IOC Report
2q45IEa3Ee.exe

loading gif

Files

File Path
Type
Category
Malicious
2q45IEa3Ee.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma1504[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\uw5Stgma3gbM9Xo4g_6cCoQ.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AdobeUpdaterV202.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSIUpdaterV202.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oRkIPIEeryat7GMgjkBr.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\4yAbYkouo2kFHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\6fh90gXBIXtLCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\BlbScHFwlLfTWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\Dssi8APnhY2JHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\LBC6lg2YJ3HXLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\McwFytJF8a_xHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\PGpLy2WBlLFSWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\SMhcoWrJBtJiHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\YdLSeGsJxirBWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\_TP0jqeyFqX_Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\btyqKjO2JbORWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\hFeN_nRcyMkILogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\i8Wb7Rd9dTs_Login Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\y_CqgZq8h7seWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END\History\Firefox_fqs92o4p.default-release.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyBzNJzauM1END\screenshot.png
PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
dropped
There are 21 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\2q45IEa3Ee.exe
"C:\Users\user\Desktop\2q45IEa3Ee.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c LG" /sc ONLOGON /rl HIGHEST
malicious
C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe
"C:\Users\user\AppData\Local\Temp\spanBzNJzauM1END\oRkIPIEeryat7GMgjkBr.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
 malicious
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
C:\ProgramData\MSIUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\MSIUpdaterV202.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
"C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe
"C:\Users\user\AppData\Local\AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c\AdobeUpdaterV202.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 5 hidden processes, click here to show them.

URLs

Name
IP
Malicious
bordersoarmanusjuw.shop
malicious
https://bordersoarmanusjuw.shop/api
172.67.189.66
 malicious
mealplayerpreceodsju.shop
malicious
absentconvicsjawun.shop
malicious
http://193.233.132.253/lumma1504.exe
193.233.132.253
 malicious
pushjellysingeywus.shop
malicious
economicscreateojsu.shop
malicious
wifeplasterbakewis.shop
malicious
suitcaseacanehalk.shop
malicious
entitlementappwo.shop
malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://bordersoarmanusjuw.shop/k9
unknown
https://duckduckgo.com/ac/?q=
unknown
http://ocsp.sectigo.com0
unknown
https://bordersoarmanusjuw.shop/0
unknown
https://db-ip.com/
unknown
https://bordersoarmanusjuw.shop:443/apiSID
unknown
https://bordersoarmanusjuw.shop:443/api
unknown
https://bordersoarmanusjuw.shop/San
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://bordersoarmanusjuw.shop/apiVY
unknown
https://ipinfo.io/Content-Type:
unknown
https://bordersoarmanusjuw.shop/Xavf
unknown
https://ipinfo.io/widget/demo/81.181.57.52/0
unknown
https://bordersoarmanusjuw.shop/es)
unknown
http://193.233.132.253/lumma1504.exedser
unknown
https://t.me/risepro_bot.52igY
unknown
https://bordersoarmanusjuw.shop/
unknown
http://193.233.132.253/lumma1504.exesw
unknown
https://ipinfo.io:443/widget/demo/81.181.57.52
unknown
https://t.me/risepro_botrisepro8Y
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://ipinfo.io/s
unknown
https://bordersoarmanusjuw.shop/api$
unknown
https://bordersoarmanusjuw.shop/api(
unknown
https://bordersoarmanusjuw.shop/#
unknown
https://bordersoarmanusjuw.shop/rx
unknown
https://db-ip.com:443/demo/home.php?s=81.181.57.52
unknown
https://sectigo.com/CPS0
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bordersoarmanusjuw.shop/&Y
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://t.me/RiseProSUPPORT
unknown
https://bordersoarmanusjuw.shop/y
unknown
https://ipinfo.io/L
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://bordersoarmanusjuw.shop/apiM
unknown
https://www.ecosia.org/newtab/
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://ipinfo.io/widget/demo/81.181.57.52
34.117.186.192
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
https://t.me/risepro_bot
unknown
https://ipinfo.io/
