IOC Report

loading gif

Files

File Path
Type
Category
Malicious
NRB-RTGS 28-Sept 2021.jar
Zip archive data, at least v2.0 to extract
initial sample
malicious
C:\cmdlinestart.log
ASCII text, with CRLF, LF line terminators
dropped
malicious
C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d83e2.timestamp
ASCII text, with CRLF line terminators
dropped
clean
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\83aa4cc77f591dfc2374580bbd95f6ba_d06ed635-68f6-4e9a-955c-4899f5f57b9a
data
dropped
clean

Processes

Path
Cmdline
Malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ''C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -javaagent:'C:\Users\user\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\NRB-RTGS 28-Sept 2021.jar'' >> C:\cmdlinestart.log 2>&1
clean
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
clean
C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -javaagent:'C:\Users\user\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\NRB-RTGS 28-Sept 2021.jar'
clean
C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
clean
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
clean

URLs

Name
IP
Malicious
http://null.oracle.com/
unknown
clean
https://repo1.maven.org/maven2/net/java/dev/jna/jna-platform/5.5.0/jna-platform-5.5.0.jar
unknown
clean
https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jar
unknown
clean
http://www.certplus.com/CRL/class2.crl0
unknown
clean
http://www.allatori.com
unknown
clean
https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.14.2.1/sqlite-jdbc-3.14.2.1.jar
unknown
clean
https://github.com/kristian/system-hook/releases/download/3.5/system-hook-3.5.jar
unknown
clean

Domains

Name
IP
Malicious
sonatype.map.fastly.net
199.232.192.209
clean
github.com
140.82.121.4
clean
repo1.maven.org
unknown
clean

IPs

IP
Domain
Country
Malicious
199.232.192.209
sonatype.map.fastly.net
United States
clean
140.82.121.4
github.com
United States
clean

Memdumps

Base Address
Regiontype
Protect
Malicious
7FF521C4A000
unkown image
page readonly
clean
7FF5DD93E000
unkown image
page readonly
clean
1613577A000
unkown
page read and write
clean
7FF5580D1000
unkown image
page readonly
clean
1686C000
unkown
page read and write
clean
7FF5B32D1000
unkown image
page readonly
clean
17C3EAF0000
unkown
page read and write
clean
161357A3000
unkown
page read and write
clean
7FF521B4B000
unkown image
page readonly
clean
16981000
unkown
page read and write
clean
1684C000
unkown
page read and write
clean
7FF557EB0000
unkown image
page readonly
clean
90FBBFE000
unkown
page read and write
clean
17C3EB10000
unkown image
page readonly
clean
7DF4AEAF0000
unkown image
page readonly
clean
167EC000
unkown
page read and write
clean
7FF521BAE000
unkown image
page readonly
clean
17C3E8D0000
unkown image
page readonly
clean
7DF52F932000
unkown image
page readonly
clean
7DF52F932000
unkown image
page readonly
clean
BF53000
unkown
page read and write
clean
7FF5A2ECF000
unkown image
page readonly
clean
2CC1CE6F000
unkown
page read and write
clean
DE0000
unkown image
page readonly
clean
7DF5B0C20000
unkown image
page readonly
clean
155FE000
unkown
page read and write
clean
7FF5A2F92000
unkown image
page readonly
clean
7FF521AE2000
unkown image
page readonly
clean
7FF5DE14A000
unkown image
page readonly
clean
7FF55ACE2000
unkown image
page readonly
clean
7F2D2000
unkown image
page readonly
clean
90FBB7B000
unkown
page read and write
clean
168D7000
unkown
page read and write
clean
2450D77000
unkown
page read and write
clean
1B76664A000
unkown
page read and write
clean
BF65000
unkown
page read and write
clean
BF3D000
unkown
page read and write
clean
7DF466840000
unkown image
page readonly
clean
17C3E95D000
unkown
page read and write
clean
7FF5A2AA7000
unkown image
page readonly
clean
17C3E936000
heap default
page read and write
clean
BF8F000
unkown
page read and write
clean
89FA7A000
unkown
page read and write
clean
1A837A70000
unkown
page read and write
clean
17C3E8F0000
unkown
page read and write
clean
7FF5580B2000
unkown image
page readonly
clean
BF46000
unkown
page read and write
clean
BF4C000
unkown
page read and write
clean
7FF55ACE9000
unkown image
page readonly
clean
7FF55AC23000
unkown image
page readonly
clean
161357AD000
unkown
page read and write
clean
168A2000
unkown
page read and write
clean
16802000
unkown
page read and write
clean
1207000
unkown
page read and write
clean
BF76000
unkown
page read and write
clean
1689B000
unkown
page read and write
clean
BF6C000
unkown
page read and write
clean
16135765000
unkown
page read and write
clean
167FC000
unkown
page read and write
clean
16752000
unkown
page read and write
clean
16135C02000
unkown
page read and write
clean
16802000
unkown
page read and write
clean
BF5D000
unkown
page read and write
clean
161354C0000
unkown image
page read and write
clean
E86A8F7000
unkown
page read and write
clean
16981000
unkown
page read and write
clean
7FF521BF3000
unkown image
page readonly
clean
1562E000
unkown
page read and write
clean
1562E000
unkown
page read and write
clean
1613576D000
unkown
page read and write
clean
BFB1000
unkown
page read and write
clean
BF8B000
unkown
page read and write
clean
BFA4000
unkown
page read and write
clean
15BE7000
unkown
page read and write
clean
BF67000
unkown
page read and write
clean
31F5000
unkown
page read and write
