IOC Report
dendy.exe

loading gif

Files

File Path
Type
Category
Malicious
dendy.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\6XWWeAeVicQTZ7HrJgfaAa9.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
modified
 malicious
C:\Users\user\AppData\Local\Temp\7SoGIg_Dgh61RYTHw6zemBp.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
modified
 malicious
C:\Users\user\AppData\Local\Temp\c9bTQaLpRNBVsUoe4pkuQMW.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_24a29007-21d3-42b0-b4aa-a502308dbc55\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_3876214c-d790-41b5-b5e2-d2ed096deda4\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_4f7c52ae-a147-40d8-a3f2-8a9bebe00511\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_79bbe31a-7538-472f-bc88-c4ceabe8f0b1\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_7beb78b6-6e28-400c-9bec-333e5a1201c0\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
modified
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_fa6f4377-f796-4dc3-b6a9-a4af4a149016\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_8da9ded6fcd3711f80e32889caff945e9691e_62a9ba1a_fd7510c0-0ba9-4985-bc35-420bde20bbb7\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_bf368937aa71444bfe4b5f2ea5f56432083d3_deda682a_99bc5391-f9a6-410f-81b2-90d93152f0db\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_7c2eca60-39e2-4891-80ad-9cb598a01ab4\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_93f7b6c4-5ced-48d1-a491-d06e46313ed7\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_985b3f1e-996c-4fbf-b6be-01ab57397a69\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_a37fdd3b-65f7-4f64-b95e-eddc769fb9af\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_a7d04d5a-b292-4a7f-bb04-f331e1e6070f\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_b0018fe4-ab49-4a41-be81-253da0997ded\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dendy.exe_aa9f15d75e87e911f42a0812ef56c2977edd110_fa985918_b25a0167-156e-47da-8b75-d9e08c1e0ac7\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER37F1.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:08 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER390B.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER396A.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER481D.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:12 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER487C.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER489B.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:12 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER489C.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4987.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER49B6.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER59FF.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:16 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A5E.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A7E.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CDE.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:17 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E08.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E28.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER60B6.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:18 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6163.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER61C2.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER671F.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:21 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6EE0.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F8D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FC9.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:22 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FE9.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:22 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER71BE.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER71FE.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER722C.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER725C.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7651.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:24 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER76CE.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:24 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7885.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER78B3.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:25 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER78C4.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER78E3.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER798F.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B54.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B83.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7DD3.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:26 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E60.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:26 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7FB9.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8102.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8130.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER815F.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8248.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 07:41:27 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER83FE.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER84BB.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe6Qz8rFkBJKgG\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe6Qz8rFkBJKgG\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe6Qz8rFkBJKgG\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeMPBzMuKRxBXT\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeMPBzMuKRxBXT\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeMPBzMuKRxBXT\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe_DCXbajIrPwg\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe_DCXbajIrPwg\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe_DCXbajIrPwg\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\0SUQ0f15JMK7Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\6xQrR_hJnX90Login Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\GrE_iBTQJdDJHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\LWKdqyAhSnWPLogin Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\NuTl_5zQHhB1Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\VIFFOsfry3qSHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\XEPXj5v8mkStCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\YXdO0FNFZMXPWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\fd7hv5c9m7PWLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\hCv8TVXXESZkHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\pbkJaPMaY9JtWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\xLkPmPbriQeYHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\xjqD6LmmUXwRWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi6Qz8rFkBJKgG\zYbZR7DAArvUWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\2l02O9W1_FhwWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\4hARhjpljgnYHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\4yZUYxDepIZ1Web Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\7QP8D56XEcyNHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\BAKulPcBRmujHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\BYnglavidnY6Login Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\FDWjNP4RsRAAWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\Lx2g_U4O1ewNWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\fNgu77Rnk80sHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\fXJWNy96hYVoWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\hd0ZRJK8jbpUCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\lt1lRsmiPxELLogin Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\o47QYaSXnflcWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiMPBzMuKRxBXT\s5KTHH5Pma1BLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\9kIPQpaY4rvVHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\BpKPZ1MEPGssHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\Ct9hyqWswfwmWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\E3k9iNbkN2AxHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\Jny1sItdcq9uWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\Qmh61QEwQYiXCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\UilUp13UfaxJWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\cMZR3uGrcVjNLogin Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\fHH8Sj5XFtveWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\hn0rI1Di9iTsHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\jivh3ZMPe0AVWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\nF96X0gSy0TrLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\q4newEXeW0gGLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi_DCXbajIrPwg\wUqBSbUei7PhWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\rage131MP.tmp
ASCII text, with no line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 120 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\dendy.exe
"C:\Users\user\Desktop\dendy.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 868
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 804
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 780
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 952
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 960
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 928
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 892
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 1464
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 924
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 964
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 884
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 1472
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 820
There are 13 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://193.233.132.167/cost/lenin.exe
unknown
 malicious
http://193.233.132.167/cost/lenin.exenesCH
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://193.233.132.167/cost/lenin.exe.exe/HS2
unknown
http://147.45.47.102:57893/hera/amadka.exe6
unknown
https://duckduckgo.com/ac/?q=
unknown
https://t.me/RiseProSUPPORTq
unknown
http://193.233.132.167/cost/go.exeadka.ex
unknown
https://t.me/RiseProSUPPORTOU~
unknown
https://t.me/RiseProSUPPORTn
unknown
http://147.45.47.102:57893/hera/amadka.exe
unknown
https://db-ip.com/demo/home.php?s=81
unknown
http://147.45.47.102:57893/hera/amadka.exe2
unknown
http://147.45.47.102:57893/hera/amadka.exeCH
unknown
https://db-ip.com/
unknown
https://t.me/risepro_botrA
unknown
http://147.45.47.102:57893/hera/amadka.exe68.0
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://t.me/risepro_bottl;
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://t.me/RiseProSUPPORT117.0.2045.47
unknown
http://193.233.132.167/cost/go.exe
unknown
https://ipinfo.io/x
unknown
https://t.me/RiseProSUPPORTV
unknown
http://193.233.132.167/cost/go.exeisepro_botj
unknown
https://t.me/risepro_botDA
unknown
https://ipinfo.io:443/widget/demo/81.181.57.52
unknown
https://db-ip.com/ZMru
unknown
https://ipinfo.io/widget/demo/81.181.57.52l
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://193.233.132.167/cost/go.exedka.exeuKRx
unknown
https://t.me/risepro_botrisepro
unknown
http://193.233.132.167/cost/lenin.exeania)
unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52s
unknown
https://db-ip.com/demo/home.php?s=81.181.57.52A
unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52
unknown
https://ipinfo.io/X
unknown
https://ipinfo.io/widget/demo/81.181.57.52F
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://193.233.132.167/cost/lenin.exe192.168.0gA
unknown
https://db-ip.com/demo/home.php?s=81.181.57.52dress
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
https://t.me/RiseProSUPPORT
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://www.ecosia.org/newtab/
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://ipinfo.io/widget/demo/81.181.57.52
34.117.186.192
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://db-ip.com/GIG
unknown
https://t.me/risepro_bot1.181.57.52
unknown
https://t.me/risepro_botomania
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://ipinfo.io/8
unknown
https://t.me/risepro_bot
unknown
http://193.233.132.167/cost/lenin.exe_tenant_idr
unknown
https://db-ip.com/~
unknown
https://ipinfo.io/
unknown
http://193.233.132.167/cost/go.exehoin5
unknown
https://db-ip.com/demo/home.php?s=81.181.57.52
104.26.5.15
https://www.maxmind.com/en/locate-my-ip-address
unknown
https://ipinfo.io/4
unknown
https://t.me/risepro_botlateraQ
unknown
https://t.me/RiseProSUPPORTIva
unknown
http://www.winimage.com/zLibDll
unknown
https://support.mozilla.org
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://www.winimage.com/zLibDllDpRTpR
unknown
There are 62 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ipinfo.io
34.117.186.192
db-ip.com
104.26.5.15

IPs

IP
Domain
Country
Malicious
147.45.47.93
unknown
Russian Federation
malicious
34.117.186.192
ipinfo.io
United States
104.26.5.15
db-ip.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RageMP131
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
ProgramId
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
FileId
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
LowerCaseLongPath
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
LongPathHash
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
Name
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
OriginalFileName
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
Publisher
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
Version
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
BinFileVersion
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
BinaryType
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
