IOC Report
melimar.com.xls

loading gif

Files

File Path
Type
Category
Malicious
melimar.com.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 16:15:56 2022, Security: 0
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
downloaded
 malicious
C:\Users\user\Desktop\melimar.com.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 16:15:56 2022, Security: 0
dropped
 malicious
C:\Users\user\uxevr1.ocx
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\uxevr2.ocx
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\uxevr3.ocx
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Windows\System32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Windows\System32\WFwVcxpK\qMgBgEIcUslg.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Windows\System32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 61480 bytes, 1 file
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lJWa95VlQ[1]
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\CabF04.tmp
Microsoft Cabinet archive data, 61480 bytes, 1 file
dropped
C:\Users\user\AppData\Local\Temp\TarF05.tmp
data
modified
C:\Users\user\AppData\Local\Temp\~DF4A00E8F1D401126E.TMP
data
dropped
There are 7 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HtkzwckLMRsIno\zbbayGuUXRtRt.dll"
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XcSShRaCEZoMkA\LaeOniCeFWEmCa.dll"
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WFwVcxpK\qMgBgEIcUslg.dll"
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
 malicious
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup

URLs

Name
IP
Malicious
https://173.82.82.196:8080/
unknown
 malicious
http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/
160.153.40.1
 malicious
https://173.82.82.196/;
unknown
 malicious
https://173.82.82.196/
unknown
 malicious
https://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/
188.114.97.10
 malicious
http://www.kabeonet.pl/wp-admin/VWlAz5vWJNHDb/
193.143.77.34
 malicious
http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/
188.114.97.10
 malicious
http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/
193.143.77.34
 malicious
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
http://crl.entrust.net/server1.crl0
unknown
http://ocsp.entrust.net03
unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
http://www.diginotar.nl/cps/pkioverheid0
unknown
http://ocsp.entrust.net0D
unknown
https://secure.comodo.com/CPS0
unknown
http://crl.entrust.net/2048ca.crl0
unknown
https://airliftlimo.com/wp-admin/iMc/
159.203.19.2
There are 7 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
salledemode.com
160.153.40.1
 malicious
kabeonet.pl
193.143.77.34
vipteck.com
188.114.97.10
airliftlimo.com
159.203.19.2
windowsupdatebg.s.llnwi.net
178.79.242.0
www.kabeonet.pl
unknown

IPs

IP
Domain
Country
Malicious
173.82.82.196
unknown
United States
malicious
160.153.40.1
salledemode.com
United States
malicious
159.203.19.2
airliftlimo.com
United States
188.114.97.10
vipteck.com
European Union
193.143.77.34
kabeonet.pl
Poland

