IOC Report
s2dwlCsA95.exe

loading gif

Files

File Path
Type
Category
Malicious
s2dwlCsA95.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9EaqYGrOoLZGqTHtmnARfPr.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Aso5djWiC8bybG6teNs2YR5.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
modified
 malicious
C:\Users\user\AppData\Local\Temp\CaUaqkY92GovL9TcuRMGkgg.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Temp\M3KUyMMJ1wTzBxomWRvBAGK.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_95e9fd82e24f30d63ecf9d1f80f114c364d48515_a4a3a431_28c10e55-a34b-44f3-a332-bed6255c7202\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_95e9fd82e24f30d63ecf9d1f80f114c364d48515_a4a3a431_9b78097f-fe58-40b1-88d0-6e5a0e0057c7\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_95e9fd82e24f30d63ecf9d1f80f114c364d48515_a4a3a431_cc2c03f1-f312-454e-8eb4-b645afa2396e\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_95e9fd82e24f30d63ecf9d1f80f114c364d48515_a4a3a431_cf7a9a92-7bbd-4d37-adee-2a3c5a946a38\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MPGPH131.exe_95e9fd82e24f30d63ecf9d1f80f114c364d48515_a4a3a431_fb5424f0-075f-453b-baa8-309a8f4c4bd6\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s2dwlCsA95.exe_6de23016204281d0a81f392e15bb30aed1e0184d_c64a53aa_21832f93-29c9-4fb6-853b-2c5ea1086e91\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s2dwlCsA95.exe_6de23016204281d0a81f392e15bb30aed1e0184d_c64a53aa_485db384-2eba-4d4d-8d3d-a09c26b672e3\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s2dwlCsA95.exe_6de23016204281d0a81f392e15bb30aed1e0184d_c64a53aa_4a5afd04-2bd6-4f10-af0e-99ba73014f03\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s2dwlCsA95.exe_6de23016204281d0a81f392e15bb30aed1e0184d_c64a53aa_525519ec-2ea1-4b69-9897-9f258e363b41\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s2dwlCsA95.exe_6de23016204281d0a81f392e15bb30aed1e0184d_c64a53aa_71552c83-7196-462b-bb67-0c5e7fdbffcf\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s2dwlCsA95.exe_6de23016204281d0a81f392e15bb30aed1e0184d_c64a53aa_b2b792f5-2149-4ab0-bd34-7450e715b1d5\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s2dwlCsA95.exe_6de23016204281d0a81f392e15bb30aed1e0184d_c64a53aa_c8752875-d89b-4c62-bfee-0f8060f1441b\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s2dwlCsA95.exe_6de23016204281d0a81f392e15bb30aed1e0184d_c64a53aa_f5cbb6ed-3531-44ea-bd4f-e14b4973d104\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s2dwlCsA95.exe_6de23016204281d0a81f392e15bb30aed1e0184d_c64a53aa_fd5f25d6-0197-4780-8743-d608c513d0c0\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s2dwlCsA95.exe_d6bfd67ad42f3cffc67d0fc89fa0bef697f58e_c64a53aa_b5faa5de-0809-4ef1-94ec-ab31d9b4a399\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1135.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:12 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER185.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:06 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER19E1.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A10.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EA2.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:14 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FCB.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:15 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2048.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:15 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2182.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER21C1.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER22CA.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER22FA.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2318.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2367.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER242.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER281.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C00.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:18 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CDB.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:18 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E24.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E43.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E83.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2ED1.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB0B.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:09 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE6.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC24.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:09 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC26.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2F.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1A.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA06.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:00 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAD2.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB11.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF001.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:02 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF09E.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0CE.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF291.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:03 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF30F.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF34F.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF63B.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:03 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF6B9.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF746.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF948.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:04 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF9F5.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA53.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD7E.tmp.dmp
Mini DuMP crash report, 15 streams, Fri Apr 19 05:32:06 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEC7.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEE7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe5tQMZAayLr2i\Cookies\Chrome_Default.txt
ASCII text, with very long lines (369), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe5tQMZAayLr2i\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe5tQMZAayLr2i\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe8JCb_VPvrS5h\Cookies\Chrome_Default.txt
ASCII text, with very long lines (369), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe8JCb_VPvrS5h\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobe8JCb_VPvrS5h\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeUVGGzgpMYGEJ\Cookies\Chrome_Default.txt
ASCII text, with very long lines (369), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeUVGGzgpMYGEJ\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeUVGGzgpMYGEJ\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeYzp6h16udgt1\Cookies\Chrome_Default.txt
ASCII text, with very long lines (369), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeYzp6h16udgt1\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\adobeYzp6h16udgt1\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\3Yv_KHN5L6xjHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\6X2eEkf_7MRKWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\ARK9jcv46EtQWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\CoMQhAavqDqMWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\E01jwUaE5KqzCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\FE57sfjjIQcyWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\JOXEe2Lpf_0zWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\MGlBYh8v4VVgHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\NiNaJ8S8mz0BWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\UGKLJgs1VmxYHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\WM_xRkvgBtDSHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\YVR3M2BYNCNXLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\bxBCgEVQur0KCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\lR6vVi8Nh9dvLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi5tQMZAayLr2i\vvS5LNULl6RXLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\1ZhbvlEvlloOHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\2nfAU_RJIGwEHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\3SFrnxRyWWdrCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\AwY3wK8EalbzWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\BrSg8aBcmS6GLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\EHdOalxIBfLRHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\HLP2yyczuyZDLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\MNcPl1UE6oiiWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\UpvrdI6Wo3v2Cookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\b7Aqu4tZuQD5History
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\ffbERgjR2VedWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\fxUO2AT7_b9NWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\kfF3SxorO0TnWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\nONciQGcVv0jLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidi8JCb_VPvrS5h\xC4yzTeoaKfcWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\3faqGhkRMBTjHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\4xnFiyChicziHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\DMfAPIX7W9tlWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\GDzzp2xjyp3xHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\H4OxCvbsuTmXLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\JOrVCJO0eOimWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\LqChuQc4ErSaLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\OPXg3z9x1EIMLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\OelzQluwlGH7History
