IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\OfCx6VeglYVpWTwI9NddWAo.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Temp\dSyaNbAby9QXs4RBu3VN33H.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Temp\e_uwnYJDOrnylP4tGD1vKSo.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
modified
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_3b166e6571299cee7343626b59f7d7bbe157b8c9_45086259_c58001ed-2ce3-4e1e-9019-867a112921c2\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_3b166e6571299cee7343626b59f7d7bbe157b8c9_45086259_ccde6796-0630-43ad-93e5-81a73d475583\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RageMP131.exe_3b166e6571299cee7343626b59f7d7bbe157b8c9_45086259_dfa15fe3-4273-4d5b-97f7-438a6adc3f79\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4594c263b2b2fddaf2855c7efb1b922584ccf4c_804fa867_cf5d468c-292b-40ba-84bc-75df7a1336d9\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4594c263b2b2fddaf2855c7efb1b922584ccf4c_804fa867_fb3b76dc-3723-4c12-95a8-3eb742cb3382\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_1bea40c6-29f2-46a6-b131-6f75278ec17c\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_7468fa83-67cd-459b-9cbc-4c12e81c893a\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_8b113e4e-2225-4b05-80d3-ff5f486a2ef9\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_aa9cc303-3ec6-47f1-8d50-17d31237829f\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_b150831a-ad0d-4b32-98f8-831394925195\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_b8d96110-c9fb-424d-a33b-5f55f8d8ed4e\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_dc311b2a-bab5-4e6b-947c-da0882de2d5b\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
modified
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_e1758707-7d75-4927-bfcd-905886584b83\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4b4ed4d6f389ca52de2c98f49a78651fcbdf4a2_804fa867_f5f9e377-8adc-4276-a920-6dab30daf607\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DC0.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:12 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F09.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F58.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER31B8.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:13 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER32D2.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3311.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER365B.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:14 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3718.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3786.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3E98.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:16 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4030.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4060.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4976.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:19 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AFD.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B4C.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER53D6.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:22 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER56A6.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER56D6.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER65D7.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:27 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C70.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CBF.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6EFF.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:29 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7058.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER70C6.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER744E.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:30 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7653.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER76D1.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER80E1.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:33 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8382.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER844E.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8834.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:35 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER89FA.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A49.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8AE4.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:36 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C1D.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8C5D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8EDB.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:37 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FB7.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9016.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA69.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Apr 18 08:29:03 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4E.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC7E.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe39GtSuVzyOuE\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe39GtSuVzyOuE\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe39GtSuVzyOuE\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeIl1ZoQx5ZnY2\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeIl1ZoQx5ZnY2\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeIl1ZoQx5ZnY2\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobesyO6NvG6vZji\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobesyO6NvG6vZji\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobesyO6NvG6vZji\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\2_TMjP6pWvYDLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\9zMbGEqpE5COLogin Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\BOV292H0mxgEHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\FxAu1a1JDtB8Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\HeifOucJlv60Web Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\IcPAi7xok6iaHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\M94FW15qXt05Cookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\QkoBCD2tTFlpHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\eBt1v4cLiOqEWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\jTDil21rwmscLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\nXFtGKoHb21jHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\uHXLq2btT439Web Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\uYMQq4w30H95Web Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi39GtSuVzyOuE\weyqQCNm9HN2Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\2lqugrjeVJunWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\6_PbUyeA3kVjWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\AqkFZJnS_4eJHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\LZlzsFoefEVpHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\MKjdaszvj8XCLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\RY6RdEPM8E4dWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\TifxbkBvgKkFWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\ZTjqnM2lH92vCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\_yiJuL8xeLPXLogin Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\d4QTaPGdbj7gHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\fotzzxFskzb6Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\rWOqT1UkdTpuHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\rzThZlFR926oLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiIl1ZoQx5ZnY2\tcNWocR92MUuWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\8Mse1jO6nK1IWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\GUahzsMvIC8wHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\MBSHfyCuKHxNHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\MGPDw7uupP6KLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\NBCgMFNDNiM2Web Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\SjNa0HpZUcV6Login Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\ToLgTrDbYUcjWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\Tx9lIpMUG2zOWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\UyyA_zbRMLWeHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\W_RHKqX26M1cHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\_EJYNzOMy_83Login Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\hZAEvdPucF1VCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\ixjTP3QSda4xWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidisyO6NvG6vZji\yzmVLlOHIOgjWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\rage131MP.tmp
ASCII text, with no line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 116 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 784
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 960
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1008
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 996
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1020
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1416
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1828
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1848
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 820
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1808
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1940
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 940
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 1948
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7988 -s 952
There are 13 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://193.233.132.167/cost/lenin.exe
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://db-ip.com/demo/home.php?s=81.181.57.52j
unknown
http://147.45.47.102:57893/hera/amadka.exe
unknown
https://ipinfo.io/widget/demo/81.181.57.52$v
unknown
http://crl.mtO
unknown
https://db-ip.com/
unknown
http://193.233.132.167/cost/lenin.exese
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://t.me/risepro_botW
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://147.45.47.102:57893/hera/amadka.exeDatae
unknown
http://147.45.47.102:57893/hera/amadka.exe.52
unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52D)
unknown
https://ipinfo.io/widget/demo/81.181.57.52H)
unknown
http://193.233.132.167/cost/go.exe
unknown
http://147.45.47.102:57893/hera/amadka.exedatD
unknown
https://db-ip.com/demo/home.php?s=81.181.57.52gQ
unknown
https://db-ip.com/?
