IOC Report
Dhl Express Shipping Docs .pdf.exe

loading gif

Files

File Path
Type
Category
Malicious
Dhl Express Shipping Docs .pdf.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\tmpB967.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\emaGqYHYeYNHas.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dhl Express Shipping Docs .pdf.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\emaGqYHYeYNHas.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1fnrznbs.oej.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aqje4zow.aau.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cssatfbo.obw.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dn3rgoyt.hbf.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h5zksprv.qqh.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iynhucx1.oni.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kaffcvxv.x3r.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uixhcj4c.avk.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmpCA21.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Roaming\emaGqYHYeYNHas.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
There are 6 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Dhl Express Shipping Docs .pdf.exe
"C:\Users\user\Desktop\Dhl Express Shipping Docs .pdf.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Dhl Express Shipping Docs .pdf.exe"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\emaGqYHYeYNHas.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emaGqYHYeYNHas" /XML "C:\Users\user\AppData\Local\Temp\tmpB967.tmp"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
 malicious
C:\Users\user\AppData\Roaming\emaGqYHYeYNHas.exe
C:\Users\user\AppData\Roaming\emaGqYHYeYNHas.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emaGqYHYeYNHas" /XML "C:\Users\user\AppData\Local\Temp\tmpCA21.tmp"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 7 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
unknown
http://ocsp.sectigo.com0A
unknown
https://sectigo.com/CPS0
unknown
https://account.dyn.com/
unknown
http://us2.smtp.mailhostbox.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
us2.smtp.mailhostbox.com
208.91.199.223
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
208.91.199.223
us2.smtp.mailhostbox.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2B53000
trusted library allocation
page read and write
 malicious
2B7F000
trusted library allocation
page read and write
 malicious
2932000
trusted library allocation
page read and write
 malicious
290E000
trusted library allocation
page read and write
 malicious
28E1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
8921000
trusted library allocation
page read and write
 malicious
3D9E000
trusted library allocation
page read and write
38B1000
trusted library allocation
page read and write
12C2000
trusted library allocation
page read and write
1952000
trusted library allocation
page read and write
17E0000
heap
page read and write
E84000
heap
page read and write
7B42000
trusted library allocation
page read and write
4DAE000
trusted library allocation
page read and write
54BB000
stack
page read and write
99DE000
stack
page read and write
515C000
stack
page read and write
1930000
trusted library allocation
page read and write
628F000
stack
page read and write
B28000
heap
page read and write
4F74000
trusted library allocation
page read and write
5503000
trusted library allocation
page read and write
9730000
trusted library allocation
page execute and read and write
673E000
stack
page read and write
1000000
heap
page read and write
194A000
trusted library allocation
page execute and read and write
5470000
heap
page read and write
2B50000
heap
page read and write
A25000
heap
page read and write
D6BC000
stack
page read and write
2B20000
heap
page read and write
FD8000
heap
page read and write
269A000
trusted library allocation
page execute and read and write
3D58000
trusted library allocation
page read and write
2942000
trusted library allocation
page read and write
7FD40000
trusted library allocation
page execute and read and write
DD0000
heap
page read and write
7359000
heap
page read and write
28A0000
heap
page execute and read and write
293A000
trusted library allocation
page read and write
5167000
trusted library allocation
page read and write
1924000
trusted library allocation
page read and write
5DA0000
heap
page read and write
62D7000
trusted library allocation
page read and write
1110000
trusted library allocation
page execute and read and write
337F000
stack
page read and write
F80000
