IOC Report

loading gif

Files

File Path
Type
Category
Malicious
2nd order.xlsx
CDFV2 Encrypted
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
downloaded
 malicious
C:\Users\Public\vbc.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\147ED9DA.png
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\42532842.emf
Windows Enhanced Metafile (EMF) image data version 0x10000
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4C603BFD.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 160x160, frames 3
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5BD18EF8.png
PNG image data, 413 x 220, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5F2CC8EC.png
PNG image data, 139 x 180, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\67E6B1A0.jpeg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 160x160, frames 3
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6EB5575B.png
PNG image data, 139 x 180, 8-bit colormap, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8A1CC521.png
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9A2764D7.png
PNG image data, 413 x 220, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BA3A28AE.png
PNG image data, 458 x 211, 8-bit/color RGB, non-interlaced
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DB87EC13.png
PNG image data, 458 x 211, 8-bit/color RGB, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\~DF4DB268AE65115E03.TMP
data
dropped
C:\Users\user\AppData\Local\Temp\~DF8E53683BC65278C6.TMP
CDFV2 Encrypted
dropped
C:\Users\user\AppData\Local\Temp\~DFD1B078BFCCC38B01.TMP
data
dropped
C:\Users\user\AppData\Local\Temp\~DFEFE1961646CBFAF0.TMP
data
dropped
C:\Users\user\Desktop\~$2nd order.xlsx
data
dropped
There are 9 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
 malicious
C:\Users\Public\vbc.exe
"C:\Users\Public\vbc.exe"
malicious
C:\Users\Public\vbc.exe
C:\Users\Public\vbc.exe
 malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

URLs

Name
IP
Malicious
ftp://primesinsured.com/oil1
unknown
 malicious
http://198.12.127.213/400/vbc.exe
198.12.127.213
 malicious
http://blog.iandreev.com
unknown
http://127.0.0.1:HTTP/1.1
unknown
http://SsT3DRxYDVjmHt.org
unknown
http://DynDns.comDynDNS
unknown
http://blog.iandreev.com/
unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
unknown
http://FujuYs.com
unknown
There are 1 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
198.12.127.213
unknown
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
5p-
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\2DD54
2DD54
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
`x-
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\32839
32839
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\33EE4
33EE4
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Max Display
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 1
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 2
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 3
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 4
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 5
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 6
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 7
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 8
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 9
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 10
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 11
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 12
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 13
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 14
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 15
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 16
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 17
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 18
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 19
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 20
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\file mru
Item 21
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\32839
32839
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_CURRENT_USER\Software\Microsoft\GDIPlus
FontCachePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbc_RASMANCS
FileDirectory
There are 43 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
2281000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
2324000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
2491000
trusted library allocation
page read and write
 malicious
2520000
trusted library allocation
page read and write
 malicious
3499000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
6BFE000
trusted library allocation
page read and write
5ACD000
stack
page read and write
790000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
212000
trusted library allocation
page read and write
286000
trusted library allocation
page execute and read and write
345000
trusted library allocation
page read and write
8C0000
unkown
page readonly
280000
trusted library allocation
page read and write
7C0000
heap
page read and write
647E000
stack
page read and write
935000
unkown
page execute read
24E5000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
5190000
trusted library allocation
page read and write
4980000
trusted library allocation
page read and write
996000
unkown
page readonly
6E75000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
6B0000
trusted library allocation
page read and write
996000
unkown
page readonly
282000
trusted library allocation
page read and write
855000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
6470000
trusted library allocation
page read and write
20C0000
trusted library allocation
page read and write
6C40000
trusted library allocation
page read and write
49AD000
trusted library allocation