clean
BF9E000
unkown
page read and write
clean
7DF568980000
unkown image
page readonly
clean
BF5B000
unkown
page read and write
clean
7DF52F940000
unkown image
page readonly
clean
1568D000
unkown
page read and write
clean
161357A3000
unkown
page read and write
clean
BF7A000
unkown
page read and write
clean
161357C1000
unkown
page read and write
clean
16135795000
unkown
page read and write
clean
17C3E947000
unkown
page read and write
clean
17C3EF40000
unkown image
page readonly
clean
7FF5DE0F3000
unkown image
page readonly
clean
161357B6000
unkown
page read and write
clean
7FF55805A000
unkown image
page readonly
clean
BF76000
unkown
page read and write
clean
16135795000
unkown
page read and write
clean
1613578D000
unkown
page read and write
clean
7DF568990000
unkown image
page readonly
clean
7FF5A2E1B000
unkown image
page readonly
clean
7FF5580E1000
unkown image
page readonly
clean
16926000
unkown
page read and write
clean
16135762000
unkown
page read and write
clean
7FF55A99C000
unkown image
page readonly
clean
16873000
unkown
page read and write
clean
BF7D000
unkown
page read and write
clean
2CC1D602000
unkown
page read and write
clean
16802000
unkown
page read and write
clean
7FF5DE1A9000
unkown image
page readonly
clean
BF60000
unkown
page read and write
clean
7FF55A7F1000
unkown image
page readonly
clean
16134ED1000
unkown
page read and write
clean
16135765000
unkown
page read and write
clean
1564B000
unkown
page read and write
clean
1A837CD0000
unkown image
page readonly
clean
16135768000
unkown
page read and write
clean
BF6C000
unkown
page read and write
clean
7DF52F930000
unkown image
page readonly
clean
BFAD000
unkown
page read and write
clean
15C35000
unkown
page read and write
clean
7DF5EBE30000
unkown image
page readonly
clean
7FF5A2E15000
unkown image
page readonly
clean
7FF521A85000
unkown image
page readonly
clean
BF8B000
unkown
page read and write
clean
7FF5DE12E000
unkown image
page readonly
clean
7FF52164C000
unkown image
page readonly
clean
7FF521A9D000
unkown image
page readonly
clean
BF77000
unkown
page read and write
clean
7FF521CBA000
unkown image
page readonly
clean
17C3E8B0000
unkown image
page readonly
clean
1B766654000
unkown
page read and write
clean
BF5C000
unkown
page read and write
clean
16134C30000
heap private
page read and write
clean
16819000
unkown
page read and write
clean
7FF521B55000
unkown image
page readonly
clean
7FF5DE0DD000
unkown image
page readonly
clean
7FF521ABB000
unkown image
page readonly
clean
7FF55AC8D000
unkown image
page readonly
clean
26105E30000
unkown image
page readonly
clean
2BF5000
unkown image
page readonly
clean
2CC1CF02000
unkown
page read and write
clean
7FF5DE1C1000
unkown image
page readonly
clean
16819000
unkown
page read and write
clean
BF2C000
unkown
page read and write
clean
1B766580000
heap private
page read and write
clean
15D87000
unkown
page read and write
clean
16134C60000
unkown image
page readonly
clean
7FF521432000
unkown image
page readonly
clean
BF46000
unkown
page read and write
clean
16752000
unkown
page read and write
clean
7DF4E9D00000
unkown image
page readonly
clean
1A837A4F000
unkown
page read and write
clean
1688B000
unkown
page read and write
clean
7FF521BD9000
unkown image
page readonly
clean
7DF5EBE32000
unkown image
page readonly
clean
1B7668D0000
unkown image
page readonly
clean
7FF521BDD000
unkown image
page readonly
clean
1B766590000
unkown image
page readonly
clean
7FF55AAC1000
unkown image
page readonly
clean
33B0000
heap default
page read and write
clean
90FC37F000
unkown
page read and write
clean
2450E7F000
unkown
page read and write
clean
4B0067E000
unkown
page read and write
clean
245076B000
unkown
page read and write
clean
15D87000
unkown
page read and write
clean
BFAB000
unkown
page read and write
clean
34A0000
heap default
page read and write
clean
BF0C000
unkown
page read and write
clean
BF66000
unkown
page read and write
clean
BF60000
unkown
page read and write
clean
24507EF000
unkown
page read and write
clean
167EC000
unkown
page read and write
clean
16835000
unkown
page read and write
clean
7FF5A2F0B000
unkown image
page readonly
clean
1A8378F0000
heap private
page read and write
clean
BFC6000
unkown
page read and write
clean
1613578B000
unkown
page read and write
clean
1613578D000
unkown
page read and write
clean
7FF5219DB000
unkown image
page readonly
clean
7FF521839000
unkown image
page readonly
clean
7FF557FE9000
unkown image
page readonly
clean
2FEE000
unkown
page read and write
clean
7FF521CA9000
unkown image
page readonly
clean
BF72000
unkown
page read and write
clean
1B766708000
unkown
page read and write
clean
1B766E02000
unkown
page read and write
clean
7FF5217B7000
unkown image
page readonly
clean
16135779000
unkown
page read and write
clean
7FF55AC33000
unkown image
page readonly
clean
1B76664F000
unkown
page read and write
clean
16822000
unkown
page read and write
clean
BF52000
unkown
page read and write
clean
1688B000
unkown
page read and write
clean
168A2000
unkown
page read and write
clean
7FF5A2FC1000
unkown image
page readonly
clean
BF50000
unkown
page read and write
clean
E86A4FE000
unkown
page read and write
clean
16134EA3000
unkown
page read and write
clean
7FF5580E1000
unkown image
page readonly
clean
1680A000
unkown
page read and write
clean
7DF568970000
unkown image