unknown
https://db-ip.com/demo/home.php?s=81.181.57.52
104.26.5.15
https://www.maxmind.com/en/locate-my-ip-address
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
https://bordersoarmanusjuw.shop/O
unknown
https://bordersoarmanusjuw.shop/apie
unknown
https://bordersoarmanusjuw.shop/ll
unknown
http://www.winimage.com/zLibDll
unknown
https://support.mozilla.org
unknown
https://bordersoarmanusjuw.shop/pi
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
https://bordersoarmanusjuw.shop/piable
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bordersoarmanusjuw.shop/apir
unknown
There are 61 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bordersoarmanusjuw.shop
172.67.189.66
 malicious
ipinfo.io
34.117.186.192
db-ip.com
104.26.5.15

IPs

IP
Domain
Country
Malicious
172.67.189.66
bordersoarmanusjuw.shop
United States
malicious
193.233.132.253
unknown
Russian Federation
malicious
34.117.186.192
ipinfo.io
United States
104.26.5.15
db-ip.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV202_3e3a2bee5ace9e061f31a101c1269b0c

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
5E26000
heap
page read and write
 malicious
5A4B000
stack
page read and write
1480000
heap
page read and write
8BB000
trusted library allocation
page execute and read and write
1485000
heap
page read and write
5FC6000
heap
page read and write
620F000
stack
page read and write
3CE1000
trusted library allocation
page read and write
5FEA000
heap
page read and write
1570000
direct allocation
page read and write
5FC6000
heap
page read and write
5FF0000
heap
page read and write
2A3B000
trusted library allocation
page read and write
1423000
trusted library allocation
page execute and read and write
4355000
trusted library allocation
page read and write
6002000
heap
page read and write
1410000
trusted library allocation
page read and write
15B4000
heap
page read and write
5FC0000
heap
page read and write
31D1000
heap
page read and write
361F000
trusted library allocation
page read and write
1584000
heap
page read and write
84E000
stack
page read and write
5F70000
trusted library allocation
page read and write
5FCF000
heap
page read and write
5FC6000
heap
page read and write
288E000
stack
page read and write
1659000
heap
page read and write
31D1000
heap
page read and write
5F97000
heap
page read and write
3365000
trusted library allocation
page read and write
2E70000
heap
page read and write
1850000
heap
page read and write
3D9F000
stack
page read and write
F1E000
stack
page read and write
5F9F000
heap
page read and write
145A000
heap
page read and write
1570000
direct allocation
page read and write
391E000
stack
page read and write
945000
heap
page read and write
3140000
heap
page read and write
F5A000
unkown
page execute and read and write
5FBE000
heap
page read and write
12D0000
heap
page read and write
31D1000
heap
page read and write
F50000
heap
page read and write
EA4000
trusted library allocation
page read and write
1435000
heap
page read and write
590D000
stack
page read and write
11F4000
unkown
page execute read
5FB7000
heap
page read and write
37DE000
stack
page read and write
5FD1000
heap
page read and write
C61000
unkown
page execute read
1570000
direct allocation
page read and write
5FA8000
heap
page read and write
17DE000
stack
page read and write
1450000
trusted library allocation
page read and write
5FCF000
heap
page read and write
60E0000
heap
page read and write
5FD1000
heap
page read and write
135E000
stack
page read and write
5FD1000
heap
page read and write
301E000
stack
page read and write
347E000
stack
page read and write
1857000
heap
page read and write
37D0000
heap
page read and write
150E000
stack
page read and write
5FCF000
heap
page read and write
5FA8000
heap
page read and write
3B5E000
stack
page read and write
2833000
trusted library allocation
page read and write
5FD4000
heap
page read and write
2820000
heap
page read and write
F77000
heap
page read and write
2E9D000
stack
page read and write
3B40000
heap
page read and write
17D1000
heap
page read and write
140E000
stack
page read and write
5FCF000
heap
page read and write
29D0000
trusted library allocation
page read and write
E3E000
stack
page read and write
31D1000
heap
page read and write
29A0000
trusted library allocation
page read and write
E2D000
unkown
page readonly
369F000
stack
page read and write
31D1000
heap
page read and write
31D1000
heap
page read and write
3868000
trusted library allocation
page read and write
31D1000
heap
page read and write
15A7000
heap
page read and write
5FDB000
heap
page read and write
3830000
heap
page read and write
10BB000
trusted library allocation
page execute and read and write
31D1000
heap
page read and write