ProductName
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
ProductVersion
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
LinkDate
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
BinProductVersion
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
AppxPackageFullName
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
AppxPackageRelativeId
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
Size
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
Language
\REGISTRY\A\{07415037-cf2d-ac82-cfc0-211e2af21a85}\Root\InventoryApplicationFile\dendy.exe|b0652e2bf133a4ef
Usn
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
ProgramId
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
FileId
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
LowerCaseLongPath
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
LongPathHash
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Name
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
OriginalFileName
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Publisher
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Version
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
BinFileVersion
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
BinaryType
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
ProductName
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
ProductVersion
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
LinkDate
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
BinProductVersion
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
AppxPackageFullName
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
AppxPackageRelativeId
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Size
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Language
\REGISTRY\A\{eeb1f32e-d1a7-fccb-2a76-b53ae3927bdd}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Usn
There are 29 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
7981000
heap
page read and write
 malicious
305E000
heap
page read and write
 malicious
4A40000
direct allocation
page execute and read and write
 malicious
7984000
heap
page read and write
 malicious
4A60000
direct allocation
page execute and read and write
 malicious
400000
unkown
page execute and read and write
 malicious
4A80000
direct allocation
page execute and read and write
 malicious
4BB0000
direct allocation
page read and write
 malicious
77F0000
heap
page read and write
 malicious
7984000
heap
page read and write
 malicious
4BC0000
direct allocation
page read and write
 malicious
7920000
heap
page read and write
 malicious
799A000
heap
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
400000
unkown
page execute and read and write
 malicious
7999000
heap
page read and write
 malicious
4A70000
direct allocation
page execute and read and write
 malicious
400000
unkown
page execute and read and write
 malicious
4B90000
direct allocation
page read and write
 malicious
7995000
heap
page read and write
 malicious
4BD0000
direct allocation
page read and write
 malicious
79DE000
heap
page read and write
7859000
heap
page read and write
7950000
heap
page read and write
2F28000
heap
page read and write
7996000
heap
page read and write
7856000
heap
page read and write
7873000
heap
page read and write
77DE000
stack
page read and write
79CF000
heap
page read and write
7A60000
remote allocation
page read and write
7840000
heap
page read and write
400000
unkown
page readonly
79B2000
heap
page read and write
7967000
heap
page read and write
782C000
heap
page read and write
7968000
heap
page read and write
7859000
heap
page read and write
79A8000
heap
page read and write
8311000
heap
page read and write
799D000
heap
page read and write
79D4000
heap
page read and write
40F000
unkown
page readonly
79D4000
heap
page read and write
7CD0000
trusted library allocation
page read and write
784C000
heap
page read and write
9B000
stack
page read and write
4E2D000
stack
page read and write
799D000
heap
page read and write
4BCE000
heap
page read and write
8310000
remote allocation
page read and write
1F0000
heap
page read and write
799E000
heap
page read and write
40F000
unkown
page readonly
2F20000
heap
page read and write
2F44000
heap
page read and write
2E68000
heap
page read and write
7990000
heap
page read and write
7992000
heap
page read and write
8410000
remote allocation
page read and write
2F5D000
heap
page read and write
4F00000
remote allocation
page read and write
7930000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7A01000
heap
page read and write
79CD000
heap
page read and write
797C000
heap
page read and write
8321000
heap
page read and write
797F000
heap
page read and write
79B7000
heap
page read and write
76DD000
stack
page read and write
2FF7000
heap
page read and write
7970000
heap
page read and write
784D000
heap
page read and write
783E000
heap
page read and write
7CD0000
trusted library allocation
page read and write
79C4000
heap
page read and write
79B3000
heap
page read and write
79A5000
heap
page read and write
4D01000
heap
page read and write
580000
heap
page read and write
79CF000
heap
page read and write
797C000
heap
page read and write
4F40000
remote allocation
page read and write
4F40000
remote allocation
page read and write
786C000
heap
page read and write
79AF000
heap
page read and write
7996000
heap
page read and write
2E20000
heap
page read and write
797C000
heap
page read and write
78A1000
heap
page read and write
422000
unkown
page readonly
789B000
heap
page read and write
2F11000
heap
page read and write
79A8000
heap
page read and write
7837000
heap
page read and write
79A2000
heap
page read and write
7859000
heap
page read and write
7990000
heap
page read and write
79C4000
heap
page read and write
2FFE000
heap
page read and write
79F4000
heap
page read and write
79DD000
heap
page read and write
799B000
heap
page read and write
7995000
heap
page read and write
43A000
stack
page read and write
7938000
heap
page read and write
781D000
stack
page read and write
7958000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7976000
heap
page read and write
784F000
heap
page read and write
2FF4000
heap
page read and write
2E30000
heap
page read and write
79C9000
heap
page read and write
2F1C000
heap
page read and write
7958000
heap
page read and write
787B000
heap
page read and write
785C000
heap
page read and write
783D000
heap
page read and write
7B70000
trusted library allocation
page read and write
2FEE000
heap
page read and write
7869000
heap
page read and write
79B2000
heap
page read and write
783B000
heap
page read and write
2EF2000
heap
page read and write
305A000
heap
page read and write
783E000
heap
page read and write
79C7000
heap
page read and write
791E000
stack
page read and write
786D000
heap
page read and write
2F3F000
heap
page read and write
795F000
heap
page read and write
79D6000
heap
page read and write
2CB2000
unkown
page readonly
2EAA000
heap
page read and write
7CD0000
trusted library allocation