page readonly
clean
2CC1CE46000
unkown
page read and write
clean
7DF5B0C30000
unkown image
page readonly
clean
7DF5EBE40000
unkown image
page readonly
clean
1613579E000
unkown
page read and write
clean
7FF55AD01000
unkown image
page readonly
clean
2CC1CE4E000
unkown
page read and write
clean
16135C3C000
unkown
page read and write
clean
7FF521BFE000
unkown image
page readonly
clean
7F2D0000
unkown image
page readonly
clean
16134F02000
unkown
page read and write
clean
BF72000
unkown
page read and write
clean
1613576A000
unkown
page read and write
clean
7FF5DE123000
unkown image
page readonly
clean
7DF5EBE50000
unkown image
page readonly
clean
16134F08000
unkown
page read and write
clean
7FF558003000
unkown image
page readonly
clean
1A837B08000
unkown
page read and write
clean
BFCE000
unkown
page read and write
clean
7FF5DE0DF000
unkown image
page readonly
clean
161357A4000
unkown
page read and write
clean
BF52000
unkown
page read and write
clean
2450F7A000
unkown
page read and write
clean
7FF5A2FAA000
unkown image
page readonly
clean
161357AC000
unkown
page read and write
clean
7FF557F61000
unkown image
page readonly
clean
156A4000
unkown
page read and write
clean
1613578B000
unkown
page read and write
clean
7DF5EBE42000
unkown image
page readonly
clean
7FF5A2E45000
unkown image
page readonly
clean
16135797000
unkown
page read and write
clean
15DED000
unkown
page read and write
clean
1681E000
unkown
page read and write
clean
2C7F000
unkown image
page readonly
clean
2CC1CBF0000
heap private
page read and write
clean
7F2C2000
unkown image
page readonly
clean
7FF557CDC000
unkown image
page readonly
clean
7FF557F3B000
unkown image
page readonly
clean
7FF55AD11000
unkown image
page readonly
clean
1A837A3C000
unkown
page read and write
clean
16134E4C000
unkown
page read and write
clean
BF80000
unkown
page read and write
clean
BFA2000
unkown
page read and write
clean
2CC1CF13000
unkown
page read and write
clean
7FF521ADF000
unkown image
page readonly
clean
E86A47C000
unkown
page read and write
clean
161357BF000
unkown
page read and write
clean
1613577D000
unkown
page read and write
clean
15683000
unkown
page read and write
clean
7FF5DE1CA000
unkown image
page readonly
clean
1B766650000
unkown
page read and write
clean
16885000
unkown
page read and write
clean
BF7A000
unkown
page read and write
clean
16134ECA000
unkown
page read and write
clean
7DF5B0C32000
unkown image
page readonly
clean
16135762000
unkown
page read and write
clean
161357A3000
unkown
page read and write
clean
16991000
unkown
page read and write
clean
BF91000
unkown
page read and write
clean
16885000
unkown
page read and write
clean
16135C02000
unkown
page read and write
clean
161357A3000
unkown
page read and write
clean
4B003F7000
unkown
page read and write
clean
161357B4000
unkown
page read and write
clean
BF61000
unkown
page read and write
clean
16135C3C000
unkown
page read and write
clean
7FF521B81000
unkown image
page readonly
clean
BF1B000
unkown
page read and write
clean
17C3EBC0000
unkown image
page readonly
clean
168C2000
unkown
page read and write
clean
161357A3000
unkown
page read and write
clean
16134E5A000
unkown
page read and write
clean
161357A2000
unkown
page read and write
clean
7FF521BAA000
unkown image
page readonly
clean
34A7000
heap default
page read and write
clean
161357B6000
unkown
page read and write
clean
E86A7FF000
unkown
page read and write
clean
7FF557EAD000
unkown image
page readonly
clean
2CC1CC30000
unkown image
page readonly
clean
BFA1000
unkown
page read and write
clean
4B004FE000
unkown
page read and write
clean
7F0D0000
unkown image
page readonly
clean
7DF5D5040000
unkown image
page readonly
clean
7FF5A2DCF000
unkown image
page readonly
clean
89F57A000
unkown
page read and write
clean
7FF521C23000
unkown image
page readonly
clean
16822000
unkown
page read and write
clean
BF5C000
unkown
page read and write
clean
BF4B000
unkown
page read and write
clean
BF97000
unkown
page read and write
clean
7FF521B3C000
unkown image
page readonly
clean
17C3E890000
unkown image
page read and write
clean
BF5E000
unkown
page read and write
clean
7FF521B92000
unkown image
page readonly
clean
16135765000
unkown
page read and write
clean
7FF55AB65000
unkown image
page readonly
clean
1696F000
unkown
page read and write
clean
155EA000
unkown
page read and write
clean
7DF5D5030000
unkown image
page readonly
clean
161357AE000
unkown
page read and write
clean
7FF5580B9000
unkown image
page readonly
clean
16135D00000
unkown
page read and write
clean
167EC000
unkown
page read and write
clean
BF4A000
unkown
page read and write
clean
15D13000
unkown
page read and write
clean
BF6D000
unkown
page read and write
clean
7FF557D65000
unkown image
page readonly
clean
16135768000
unkown
page read and write
clean
2CC1CE4A000
unkown
page read and write
clean
BF51000
unkown
page read and write
clean
1B76664C000
unkown
page read and write
clean
7FF5DE0E3000
unkown image
page readonly
clean
167E5000
unkown
page read and write
clean
7DF568970000
unkown image
page readonly
clean
BF90000
unkown
page read and write
clean
BF50000
unkown
page read and write
clean
7FF557842000
unkown image
page readonly
clean
16135D02000
unkown
page read and write
clean
7FF5DE11B000
unkown image
page readonly
clean
1A837930000
unkown image
page readonly
clean
7FF5A2D46000
unkown image
