IOC Report
PO No. 2430800015.exe

loading gif

Files

File Path
Type
Category
Malicious
PO No. 2430800015.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\tmp5967.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\yHoBWWkdpyxFI.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO No. 2430800015.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yHoBWWkdpyxFI.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1nsl5gzm.ezb.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bfjnjfoc.ai5.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_klxnq02u.dkd.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lrnlb3zv.nnh.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp69E2.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Roaming\yHoBWWkdpyxFI.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PO No. 2430800015.exe
"C:\Users\user\Desktop\PO No. 2430800015.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\yHoBWWkdpyxFI.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yHoBWWkdpyxFI" /XML "C:\Users\user\AppData\Local\Temp\tmp5967.tmp"
 malicious
C:\Users\user\Desktop\PO No. 2430800015.exe
"C:\Users\user\Desktop\PO No. 2430800015.exe"
 malicious
C:\Users\user\Desktop\PO No. 2430800015.exe
"C:\Users\user\Desktop\PO No. 2430800015.exe"
 malicious
C:\Users\user\AppData\Roaming\yHoBWWkdpyxFI.exe
C:\Users\user\AppData\Roaming\yHoBWWkdpyxFI.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yHoBWWkdpyxFI" /XML "C:\Users\user\AppData\Local\Temp\tmp69E2.tmp"
 malicious
C:\Users\user\AppData\Roaming\yHoBWWkdpyxFI.exe
"C:\Users\user\AppData\Roaming\yHoBWWkdpyxFI.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 2 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
http://r3.o.lencr.org0
unknown
https://api.ipify.org
unknown
http://mail.leema.lk
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://r3.i.lencr.org/0
unknown

Domains

Name
IP
Malicious
mail.leema.lk
162.241.225.141
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
162.241.225.141
mail.leema.lk
United States
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO No_RASMANCS
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\yHoBWWkdpyxFI_RASMANCS
FileDirectory
There are 19 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4E89000
trusted library allocation
page read and write
 malicious
2F17000
trusted library allocation
page read and write
 malicious
432000
remote allocation
page execute and read and write
 malicious
2FD5000
trusted library allocation
page read and write
 malicious
2FC2000
trusted library allocation
page read and write
 malicious
2EF1000
trusted library allocation
page read and write
 malicious
2D20000
heap
page execute and read and write
1440000
trusted library allocation
page read and write
83A000
stack
page read and write
CF7F000
stack
page read and write
145D000
trusted library allocation
page execute and read and write
686E000
stack
page read and write
5A29000
trusted library allocation
page read and write
4A3C000
stack
page read and write
652E000
stack
page read and write
E90000
trusted library allocation
page read and write
3EC9000
trusted library allocation
page read and write
2BB2000
trusted library allocation
page read and write
4DF0000
trusted library allocation
page execute and read and write
8CD000
stack
page read and write
6648000
heap
page read and write
DB50000
heap
page read and write
D1FE000
stack
page read and write
E74000
trusted library allocation
page read and write
6A0D000
trusted library allocation
page read and write
53A6000
trusted library allocation
page read and write
CD3E000
stack
page read and write
400000
remote allocation
page execute and read and write
40B000
remote allocation
page execute and read and write
5EF0000
trusted library allocation
page execute and read and write
DCCE000
stack
page read and write
1176000
heap
page read and write
5328000
trusted library allocation
page read and write
2F96000
trusted library allocation
page read and write
54A1000
trusted library allocation
page read and write
B1D000
stack
page read and write
FE9000
stack
page read and write
1475000
trusted library allocation
page execute and read and write
5430000
heap
page read and write
11F2000
heap
page read and write
16DE000
stack
page read and write
40C000
remote allocation
page execute and read and write
2FBA000
trusted library allocation
page read and write
1190000
trusted library allocation
page read and write
4EA8000
trusted library allocation
page read and write
2FF6000
trusted library allocation
page read and write
DBE000
stack
page read and write
1090000
heap
page read and write
2FEE000
trusted library allocation
page read and write
2DE0000
heap