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
1$)
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\66C3A
66C3A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
$<)
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
There are 13 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3C0000
direct allocation
page execute and read and write
 malicious
2010000
direct allocation
page execute and read and write
 malicious
180001000
direct allocation
page execute read
 malicious
1F0000
direct allocation
page execute and read and write
 malicious
180001000
direct allocation
page execute read
 malicious
180001000
direct allocation
page execute read
 malicious
1C0000
direct allocation
page execute and read and write
 malicious
180001000
direct allocation
page execute read
 malicious
2C0000
direct allocation
page execute and read and write
 malicious
180001000
direct allocation
page execute read
 malicious
180001000
direct allocation
page execute read
 malicious
1F00000
direct allocation
page execute and read and write
 malicious
39D000
heap
page read and write
2EAE000
stack
page read and write
11B000
heap
page read and write
154000
heap
page read and write
407000
heap
page read and write
3F0000
heap
page read and write
2F04000
heap
page read and write
2F0000
heap
page read and write
1D7000
heap
page read and write
10000
heap
page read and write
383000
heap
page read and write
310000
heap
page read and write
7FEF9D4F000
unkown
page readonly
24E000
heap
page read and write
30E000
heap
page read and write
2EF0000
heap
page read and write
263000
heap
page read and write
87000
heap
page read and write
27AD000
stack
page read and write
2B2000
heap
page read and write
1D6000
heap
page read and write
2A0000
heap
page read and write
25A0000
heap
page read and write
21F0000
heap
page read and write
3000000
heap
page read and write
20FE000
stack
page read and write
7FEF9D4B000
unkown
page read and write
1F7B000
heap
page read and write
2EE2000
heap
page read and write
393000
heap
page read and write
114000
heap
page read and write
65D000
heap
page read and write
217000
heap
page read and write
7FEF755F000
unkown
page readonly
383000
heap
page read and write
2F04000
heap
page read and write
2B4000
heap
page read and write
2E73000
heap
page read and write
365C000
heap
page read and write
400000
heap
page read and write
384000
heap
page read and write
2C3F000
stack
page read and write
2F00000
heap
page read and write
7FEF74D1000
unkown
page execute read
4D4000
heap
page read and write
34A000
heap
page read and write
2EB000
heap
page read and write
1A0000
heap
page read and write
100000
heap
page read and write
2F05000
heap
page read and write
14F000
heap
page read and write
2EE8000
heap
page read and write
2110000
heap
page read and write
18002D000
direct allocation
page read and write
2B30000
heap
page read and write
7FEF7530000
unkown
page readonly
4B6000
heap
page read and write
2EC000
heap
page read and write
222B000
stack
page read and write
2242000
heap
page read and write
36CA000
heap
page read and write
150000
heap
page read and write
35E1000
heap
page read and write
2E6F000
heap
page read and write
2C8C000
stack
page read and write
2F00000
heap
page read and write
18002C000
direct allocation
page readonly
2F80000
heap
page read and write
BE000
heap
page read and write
2720000
heap
page read and write
18002C000
direct allocation
page readonly
7EFE0000
unkown
page readonly
2F00000
heap
page read and write
2EF0000
heap
page read and write
10000
heap
page read and write
17D000
stack
page read and write
4D0000
heap
page read and write
500000
heap
page read and write
2620000
heap
page read and write
203B000
heap
page read and write
52F000
stack
page read and write
2F00000
heap
page read and write
220000
heap
page read and write
380000
heap
page read and write
578000
heap
page read and write
10000
heap
page read and write
18002D000
direct allocation
page read and write
2DB2000
heap
page read and write
5D0000
remote allocation
page read and write
2E8000
heap
page read and write
2FF000
heap
page read and write
2D6000
heap
page read and write
2F0B000
heap
page read and write
18002E000
direct allocation
page readonly
2260000
heap
page read and write
658000
heap
page read and write
2D0000
heap
page read and write
18002E000
direct allocation
page readonly
136000
heap
page read and write
7FEF755B000
unkown
page read and write
10000
heap
page read and write
2000000
heap
page read and write
1B6000
heap
page read and write
2EE2000
heap
page read and write
2D3000
heap
page read and write
3D0000
heap
page read and write
2F5B000
heap
page read and write
2E10000
heap
page read and write
2302000
heap
page read and write
7FEF755F000
unkown
page readonly
7FEF7552000
unkown
page readonly
2180000
remote allocation
page read and write
2EE2000
heap
page read and write
2F19000
heap
page read and write
554000
heap
page read and write
500000
trusted library allocation
page read and write
2EE9000
heap
page read and write
2E20000
heap
page read and write
10000
heap
page read and write
130000
direct allocation
page execute and read and write