115E000
stack
page read and write
31D1000
heap
page read and write
C10000
trusted library allocation
page read and write
5FD8000
heap
page read and write
15DA000
heap
page read and write
DEA000
unkown
page readonly
D40000
trusted library allocation
page read and write
3610000
direct allocation
page read and write
EA3000
trusted library allocation
page execute and read and write
2731000
trusted library allocation
page read and write
1570000
direct allocation
page read and write
2A70000
trusted library allocation
page read and write
940000
heap
page read and write
5FC0000
heap
page read and write
5F70000
trusted library allocation
page read and write
69D000
stack
page read and write
6DA000
heap
page read and write
31D1000
heap
page read and write
17C0000
heap
page read and write
960000
heap
page read and write
31D1000
heap
page read and write
F5A000
heap
page read and write
31D1000
heap
page read and write
37A2000
trusted library allocation
page read and write
150F000
heap
page read and write
1820000
heap
page read and write
600A000
heap
page read and write
127E000
stack
page read and write
3353000
trusted library allocation
page read and write
3830000
trusted library allocation
page read and write
16F0000
direct allocation
page read and write
890000
trusted library allocation
page read and write
5FBC000
heap
page read and write
1430000
trusted library allocation
page read and write
299E000
stack
page read and write
862000
unkown
page readonly
31A0000
remote allocation
page read and write
56E9000
heap
page read and write
5E27000
heap
page read and write
5FA8000
heap
page read and write
11F4000
unkown
page execute read
A25000
heap
page read and write
35F2000
trusted library allocation
page read and write
3C61000
trusted library allocation
page read and write
5D00000
heap
page read and write
5FBF000
heap
page read and write
3340000
heap
page execute and read and write
5FA8000
heap
page read and write
398E000
stack
page read and write
D60000
heap
page read and write
31D1000
heap
page read and write
6019000
heap
page read and write
3849000
trusted library allocation
page read and write
1570000
direct allocation
page read and write
5FD1000
heap
page read and write
5FFB000
heap
page read and write
16F0000
direct allocation
page read and write
2C63000
trusted library allocation
page read and write
8FB000
stack
page read and write
601A000
heap
page read and write
5FC6000
heap
page read and write
5FC6000
heap
page read and write
17A9000
heap
page read and write
5F74000
heap
page read and write
4D5E000
stack
page read and write
6005000
heap
page read and write
31D1000
heap
page read and write
158E000
stack
page read and write
5F9F000
heap
page read and write
17DB000
heap
page read and write
5FA7000
heap
page read and write
3359000
trusted library allocation
page read and write
EDE000
stack
page read and write
31A0000
remote allocation
page read and write
6005000
heap
page read and write
1570000
direct allocation
page read and write
C70000
heap
page read and write
144D000
stack
page read and write
5FCF000
heap
page read and write
5FD1000
heap
page read and write
2735000
trusted library allocation
page read and write
31D1000
heap
page read and write
185D000
heap
page read and write
1584000
heap
page read and write
F60000
heap
page read and write
5FBA000
heap
page read and write
884000
trusted library allocation
page read and write
F60000
unkown
page execute and read and write
F64000
unkown
page execute and read and write
111E000
stack
page read and write
6D0000
heap
page read and write
E38000
unkown
page readonly
22DE000
stack
page read and write
5FC7000
heap
page read and write
860000
trusted library allocation
page read and write
5FC9000
heap
page read and write
31D1000
heap
page read and write
1158000
stack
page read and write
2810000
heap
page execute and read and write
5F97000
heap
page read and write
4FE000
stack
page read and write
3835000
trusted library allocation
page read and write
DEA000
unkown
page readonly
5F97000
heap
page read and write
2C75000
trusted library allocation
page read and write
6FB000
stack
page read and write
DF5000
unkown
page readonly
29BB000
trusted library allocation
page execute and read and write
F7C000
heap
page read and write
2CF5000
trusted library allocation
page read and write
5FA8000
heap
page read and write
1424000
trusted library allocation
page read and write
5FE9000
heap
page read and write
5FEE000
heap
page read and write
156E000
stack
page read and write
5FA8000
heap
page read and write
153D000
heap
page read and write
2CE3000
trusted library allocation
page read and write
5FA8000
heap
page read and write
1570000
direct allocation
page read and write
6070000
