap
page read and write
1920000
trusted library allocation
page read and write
954E000
stack
page read and write
293A000
stack
page read and write
4E1D000
stack
page read and write
109B000
stack
page read and write
59BD000
stack
page read and write
2DA0000
trusted library allocation
page read and write
2521000
trusted library allocation
page read and write
FE7000
trusted library allocation
page execute and read and write
2F50000
heap
page read and write
F6A000
stack
page read and write
14DD000
trusted library allocation
page execute and read and write
32FD000
trusted library allocation
page read and write
6F10000
heap
page read and write
7AEF000
stack
page read and write
48C0000
heap
page read and write
6F10000
heap
page read and write
5D50000
trusted library allocation
page read and write
606000
heap
page read and write
7708000
heap
page read and write
563B000
stack
page read and write
5D40000
trusted library allocation
page read and write
57D5000
heap
page read and write
32BC000
trusted library allocation
page read and write
1140000
heap
page read and write
6F30000
heap
page read and write
144E000
stack
page read and write
D7E000
stack
page read and write
1475000
trusted library allocation
page read and write
6EE0000
trusted library allocation
page read and write
6BF0000
trusted library allocation
page read and write
8C07000
trusted library allocation
page read and write
6A87000
trusted library allocation
page read and write
4F6C000
stack
page read and write
57F4000
trusted library allocation
page read and write
867000
trusted library allocation
page execute and read and write
6A5E000
stack
page read and write
2596000
trusted library allocation
page read and write
2790000
heap
page read and write
2E79000
trusted library allocation
page read and write
1650000
trusted library allocation
page read and write
FC0000
trusted library allocation
page read and write
32E7000
trusted library allocation
page read and write
833000
trusted library allocation
page execute and read and write
15C0000
trusted library allocation
page read and write
B50000
trusted library allocation
page read and write
5BEE000
stack
page read and write
1050000
heap
page execute and read and write
5E6E000
stack
page read and write
531E000
stack
page read and write
5A30000
heap
page read and write
29EE000
unkown
page read and write
4615000
trusted library allocation
page read and write
3350000
trusted library allocation
page read and write
3274000
trusted library allocation
page read and write
7B46000
heap
page read and write
76B1000
heap
page read and write
3FAE000
trusted library allocation
page read and write
D99000
heap
page read and write
7F960000
trusted library allocation
page execute and read and write
2A01000
trusted library allocation
page read and write
6F20000
trusted library allocation
page execute and read and write
F10000
trusted library allocation
page read and write
4C9E000
stack
page read and write
3230000
trusted library allocation
page read and write
A46D000
stack
page read and write
54A0000
trusted library section
page read and write
1654000
heap
page read and write
2797000
heap
page read and write
918F000
stack
page read and write
EEA000
trusted library allocation
page execute and read and write
DE8000
heap
page read and write
1530000
heap
page read and write
1520000
heap
page read and write
9C0000
heap
page read and write
A42F000
stack
page read and write
F6F000
stack
page read and write
32F1000
trusted library allocation
page read and write
1914000
trusted library allocation
page read and write
A6A0000
trusted library allocation
page read and write
1470000
heap
page read and write
C90000
heap
page read and write
EC0000
trusted library allocation
page read and write
7F740000
trusted library allocation
page execute and read and write
6A78000
trusted library allocation
page read and write
6B9D000
stack
page read and write
1A9000
stack
page read and write
3028000
trusted library allocation
page read and write
2DC0000
heap
page execute and read and write
40D2000
trusted library allocation
page read and write
32A0000
heap
page execute and read and write
480000
heap
page read and write
1594000
trusted library allocation
page read and write
323E000
trusted library allocation
page read and write
BB5000
heap
page read and write
162D000
heap
page read and write
9B70000
trusted library allocation
page read and write
217E000
stack
page read and write
D2C000
stack
page read and write
14FB000
trusted library allocation
page execute and read and write
1580000
trusted library allocation
page read and write
F5A000
stack
page read and write
10E0000
trusted library allocation
page read and write
24C4000
trusted library allocation
page read and write
4314000
trusted library allocation
page read and write
C95000
heap
page read and write
B7D000
trusted library allocation
page execute and read and write
5811000
trusted library allocation
page read and write
2D0F000
unkown
page read and write
F94000
heap
page read and write
56B0000
heap
page read and write
AE7E000
stack
page read and write
25DD000
unkown
page read and write
1550000
heap
page read and write
124E000
stack
page read and write
56F0000
heap
page read and write
5D90000
trusted library allocation
page execute and read and write
10F0000
trusted library allocation
page read and write
1660000
trusted library allocation
page read and write
1490000
heap
page read and write
259A000
trusted library allocation
page read and write
59DF000
trusted library section
page readonly
15B6000
trusted library allocation
page execute and read and write
76C3000
heap
page read and write
324A000
trusted library allocation
page read and write
255F000
trusted library allocation
page read and write
51CE000
stack
page read and write
15E0000
trusted library allocation
page read and write
340E000
trusted library allocation
page read and write
1DD000
stack
page read and write
14D0000
trusted library allocation
page read and write
76D3000
heap
page read and write
15BA000
trusted library allocation
page execute and read and write
5AFE000
stack
page read and write
1470000
trusted library allocation
page read and write
261F000
unkown
page read and write
236C000
stack
page read and write
188E000
stack
page read and write
FAD000
stack
page read and write
2820000
trusted library allocation
page read and write
583C000
stack
page read and write
4864000
trusted library allocation
page read and write