page read and write
797C000
heap
page read and write
2FF0000
heap
page read and write
2F3E000
heap
page read and write
2EC0000
heap
page read and write
7969000
heap
page read and write
401000
unkown
page execute read
79E3000
heap
page read and write
7868000
heap
page read and write
7996000
heap
page read and write
721E000
stack
page read and write
2F0E000
heap
page read and write
79A2000
heap
page read and write
7990000
heap
page read and write
7859000
heap
page read and write
797C000
heap
page read and write
784E000
heap
page read and write
7868000
heap
page read and write
7859000
heap
page read and write
79E2000
heap
page read and write
79C8000
heap
page read and write
79EE000
heap
page read and write
7992000
heap
page read and write
31D0000
heap
page read and write
2CB2000
unkown
page readonly
7966000
heap
page read and write
4CC6000
heap
page read and write
7CD0000
trusted library allocation
page read and write
2E84000
heap
page read and write
784E000
heap
page read and write
7971000
heap
page read and write
786C000
heap
page read and write
799B000
heap
page read and write
7986000
heap
page read and write
2FF4000
heap
page read and write
7A09000
heap
page read and write
783C000
heap
page read and write
79B3000
heap
page read and write
401000
unkown
page execute read
7820000
heap
page read and write
4C80000
remote allocation
page read and write
7996000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7992000
heap
page read and write
7CD0000
trusted library allocation
page read and write
79A8000
heap
page read and write
7859000
heap
page read and write
7CD0000
trusted library allocation
page read and write
799D000
heap
page read and write
724E000
stack
page read and write
79A2000
heap
page read and write
7967000
heap
page read and write
799B000
heap
page read and write
79A8000
heap
page read and write
2F6A000
heap
page read and write
2FE0000
heap
page read and write
79C9000
heap
page read and write
799B000
heap
page read and write
7854000
heap
page read and write
2CC0000
heap
page read and write
784E000
heap
page read and write
7CD0000
trusted library allocation
page read and write
4CF000
unkown
page write copy
7836000
heap
page read and write
7856000
heap
page read and write
79C7000
heap
page read and write
4F10000
heap
page read and write
79A8000
heap
page read and write
79B2000
heap
page read and write
79D0000
heap
page read and write
79B8000
heap
page read and write
79BB000
heap
page read and write
7921000
heap
page read and write
401000
unkown
page execute read
7CD0000
trusted library allocation
page read and write
2E63000
heap
page read and write
79D4000
heap
page read and write
799E000
heap
page read and write
7991000
heap
page read and write
784F000
heap
page read and write
789B000
heap
page read and write
7844000
heap
page read and write
7854000
heap
page read and write
2E83000
heap
page read and write
7859000
heap
page read and write
782C000
heap
page read and write
79A7000
heap
page read and write
7960000
heap
page read and write
79C0000
heap
page read and write
9B000
stack
page read and write
78A7000
heap
page read and write
2FF0000
heap
page read and write
79A4000
heap
page read and write
7992000
heap
page read and write
7854000
heap
page read and write
782C000
heap
page read and write
79CA000
heap
page read and write
7972000
heap
page read and write
784D000
stack
page read and write
7CD0000
trusted library allocation
page read and write
2F53000
heap
page read and write
7972000
heap
page read and write
31CF000
stack
page read and write
784E000
heap
page read and write
770D000
stack
page read and write
783F000
heap
page read and write
79C5000
heap
page read and write
7847000
heap
page read and write
7981000
heap
page read and write
2DDE000
stack
page read and write
79ED000
heap
page read and write
7CD0000
trusted library allocation
page read and write
79D1000
heap
page read and write
8310000
remote allocation
page read and write
79F4000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7854000
heap
page read and write
796E000
heap
page read and write
7844000
heap
page read and write
2FD0000
heap
page read and write
79BA000
heap
page read and write
79F3000
heap
page read and write
7848000
heap
page read and write
79A8000
heap
page read and write
19A000
stack
page read and write
2EB5000
heap
page read and write
7CB0000
trusted library allocation
page read and write
8420000
trusted library allocation
page read and write
7812000
heap
page read and write
79B3000
heap
page read and write
79D5000
heap
page read and write
7CD0000
trusted library allocation
page read and write
701D000
stack
page read and write
7996000
heap
page read and write
79AF000
heap
page read and write
7920000
remote allocation
page read and write
7875000
heap
page read and write
78A7000
heap
page read and write
796C000
heap
page read and write
7A08000
heap
page read and write
7972000
heap
page read and write
2CB2000
unkown
page readonly
7980000
heap
page read and write
2DAA000
heap
page execute and read and write
2E00000
heap
page read and write
77F1000
heap
page read and write
79AF000
heap
page read and write
4E40000
remote allocation
page read and write
79AF000
heap
page read and write
313A000
heap
page read and write
782C000
heap
page read and write
2EA7000
heap
page read and write
714D000
stack
page read and write
2E5D000
heap
page read and write
400000
unkown
page readonly
7859000
heap
page read and write
79C9000
heap
page read and write
7968000
heap
page read and write
2D0E000
stack
page read and write
79C7000
heap
page read and write
7946000
heap
page read and write
2F2B000
heap
page read and write
79CF000
heap
page read and write
700D000
stack
page read and write
79A7000
heap
page read and write
2E97000
heap
page read and write
79CF000
heap
page read and write
79B3000
heap
page read and write
770D000
stack
page read and write
795F000
heap
page read and write
7960000
heap
page read and write
4DC0000
heap
page read and write
7951000
heap
page read and write
7856000
heap
page read and write
79D8000
heap
page read and write
782C000
heap
page read and write
7960000
heap
page read and write
7848000
heap
page read and write
7821000
heap
page read and write
2ECD000
stack
page read and write
7951000
heap
page read and write
347F000
stack
page read and write
79B0000
heap
page read and write
7814000
heap
page read and write
79A7000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7859000
heap
page read and write
7A09000
heap
page read and write
788B000
heap
page read and write
8310000
heap
page read and write
3340000
heap
page read and write
2ED2000
heap
page read and write
2F4D000
heap
page read and write
2F2A000
heap
page read and write
7960000
remote allocation
page read and write
7942000
heap
page read and write
3050000
heap
page read and write
79AC000
heap
page read and write
7955000
heap
page read and write
2F70000
heap
page read and write
7837000
heap
page read and write
7856000
heap
page read and write
79C4000
heap
page read and write
7981000
heap
page read and write