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\WUs5NEfeTXcAWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\YujJUqZdR_T2Cookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\pV4KHKYs8VJrWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\skL8eKrjoSpfWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\t2S8Y46M8CjnWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidiUVGGzgpMYGEJ\tjTgeGuVhPAsCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\0s92xVxIA0FEHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\6ntuo9ge9uJPHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\Bxl5fQmK9LbKLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\QiQsD07Z5ThfWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\ZWaqi3u9km_kHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\ZZe_lFf_z46tLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\c9cMZIR1vMurCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\eVs77w9JQb7tWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\iLf0wCBweGxDWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\jlhBI5sEi3CNWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\mBeF6fjmagbuWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\nDoSnovqBPl9Cookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\qWLSFxkgVRGKWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\qgREuUdK7z4uHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\heidiYzp6h16udgt1\u0mEFv0CB7P7Login Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\rage131MP.tmp
ASCII text, with no line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 145 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\s2dwlCsA95.exe
"C:\Users\user\Desktop\s2dwlCsA95.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 868
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 960
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 1008
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 1008
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 984
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 1384
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 1016
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 812
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6340 -s 780
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 1872
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 1908
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 900
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6340 -s 872
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 1876
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 932
There are 13 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://193.233.132.167/cost/lenin.exe
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://147.45.47.102:57893/hera/amadka.exe9
unknown
https://duckduckgo.com/ac/?q=
unknown
http://193.233.132.167/cost/go.exeadka.ex
unknown
http://193.233.132.167/cost/go.exeoinoin
unknown
https://t.me/risepro_bot52Hg
unknown
http://147.45.47.102:57893/hera/amadka.exe
unknown
https://db-ip.com/
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://t.me/risepro_botRoman
unknown
http://193.233.132.167/cost/go.exe
unknown
https://t.me/RiseProSUPPORTV
unknown
https://ipinfo.io/widget/demo/81.181.57.52b
unknown
https://t.me/RiseProSUPPORTP
unknown
https://ipinfo.io:443/widget/demo/81.181.57.52
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://ipinfo.io/t
unknown
https://t.me/risepro_botisepro_bot
unknown
http://193.233.132.167/cost/lenin.exein9
unknown
https://ipinfo.io/g
unknown
https://t.me/risepro_bot=
unknown
https://db-ip.com/demo/home.php?s=81.181.57.52:1%
unknown
https://t.me/risepro_botrisepro
unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52
unknown
https://t.me/RiseProSUPPORT7
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://193.233.132.167/cost/go.exedka.exea
unknown
https://db-ip.com/-~
unknown
https://db-ip.com/demo/home.php?s=81.181.57.522
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
https://t.me/RiseProSUPPORT
unknown
https://www.ecosia.org/newtab/
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://ipinfo.io/widget/demo/81.181.57.52
34.117.186.192
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://147.45.47.102:57893/hera/amadka.exea
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://t.me/RiseProSUPPORT-PC77
unknown
https://t.me/risepro_bot
unknown
http://193.233.132.167/cost/lenin.exenia
unknown
https://t.me/risepro_botl
unknown
https://ipinfo.io/
unknown
https://db-ip.com/demo/home.php?s=81.181.57.52
172.67.75.166
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
unknown
http://www.winimage.com/zLibDll
unknown
https://support.mozilla.org
unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.527
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://db-ip.com/vVpR
unknown
http://www.winimage.com/zLibDllDpRTpR
unknown
There are 43 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ipinfo.io
34.117.186.192
db-ip.com
172.67.75.166

IPs

IP
Domain
Country
Malicious
147.45.47.93
unknown
Russian Federation
malicious
34.117.186.192
ipinfo.io
United States
172.67.75.166
db-ip.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RageMP131
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
ProgramId
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
FileId
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
LowerCaseLongPath
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
LongPathHash
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
Name
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
OriginalFileName
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
Publisher
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
Version
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
BinFileVersion
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
BinaryType
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
ProductName
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
ProductVersion
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
LinkDate
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
BinProductVersion
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
AppxPackageFullName
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
AppxPackageRelativeId
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
Size
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
Language
\REGISTRY\A\{113ef7de-504e-6df7-431f-ee50d337de0b}\Root\InventoryApplicationFile\s2dwlcsa95.exe|d96c00622e138d0e
Usn
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
ProgramId
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
FileId
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
LowerCaseLongPath
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
LongPathHash
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Name
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
OriginalFileName
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Publisher
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Version
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
BinFileVersion
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
BinaryType
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
ProductName
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
ProductVersion
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
LinkDate
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
BinProductVersion
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
AppxPackageFullName
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
AppxPackageRelativeId
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Size
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Language
\REGISTRY\A\{1d719abf-d460-8273-73c2-f6ca278c093c}\Root\InventoryApplicationFile\mpgph131.exe|9aac11c6f9321563
Usn
There are 29 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
79CB000
heap
page read and write
 malicious
7B0B000
heap
page read and write
 malicious
4A00000
direct allocation
page execute and read and write
 malicious
79C8000
heap
page read and write
 malicious
4B90000
direct allocation
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
2F1C000
heap
page read and write
 malicious
2EAE000
heap
page read and write
 malicious
2F1C000
heap
page read and write
 malicious
4C50000
direct allocation
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
7983000
heap
page read and write
 malicious
7983000
heap
page read and write
 malicious
79AB000
heap
page read and write
 malicious
7987000
heap
page read and write
 malicious
79C8000
heap
page read and write
 malicious
4AF0000
direct allocation
page execute and read and write
 malicious
79C8000
heap
page read and write
 malicious
7B0A000
heap
page read and write
 malicious
7B0A000
heap
page read and write
 malicious
79CB000
heap
page read and write
 malicious
2F1C000
heap
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
4A30000
direct allocation
page execute and read and write
 malicious
7983000
heap
page read and write
 malicious
7A00000
heap
page read and write
 malicious
7B0A000
heap
page read and write
 malicious
796A000
heap
page read and write
 malicious
2F1D000
heap
page read and write
 malicious
4A60000
direct allocation
page execute and read and write
 malicious
7B0A000
heap