page read and write
5B39000
trusted library allocation
page read and write
11B0000
trusted library allocation
page read and write
503C000
stack
page read and write
461D000
trusted library allocation
page read and write
5150000
heap
page read and write
84D5000
heap
page read and write
3132000
trusted library allocation
page read and write
4692000
trusted library allocation
page read and write
6B2F000
stack
page read and write
581E000
trusted library allocation
page read and write
330C000
stack
page read and write
6B40000
trusted library allocation
page execute and read and write
5BC0000
trusted library allocation
page read and write
431E000
trusted library allocation
page read and write
6D2E000
heap
page read and write
6782000
heap
page read and write
402000
remote allocation
page execute and read and write
313B000
trusted library allocation
page execute and read and write
5570000
heap
page read and write
35FF000
stack
page read and write
5F00000
trusted library allocation
page read and write
1130000
heap
page read and write
503E000
stack
page read and write
15E7000
heap
page read and write
5480000
trusted library allocation
page read and write
312A000
trusted library allocation
page execute and read and write
3310000
heap
page execute and read and write
5890000
trusted library allocation
page read and write
E70000
trusted library allocation
page read and write
5870000
trusted library allocation
page read and write
58E0000
trusted library allocation
page execute and read and write
4B77000
trusted library allocation
page read and write
65EF000
stack
page read and write
3137000
trusted library allocation
page execute and read and write
669F000
heap
page read and write
5140000
heap
page read and write
5B0E000
stack
page read and write
1648000
heap
page read and write
5590000
heap
page read and write
5F30000
trusted library allocation
page read and write
B77000
trusted library allocation
page execute and read and write
3170000
trusted library allocation
page read and write
CCFF000
stack
page read and write
4329000
trusted library allocation
page read and write
5A70000
trusted library section
page readonly
A05000
heap
page read and write
27F4000
trusted library allocation
page read and write
35BE000
stack
page read and write
622E000
stack
page read and write
3FC5000
trusted library allocation
page read and write
6A50000
trusted library allocation
page read and write
4E10000
trusted library allocation
page read and write
6FF0000
trusted library allocation
page read and write
B57000
heap
page read and write
3100000
trusted library allocation
page read and write
3396000
trusted library allocation
page read and write
11A0000
heap
page read and write
1100000
heap
page read and write
5F40000
heap
page read and write
2FAD000
trusted library allocation
page read and write
11D0000
heap
page read and write
1466000
trusted library allocation
page execute and read and write
32E0000
heap
page read and write
6B1E000
stack
page read and write
6ADD000
trusted library allocation
page read and write
5486000
trusted library allocation
page read and write
14B0000
trusted library allocation
page read and write
4E0A000
trusted library allocation
page read and write
120C000
heap
page read and write
1193000
trusted library allocation
page execute and read and write
594E000
stack
page read and write
4C13000
trusted library allocation
page read and write
27FB000
trusted library allocation
page read and write
C04000
heap
page read and write
54A0000
heap
page read and write
B40000
trusted library allocation
page read and write
E00000
trusted library allocation
page execute and read and write
7250000
heap
page read and write
3160000
trusted library allocation
page execute and read and write
195F000
stack
page read and write
1000000
heap
page read and write
9BE000
unkown
page read and write
69EF000
stack
page read and write
12F7000
stack
page read and write
31CE000
stack
page read and write
696D000
stack
page read and write
3941000
trusted library allocation
page read and write
E08E000
stack
page read and write
29B2000
trusted library allocation
page read and write
E04F000
stack
page read and write
6730000
heap
page read and write
4E50000
heap
page read and write
67AE000
stack
page read and write
2DC4000
trusted library allocation
page read and write
147B000
trusted library allocation
page execute and read and write
BF7000
heap
page read and write
9CE000
stack
page read and write
15D6000
heap
page read and write
6B30000
heap
page read and write
5BF0000
trusted library allocation
page read and write
157E000
stack
page read and write
556E000
stack
page read and write
2C77000
trusted library allocation
page execute and read and write
