IOC Report
kOiaWLNKXpjayWeM.dll

loading gif

Files

File Path
Type
Category
Malicious
kOiaWLNKXpjayWeM.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
initial sample
malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_kOi_a748228d1b9ab9a1bb94dae9e0fac923745_f2877757_0d5857e4\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_kOi_a748228d1b9ab9a1bb94dae9e0fac923745_f2877757_14085813\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F6F.tmp.dmp
Mini DuMP crash report, 15 streams, Mon Nov 21 11:32:49 2022, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2173.tmp.dmp
Mini DuMP crash report, 15 streams, Mon Nov 21 11:32:50 2022, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER222F.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER232A.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2452.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER24EF.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Windows\System32\regsvr32.exe
regsvr32.exe /s C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll
malicious
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1
malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?AddArrayString@JKDefragLib@@QEAAPEAPEA_WPEAPEA_WPEA_W@Z
malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll"
malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?CallShowStatus@JKDefragLib@@QEAAXPEAUDefragDataStruct@@HH@Z
malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?ColorizeItem@JKDefragLib@@QEAAXPEAUDefragDataStruct@@PEAUItemStruct@@_K2H@Z
malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll
malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\WrWLj\BwssvzQrG.dll"
malicious
C:\Windows\System32\loaddll64.exe
loaddll64.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 6128 -s 480
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2424 -s 472
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://218.38.121.17/
218.38.121.17
malicious
https://218.38.121.17/$
unknown

IPs

IP
Domain
Country
Malicious
188.165.79.151
unknown
France
malicious
196.44.98.190
unknown
Ghana
malicious
174.138.33.49
unknown
United States
malicious
160.16.143.191
unknown
Japan
malicious
36.67.23.59
unknown
Indonesia
malicious
103.41.204.169
unknown
Indonesia
malicious
103.56.149.105
unknown
Indonesia
malicious
85.214.67.203
unknown
Germany
malicious
83.229.80.93
unknown
United Kingdom
malicious
85.25.120.45
unknown
Germany
malicious
198.199.70.22
unknown
United States
malicious
93.104.209.107
unknown
Germany
malicious
186.250.48.5
unknown
Brazil
malicious
175.126.176.79
unknown
Korea Republic of
malicious
139.196.72.155
unknown
China
malicious
128.199.242.164
unknown
United Kingdom
malicious
103.126.216.86
unknown
Bangladesh
malicious
178.238.225.252
unknown
Germany
malicious
128.199.217.206
unknown
United Kingdom
malicious
190.145.8.4
unknown
Colombia
malicious
46.101.98.60
unknown
Netherlands
malicious
82.98.180.154
unknown
Spain
malicious
114.79.130.68
unknown
India
malicious
103.71.99.57
unknown
India
malicious
103.224.241.74
unknown
India
malicious
210.57.209.142
unknown
Indonesia
malicious
202.28.34.99
unknown
Thailand
malicious
87.106.97.83
unknown
Germany
malicious
103.254.12.236
unknown
Viet Nam
malicious
103.85.95.4
unknown
Indonesia
malicious
80.211.107.116
unknown
Italy
malicious
54.37.228.122
unknown
France
malicious
202.134.4.210
unknown
Indonesia
malicious
218.38.121.17
unknown
Korea Republic of
malicious
185.148.169.10
unknown
Germany
malicious
165.22.254.236
unknown
United States
malicious
195.77.239.39
unknown
Spain
malicious
78.47.204.80
unknown
Germany
malicious
118.98.72.86
unknown
Indonesia
malicious
139.59.80.108
unknown
Singapore
malicious
178.62.112.199
unknown
European Union
malicious
104.244.79.94
unknown
United States
malicious
37.44.244.177
unknown
Germany
malicious
62.171.178.147
unknown
United Kingdom
malicious
51.75.33.122
unknown
France
malicious
64.227.55.231
unknown
United States
malicious
192.168.2.1
unknown
unknown
There are 37 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KuLiEStglluewHbC.dll
malicious
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