trusted library allocation
page read and write
5F70000
trusted library allocation
page read and write
8F0000
heap
page read and write
6070000
trusted library allocation
page read and write
158A000
heap
page read and write
883000
trusted library allocation
page execute and read and write
31D1000
heap
page read and write
5FCB000
heap
page read and write
5FD7000
heap
page read and write
5FE1000
heap
page read and write
31D1000
heap
page read and write
9E0000
heap
page read and write
140E000
stack
page read and write
140E000
stack
page read and write
17AB000
heap
page read and write
29C0000
trusted library allocation
page read and write
F3B000
stack
page read and write
12A0000
heap
page read and write
5FD7000
heap
page read and write
2A60000
trusted library allocation
page execute and read and write
16F0000
direct allocation
page read and write
3831000
trusted library allocation
page read and write
1300000
heap
page read and write
5CDF000
stack
page read and write
5FC0000
heap
page read and write
1850000
heap
page read and write
1570000
direct allocation
page read and write
1520000
heap
page read and write
3891000
trusted library allocation
page read and write
A14000
heap
page read and write
5F5F000
stack
page read and write
325E000
stack
page read and write
10B0000
trusted library allocation
page read and write
F20000
trusted library allocation
page read and write
5FDD000
heap
page read and write
FCB000
stack
page read and write
E38000
unkown
page readonly
31D1000
heap
page read and write
610E000
stack
page read and write
31D1000
heap
page read and write
3355000
trusted library allocation
page read and write
F58000
unkown
page execute and read and write
5F70000
trusted library allocation
page read and write
9CB000
stack
page read and write
2CE1000
trusted library allocation
page read and write
5FC0000
heap
page read and write
5F8F000
heap
page read and write
2AD0000
heap
page read and write
5FEA000
heap
page read and write
16D0000
heap
page read and write
1584000
heap
page read and write
5D30000
heap
page read and write
1456000
stack
page read and write
13C0000
heap
page read and write
F84000
heap
page read and write
A0C000
heap
page read and write
2FDD000
stack
page read and write
1410000
heap
page read and write
80E000
stack
page read and write
3582000
trusted library allocation
page read and write
5FE3000
heap
page read and write
5FCF000
heap
page read and write
5FFA000
heap
page read and write
371E000
stack
page read and write
1450000
heap
page read and write
1360000
heap
page read and write
F68000
unkown
page execute and read and write
6070000
trusted library allocation
page read and write
E2D000
unkown
page readonly
D0D000
stack
page read and write
5F70000
trusted library allocation
page read and write
149B000
heap
page read and write
6070000
trusted library allocation
page read and write
5FDE000
heap
page read and write
F4F000
stack
page read and write
1330000
heap
page read and write
5FCE000
heap
page read and write
5FDC000
heap
page read and write
9AE000
stack
page read and write
C04000
trusted library allocation
page read and write
1490000
heap
page read and write
79F000
heap
page read and write
C3B000
trusted library allocation
page execute and read and write
2CE2000
trusted library allocation
page execute and read and write
31D1000
heap
page read and write
5FCB000
heap
page read and write
5FF0000
heap
page read and write
373D000
trusted library allocation
page read and write
140A000
heap
page read and write
31D1000
heap
page read and write
153E000
heap
page read and write
3A2F000
stack
page read and write
99C000
stack
page read and write
1570000
direct allocation
page read and write
35C000
stack
page read and write
600A000
heap
page read and write
E9E000
stack
page read and write
326D000
stack
page read and write
5FC0000
heap
page read and write
5FD1000
heap
page read and write
3940000
trusted library allocation
page read and write
5FD1000
heap
page read and write
5FC6000
heap
page read and write
148E000
stack
page read and write
29E2000
trusted library allocation
page read and write
5FCF000
heap
page read and write
CFB000
stack
page read and write
894000
trusted library allocation
page read and write
F93000
heap
page read and write
17E5000
heap
page read and write
5FB7000
heap
page read and write
927000
heap
page read and write
31A0000
remote allocation
page read and write
168E000
stack
page read and write
5FC8000
heap
page read and write
A18000
heap
page read and write
108F000
stack
page read and write
5FD1000
heap
page read and write
152A000
heap
page read and write
8CE000
stack
page read and write
F62000
unkown
page execute and read and write
17B0000
heap
page read and write
1094000
trusted library allocation