CE3E000
stack
page read and write
8220000
trusted library allocation
page read and write
14A0000
trusted library allocation
page execute and read and write
11C0000
trusted library allocation
page read and write
5583000
heap
page read and write
3130000
trusted library allocation
page read and write
2F2E000
trusted library allocation
page read and write
C82E000
stack
page read and write
B7B000
trusted library allocation
page execute and read and write
539E000
trusted library allocation
page read and write
59D0000
trusted library allocation
page read and write
A00000
heap
page read and write
1194000
trusted library allocation
page read and write
84EF000
heap
page read and write
7EF0000
trusted library section
page read and write
3321000
trusted library allocation
page read and write
2F61000
trusted library allocation
page read and write
2F80000
heap
page read and write
11D8000
heap
page read and write
2E90000
heap
page read and write
64AE000
stack
page read and write
542C000
stack
page read and write
F69000
stack
page read and write
5C30000
heap
page read and write
BC8000
heap
page read and write
1420000
heap
page read and write
2C90000
trusted library allocation
page read and write
8506000
heap
page read and write
15A0000
heap
page read and write
2E3C000
trusted library allocation
page read and write
FAF000
stack
page read and write
5F10000
trusted library section
page read and write
311D000
trusted library allocation
page execute and read and write
5BF9000
trusted library allocation
page read and write
5A0D000
stack
page read and write
B43000
trusted library allocation
page read and write
B20000
trusted library allocation
page read and write
59B3000
trusted library allocation
page read and write
C3E000
heap
page read and write
1460000
trusted library allocation
page read and write
1269000
heap
page read and write
53B2000
trusted library allocation
page read and write
936000
stack
page read and write
6B20000
trusted library allocation
page read and write
29B6000
trusted library allocation
page read and write
3113000
trusted library allocation
page read and write
C53000
heap
page read and write
1817000
heap
page read and write
45A1000
trusted library allocation
page read and write
5BBE000
stack
page read and write
6E8E000
stack
page read and write
144D000
trusted library allocation
page execute and read and write
5483000
heap
page read and write
342E000
unkown
page read and write
6AAF000
stack
page read and write
6FA0000
trusted library allocation
page read and write
6AD0000
trusted library allocation
page read and write
E40F000
stack
page read and write
323D000
stack
page read and write
1590000
heap
page read and write
E76000
trusted library allocation
page read and write
5800000
trusted library allocation
page read and write
346F000
unkown
page read and write
169A000
heap
page read and write
662D000
stack
page read and write
11BB000
heap
page read and write
66C4000
heap
page read and write
1140000
heap
page read and write
35A1000
trusted library allocation
page read and write
61EF000
stack
page read and write
5A0E000
stack
page read and write
6A08000
trusted library allocation
page read and write
656E000
stack
page read and write
666E000
stack
page read and write
612E000
stack
page read and write
970000
heap
page read and write
5830000
trusted library allocation
page read and write
B3D000
trusted library allocation
page execute and read and write
3EA1000
trusted library allocation
page read and write
6FE0000
trusted library allocation
page execute and read and write
1490000
trusted library allocation
page read and write
3F61000
trusted library allocation
page read and write
D0FE000
stack
page read and write
2DD0000
trusted library allocation
page read and write
B72000
trusted library allocation
page read and write
1430000
heap
page read and write
4DA0000
trusted library allocation
page read and write
2BC1000
trusted library allocation
page read and write
12A2000
heap
page read and write
11A7000
heap
page read and write
7000000
trusted library allocation
page read and write
54BC000
stack
page read and write
580B000
trusted library allocation
page read and write
1470000
trusted library allocation
page read and write
59A3000
heap
page read and write
5386000
trusted library allocation
page read and write
5860000
trusted library allocation
page read and write
3660000
heap
page read and write
420000
remote allocation
page execute and read and write
6610000
heap
page read and write
548E000
trusted library allocation
page read and write
5480000
heap
page read and write
826D000
trusted library allocation
page read and write
90A000
stack
page read and write
3180000
heap
page read and write