trusted library allocation
page read and write
267D000
trusted library allocation
page execute and read and write
55BD000
stack
page read and write
2BFE000
stack
page read and write
7300000
trusted library allocation
page read and write
3B21000
trusted library allocation
page read and write
4E90000
heap
page execute and read and write
2916000
trusted library allocation
page read and write
7F35000
heap
page read and write
2BA5000
trusted library allocation
page read and write
2921000
trusted library allocation
page read and write
55B0000
trusted library allocation
page read and write
5E80000
trusted library section
page read and write
2A3F000
stack
page read and write
F8D000
trusted library allocation
page execute and read and write
5050000
heap
page read and write
980E000
trusted library allocation
page read and write
2BBD000
stack
page read and write
626E000
stack
page read and write
5C34000
heap
page read and write
51B0000
trusted library allocation
page read and write
49BB000
trusted library allocation
page read and write
5E70000
trusted library section
page read and write
55C0000
trusted library allocation
page execute and read and write
A690000
trusted library section
page read and write
6377000
trusted library allocation
page read and write
FE0000
heap
page read and write
FF1000
heap
page read and write
1940000
trusted library allocation
page read and write
64BE000
stack
page read and write
4B51000
trusted library allocation
page read and write
2730000
heap
page read and write
55E0000
heap
page read and write
FA6000
trusted library allocation
page execute and read and write
2B20000
heap
page read and write
4409000
trusted library allocation
page read and write
132E000
stack
page read and write
554E000
stack
page read and write
5250000
trusted library allocation
page read and write
5AFB000
stack
page read and write
4C1E000
stack
page read and write
2673000
trusted library allocation
page execute and read and write
6F4F000
stack
page read and write
3381000
trusted library allocation
page read and write
1920000
trusted library allocation
page read and write
4381000
trusted library allocation
page read and write
35D5000
trusted library allocation
page read and write
5C39000
heap
page read and write
5164000
trusted library allocation
page read and write
D20000
heap
page read and write
339E000
stack
page read and write
2950000
heap
page read and write
B58000
heap
page read and write
303D000
stack
page read and write
558E000
stack
page read and write
5FAD000
stack
page read and write
52A3000
heap
page read and write
5F3D000
stack
page read and write
54E0000
trusted library allocation
page read and write
54E9000
trusted library allocation
page read and write
FDC000
heap
page read and write
4DAA000
trusted library allocation
page read and write
53CF000
stack
page read and write
F62000
unkown
page readonly
5260000
trusted library allocation
page execute and read and write
5C20000
heap
page read and write
27C0000
heap
page read and write
6370000
trusted library allocation
page read and write
1026000
heap
page read and write
66FE000
stack
page read and write
5760000
heap
page read and write
76EF000
stack
page read and write
5440000
trusted library section
page readonly
664E000
stack
page read and write
E50000
heap
page read and write
5A70000
trusted library allocation
page read and write
5E1E000
stack
page read and write
980A000
trusted library allocation
page read and write
5830000
trusted library allocation
page read and write
2F91000
trusted library allocation
page read and write
667E000
stack
page read and write
5190000
trusted library allocation
page read and write
14F0000
heap
page read and write
A20000
heap
page read and write
5D10000
trusted library section
page readonly
D74E000
stack
page read and write
3120000
trusted library allocation
page read and write
C17000
heap
page read and write
B58000
stack
page read and write
1445000
heap
page read and write
D150000
heap
page read and write
811F000
stack
page read and write
7A1C000
trusted library allocation
page read and write
545E000
stack
page read and write
CBBE000
stack
page read and write
5BC0000
heap
page read and write
4F53000
heap
page read and write
7A0E000
trusted library allocation
page read and write
313E000
unkown
page read and write
5BFD000
stack
page read and write
5450000
heap
page read and write
F9D000
trusted library allocation
page execute and read and write
5C00000
heap
page read and write
3B88000
trusted library allocation
page read and write
3664000
trusted library allocation
page read and write
2B21000
trusted library allocation