2C0000
direct allocation
page execute and read and write
DA000
heap
page read and write
27CD000
stack
page read and write
7FEF7531000
unkown
page execute read
400000
heap
page read and write
180000000
direct allocation
page read and write
1F40000
heap
page read and write
2F00000
heap
page read and write
22D0000
heap
page read and write
2BA000
heap
page read and write
648000
heap
page read and write
476000
heap
page read and write
2DB0000
heap
page read and write
3C8000
heap
page read and write
2D0000
heap
page read and write
2B5000
heap
page read and write
2140000
heap
page read and write
35E0000
heap
page read and write
2F7000
heap
page read and write
25E000
heap
page read and write
2310000
heap
page read and write
274C000
stack
page read and write
5F0000
heap
page read and write
222B000
heap
page read and write
2315000
heap
page read and write
36A4000
heap
page read and write
7FEF9D21000
unkown
page execute read
2B0000
heap
page read and write
213B000
heap
page read and write
234B000
heap
page read and write
2AB000
heap
page read and write
2005000
heap
page read and write
2E80000
heap
page read and write
2ACB000
stack
page read and write
18002D000
direct allocation
page read and write
2EA1000
heap
page read and write
35C000
heap
page read and write
37E000
heap
page read and write
2EE8000
heap
page read and write
2E0A000
heap
page read and write
520000
heap
page read and write
526000
heap
page read and write
323000
heap
page read and write
216E000
stack
page read and write
29B0000
heap
page read and write
2EDE000
stack
page read and write
7FEF74F2000
unkown
page readonly
2DD0000
heap
page read and write
3C8000
heap
page read and write
614000
heap
page read and write
2A7B000
stack
page read and write
36A5000
heap
page read and write
2240000
heap
page read and write
3F4000
heap
page read and write
7FEF74FF000
unkown
page readonly
180000000
direct allocation
page read and write
2A3B000
stack
page read and write
306000
heap
page read and write
221F000
stack
page read and write
2F04000
heap
page read and write
2A0000
heap
page read and write
7FEF9D4F000
unkown
page readonly
26DE000
stack
page read and write
7FEF9D20000
unkown
page readonly
5D0000
remote allocation
page read and write
510000
heap
page read and write
7FEF74F2000
unkown
page readonly
1A8000
stack
page read and write
2290000
heap
page read and write
7FEF74FB000
unkown
page read and write
2800000
heap
page read and write
43E000
heap
page read and write
453000
heap
page read and write
18002C000
direct allocation
page readonly
1D0000
heap
page read and write
22D2000
heap
page read and write
29AE000
stack
page read and write
2B2000
heap
page read and write
30F0000
heap
page read and write
7FEF74FF000
unkown
page readonly
26A000
heap
page read and write
180000000
direct allocation
page read and write
2EF6000
heap
page read and write
36CA000
heap
page read and write
2D7000
heap
page read and write
2B0000
heap
page read and write
221F000
stack
page read and write
289F000
heap
page read and write
365C000
heap
page read and write
7FEF755B000
unkown
page read and write
340000
heap
page read and write
2EF0000
heap
page read and write
2710000
heap
page read and write
636000
heap
page read and write
343000
heap
page read and write
31C000
heap
page read and write
7FEF9D42000
unkown
page readonly
2E2F000
heap
page read and write
2140000
heap
page read and write
27A000
heap
page read and write
2EBA000
heap
page read and write
7FEF9D4B000
unkown
page read and write
558000
heap
page read and write
228000
stack
page read and write
2EBC000
heap
page read and write
136000
heap
page read and write
10000
heap
page read and write
18002E000
direct allocation
page readonly
227000
heap
page read and write
7FEF74FB000
unkown
page read and write
23CF000
stack
page read and write
233F000
stack
page read and write
36A5000
heap
page read and write
1F45000
heap
page read and write
2EE8000
heap
page read and write
378000
heap
page read and write
2EF6000
heap
page read and write
2C0000
direct allocation
page execute and read and write
3F5000
heap
page read and write
241F000
stack
page read and write
273000
heap
page read and write
45A000
heap
page read and write
347000
heap
page read and write
638000
heap
page read and write
500000
trusted library allocation
page read and write
2BCC000
stack
page read and write
7FEF74D0000
unkown
page readonly
2E99000
heap
page read and write
425000
heap
page read and write
568000
heap
page read and write
287B000
stack
page read and write
380000
heap
page read and write
2F00000
heap
page read and write
2C6F000
stack
page read and write
13F000
heap
page read and write
2F04000
heap
page read and write
2EF0000
heap
page read and write
6FE000
stack
page read and write
2C4000
heap
page read and write
2B00000
heap
page read and write
556000
heap
page read and write
470000
heap
page read and write
2F04000
heap
page read and write
2E75000
heap
page read and write
32A000
heap
page read and write
2E6000
heap
page read and write
18002E000
direct allocation
page readonly
22CF000
stack
page read and write
224C000
stack
page read and write
2EE2000
heap