page read and write
 malicious
7987000
heap
page read and write
 malicious
2E3E000
heap
page read and write
 malicious
4BC0000
direct allocation
page read and write
 malicious
4B60000
direct allocation
page read and write
 malicious
79AB000
heap
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
7A55000
heap
page read and write
7CF0000
trusted library allocation
page read and write
7C3A000
heap
page read and write
7D00000
trusted library allocation
page read and write
7A3A000
heap
page read and write
3060000
heap
page read and write
400000
unkown
page readonly
794E000
stack
page read and write
2F21000
heap
page read and write
7B04000
heap
page read and write
7BD3000
heap
page read and write
2D4E000
heap
page read and write
7D00000
trusted library allocation
page read and write
7C63000
heap
page read and write
2F99000
heap
page read and write
7C98000
heap
page read and write
79AB000
heap
page read and write
7C5C000
heap
page read and write
79C3000
heap
page read and write
79EB000
heap
page read and write
7CE0000
trusted library allocation
page read and write
79A8000
heap
page read and write
E5D000
stack
page read and write
7CF0000
trusted library allocation
page read and write
401000
unkown
page execute read
2DEE000
heap
page read and write
2D77000
heap
page read and write
7A27000
heap
page read and write
79AB000
heap
page read and write
7950000
heap
page read and write
7E7A000
heap
page read and write
7998000
heap
page read and write
7998000
heap
page read and write
79AB000
heap
page read and write
2F7C000
heap
page read and write
7A73000
heap
page read and write
7C31000
heap
page read and write
7BA1000
heap
page read and write
7BB1000
heap
page read and write
797B000
heap
page read and write
7BD8000
heap
page read and write
2F90000
heap
page read and write
30BC000
heap
page read and write
79AB000
heap
page read and write
7B20000
heap
page read and write
30B3000
heap
page read and write
7A0E000
heap
page read and write
7B21000
heap
page read and write
2EDB000
heap
page read and write
79DB000
heap
page read and write
79B6000
heap
page read and write
7A6D000
heap
page read and write
9B000
stack
page read and write
7C42000
heap
page read and write
7B20000
heap
page read and write
30BC000
heap
page read and write
7B1B000
heap
page read and write
7979000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7BD4000
heap
page read and write
7A49000
heap
page read and write
2F94000
heap
page read and write
7E60000
heap
page read and write
7984000
heap
page read and write
7A75000
heap
page read and write
7B25000
heap
page read and write
7CE0000
trusted library allocation
page read and write
18E000
stack
page read and write
7984000
heap
page read and write
7B63000
heap
page read and write
79CA000
heap
page read and write
7B90000
heap
page read and write
7A43000
heap
page read and write
2ED1000
heap
page read and write
7CE0000
trusted library allocation
page read and write
2DEB000
heap
page read and write
796E000
stack
page read and write
2F77000
heap
page read and write
79C4000
heap
page read and write
7B05000
heap
page read and write
7C50000
heap
page read and write
7D00000
trusted library allocation
page read and write
7B63000
heap
page read and write
7B28000
heap
page read and write
79EF000
heap
page read and write
79D9000
heap
page read and write
2DD3000
heap
page read and write
2F99000
heap
page read and write
79BD000
heap
page read and write
7CE0000
trusted library allocation
page read and write
79BD000
heap
page read and write
7B7E000
heap
page read and write
2F99000
heap
page read and write
7A73000
heap
page read and write
2D77000
heap
page read and write
7B01000
heap
page read and write
7B0F000
heap
page read and write
799E000
heap
page read and write
79C5000
heap
page read and write
2F89000
heap
page read and write
7B0F000
heap
page read and write
2F2A000
heap
page read and write
7AF1000
heap
page read and write
79BE000
heap
page read and write
79CC000
heap
page read and write
7AF1000
heap
page read and write
304F000
heap
page read and write
7B0B000
heap
page read and write
7997000
heap
page read and write
7C55000
heap
page read and write
79C3000
heap
page read and write
79B4000
heap
page read and write
7A27000
heap
page read and write
797D000
heap
page read and write
50E000
unkown
page read and write
6D67000
heap
page read and write
7965000
heap
page read and write
2F26000
heap
page read and write
79B8000
heap
page read and write
7B2E000
heap
page read and write
7970000
heap
page read and write
7C73000
heap
page read and write
7B16000
heap
page read and write
8660000
trusted library allocation
page read and write
79FC000
heap
page read and write
7E5E000
heap
page read and write
7964000
heap
page read and write
7E79000
heap
page read and write
7CF0000
trusted library allocation
page read and write
7B20000
heap
page read and write
7A7E000
heap
page read and write
7AA9000
heap
page read and write
796A000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7CD0000
trusted library allocation
page read and write
7AF1000
heap
page read and write
7D03000
heap
page read and write
18E000
stack
page read and write
799E000
heap
page read and write
3054000
heap
page read and write
79D9000
heap
page read and write
7A27000
heap
page read and write
7C3F000
heap
page read and write
7CE0000
trusted library allocation
page read and write
7B1A000
heap
page read and write
7A80000
heap
page read and write
2EFF000
heap
page read and write
799E000
heap
page read and write
7B00000
heap
page read and write
2DD3000
heap
page read and write
7CE0000
trusted library allocation
page read and write
796A000
heap
page read and write
58E000
stack
page read and write
79BC000
heap
page read and write
30EE000
stack
page read and write
305C000
heap
page read and write
7CFD000
heap
page read and write
2F28000
heap
page read and write
79B4000
heap
page read and write
7A45000
heap
page read and write
797A000
heap
page read and write
73BE000
stack
page read and write
7A56000
heap
page read and write
2FEB000
heap
page read and write
7D14000
heap
page read and write
79CD000
heap
page read and write
7C45000
heap
page read and write
7380000
remote allocation
page read and write
7A77000
heap
page read and write
7B29000
heap
page read and write
7B63000
heap
page read and write
7CE0000
trusted library allocation
page read and write
7C42000
heap
page read and write
7B2A000
heap
page read and write
7B1A000
heap
page read and write
7B57000
heap
page read and write
7DC8000
heap
page read and write
79EF000
heap
page read and write
7A46000
heap
page read and write
7C75000
heap
page read and write
79C3000
heap
page read and write
7C5D000
heap
page read and write
7D00000
trusted library allocation
page read and write
796B000
heap
page read and write
799E000
heap
page read and write
79B4000
heap
page read and write
79B6000
heap
page read and write
7C45000
heap
page read and write
2F93000
heap
page read and write
4945000
heap
page execute and read and write
2DB0000
heap
page read and write
2F8B000
heap
page read and write
4ADD000
stack
page read and write
79AB000
heap
page read and write
7B63000
heap
page read and write
79BE000
heap
page read and write
7984000
heap
page read and write
7E93000
heap
page read and write
2DD8000
heap
page read and write
79B5000
heap
page read and write
7998000
heap
page read and write
7B63000
heap
page read and write
7B21000
heap
page read and write
7D00000
trusted library allocation
page read and write
7CF0000
trusted library allocation
page read and write
308F000
unkown
page read and write
7A27000
heap
page read and write
7986000
heap
page read and write
7B20000
heap
page read and write
7984000
heap
page read and write
7B1B000
heap
page read and write
7997000
heap
page read and write
2E82000
heap
page read and write
2F1C000
heap
page read and write
79CD000
heap
page read and write
7EAF000
heap
page read and write
7B84000
heap
page read and write
2D73000
heap
page read and write
79CF000
heap
page read and write
8561000
heap
page read and write
7B63000
heap
page read and write
7BB1000
heap
page read and write
2F89000
heap
page read and write
7997000
heap
page read and write
2D38000
heap
page read and write
7C34000
heap
page read and write
7B24000
heap
page read and write
2E3E000
stack
page read and write
797A000
heap
page read and write
7C7C000
heap
page read and write
7B63000
heap
page read and write
7B05000
heap
page read and write
7A7C000
heap
page read and write
7DC7000
heap
page read and write
7AF1000
heap
page read and write
7DB0000
heap
page read and write
7B1B000
heap
page read and write
79DA000
heap
page read and write
7C2E000
heap
page read and write
7A55000
heap
page read and write
7B0A000
heap
page read and write
7C4A000
heap
page read and write
4D3000
unkown
page write copy
7AB9000
heap
page read and write
79D3000
heap
page read and write
797A000
heap
page read and write
7B0F000
heap
page read and write
7C63000
heap
page read and write
7B63000
heap
page read and write
797A000
heap
page read and write
79BA000
heap
page read and write
7C21000
heap
page read and write
7984000
heap
page read and write
4C0000
heap
page read and write
7C31000
heap
page read and write
18E000
stack
page read and write
2F77000
heap
page read and write
7C27000
heap
page read and write
7A58000
heap
page read and write
19B000
stack
page read and write
7997000
heap
page read and write
2D31000
heap
page read and write
305C000
heap
page read and write
7B24000
heap
page read and write
79C3000
heap
page read and write
7962000
heap
page read and write
7C6C000
heap
page read and write
7B76000
heap
page read and write
79BA000
heap
page read and write
716D000