page read and write
647E000
stack
page read and write
5860000
trusted library allocation
page read and write
DF4E000
stack
page read and write
47FB000
trusted library allocation
page read and write
33DF000
trusted library allocation
page read and write
55D5000
heap
page read and write
FB7000
trusted library allocation
page execute and read and write
5EAE000
stack
page read and write
D5BC000
stack
page read and write
4FB0000
trusted library allocation
page read and write
57FD000
trusted library allocation
page read and write
5040000
heap
page execute and read and write
11AE000
stack
page read and write
4D9B000
trusted library allocation
page read and write
4F1E000
stack
page read and write
4D90000
trusted library allocation
page read and write
1910000
trusted library allocation
page read and write
1942000
trusted library allocation
page read and write
57F6000
trusted library allocation
page read and write
3270000
heap
page execute and read and write
5C40000
heap
page read and write
4DD0000
trusted library allocation
page read and write
4F50000
heap
page read and write
622E000
stack
page read and write
3D11000
trusted library allocation
page read and write
9810000
trusted library allocation
page read and write
58A0000
heap
page execute and read and write
FB2000
trusted library allocation
page read and write
D140000
heap
page read and write
5820000
trusted library allocation
page read and write
7F37000
heap
page read and write
B00000
heap
page read and write
110E000
stack
page read and write
2B85000
trusted library allocation
page read and write
6187000
trusted library allocation
page read and write
57DB000
trusted library allocation
page read and write
CEBE000
stack
page read and write
E7A000
heap
page read and write
5802000
trusted library allocation
page read and write
2B94000
trusted library allocation
page read and write
612E000
stack
page read and write
732D000
heap
page read and write
1923000
trusted library allocation
page execute and read and write
1120000
heap
page read and write
607E000
stack
page read and write
2DB0000
trusted library allocation
page read and write
FBE000
heap
page read and write
A66E000
stack
page read and write
FA0000
trusted library allocation
page read and write
325C000
stack
page read and write
7440000
heap
page read and write
6A90000
heap
page read and write
9800000
trusted library allocation
page read and write
7A20000
trusted library allocation
page read and write
6E4E000
stack
page read and write
DC0000
heap
page read and write
2A1F000
trusted library allocation
page read and write
F60000
unkown
page readonly
FF3000
heap
page read and write
2674000
trusted library allocation
page read and write
28B1000
trusted library allocation
page read and write
15B3000
heap
page read and write
D40000
heap
page read and write
6FF0000
trusted library allocation
page read and write
5599000
trusted library allocation
page read and write
FE6000
heap
page read and write
12C0000
trusted library allocation
page read and write
2690000
trusted library allocation
page read and write
D94E000
stack
page read and write
FB8000
heap
page read and write
61E0000
trusted library allocation
page read and write
5DC0000
trusted library allocation
page execute and read and write
2680000
trusted library allocation
page read and write
DB8F000
stack
page read and write
1034000
unkown
page readonly
D13D000
stack
page read and write
18EE000
stack
page read and write
4F60000
trusted library allocation
page read and write
CE5000
heap
page read and write
E18F000
stack
page read and write
E32C000
stack
page read and write
550D000
trusted library allocation
page read and write
78A0000
trusted library allocation
page read and write
2F65000
trusted library allocation
page read and write
2710000
trusted library allocation
page execute and read and write
5840000
trusted library allocation
page read and write
2660000
trusted library allocation
page read and write
7CD9000
trusted library allocation
page read and write
FAA000
trusted library allocation
page execute and read and write
CE0000
heap
page read and write
4EDE000
stack
page read and write
5174000
trusted library allocation
page read and write
5177000
trusted library allocation
page read and write
E4E000
stack
page read and write
2720000
trusted library allocation
page read and write
63BD000
stack
page read and write
26CA000
stack
page read and write
5C10000
heap
page read and write
2FA2000
trusted library allocation
page read and write
62D0000
trusted library allocation
page read and write
4689000
trusted library allocation