ProgramId
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
FileId
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
LowerCaseLongPath
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
LongPathHash
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Name
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Publisher
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Version
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
BinFileVersion
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
BinaryType
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
ProductName
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
ProductVersion
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
LinkDate
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
BinProductVersion
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Size
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Language
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
IsPeFile
\REGISTRY\A\{242152ea-91f6-9c12-fea7-ca7749e75c6a}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
IsOsComponent
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
00184009D4068F89
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug
ExceptionRecord
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
00184009D4068F89
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
There are 15 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
22AB0991000
direct allocation
page execute read
malicious
2401000
direct allocation
page execute read
malicious
21CE85C1000
direct allocation
page execute read
malicious
B00000
direct allocation
page execute and read and write
malicious
2A00000
direct allocation
page execute and read and write
malicious
29C1000
direct allocation
page execute read
malicious
2A31000
direct allocation
page execute read
malicious
22AB0780000
direct allocation
page execute and read and write
malicious
22AB0991000
direct allocation
page execute read
malicious
22AB0780000
direct allocation
page execute and read and write
malicious
22AB0991000
direct allocation
page execute read
malicious
F14000
heap
page read and write
malicious
21CE8590000
direct allocation
page execute and read and write
malicious
21CE8590000
direct allocation
page execute and read and write
malicious
21CE85C1000
direct allocation
page execute read
malicious
2990000
direct allocation
page execute and read and write
malicious
21CE8590000
direct allocation
page execute and read and write
malicious
21CE85C1000
direct allocation
page execute read
malicious
22AB0780000
direct allocation
page execute and read and write
malicious
11C5000
heap
page read and write
8AC35FD000
stack
page read and write
1D74CC73000
heap
page read and write
F1698FB000
stack
page read and write
1CAB5DB0000
heap
page read and write
22AB0730000
heap
page read and write
BCEF07F000
stack
page read and write
F52000
heap
page read and write
27B43400000
heap
page read and write
22AB084C000
heap
page read and write
22AB0869000
heap
page read and write
1D74CC71000
heap
page read and write
67C000
heap
page read and write
1B8AC4F0000
heap
page read and write
22AB07B0000
heap
page read and write
2D82B5DC000
heap
page read and write
27B4343C000
heap
page read and write
21A67A00000
heap
page read and write
1B907F00000
heap
page read and write
F52000
heap
page read and write
B00000
heap
page read and write
B07AB3B000
stack
page read and write
1B8AC580000
trusted library allocation
page read and write
21CE86E0000
remote allocation
page read and write
1800D8000
unkown
page read and write
21CE6D52000
heap
page read and write
21A67A44000
heap
page read and write
22AB080F000
heap
page read and write
2D82C0D0000
trusted library allocation
page read and write
27B43471000
heap
page read and write
21A67AC3000
heap
page read and write
21CE6CFE000
heap
page read and write
F52000
heap
page read and write
21CE6D52000
heap
page read and write
22AB07B8000
heap
page read and write
21CE6D52000
heap
page read and write
68DA30E000
stack
page read and write
BCEEE7E000
stack
page read and write
2D82B5F1000
heap
page read and write