page readonly
clean
1B766570000
unkown image
page read and write
clean
16134E56000
unkown
page read and write
clean
BFB7000
unkown
page read and write
clean
16135C0A000
unkown
page read and write
clean
16135C02000
unkown
page read and write
clean
7FF5A2EE7000
unkown image
page readonly
clean
161357D2000
unkown
page read and write
clean
7DF568990000
unkown image
page readonly
clean
BF7E000
unkown
page read and write
clean
161357A5000
unkown
page read and write
clean
1568C000
unkown
page read and write
clean
BF94000
unkown
page read and write
clean
7FF5A2F1E000
unkown image
page readonly
clean
167EC000
unkown
page read and write
clean
E86AAFE000
unkown
page read and write
clean
90FC27F000
unkown
page read and write
clean
2450C7B000
unkown
page read and write
clean
2BAF000
unkown image
page readonly
clean
1613579B000
unkown
page read and write
clean
16134C40000
unkown image
page readonly
clean
7DF463C10000
unkown image
page readonly
clean
16873000
unkown
page read and write
clean
BF66000
unkown
page read and write
clean
7FF55ACF4000
unkown image
page readonly
clean
7FF55ACFA000
unkown image
page readonly
clean
1699B000
unkown
page read and write
clean
7FF521BB3000
unkown image
page readonly
clean
15BEA000
unkown
page read and write
clean
7FF5A2EEE000
unkown image
page readonly
clean
161357A5000
unkown
page read and write
clean
7FF55A995000
unkown image
page readonly
clean
4B7FD4B000
unkown
page read and write
clean
E86A77B000
unkown
page read and write
clean
7FF521BC7000
unkown image
page readonly
clean
7DF5EBE40000
unkown image
page readonly
clean
BF88000
unkown
page read and write
clean
BF56000
unkown
page read and write
clean
7FF521A2F000
unkown image
page readonly
clean
1A837A52000
unkown
page read and write
clean
BF48000
unkown
page read and write
clean
161357B4000
unkown
page read and write
clean
7FF5A2BBC000
unkown image
page readonly
clean
7DF52F930000
unkown image
page readonly
clean
7DF565D42000
unkown image
page readonly
clean
16134E54000
unkown
page read and write
clean
16135C21000
unkown
page read and write
clean
7FF55802B000
unkown image
page readonly
clean
7FF5DDD97000
unkown image
page readonly
clean
BF5D000
unkown
page read and write
clean
7FF521CD1000
unkown image
page readonly
clean
BF61000
unkown
page read and write
clean
7FF521837000
unkown image
page readonly
clean
7FF5A2E2C000
unkown image
page readonly
clean
7FF52143E000
unkown image
page readonly
clean
16135C21000
unkown
page read and write
clean
7FF55AC19000
unkown image
page readonly
clean
2CC1CC00000
unkown image
page readonly
clean
E86A9FF000
unkown
page read and write
clean
15617000
unkown
page read and write
clean
7FF521CA2000
unkown image
page readonly
clean
1A837A13000
unkown
page read and write
clean
7DF42D800000
unkown image
page readonly
clean
4B005F7000
unkown
page read and write
clean
1613578B000
unkown
page read and write
clean
7FF5DE1A2000
unkown image
page readonly
clean
7FF55AC87000
unkown image
page readonly
clean
BF7E000
unkown
page read and write
clean
16134EF5000
unkown
page read and write
clean
17C3EBB5000
heap private
page read and write
clean
1B766AD0000
unkown image
page readonly
clean
1A837A4C000
unkown
page read and write
clean
90FC177000
unkown
page read and write
clean
1688B000
unkown
page read and write
clean
16134E50000
unkown
page read and write
clean
BF5E000
unkown
page read and write
clean
2450A7E000
unkown
page read and write
clean
1210000
unkown
page read and write
clean
BF94000
unkown
page read and write
clean
15BDA000
unkown
page read and write
clean
7F0D2000
unkown image
page readonly
clean
BEFB000
unkown
page read and write
clean
7FF55AA96000
unkown image
page readonly
clean
7FF521CD0000
unkown image
page readonly
clean
16135D9D000
unkown
page read and write
clean
16135768000
unkown
page read and write
clean
15DCD000
unkown
page read and write
clean
15DD5000
unkown
page read and write
clean
7FF55AB91000
unkown image
page readonly
clean
7F2E0000
unkown image
page readonly
clean
7FF557ECB000
unkown image
page readonly
clean
7FF521C47000
unkown image
page readonly
clean
7F2D0000
unkown image
page readonly
clean
1B766D40000
unkown
page read and write
clean
89F87F000
unkown
page read and write
clean
16822000
unkown
page read and write
clean
BF58000
unkown
page read and write
clean
2CC1CF00000
unkown
page read and write
clean
4B0077B000
unkown
page read and write
clean
15C54000
unkown
page read and write
clean
7FF55805D000
unkown image
page readonly
clean
4B0007E000
unkown
page read and write
clean
BF99000
unkown
page read and write
clean
2CC1CE55000
unkown
page read and write
clean
7DF565D42000
unkown image
page readonly
clean
16134EEB000
unkown
page read and write
clean
161357A3000
unkown
page read and write
clean
167FC000
unkown
page read and write
clean
BF9B000
unkown
page read and write
clean
16134E3A000
unkown
page read and write
clean
32D0000
heap private
page read and write
clean
BF51000
unkown
page read and write
clean
7DF565D40000
unkown image
page readonly
clean
16134C70000
unkown image
page readonly
clean
BF47000
unkown
page read and write
clean
BF6B000
unkown
page read and write
clean
16825000
unkown
page read and write
clean
BF89000
unkown
page read and write
clean
1204000
unkown
page read and write
clean
BF98000
unkown
page read and write
clean
BF85000
unkown
page read and write
clean
BF6B000
unkown