page read and write
6623000
trusted library allocation
page read and write
559E000
stack
page read and write
6626000
trusted library allocation
page read and write
7A0000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
6BC4000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
68AB000
trusted library allocation
page read and write
665A000
trusted library allocation
page read and write
785000
trusted library allocation
page read and write
994000
unkown
page write copy
935000
unkown
page execute read
780000
trusted library allocation
page read and write
996000
unkown
page readonly
6B11000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
6C35000
trusted library allocation
page read and write
42BE000
stack
page read and write
8B0000
trusted library allocation
page read and write
6848000
trusted library allocation
page read and write
42C0000
trusted library allocation
page read and write
64EF000
trusted library allocation
page read and write
67D9000
trusted library allocation
page read and write
6D0000
heap
page read and write
8C0000
unkown
page readonly
6CBA000
trusted library allocation
page read and write
68FA000
trusted library allocation
page read and write
5A0000
trusted library allocation
page read and write
4940000
heap
page read and write
535D000
trusted library allocation
page read and write
6A92000
trusted library allocation
page read and write
6899000
trusted library allocation
page read and write
8C2000
unkown
page execute read
2130000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
996000
unkown
page readonly
8C2000
unkown
page execute read
890000
trusted library allocation
page read and write
62D0000
trusted library allocation
page read and write
6F2000
heap
page read and write
780000
trusted library allocation
page read and write
8B0000
trusted library allocation
page read and write
7F7000
heap
page read and write
B4000
trusted library allocation
page read and write
590000
trusted library allocation
page read and write
996000
unkown
page readonly
7E0000
trusted library allocation
page read and write
42C0000
trusted library allocation
page read and write
2200000
heap
page execute and read and write
7D0000
trusted library allocation
page read and write
2130000
trusted library allocation
page read and write
785000
trusted library allocation
page read and write
6C54000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
8C2000
unkown
page execute read
6C0000
trusted library allocation
page read and write
65C8000
trusted library allocation
page read and write
8C0000
unkown
page readonly
574E000
stack
page read and write
340000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
46B0000
trusted library allocation
page read and write
4A33000
trusted library allocation
page read and write
77E000
stack
page read and write
7782000
trusted library allocation
page read and write
2150000
trusted library allocation
page read and write
307000
heap
page read and write
2149000
trusted library allocation
page read and write
66EC000
trusted library allocation
page read and write
4F8000
trusted library allocation
page read and write
533E000
stack
page read and write
65C1000
trusted library allocation
page read and write
5A0000
trusted library allocation
page read and write
785000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
634E000
trusted library allocation
page read and write
68C000
heap
page read and write
7D0000
trusted library allocation
page read and write
4A42000
trusted library allocation
page read and write
6806000
trusted library allocation
page read and write
55A0000
heap
page read and write
6817000
trusted library allocation
page read and write
684E000
trusted library allocation
page read and write
780000
trusted library allocation
page execute and read and write
6353000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
650000
trusted library allocation
page read and write
42C0000
trusted library allocation
page read and write
6482000
trusted library allocation
page read and write
8A0000
trusted library allocation
page read and write
47B000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
210E000
stack
page read and write
340000
trusted library allocation
page read and write
4B6D000
stack
page read and write
5D0000
heap
page read and write
4A56000
trusted library allocation
page read and write
4CC000
stack
page read and write
8C0000
unkown
page readonly
994000
unkown
page write copy
600000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
8C2000
unkown
page execute read
780000
trusted library allocation
page read and write
20C0000
trusted library allocation
page read and write
6C05000
trusted library allocation
page read and write
4962000
heap
page read and write
6CF000
heap
page read and write
785000
trusted library allocation
page read and write
7D9000
heap
page read and write
8B4000
trusted library allocation
page read and write
8C0000
unkown
page readonly
5340000
trusted library allocation
page read and write
6D16000
trusted library allocation
page read and write
595E000
stack
page read and write
62EB000
trusted library allocation
page read and write
4A17000
trusted library allocation
page read and write
8C0000
unkown
page readonly
8C0000
unkown
page readonly
994000
unkown
page write copy
870000
trusted library allocation
page read and write
4A34000
trusted library allocation
page read and write
4D0000
trusted library allocation
page read and write
297000
trusted library allocation
page execute and read and write
5150000
trusted library allocation
page read and write
850000
trusted library allocation
page read and write
2D0000
trusted library allocation
page read and write
6747000
trusted library allocation
page read and write
2E0000
trusted library allocation
page execute and read and write
48C0000
trusted library allocation
page read and write