CFBC000
stack
page read and write
970000
heap
page read and write
1265000
heap
page read and write
CBFE000
stack
page read and write
549A000
trusted library allocation
page read and write
6C10000
trusted library allocation
page read and write
3392000
trusted library allocation
page read and write
4525000
trusted library allocation
page read and write
548B000
trusted library allocation
page read and write
59D4000
heap
page read and write
1174000
heap
page read and write
C01000
heap
page read and write
5C30000
heap
page read and write
2FA1000
trusted library allocation
page read and write
580E000
stack
page read and write
CA7E000
stack
page read and write
E10000
trusted library allocation
page read and write
3126000
trusted library allocation
page execute and read and write
2DC0000
trusted library allocation
page read and write
11FA000
heap
page read and write
E20000
heap
page execute and read and write
5392000
trusted library allocation
page read and write
2758000
trusted library allocation
page read and write
54B2000
trusted library allocation
page read and write
9430000
trusted library allocation
page read and write
2E64000
trusted library allocation
page read and write
6FF5000
trusted library allocation
page read and write
5400000
trusted library allocation
page execute and read and write
15E5000
heap
page read and write
6FD0000
heap
page read and write
1270000
heap
page read and write
8270000
trusted library allocation
page read and write
53A1000
trusted library allocation
page read and write
6A00000
trusted library allocation
page read and write
430000
remote allocation
page execute and read and write
146A000
trusted library allocation
page execute and read and write
7F950000
trusted library allocation
page execute and read and write
1800000
trusted library allocation
page read and write
2E7E000
trusted library allocation
page read and write
9470000
trusted library allocation
page read and write
2C7B000
trusted library allocation
page execute and read and write
293F000
stack
page read and write
120A000
heap
page read and write
57CB000
stack
page read and write
E1CE000
stack
page read and write
6E30000
trusted library allocation
page execute and read and write
5090000
heap
page read and write
15AE000
heap
page read and write
1137000
heap
page read and write
4E53000
heap
page read and write
549E000
trusted library allocation
page read and write
381C000
trusted library allocation
page read and write
4D80000
trusted library allocation
page read and write
63EF000
stack
page read and write
4F68000
trusted library allocation
page read and write
2EA1000
trusted library allocation
page read and write
2F36000
trusted library allocation
page read and write
2DB0000
trusted library allocation
page read and write
E6C000
stack
page read and write
E30E000
stack
page read and write
2E60000
trusted library allocation
page read and write
7F10000
trusted library section
page read and write
7F00000
trusted library allocation
page execute and read and write
2F9F000
trusted library allocation
page read and write
9480000
trusted library allocation
page read and write
54FC000
stack
page read and write
58CC000
stack
page read and write
40D000
remote allocation
page execute and read and write
6F80000
trusted library allocation
page read and write
127E000
heap
page read and write
3949000
trusted library allocation
page read and write
11BD000
trusted library allocation
page execute and read and write
E18E000
stack
page read and write
1200000
heap
page read and write
119D000
trusted library allocation
page execute and read and write
4E13000
trusted library allocation
page read and write
660D000
stack
page read and write
4BC5000
trusted library allocation
page read and write
35B7000
trusted library allocation
page read and write
32CE000
stack
page read and write
14C0000
heap
page read and write
11C2000
trusted library allocation
page read and write
A20000
heap
page read and write
6BBF000
stack
page read and write
69F0000
trusted library allocation
page execute and read and write
6D20000
heap
page read and write
E54C000
stack
page read and write
3150000
trusted library allocation
page read and write
642D000
stack
page read and write
6F90000
trusted library allocation
page read and write
DB0000
heap
page read and write
6AED000
stack
page read and write
3480000
heap
page read and write
DF4E000
stack
page read and write
5832000
trusted library allocation
page read and write
280E000
trusted library allocation
page read and write
5D90000
trusted library section
page read and write
1477000
trusted library allocation
page execute and read and write
69AE000
stack
page read and write
7FBB0000
trusted library allocation