page read and write
1967000
heap
page read and write
603E000
stack
page read and write
57D0000
trusted library allocation
page read and write
D78E000
stack
page read and write
540D000
stack
page read and write
5500000
trusted library allocation
page read and write
1006000
heap
page read and write
4389000
trusted library allocation
page read and write
26AB000
trusted library allocation
page execute and read and write
55D0000
heap
page read and write
2880000
trusted library allocation
page read and write
2C8F000
trusted library allocation
page read and write
B4A000
heap
page read and write
BC0000
heap
page read and write
731C000
heap
page read and write
4DA2000
trusted library allocation
page read and write
7F480000
trusted library allocation
page execute and read and write
D56000
stack
page read and write
989D000
stack
page read and write
195B000
trusted library allocation
page execute and read and write
12B0000
trusted library allocation
page read and write
4DE3000
trusted library allocation
page read and write
2890000
trusted library allocation
page read and write
2A68000
trusted library allocation
page read and write
57D4000
trusted library allocation
page read and write
268D000
stack
page read and write
617D000
stack
page read and write
316E000
stack
page read and write
4E0C000
stack
page read and write
61D0000
trusted library allocation
page execute and read and write
58D0000
heap
page read and write
DF0000
heap
page read and write
1337000
heap
page read and write
4A4D000
stack
page read and write
4A43000
trusted library allocation
page read and write
62E0000
trusted library allocation
page read and write
1510000
heap
page read and write
4D96000
trusted library allocation
page read and write
5270000
trusted library allocation
page read and write
535E000
stack
page read and write
5C6F000
stack
page read and write
3915000
trusted library allocation
page read and write
2B10000
heap
page execute and read and write
CDBE000
stack
page read and write
5E40000
trusted library allocation
page read and write
268D000
trusted library allocation
page execute and read and write
5D6C000
stack
page read and write
944B000
trusted library allocation
page read and write
4E8E000
stack
page read and write
744E000
heap
page read and write
57C0000
trusted library allocation
page read and write
10A3000
heap
page read and write
4DB1000
trusted library allocation
page read and write
DA8E000
stack
page read and write
1430000
heap
page read and write
518C000
stack
page read and write
55F0000
heap
page read and write
4FA5000
trusted library allocation
page read and write
317F000
unkown
page read and write
66BE000
stack
page read and write
51C5000
trusted library allocation
page read and write
5E20000
trusted library section
page read and write
2730000
heap
page read and write
517E000
trusted library allocation
page read and write
28A0000
heap
page read and write
A14E000
trusted library allocation
page read and write
52CE000
stack
page read and write
26A2000
trusted library allocation
page read and write
52A0000
heap
page read and write
193D000
trusted library allocation
page execute and read and write
12BA000
trusted library allocation
page execute and read and write
4F99000
trusted library allocation
page read and write
1020000
heap
page read and write
EED000
heap
page read and write
12C7000
trusted library allocation
page execute and read and write
5C05000
heap
page read and write
E50000
heap
page read and write
FA3000
trusted library allocation
page read and write
55A0000
heap
page read and write
F70000
trusted library allocation
page read and write
30D0000
heap
page read and write
3612000
trusted library allocation
page read and write
CEFE000
stack
page read and write
D43E000
stack
page read and write
969000
stack
page read and write
6F70000
trusted library allocation
page read and write
E4E000
stack
page read and write
6F7D000
trusted library allocation
page read and write
151E000
heap
page read and write
F6E000
stack
page read and write
4773000
trusted library allocation
page read and write
1552000
heap
page read and write
F83000
trusted library allocation
page execute and read and write
FA2000
trusted library allocation
page read and write
F80000
trusted library allocation
page read and write
4ACA000
trusted library allocation
page read and write
5810000
trusted library allocation
page read and write
2B00000
trusted library allocation
page read and write
61CD000
stack
page read and write
400000
remote allocation
page execute and read and write
5170000
trusted library allocation
page read and write
51A6000