4D0000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
6820000
trusted library allocation
page read and write
935000
unkown
page execute read
7D0000
trusted library allocation
page read and write
68AF000
trusted library allocation
page read and write
7E0000
trusted library allocation
page read and write
5B0000
trusted library allocation
page execute and read and write
20C0000
trusted library allocation
page read and write
67D7000
trusted library allocation
page read and write
88A000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
42C0000
trusted library allocation
page read and write
6C0000
trusted library allocation
page read and write
55C2000
heap
page read and write
3281000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
49D4000
trusted library allocation
page read and write
730000
trusted library allocation
page read and write
8B3000
trusted library allocation
page read and write
46B0000
trusted library allocation
page read and write
49FC000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
29B000
trusted library allocation
page execute and read and write
935000
unkown
page execute read
65C5000
trusted library allocation
page read and write
3491000
trusted library allocation
page read and write
348000
trusted library allocation
page read and write
7E0000
trusted library allocation
page read and write
6851000
trusted library allocation
page read and write
4A72000
trusted library allocation
page read and write
2130000
trusted library allocation
page read and write
6854000
trusted library allocation
page read and write
785000
trusted library allocation
page read and write
5E1C000
stack
page read and write
236E000
trusted library allocation
page read and write
23B4000
trusted library allocation
page read and write
652A000
trusted library allocation
page read and write
994000
unkown
page write copy
935000
unkown
page execute read
10000
heap
page read and write
22D8000
trusted library allocation
page read and write
264000
trusted library allocation
page read and write
4A42000
trusted library allocation
page read and write
65EA000
trusted library allocation
page read and write
996000
unkown
page readonly
34B000
trusted library allocation
page read and write
4BDD000
stack
page read and write
785000
trusted library allocation
page read and write
4A56000
trusted library allocation
page read and write
790000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
68A5000
trusted library allocation
page read and write
20E0000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
785000
trusted library allocation
page read and write
2F0000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
348000
trusted library allocation
page read and write
650000
trusted library section
page read and write
4A19000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
380000
heap
page read and write
400000
remote allocation
page execute and read and write
42C0000
trusted library allocation
page read and write
61D000
heap
page read and write
2130000
trusted library allocation
page read and write
8C2000
unkown
page execute read
590E000
stack
page read and write
994000
unkown
page write copy
E0000
trusted library allocation
page read and write
5F4000
heap
page read and write
6740000
trusted library allocation
page read and write
50CF000
stack
page read and write
935000
unkown
page execute read
345000
trusted library allocation
page read and write
6867000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
6B0000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
8C2000
unkown
page execute read
A0000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
935000
unkown
page execute read
6AD9000
trusted library allocation
page read and write
6420000
trusted library allocation
page read and write
69C7000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
2130000
trusted library allocation
page read and write
3B6000
heap
page read and write
42D0000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
263000
trusted library allocation
page execute and read and write
8C0000
unkown
page readonly
6CD8000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
6595000
trusted library allocation
page read and write
588E000
stack
page read and write
350000
trusted library allocation
page read and write
7D5000
trusted library allocation
page read and write
610000
heap
page read and write
27D000
trusted library allocation
page execute and read and write
780000
trusted library allocation
page read and write
65BC000
trusted library allocation
page read and write
8B0000
trusted library allocation
page read and write
6C14000
trusted library allocation
page read and write
4930000
trusted library allocation
page read and write
2130000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
5BAE000
stack
page read and write
4A86000
trusted library allocation
page read and write
6A0000
trusted library allocation
page read and write
840000
trusted library allocation
page read and write
6940000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
840000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
6A4C000
trusted library allocation
page read and write
217E000
stack
page read and write
2240000
heap
page read and write
5C4E000
stack
page read and write
67D1000
trusted library allocation
page read and write
6892000
trusted library allocation
page read and write
6C83000
trusted library allocation
page read and write
996000
unkown
page readonly
8C0000
unkown
page readonly
42D0000
trusted library allocation
page read and write
4CAE000
stack
page read and write
7094000
trusted library allocation
page read and write
5B0000
heap
page execute and read and write
6CB000
heap
page read and write
46B0000
trusted library allocation
page read and write
34C000
heap
page read and write
340000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
2130000