stack
page read and write
7BB0000
heap
page read and write
7B05000
heap
page read and write
79CD000
heap
page read and write
4C5E000
heap
page read and write
7B2E000
heap
page read and write
7B24000
heap
page read and write
400000
unkown
page readonly
7B9E000
heap
page read and write
7370000
remote allocation
page read and write
79B4000
heap
page read and write
2F93000
heap
page read and write
79C3000
heap
page read and write
7986000
heap
page read and write
7B22000
heap
page read and write
4D2D000
stack
page read and write
79B4000
heap
page read and write
77FE000
stack
page read and write
7B14000
heap
page read and write
7A0C000
heap
page read and write
79B4000
heap
page read and write
41F000
unkown
page readonly
7DA4000
heap
page read and write
2DEB000
heap
page read and write
7CD0000
trusted library allocation
page read and write
737E000
stack
page read and write
79AB000
heap
page read and write
79B6000
heap
page read and write
7985000
heap
page read and write
7C7C000
heap
page read and write
7B04000
heap
page read and write
7CE0000
trusted library allocation
page read and write
7961000
heap
page read and write
2CB6000
unkown
page readonly
726E000
stack
page read and write
7B36000
heap
page read and write
7A23000
heap
page read and write
7E96000
heap
page read and write
7B85000
heap
page read and write
7BA2000
heap
page read and write
7C88000
heap
page read and write
7984000
heap
page read and write
7C98000
heap
page read and write
9B000
stack
page read and write
79AB000
heap
page read and write
7A5D000
heap
page read and write
7994000
heap
page read and write
79C7000
heap
page read and write
7AFB000
heap
page read and write
799E000
heap
page read and write
3027000
heap
page read and write
79AB000
heap
page read and write
7A27000
heap
page read and write
7997000
heap
page read and write
2F26000
heap
page read and write
7B0B000
heap
page read and write
2D62000
heap
page read and write
7C40000
heap
page read and write
2FFF000
heap
page read and write
798A000
heap
page read and write
7B21000
heap
page read and write
7E9B000
heap
page read and write
79BE000
heap
page read and write
2CF0000
heap
page read and write
7A27000
heap
page read and write
7C5D000
heap
page read and write
2D6C000
heap
page read and write
5DF000
stack
page read and write
2DEB000
heap
page read and write
79D2000
heap
page read and write
7A75000
heap
page read and write
3045000
heap
page read and write
7D00000
trusted library allocation
page read and write
2EED000
heap
page read and write
4E5E000
stack
page read and write
79C6000
heap
page read and write
79F7000
heap
page read and write
79EB000
heap
page read and write
7E69000
heap
page read and write
8D0000
heap
page read and write
7A59000
heap
page read and write
7A64000
heap
page read and write
2D55000
heap
page read and write
2E17000
heap
page read and write
7998000
heap
page read and write
7C34000
heap
page read and write
7A7A000
heap
page read and write
7B01000
heap
page read and write
7CF0000
trusted library allocation
page read and write
2CFB000
heap
page read and write
7A19000
heap
page read and write
79A0000
heap
page read and write
7B27000
heap
page read and write
7A56000
heap
page read and write
2D77000
heap
page read and write
4D60000
remote allocation
page read and write
79BE000
heap
page read and write
8640000
trusted library allocation
page read and write
79EB000
heap
page read and write
2E98000
heap
page read and write
7C74000
heap
page read and write
41F000
unkown
page readonly
7DBA000
heap
page read and write
4C9D000
stack
page read and write
7D00000
trusted library allocation
page read and write
7A8A000
heap
page read and write
2F09000
heap
page read and write
4BF0000
heap
page read and write
7B21000
heap
page read and write
79A0000
heap
page read and write
79B6000
heap
page read and write
2FFB000
heap
page read and write
798C000
heap
page read and write
4D20000
heap
page read and write
7C45000
heap
page read and write
79B8000
heap
page read and write
7B0F000
heap
page read and write
2F77000
heap
page read and write
7B04000
heap
page read and write
7AB7000
heap
page read and write
7C47000
heap
page read and write
70BE000
stack
page read and write
79D2000
heap
page read and write
7B11000
heap
page read and write
798D000
heap
page read and write
7B01000
heap
page read and write
309F000
stack
page read and write
2F7C000
heap
page read and write
7BAC000
heap
page read and write
7DDB000
heap
page read and write
7AFB000
heap
page read and write
79A2000
heap
page read and write
7A52000
heap
page read and write
7998000
heap
page read and write
7996000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7AF1000
heap
page read and write
2DDC000
heap
page read and write
2D6C000
heap
page read and write
7B2D000
heap
page read and write
7B29000
heap
page read and write
7B0B000
heap
page read and write
7B11000
heap
page read and write
7A03000
heap
page read and write
4BED000
stack
page read and write
7984000
heap
page read and write
4C1F000
heap
page read and write
79C4000
heap
page read and write
7997000
heap
page read and write
7A45000
heap
page read and write
6FBE000
stack
page read and write
79C9000
heap
page read and write
7C88000
heap
page read and write
7C48000
heap
page read and write
3029000
heap
page read and write
7BF7000
heap
page read and write
7B7D000
heap
page read and write
7B1B000
heap
page read and write
30BC000
heap
page read and write
2DEB000
heap
page read and write
772D000
stack
page read and write
7A5B000
heap
page read and write
7C27000
heap
page read and write
2E7D000
heap
page read and write
7B85000
heap
page read and write
4C0D000
stack
page read and write
7C4E000
heap
page read and write
7B63000
heap
page read and write
79A7000
heap
page read and write
79EB000
heap
page read and write
79B6000
heap
page read and write
79CD000
heap
page read and write
312F000
stack
page read and write
7A58000
heap
page read and write
2D62000
heap
page read and write
7E6E000
heap
page read and write
734E000
stack
page read and write
7B22000
heap
page read and write
2D5E000
heap
page read and write
30B1000
heap
page read and write
1C5000
heap
page read and write
2DD7000
heap
page read and write
7D1A000
heap
page read and write
7A62000
heap
page read and write
2ECC000
heap
page read and write
7DAA000
heap
page read and write
2D20000
heap
page read and write
2E3A000
heap
page read and write
79CA000
heap
page read and write
43D000
stack
page read and write
7A0C000
heap
page read and write
796B000
heap
page read and write
7B24000
heap
page read and write
7B24000
heap
page read and write
797A000
heap
page read and write
79AB000
heap
page read and write
47A000
stack
page read and write
7A41000
heap
page read and write
7C25000
heap
page read and write
2DEB000
heap
page read and write
7B24000
heap
page read and write
7DBB000
heap
page read and write
7997000
heap
page read and write
79BF000
heap
page read and write
3009000
heap
page read and write
7AF1000
heap
page read and write
7A6D000
heap
page read and write
2F26000
heap
page read and write
79AB000
heap
page read and write
79C7000
heap
page read and write
79B4000
heap
page read and write
797A000
heap
page read and write
7B29000
heap
page read and write
3038000
heap
page read and write
7C98000
heap
page read and write
4F20000
heap
page read and write
2F2D000
heap
page read and write
2DEB000
heap
page read and write
5E0000
heap
page read and write
7B02000
heap
page read and write
7F39000
heap
page read and write
7B1B000
heap
page read and write
79FE000
stack
page read and write
7A6D000
heap
page read and write
7B63000
heap
page read and write
6F4E000
stack
page read and write
7A05000
heap
page read and write
79B6000
heap
page read and write
7B1B000
heap
page read and write
7997000
heap
page read and write
79A2000
heap
page read and write
7C98000
heap
page read and write
2F77000
heap
page read and write
7CF1000
heap
page read and write
1F0000
heap
page read and write
7C39000
heap
page read and write
79B6000
heap
page read and write
799E000
heap
page read and write
2F2D000
heap
page read and write
4A9D000
stack
page read and write
79DB000
heap
page read and write
7DC5000
heap
page read and write
2DEE000
stack
page read and write
7D0F000
heap
page read and write
7AFB000
heap
page read and write
3060000
heap
page read and write
79D3000
heap
page read and write
7B20000
heap
page read and write
7CD0000
trusted library allocation
page read and write
79A0000
heap
page read and write
7DCD000
heap
page read and write
7B24000
heap
page read and write
2F8B000
heap
page read and write
2DA5000
heap
page read and write
7A7B000
heap
page read and write
7E77000
heap
page read and write
7984000
heap
page read and write
796A000
heap
page read and write
7B11000
heap
page read and write
7B21000
heap
page read and write
40C000
unkown
page readonly
1C7000
heap
page read and write
7A85000
heap
page read and write
7B27000
heap
page read and write
7A49000
heap
page read and write
7DA4000
heap
page read and write
305C000
heap
page read and write
7C53000
heap
page read and write
79AB000
heap
page read and write
3060000
heap
page read and write
7BFC000
heap
page read and write
7A61000
heap
page read and write
2F89000
heap
page read and write
7B04000
heap
page read and write
4D60000
remote allocation
page read and write
79CF000
heap
page read and write
7AF1000
heap
page read and write
4D50000
heap
page read and write
7B1C000
heap
page read and write
79C3000
heap
page read and write
7B63000
heap
page read and write
7B27000
heap
page read and write
304F000
heap
page read and write
7B28000
heap
page read and write
7986000
heap
page read and write
79E8000
heap