79A2000
heap
page read and write
4CF0000
heap
page read and write
7960000
heap
page read and write
79A8000
heap
page read and write
794E000
stack
page read and write
7856000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7A03000
heap
page read and write
400000
unkown
page readonly
7866000
heap
page read and write
3141000
heap
page read and write
79B6000
heap
page read and write
79B8000
heap
page read and write
785B000
heap
page read and write
79D9000
heap
page read and write
789F000
heap
page read and write
79D0000
heap
page read and write
79AF000
heap
page read and write
7996000
heap
page read and write
7A0F000
heap
page read and write
7955000
heap
page read and write
799E000
heap
page read and write
797D000
heap
page read and write
7991000
heap
page read and write
2F7D000
heap
page read and write
7877000
heap
page read and write
40F000
unkown
page readonly
782C000
heap
page read and write
79C4000
heap
page read and write
7CD0000
trusted library allocation
page read and write
6F8E000
stack
page read and write
788C000
heap
page read and write
7854000
heap
page read and write
4C4D000
stack
page read and write
7996000
heap
page read and write
79B6000
heap
page read and write
799E000
heap
page read and write
7893000
heap
page read and write
4D2D000
stack
page read and write
2E3E000
stack
page read and write
7995000
heap
page read and write
79ED000
heap
page read and write
7940000
remote allocation
page read and write
30C0000
heap
page read and write
30A4000
heap
page read and write
4D22000
heap
page read and write
2F51000
heap
page read and write
7977000
heap
page read and write
79B3000
heap
page read and write
79C3000
heap
page read and write
7B70000
trusted library allocation
page read and write
79E000
stack
page read and write
7836000
heap
page read and write
313C000
heap
page read and write
782A000
heap
page read and write
7A0F000
heap
page read and write
735E000
stack
page read and write
7992000
heap
page read and write
7874000
heap
page read and write
7960000
heap
page read and write
7854000
heap
page read and write
799E000
heap
page read and write
3093000
heap
page read and write
7837000
heap
page read and write
7995000
heap
page read and write
7983000
heap
page read and write
797C000
heap
page read and write
79B2000
heap
page read and write
7877000
heap
page read and write
79B8000
heap
page read and write
79B2000
heap
page read and write
79DD000
heap
page read and write
7964000
heap
page read and write
3099000
heap
page read and write
2F50000
heap
page read and write
79AE000
heap
page read and write
79B8000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7859000
heap
page read and write
796C000
heap
page read and write
79B2000
heap
page read and write
79D1000
heap
page read and write
2F0A000
heap
page read and write
2FEE000
heap
page read and write
7980000
heap
page read and write
79AF000
heap
page read and write
79B0000
heap
page read and write
782C000
heap
page read and write
783D000
heap
page read and write
30CB000
heap
page read and write
7A02000
heap
page read and write
79AC000
heap
page read and write
4A3F000
stack
page read and write
7869000
heap
page read and write
4D2D000
stack
page read and write
79A7000
heap
page read and write
79B8000
heap
page read and write
2EA7000
heap
page read and write
4DA0000
heap
page read and write
79A2000
heap
page read and write
81F1000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7CD0000
trusted library allocation
page read and write
7CB0000
trusted library allocation
page read and write
7996000
heap
page read and write
79F8000
heap
page read and write
79B3000
heap
page read and write
2E7B000
heap
page read and write
7847000
heap
page read and write
18E000
stack
page read and write
79A2000
heap
page read and write
79AF000
heap
page read and write
7859000
heap
page read and write
30B8000
heap
page read and write
7972000
heap
page read and write
728E000
stack
page read and write
7861000
heap
page read and write
8361000
heap
page read and write
787B000
heap
page read and write
2F46000
heap
page read and write
785D000
heap
page read and write
73AE000
stack
page read and write
7992000
heap
page read and write
2F3A000
heap
page read and write
9B000
stack
page read and write
668000
heap
page read and write
1F0000
heap
page read and write
7994000
heap
page read and write
7893000
heap
page read and write
2CB2000
unkown
page readonly
77EE000
stack
page read and write
7B70000
trusted library allocation
page read and write
79D8000
heap
page read and write
2D90000
heap
page read and write
7871000
heap
page read and write
7856000
heap
page read and write
7843000
heap
page read and write
7856000
heap
page read and write
79B7000
heap
page read and write
79F3000
heap
page read and write
2ECE000
heap
page read and write
798F000
heap
page read and write
4F40000
remote allocation
page read and write
79A6000
heap
page read and write
7862000
heap
page read and write
2F4B000
heap
page read and write
7893000
heap
page read and write
794A000
heap
page read and write
7859000
heap
page read and write
788B000
heap
page read and write
79AC000
heap
page read and write
782C000
heap
page read and write
4FA0000
heap
page read and write
7980000
heap
page read and write
8320000
heap
page read and write
7970000
heap
page read and write
30C5000
heap
page read and write
7844000
heap
page read and write
79D0000
heap
page read and write
312B000
heap
page read and write
780E000
stack
page read and write
784E000
heap
page read and write
7A01000
heap
page read and write
8360000
heap
page read and write
7996000
heap
page read and write
79B2000
heap
page read and write
2F3A000
heap
page read and write
738E000
stack
page read and write
796E000
heap
page read and write
81F0000
heap
page read and write
7970000
heap
page read and write
79B7000
heap
page read and write
422000
unkown
page readonly
309D000
heap
page read and write
79DB000
heap
page read and write
79C6000
heap
page read and write
8A0000
heap
page read and write
7960000
heap
page read and write
7837000
heap
page read and write
7A03000
heap
page read and write
2E27000
heap
page read and write
79DD000
heap
page read and write
796C000
heap
page read and write
79B7000
heap
page read and write
796E000
heap
page read and write
2F4F000
heap
page read and write
7856000
heap
page read and write
4E5E000
stack
page read and write
7970000
remote allocation
page read and write
79A4000
heap
page read and write
2EB5000
heap
page read and write
786C000
heap
page read and write
8440000
remote allocation
page read and write
796C000
heap
page read and write
7CD0000
trusted library allocation
page read and write
79D7000
heap
page read and write
79AA000
heap
page read and write
7948000
heap
page read and write
7856000
heap
page read and write
782C000
heap
page read and write
2E82000
heap
page read and write
7984000
heap
page read and write
7B80000
remote allocation
page read and write
79DE000
heap
page read and write
2FFE000
heap
page read and write
4BC0000
remote allocation
page read and write
79FD000
heap