page execute and read and write
2941000
trusted library allocation
page read and write
E69000
stack
page read and write
15AA000
heap
page read and write
58FA000
trusted library allocation
page read and write
6712000
heap
page read and write
2FD0000
heap
page read and write
7710000
heap
page read and write
1148000
heap
page read and write
4CFE000
trusted library allocation
page read and write
5B30000
trusted library allocation
page read and write
32D0000
heap
page read and write
60EF000
stack
page read and write
5A90000
heap
page execute and read and write
2830000
heap
page read and write
5E6B000
stack
page read and write
7902000
trusted library allocation
page read and write
CB7E000
stack
page read and write
5520000
heap
page execute and read and write
41F000
remote allocation
page execute and read and write
2E70000
trusted library allocation
page read and write
2C70000
trusted library allocation
page read and write
8260000
trusted library allocation
page read and write
5A20000
trusted library allocation
page read and write
431000
remote allocation
page execute and read and write
C82000
heap
page read and write
2811000
trusted library allocation
page read and write
1697000
heap
page read and write
8500000
heap
page read and write
59A0000
heap
page read and write
672E000
stack
page read and write
2FB1000
trusted library allocation
page read and write
59B0000
trusted library allocation
page read and write
B6A000
trusted library allocation
page execute and read and write
2ED6000
trusted library allocation
page read and write
A00000
heap
page read and write
2C75000
trusted library allocation
page execute and read and write
5080000
trusted library section
page readonly
11D5000
heap
page read and write
2CDE000
stack
page read and write
FC0000
heap
page read and write
3103000
trusted library allocation
page execute and read and write
7020000
trusted library allocation
page read and write
5804000
trusted library allocation
page read and write
442B000
trusted library allocation
page read and write
5380000
trusted library allocation
page read and write
2E66000
trusted library allocation
page read and write
BE8000
heap
page read and write
68EE000
stack
page read and write
4DE0000
heap
page read and write
B90000
trusted library allocation
page read and write
7007000
trusted library allocation
page read and write
B66000
trusted library allocation
page execute and read and write
7010000
trusted library allocation
page read and write
43A5000
trusted library allocation
page read and write
53E0000
heap
page execute and read and write
590E000
stack
page read and write
7060000
trusted library allocation
page execute and read and write
2BCE000
stack
page read and write
7EFD0000
trusted library allocation
page execute and read and write
5C20000
heap
page read and write
3F05000
trusted library allocation
page read and write
9FF000
unkown
page read and write
3122000
trusted library allocation
page read and write
11C6000
trusted library allocation
page execute and read and write
2C72000
trusted library allocation
page read and write
E80000
trusted library allocation
page read and write
4321000
trusted library allocation
page read and write
5D8E000
stack
page read and write
5C8E000
stack
page read and write
3380000
trusted library allocation
page read and write
84D0000
heap
page read and write
B30000
trusted library allocation
page read and write
675D000
heap
page read and write
59C0000
heap
page read and write
5A10000
heap
page read and write
6620000
heap
page read and write
5C10000
heap
page read and write
EB2000
unkown
page readonly
2E2E000
stack
page read and write
529E000
stack
page read and write
6AC0000
trusted library allocation
page execute and read and write
15C1000
heap
page read and write
2816000
trusted library allocation
page read and write
FD0000
heap
page read and write
B33000
trusted library allocation
page execute and read and write
44A9000
trusted library allocation
page read and write
10F8000
stack
page read and write
2E2E000
stack
page read and write
41E000
remote allocation
page execute and read and write
980000
heap
page read and write
538B000
trusted library allocation
page read and write
1450000
trusted library allocation
page read and write
BC0000
heap
page read and write
8280000
trusted library allocation
page execute and read and write
2E50000
heap
page execute and read and write
1472000
trusted library allocation
page read and write
3120000
trusted library allocation
page read and write
2D1C000
stack
page read and write
5840000
trusted library allocation
page read and write
513E000
stack
page read and write
1250000
trusted library allocation
page read and write
6A57000