page read and write
7A49000
heap
page read and write
2D1E000
stack
page read and write
2DD3000
heap
page read and write
7A56000
heap
page read and write
7A27000
heap
page read and write
7B63000
heap
page read and write
72BD000
stack
page read and write
302F000
heap
page read and write
2DFE000
stack
page read and write
2CB6000
unkown
page readonly
7A27000
heap
page read and write
7C34000
heap
page read and write
2DEE000
heap
page read and write
7B6B000
heap
page read and write
79BD000
heap
page read and write
7C98000
heap
page read and write
7C25000
heap
page read and write
31BF000
stack
page read and write
7C48000
heap
page read and write
7B15000
heap
page read and write
79A2000
heap
page read and write
41F000
unkown
page readonly
30B3000
heap
page read and write
7A6D000
heap
page read and write
7AFB000
heap
page read and write
7A1D000
heap
page read and write
2D73000
heap
page read and write
7AF1000
heap
page read and write
2F8B000
heap
page read and write
7C98000
heap
page read and write
2EF9000
heap
page read and write
7C98000
heap
page read and write
2D23000
heap
page read and write
7D00000
trusted library allocation
page read and write
4D60000
remote allocation
page read and write
797A000
heap
page read and write
7B6B000
heap
page read and write
7A45000
heap
page read and write
7E88000
heap
page read and write
7C98000
heap
page read and write
7BD4000
heap
page read and write
7B07000
heap
page read and write
7B24000
heap
page read and write
796B000
heap
page read and write
7A62000
heap
page read and write
798A000
heap
page read and write
782E000
stack
page read and write
1C0000
heap
page read and write
2E79000
heap
page read and write
2DE3000
heap
page read and write
2DE3000
heap
page read and write
7B11000
heap
page read and write
7C28000
heap
page read and write
2F13000
heap
page read and write
7CF0000
trusted library allocation
page read and write
79CB000
heap
page read and write
7997000
heap
page read and write
79CF000
heap
page read and write
401000
unkown
page execute read
7984000
heap
page read and write
7F34000
heap
page read and write
7B11000
heap
page read and write
7B20000
heap
page read and write
3019000
heap
page read and write
7BDB000
heap
page read and write
79CD000
heap
page read and write
328B000
heap
page read and write
7964000
heap
page read and write
7B14000
heap
page read and write
79B8000
heap
page read and write
7986000
heap
page read and write
7CD0000
trusted library allocation
page read and write
797A000
heap
page read and write
79C8000
heap
page read and write
7A49000
heap
page read and write
7E6D000
heap
page read and write
7CF7000
heap
page read and write
7970000
heap
page read and write
2F60000
heap
page read and write
2D5E000
heap
page read and write
7B16000
heap
page read and write
2F2D000
heap
page read and write
7B9E000
heap
page read and write
79B3000
heap
page read and write
79B4000
heap
page read and write
7986000
heap
page read and write
7C98000
heap
page read and write
7A56000
heap
page read and write
79AB000
heap
page read and write
7B63000
heap
page read and write
3280000
heap
page read and write
79A8000
heap
page read and write
7984000
heap
page read and write
7B63000
heap
page read and write
7B63000
heap
page read and write
4D50000
heap
page read and write
7952000
heap
page read and write
2E6F000
heap
page read and write
2F8B000
heap
page read and write
79C3000
heap
page read and write
7B2A000
heap
page read and write
2EA0000
heap
page read and write
7986000
heap
page read and write
79CA000
heap
page read and write
7AB9000
heap
page read and write
7AF1000
heap
page read and write
7B11000
heap
page read and write
7BA1000
heap
page read and write
2F29000
heap
page read and write
7B01000
heap
page read and write
7C29000
heap
page read and write
79CF000
heap
page read and write
2F26000
heap
page read and write
2CB6000
unkown
page readonly
72AD000
stack
page read and write
7BB3000
heap
page read and write
7BA2000
heap
page read and write
7B10000
heap
page read and write
79DB000
heap
page read and write
7B0F000
heap
page read and write
7C45000
heap
page read and write
7AFC000
heap
page read and write
2DEB000
heap
page read and write
7AAC000
heap
page read and write
2EDF000
heap
page read and write
4F0D000
stack
page read and write
2ECD000
heap
page read and write
7997000
heap
page read and write
7B0B000
heap
page read and write
18E000
stack
page read and write
3054000
heap
page read and write
7A45000
heap
page read and write
2D73000
heap
page read and write
7B29000
heap
page read and write
7AFC000
heap
page read and write
2F0D000
heap
page read and write
7997000
heap
page read and write
7A27000
heap
page read and write
7B13000
heap
page read and write
7C20000
heap
page read and write
480E000
stack
page read and write
4CCD000
stack
page read and write
7B07000
heap
page read and write
798C000
heap
page read and write
7BA4000
heap
page read and write
7AFC000
heap
page read and write
4C5D000
stack
page read and write
79B4000
heap
page read and write
7C31000
heap
page read and write
7C43000
heap
page read and write
7A66000
heap
page read and write
7C3D000
heap
page read and write
79AB000
heap
page read and write
79B8000
heap
page read and write
7B2A000
heap
page read and write
79E6000
heap
page read and write
7C80000
heap
page read and write
799E000
heap
page read and write
7CE1000
heap
page read and write
9B000
stack
page read and write
7DA9000
heap
page read and write
7AF1000
heap
page read and write
7B0B000
heap
page read and write
7CE5000
heap
page read and write
7B20000
heap
page read and write
7BA6000
heap
page read and write
79BD000
heap
page read and write
7DB5000
heap
page read and write
7999000
heap
page read and write
79B6000
heap
page read and write
7959000
heap
page read and write
7BD3000
heap
page read and write
79C5000
heap
page read and write
2CD0000
heap
page read and write
7B24000
heap
page read and write
7970000
heap
page read and write
4C7B000
heap
page read and write
79AB000
heap
page read and write
2DD7000
heap
page read and write
7CE0000
trusted library allocation
page read and write
7BA5000
heap
page read and write
30BA000
heap
page read and write
7B04000
heap
page read and write
7A27000
heap
page read and write
7DD2000
heap
page read and write
2F8B000
heap
page read and write
79B6000
heap
page read and write
799E000
heap
page read and write
79D2000
heap
page read and write
79C7000
heap
page read and write
7967000
heap
page read and write
2FCE000
heap
page read and write
7BD3000
heap
page read and write
7C98000
heap
page read and write
19B000
stack
page read and write
79DF000
heap
page read and write
797D000
heap
page read and write
79B4000
heap
page read and write
E9A000
stack
page read and write
79B4000
heap
page read and write
7C40000
heap
page read and write
79AB000
heap
page read and write
7D00000
trusted library allocation
page read and write
79AB000
heap
page read and write
7997000
heap
page read and write
7AF1000
heap
page read and write
2DEB000
heap
page read and write
7BD9000
heap
page read and write
2F8B000
heap
page read and write
799E000
heap
page read and write
7B05000
heap
page read and write
7967000
heap
page read and write
2D5E000
heap
page read and write
7B04000
heap
page read and write
7A27000
heap
page read and write
7B11000
heap
page read and write
79CB000
heap
page read and write
7C2C000
heap
page read and write
339F000
stack
page read and write
79EA000
heap
page read and write
7D00000
trusted library allocation
page read and write
3060000
heap
page read and write
7B10000
heap
page read and write
2FF2000
heap
page read and write
7C98000
heap
page read and write
7AFB000
heap
page read and write
2DD3000
heap
page read and write
79C1000
heap
page read and write
785D000
stack
page read and write
4D3000
unkown
page write copy
7D1F000
heap
page read and write
7C3C000
heap
page read and write
7B6E000
heap
page read and write
401000
unkown
page execute read
7A12000
heap
page read and write
79AB000
heap
page read and write
7997000
heap
page read and write
799E000
heap
page read and write
7A50000
heap
page read and write
7B57000
heap
page read and write
30B9000
heap
page read and write
79C5000
heap
page read and write
7B63000
heap
page read and write
7B0E000
heap
page read and write
302F000
stack
page read and write
7997000
heap
page read and write
30B3000
heap
page read and write
610000
heap
page read and write
7A45000
heap
page read and write
54E000
unkown
page read and write
2D77000
heap
page read and write
7BD8000
heap
page read and write
7A27000
heap
page read and write
79C7000
heap
page read and write
7985000
heap
page read and write
590000
heap
page read and write
7A27000
heap
page read and write
7A49000
heap
page read and write
7B10000
heap
page read and write
7AB7000
heap
page read and write
7997000
heap
page read and write
79AC000
heap
page read and write
7BF1000
heap
page read and write
7BA1000
heap
page read and write
797A000
heap
page read and write
7A65000
heap
page read and write
7A67000
heap
page read and write
7F19000
heap
page read and write
7C98000
heap
page read and write
2DD3000
heap
page read and write
7A45000
heap
page read and write
7A1C000
heap
page read and write
2F5E000
stack
page read and write
7B18000
heap
page read and write
79A2000
heap
page read and write
4ECD000
stack
page read and write
7D00000
trusted library allocation
page read and write
2F16000
heap
page read and write
79A0000
heap
page read and write
7DC3000
heap
page read and write
799E000
heap
page read and write
2D50000
heap
page read and write
7B04000
heap
page read and write
7BA3000
heap
page read and write
1F0000
heap
page read and write