unknown
https://ipinfo.io/~
unknown
https://t.me/RiseProSUPPORTR
unknown
https://ipinfo.io:443/widget/demo/81.181.57.52
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://ipinfo.io/t
unknown
https://t.me/risepro_botisepro_bot
unknown
http://193.233.132.167/cost/go.exee
unknown
http://193.233.132.167/cost/lenin.exepro_botF
unknown
https://ipinfo.io/n
unknown
https://t.me/risepro_botrisepro
unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52r
unknown
https://t.me/risepro_bot.
unknown
https://db-ip.com/demo/home.php?s=81.181.57.525w
unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52
unknown
http://193.233.132.167/cost/go.exeoinxs
unknown
https://ipinfo.io/widget/demo/81.181.57.52.tmpW
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://t.me/RiseProSUPPORTS)
unknown
http://193.233.132.167/cost/lenin.exe192.168.0
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
https://t.me/RiseProSUPPORT
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://t.me/RiseProSUPPORT$
unknown
https://t.G
unknown
https://www.ecosia.org/newtab/
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://ipinfo.io/widget/demo/81.181.57.52
34.117.186.192
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://t.me/risepro_bot1.181.57.52
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://t.me/risepro_bot
unknown
http://193.233.132.167/cost/lenin.exe~
unknown
http://193.233.132.167/cost/go.exero
unknown
https://t.me/risepro_botlater
unknown
https://ipinfo.io/
unknown
https://db-ip.com/demo/home.php?s=81.181.57.52
104.26.4.15
https://www.maxmind.com/en/locate-my-ip-address
unknown
http://www.winimage.com/zLibDll
unknown
https://support.mozilla.org
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
http://147.45.47.102:57893/hera/amadka.exe_prof
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://www.winimage.com/zLibDllDpRTpR
unknown
There are 57 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ipinfo.io
34.117.186.192
db-ip.com
104.26.4.15

IPs

IP
Domain
Country
Malicious
147.45.47.93
unknown
Russian Federation
malicious
34.117.186.192
ipinfo.io
United States
104.26.4.15
db-ip.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RageMP131
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProgramId
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
FileId
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LowerCaseLongPath
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LongPathHash
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Name
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
OriginalFileName
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Publisher
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Version
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinFileVersion
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinaryType
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductName
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductVersion
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LinkDate
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinProductVersion
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageFullName
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageRelativeId
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Size
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Language
\REGISTRY\A\{83f8ddd2-0229-5ac6-e7a6-ae7565d8dba3}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Usn
There are 10 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
7A99000
heap
page read and write
 malicious
4C20000
direct allocation
page read and write
 malicious
4900000
direct allocation
page execute and read and write
 malicious
4AD0000
direct allocation
page execute and read and write
 malicious
4A60000
direct allocation
page read and write
 malicious
7A6D000
heap
page read and write
 malicious
7A6D000
heap
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
2F47000
heap
page read and write
 malicious
4A10000
direct allocation
page read and write
 malicious
4C30000
direct allocation
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
302E000
heap
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
400000
unkown
page execute and read and write
 malicious
7A40000
heap
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
4AC0000
direct allocation
page execute and read and write
 malicious
48B0000
direct allocation
page execute and read and write
 malicious
4C40000
direct allocation
page read and write
 malicious
4AE0000
direct allocation
page execute and read and write
 malicious
2F7E000
heap
page read and write
 malicious
7A40000
heap
page read and write
 malicious
19A000
stack
page read and write
7A98000
heap
page read and write
7ADE000
heap
page read and write
7A6D000
heap
page read and write
7A83000
heap
page read and write
7AF9000
heap
page read and write
2FEE000
heap
page read and write
302A000
heap
page read and write
7AAB000
heap
page read and write
7ABA000
heap
page read and write
7ADD000
heap
page read and write
7AEE000
heap
page read and write
4F60000
remote allocation
page read and write
7DD0000
trusted library allocation
page read and write
7AC5000
heap
page read and write
2DBA000
unkown
page readonly
305D000
heap
page read and write
7AAB000
heap
page read and write
7DD0000
trusted library allocation
page read and write
3116000
heap
page read and write
747E000
stack
page read and write
7A8C000
heap
page read and write
7AD5000
heap
page read and write
3058000
heap
page read and write
30E9000
heap
page read and write
7A9B000
heap
page read and write
7A9A000
heap
page read and write
4A1C000
heap
page execute and read and write
7A3E000
stack
page read and write
2E38000
heap
page read and write
6FFE000
stack
page read and write
7AC6000
heap
page read and write
310E000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A88000
heap
page read and write