page read and write
7A80000
remote allocation
page read and write
782C000
heap
page read and write
79B3000
heap
page read and write
7992000
heap
page read and write
4C80000
remote allocation
page read and write
7854000
heap
page read and write
7981000
heap
page read and write
79F3000
heap
page read and write
7CB0000
trusted library allocation
page read and write
79CA000
heap
page read and write
4C90000
heap
page read and write
2EDA000
heap
page read and write
79C2000
heap
page read and write
79D6000
heap
page read and write
7859000
heap
page read and write
725D000
stack
page read and write
4CF000
unkown
page write copy
79AF000
heap
page read and write
7859000
heap
page read and write
2E71000
heap
page read and write
2F46000
heap
page read and write
79A9000
heap
page read and write
7856000
heap
page read and write
7836000
heap
page read and write
7998000
heap
page read and write
2CB2000
unkown
page readonly
79B0000
heap
page read and write
796F000
heap
page read and write
7965000
heap
page read and write
2F86000
heap
page read and write
79B5000
heap
page read and write
7960000
heap
page read and write
796F000
heap
page read and write
313C000
heap
page read and write
784E000
heap
page read and write
34C0000
heap
page read and write
7B70000
trusted library allocation
page read and write
788C000
heap
page read and write
79B3000
heap
page read and write
4C0C000
heap
page read and write
7831000
heap
page read and write
79C4000
heap
page read and write
82F0000
trusted library allocation
page read and write
313E000
stack
page read and write
7B70000
trusted library allocation
page read and write
79A7000
heap
page read and write
2EAE000
heap
page read and write
2F14000
heap
page read and write
2F6D000
heap
page execute and read and write
4C8D000
stack
page read and write
79BB000
heap
page read and write
7996000
heap
page read and write
718E000
stack
page read and write
422000
unkown
page readonly
79BE000
heap
page read and write
799B000
heap
page read and write
4CA5000
heap
page read and write
1F0000
heap
page read and write
799D000
heap
page read and write
788E000
heap
page read and write
78A1000
heap
page read and write
79B2000
heap
page read and write
490000
heap
page read and write
784F000
heap
page read and write
7969000
heap
page read and write
797C000
heap
page read and write
784E000
heap
page read and write
79C5000
heap
page read and write
79A8000
heap
page read and write
7CD0000
trusted library allocation
page read and write
728D000
stack
page read and write
79AF000
heap
page read and write
79D4000
heap
page read and write
78F0000
remote allocation
page read and write
7997000
heap
page read and write
799B000
heap
page read and write
30A9000
heap
page read and write
7A50000
remote allocation
page read and write
784E000
heap
page read and write
4BEF000
heap
page read and write
79B8000
heap
page read and write
7973000
heap
page read and write
7CD0000
trusted library allocation
page read and write
8460000
trusted library allocation
page read and write
798B000
heap
page read and write
7960000
heap
page read and write
5CE000
unkown
page read and write
79B0000
heap
page read and write
738E000
stack
page read and write
7992000
heap
page read and write
18E000
stack
page read and write
2CB2000
unkown
page readonly
79BB000
heap
page read and write
79C3000
heap
page read and write
7997000
heap
page read and write
2E70000
heap
page read and write
782C000
heap
page read and write
7974000
heap
page read and write
79B8000
heap
page read and write
782C000
heap
page read and write
7859000
heap
page read and write
4CF000
unkown
page write copy
7CD0000
trusted library allocation
page read and write
783B000
heap
page read and write
7970000
heap
page read and write
2FFE000
stack
page read and write
3143000
heap
page read and write
2E60000
heap
page read and write
2F2B000
heap
page read and write
7CB0000
trusted library allocation
page read and write
2F59000
heap
page read and write
7800000
heap
page read and write
785D000
heap
page read and write
794E000
stack
page read and write
79AF000
heap
page read and write
7CB0000
trusted library allocation
page read and write
7856000
heap
page read and write
7942000
heap
page read and write
79DD000
heap
page read and write
7887000
heap
page read and write
79C8000
heap
page read and write
308F000
heap
page read and write
401000
unkown
page execute read
7938000
heap
page read and write
79C7000
heap
page read and write
30D4000
heap
page read and write
796B000
heap
page read and write
3320000
heap
page read and write
79CA000
heap
page read and write
7992000
heap
page read and write
7833000
heap
page read and write
7859000
heap
page read and write
2EC8000
heap
page read and write
7A40000
remote allocation
page read and write
79BA000
heap
page read and write
2D80000
heap
page read and write
79DC000
heap
page read and write
660000
heap
page read and write
4EED000
stack
page read and write
7B70000
trusted library allocation
page read and write
799D000
heap
page read and write
79B2000
heap
page read and write
79A8000
heap
page read and write
7996000
heap
page read and write
1ED000
stack
page read and write
60E000
unkown
page read and write
79B0000
heap
page read and write
7B60000
remote allocation
page read and write
79A7000
heap
page read and write
7991000
heap
page read and write
4CED000
stack
page read and write
79DC000
heap
page read and write
7CD0000
trusted library allocation
page read and write
79B3000
heap
page read and write
79C9000
heap
page read and write
79CE000
heap
page read and write
79D5000
heap
page read and write
79E3000
heap
page read and write
79AA000
heap
page read and write
7856000
heap
page read and write
79A6000
heap
page read and write
796D000
heap
page read and write
4C3D000
stack
page read and write
2D85000
heap
page read and write
799E000
heap
page read and write
7951000
heap
page read and write
79C7000
heap
page read and write
2D87000
heap
page read and write
7984000
heap
page read and write
799E000
heap
page read and write
7887000
heap
page read and write
331D000
stack
page read and write
30FF000
stack
page read and write
7CD0000
trusted library allocation
page read and write
2E8F000
heap
page read and write
79A5000
heap
page read and write
7856000
heap
page read and write
79BD000
heap
page read and write
7986000
heap
page read and write
4E40000
remote allocation
page read and write
7992000
heap
page read and write
7992000
heap
page read and write
4CD0000
heap
page read and write
782A000
heap
page read and write
2F18000
heap
page read and write
7996000
heap
page read and write
7960000
heap
page read and write
19A000
stack
page read and write
4EDD000
stack
page read and write
32CF000
stack
page read and write
7997000
heap
page read and write
79E3000
heap
page read and write
4F00000
remote allocation
page read and write
796A000
heap
page read and write
7854000
heap
page read and write
789B000
heap
page read and write
786D000
heap
page read and write
3131000
heap
page read and write
797F000
heap
page read and write
79FD000
heap