EF0000
heap
page read and write
7C4F000
heap
page read and write
71BD000
stack
page read and write
2F8B000
heap
page read and write
2F2A000
heap
page read and write
7DAE000
heap
page read and write
2F2A000
heap
page read and write
2F89000
heap
page read and write
7BC0000
heap
page read and write
79FC000
heap
page read and write
3054000
heap
page read and write
2F2E000
heap
page read and write
76FD000
stack
page read and write
79DA000
heap
page read and write
2DD3000
heap
page read and write
7B0F000
heap
page read and write
7B63000
heap
page read and write
7B24000
heap
page read and write
304F000
heap
page read and write
2F2E000
heap
page read and write
3054000
heap
page read and write
7B0B000
heap
page read and write
4D60000
remote allocation
page read and write
7C4F000
heap
page read and write
7AF1000
heap
page read and write
2F2B000
heap
page read and write
3014000
heap
page read and write
7998000
heap
page read and write
7982000
heap
page read and write
79B8000
heap
page read and write
7C3D000
heap
page read and write
4E8E000
stack
page read and write
7CF0000
trusted library allocation
page read and write
7C4C000
heap
page read and write
7A90000
heap
page read and write
4DF0000
heap
page read and write
7B01000
heap
page read and write
2F77000
heap
page read and write
7C4F000
heap
page read and write
8650000
trusted library allocation
page read and write
7B22000
heap
page read and write
7B63000
heap
page read and write
799E000
heap
page read and write
7C45000
heap
page read and write
78FE000
stack
page read and write
7B27000
heap
page read and write
79C2000
heap
page read and write
2FFF000
stack
page read and write
7BD4000
heap
page read and write
7DC9000
heap
page read and write
19B000
stack
page read and write
2D13000
heap
page read and write
7B0A000
heap
page read and write
3060000
heap
page read and write
7CF0000
trusted library allocation
page read and write
7B20000
heap
page read and write
79C0000
heap
page read and write
799E000
heap
page read and write
400000
unkown
page readonly
7D0C000
heap
page read and write
784D000
stack
page read and write
7D00000
trusted library allocation
page read and write
7D00000
trusted library allocation
page read and write
7997000
heap
page read and write
2E15000
heap
page read and write
7B0A000
heap
page read and write
7997000
heap
page read and write
7B18000
heap
page read and write
7A65000
heap
page read and write
30B3000
heap
page read and write
7B20000
heap
page read and write
4D3000
unkown
page write copy
7CFF000
heap
page read and write
79AB000
heap
page read and write
7CF0000
trusted library allocation
page read and write
79B4000
heap
page read and write
79A7000
heap
page read and write
7B10000
heap
page read and write
79AB000
heap
page read and write
7BB6000
heap
page read and write
2D77000
heap
page read and write
7B04000
heap
page read and write
79BF000
heap
page read and write
7E94000
heap
page read and write
79FC000
heap
page read and write
79BA000
heap
page read and write
8550000
heap
page read and write
7A4A000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7B46000
heap
page read and write
702D000
stack
page read and write
7C31000
heap
page read and write
7F1F000
heap
page read and write
7C3D000
heap
page read and write
7A0E000
heap
page read and write
2F77000
heap
page read and write
7AC7000
heap
page read and write
400000
unkown
page readonly
7997000
heap
page read and write
798D000
heap
page read and write
79BA000
heap
page read and write
2D55000
heap
page read and write
305C000
heap
page read and write
796A000
heap
page read and write
799E000
heap
page read and write
7D07000
heap
page read and write
7B18000
heap
page read and write
79B4000
heap
page read and write
2DEB000
heap
page read and write
796B000
heap
page read and write
7E94000
heap
page read and write
79D3000
heap
page read and write
7960000
heap
page read and write
79B4000
heap
page read and write
8650000
trusted library allocation
page read and write
7A0F000
heap
page read and write
30B3000
heap
page read and write
4BF0000
heap
page read and write
79A2000
heap
page read and write
7F33000
heap
page read and write
7A6B000
heap
page read and write
7A27000
heap
page read and write
7B26000
heap
page read and write
4D4D000
stack
page read and write
7B04000
heap
page read and write
7F2A000
heap
page read and write
7B17000
heap
page read and write
7B37000
heap
page read and write
7B11000
heap
page read and write
7984000
heap
page read and write
799E000
heap
page read and write
79BD000
heap
page read and write
7CE0000
trusted library allocation
page read and write
7980000
heap
page read and write
79C5000
heap
page read and write
7962000
heap
page read and write
2DD8000
heap
page read and write
7998000
heap
page read and write
4C8D000
stack
page read and write
79B4000
heap
page read and write
7A27000
heap
page read and write
7C33000
heap
page read and write
7C28000
heap
page read and write
79FC000
heap
page read and write
7A27000
heap
page read and write
7AAB000
heap
page read and write
79F9000
heap
page read and write
79AB000
heap
page read and write
79DA000
heap
page read and write
7966000
heap
page read and write
7DA8000
heap
page read and write
7984000
heap
page read and write
7B05000
heap
page read and write
7982000
heap
page read and write
7B05000
heap
page read and write
7965000
heap
page read and write
7DAF000
heap
page read and write
7998000
heap
page read and write
7DC4000
heap
page read and write
494C000
heap
page execute and read and write
2F77000
heap
page read and write
7B0F000
heap
page read and write
7998000
heap
page read and write
7971000
heap
page read and write
7B0F000
heap
page read and write
79BF000
heap
page read and write
7CE0000
trusted library allocation
page read and write
4D80000
heap
page read and write
7D12000
heap
page read and write
7B01000
heap
page read and write
2F82000
heap
page read and write
7965000
heap
page read and write
7997000
heap
page read and write
7AF3000
heap
page read and write
4E03000
heap
page read and write
79B4000
heap
page read and write
7B04000
heap
page read and write
7B04000
heap
page read and write
7998000
heap
page read and write
7F25000
heap
page read and write
7B04000
heap
page read and write
2E30000
heap
page read and write
7C39000
heap
page read and write
7B0A000
heap
page read and write
2F8B000
heap
page read and write
7984000
heap
page read and write
7A27000
heap
page read and write
304F000
heap
page read and write
79CD000
heap
page read and write
2D0F000
heap
page read and write
4990000
heap
page read and write
7BA4000
heap
page read and write
79B4000
heap
page read and write
79C5000
heap
page read and write
7E5C000
heap
page read and write
7B63000
heap
page read and write
7C34000
heap
page read and write
79CA000
heap
page read and write
7A54000
heap
page read and write
7A27000
heap
page read and write
7B05000
heap
page read and write
79AB000
heap
page read and write
79C7000
heap
page read and write
2D33000
heap
page read and write
7B24000
heap
page read and write
7EAE000
heap
page read and write
7B17000
heap
page read and write
7967000
heap
page read and write
7980000
heap
page read and write
7C44000
heap
page read and write
7AB9000
heap
page read and write
7DD4000
heap
page read and write
79E7000
heap
page read and write
7E6B000
heap
page read and write
7B2B000
heap
page read and write
2DEB000
heap
page read and write
2E84000
heap
page read and write
7E82000
heap
page read and write
7C3D000
heap
page read and write
7C4A000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7AFB000
heap
page read and write
2F89000
heap
page read and write
7984000
heap
page read and write
2F91000
heap
page read and write
7B11000
heap
page read and write
79A2000
heap
page read and write
7C25000
heap
page read and write
4FB0000
heap
page read and write
7B24000
heap
page read and write
3003000
heap
page read and write
7B0C000
heap
page read and write
7980000
heap
page read and write
7B04000
heap
page read and write
2E10000
heap
page read and write
7966000
heap
page read and write
704D000
stack
page read and write
4C02000
heap
page read and write
7A49000
heap
page read and write
2EC3000
heap
page read and write
770D000
stack
page read and write
79BF000
heap
page read and write
2DEB000
heap
page read and write
7C5E000
heap
page read and write
7A2D000
heap
page read and write
2D43000
heap
page read and write
7A65000
heap
page read and write
7B17000
heap
page read and write
3560000
heap
page read and write
79CD000
heap
page read and write
40C000
unkown
page readonly
712D000
stack
page read and write
797E000
heap
page read and write
7C6F000
heap
page read and write
7962000
heap
page read and write
7A56000
heap
page read and write
7C98000
heap
page read and write
7B1B000
heap
page read and write
7CE0000
trusted library allocation
page read and write
7984000
heap
page read and write
19B000
stack
page read and write
7BA2000
heap
page read and write
7986000
heap
page read and write
2DEB000
heap
page read and write
7B27000
heap
page read and write
797A000
heap
page read and write
79B4000
heap
page read and write
79BE000
heap
page read and write
2DD3000
heap
page read and write
7B04000
heap
page read and write
7B63000
heap
page read and write
7B63000
heap
page read and write
2D4C000
heap
page read and write
727D000
stack
page read and write
2DD8000
heap
page read and write
79FD000
heap
page read and write
7C98000
heap
page read and write
7BA3000
heap
page read and write
7A45000
heap
page read and write
7EAB000
heap
page read and write
2F89000
heap
page read and write
2D55000
heap
page read and write
7A57000
heap
page read and write
2DA7000
heap
page read and write