page read and write
clean
4B0097A000
unkown
page read and write
clean
7DF568972000
unkown image
page readonly
clean
16135779000
unkown
page read and write
clean
BF89000
unkown
page read and write
clean
BF61000
unkown
page read and write
clean
155B9000
unkown
page read and write
clean
BF28000
unkown
page read and write
clean
BF8D000
unkown
page read and write
clean
7FF55A7F7000
unkown image
page readonly
clean
7FF5A2F3A000
unkown image
page readonly
clean
BF7A000
unkown
page read and write
clean
7FF557F4C000
unkown image
page readonly
clean
BF87000
unkown
page read and write
clean
16135D02000
unkown
page read and write
clean
7FF521AA0000
unkown image
page readonly
clean
BF4D000
unkown
page read and write
clean
17C3E920000
heap default
page read and write
clean
BF76000
unkown
page read and write
clean
7DF5D5020000
unkown image
page readonly
clean
16135767000
unkown
page read and write
clean
7F2E0000
unkown image
page readonly
clean
BF63000
unkown
page read and write
clean
7FF5A2D90000
unkown image
page readonly
clean
BF54000
unkown
page read and write
clean
7DF52F950000
unkown image
page readonly
clean
BF9E000
unkown
page read and write
clean
16134F16000
unkown
page read and write
clean
BF7A000
unkown
page read and write
clean
7FF521BE3000
unkown image
page readonly
clean
7FF521C07000
unkown image
page readonly
clean
168C6000
unkown
page read and write
clean
2BDA000
unkown image
page readonly
clean
7DF5D5022000
unkown image
page readonly
clean
1B766613000
unkown
page read and write
clean
7FF557EEF000
unkown image
page readonly
clean
BF6A000
unkown
page read and write
clean
BF98000
unkown
page read and write
clean
1A837A56000
unkown
page read and write
clean
D9D000
unkown
page read and write
clean
16135700000
unkown
page read and write
clean
161357AD000
unkown
page read and write
clean
7FF55AC8A000
unkown image
page readonly
clean
17C3EB20000
unkown image
page readonly
clean
16135C03000
unkown
page read and write
clean
7FF5580CA000
unkown image
page readonly
clean
16135718000
unkown
page read and write
clean
1613579B000
unkown
page read and write
clean
16134E39000
unkown
page read and write
clean
16134E13000
unkown
page read and write
clean
15C35000
unkown
page read and write
clean
7DF52F942000
unkown image
page readonly
clean
7FF521A81000
unkown image
page readonly
clean
16135C0A000
unkown
page read and write
clean
BF48000
unkown
page read and write
clean
16134E82000
unkown
page read and write
clean
7DF568980000
unkown image
page readonly
clean
1B766713000
unkown
page read and write
clean
BF63000
unkown
page read and write
clean
7FF521A35000
unkown image
page readonly
clean
15DD5000
unkown
page read and write
clean
16135D9D000
unkown
page read and write
clean
7DF52F950000
unkown image
page readonly
clean
BF57000
unkown
page read and write
clean
16135D02000
unkown
page read and write
clean
7FF557F35000
unkown image
page readonly
clean
161354B0000
unkown
page read and write
clean
1204000
unkown
page read and write
clean
7DF52F942000
unkown image
page readonly
clean
168AA000
unkown
page read and write
clean
7FF55AC63000
unkown image
page readonly
clean
16819000
unkown
page read and write
clean
BF5F000
unkown
page read and write
clean
16135768000
unkown
page read and write
clean
7F0C2000
unkown image
page readonly
clean
1A837950000
heap default
page read and write
clean
2C0D000
unkown image
page readonly
clean
1613578D000
unkown
page read and write
clean
BF54000
unkown
page read and write
clean
16134EE9000
unkown
page read and write
clean
BF5C000
unkown
page read and write
clean
34B6000
heap default
page read and write
clean
E86A67B000
unkown
page read and write
clean
7FF521C4D000
unkown image
page readonly
clean
17C3E8B0000
unkown image
page readonly
clean
7FF521A21000
unkown image
page readonly
clean
1B7665B0000
unkown image
page readonly
clean
7DF565D60000
unkown image
page readonly
clean
1B766702000
unkown
page read and write
clean
1699B000
unkown
page read and write
clean
155EA000
unkown
page read and write
clean
15D13000
unkown
page read and write
clean
1681E000
unkown
page read and write
clean
7FF5A2FBA000
unkown image
page readonly
clean
7FF558057000
unkown image
page readonly
clean
BF49000
unkown
page read and write
clean
1B76668E000
unkown
page read and write
clean
7FF557E91000
unkown image
page readonly
clean
16864000
unkown
page read and write
clean
7FF521A14000
unkown image
page readonly
clean
7FF5A2E41000
unkown image
page readonly
clean
16752000
unkown
page read and write
clean
7DF568972000
unkown image
page readonly
clean
16134C40000
unkown image
page readonly
clean
7FF5A2C45000
unkown image
page readonly
clean
7DF565D50000
unkown image
page readonly
clean
1564B000
unkown
page read and write
clean
168AF000
unkown
page read and write
clean
2CC1CC50000
heap default
page read and write
clean
2CC1CE8D000
unkown
page read and write
clean
BF85000
unkown
page read and write
clean
16135765000
unkown
page read and write
clean
17C3EBB0000
heap private
page read and write
clean
1B766700000
unkown
page read and write
clean
16135768000
unkown
page read and write
clean
16873000
unkown
page read and write
clean
7F1C0000
unkown image
page readonly
clean
BF08000
unkown
page read and write
clean
1A837B13000
unkown
page read and write
clean
161357B6000
unkown
page read and write
clean
BF24000
unkown
page read and write