page read and write
79D4000
heap
page read and write
7854000
heap
page read and write
2EBE000
stack
page read and write
7800000
heap
page read and write
79CA000
heap
page read and write
797F000
heap
page read and write
784D000
stack
page read and write
79A7000
heap
page read and write
79A7000
heap
page read and write
7854000
heap
page read and write
795A000
heap
page read and write
313C000
heap
page read and write
708D000
stack
page read and write
7995000
heap
page read and write
3142000
heap
page read and write
7996000
heap
page read and write
798E000
heap
page read and write
4E80000
heap
page read and write
7980000
heap
page read and write
79CF000
heap
page read and write
7883000
heap
page read and write
79A8000
heap
page read and write
798A000
heap
page read and write
3148000
heap
page read and write
7848000
heap
page read and write
7996000
heap
page read and write
79CE000
heap
page read and write
7996000
heap
page read and write
7CB0000
trusted library allocation
page read and write
79B0000
heap
page read and write
31B0000
heap
page read and write
4F8D000
stack
page read and write
786C000
heap
page read and write
79C2000
heap
page read and write
2D90000
heap
page read and write
4BEB000
heap
page read and write
7970000
heap
page read and write
79D5000
heap
page read and write
2F53000
heap
page read and write
30D4000
heap
page read and write
79D8000
heap
page read and write
79A9000
heap
page read and write
79BA000
heap
page read and write
3010000
heap
page read and write
7992000
heap
page read and write
7A07000
heap
page read and write
79BE000
heap
page read and write
7CD0000
trusted library allocation
page read and write
797C000
heap
page read and write
79BA000
heap
page read and write
79DD000
heap
page read and write
2DFE000
stack
page read and write
30BB000
heap
page read and write
4C0D000
stack
page read and write
799B000
heap
page read and write
7992000
heap
page read and write
79A6000
heap
page read and write
79C9000
heap
page read and write
313C000
heap
page read and write
2D4E000
stack
page read and write
2F48000
heap
page read and write
79A8000
heap
page read and write
7840000
heap
page read and write
7954000
heap
page read and write
79C7000
heap
page read and write
79BB000
heap
page read and write
30C0000
heap
page read and write
3090000
heap
page read and write
79A5000
heap
page read and write
2E39000
heap
page execute and read and write
2F4C000
heap
page read and write
6ECE000
stack
page read and write
2FFE000
heap
page read and write
7A07000
heap
page read and write
7836000
heap
page read and write
782C000
heap
page read and write
81E0000
remote allocation
page read and write
7874000
heap
page read and write
797F000
heap
page read and write
79BE000
heap
page read and write
2CB2000
unkown
page readonly
7854000
heap
page read and write
79C5000
heap
page read and write
79CA000
heap
page read and write
2DB5000
heap
page read and write
780E000
stack
page read and write
79C4000
heap
page read and write
7854000
heap
page read and write
782C000
heap
page read and write
2FBF000
stack
page read and write
7986000
heap
page read and write
79AF000
heap
page read and write
7859000
heap
page read and write
2F53000
heap
page read and write
7A03000
heap
page read and write
782C000
heap
page read and write
7A0F000
heap
page read and write
79C5000
heap
page read and write
79B3000
heap
page read and write
4CF000
unkown
page write copy
7859000
heap
page read and write
789F000
heap
page read and write
79BB000
heap
page read and write
2F0A000
stack
page read and write
79CD000
heap
page read and write
785C000
heap
page read and write
2DB7000
heap
page read and write
4A5F000
stack
page read and write
79D5000
heap
page read and write
2F8E000
unkown
page read and write
2F4F000
heap
page read and write
79A2000
heap
page read and write
782C000
heap
page read and write
308B000
heap
page read and write
2F77000
heap
page read and write
18E000
stack
page read and write
7895000
heap
page read and write
79A2000
heap
page read and write
7990000
heap
page read and write
799E000
heap
page read and write
79DD000
heap
page read and write
2F40000
heap
page read and write
783B000
heap
page read and write
79B4000
heap
page read and write
79C1000
heap
page read and write
7985000
heap
page read and write
79B2000
heap
page read and write
7837000
heap
page read and write
797A000
heap
page read and write
4D1000
unkown
page read and write
2EAD000
heap
page read and write
79A4000
heap
page read and write
8450000
remote allocation
page read and write
3170000
heap
page read and write
7CB0000
trusted library allocation
page read and write
7997000
heap
page read and write
2F53000
heap
page read and write
7950000
remote allocation
page read and write
4EAE000
stack
page read and write
7973000
heap
page read and write
32DF000
stack
page read and write
71AE000
stack
page read and write
7980000
heap
page read and write
79BB000
heap
page read and write
2EF2000
heap
page read and write
313C000
heap
page read and write
7848000
heap
page read and write
7969000
heap
page read and write
79CE000
heap
page read and write
2EBC000
heap
page read and write
79BC000
heap
page read and write
4E9D000
stack
page read and write
2DB0000
heap
page read and write
797C000
heap
page read and write
7CD0000
trusted library allocation
page read and write
79D1000
heap
page read and write
2F50000
heap
page read and write
7854000
heap
page read and write
78A0000
heap
page read and write
2E6A000
heap
page read and write
7B70000
trusted library allocation
page read and write
18E000
stack
page read and write
2E77000
heap
page read and write
79C2000
heap
page read and write
79B8000
heap
page read and write
7856000
heap
page read and write
79CF000
heap
page read and write
799B000
heap
page read and write
2F92000
heap
page read and write
2D90000
heap
page read and write
2EA5000
heap
page read and write
79C6000
heap
page read and write
2CB2000
unkown
page readonly
2FDF000
heap
page read and write
7931000
heap
page read and write
2E94000
heap
page read and write
307D000
heap
page read and write
7893000
heap
page read and write
7B70000
trusted library allocation
page read and write
79A2000
heap
page read and write
79BD000
heap
page read and write
313C000
heap
page read and write
2F57000
heap
page read and write
79D2000
heap
page read and write
79A7000
heap
page read and write
2E8A000
heap
page read and write
4F00000
remote allocation
page read and write
787B000
heap
page read and write
79ED000
heap
page read and write
79C9000
heap
page read and write
782A000
heap
page read and write
7CD0000
trusted library allocation
page read and write
4D50000
heap
page read and write
2F53000
heap
page read and write
787A000
heap
page read and write
79D1000
heap
page read and write
7CB0000
trusted library allocation
page read and write
2E6D000
heap
page read and write
79E3000
heap
page read and write
79B7000
heap
page read and write
1F0000
heap
page read and write
4F2D000
stack
page read and write
7976000
heap
page read and write
40F000
unkown
page readonly
79C9000
heap