311C000
heap
page read and write
7A88000
heap
page read and write
7A82000
heap
page read and write
7ADA000
heap
page read and write
7AFA000
heap
page read and write
7ABB000
heap
page read and write
78FE000
stack
page read and write
7DD0000
trusted library allocation
page read and write
7A7F000
heap
page read and write
7ABB000
heap
page read and write
7A84000
heap
page read and write
3062000
heap
page read and write
3116000
heap
page read and write
7A9F000
heap
page read and write
3058000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A8F000
heap
page read and write
19A000
stack
page read and write
7A8A000
heap
page read and write
2E58000
heap
page read and write
7A4D000
heap
page read and write
7A7D000
heap
page read and write
7A91000
heap
page read and write
8540000
trusted library allocation
page read and write
7ABD000
heap
page read and write
4F30000
heap
page read and write
2E2A000
heap
page read and write
7AEB000
heap
page read and write
7DD0000
trusted library allocation
page read and write
713D000
stack
page read and write
2FCC000
heap
page read and write
3026000
heap
page read and write
7A86000
heap
page read and write
7A50000
heap
page read and write
41A000
unkown
page readonly
7AF2000
heap
page read and write
2E5E000
heap
page read and write
308A000
heap
page read and write
7AA1000
heap
page read and write
7AA5000
heap
page read and write
9EF000
unkown
page read and write
2DD0000
heap
page read and write
7A9C000
heap
page read and write
7A93000
heap
page read and write
7AAB000
heap
page read and write
7AB7000
heap
page read and write
7A86000
heap
page read and write
7A87000
heap
page read and write
7AA5000
heap
page read and write
7AB2000
heap
page read and write
4B4E000
stack
page read and write
7AA5000
heap
page read and write
7AB2000
heap
page read and write
401000
unkown
page execute read
7ABB000
heap
page read and write
7AC3000
heap
page read and write
7AEB000
heap
page read and write
331F000
stack
page read and write
7A7D000
heap
page read and write
7AC2000
heap
page read and write
3093000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A80000
heap
page read and write
2E6E000
stack
page read and write
4E80000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A8A000
heap
page read and write
7A95000
heap
page read and write
7AC9000
heap
page read and write
7B05000
heap
page read and write
7AA5000
heap
page read and write
730E000
stack
page read and write
7DD0000
trusted library allocation
page read and write
7AA5000
heap
page read and write
7A6C000
heap
page read and write
7A88000
heap
page read and write
7A7D000
heap
page read and write
2E6A000
heap
page read and write
4E30000
heap
page read and write
7AEC000
heap
page read and write
780D000
stack
page read and write
4CA0000
heap
page read and write
7A8A000
heap
page read and write
2FB6000
heap
page read and write
3025000
heap
page read and write
2FA0000
heap
page read and write
7AAE000
heap
page read and write
2E30000
heap
page read and write
2F8A000
heap
page read and write
2F6E000
heap
page read and write
303A000
heap
page read and write
720D000
stack
page read and write
7A6D000
heap
page read and write
7A73000
heap
page read and write
7AA6000
heap
page read and write
7AA8000
heap
page read and write
7A8C000
heap
page read and write
7A8A000
heap
page read and write
7A91000
heap
page read and write
7ACF000
heap
page read and write
316F000
stack
page read and write
7A88000
heap
page read and write
7AD9000
heap
page read and write
7B05000
heap
page read and write
7A41000
heap
page read and write
7A7F000
heap
page read and write
2F37000
heap
page read and write
7ABF000
heap
page read and write
310D000
heap
page read and write
7A5C000
heap
page read and write
7A43000
heap
page read and write
7ABB000
heap
page read and write
7A4E000
stack
page read and write
314A000
heap
page read and write
311A000
heap
page read and write
7ADC000
heap
page read and write
302D000
heap
page read and write
2FA8000
heap
page read and write
7AC3000
heap
page read and write
3028000
heap
page read and write
7A73000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A7F000
heap
page read and write
7AA5000
heap
page read and write
7A7D000
heap
page read and write
7A64000
heap
page read and write
7AD4000
heap
page read and write
7A92000
heap
page read and write
7ACE000
heap
page read and write
4ED0000
heap
page read and write
7AEB000
heap
page read and write
7AAB000
heap
page read and write
71FD000
stack
page read and write
7A6D000
heap
page read and write
7A7E000
heap
page read and write
424000
unkown
page write copy
2FF6000
heap
page read and write
7AB3000
heap
page read and write
7AA3000
heap
page read and write
7AAB000
heap
page read and write
7A9C000
heap
page read and write
30DF000
heap
page read and write
7A3E000
stack
page read and write
7A82000
heap
page read and write
4D27000
heap
page read and write
747E000
stack
page read and write
7A9B000
heap
page read and write
7AA5000
heap
page read and write
1E0000
heap
page read and write
7ABC000
heap
page read and write
7AC8000
heap
page read and write
3039000
heap
page read and write
7DD0000
trusted library allocation
page read and write
303B000
heap
page read and write
7A8A000
heap
page read and write
7AA5000
heap
page read and write
7AAB000
heap
page read and write
4CDD000
stack
page read and write
7AEC000
heap
page read and write
4A1F000
stack
page read and write
7AB0000
heap
page read and write
310C000
heap
page read and write
18D000
stack
page read and write
7ABB000
heap
page read and write
7A8A000
heap
page read and write
7A91000
heap
page read and write
2FEB000
heap
page read and write
7A8F000
heap
page read and write
7A50000
heap
page read and write
7A64000
heap
page read and write
7A8C000
heap
page read and write
7AA5000
heap
page read and write
747E000
stack
page read and write
7A91000
heap
page read and write
302A000
heap
page read and write
7A9B000