trusted library allocation
page read and write
26C0000
trusted library allocation
page read and write
57F1000
trusted library allocation
page read and write
7A00000
trusted library allocation
page read and write
C01000
heap
page read and write
43E000
remote allocation
page execute and read and write
E58000
heap
page read and write
7C21000
trusted library allocation
page read and write
9ADE000
stack
page read and write
5150000
trusted library allocation
page read and write
4CF9000
trusted library allocation
page read and write
4FB4000
trusted library allocation
page read and write
516B000
trusted library allocation
page read and write
F90000
trusted library allocation
page read and write
5460000
heap
page read and write
9820000
trusted library allocation
page read and write
283E000
stack
page read and write
F84000
trusted library allocation
page read and write
31BE000
stack
page read and write
F93000
trusted library allocation
page execute and read and write
1330000
heap
page read and write
981B000
trusted library allocation
page read and write
290C000
trusted library allocation
page read and write
149E000
stack
page read and write
12B2000
trusted library allocation
page read and write
35A0000
heap
page read and write
28CA000
heap
page read and write
BE6000
heap
page read and write
294C000
stack
page read and write
502B000
trusted library allocation
page read and write
29FE000
stack
page read and write
26A0000
trusted library allocation
page read and write
5BE0000
heap
page read and write
51F0000
trusted library allocation
page read and write
F90000
trusted library allocation
page read and write
E00000
heap
page read and write
DCD0000
heap
page read and write
5DB0000
heap
page read and write
30F0000
heap
page read and write
5A90000
trusted library allocation
page read and write
3B25000
trusted library allocation
page read and write
2D11000
trusted library allocation
page read and write
26A5000
trusted library allocation
page execute and read and write
FB5000
trusted library allocation
page execute and read and write
290A000
trusted library allocation
page read and write
5835000
trusted library allocation
page read and write
2B7D000
trusted library allocation
page read and write
12B6000
trusted library allocation
page execute and read and write
5187000
trusted library allocation
page read and write
9850000
trusted library allocation
page execute and read and write
27BF000
unkown
page read and write
550E000
stack
page read and write
61F0000
trusted library allocation
page execute and read and write
2A5E000
stack
page read and write
2696000
trusted library allocation
page execute and read and write
12CB000
trusted library allocation
page execute and read and write
5192000
trusted library allocation
page read and write
E08E000
stack
page read and write
7D14000
trusted library allocation
page read and write
CBFE000
stack
page read and write
78B0000
trusted library allocation
page execute and read and write
E04E000
stack
page read and write
4C4C000
trusted library allocation
page read and write
1933000
trusted library allocation
page read and write
290E000
stack
page read and write
7A30000
trusted library allocation
page execute and read and write
5000000
heap
page read and write
E42C000
stack
page read and write
48B8000
trusted library allocation
page read and write
C59000
stack
page read and write
DCCD000
stack
page read and write
654E000
stack
page read and write
58D3000
heap
page read and write
51A0000
trusted library allocation
page read and write
3D19000
trusted library allocation
page read and write
6180000
trusted library allocation
page read and write
5800000
trusted library allocation
page read and write
307A000
stack
page read and write
38D9000
trusted library allocation
page read and write
5160000
trusted library allocation
page read and write
869000
stack
page read and write
F47000
heap
page read and write
683E000
stack
page read and write
A56E000
stack
page read and write
7F020000
trusted library allocation
page execute and read and write
63E0000
trusted library allocation
page execute and read and write
1946000
trusted library allocation
page execute and read and write
4BCF000
trusted library allocation
page read and write
4FB6000
trusted library allocation
page read and write
4F80000
trusted library allocation
page read and write
4D9E000
trusted library allocation
page read and write
1960000
heap
page read and write
5880000
heap
page read and write
7A10000
trusted library allocation
page read and write
5A80000
trusted library allocation
page execute and read and write
277E000