trusted library allocation
page read and write
6C3E000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
48B0000
trusted library allocation
page read and write
6CF9000
trusted library allocation
page read and write
74AE000
trusted library allocation
page read and write
4E0000
heap
page read and write
6E35000
trusted library allocation
page read and write
6C48000
trusted library allocation
page read and write
55A5000
heap
page read and write
470000
trusted library allocation
page read and write
4A86000
trusted library allocation
page read and write
70BA000
trusted library allocation
page read and write
5D7000
heap
page read and write
6FE6000
trusted library allocation
page read and write
63A1000
trusted library allocation
page read and write
7AB000
trusted library allocation
page read and write
996000
unkown
page readonly
4919000
trusted library allocation
page read and write
610000
heap
page execute and read and write
63BE000
trusted library allocation
page read and write
6CFB000
trusted library allocation
page read and write
5640000
heap
page read and write
340000
trusted library allocation
page read and write
782000
trusted library allocation
page read and write
292000
trusted library allocation
page read and write
67DB000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
2130000
trusted library allocation
page read and write
8C2000
unkown
page execute read
994000
unkown
page write copy
42C0000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
42C0000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
69E000
stack
page read and write
345000
trusted library allocation
page read and write
66D4000
trusted library allocation
page read and write
661A000
trusted library allocation
page read and write
5F0000
trusted library allocation
page read and write
340000
heap
page read and write
68B2000
trusted library allocation
page read and write
665D000
trusted library allocation
page read and write
6DF9000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
6C0000
trusted library allocation
page execute and read and write
6742000
trusted library allocation
page read and write
996000
unkown
page readonly
5140000
heap
page read and write
8B0000
trusted library allocation
page read and write
AA000
stack
page read and write
47CF000
stack
page read and write
6D01000
trusted library allocation
page read and write
49F8000
trusted library allocation
page read and write
46C7000
trusted library allocation
page read and write
579E000
stack
page read and write
300000
heap
page read and write
4A33000
trusted library allocation
page read and write
490E000
stack
page read and write
780000
trusted library allocation
page read and write
880000
trusted library allocation
page read and write
6D03000
trusted library allocation
page read and write
20C0000
trusted library allocation
page read and write
6B6B000
trusted library allocation
page read and write
7D0000
heap
page read and write
4C3E000
stack
page read and write
659A000
trusted library allocation
page read and write
200000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
51A8000
trusted library allocation
page read and write
685E000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
2230000
trusted library allocation
page read and write
2280000
trusted library allocation
page read and write
227000
trusted library allocation
page execute and read and write
67BA000
trusted library allocation
page read and write
70E5000
trusted library allocation
page read and write
53BE000
stack
page read and write
6CCD000
trusted library allocation
page read and write
6CD000
heap
page read and write
5011000
trusted library allocation
page read and write
4FBE000
stack
page read and write
681E000
trusted library allocation
page read and write
782000
trusted library allocation
page read and write
935000
unkown
page execute read
4C50000
heap
page execute and read and write
8C2000
unkown
page execute read
6CC2000
trusted library allocation
page read and write
42C0000
trusted library allocation
page read and write
42C0000
trusted library allocation
page read and write
2F0000
trusted library allocation
page read and write
55E000
stack
page read and write | page guard
70D7000
trusted library allocation
page read and write
67DE000
trusted library allocation
page read and write
42C0000
trusted library allocation
page execute and read and write
560000
heap
page execute and read and write
7EF30000
trusted library allocation
page execute and read and write
21FD000
stack
page read and write
776A000
trusted library allocation
page read and write
248F000
stack
page read and write
225000
trusted library allocation
page execute and read and write
935000
unkown
page execute read
345000
trusted library allocation
page read and write
7E0000
trusted library allocation
page read and write
20C0000
trusted library allocation
page read and write
23C2000
trusted library allocation
page read and write
785000
trusted library allocation
page read and write
636F000
stack
page read and write
6A0000
trusted library allocation
page read and write
6A38000
trusted library allocation
page read and write
6909000
trusted library allocation
page read and write
6825000
trusted library allocation
page read and write
21BD000
stack
page read and write
6680000
trusted library allocation
page read and write
710000
trusted library allocation
page read and write
42D0000
trusted library allocation
page read and write
6D0B000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
4B8F000
stack
page read and write
694E000
trusted library allocation
page read and write
46B0000
trusted library allocation
page read and write
217000
trusted library allocation
page execute and read and write
2220000
trusted library allocation
page read and write
23B0000
trusted library allocation
page read and write
641E000