heap
page read and write
7A95000
heap
page read and write
7A88000
heap
page read and write
7AA5000
heap
page read and write
7ABF000
heap
page read and write
7AB0000
heap
page read and write
793D000
stack
page read and write
313E000
heap
page read and write
7A89000
heap
page read and write
7A7D000
heap
page read and write
70DD000
stack
page read and write
2F9D000
heap
page read and write
3020000
heap
page read and write
30CF000
heap
page read and write
7AB2000
heap
page read and write
7A88000
heap
page read and write
7A8C000
heap
page read and write
7AAB000
heap
page read and write
708D000
stack
page read and write
2FB3000
heap
page read and write
4C80000
heap
page read and write
794D000
stack
page read and write
7A64000
heap
page read and write
7A8E000
heap
page read and write
7A9E000
heap
page read and write
7AB2000
heap
page read and write
7A50000
heap
page read and write
7A93000
heap
page read and write
7AD9000
heap
page read and write
7A86000
heap
page read and write
2E90000
heap
page read and write
7AF2000
heap
page read and write
2F7A000
heap
page read and write
7A82000
heap
page read and write
2FA8000
heap
page read and write
78FE000
stack
page read and write
7AAB000
heap
page read and write
7AA1000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A9A000
heap
page read and write
7ABB000
heap
page read and write
2E4E000
heap
page read and write
9B000
stack
page read and write
7ACA000
heap
page read and write
2FDA000
heap
page read and write
7A80000
heap
page read and write
7A94000
heap
page read and write
7A75000
heap
page read and write
7A88000
heap
page read and write
7AA1000
heap
page read and write
7A91000
heap
page read and write
3002000
heap
page read and write
7A98000
heap
page read and write
7AAE000
heap
page read and write
308E000
heap
page read and write
3063000
heap
page read and write
7A8C000
heap
page read and write
7A94000
heap
page read and write
70BD000
stack
page read and write
4C10000
heap
page read and write
19B000
stack
page read and write
2C40000
heap
page read and write
7AA5000
heap
page read and write
7AB3000
heap
page read and write
7A88000
heap
page read and write
4E2D000
stack
page read and write
7A95000
heap
page read and write
2F55000
heap
page read and write
2FF6000
heap
page read and write
3410000
heap
page read and write
30A4000
heap
page read and write
723D000
stack
page read and write
4E9D000
stack
page read and write
401000
unkown
page execute read
7ACF000
heap
page read and write
7AAB000
heap
page read and write
7A91000
heap
page read and write
7AED000
heap
page read and write
7ABD000
heap
page read and write
7AA6000
heap
page read and write
2FC9000
heap
page read and write
7A70000
heap
page read and write
7AA1000
heap
page read and write
7A91000
heap
page read and write
7ADE000
heap
page read and write
7470000
remote allocation
page read and write
78FE000
stack
page read and write
5ED000
stack
page read and write
2DB9000
unkown
page read and write
305B000
heap
page read and write
7A8F000
heap
page read and write
7A83000
heap
page read and write
7AAB000
heap
page read and write
7A9A000
heap
page read and write
7AF1000
heap
page read and write
30AA000
heap
page read and write
400000
unkown
page readonly
2FEE000
heap
page read and write
357E000
unkown
page read and write
7AEE000
heap
page read and write
30B6000
heap
page read and write
77FD000
stack
page read and write
2DB9000
unkown
page read and write
7A9B000
heap
page read and write
7A88000
heap
page read and write
7A90000
heap
page read and write
310D000
heap
page read and write
7AA3000
heap
page read and write
71CE000
stack
page read and write
4CF0000
heap
page read and write
7ACA000
heap
page read and write
2FF6000
heap
page read and write
3028000
heap
page read and write
7A8A000
heap
page read and write
41A000
unkown
page readonly
7ACC000
heap
page read and write
30B6000
heap
page read and write
7A88000
heap
page read and write
7ABD000
heap
page read and write
3116000
heap
page read and write
77FD000
stack
page read and write
7AA5000
heap
page read and write
793D000
stack
page read and write
2E58000
heap
page read and write
7AEA000
heap
page read and write
7A7D000
heap
page read and write
3116000
heap
page read and write
2F50000
heap
page read and write
310D000
heap
page read and write
7AB3000
heap
page read and write
7A43000
heap
page read and write
3063000
heap
page read and write
71FD000
stack
page read and write
7A64000
heap
page read and write
7A43000
heap
page read and write
30FE000
heap
page read and write
2F30000
heap
page read and write
7A74000
heap
page read and write
7A88000
heap
page read and write
7A8A000
heap
page read and write
306C000
heap
page read and write
7AC5000
heap
page read and write
2E50000
heap
page read and write
7ACD000
heap
page read and write
30D0000
heap
page read and write
4F70000
heap
page read and write
7A73000
heap
page read and write
7AB9000
heap
page read and write
401000
unkown
page execute read
7A99000
heap
page read and write
7A82000
heap
page read and write
7A6E000
heap
page read and write
7AD0000
heap
page read and write
7A5C000
heap
page read and write
7AFD000
heap
page read and write
3060000
heap
page read and write
7A7D000
heap
page read and write
7AA5000
heap
page read and write
7A8F000
heap
page read and write
7AEB000
heap
page read and write
7AAB000
heap
page read and write
7AAB000
heap
page read and write
7AB5000
heap
page read and write
7A88000
heap
page read and write
7ABA000
heap
page read and write
7AC1000
heap
page read and write
7A41000
heap
page read and write
7A92000
heap
page read and write
2FFE000
heap
page read and write
30A0000
heap
page read and write
7A86000
heap
page read and write
7AED000
heap
page read and write
7ACA000
heap
page read and write
7A7F000
heap
page read and write
2DE0000
heap
page read and write
2F80000
heap
page read and write
4D3D000
stack
page read and write
7A9A000
heap