page read and write
5FAD000
heap
page read and write
71D000
heap
page read and write
2C50000
heap
page execute and read and write
5FEA000
heap
page read and write
E6E000
unkown
page write copy
C60000
unkown
page readonly
5FB7000
heap
page read and write
31D1000
heap
page read and write
1483000
heap
page read and write
2620000
heap
page read and write
15D7000
heap
page read and write
5FA8000
heap
page read and write
311F000
stack
page read and write
6005000
heap
page read and write
5FD1000
heap
page read and write
31D0000
heap
page read and write
183D000
heap
page read and write
1855000
heap
page read and write
31D1000
heap
page read and write
5F92000
heap
page read and write
A3F000
heap
page read and write
153B000
heap
page read and write
49CE000
stack
page read and write
5FCF000
heap
page read and write
5FF5000
heap
page read and write
5FA8000
heap
page read and write
361E000
stack
page read and write
5FD1000
heap
page read and write
5FEB000
heap
page read and write
3859000
trusted library allocation
page read and write
5FDB000
heap
page read and write
E23000
unkown
page readonly
561A000
heap
page read and write
2A5E000
stack
page read and write
15C9000
heap
page read and write
358C000
trusted library allocation
page read and write
1855000
heap
page read and write
18D0000
trusted library allocation
page read and write
31D1000
heap
page read and write
1590000
trusted library allocation
page execute and read and write
18E0000
heap
page read and write
6005000
heap
page read and write
1570000
direct allocation
page read and write
5FCF000
heap
page read and write
5F81000
heap
page read and write
145B000
trusted library allocation
page execute and read and write
6070000
trusted library allocation
page read and write
5FC7000
heap
page read and write
5FFD000
heap
page read and write
138E000
stack
page read and write
D50000
heap
page read and write
2732000
trusted library allocation
page execute and read and write
A07000
heap
page read and write
5FFF000
heap
page read and write
943000
heap
page read and write
1797000
heap
page read and write
35D2000
trusted library allocation
page read and write
5FE7000
heap
page read and write
31D1000
heap
page read and write
BEE000
stack
page read and write
DC2000
unkown
page readonly
2C61000
trusted library allocation
page read and write
5FB4000
heap
page read and write
3740000
trusted library allocation
page read and write
56B2000
heap
page read and write
2832000
trusted library allocation
page execute and read and write
5D31000
heap
page read and write
1570000
direct allocation
page read and write
D10000
trusted library allocation
page execute and read and write
31D1000
heap
page read and write
D95000
heap
page read and write
1472000
heap
page read and write
1792000
heap
page read and write
2FEE000
stack
page read and write
6026000
heap
page read and write
31D1000
heap
page read and write
24F0000
trusted library allocation
page read and write
6004000
heap
page read and write
36EF000
stack
page read and write
5FD1000
heap
page read and write
315D000
stack
page read and write
5FA8000
heap
page read and write
1090000
trusted library allocation
page read and write
11C0000
heap
page read and write
5D32000
heap
page read and write
3A20000
heap
page read and write
289E000
stack
page read and write
179F000
stack
page read and write
5FC6000
heap
page read and write
382E000
stack
page read and write
540000
heap
page read and write
31D1000
heap
page read and write
156D000
stack
page read and write
660B000
stack
page read and write
DF5000
unkown
page readonly
1470000
trusted library allocation
page read and write
C60000
unkown
page readonly
272E000
stack
page read and write
12FB000
stack
page read and write
15C9000
heap
page read and write
C61000
unkown
page execute read
5FFA000
heap
page read and write
44A000
remote allocation
page execute and read and write
FBD000
stack
page read and write
31D1000
heap
page read and write
31D1000
heap
page read and write
1390000
heap
page read and write
13CE000
stack
page read and write
1576000
heap
page read and write
280E000
stack
page read and write
392E000
stack
page read and write
94C000
stack
page read and write
3738000
trusted library allocation
page read and write
1570000
direct allocation
page read and write
F70000
heap
page read and write
5FEC000
heap
page read and write
3805000
trusted library allocation
page read and write
36CD000
stack
page read and write
5FE9000
heap
page read and write
601A000
heap
page read and write
1434000
trusted library allocation
page read and write
31D1000
heap
page read and write
1320000
heap
page read and write
31D1000
heap
page read and write
5F78000
heap
page read and write
3A8F000
stack
page read and write