22AB0AC5000
heap
page read and write
1D74CC49000
heap
page read and write
FC9000
heap
page read and write
180001000
unkown
page execute read
1AC8F66A000
heap
page read and write
F70000
heap
page read and write
29D6AE48000
heap
page read and write
21CE85C0000
direct allocation
page read and write
3D9000
stack
page read and write
29D6AE44000
heap
page read and write
1B8AC637000
heap
page read and write
22AB07D5000
heap
page read and write
22AB07D5000
heap
page read and write
27B43D43000
heap
page read and write
8AC34FB000
stack
page read and write
D80DCFE000
stack
page read and write
1AC8F64E000
heap
page read and write
180000000
unkown
page readonly
1CAB6075000
heap
page read and write
306E000
stack
page read and write
1240000
heap
page readonly
1AC8F62E000
heap
page read and write
F52000
heap
page read and write
F8C000
heap
page read and write
27B4345B000
heap
page read and write
25FFF44D000
heap
page read and write
22AB07BE000
heap
page read and write
1AC8F657000
heap
page read and write
242E000
direct allocation
page read and write
1D74CD00000
heap
page read and write
180001000
unkown
page execute read
BBB000
stack
page read and write
25FFF455000
heap
page read and write
21CE6C30000
heap
page read and write
242D000
direct allocation
page readonly
29D6AE00000
heap
page read and write
22AB0730000
heap
page read and write
21CE6D8F000
heap
page read and write
B07B0FF000
stack
page read and write
A59000
heap
page read and write
22AB0990000
direct allocation
page read and write
1CAB5DC0000
heap
page read and write
1800D8000
unkown
page read and write
21CE6C30000
heap
page read and write
2AF0000
trusted library allocation
page read and write
68DA38F000
stack
page read and write
8AC2E7C000
stack
page read and write
F8C000
heap
page read and write
1AC8F674000
heap
page read and write
1D74CC4A000
heap
page read and write
2D82B855000
heap
page read and write
1B907F13000
heap
page read and write
180000000
unkown
page readonly
22AB080F000
heap
page read and write
21CE6D8F000
heap
page read and write
379B5CC000
stack
page read and write
392E000
stack
page read and write
9E2000
heap
page read and write
1EEF6A7A000
heap
page read and write
B55000
heap
page read and write
25FFF426000
heap
page read and write
F92000
heap
page read and write
F92000
heap
page read and write
29D6AD90000
heap
page read and write
F92000
heap
page read and write
1AC8F668000
heap
page read and write
630000
heap
page read and write
1AC8F63A000
heap
page read and write
2F6C000
stack
page read and write
2111B7B000
stack
page read and write
21A68202000
heap
page read and write
21CE6CFE000
heap
page read and write
F9A000
heap
page read and write
6559B7E000
stack
page read and write
22AB080F000
heap
page read and write
180001000
unkown
page execute read
317E000
heap
page read and write
25FFF429000
heap
page read and write
1B8AC641000
heap
page read and write
379B5CC000
stack
page read and write
F70000
heap
page read and write
21CE6D52000
heap
page read and write
6A5000
heap
page read and write
25FFF3D0000
heap
page read and write
2B60000
trusted library allocation
page read and write
F8C000
heap
page read and write
FEE000
heap
page read and write
2587000
stack
page read and write
B838B7E000
stack
page read and write
1D74E800000
trusted library allocation
page read and write
27B43492000
heap
page read and write
25F83460000
heap
page read and write
6559EFE000
stack
page read and write
27B43457000
heap
page read and write
B8389FA000
stack
page read and write
1B907C90000
heap
page read and write
22AB0980000
direct allocation
page execute and read and write
FA0000
heap
page read and write
21CE6D18000
heap
page read and write
21CE6D2F000
heap
page read and write
1B907E51000
heap
page read and write
180000000
unkown
page readonly
22AB080F000
heap
page read and write
21A67A71000
heap
page read and write
9E2000
heap
page read and write
180001000
unkown
page execute read
1CAB6064000
heap
page read and write
F92000
heap
page read and write
6559A7C000
stack
page read and write
F8C000
heap
page read and write
25F82B73000
heap
page read and write
FE6000
heap
page read and write
1EEF6A8D000
heap