clean
1613579B000
unkown
page read and write
clean
1B76667F000
unkown
page read and write
clean
16135778000
unkown
page read and write
clean
16134E4B000
unkown
page read and write
clean
7FF5218A4000
unkown image
page readonly
clean
2C1B000
unkown image
page readonly
clean
7FF55AC3E000
unkown image
page readonly
clean
1613578B000
unkown
page read and write
clean
E7E000
unkown
page read and write
clean
1B766600000
unkown
page read and write
clean
1B766658000
unkown
page read and write
clean
1613579B000
unkown
page read and write
clean
2CB8000
unkown image
page readonly
clean
17C3E951000
unkown
page read and write
clean
7FF521B51000
unkown image
page readonly
clean
BF56000
unkown
page read and write
clean
1A837920000
unkown image
page readonly
clean
16135D6A000
unkown
page read and write
clean
7FF521955000
unkown image
page readonly
clean
16135C02000
unkown
page read and write
clean
7FF557FEF000
unkown image
page readonly
clean
15695000
unkown
page read and write
clean
7FF557FED000
unkown image
page readonly
clean
BFB5000
unkown
page read and write
clean
1B766C50000
unkown image
page readonly
clean
89F9FE000
unkown
page read and write
clean
7FF55AC47000
unkown image
page readonly
clean
16135D3C000
unkown
page read and write
clean
BF58000
unkown
page read and write
clean
7DF565D60000
unkown image
page readonly
clean
BF8D000
unkown
page read and write
clean
BF78000
unkown
page read and write
clean
16134E59000
unkown
page read and write
clean
BF8B000
unkown
page read and write
clean
7FF521637000
unkown image
page readonly
clean
16135714000
unkown
page read and write
clean
155FE000
unkown
page read and write
clean
7FF558000000
unkown image
page readonly
clean
16976000
unkown
page read and write
clean
BF56000
unkown
page read and write
clean
16134E9C000
unkown
page read and write
clean
1B766671000
unkown
page read and write
clean
7FF55AC07000
unkown image
page readonly
clean
7DF5EBE30000
unkown image
page readonly
clean
1613576C000
unkown
page read and write
clean
16134E8A000
unkown
page read and write
clean
161357C3000
unkown
page read and write
clean
1207000
unkown
page read and write
clean
BFB9000
unkown
page read and write
clean
7DF52F940000
unkown image
page readonly
clean
7FF5A2EB7000
unkown image
page readonly
clean
7FF55AD11000
unkown image
page readonly
clean
7FF55AC1D000
unkown image
page readonly
clean
7DF5B0C32000
unkown image
page readonly
clean
7FF557E66000
unkown image
page readonly
clean
1204000
unkown
page read and write
clean
1568C000
unkown
page read and write
clean
16134E4A000
unkown
page read and write
clean
161357B4000
unkown
page read and write
clean
4B00879000
unkown
page read and write
clean
17C3E951000
unkown
page read and write
clean
BF46000
unkown
page read and write
clean
BF3B000
unkown
page read and write
clean
2CC1CE88000
unkown
page read and write
clean
1207000
unkown
page read and write
clean
2CC1CBE0000
unkown image
page read and write
clean
15636000
unkown
page read and write
clean
1613576A000
unkown
page read and write
clean
EC0000
unkown
page read and write
clean
D40000
unkown image
page readonly
clean
7FF55AAE0000
unkown image
page readonly
clean
17C3EDC0000
unkown image
page readonly
clean
1A837900000
unkown image
page readonly
clean
16977000
unkown
page read and write
clean
7FF521A56000
unkown image
page readonly
clean
161357D2000
unkown
page read and write
clean
1A837B00000
unkown
page read and write
clean
7F2D2000
unkown image
page readonly
clean
7FF55803E000
unkown image
page readonly
clean
1613578B000
unkown
page read and write
clean
1562A000
unkown
page read and write
clean
16135762000
unkown
page read and write
clean
167EC000
unkown
page read and write
clean
2CC1CD50000
unkown
page read and write
clean
BFA8000
unkown
page read and write
clean
4B002FA000
unkown
page read and write
clean
16134E4F000
unkown
page read and write
clean
7FF55AC6E000
unkown image
page readonly
clean
BF4A000
unkown
page read and write
clean
BF8C000
unkown
page read and write
clean
7FF5A2F37000
unkown image
page readonly
clean
16134E70000
unkown
page read and write
clean
BF4E000
unkown
page read and write
clean
7FF5C73C1000
unkown image
page readonly
clean
7F0C0000
unkown image
page readonly
clean
7FF5A2EF7000
unkown image
page readonly
clean
2CC1CE7E000
unkown
page read and write
clean
15699000
unkown
page read and write
clean
7FF5DE0FE000
unkown image
page readonly
clean
7FF521A89000
unkown image
page readonly
clean
90FBE7E000
unkown
page read and write
clean
BF5F000
unkown
page read and write
clean
BF9F000
unkown
page read and write
clean
BFAF000
unkown
page read and write
clean
1B76664D000
unkown
page read and write
clean
7FF5A2ECD000
unkown image
page readonly
clean
16134E00000
unkown
page read and write
clean
7F0E0000
unkown image
page readonly
clean
1A837900000
unkown image
page readonly
clean
2CC1CE13000
unkown
page read and write
clean
BF48000
unkown
page read and write
clean
167FC000
unkown
page read and write
clean
7FF55AC37000
unkown image
page readonly
clean
1B7665F0000
unkown image
page readonly
clean
7FF521C1B000
unkown image
page readonly
clean
16135460000
unkown image
page write copy
clean
2450B7B000
unkown
page read and write
clean
7DF565D52000
unkown image
page readonly
clean
BF7E000
unkown
page read and write
clean
155FE000
unkown
page read and write
clean
2CC1CE00000
unkown