F5E000
heap
page read and write
2EEF000
stack
page read and write
9B0000
heap
page read and write
229D000
stack
page read and write
31D1000
heap
page read and write
5FC6000
heap
page read and write
183A000
heap
page read and write
D6A000
heap
page read and write
1653000
heap
page read and write
D6E000
heap
page read and write
5F70000
trusted library allocation
page read and write
2739000
trusted library allocation
page read and write
1C8000
stack
page read and write
3190000
heap
page read and write
1570000
direct allocation
page read and write
37E5000
trusted library allocation
page read and write
E6E000
unkown
page read and write
1354000
unkown
page readonly
2A1E000
stack
page read and write
7B6000
heap
page read and write
1220000
heap
page read and write
500000
heap
page read and write
5FA8000
heap
page read and write
5FCF000
heap
page read and write
275E000
stack
page read and write
31D1000
heap
page read and write
12F8000
stack
page read and write
545000
heap
page read and write
60D4000
heap
page read and write
860000
unkown
page readonly
5FA8000
heap
page read and write
E70000
unkown
page execute and read and write
6270000
heap
page read and write
12F8000
stack
page read and write
9EA000
heap
page read and write
1093000
trusted library allocation
page execute and read and write
6000000
heap
page read and write
619B000
heap
page read and write
5D20000
heap
page read and write
149C000
heap
page read and write
3C65000
trusted library allocation
page read and write
1430000
heap
page read and write
56E0000
heap
page read and write
DE0000
heap
page read and write
5FE7000
heap
page read and write
31D1000
heap
page read and write
15F5000
heap
page read and write
1480000
heap
page read and write
181D000
stack
page read and write
F5C000
unkown
page execute and read and write
6070000
trusted library allocation
page read and write
DE2000
unkown
page write copy
17BD000
heap
page read and write
5F70000
heap
page read and write
5B8D000
stack
page read and write
9C0000
heap
page read and write
5FEB000
heap
page read and write
3357000
trusted library allocation
page read and write
362E000
trusted library allocation
page read and write
5FC0000
heap
page read and write
601E000
heap
page read and write
5FCF000
heap
page read and write
14BD000
heap
page read and write
795000
heap
page read and write
5F97000
heap
page read and write
35DF000
stack
page read and write
1767000
heap
page read and write
219E000
stack
page read and write
5FD1000
heap
page read and write
1170000
heap
page read and write
6026000
heap
page read and write
CFB000
stack
page read and write
FD7000
unkown
page execute and read and write
6004000
heap
page read and write
31D1000
heap
page read and write
16D0000
trusted library allocation
page read and write
5FD7000
heap
page read and write
385D000
trusted library allocation
page read and write
31D1000
heap
page read and write
302E000
stack
page read and write
1845000
heap
page read and write
2F5E000
stack
page read and write
36DE000
stack
page read and write
DA3000
heap
page read and write
2845000
trusted library allocation
page read and write
E9E000
stack
page read and write
B1E000
stack
page read and write
5FD1000
heap
page read and write
1570000
direct allocation
page read and write
D3E000
stack
page read and write
15A0000
heap
page read and write
1584000
heap
page read and write
5BDE000
stack
page read and write
3731000
trusted library allocation
page read and write
950000
heap
page read and write
5FD1000
heap
page read and write
1852000
heap
page read and write
285F000
stack
page read and write
2745000
trusted library allocation
page read and write
FA0000
heap
page read and write
7AD000
heap
page read and write
5FC6000
heap
page read and write
5F97000
heap
page read and write
920000
heap
page read and write
1584000
heap
page read and write
31D1000
heap
page read and write
16F0000
direct allocation
page read and write
C03000
trusted library allocation
page execute and read and write
5FCF000
heap
page read and write
D9E000
stack
page read and write
594D000
stack
page read and write
BC0000
heap
page read and write
1570000
direct allocation
page read and write
1330000
heap
page read and write
3735000
trusted library allocation
page read and write
1580000
heap
page read and write
EB0000
heap
page read and write
1838000
heap
page read and write
31D1000
heap
page read and write
6005000
heap
page read and write
184F000
heap
page read and write
37CE000
stack
page read and write
601E000
heap
page read and write
3CE5000
trusted library allocation
page read and write
1365000
heap
page read and write
1844000
heap
page read and write
31D1000
heap
page read and write
17A4000
heap
page read and write
5FD4000
heap