page read and write
7AF9000
heap
page read and write
7A5D000
heap
page read and write
7A8A000
heap
page read and write
1F0000
heap
page read and write
7AC4000
heap
page read and write
7AAB000
heap
page read and write
7AD0000
heap
page read and write
7AFD000
heap
page read and write
2DBA000
unkown
page readonly
7A88000
heap
page read and write
4F60000
remote allocation
page read and write
7A7F000
heap
page read and write
30D8000
heap
page read and write
2E1E000
stack
page read and write
2EAC000
heap
page read and write
7AAA000
heap
page read and write
305A000
heap
page read and write
7AA5000
heap
page read and write
311C000
heap
page read and write
1F0000
heap
page read and write
7A91000
heap
page read and write
A00000
heap
page read and write
4B0F000
stack
page read and write
2FFD000
heap
page read and write
7A87000
heap
page read and write
7A44000
heap
page read and write
2EC2000
heap
page read and write
7A73000
heap
page read and write
7DD0000
trusted library allocation
page read and write
42A000
unkown
page write copy
6F3E000
stack
page read and write
703E000
stack
page read and write
424000
unkown
page write copy
305A000
heap
page read and write
7A80000
heap
page read and write
7AF0000
heap
page read and write
7470000
remote allocation
page read and write
4C90000
heap
page read and write
7ABD000
heap
page read and write
7AAE000
heap
page read and write
363E000
stack
page read and write
2EA0000
heap
page read and write
2FF6000
heap
page read and write
3028000
heap
page read and write
7A41000
heap
page read and write
2EEE000
stack
page read and write
7AA5000
heap
page read and write
7ACE000
heap
page read and write
7A93000
heap
page read and write
7A88000
heap
page read and write
7AF9000
heap
page read and write
8441000
heap
page read and write
7A9F000
heap
page read and write
7A73000
heap
page read and write
2FBD000
heap
page read and write
7AAB000
heap
page read and write
4F20000
remote allocation
page read and write
1F0000
heap
page read and write
7DD0000
trusted library allocation
page read and write
30FE000
heap
page read and write
7A9C000
heap
page read and write
7A8C000
heap
page read and write
7A5B000
heap
page read and write
7AB8000
heap
page read and write
7A7D000
heap
page read and write
7AC2000
heap
page read and write
7A8C000
heap
page read and write
737D000
stack
page read and write
7A8A000
heap
page read and write
7A80000
heap
page read and write
7ABF000
heap
page read and write
3071000
heap
page read and write
4CE0000
heap
page read and write
7A8F000
heap
page read and write
7A60000
heap
page read and write
7A7D000
heap
page read and write
7A47000
heap
page read and write
7A93000
heap
page read and write
7ACA000
heap
page read and write
2ED2000
heap
page read and write
3073000
heap
page read and write
2F9E000
heap
page read and write
304D000
heap
page read and write
7ABD000
heap
page read and write
7A7F000
heap
page read and write
7ADC000
heap
page read and write
7ABB000
heap
page read and write
7A8A000
heap
page read and write
7ABA000
heap
page read and write
7AA8000
heap
page read and write
7AF3000
heap
page read and write
7A82000
heap
page read and write
7A9A000
heap
page read and write
7480000
remote allocation
page read and write
7AF9000
heap
page read and write
8440000
heap
page read and write
7ADE000
heap
page read and write
30C8000
heap
page read and write
7AC4000
heap
page read and write
7AA1000
heap
page read and write
7AA4000
heap
page read and write
7ABE000
heap
page read and write
3025000
heap
page read and write
4D59000
heap
page read and write
30FE000
heap
page read and write
7A57000
heap
page read and write
7AB7000
heap
page read and write
7AAB000
heap
page read and write
41A000
unkown
page readonly
7AD6000
heap
page read and write
7AA0000
heap
page read and write
7A97000
heap
page read and write
4D81000
heap
page read and write
30B6000
heap
page read and write
7AB4000
heap
page read and write
2E45000
heap
page read and write
3400000
heap
page read and write
7AA8000
heap
page read and write
7AC4000
heap
page read and write
7AC1000
heap
page read and write
3023000
heap
page read and write
7A98000
heap
page read and write
35FE000
stack
page read and write
2E1E000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7DD0000
trusted library allocation
page read and write
745E000
stack
page read and write
7AC7000
heap
page read and write
7A8E000
heap
page read and write
7A7D000
heap
page read and write
3028000
heap
page read and write
7A64000
heap
page read and write
7A9C000
heap
page read and write
7A88000
heap
page read and write
2E56000
heap
page read and write
424000
unkown
page write copy
7A9F000
heap
page read and write
3440000
heap
page read and write
7AEE000
heap
page read and write
2E3A000
heap
page read and write
7A7D000
heap
page read and write
313F000
stack
page read and write
7A93000
heap
page read and write
7A73000
heap
page read and write
30A7000
heap
page read and write
7AA1000
heap
page read and write
2FA7000
heap
page read and write
7AB2000
heap
page read and write
7AAB000
heap
page read and write
7A6C000
heap
page read and write
7A96000
heap
page read and write
4CFF000
heap
page read and write
707D000
stack
page read and write
7ABC000
heap
page read and write
7A43000
heap
page read and write
311C000
heap
page read and write
7AC3000
heap
page read and write
7AB0000
heap
page read and write
7AA6000
heap
page read and write
7AD6000
heap
page read and write
7A50000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7AF2000
heap
page read and write
4B5F000
stack
page read and write
30B1000
heap
page read and write
7A91000
heap
page read and write
7ACA000
heap
page read and write
7A90000
heap
page read and write
7A41000
heap
page read and write
2FE4000
heap
page read and write
7A91000
heap
page read and write
7AB0000
heap
page read and write
35BF000
unkown
page read and write
302C000
heap
page read and write
7A9A000