A7ED000
stack
page read and write
1630000
trusted library allocation
page execute and read and write
553E000
stack
page read and write
15D9000
heap
page read and write
6A90000
trusted library allocation
page read and write
28FD000
stack
page read and write
7B41000
heap
page read and write
5AAE000
stack
page read and write
3270000
trusted library allocation
page read and write
70AE000
stack
page read and write
4C5E000
stack
page read and write
57C0000
trusted library allocation
page execute and read and write
25A6000
trusted library allocation
page read and write
D78000
heap
page read and write
32EF000
trusted library allocation
page read and write
865000
trusted library allocation
page execute and read and write
B30000
heap
page read and write
7DE000
stack
page read and write
1590000
trusted library allocation
page read and write
58B8000
trusted library allocation
page read and write
4874000
trusted library allocation
page read and write
C60000
heap
page read and write
BAB000
trusted library allocation
page execute and read and write
97DC000
stack
page read and write
149E000
heap
page read and write
1488000
heap
page read and write
603000
heap
page read and write
3DD9000
trusted library allocation
page read and write
ED3000
trusted library allocation
page read and write
A680000
trusted library allocation
page read and write
15CB000
trusted library allocation
page execute and read and write
268E000
stack
page read and write
5890000
trusted library allocation
page read and write
5C2E000
stack
page read and write
680E000
stack
page read and write
72C000
stack
page read and write
6BE7000
trusted library allocation
page read and write
4F7E000
stack
page read and write
14B4000
heap
page read and write
A2EE000
stack
page read and write
2288000
trusted library allocation
page read and write
2510000
heap
page execute and read and write
4F3E000
stack
page read and write
325E000
stack
page read and write
14F5000
heap
page read and write
612E000
stack
page read and write
51D0000
heap
page execute and read and write
3A01000
trusted library allocation
page read and write
5340000
heap
page read and write
57D0000
heap
page read and write
FD0000
heap
page read and write
14F2000
trusted library allocation
page read and write
48D0000
heap
page execute and read and write
14F0000
trusted library allocation
page read and write
12F7000
stack
page read and write
5330000
trusted library section
page readonly
7B18000
heap
page read and write
1133000
heap
page read and write
5480000
trusted library allocation
page execute and read and write
92D0000
heap
page read and write
A1EE000
stack
page read and write
9B5E000
stack
page read and write
4B5E000
stack
page read and write
1640000
heap
page read and write
3285000
trusted library allocation
page read and write
54B0000
heap
page execute and read and write
5AED000
stack
page read and write
59E000
stack
page read and write
FF0000
heap
page read and write
4796000
trusted library allocation
page read and write
AB7B000
stack
page read and write
178F000
stack
page read and write
B79000
stack
page read and write
32B1000
trusted library allocation
page read and write
5850000
trusted library allocation
page read and write
897000
heap
page read and write
EFB000
trusted library allocation
page execute and read and write
10FB000
trusted library allocation
page read and write
779B000
trusted library allocation
page read and write
694000
heap
page read and write
2D90000
heap
page read and write
24A0000
trusted library allocation
page read and write
3549000
trusted library allocation
page read and write
790000
heap
page read and write
5DFE000
stack
page read and write
810000
unkown
page readonly
D94000
heap
page read and write
32A0000
heap
page execute and read and write
2598000
trusted library allocation
page read and write
4870000
trusted library allocation
page read and write
3DD1000
trusted library allocation
page read and write
5DD0000
trusted library allocation
page execute and read and write
7CF000
stack
page read and write
852000
trusted library allocation
page read and write
5D48000
trusted library allocation
page read and write
4E3F000
stack
page read and write
FEB000
heap
page read and write
5470000
heap
page read and write
DB7000
heap
page read and write
6350000
heap
page read and write
991D000
stack
page read and write
768E000
stack
page read and write
856000
trusted library allocation
page execute and read and write
33B1000
trusted library allocation
page read and write
B64000
trusted library allocation
page read and write
324E000
trusted library allocation
page read and write
14C4000
trusted library allocation
page read and write
908E000
stack
page read and write
F6E000
heap
page read and write
18CE000
stack
page read and write
154A000
heap
page read and write
5D8000
heap
page read and write
10C0000
heap
page read and write
ECD000
trusted library allocation
page execute and read and write
9B60000
trusted library allocation
page read and write
568E000
stack
page read and write
3200000
heap
page read and write
256D000
trusted library allocation
page read and write
24C6000
trusted library allocation
page read and write
6360000
heap
page read and write
FE5000
heap
page read and write
59E0000
heap
page read and write
5970000
trusted library allocation
page read and write
76A9000
heap
page read and write
14CD000
trusted library allocation
page execute and read and write
458E000
trusted library allocation
page read and write
533F000
stack
page read and write
E8E000
stack
page read and write
4F80000
trusted library allocation
page read and write
2A4E000
stack
page read and write
3A61000
trusted library allocation
page read and write
5FA000
heap
page read and write
5D5D000
trusted library allocation
page read and write
590B000
heap
page read and write
15A0000
trusted library allocation
page read and write
77F0000
trusted library allocation
page execute and read and write
1A3F000
stack
page read and write
485000
heap
page read and write
15C2000
trusted library allocation
page read and write
5E40000
heap
page read and write
43E000
remote allocation
page execute and read and write
29F0000
heap
page execute and read and write
3346000
trusted library allocation
page read and write
5892000
trusted library allocation
page read and write
1553000
heap
page read and write
EF2000
trusted library allocation
page read and write
There are 634 hidden memdumps, click here to show them.