79B6000
heap
page read and write
7B05000
heap
page read and write
7B25000
heap
page read and write
7BB1000
heap
page read and write
4C10000
heap
page read and write
79CD000
heap
page read and write
795E000
stack
page read and write
2D62000
heap
page read and write
7A19000
heap
page read and write
79CD000
heap
page read and write
7998000
heap
page read and write
7BD9000
heap
page read and write
79B6000
heap
page read and write
7997000
heap
page read and write
2CD0000
heap
page read and write
2D58000
heap
page read and write
79FC000
heap
page read and write
7979000
heap
page read and write
2DEB000
heap
page read and write
7B63000
heap
page read and write
2D25000
heap
page read and write
7B01000
heap
page read and write
7B0F000
heap
page read and write
305C000
heap
page read and write
7B38000
heap
page read and write
7B1B000
heap
page read and write
7979000
heap
page read and write
7980000
heap
page read and write
79C0000
heap
page read and write
7C98000
heap
page read and write
7B1B000
heap
page read and write
79CD000
heap
page read and write
7C45000
heap
page read and write
79B6000
heap
page read and write
79BE000
heap
page read and write
7997000
heap
page read and write
48EF000
stack
page read and write
79AF000
heap
page read and write
41F000
unkown
page readonly
7C2B000
heap
page read and write
2D55000
heap
page read and write
7B18000
heap
page read and write
2DD3000
heap
page read and write
2CB6000
unkown
page readonly
7B06000
heap
page read and write
79AB000
heap
page read and write
4EB0000
heap
page read and write
3060000
heap
page read and write
7C34000
heap
page read and write
79BE000
heap
page read and write
2F8B000
heap
page read and write
7980000
heap
page read and write
7E60000
heap
page read and write
7B11000
heap
page read and write
2E9E000
heap
page read and write
7A7B000
heap
page read and write
7380000
remote allocation
page read and write
7BA0000
heap
page read and write
79C7000
heap
page read and write
7B0F000
heap
page read and write
4CFD000
stack
page read and write
7CFE000
heap
page read and write
7AF5000
heap
page read and write
7A27000
heap
page read and write
7A45000
heap
page read and write
79BD000
heap
page read and write
7987000
heap
page read and write
7D0D000
heap
page read and write
7B08000
heap
page read and write
7B04000
heap
page read and write
2D73000
heap
page read and write
7987000
heap
page read and write
7C98000
heap
page read and write
7B2A000
heap
page read and write
7A09000
heap
page read and write
7CD0000
trusted library allocation
page read and write
2DEB000
heap
page read and write
2DD3000
heap
page read and write
7998000
heap
page read and write
7A5B000
heap
page read and write
7CE5000
heap
page read and write
7B24000
heap
page read and write
4D60000
remote allocation
page read and write
7AFB000
heap
page read and write
7A5C000
heap
page read and write
7998000
heap
page read and write
79AB000
heap
page read and write
7AB7000
heap
page read and write
7CF0000
trusted library allocation
page read and write
79C6000
heap
page read and write
7D00000
trusted library allocation
page read and write
7C98000
heap
page read and write
7B04000
heap
page read and write
7A60000
heap
page read and write
7A05000
heap
page read and write
797A000
heap
page read and write
7BDB000
heap
page read and write
7B63000
heap
page read and write
7C32000
heap
page read and write
7998000
heap
page read and write
7370000
remote allocation
page read and write
7997000
heap
page read and write
7C88000
heap
page read and write
7B1C000
heap
page read and write
7BE8000
heap
page read and write
7A57000
heap
page read and write
797A000
heap
page read and write
70FD000
stack
page read and write
79CF000
heap
page read and write
7B1C000
heap
page read and write
4E00000
remote allocation
page read and write
30B4000
heap
page read and write
2CE0000
heap
page read and write
79C4000
heap
page read and write
7D10000
heap
page read and write
7DCE000
heap
page read and write
2F7C000
heap
page read and write
7CD0000
trusted library allocation
page read and write
49A1000
heap
page execute and read and write
7B05000
heap
page read and write
7C28000
heap
page read and write
7965000
heap
page read and write
2DD3000
heap
page read and write
79B4000
heap
page read and write
797C000
heap
page read and write
79BE000
heap
page read and write
7C98000
heap
page read and write
7A49000
heap
page read and write
7984000
heap
page read and write
7B24000
heap
page read and write
7998000
heap
page read and write
7B08000
heap
page read and write
2D3D000
heap
page read and write
7B04000
heap
page read and write
7B20000
heap
page read and write
4DAD000
stack
page read and write
7B01000
heap
page read and write
79C7000
heap
page read and write
3090000
heap
page read and write
2DEB000
heap
page read and write
2E10000
heap
page read and write
7E57000
heap
page read and write
79E9000
heap
page read and write
7B0B000
heap
page read and write
2D77000
heap
page read and write
7986000
heap
page read and write
7C33000
heap
page read and write
7BD3000
heap
page read and write
79FD000
heap
page read and write
7997000
heap
page read and write
2F8B000
heap
page read and write
7BE2000
heap
page read and write
7986000
heap
page read and write
79B4000
heap
page read and write
7C57000
heap
page read and write
2DD4000
heap
page read and write
3054000
heap
page read and write
2F2A000
heap
page read and write
7967000
heap
page read and write
7AFC000
heap
page read and write
2D5E000
heap
page read and write
7D03000
heap
page read and write
7997000
heap
page read and write
7B48000
heap
page read and write
7B05000
heap
page read and write
723E000
stack
page read and write
30BC000
heap
page read and write
79DB000
heap
page read and write
7BB9000
heap
page read and write
7962000
heap
page read and write
2D77000
heap
page read and write
79D6000
heap
page read and write
79A2000
heap
page read and write
7B1B000
heap
page read and write
2D62000
heap
page read and write
2D77000
heap
page read and write
4D3000
unkown
page write copy
7C58000
heap
page read and write
305C000
heap
page read and write
7C24000
heap
page read and write
7C45000
heap
page read and write
7A1A000
heap
page read and write
7A56000
heap
page read and write
797A000
heap
page read and write
79B4000
heap
page read and write
2DD0000
heap
page read and write
7C2F000
heap
page read and write
2D5E000
heap
page read and write
7B08000
heap
page read and write
7C7C000
heap
page read and write
7B70000
heap
page read and write
7B05000
heap
page read and write
30B3000
heap
page read and write
79CC000
heap
page read and write
304F000
heap
page read and write
79C3000
heap
page read and write
7B11000
heap
page read and write
79CB000
heap
page read and write
79C5000
heap
page read and write
9B000
stack
page read and write
7B32000
heap
page read and write
79A0000
heap
page read and write
30B7000
heap
page read and write
79AB000
heap
page read and write
79A7000
heap
page read and write
786D000
stack
page read and write
7A55000
heap
page read and write
79C3000
heap
page read and write
7B24000
heap
page read and write
7BE8000
heap
page read and write
7A15000
heap
page read and write
2D56000
heap
page read and write
7B7E000
heap
page read and write
79AB000
heap
page read and write
7B04000
heap
page read and write
7AF0000
heap
page read and write
4D0D000
stack
page read and write
797A000
heap
page read and write
7A19000
heap
page read and write
7A8B000
heap
page read and write
4930000
heap
page read and write
2F7C000
heap
page read and write
7C98000
heap
page read and write
2FCA000
heap
page read and write
7A6D000
heap
page read and write
79CF000
heap
page read and write
2EEF000
heap
page read and write
7D06000
heap
page read and write
2F26000
heap
page read and write
7B63000
heap
page read and write
7BAF000
heap
page read and write
7DA2000
heap
page read and write
79D4000
heap
page read and write
7A27000
heap
page read and write
799E000
heap
page read and write
79C7000
heap
page read and write
F3E000
unkown
page read and write
79B6000
heap
page read and write
8551000
heap
page read and write
7A6C000
heap
page read and write
7B14000
heap
page read and write
7E5B000
heap
page read and write
7AF1000
heap
page read and write
7A56000
heap
page read and write
7BA1000
heap
page read and write
47EE000
stack
page read and write
7B0B000
heap
page read and write
79AB000
heap
page read and write
79A2000
heap
page read and write
7E93000
heap
page read and write
2DEB000
heap
page read and write
79C3000
heap
page read and write
7CF0000
trusted library allocation
page read and write
79BD000
heap
page read and write
7BA2000
heap
page read and write
7997000
heap
page read and write
7AAB000
heap
page read and write
797A000
heap
page read and write
7BA1000
heap
page read and write
7B28000
heap
page read and write
79BE000
heap
page read and write
2DEB000
heap
page read and write
7C98000
heap
page read and write
7B2B000
heap
page read and write
79C2000
heap
page read and write
7A5B000
heap
page read and write
1F0000
heap
page read and write
4AE0000
heap
page read and write
7B63000
heap
page read and write
7E9A000
heap
page read and write
4D00000
heap
page read and write
7998000
heap
page read and write
79D9000
heap
page read and write
79CF000
heap
page read and write
79CE000
heap
page read and write
6D84000
heap
page read and write
79EA000
heap
page read and write
4D60000
remote allocation
page read and write
79AB000
heap
page read and write
797C000
heap
page read and write
799E000
heap
page read and write
7CD0000
trusted library allocation
page read and write
797A000
heap
page read and write
7B1C000
heap
page read and write
2ECE000