heap
page read and write
7AC3000
heap
page read and write
7AAC000
heap
page read and write
7AA5000
heap
page read and write
733E000
stack
page read and write
7AA1000
heap
page read and write
7AEE000
heap
page read and write
7AC3000
heap
page read and write
7A88000
heap
page read and write
3116000
heap
page read and write
7A91000
heap
page read and write
3320000
heap
page read and write
30B6000
heap
page read and write
7AC0000
heap
page read and write
7A8F000
heap
page read and write
7AAE000
heap
page read and write
7A82000
heap
page read and write
7A7F000
heap
page read and write
2FA2000
heap
page read and write
7A88000
heap
page read and write
7A8A000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A64000
heap
page read and write
327D000
stack
page read and write
7A82000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7AAB000
heap
page read and write
4EE0000
remote allocation
page read and write
4E8D000
stack
page read and write
7AAB000
heap
page read and write
310C000
heap
page read and write
7AB7000
heap
page read and write
7ABD000
heap
page read and write
723D000
stack
page read and write
3067000
heap
page read and write
7A43000
heap
page read and write
2E47000
heap
page read and write
2ADF000
stack
page read and write
4E5D000
stack
page read and write
2FEE000
heap
page read and write
2FC4000
heap
page read and write
311C000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A72000
heap
page read and write
7A6D000
heap
page read and write
7A45000
heap
page read and write
7A8C000
heap
page read and write
7AB0000
heap
page read and write
3025000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7DD0000
trusted library allocation
page read and write
2F30000
heap
page read and write
7A80000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7AA7000
heap
page read and write
7A82000
heap
page read and write
7AAD000
heap
page read and write
7A73000
heap
page read and write
7A8A000
heap
page read and write
7A93000
heap
page read and write
311C000
heap
page read and write
2FEE000
heap
page read and write
3028000
heap
page read and write
7AC6000
heap
page read and write
2DBA000
unkown
page readonly
7ADD000
heap
page read and write
2FBB000
heap
page read and write
30B2000
heap
page read and write
733E000
stack
page read and write
30FE000
heap
page read and write
7AB9000
heap
page read and write
793D000
stack
page read and write
7A6D000
heap
page read and write
401000
unkown
page execute read
6FBD000
stack
page read and write
424000
unkown
page write copy
790E000
stack
page read and write
37D0000
heap
page read and write
3116000
heap
page read and write
2F51000
heap
page execute and read and write
321F000
stack
page read and write
7AD4000
heap
page read and write
7AC0000
heap
page read and write
7A7D000
heap
page read and write
302A000
heap
page read and write
7ADE000
heap
page read and write
3028000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7AB0000
heap
page read and write
735D000
stack
page read and write
7A82000
heap
page read and write
2F40000
heap
page read and write
30CA000
heap
page read and write
2F2E000
stack
page read and write
7A88000
heap
page read and write
8540000
trusted library allocation
page read and write
3023000
heap
page read and write
7A65000
heap
page read and write
3029000
heap
page read and write
30B4000
heap
page read and write
400000
unkown
page readonly
7A4A000
heap
page read and write
7AF0000
heap
page read and write
7A91000
heap
page read and write
3065000
heap
page read and write
4D2F000
heap
page read and write
7ACD000
heap
page read and write
7ACD000
heap
page read and write
8441000
heap
page read and write
7AF1000
heap
page read and write
4C70000
heap
page read and write
2FFD000
heap
page read and write
737D000
stack
page read and write
7AB8000
heap
page read and write
32BA000
stack
page read and write
7AE9000
heap
page read and write
7ADF000
heap
page read and write
7AA5000
heap
page read and write
3053000
heap
page read and write
7A8F000
heap
page read and write
7AA4000
heap
page read and write
7AE7000
heap
page read and write
7AEB000
heap
page read and write
7AAB000
heap
page read and write
7A99000
heap
page read and write
2F88000
heap
page read and write
7A9F000
heap
page read and write
7A82000
heap
page read and write
401000
unkown
page execute read
7AAE000
heap
page read and write
7AB3000
heap
page read and write
7AA5000
heap
page read and write
7AC4000
heap
page read and write
7A64000
heap
page read and write
7AC2000
heap
page read and write
3024000
heap
page read and write
7A8F000
heap
page read and write
1E5000
heap
page read and write
7AAF000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7AA8000
heap
page read and write
7AB0000
heap
page read and write
7A91000
heap
page read and write
2E27000
heap
page read and write
7AD9000
heap
page read and write
3039000
heap
page read and write
7A98000
heap
page read and write
42A000
unkown
page write copy
4D40000
heap
page read and write
2F95000
heap
page read and write
7A9C000
heap
page read and write
7AB6000
heap
page read and write
42A000
unkown
page write copy
7A84000
heap
page read and write
7A6D000
heap
page read and write
7A60000
heap
page read and write
7AA0000
heap
page read and write
2E97000
heap
page read and write
7AA5000
heap
page read and write
400000
unkown
page readonly
400000
unkown
page readonly
7AEA000
heap
page read and write
302A000
heap
page read and write
7ACD000
heap
page read and write
311E000
heap
page read and write
7A64000
heap
page read and write
7ACE000
heap
page read and write
6F8E000
stack
page read and write
7DD0000
trusted library allocation
page read and write
7ABB000
heap
page read and write
7AF0000
heap
page read and write
7A86000
heap
page read and write
7A88000
heap
page read and write
344B000
heap
page read and write
7AB7000
heap
page read and write
7A7D000
heap
page read and write
7ABC000
heap
page read and write