page read and write
1E8000
stack
page read and write
2F04000
heap
page read and write
393000
heap
page read and write
362000
heap
page read and write
2EBA000
heap
page read and write
3C4000
heap
page read and write
80000
heap
page read and write
2C9000
heap
page read and write
2EF6000
heap
page read and write
2E0E000
stack
page read and write
2E1E000
stack
page read and write
D3000
heap
page read and write
2100000
remote allocation
page read and write
406000
heap
page read and write
18002C000
direct allocation
page readonly
7FEF7531000
unkown
page execute read
2EFA000
heap
page read and write
29C000
stack
page read and write
2B0000
heap
page read and write
393000
heap
page read and write
2100000
remote allocation
page read and write
1B0000
direct allocation
page execute and read and write
440000
heap
page read and write
2E85000
heap
page read and write
198000
stack
page read and write
2D2F000
stack
page read and write
3F0000
heap
page read and write
180000000
direct allocation
page read and write
288000
stack
page read and write
138000
heap
page read and write
2300000
heap
page read and write
2EDB000
heap
page read and write
2B0000
direct allocation
page execute and read and write
392000
heap
page read and write
5CE000
stack
page read and write
308000
heap
page read and write
4E0000
heap
page read and write
10000
heap
page read and write
228F000
stack
page read and write
2120000
heap
page read and write
2E4000
heap
page read and write
3CC000
heap
page read and write
600000
heap
page read and write
180000
heap
page read and write
550000
heap
page read and write
2869000
heap
page read and write
2F00000
heap
page read and write
217B000
heap
page read and write
370000
heap
page read and write
304000
heap
page read and write
3AB000
heap
page read and write
370000
heap
page read and write
2BE000
heap
page read and write
18002E000
direct allocation
page readonly
216000
heap
page read and write
7FEF7530000
unkown
page readonly
18002C000
direct allocation
page readonly
2100000
heap
page read and write
27EF000
stack
page read and write
2105000
heap
page read and write
42D000
heap
page read and write
218000
heap
page read and write
2ED7000
heap
page read and write
2C7000
heap
page read and write
418000
heap
page read and write
180000000
direct allocation
page read and write
5F4000
heap
page read and write
2ED5000
heap
page read and write
7FEF9D21000
unkown
page execute read
18002D000
direct allocation
page read and write
18002D000
direct allocation
page read and write
536000
heap
page read and write
7FEF9D42000
unkown
page readonly
7FEF74D1000
unkown
page execute read
365E000
heap
page read and write
436000
heap
page read and write
400000
heap
page read and write
428000
heap
page read and write
362000
heap
page read and write
36CA000
heap
page read and write
365E000
heap
page read and write
39A000
heap
page read and write
176000
heap
page read and write
18002C000
direct allocation
page readonly
408000
heap
page read and write
3C0000
heap
page read and write
320000
heap
page read and write
2C3F000
stack
page read and write
744000
heap
page read and write
20D000
heap
page read and write
474000
heap
page read and write
21F5000
heap
page read and write
480000
heap
page read and write
7FEF74D0000
unkown
page readonly
378000
heap
page read and write
2E3E000
stack
page read and write
158000
stack
page read and write
7FEF7552000
unkown
page readonly
309000
heap
page read and write
2B5C000
stack
page read and write
32E000
heap
page read and write
397000
heap
page read and write
740000
heap
page read and write
2F0000
heap
page read and write
210000
heap
page read and write
2180000
remote allocation
page read and write
610000
heap
page read and write
396000
heap
page read and write
2B0000
heap
page read and write
3AB000
heap
page read and write
2EDB000
heap
page read and write
380000
heap
page read and write
180000000
direct allocation
page read and write
35EF000
heap
page read and write
3EC000
heap
page read and write
26AD000
stack
page read and write
2F16000
heap
page read and write
57D000
heap
page read and write
302000
heap
page read and write
10000
heap
page read and write
2F04000
heap
page read and write
38D000
heap
page read and write
18002E000
direct allocation
page readonly
4E4000
heap
page read and write
3B0000
direct allocation
page execute and read and write
2C5E000
stack
page read and write
7FEF9D20000
unkown
page readonly
2860000
heap
page read and write
2145000
heap
page read and write
356000
heap
page read and write
4F0000
heap
page read and write
36E000
heap
page read and write
100000
heap
page read and write
3616000
heap
page read and write
36E000
heap
page read and write
2CFE000
stack
page read and write
3637000
heap
page read and write
18002D000
direct allocation
page read and write
292F000
stack
page read and write
38D000
heap
page read and write
2EE8000
heap
page read and write
515000
heap
page read and write
397000
heap
page read and write
2B5000
heap
page read and write
B7F000
stack
page read and write
20B0000
trusted library allocation
page read and write
There are 418 hidden memdumps, click here to show them.