heap
page read and write
2E99000
heap
page read and write
7B63000
heap
page read and write
7DA9000
heap
page read and write
618000
heap
page read and write
79C4000
heap
page read and write
79BB000
heap
page read and write
7B0F000
heap
page read and write
79B6000
heap
page read and write
79C5000
heap
page read and write
2F86000
heap
page read and write
7B9E000
heap
page read and write
7998000
heap
page read and write
2F2E000
heap
page read and write
713D000
stack
page read and write
7980000
heap
page read and write
8551000
heap
page read and write
79C3000
heap
page read and write
7DA5000
heap
page read and write
7A01000
heap
page read and write
7AF1000
heap
page read and write
7B05000
heap
page read and write
2F7C000
heap
page read and write
79BB000
heap
page read and write
7A60000
heap
page read and write
7B10000
heap
page read and write
7C4A000
heap
page read and write
2DD3000
heap
page read and write
7D00000
trusted library allocation
page read and write
7997000
heap
page read and write
796B000
heap
page read and write
7DAD000
heap
page read and write
79C3000
heap
page read and write
7B85000
heap
page read and write
2D78000
heap
page read and write
7B0A000
heap
page read and write
79EF000
heap
page read and write
2DD3000
heap
page read and write
7BC3000
heap
page read and write
79BD000
heap
page read and write
7B15000
heap
page read and write
79AB000
heap
page read and write
7BB1000
heap
page read and write
79AA000
heap
page read and write
7B37000
heap
page read and write
7E86000
heap
page read and write
796B000
heap
page read and write
7C26000
heap
page read and write
30A0000
heap
page read and write
2DA0000
heap
page read and write
2D6C000
heap
page read and write
7A74000
heap
page read and write
496E000
heap
page execute and read and write
2ED2000
heap
page read and write
2F22000
heap
page read and write
79EA000
heap
page read and write
8550000
heap
page read and write
7B0A000
heap
page read and write
7E6F000
heap
page read and write
7C36000
heap
page read and write
797A000
heap
page read and write
74BE000
stack
page read and write
7C5C000
heap
page read and write
7987000
heap
page read and write
7A7E000
heap
page read and write
300D000
heap
page read and write
798B000
heap
page read and write
2DEB000
heap
page read and write
7380000
remote allocation
page read and write
2EA0000
heap
page read and write
7997000
heap
page read and write
7B11000
heap
page read and write
7BA1000
heap
page read and write
490F000
stack
page read and write
7B07000
heap
page read and write
4C40000
heap
page read and write
79C7000
heap
page read and write
7CFE000
heap
page read and write
7C43000
heap
page read and write
7997000
heap
page read and write
2CB6000
unkown
page readonly
3054000
heap
page read and write
7DAD000
heap
page read and write
7CD0000
trusted library allocation
page read and write
7B05000
heap
page read and write
2F7C000
heap
page read and write
79D6000
heap
page read and write
79DA000
heap
page read and write
79BA000
heap
page read and write
2CB6000
unkown
page readonly
2EB7000
heap
page read and write
305C000
heap
page read and write
85F000
stack
page read and write
7B01000
heap
page read and write
7B9D000
heap
page read and write
30BD000
heap
page read and write
7A45000
heap
page read and write
2EFE000
stack
page read and write
2EE3000
heap
page read and write
4DED000
stack
page read and write
79B6000
heap
page read and write
7951000
heap
page read and write
79C2000
heap
page read and write
7B01000
heap
page read and write
6FFD000
stack
page read and write
7CF0000
trusted library allocation
page read and write
79CF000
heap
page read and write
7D11000
heap
page read and write
780E000
stack
page read and write
7C5C000
heap
page read and write
7B36000
heap
page read and write
7370000
remote allocation
page read and write
7AB9000
heap
page read and write
79B4000
heap
page read and write
4E9D000
stack
page read and write
7B24000
heap
page read and write
7AF1000
heap
page read and write
7B08000
heap
page read and write
8541000
heap
page read and write
2F2B000
heap
page read and write
3060000
heap
page read and write
79A8000
heap
page read and write
7C80000
heap
page read and write
7A0A000
heap
page read and write
7BD9000
heap
page read and write
7B64000
heap
page read and write
2F89000
heap
page read and write
796A000
heap
page read and write
2DA0000
heap
page read and write
79DA000
heap
page read and write
79B4000
heap
page read and write
714D000
stack
page read and write
2E66000
heap
page read and write
2F1F000
heap
page read and write
7997000
heap
page read and write
797A000
heap
page read and write
79CD000
heap
page read and write
7B0F000
heap
page read and write
7997000
heap
page read and write
7C27000
heap
page read and write
7B01000
heap
page read and write
79F7000
heap
page read and write
2CB6000
unkown
page readonly
7E9E000
heap
page read and write
2EAA000
heap
page read and write
79A3000
heap
page read and write
79D2000
heap
page read and write
2D77000
heap
page read and write
2F95000
heap
page read and write
79CF000
heap
page read and write
2F7C000
heap
page read and write
7BA1000
heap
page read and write
7BC0000
heap
page read and write
7DBD000
heap
page read and write
7B24000
heap
page read and write
7B7E000
heap
page read and write
7984000
heap
page read and write
7B24000
heap
page read and write
7A05000
heap
page read and write
7B63000
heap
page read and write
7984000
heap
page read and write
40C000
unkown
page readonly
7987000
heap
page read and write
7B01000
heap
page read and write
7B63000
heap
page read and write
724E000
stack
page read and write
79CC000
heap
page read and write
7997000
heap
page read and write
797F000
heap
page read and write
79AB000
heap
page read and write
7B11000
heap
page read and write
40C000
unkown
page readonly
79C5000
heap
page read and write
7981000
heap
page read and write
79BA000
heap
page read and write
7CF0000
trusted library allocation
page read and write
7A27000
heap
page read and write
7A50000
heap
page read and write
7994000
heap
page read and write
7B32000
heap
page read and write
79B4000
heap
page read and write
2EF4000
heap
page read and write
79AC000
heap
page read and write
4A00000
heap
page read and write
7967000
heap
page read and write
79B6000
heap
page read and write
30B3000
heap
page read and write
7A45000
heap
page read and write
7CE0000
trusted library allocation
page read and write
7981000
heap
page read and write
2DD3000
heap
page read and write
79C0000
heap
page read and write
2D6C000
heap
page read and write
7CD0000
trusted library allocation
page read and write
79CF000
heap
page read and write
797A000
heap
page read and write
7B01000
heap
page read and write
7B11000
heap
page read and write
79C5000
heap
page read and write
7C45000
heap
page read and write
7B11000
heap
page read and write
7AF1000
heap
page read and write
2D6C000
heap
page read and write
81E000
stack
page read and write
79CF000
heap
page read and write
8540000
heap
page read and write
7967000
heap
page read and write
7B12000
heap
page read and write
7AF1000
heap
page read and write
79EB000
heap
page read and write
2E88000
heap
page read and write
7A49000
heap
page read and write
79F9000
heap
page read and write
2DEB000
heap
page read and write
79A0000
heap
page read and write
7AFB000
heap
page read and write
7CF0000
trusted library allocation
page read and write
79CC000
heap
page read and write
2ED8000
heap
page read and write
2F1F000
stack
page read and write
7C98000
heap
page read and write
7CF0000
trusted library allocation
page read and write
79B4000
heap
page read and write
2FC0000
heap
page read and write
79CB000
heap
page read and write
7B0A000
heap
page read and write
79B6000
heap
page read and write
7A49000
heap
page read and write
7997000
heap
page read and write
7B47000
heap
page read and write
7984000
heap
page read and write
2EA8000
heap
page read and write
2EE9000
heap
page read and write
79C3000
heap
page read and write
7B1B000
heap
page read and write
7C98000
heap
page read and write
79CA000
heap
page read and write
7A27000
heap
page read and write
73AE000
stack
page read and write
796E000
heap
page read and write
7AFB000
heap
page read and write
300F000
heap
page read and write
2D27000
heap
page read and write
2D73000
heap
page read and write
7989000
heap
page read and write
8560000
heap
page read and write
2F2E000
heap
page read and write
7B29000
heap
page read and write
3054000
heap
page read and write
7CE0000
trusted library allocation
page read and write
7CD0000
trusted library allocation
page read and write
79B8000
heap
page read and write
7A27000
heap
page read and write
797C000
heap
page read and write
7A27000
heap
page read and write
79BE000
heap
page read and write
2CB6000
unkown
page readonly
7962000
heap
page read and write
7D1F000
heap
page read and write
7B32000
heap
page read and write
2F89000
heap
page read and write
7C48000
heap
page read and write
7A1E000
heap
page read and write
4E20000
heap
page read and write
7998000
heap
page read and write
401000
unkown
page execute read
79C3000
heap
page read and write
7967000
heap
page read and write
304F000
heap
page read and write
7B9E000
heap
page read and write
7B1B000
heap
page read and write
79F9000
heap
page read and write
79CE000
heap
page read and write
7B07000
heap
page read and write
7B24000
heap
page read and write
2D1C000
heap
page read and write
2F23000
heap
page read and write
2D2D000
heap
page read and write
2DD3000
heap
page read and write
7CFF000
heap
page read and write
7CE0000
trusted library allocation
page read and write
There are 1716 hidden memdumps, click here to show them.