page read and write
4E40000
remote allocation
page read and write
79CE000
heap
page read and write
796D000
heap
page read and write
79B5000
heap
page read and write
7968000
heap
page read and write
7859000
heap
page read and write
783B000
heap
page read and write
2F00000
heap
page read and write
2FF3000
heap
page read and write
711D000
stack
page read and write
797C000
heap
page read and write
7843000
heap
page read and write
7856000
heap
page read and write
79E3000
heap
page read and write
8420000
trusted library allocation
page read and write
2F4D000
heap
page read and write
2F10000
heap
page read and write
7893000
heap
page read and write
7B70000
trusted library allocation
page read and write
7960000
heap
page read and write
79BC000
heap
page read and write
7992000
heap
page read and write
79C3000
heap
page read and write
79C9000
heap
page read and write
330E000
stack
page read and write
79AA000
heap
page read and write
79A4000
heap
page read and write
79AF000
heap
page read and write
79B7000
heap
page read and write
7B70000
trusted library allocation
page read and write
7877000
heap
page read and write
2FFE000
heap
page read and write
300C000
heap
page execute and read and write
7840000
heap
page read and write
3140000
heap
page read and write
9B000
stack
page read and write
782C000
heap
page read and write
79DC000
heap
page read and write
7854000
heap
page read and write
7854000
heap
page read and write
79D1000
heap
page read and write
4C80000
remote allocation
page read and write
3143000
heap
page read and write
782C000
heap
page read and write
7CB0000
trusted library allocation
page read and write
7A09000
heap
page read and write
7992000
heap
page read and write
7CB0000
trusted library allocation
page read and write
7CD0000
remote allocation
page read and write
31BF000
stack
page read and write
2E9F000
heap
page read and write
7980000
remote allocation
page read and write
79C5000
heap
page read and write
72AE000
stack
page read and write
70AD000
stack
page read and write
7B70000
trusted library allocation
page read and write
2FCF000
unkown
page read and write
79A8000
heap
page read and write
400000
unkown
page readonly
79B7000
heap
page read and write
2E25000
heap
page read and write
7996000
heap
page read and write
19A000
stack
page read and write
7B70000
trusted library allocation
page read and write
4C90000
heap
page read and write
7CB0000
trusted library allocation
page read and write
79CA000
heap
page read and write
797A000
heap
page read and write
2EB0000
heap
page read and write
786C000
heap
page read and write
7861000
heap
page read and write
78A7000
heap
page read and write
79C4000
heap
page read and write
4C7D000
stack
page read and write
79C9000
heap
page read and write
4CDD000
stack
page read and write
798B000
heap
page read and write
79CF000
heap
page read and write
77F1000
heap
page read and write
79B2000
heap
page read and write
7930000
remote allocation
page read and write
79A2000
heap
page read and write
79AE000
heap
page read and write
77F7000
heap
page read and write
79A5000
heap
page read and write
7CB0000
trusted library allocation
page read and write
7854000
heap
page read and write
79D0000
heap
page read and write
79C9000
heap
page read and write
797F000
heap
page read and write
79A5000
heap
page read and write
2F3A000
heap
page read and write
7854000
heap
page read and write
784E000
heap
page read and write
7971000
heap
page read and write
2E7F000
heap
page read and write
64E000
stack
page read and write
4D50000
heap
page read and write
79B2000
heap
page read and write
783E000
heap
page read and write
422000
unkown
page readonly
2FE7000
heap
page read and write
797C000
heap
page read and write
7844000
heap
page read and write
7CB0000
trusted library allocation
page read and write
787E000
heap
page read and write
79A4000
heap
page read and write
7CB0000
trusted library allocation
page read and write
79C9000
heap
page read and write
2EA1000
heap
page read and write
79B7000
heap
page read and write
7869000
heap
page read and write
7A70000
remote allocation
page read and write
7860000
heap
page read and write
2EAD000
heap
page read and write
79E3000
heap
page read and write
79C9000
heap
page read and write
7854000
heap
page read and write
79F3000
heap
page read and write
7802000
heap
page read and write
79D1000
heap
page read and write
7997000
heap
page read and write
7986000
heap
page read and write
79AD000
heap
page read and write
6FCD000
stack
page read and write
4D9D000
stack
page read and write
7848000
heap
page read and write
7893000
heap
page read and write
79B3000
heap
page read and write
312B000
heap
page read and write
2EA3000
heap
page read and write
7856000
heap
page read and write
7981000
heap
page read and write
784E000
heap
page read and write
7950000
heap
page read and write
2E90000
heap
page read and write
79C4000
heap
page read and write
79FD000
heap
page read and write
79D0000
heap
page read and write
7968000
heap
page read and write
7854000
heap
page read and write
3143000
heap
page read and write
2E3E000
heap
page read and write
785C000
heap
page read and write
796C000
heap
page read and write
79D1000
heap
page read and write
796B000
heap
page read and write
7992000
heap
page read and write
797F000
heap
page read and write
19A000
stack
page read and write
784E000
heap
page read and write
7856000
heap
page read and write
313C000
heap
page read and write
788B000
heap
page read and write
2F0E000
heap
page read and write
7973000
heap
page read and write
309F000
heap
page read and write
2E3A000
heap
page read and write
794A000
heap
page read and write
2F0E000
heap
page read and write
7867000
heap
page read and write
79D6000
heap
page read and write
7968000
heap
page read and write
7930000
heap
page read and write
79CA000
heap
page read and write
79BC000
heap
page read and write
786C000
heap
page read and write
710E000
stack
page read and write
7B70000
trusted library allocation
page read and write
7843000
heap
page read and write
782A000
heap
page read and write
2F35000
heap
page read and write
79DD000
heap
page read and write
2E8A000
heap
page read and write
79BB000
heap
page read and write
7B70000
trusted library allocation
page read and write
570000
heap
page read and write
797F000
heap
page read and write
783B000
heap
page read and write
2EE1000
heap
page read and write
7988000
heap
page read and write
2E8E000
heap
page read and write
7967000
heap
page read and write
7996000
heap
page read and write
2E75000
heap
page read and write
7821000
heap
page read and write
334A000
heap
page read and write
79B8000
heap
page read and write
7821000
heap
page read and write
784E000
heap
page read and write
7B70000
trusted library allocation
page read and write
7856000
heap
page read and write
7996000
heap
page read and write
2E9D000
heap
page read and write
7960000
heap
page read and write
2F68000
heap
page read and write
7CB0000
trusted library allocation
page read and write
There are 1139 hidden memdumps, click here to show them.