page read and write
6137000
heap
page read and write
5FA8000
heap
page read and write
2A0A000
trusted library allocation
page read and write
2737000
trusted library allocation
page read and write
2BEE000
stack
page read and write
1570000
direct allocation
page read and write
6271000
heap
page read and write
1485000
heap
page read and write
5F70000
trusted library allocation
page read and write
3352000
trusted library allocation
page execute and read and write
5FE3000
heap
page read and write
2BAE000
stack
page read and write
91E000
stack
page read and write
490000
heap
page read and write
3AD0000
heap
page read and write
23DF000
stack
page read and write
17A0000
heap
page read and write
5F95000
heap
page read and write
105B000
stack
page read and write
8B0000
unkown
page readonly
2C62000
trusted library allocation
page execute and read and write
30ED000
stack
page read and write
184D000
heap
page read and write
870000
heap
page read and write
184D000
heap
page read and write
2BD0000
heap
page execute and read and write
15CC000
heap
page read and write
65E000
stack
page read and write
EBB000
stack
page read and write
D00000
heap
page read and write
1570000
direct allocation
page read and write
5FD7000
heap
page read and write
1840000
heap
page read and write
FB8000
stack
page read and write
31D1000
heap
page read and write
37E0000
trusted library allocation
page read and write
5FA8000
heap
page read and write
5FEA000
heap
page read and write
705000
heap
page read and write
E40000
heap
page read and write
C40000
heap
page read and write
5FB3000
heap
page read and write
6001000
heap
page read and write
5FE4000
heap
page read and write
7A3000
heap
page read and write
94A000
heap
page read and write
5FDC000
heap
page read and write
5FA8000
heap
page read and write
1554000
heap
page read and write
31D1000
heap
page read and write
480000
heap
page read and write
6000000
heap
page read and write
17C2000
heap
page read and write
34DE000
stack
page read and write
31D1000
heap
page read and write
31E2000
heap
page read and write
FB0000
heap
page read and write
7CE000
heap
page read and write
5FE9000
heap
page read and write
1492000
heap
page read and write
1855000
heap
page read and write
DC2000
unkown
page readonly
5FE7000
heap
page read and write
5FB9000
heap
page read and write
5FC6000
heap
page read and write
6020000
heap
page read and write
5D35000
heap
page read and write
14CE000
stack
page read and write
2CEF000
stack
page read and write
1570000
direct allocation
page read and write
5F8D000
heap
page read and write
14ED000
stack
page read and write
3C0000
heap
page read and write
5FCF000
heap
page read and write
35EE000
stack
page read and write
5FF0000
heap
page read and write
1370000
heap
page read and write
195F000
stack
page read and write
2831000
trusted library allocation
page read and write
31E0000
heap
page read and write
17D0000
heap
page read and write
324F000
stack
page read and write
1094000
trusted library allocation
page read and write
D8D000
heap
page read and write
5FDE000
heap
page read and write
3D10000
heap
page read and write
482D000
stack
page read and write
2990000
trusted library allocation
page read and write
5FA8000
heap
page read and write
5FE8000
heap
page read and write
2D5E000
stack
page read and write
1584000
heap
page read and write
60E4000
heap
page read and write
D40000
heap
page read and write
38EC000
trusted library allocation
page read and write
5FD1000
heap
page read and write
5FD5000
heap
page read and write
2D9D000
stack
page read and write
5FD1000
heap
page read and write
C60000
trusted library allocation
page execute and read and write
1850000
heap
page read and write
5A8D000
stack
page read and write
5D33000
heap
page read and write
5FA8000
heap
page read and write
5F70000
trusted library allocation
page read and write
2EDE000
stack
page read and write
DE2000
unkown
page read and write
1325000
heap
page read and write
2994000
trusted library allocation
page read and write
958000
heap
page read and write
372D000
stack
page read and write
4351000
trusted library allocation
page read and write
5D10000
heap
page read and write
5D31000
heap
page read and write
5D33000
heap
page read and write
37C4000
trusted library allocation
page read and write
5FC6000
heap
page read and write
BF0000
trusted library allocation
page read and write
5FCF000
heap
page read and write
5FE5000
heap
page read and write
F0C000
stack
page read and write
316E000
stack
page read and write
131E000
stack
page read and write
1080000
trusted library allocation
page read and write
5FB9000
heap
page read and write
17C8000
heap
page read and write
9EE000
heap
page read and write
5FE7000
heap
page read and write