page read and write
180001000
unkown
page execute read
1AC8F67B000
heap
page read and write
B8387F9000
stack
page read and write
27E0000
direct allocation
page execute and read and write
25FFF360000
heap
page read and write
27B43513000
heap
page read and write
28B0000
remote allocation
page read and write
1D74E5F0000
remote allocation
page read and write
22AB0AC5000
heap
page read and write
1EEF6A60000
heap
page read and write
22AB0AC0000
heap
page read and write
27F0000
heap
page readonly
F78000
heap
page read and write
F8C000
heap
page read and write
1AC8F651000
heap
page read and write
1AC8F600000
heap
page read and write
B8384FA000
stack
page read and write
A35000
heap
page read and write
2E40000
trusted library allocation
page read and write
1800DB000
unkown
page readonly
22AB09C0000
heap
page readonly
22AB0710000
heap
page read and write
21CE6CB0000
heap
page readonly
21CE6D52000
heap
page read and write
1CAB5FF0000
trusted library allocation
page read and write
FB3000
heap
page read and write
27B43D22000
heap
page read and write
1AC8F663000
heap
page read and write
2D82B3B0000
heap
page read and write
11AE000
stack
page read and write
1CAB6002000
heap
page read and write
22AB09BF000
direct allocation
page readonly
27B43E00000
heap
page read and write
3083000
heap
page read and write
25FFF429000
heap
page read and write
21CE6CA0000
direct allocation
page execute and read and write
29EF000
direct allocation
page readonly
2480000
heap
page read and write
EF8000
heap
page read and write
B07B1FF000
stack
page read and write
22AB0710000
heap
page read and write
21CE6C50000
heap
page read and write
21CE85ED000
direct allocation
page readonly
22AB09BD000
direct allocation
page readonly
1800DB000
unkown
page readonly
68DA28C000
stack
page read and write
22AB09C0000
heap
page readonly
21CE6D29000
heap
page read and write
2000000
heap
page read and write
21CE6AF0000
heap
page read and write
379B87D000
stack
page read and write
29D6AE13000
heap
page read and write
3D60000
heap
page read and write
379B8FE000
stack
page read and write
21CE6AF0000
unkown
page read and write
FB2000
heap
page read and write
BE0000
remote allocation
page read and write
68DA28C000
stack
page read and write
21CE6D52000
heap
page read and write
379B87D000
stack
page read and write
1B8AC65F000
heap
page read and write
2A5E000
direct allocation
page read and write
27B43489000
heap
page read and write
B40000
heap
page readonly
6B6000
heap
page read and write
5D0000
heap
page read and write
F52000
heap
page read and write
2D82B5C1000
heap
page read and write
1D74CC4A000
heap
page read and write
22AB080F000
heap
page read and write
B83867F000
stack
page read and write
6D1000
heap
page read and write
FA8000
heap
page read and write
2003000
heap
page read and write
21CE6D8F000
heap
page read and write
2D82B5DC000
heap
page read and write
1D74CAC0000
heap
page read and write
1EEF6A7E000
heap
page read and write
1B8AC613000
heap
page read and write
22AB07B0000
heap
page read and write
329BCFC000
stack
page read and write
22AB07B8000
heap
page read and write
22AB23D0000
heap
page read and write
670000
heap
page read and write
21CE6D18000
heap
page read and write
F9A000
heap
page read and write
22AB0AC5000
heap
page read and write
F69000
heap
page read and write
F61000
heap
page read and write
A95000
heap
page read and write
21123FF000
stack
page read and write
18007D000
unkown
page readonly
22AB0990000
direct allocation
page read and write
22AB07D5000
heap
page read and write
2800000
heap
page read and write
21CE6CB0000
heap
page readonly
F92000
heap
page read and write
22AB23D0000
heap
page read and write
BE0000
remote allocation
page read and write
1800D8000
unkown
page read and write
1EEF6CEB000
heap
page read and write
29EE000
direct allocation
page read and write
21CE6CFE000
heap
page read and write
1AC8F675000
heap
page read and write
F4F000
heap
page read and write
27B43429000
heap
page read and write
1CAB6000000
heap
page read and write
688000
heap
page read and write
F22000
heap
page read and write
180001000
unkown
page execute read
68DA30E000
stack
page read and write
18007D000