2E40000
heap
page read and write
3036000
heap
page read and write
303B000
heap
page read and write
7AB3000
heap
page read and write
7A94000
heap
page read and write
7AE9000
heap
page read and write
4D2E000
heap
page read and write
7ACD000
heap
page read and write
4C60000
heap
page read and write
2FAF000
heap
page read and write
70CD000
stack
page read and write
7A99000
heap
page read and write
7A88000
heap
page read and write
306E000
heap
page read and write
4BFD000
stack
page read and write
2DF0000
heap
page read and write
7A43000
heap
page read and write
7AC2000
heap
page read and write
9B000
stack
page read and write
7A3E000
stack
page read and write
4EE0000
remote allocation
page read and write
30CE000
stack
page read and write
7A7D000
heap
page read and write
7AA5000
heap
page read and write
7A62000
heap
page read and write
7A62000
heap
page read and write
41A000
unkown
page readonly
7DD0000
trusted library allocation
page read and write
7AAB000
heap
page read and write
2E95000
heap
page read and write
7A73000
heap
page read and write
7AF9000
heap
page read and write
4F20000
remote allocation
page read and write
7AA6000
heap
page read and write
7AFA000
heap
page read and write
2E40000
heap
page read and write
2E3C000
heap
page read and write
7A92000
heap
page read and write
7A9B000
heap
page read and write
7AA8000
heap
page read and write
3036000
heap
page read and write
7A7F000
heap
page read and write
4E7D000
stack
page read and write
2FE2000
heap
page read and write
7AA6000
heap
page read and write
9AE000
unkown
page read and write
7DD0000
trusted library allocation
page read and write
7AB9000
heap
page read and write
7AC2000
heap
page read and write
7A8A000
heap
page read and write
8540000
trusted library allocation
page read and write
733E000
stack
page read and write
3020000
heap
page read and write
7A92000
heap
page read and write
2F90000
heap
page read and write
30BA000
heap
page read and write
7A80000
heap
page read and write
734D000
stack
page read and write
7DD0000
trusted library allocation
page read and write
7A73000
heap
page read and write
424000
unkown
page write copy
7A73000
heap
page read and write
7A7D000
heap
page read and write
7AC7000
heap
page read and write
9B000
stack
page read and write
19A000
stack
page read and write
7A7F000
heap
page read and write
4F00000
heap
page read and write
7AAB000
heap
page read and write
7A86000
heap
page read and write
7A91000
heap
page read and write
2EEE000
stack
page read and write
7AC0000
heap
page read and write
310C000
heap
page read and write
7DD0000
trusted library allocation
page read and write
737D000
stack
page read and write
7AD4000
heap
page read and write
3023000
heap
page read and write
310D000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7DD0000
trusted library allocation
page read and write
3093000
heap
page read and write
78FE000
stack
page read and write
7AB9000
heap
page read and write
19B000
stack
page read and write
70FD000
stack
page read and write
311E000
heap
page read and write
7ABF000
heap
page read and write
7AAB000
heap
page read and write
7AA5000
heap
page read and write
1F0000
heap
page read and write
9B000
stack
page read and write
2FEF000
heap
page read and write
7AA5000
heap
page read and write
4D07000
heap
page read and write
7ACD000
heap
page read and write
7AA4000
heap
page read and write
7AD4000
heap
page read and write
7A89000
heap
page read and write
18D000
stack
page read and write
2FC6000
heap
page read and write
7480000
remote allocation
page read and write
7ADE000
heap
page read and write
302A000
heap
page read and write
3128000
heap
page read and write
7B05000
heap
page read and write
7AB6000
heap
page read and write
7ACE000
heap
page read and write
2EA0000
heap
page read and write
7AED000
heap
page read and write
4E10000
heap
page read and write
7AB0000
heap
page read and write
7AC2000
heap
page read and write
307B000
heap
page read and write
7AB0000
heap
page read and write
4EED000
stack
page read and write
7AB2000
heap
page read and write
4D1F000
stack
page read and write
7A83000
heap
page read and write
2F77000
heap
page read and write
306A000
heap
page read and write
83A000
stack
page read and write
4E3D000
stack
page read and write
4C70000
heap
page read and write
7A92000
heap
page read and write
302A000
heap
page read and write
7ABA000
heap
page read and write
7A6D000
heap
page read and write
7AB0000
heap
page read and write
2FBB000
heap
page read and write
7AC0000
heap
page read and write
2F70000
heap
page read and write
3032000
heap
page read and write
7A67000
heap
page read and write
7ABB000
heap
page read and write
7ACE000
heap
page read and write
7A93000
heap
page read and write
6F7D000
stack
page read and write
2DD0000
heap
page read and write
7AE7000
heap
page read and write
7AAB000
heap
page read and write
7A88000
heap
page read and write
7AB7000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A9B000
heap
page read and write
7AAB000
heap
page read and write
3002000
heap
page read and write
723E000
stack
page read and write
7AB1000
heap
page read and write
7A75000
heap
page read and write
4F20000
remote allocation
page read and write
7A52000
heap
page read and write
7AA5000
heap
page read and write
7A88000
heap
page read and write
311C000
heap
page read and write
7A7F000
heap
page read and write
7A9B000
heap
page read and write
7A93000
heap
page read and write
7A8F000
heap
page read and write
7DD0000
trusted library allocation
page read and write
306A000
heap
page read and write
7AEE000
heap
page read and write
2DBA000
unkown
page readonly
7A94000
heap
page read and write
7AC7000
heap
page read and write
2FCE000
heap
page execute and read and write
9F0000
heap
page read and write
18D000
stack
page read and write
2DF7000
heap
page read and write
7A80000
heap
page read and write
2FC6000
heap
page read and write
310D000
heap