trusted library allocation
page read and write
42D0000
trusted library allocation
page read and write
7121000
trusted library allocation
page read and write
5470000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
34A000
heap
page read and write
757A000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
10000
heap
page read and write
340000
trusted library allocation
page read and write
5010000
trusted library allocation
page read and write
785000
trusted library allocation
page read and write
42D0000
remote allocation
page read and write
6BF3000
trusted library allocation
page read and write
1E7000
stack
page read and write
7D0000
trusted library allocation
page read and write
46C0000
trusted library allocation
page read and write
43DE000
stack
page read and write
4A72000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
3BA000
heap
page read and write
345000
trusted library allocation
page read and write
69F5000
trusted library allocation
page read and write
1FA000
stack
page read and write
8C2000
unkown
page execute read
38B000
heap
page read and write
46C5000
trusted library allocation
page read and write
6C97000
trusted library allocation
page read and write
996000
unkown
page readonly
996000
unkown
page readonly
6860000
trusted library allocation
page read and write
6865000
trusted library allocation
page read and write
6846000
trusted library allocation
page read and write
5680000
trusted library allocation
page read and write
1B8000
stack
page read and write
2E0000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
66DF000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
4A86000
trusted library allocation
page read and write
994000
unkown
page write copy
65F4000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
4910000
trusted library allocation
page read and write
638E000
trusted library allocation
page read and write
697C000
trusted library allocation
page read and write
350000
trusted library allocation
page read and write
860000
trusted library allocation
page read and write
646E000
trusted library allocation
page read and write
8C2000
unkown
page execute read
22B000
trusted library allocation
page execute and read and write
49DF000
stack
page read and write
6BC000
heap
page read and write
350000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
4D0000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
6C12000
trusted library allocation
page read and write
680A000
trusted library allocation
page read and write
545E000
stack
page read and write
680D000
trusted library allocation
page read and write
2360000
trusted library allocation
page read and write
248E000
stack
page read and write | page guard
633F000
trusted library allocation
page read and write
790000
trusted library allocation
page read and write
2130000
trusted library allocation
page read and write
2210000
trusted library allocation
page read and write
6CBD000
trusted library allocation
page read and write
6D4000
heap
page read and write
781000
trusted library allocation
page read and write
20D000
trusted library allocation
page execute and read and write
340000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
5C50000
heap
page read and write
548D000
trusted library allocation
page read and write
672C000
trusted library allocation
page read and write
718F000
trusted library allocation
page read and write
5A0000
heap
page read and write
4990000
trusted library allocation
page read and write
4A2E000
stack
page read and write
20D0000
trusted library allocation
page read and write
42D0000
remote allocation
page read and write
2370000
trusted library allocation
page read and write
42C0000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
6CB7000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
44EC000
stack
page read and write
994000
unkown
page write copy
698B000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
660E000
stack
page read and write
7B0000
trusted library allocation
page read and write
5F0000
trusted library allocation
page read and write
4A42000
trusted library allocation
page read and write
6BFB000
trusted library allocation
page read and write
6656000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
66E6000
trusted library allocation
page read and write
324000
heap
page read and write
345000
trusted library allocation
page read and write
6C78000
trusted library allocation
page read and write
996000
unkown
page readonly
6C5000
heap
page read and write
67C3000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
33E000
stack
page read and write
7765000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
506B000
trusted library allocation
page read and write
769D000
trusted library allocation
page read and write
24E3000
trusted library allocation
page read and write
994000
unkown
page write copy
4920000
trusted library allocation
page read and write
4A17000
trusted library allocation
page read and write
994000
unkown
page write copy
8C2000
unkown
page execute read
994000
unkown
page write copy
7D3000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
6650000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
994000
unkown
page write copy
65BA000
trusted library allocation
page read and write
65F0000
trusted library allocation
page read and write
240000
heap
page read and write
785000
trusted library allocation
page read and write
42D1000
trusted library allocation
page read and write
20CF000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
3AB000
heap
page read and write
7D0000
trusted library allocation
page read and write
996000
unkown
page readonly
8C0000
unkown
page readonly
590000
trusted library allocation
page read and write
8C0000
unkown
page readonly
6C0000
trusted library allocation
page read and write
6739000
trusted library allocation
page read and write
850000