page read and write
clean
161357D7000
unkown
page read and write
clean
156AC000
unkown
page read and write
clean
11F4000
unkown
page read and write
clean
7FF558017000
unkown image
page readonly
clean
1B7665C0000
unkown image
page readonly
clean
7FF521BDF000
unkown image
page readonly
clean
7DF5EBE42000
unkown image
page readonly
clean
166F6000
unkown
page read and write
clean
168AA000
unkown
page read and write
clean
323F000
unkown
page read and write
clean
1A837980000
unkown
page read and write
clean
BF04000
unkown
page read and write
clean
16134EB9000
unkown
page read and write
clean
7FF5A2EC9000
unkown image
page readonly
clean
EBF000
unkown
page read and write
clean
16825000
unkown
page read and write
clean
7FF5A2EE0000
unkown image
page readonly
clean
BFCC000
unkown
page read and write
clean
155EA000
unkown
page read and write
clean
16134E4D000
unkown
page read and write
clean
168AF000
unkown
page read and write
clean
16134C20000
unkown image
page read and write
clean
1699B000
unkown
page read and write
clean
161357B1000
unkown
page read and write
clean
BF5A000
unkown
page read and write
clean
7FF55AB1F000
unkown image
page readonly
clean
7DF5B0C20000
unkown image
page readonly
clean
16134EE2000
unkown
page read and write
clean
161357BF000
unkown
page read and write
clean
BF31000
unkown
page read and write
clean
2CC1CE3C000
unkown
page read and write
clean
1681E000
unkown
page read and write
clean
BFC0000
unkown
page read and write
clean
16134D70000
unkown image
page readonly
clean
7FF558033000
unkown image
page readonly
clean
BF8A000
unkown
page read and write
clean
7FF55AC5B000
unkown image
page readonly
clean
1A837A00000
unkown
page read and write
clean
2CB8000
unkown image
page readonly
clean
BFBB000
unkown
page read and write
clean
1680B000
unkown
page read and write
clean
16134EC0000
unkown
page read and write
clean
16882000
unkown
page read and write
clean
1A838050000
unkown image
page readonly
clean
16135200000
unkown image
page readonly
clean
90FC07B000
unkown
page read and write
clean
1613574A000
unkown
page read and write
clean
1A8378E0000
unkown image
page read and write
clean
15D87000
unkown
page read and write
clean
1689B000
unkown
page read and write
clean
1B766590000
unkown image
page readonly
clean
7FF557F65000
unkown image
page readonly
clean
16134EDA000
unkown
page read and write
clean
1A837A29000
unkown
page read and write
clean
16135712000
unkown
page read and write
clean
17C3E931000
unkown
page read and write
clean
7FF557BC7000
unkown image
page readonly
clean
7F2C2000
unkown image
page readonly
clean
1B76668C000
unkown
page read and write
clean
7FF521BF7000
unkown image
page readonly
clean
4B001FE000
unkown
page read and write
clean
7DF5B0C40000
unkown image
page readonly
clean
16892000
unkown
page read and write
clean
BF49000
unkown
page read and write
clean
1B7665E0000
heap default
page read and write
clean
1568B000
unkown
page read and write
clean
7FF5DE14D000
unkown image
page readonly
clean
15BF3000
unkown
page read and write
clean
BF83000
unkown
page read and write
clean
1613578B000
unkown
page read and write
clean
7FF5A2722000
unkown image
page readonly
clean
7FF521CB4000
unkown image
page readonly
clean
BFA7000
unkown
page read and write
clean
16135D02000
unkown
page read and write
clean
16135C02000
unkown
page read and write
clean
BF9D000
unkown
page read and write
clean
7FF5DE0E6000
unkown image
page readonly
clean
2CC1CE50000
unkown
page read and write
clean
BF35000
unkown
page read and write
clean
2CC1D380000
unkown image
page readonly
clean
1613579B000
unkown
page read and write
clean
16825000
unkown
page read and write
clean
155B9000
unkown
page read and write
clean
7FF521AE7000
unkown image
page readonly
clean
7FF55AB95000
unkown image
page readonly
clean
16134EEC000
unkown
page read and write
clean
7FF521997000
unkown image
page readonly
clean
89F97F000
unkown
page read and write
clean
7FF55AC30000
unkown image
page readonly
clean
1613578F000
unkown
page read and write
clean
E86A57E000
unkown
page read and write
clean
7DF5B0C40000
unkown image
page readonly
clean
1B766629000
unkown
page read and write
clean
BF00000
unkown
page read and write
clean
89F5FF000
unkown
page read and write
clean
16135792000
unkown
page read and write
clean
7FF5217B1000
unkown image
page readonly
clean
15DDC000
unkown
page read and write
clean
7FF557FF3000
unkown image
page readonly
clean
16135000000
unkown image
page readonly
clean
7FF55AB7C000
unkown image
page readonly
clean
D30000
unkown image
page read and write
clean
7FF521CCA000
unkown image
page readonly
clean
D40000
unkown image
page readonly
clean
17C3E95F000
unkown
page read and write
clean
7DF5D5032000
unkown image
page readonly
clean
7FF5DE0F7000
unkown image
page readonly
clean
16134E3C000
unkown
page read and write
clean
2CC1CC00000
unkown image
page readonly
clean
15647000
unkown
page read and write
clean
161354B0000
unkown
page read and write
clean
16135C00000
unkown
page read and write
clean
161357AB000
unkown
page read and write
clean
7FF5DE0F0000
unkown image
page readonly
clean
16134E53000
unkown
page read and write
clean
7FF5A2F99000
unkown image
page readonly
clean
1B766602000
unkown
page read and write
clean
DF0000
unkown image
page readonly
clean
BF80000
unkown
page read and write
clean
167FC000
unkown
page read and write