trusted library allocation
page read and write
BCE000
heap
page read and write
5A80000
heap
page read and write
1340000
heap
page read and write
B4D000
trusted library allocation
page execute and read and write
9490000
trusted library allocation
page execute and read and write
2E40000
trusted library allocation
page read and write
4658000
trusted library allocation
page read and write
DC8E000
stack
page read and write
53AD000
trusted library allocation
page read and write
72B0000
heap
page read and write
3104000
trusted library allocation
page read and write
2E50000
trusted library allocation
page read and write
17DE000
stack
page read and write
B60000
trusted library allocation
page read and write
3110000
trusted library allocation
page read and write
64ED000
stack
page read and write
519E000
stack
page read and write
116A000
heap
page read and write
1443000
trusted library allocation
page execute and read and write
4FF0000
heap
page execute and read and write
539A000
trusted library allocation
page read and write
7F280000
trusted library allocation
page execute and read and write
BA0000
heap
page read and write
538E000
trusted library allocation
page read and write
6B27000
trusted library allocation
page read and write
B50000
heap
page read and write
2B8E000
stack
page read and write
1444000
trusted library allocation
page read and write
185E000
stack
page read and write
3F89000
trusted library allocation
page read and write
5F45000
heap
page read and write
2FDB000
heap
page read and write
4E00000
trusted library allocation
page read and write
6670000
heap
page read and write
7F5E000
stack
page read and write
D0BC000
stack
page read and write
29A0000
trusted library allocation
page read and write
54A6000
trusted library allocation
page read and write
B34000
trusted library allocation
page read and write
AAD0000
trusted library section
page read and write
348A000
heap
page read and write
5C15000
heap
page read and write
30AE000
trusted library allocation
page read and write
5580000
heap
page read and write
6F87000
trusted library allocation
page read and write
5826000
trusted library allocation
page read and write
537B000
stack
page read and write
2E30000
trusted library allocation
page execute and read and write
3310000
heap
page read and write
1462000
trusted library allocation
page read and write
670B000
heap
page read and write
1810000
heap
page read and write
7050000
heap
page read and write
2BD3000
trusted library allocation
page read and write
63AD000
stack
page read and write
11DE000
heap
page read and write
147D000
stack
page read and write
6F8F000
stack
page read and write
59CE000
stack
page read and write
6A03000
trusted library allocation
page read and write
DDCE000
stack
page read and write
EA0000
heap
page read and write
1180000
trusted library allocation
page read and write
11CA000
trusted library allocation
page execute and read and write
54AD000
trusted library allocation
page read and write
D5A000
stack
page read and write
5490000
heap
page read and write
1220000
heap
page read and write
310D000
trusted library allocation
page execute and read and write
2F5E000
stack
page read and write
5492000
trusted library allocation
page read and write
2EDF000
trusted library allocation
page read and write
27F0000
trusted library allocation
page read and write
58F0000
trusted library allocation
page read and write
4E30000
trusted library allocation
page read and write
582D000
trusted library allocation
page read and write
5850000
trusted library allocation
page read and write
805F000
stack
page read and write
598E000
stack
page read and write
CE7E000
stack
page read and write
327A000
stack
page read and write
1260000
heap
page read and write
DFE000
stack
page read and write
E2CE000
stack
page read and write
EB0000
unkown
page readonly
B62000
trusted library allocation
page read and write
281D000
trusted library allocation
page read and write
4E1B000
trusted library allocation
page read and write
1096000
heap
page read and write
6C00000
trusted library allocation
page execute and read and write
5C40000
heap
page read and write
2EED000
trusted library allocation
page read and write
E64E000
stack
page read and write
68AD000
stack
page read and write
2FEE000
trusted library allocation
page read and write
58D0000
heap
page read and write
59EA000
heap
page read and write
E44B000
stack
page read and write
5821000
trusted library allocation
page read and write
4233000
trusted library allocation
page read and write
40E000
remote allocation
page execute and read and write
C92E000
stack
page read and write
11DC000
heap
page read and write
There are 553 hidden memdumps, click here to show them.