IOC Report
b94bd24023b0df0089295b2246546a256d3e82424ecdb.exe

loading gif

Files

File Path
Type
Category
Malicious
b94bd24023b0df0089295b2246546a256d3e82424ecdb.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\AKFHCAKJDBKKEBFIIJJE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\AQRFEVRTGL.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\BFCFBFBF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BNAGMGSPLO.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\DHJJEGHIIDAFIDHJDHJEBAEGHC
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\EHCBAAAF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\EOWRVPQCCS.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\EOWRVPQCCS.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\GAOBCVIQIJ.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\HJJJECFIECBGDGCAAAEHIEGDGC
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\IDHDGDHJEGHIDGDHCGCBAKFHII
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JEHIIDGCFHIEGDGCBFHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KECGHIJDGCBKECAAKKECFBFBAF
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\LSBIHQFDVT.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_b94bd24023b0df00_2e9ca3f56c4535cfd33932f43e08cce51bf64ab_ebc05ced_569f70e4-2958-48fc-946c-1c0e6b4fd094\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB206.tmp.dmp
Mini DuMP crash report, 14 streams, Tue Apr 23 07:43:30 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB2F1.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB321.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\NYMMPCEIMA.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\PWCCAWLGRE.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\QNCYCDFIJJ.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\WHZAGPPPLA.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\ZQIXMVQGAH.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\ZQIXMVQGAH.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 30 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\b94bd24023b0df0089295b2246546a256d3e82424ecdb.exe
"C:\Users\user\Desktop\b94bd24023b0df0089295b2246546a256d3e82424ecdb.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 2016