unkown
page readonly
1EEF6A30000
heap
page read and write
FC9000
heap
page read and write
29D6AE52000
heap
page read and write
F6C000
heap
page read and write
1AC8F629000
heap
page read and write
27B43DBD000
heap
page read and write
F22000
heap
page read and write
180000000
unkown
page readonly
22AB0980000
direct allocation
page execute and read and write
1AC8F65E000
heap
page read and write
379B87D000
stack
page read and write
27B43485000
heap
page read and write
25FFF43C000
heap
page read and write
29ED000
direct allocation
page readonly
1AC8F613000
heap
page read and write
22AB09C0000
heap
page readonly
21CE6D8F000
heap
page read and write
27B43B30000
trusted library allocation
page read and write
22AB0730000
heap
page read and write
2BEE000
stack
page read and write
1EF33240000
heap
page read and write
2AEB000
stack
page read and write
21CE8700000
heap
page read and write
1EEF9DD3000
heap
page read and write
21CE6D52000
heap
page read and write
79F217F000
stack
page read and write
21A67B13000
heap
page read and write
F9F000
heap
page read and write
1AC8F679000
heap
page read and write
FAE000
heap
page read and write
2A5D000
direct allocation
page readonly
600000
remote allocation
page read and write
F30000
heap
page read and write
68DA28C000
stack
page read and write
27B43465000
heap
page read and write
F33000
heap
page read and write
1B8AC5B0000
remote allocation
page read and write
1B907C80000
heap
page read and write
F87000
heap
page read and write
22AB07BE000
heap
page read and write
9F0000
heap
page read and write
180000000
unkown
page readonly
F20000
heap
page read and write
22AB07EC000
heap
page read and write
180001000
unkown
page execute read
478747B000
stack
page read and write
2D82C330000
trusted library allocation
page read and write
21CE8700000
heap
page read and write
1EEF6A83000
heap
page read and write
478757E000
stack
page read and write
21CE85EF000
direct allocation
page readonly
2D82B830000
trusted library allocation
page read and write
B07AF7E000
stack
page read and write
2D82B820000
trusted library allocation
page read and write
F39000
heap
page read and write
22AB07F3000
heap
page read and write
1EEF9DE0000
trusted library allocation
page read and write
21A67970000
trusted library allocation
page read and write
29D6AD80000
heap
page read and write
21122FE000
stack
page read and write
680000
heap
page read and write
F70000
heap
page read and write
1EEF68D0000
heap
page read and write
21120FF000
stack
page read and write
22AB09BF000
direct allocation
page readonly
21A67AE2000
heap
page read and write
1EEF6A7F000
heap
page read and write
122E000
stack
page read and write
1AC8F627000
heap
page read and write
237E000
stack
page read and write
22AB07BE000
heap
page read and write
21CE6D52000
heap
page read and write
1D74CC3D000
heap
page read and write
21CE6D38000
heap
page read and write
27B433B0000
heap
page read and write
22AB06A0000
unkown
page read and write
1B907CF0000
heap
page read and write
21CE6D52000
heap
page read and write
2BF0000
heap
page read and write
27B43350000
heap
page read and write
68DA38F000
stack
page read and write
610000
heap
page read and write
8AC307B000
stack
page read and write
22AB0710000
heap
page read and write
2D82B859000
heap
page read and write
25FFF410000
heap
page read and write
F8C000
heap
page read and write
1B907E68000
heap
page read and write
1D74CBC0000
trusted library allocation
page read and write
1EF33284000
heap
page read and write
F22000
heap
page read and write
25FFF441000
heap
page read and write
2AF0000
trusted library allocation
page read and write
6AE000
heap
page read and write
FB3000
heap
page read and write
2D82C320000
trusted library allocation
page read and write
21CE6D18000
heap
page read and write
1800DB000
unkown
page readonly
8AC337C000
stack
page read and write
27B43469000
heap
page read and write
1230000
direct allocation
page execute and read and write
1AC8F480000
heap
page read and write
1AC8F631000
heap
page read and write
B07B4FC000
stack
page read and write
21CE85EF000
direct allocation
page readonly
21CE6C50000
heap
page read and write
29C0000