clean
7DF568982000
unkown image
page readonly
clean
7FF5A2FB1000
unkown image
page readonly
clean
2CC1CF08000
unkown
page read and write
clean
16135C14000
unkown
page read and write
clean
2CC1CD30000
unkown image
page readonly
clean
16135768000
unkown
page read and write
clean
2C16000
unkown image
page readonly
clean
7FF5A2FC1000
unkown image
page readonly
clean
7DF568982000
unkown image
page readonly
clean
7FF5A2F3D000
unkown image
page readonly
clean
7FF557FD7000
unkown image
page readonly
clean
7DF5EBE50000
unkown image
page readonly
clean
16134DB0000
unkown image
page readonly
clean
1A838202000
unkown
page read and write
clean
16822000
unkown
page read and write
clean
1A837A8A000
unkown
page read and write
clean
16134D90000
unkown
page read and write
clean
7F2C0000
unkown image
page readonly
clean
7FF521C2E000
unkown image
page readonly
clean
89F8F9000
unkown
page read and write
clean
7FF52163B000
unkown image
page readonly
clean
7F2C0000
unkown image
page readonly
clean
BF7E000
unkown
page read and write
clean
7DF565D40000
unkown image
page readonly
clean
7FF5DE1C5000
unkown image
page readonly
clean
168B7000
unkown
page read and write
clean
16135602000
unkown
page read and write
clean
15C54000
unkown
page read and write
clean
7FF558007000
unkown image
page readonly
clean
7FF521B25000
unkown image
page readonly
clean
16135380000
unkown image
page readonly
clean
16134E29000
unkown
page read and write
clean
1B76663C000
unkown
page read and write
clean
16135C02000
unkown
page read and write
clean
7FF55AD0A000
unkown image
page readonly
clean
7FF5A2F13000
unkown image
page readonly
clean
16872000
unkown
page read and write
clean
7FF521B7F000
unkown image
page readonly
clean
16134E49000
unkown
page read and write
clean
7FF5A2DAB000
unkown image
page readonly
clean
AE0000
unkown image
page readonly
clean
7FF5DE1D1000
unkown image
page readonly
clean
31F1000
unkown
page read and write
clean
7FF5A2AA1000
unkown image
page readonly
clean
2CC1D000000
unkown image
page readonly
clean
17C3E951000
unkown
page read and write
clean
7FF55AB6B000
unkown image
page readonly
clean
1A837A7F000
unkown
page read and write
clean
15DCD000
unkown
page read and write
clean
7FF5580C4000
unkown image
page readonly
clean
1A837A53000
unkown
page read and write
clean
167FC000
unkown
page read and write
clean
16135C02000
unkown
page read and write
clean
7FF5A2D71000
unkown image
page readonly
clean
BF51000
unkown
page read and write
clean
168CE000
unkown
page read and write
clean
2CB3000
unkown image
page readonly
clean
7DF5B0C30000
unkown image
page readonly
clean
1A837960000
unkown image
page readonly
clean
16134C90000
heap default
page read and write
clean
1675D000
unkown
page read and write
clean
15DED000
unkown
page read and write
clean
1568C000
unkown
page read and write
clean
7FF5DE1D1000
unkown image
page readonly
clean
BF82000
unkown
page read and write
clean
161357A5000
unkown
page read and write
clean
4B7FDCE000
unkown
page read and write
clean
2CC1D200000
unkown image
page readonly
clean
BF82000
unkown
page read and write
clean
7FF55AADD000
unkown image
page readonly
clean
BF54000
unkown
page read and write
clean
7FF521BF0000
unkown image
page readonly
clean
2CC1CE65000
unkown
page read and write
clean
1689B000
unkown
page read and write
clean
161357AC000
unkown
page read and write
clean
1B76664B000
unkown
page read and write
clean
7FF5A2ED3000
unkown image
page readonly
clean
BF49000
unkown
page read and write
clean
7FF55800E000
unkown image
page readonly
clean
2CC1CE2A000
unkown
page read and write
clean
BF6B000
unkown
page read and write
clean
7FF5219A2000
unkown image
page readonly
clean
7FF5A2EE3000
unkown image
page readonly
clean
16135D3C000
unkown
page read and write
clean
DDC000
unkown
page read and write
clean
7FF55AC1F000
unkown image
page readonly
clean
1A837ED0000
unkown image
page readonly
clean
7FF557BC1000
unkown image
page readonly
clean
7FF5DE1B4000
unkown image
page readonly
clean
7FF5580DA000
unkown image
page readonly
clean
BF4C000
unkown
page read and write
clean
7FF5A2D8D000
unkown image
page readonly
clean
16134F13000
unkown
page read and write
clean
7DF565D50000
unkown image
page readonly
clean
7FF521BBE000
unkown image
page readonly
clean
7FF521A16000
unkown image
page readonly
clean
16762000
unkown
page read and write
clean
1685D000
unkown
page read and write
clean
7FF5A2FA4000
unkown image
page readonly
clean
BF67000
unkown
page read and write
clean
2CC1CC20000
unkown image
page readonly
clean
7DF5B0C22000
unkown image
page readonly
clean
7DF5EBE32000
unkown image
page readonly
clean
17C3E948000
unkown
page read and write
clean
7DF565D52000
unkown image
page readonly
clean
1A837B02000
unkown
page read and write
clean
161354B0000
unkown
page read and write
clean
2CC1CE65000
unkown
page read and write
clean
BF91000
unkown
page read and write
clean
7FF5218A7000
unkown image
page readonly
clean
7FF5DE1BA000
unkown image
page readonly
clean
BF4F000
unkown
page read and write
clean
7FF521897000
unkown image
page readonly
clean
7FF521B2B000
unkown image
page readonly
clean
7FF521CC1000
unkown image
page readonly
clean
16135C02000
unkown
page read and write
clean
7FF55AAFB000
unkown image
page readonly
clean
7DF5B0C22000
unkown image
page readonly
clean
There are 906 hidden memdumps, click here to show them.