URLs

Name
IP
Malicious
http://185.172.128.76/3cd2b41cbd
unknown
 malicious
http://185.172.128.76/15f649199f40275b/nss3.dll
185.172.128.76
 malicious
http://185.172.128.76/15f649199f40275b/softokn3.dll
185.172.128.76
 malicious
http://185.172.128.76/15f649199f40275b/mozglue.dll
185.172.128.76
 malicious
185.172.128.76/3cd2b41cbde8fc9c.php
malicious
http://185.172.128.76/3cd2b41cbde8fc9c.php
185.172.128.76
 malicious
http://185.172.128.76/15f649199f40275b/freebl3.dll
185.172.128.76
 malicious
http://185.172.128.76/3cd2b4
unknown
 malicious
http://185.172.128.76/3c
unknown
 malicious
http://185.172.128.7
unknown
 malicious
http://185.172.128.76/3cd2b41cbde8fc
unknown
 malicious
http://185.172.128.76/15f649199f40275b/msvcp140.dll
185.172.128.76
 malicious
http://185.172.128.76/15f649199f40275b/vcruntime140.dll
185.172.128.76
 malicious
http://185.172.1
unknown
 malicious
http://185.172.128.76/15f649199f40275b/sqlite3.dll
185.172.128.76
 malicious
http://185.172.128.76
unknown
 malicious
http://185.172.128.76/3cd2b41cbde8fc9c.php~
unknown
https://duckduckgo.com/chrome_newtab
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php;T
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.172.128.76/15f649199f40275b/mozglue.dllW
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.172.128.76/15f649199f40275b/mozglue.dll#
unknown
http://185.172.128.76/15f649199f40275b/nss3.dll4
unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpG
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phps
unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpt
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
http://185.172.128.76/15f649199f40275b/mozglue.dllA
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://185.172.128.76/15f649199f40275b/vcruntime140.dll9
unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpN
unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php36261febecb4b20be6043dfc1fb7dlt-releasedf3c1f8a6405bb7678b
unknown
https://support.mozilla.org
unknown
http://185.172.128.76/15f649199f40275b/softokn3.dlly
unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpW
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://185.172.128.76/15f649199f40275b/msvcp140.dll=
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 37 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.172.128.76
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
ProgramId
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
FileId
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
LowerCaseLongPath
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
LongPathHash
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
Name
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
OriginalFileName
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
Publisher
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
Version
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
BinFileVersion
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
BinaryType
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
ProductName
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
ProductVersion
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
LinkDate
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
BinProductVersion
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
AppxPackageFullName
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
AppxPackageRelativeId
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
Size
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
Language
\REGISTRY\A\{d8d1c0c7-2f70-e413-74d1-db1f8761582b}\Root\InventoryApplicationFile\b94bd24023b0df00|eff8dfe14efcfc67
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018000DDABBE6B3
There are 13 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page execute and read and write
 malicious
42A2000
heap
page read and write
 malicious
40B0000
direct allocation
page execute and read and write
 malicious
40E0000
direct allocation
page read and write
 malicious
4114000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
245CD000
heap
page read and write
61E00000
direct allocation
page execute and read and write
1E521000
heap
page read and write
245BF000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
61ED4000
direct allocation
page readonly
5D6E000
stack
page read and write
245BF000
heap
page read and write
4114000
heap
page read and write
245B0000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4617000
heap
page read and write
4114000
heap
page read and write
4345000
heap
page read and write
4340000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
42D9000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245AA000
heap
page read and write
6D3D5000
unkown
page readonly
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
1E3BE000
stack
page read and write
1E620000
trusted library allocation
page read and write
4114000
heap
page read and write
409E000
stack
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
434B000
heap
page read and write
4114000
heap
page read and write
245A3000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
24595000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245B0000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
1DFFF000
stack
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
245C6000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
9B000
stack
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
37450000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
6D1CD000
unkown
page readonly
4114000
heap
page read and write
4114000
heap
page read and write
245BF000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
6D3CE000
unkown
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
6D3D0000
unkown
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
461B000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
2459B000
heap
page read and write
4114000
heap
page read and write
245A0000
heap
page read and write
245C9000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
24592000
heap
page read and write
24647000
heap
page read and write
4114000
heap
page read and write
1F0000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
636000
unkown
page execute and read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245B0000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4023000
unkown
page readonly
4114000
heap
page read and write
2459E000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
61EB7000
direct allocation
page readonly
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245B0000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4352000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
2A641000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245AA000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
5EAE000
stack
page read and write
24595000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245BF000
heap
page read and write
4114000
heap
page read and write
245AC000
heap
page read and write
197000
stack
page read and write
4050000
heap
page read and write
4114000
heap
page read and write
245BF000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245AD000
heap
page read and write
549000
unkown
page execute and read and write
4114000
heap
page read and write
4114000
heap
page read and write
461B000
heap
page read and write
4114000
heap
page read and write
61ECD000
direct allocation
page readonly
245A9000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
24634000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245CD000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245A3000
heap
page read and write
245A1000
heap
page read and write
245CC000
heap
page read and write
2A620000
heap
page read and write
306CE000
stack
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
6D3CF000
unkown
page write copy
245A8000
heap
page read and write
4114000
heap
page read and write
30884000
heap
page read and write
245CD000
heap
page read and write
245AA000
heap
page read and write
4114000
heap
page read and write
245B0000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245AA000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245A4000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4021000
unkown
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245AD000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
5F20000
heap
page read and write
4114000
heap
page read and write
245CD000
heap
page read and write
4114000
heap
page read and write
30876000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4617000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245A8000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
245B0000
heap
page read and write
4114000
heap
page read and write
245BF000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245A7000
heap
page read and write
245A8000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
2A6E7000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
24637000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
2459E000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
5E6F000
stack
page read and write
1E27E000
stack
page read and write
245AA000
heap
page read and write
245AA000
heap
page read and write
4114000
heap
page read and write
1E4BE000
stack
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245C0000
heap
page read and write
37440000
heap
page read and write
4114000
heap
page read and write
19B000
stack
page read and write
4114000
heap
page read and write
245CD000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
6D1F0000
unkown
page readonly
461B000
heap
page read and write
4114000
heap
page read and write
446F000
stack
page read and write
400000
unkown
page readonly
4114000
heap
page read and write
4114000
heap
page read and write
4610000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245C5000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
5D2E000
stack
page read and write
4114000
heap
page read and write
42F7000
heap
page read and write
4115000
heap
page read and write
245A8000
heap
page read and write
1E13E000
stack
page read and write
4114000
heap
page read and write
61ED0000
direct allocation
page read and write
4114000
heap
page read and write
624000
unkown
page execute and read and write
4114000
heap
page read and write
1E0FF000
stack
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245CD000
heap
page read and write
4114000
heap
page read and write
6D150000
unkown
page readonly
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
3744A000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
1E62B000
heap
page read and write
461B000
heap
page read and write
24598000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
61ED3000
direct allocation
page read and write
3088D000
heap
page read and write
30810000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
2459D000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245AA000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
401000
unkown
page execute read
5EEE000
stack
page read and write
1E521000
heap
page read and write
4114000
heap
page read and write
245A8000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
245BF000
heap
page read and write
4114000
heap
page read and write
427E000
heap
page read and write
4114000
heap
page read and write
6D1DE000
unkown
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245B0000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245BF000
heap
page read and write
433A000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
41C000
unkown
page write copy
4617000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245A8000
heap
page read and write
30885000
heap
page read and write
368C0000
trusted library allocation
page read and write
4114000
heap
page read and write
245BF000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
24598000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
428C000
heap
page execute and read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
61E01000
direct allocation
page execute read
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
2459E000
heap
page read and write
1E37D000
stack
page read and write
4114000
heap
page read and write
2469F000
heap
page read and write
245A7000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
24590000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245BF000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
307CF000
stack
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245A8000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245AD000
heap
page read and write
37951000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245AD000
heap
page read and write
4114000
heap
page read and write
245AC000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
1E23F000
stack
page read and write
192000
stack
page read and write
245AF000
heap
page read and write
61ECC000
direct allocation
page read and write
2A6AD000
heap
page read and write
1E521000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
461B000
heap
page read and write
6D151000
unkown
page execute read
3087E000
heap
page read and write
40F000
unkown
page readonly
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
24638000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245A9000
heap
page read and write
416000
unkown
page write copy
4114000
heap
page read and write
4110000
heap
page read and write
245BF000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245BF000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245B0000
heap
page read and write
1E520000
heap
page read and write
2A600000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4337000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245BF000
heap
page read and write
2459E000
heap
page read and write
245A6000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
6D38F000
unkown
page readonly
61EB4000
direct allocation
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
2A6FB000
heap
page read and write
245A8000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
427A000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245CD000
heap
page read and write
245AD000
heap
page read and write
4114000
heap
page read and write
24596000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245CC000
heap
page read and write
4115000
heap
page read and write
245B0000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245A8000
heap
page read and write
4023000
unkown
page readonly
245CD000
heap
page read and write
245AF000
heap
page read and write
245A3000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4617000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245B0000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4270000
heap
page read and write
4114000
heap
page read and write
6D1F1000
unkown
page execute read
4114000
heap
page read and write
4114000
heap
page read and write
2A6ED000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
447000
unkown
page execute and read and write
4114000
heap
page read and write
422E000
stack
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4358000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245A6000
heap
page read and write
4114000
heap
page read and write
6D1E2000
unkown
page readonly
4115000
heap
page read and write
4114000
heap
page read and write
1E510000
heap
page read and write
4114000
heap
page read and write
245B0000
heap
page read and write
4114000
heap
page read and write
4115000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
245AC000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
4114000
heap
page read and write
There are 628 hidden memdumps, click here to show them.