unkown
page read and write
CFFF000
stack
page read and write
12AE000
stack
page read and write
1950000
trusted library allocation
page read and write
CDE000
stack
page read and write
7F9A0000
trusted library allocation
page execute and read and write
5230000
heap
page execute and read and write
4DBD000
trusted library allocation
page read and write
17DE000
stack
page read and write
3260000
trusted library allocation
page execute and read and write
158E000
heap
page read and write
E86000
heap
page read and write
636E000
stack
page read and write
7351000
heap
page read and write
75EE000
stack
page read and write
1957000
trusted library allocation
page execute and read and write
2B40000
trusted library allocation
page execute and read and write
54F0000
heap
page read and write
4F84000
trusted library allocation
page read and write
DA4F000
stack
page read and write
57EE000
trusted library allocation
page read and write
9D0000
heap
page read and write
FB0000
heap
page read and write
48BB000
trusted library allocation
page read and write
10C9000
stack
page read and write
F94000
trusted library allocation
page read and write
518D000
trusted library allocation
page read and write
2B1C000
stack
page read and write
B20000
heap
page read and write
67C0000
heap
page read and write
12E0000
trusted library allocation
page read and write
58C0000
heap
page read and write
4FC0000
trusted library allocation
page read and write
2894000
trusted library allocation
page read and write
D03D000
stack
page read and write
706E000
stack
page read and write
3D78000
trusted library allocation
page read and write
51C0000
trusted library allocation
page read and write
192D000
trusted library allocation
page execute and read and write
292E000
trusted library allocation
page read and write
4CC9000
trusted library allocation
page read and write
3198000
heap
page read and write
E6E000
heap
page read and write
78C0000
trusted library section
page read and write
FA0000
trusted library allocation
page read and write
287C000
stack
page read and write
6810000
trusted library allocation
page execute and read and write
547C000
stack
page read and write
11C7000
stack
page read and write
3190000
heap
page read and write
270E000
stack
page read and write
528C000
stack
page read and write
C03000
heap
page read and write
5E50000
trusted library allocation
page read and write
483B000
trusted library allocation
page read and write
D33E000
stack
page read and write
5D70000
heap
page read and write
525E000
stack
page read and write
51A4000
trusted library allocation
page read and write
F35000
heap
page read and write
3170000
heap
page read and write
2670000
trusted library allocation
page read and write
7C9D000
trusted library allocation
page read and write
6790000
trusted library allocation
page read and write
31FD000
stack
page read and write
E55000
heap
page read and write
5507000
trusted library allocation
page read and write
5240000
heap
page read and write
DBCD000
stack
page read and write
4E2C000
stack
page read and write
28C0000
heap
page read and write
30C0000
heap
page read and write
F12000
heap
page read and write
1440000
heap
page read and write
2DB2000
trusted library allocation
page read and write
2F93000
trusted library allocation
page read and write
5181000
trusted library allocation
page read and write
2692000
trusted library allocation
page read and write
55BD000
trusted library allocation
page read and write
5D98000
heap
page read and write
FAD000
trusted library allocation
page execute and read and write
4F60000
heap
page read and write
342B000
trusted library allocation
page read and write
2C00000
heap
page execute and read and write
DEF000
stack
page read and write
716E000
stack
page read and write
1550000
heap
page read and write
51D0000
trusted library allocation
page read and write
A5B000
stack
page read and write
999E000
stack
page read and write
26A7000
trusted library allocation
page execute and read and write
7334000
heap
page read and write
3B49000
trusted library allocation
page read and write
7F20000
heap
page read and write
7310000
heap
page read and write
4DB6000
trusted library allocation
page read and write
FBB000
trusted library allocation
page execute and read and write
2D0E000
stack
page read and write
B56000
heap
page read and write
14DE000
stack
page read and write
33DF000
stack
page read and write
1450000
heap
page read and write
5590000
trusted library allocation
page read and write
FD0000
trusted library allocation
page read and write
There are 544 hidden memdumps, click here to show them.