page read and write
7A6D000
heap
page read and write
77FD000
stack
page read and write
7AD9000
heap
page read and write
7AC7000
heap
page read and write
7ABE000
heap
page read and write
7AA5000
heap
page read and write
2F3E000
stack
page read and write
2E0E000
stack
page read and write
7DD0000
trusted library allocation
page read and write
7470000
remote allocation
page read and write
2E10000
heap
page read and write
7A64000
heap
page read and write
4D09000
heap
page read and write
7AC6000
heap
page read and write
4A0F000
stack
page read and write
793D000
stack
page read and write
7A98000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7480000
remote allocation
page read and write
7AA4000
heap
page read and write
306E000
heap
page read and write
4F60000
remote allocation
page read and write
7A8A000
heap
page read and write
7A3E000
stack
page read and write
3037000
heap
page read and write
8421000
heap
page read and write
70FE000
stack
page read and write
2FAC000
heap
page read and write
7DD0000
trusted library allocation
page read and write
4EF0000
heap
page read and write
7AC4000
heap
page read and write
4D56000
heap
page read and write
9B000
stack
page read and write
2DB9000
unkown
page read and write
7A8F000
heap
page read and write
7AD5000
heap
page read and write
311E000
heap
page read and write
3116000
heap
page read and write
7ABF000
heap
page read and write
7AB1000
heap
page read and write
7AAD000
heap
page read and write
3002000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A6A000
heap
page read and write
2F7A000
heap
page read and write
7AA8000
heap
page read and write
7AA0000
heap
page read and write
7AC7000
heap
page read and write
7AA2000
heap
page read and write
2DBA000
unkown
page readonly
731E000
stack
page read and write
491E000
stack
page read and write
2FF6000
heap
page read and write
310C000
heap
page read and write
7AC0000
heap
page read and write
7A49000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A98000
heap
page read and write
3058000
heap
page read and write
7A98000
heap
page read and write
7ABE000
heap
page read and write
7A73000
heap
page read and write
4F5E000
stack
page read and write
7ACE000
heap
page read and write
7A9F000
heap
page read and write
7A88000
heap
page read and write
41A000
unkown
page readonly
3097000
heap
page read and write
7A72000
heap
page read and write
7AA8000
heap
page read and write
7A7F000
heap
page read and write
7A46000
heap
page read and write
7A80000
heap
page read and write
7A9F000
heap
page read and write
7A64000
heap
page read and write
309A000
heap
page read and write
7AA5000
heap
page read and write
7A93000
heap
page read and write
7A40000
heap
page read and write
7A73000
heap
page read and write
3069000
heap
page read and write
7A58000
heap
page read and write
7AEB000
heap
page read and write
7DD0000
trusted library allocation
page read and write
2FAF000
heap
page read and write
301C000
heap
page read and write
7A83000
heap
page read and write
7AAA000
heap
page read and write
2F65000
heap
page execute and read and write
30B2000
heap
page read and write
7A7F000
heap
page read and write
7AC8000
heap
page read and write
7A62000
heap
page read and write
2F35000
heap
page read and write
7AAC000
heap
page read and write
7AB9000
heap
page read and write
7DD0000
trusted library allocation
page read and write
7A91000
heap
page read and write
7A91000
heap
page read and write
77FD000
stack
page read and write
7DD0000
trusted library allocation
page read and write
7AC6000
heap
page read and write
7A91000
heap
page read and write
2DBA000
unkown
page readonly
7AB7000
heap
page read and write
2DB9000
unkown
page read and write
7AA0000
heap
page read and write
400000
unkown
page readonly
2FDC000
heap
page read and write
7A70000
heap
page read and write
7A8F000
heap
page read and write
3078000
heap
page read and write
8440000
heap
page read and write
3064000
heap
page read and write
721D000
stack
page read and write
2C4B000
heap
page read and write
7A9D000
heap
page read and write
890000
heap
page read and write
7AFA000
heap
page read and write
303B000
heap
page read and write
30DD000
heap
page read and write
7A82000
heap
page read and write
2DB9000
unkown
page read and write
7DD0000
trusted library allocation
page read and write
7ABD000
heap
page read and write
7ABA000
heap
page read and write
2DBA000
unkown
page readonly
7AA1000
heap
page read and write
306E000
heap
page read and write
4E5D000
stack
page read and write
7A94000
heap
page read and write
7AA5000
heap
page read and write
2A9E000
stack
page read and write
2DBA000
unkown
page readonly
4A22000
heap
page execute and read and write
42A000
unkown
page write copy
7A73000
heap
page read and write
30B1000
heap
page read and write
7AF9000
heap
page read and write
4C4F000
stack
page read and write
7A57000
heap
page read and write
305C000
heap
page read and write
4EE0000
remote allocation
page read and write
7AFE000
heap
page read and write
7AA8000
heap
page read and write
2DBA000
unkown
page readonly
7A80000
heap
page read and write
7A91000
heap
page read and write
7A93000
heap
page read and write
2E70000
heap
page read and write
7AAC000
heap
page read and write
42A000
unkown
page write copy
71DE000
stack
page read and write
4D31000
heap
page read and write
3025000
heap
page read and write
7AA6000
heap
page read and write
2DBA000
unkown
page readonly
7AA9000
heap
page read and write
302B000
heap
page read and write
8420000
heap
page read and write
7A8F000
heap
page read and write
3031000
heap
page read and write
744E000
stack
page read and write
7DD0000
trusted library allocation
page read and write
7DD0000
trusted library allocation
page read and write
2E35000
heap
page read and write
2FC2000
heap
page read and write
7AC0000
heap
page read and write
7ABA000
heap
page read and write
There are 1093 hidden memdumps, click here to show them.