trusted library allocation
page read and write
7A0000
trusted library allocation
page read and write
49F8000
trusted library allocation
page read and write
8C0000
unkown
page readonly
340000
trusted library allocation
page read and write
653E000
trusted library allocation
page read and write
6CC5000
trusted library allocation
page read and write
83D000
stack
page read and write
B3000
trusted library allocation
page execute and read and write
340000
trusted library allocation
page read and write
935000
unkown
page execute read
4A72000
trusted library allocation
page read and write
46BE000
stack
page read and write
6A08000
trusted library allocation
page read and write
2322000
trusted library allocation
page read and write
49FC000
trusted library allocation
page read and write
6897000
trusted library allocation
page read and write
935000
unkown
page execute read
6432000
trusted library allocation
page read and write
48B0000
trusted library allocation
page read and write
935000
unkown
page execute read
686C000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
55F000
stack
page read and write
42C0000
trusted library allocation
page read and write
720000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
56AF000
stack
page read and write
345000
trusted library allocation
page read and write
270000
trusted library allocation
page read and write
670F000
trusted library allocation
page read and write
782000
trusted library allocation
page read and write
65F7000
trusted library allocation
page read and write
69C0000
heap
page read and write
222000
trusted library allocation
page read and write
8B0000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
7B0000
trusted library allocation
page read and write
62D1000
trusted library allocation
page read and write
790000
trusted library allocation
page read and write
46C0000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
295000
trusted library allocation
page execute and read and write
2140000
trusted library allocation
page read and write
2240000
heap
page read and write
42CB000
trusted library allocation
page read and write
935000
unkown
page execute read
2130000
trusted library allocation
page read and write
7F0000
heap
page read and write
8C2000
unkown
page execute read
8C0000
unkown
page readonly
340000
trusted library allocation
page read and write
2371000
trusted library allocation
page read and write
785000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
2135000
trusted library allocation
page read and write
67BE000
trusted library allocation
page read and write
46C4000
trusted library allocation
page read and write
76DB000
trusted library allocation
page read and write
7CC000
heap
page read and write
780000
trusted library allocation
page read and write
46C0000
trusted library allocation
page read and write
230A000
trusted library allocation
page read and write
6C56000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
7770000
trusted library allocation
page read and write
BD000
trusted library allocation
page execute and read and write
65D1000
trusted library allocation
page read and write
780000
trusted library allocation
page read and write
6E9A000
trusted library allocation
page read and write
7CE000
stack
page read and write
64DB000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
6684000
trusted library allocation
page read and write
345000
trusted library allocation
page read and write
690E000
stack
page read and write
20C0000
trusted library allocation
page read and write
64B2000
trusted library allocation
page read and write
69B8000
trusted library allocation
page read and write
994000
unkown
page write copy
6579000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
688F000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
785000
trusted library allocation
page read and write
51C0000
trusted library section
page read and write
785000
trusted library allocation
page read and write
70D0000
trusted library allocation
page read and write
67AE000
stack
page read and write
26D000
trusted library allocation
page execute and read and write
21A000
trusted library allocation
page execute and read and write
48B0000
trusted library allocation
page read and write
6DAC000
trusted library allocation
page read and write
6801000
trusted library allocation
page read and write
2130000
trusted library allocation
page read and write
340000
trusted library allocation
page read and write
64D0000
trusted library allocation
page read and write
2160000
heap
page execute and read and write
770000
trusted library allocation
page read and write
6327000
trusted library allocation
page read and write
4F90000
trusted library allocation
page read and write
7786000
trusted library allocation
page read and write
684C000
trusted library allocation
page read and write
67C6000
trusted library allocation
page read and write
52DE000
stack
page read and write
780000
trusted library allocation
page read and write
4944000
heap
page read and write
6A7E000
trusted library allocation
page read and write
6B8000
heap
page read and write
7110000
trusted library allocation
page read and write
789000
trusted library allocation
page read and write
212E000
stack
page read and write
785000
trusted library allocation
page read and write
672E000
trusted library allocation
page read and write
8C2000
unkown
page execute read
49FD000
trusted library allocation
page read and write
2130000
trusted library allocation
page read and write
6C80000
trusted library allocation
page read and write
6C8B000
trusted library allocation
page read and write
68D0000
trusted library allocation
page read and write
28A000
trusted library allocation
page execute and read and write
4A56000
trusted library allocation
page read and write
There are 687 hidden memdumps, click here to show them.