15CF000
heap
page read and write
C90000
heap
page read and write
305F000
stack
page read and write
357F000
stack
page read and write
5FFB000
heap
page read and write
544E000
stack
page read and write
3840000
trusted library allocation
page read and write
C14000
trusted library allocation
page read and write
3782000
trusted library allocation
page read and write
1570000
direct allocation
page read and write
5F80000
heap
page read and write
38C9000
trusted library allocation
page read and write
FE0000
heap
page read and write
5FD8000
heap
page read and write
C30000
heap
page read and write
3730000
trusted library allocation
page read and write
3EF0000
heap
page read and write
1584000
heap
page read and write
5FD7000
heap
page read and write
785000
heap
page read and write
3D0000
heap
page read and write
5FCF000
heap
page read and write
16CE000
stack
page read and write
5FF2000
heap
page read and write
1584000
heap
page read and write
3580000
trusted library allocation
page read and write
600A000
heap
page read and write
5FEA000
heap
page read and write
5F9F000
heap
page read and write
CCF000
stack
page read and write
6005000
heap
page read and write
5FBA000
heap
page read and write
144E000
stack
page read and write
1580000
heap
page read and write
5F70000
trusted library allocation
page read and write
31D1000
heap
page read and write
2AA0000
heap
page read and write
5FD1000
heap
page read and write
1506000
heap
page read and write
10A0000
heap
page read and write
3947000
trusted library allocation
page read and write
2FED000
stack
page read and write
5FC6000
heap
page read and write
5FBC000
heap
page read and write
316D000
stack
page read and write
1844000
heap
page read and write
FC0000
heap
page read and write
6026000
heap
page read and write
373B000
trusted library allocation
page read and write
601A000
heap
page read and write
5FF0000
heap
page read and write
6026000
heap
page read and write
5FD0000
heap
page read and write
3852000
trusted library allocation
page read and write
5FCB000
heap
page read and write
1855000
heap
page read and write
5FB1000
heap
page read and write
DF0000
heap
page read and write
5FCF000
heap
page read and write
31D1000
heap
page read and write
3C5F000
stack
page read and write
601F000
heap
page read and write
25E0000
heap
page execute and read and write
5FA8000
heap
page read and write
5D21000
heap
page read and write
5FD7000
heap
page read and write
298F000
stack
page read and write
147B000
heap
page read and write
D20000
heap
page read and write
F66000
unkown
page execute and read and write
156B000
heap
page read and write
1584000
heap
page read and write
2DEE000
stack
page read and write
1570000
direct allocation
page read and write
5FF9000
heap
page read and write
1570000
direct allocation
page read and write
CB000
stack
page read and write
5FCF000
heap
page read and write
E23000
unkown
page readonly
15C4000
heap
page read and write
875000
heap
page read and write
5FC1000
heap
page read and write
F5E000
unkown
page execute and read and write
13F5000
heap
page read and write
3846000
trusted library allocation
page read and write
31C6000
heap
page read and write
600D000
heap
page read and write
3351000
trusted library allocation
page read and write
6070000
trusted library allocation
page read and write
3C9E000
stack
page read and write
5FF0000
heap
page read and write
31C0000
heap
page read and write
29B0000
trusted library allocation
page read and write
2733000
trusted library allocation
page read and write
5FA8000
heap
page read and write
5DC000
stack
page read and write
5FB7000
heap
page read and write
31D1000
heap
page read and write
14EC000
heap
page read and write
6147000
heap
page read and write
670C000
stack
page read and write
2EEF000
stack
page read and write
162F000
heap
page read and write
5FD1000
heap
page read and write
5FC6000
heap
page read and write
5FC9000
heap
page read and write
2AA0000
heap
page read and write
1850000
heap
page read and write
31D1000
heap
page read and write
5FC6000
heap
page read and write
312E000
stack
page read and write
13CA000
heap
page read and write
14B5000
heap
page read and write
1160000
trusted library allocation
page execute and read and write
1760000
heap
page read and write
1354000
unkown
page readonly
3A1E000
stack
page read and write
4DDE000
stack
page read and write
2CDE000
stack
page read and write
3B70000
heap
page read and write
1584000
heap
page read and write
10D0000
trusted library allocation
page read and write
6CB9000
heap
page read and write
2AC0000
trusted library allocation
page read and write
5FFA000
heap
page read and write
5E5E000
stack
page read and write
There are 838 hidden memdumps, click here to show them.