direct allocation
page read and write
2D82B5FF000
heap
page read and write
22AB06A0000
heap
page read and write
6AE000
heap
page read and write
22AB07D5000
heap
page read and write
29D6AE3C000
heap
page read and write
1EEF6CE0000
heap
page read and write
1D74CA60000
heap
page read and write
1CAB6102000
heap
page read and write
E00000
heap
page read and write
1D74CC8B000
heap
page read and write
FA3000
heap
page read and write
180001000
unkown
page execute read
27B43E23000
heap
page read and write
1AC8F662000
heap
page read and write
6B6000
heap
page read and write
B07B2FF000
stack
page read and write
1D74CC13000
heap
page read and write
21CE6CF0000
heap
page read and write
F98000
heap
page read and write
1EEF6A8D000
heap
page read and write
6C0000
heap
page read and write
2D82B590000
heap
page read and write
FEE000
heap
page read and write
D80DC7E000
stack
page read and write
22AB07B8000
heap
page read and write
1B907E00000
heap
page read and write
F60000
heap
page read and write
B07B6FC000
stack
page read and write
21CE6D36000
heap
page read and write
1B8AC5B0000
remote allocation
page read and write
27B4358E000
heap
page read and write
21CE6D18000
heap
page read and write
F8C000
heap
page read and write
B30000
direct allocation
page execute and read and write
379B8FE000
stack
page read and write
1D74E602000
trusted library allocation
page read and write
6559CFE000
stack
page read and write
ED0000
heap
page read and write
1255000
heap
page read and write
25FFF3F0000
heap
page read and write
B83808C000
stack
page read and write
1AC8F655000
heap
page read and write
25FFF438000
heap
page read and write
1D74CC5A000
heap
page read and write
2B60000
trusted library allocation
page read and write
22AB084C000
heap
page read and write
4786F3C000
stack
page read and write
22AB2290000
remote allocation
page read and write
1AC8F63C000
heap
page read and write
28B0000
remote allocation
page read and write
329BF7D000
stack
page read and write
FA2000
heap
page read and write
329BFFF000
stack
page read and write
28B0000
remote allocation
page read and write
22AB080F000
heap
page read and write
F68000
heap
page read and write
1EEF97A0000
heap
page read and write
1800DB000
unkown
page readonly
22AB23D0000
heap
page read and write
1D74CC02000
heap
page read and write
548E000
stack
page read and write
F169C79000
stack
page read and write
1CAB6602000
trusted library allocation
page read and write
27B43477000
heap
page read and write
180000000
unkown
page readonly
F78000
heap
page read and write
FB3000
heap
page read and write
1B8AC602000
heap
page read and write
B07B3FE000
stack
page read and write
1CAB606F000
heap
page read and write
478777F000
stack
page read and write
1800DB000
unkown
page readonly
F70000
heap
page read and write
2D82B510000
heap
page read and write
1EEF6A7A000
heap
page read and write
27B43E36000
heap
page read and write
D80D9CE000
stack
page read and write
21CE8700000
heap
page read and write
9E2000
heap
page read and write
1B907E63000
heap
page read and write
29EF000
stack
page read and write
21CE6D52000
heap
page read and write
600000
remote allocation
page read and write
18007D000
unkown
page readonly
29D6B602000
trusted library allocation
page read and write
F99000
heap
page read and write
B838BFF000
stack
page read and write
3073000
heap
page read and write
1AC8F656000
heap
page read and write
6BC000
heap
page read and write
B838AFE000
stack
page read and write
18007D000
unkown
page readonly
250E000
stack
page read and write
22AB080F000
heap
page read and write
2A30000
direct allocation
page read and write
301E000
stack
page read and write
B83877B000
stack
page read and write
23FF000
stack
page read and write
1800D8000
unkown
page read and write
2400000
direct allocation
page read and write
1B907DF0000
trusted library allocation
page read and write
2D82B580000
trusted library allocation
page read and write
1EF331D0000
heap
page read and write
F169CFA000
stack
page read and write
1AC8F641000
heap
page read and write
FC9000
heap
page read and write
1B8ACE02000
trusted library allocation
page read and write
F8C000
heap
page read and write
25FFF432000
heap
page read and write
1B908602000
trusted library allocation
page read and write
22AB084C000
heap
page read and write
1AC8F5F0000
trusted library allocation
page read and write
1D74CD13000
heap
page read and write
1AC8F63A000
heap
page read and write
329BD7E000
stack
page read and write
89B000
stack
page read and write
F169D7E000
stack
page read and write
F69000
heap
page read and write
EBB000
stack
page read and write
25FFF6B0000
heap
page read and write
F8C000
heap
page read and write
2EEE000
stack
page read and write
1AC8F66D000
heap
page read and write
27B43E27000
heap
page read and write
27B43451000
heap
page read and write
1EEF6A10000
heap
page read and write
29D6AE36000
heap
page read and write
1D74CD18000
heap
page read and write
27B43D02000
heap
page read and write
18007D000
unkown
page readonly
22AB0AC0000
heap
page read and write
2A6D000
stack
page read and write
1800D8000
unkown
page read and write
1CAB6029000
heap
page read and write
21CE6D52000
heap
page read and write
675000
heap
page read and write
21A67ACD000
heap
page read and write
320000
heap
page read and write
B50000
heap
page read and write
8AC347D000
stack
page read and write
211173B000
stack
page read and write
6D1000
heap
page read and write
68DA38F000
stack
page read and write
1AC8F67A000
heap
page read and write
10F0000
heap
page read and write
1D74CD02000
heap
page read and write
2111FFD000
stack
page read and write
2111CFF000
stack
page read and write
9F4000
heap
page read and write
21CE6CF0000
heap
page read and write
1800D8000
unkown
page read and write
1CAB6113000
heap
page read and write
25FFF41E000
heap
page read and write
180000000
unkown
page readonly
21A67ABC000
heap
page read and write
2D82B860000
trusted library allocation
page read and write
F61000
heap
page read and write
1B907E28000
heap
page read and write
29D6B540000
trusted library allocation
page read and write
1B8AC550000
heap
page read and write
1B907E7D000
heap
page read and write
2D82C310000
heap
page readonly
27B435E5000
heap
page read and write
27B433E0000
trusted library allocation
page read and write
2D82C300000
trusted library allocation
page read and write
FC9000
heap
page read and write
21CE85ED000
direct allocation
page readonly
22AB06A0000
unkown
page read and write
21CE6D8F000
heap
page read and write
25FFF456000
heap
page read and write
27B43340000
heap
page read and write
379B8FE000
stack
page read and write
18007D000
unkown
page readonly
1CAB605A000
heap
page read and write
21A67A29000
heap
page read and write
EF0000
heap
page read and write
21CE6DAB000
heap
page read and write
6AE000
heap
page read and write
1CAB6013000
heap
page read and write
22AB09BF000
direct allocation
page readonly
1250000
heap
page read and write
27B43479000
heap
page read and write
21A68312000
heap
page read and write
1D74CC64000
heap
page read and write
22AB080F000
heap
page read and write
FD5000
heap
page read and write
8AC37FC000
stack
page read and write
2D82B4F0000
heap
page read and write
F68000
heap
page read and write
F8C000
heap
page read and write
22AB080F000
heap
page read and write
1D74CA50000
heap
page read and write
BCEE91B000
stack
page read and write
9B0000
heap
page read and write
22AB09BD000
direct allocation
page readonly
22AB080F000
heap
page read and write
F52000
heap
page read and write
25F82B70000
heap
page read and write
1B907E3C000
heap
page read and write
F52000
heap
page read and write
1B907E13000
heap
page read and write
27B43D54000
heap
page read and write
2A6B000
stack
page read and write
BCEEF79000
stack
page read and write
296C000
stack
page read and write
329BA7C000
stack
page read and write
21CE6D52000
heap
page read and write
1EF33286000
heap
page read and write
27B43D71000
heap
page read and write
6559FFF000
stack
page read and write
27B43E02000
heap
page read and write
22AB0980000
direct allocation
page execute and read and write
25F82C40000
heap
page read and write
29D6AE02000
heap
page read and write
27B43C02000
heap
page read and write
5510000
trusted library allocation
page read and write
21CE86E0000
remote allocation
page read and write
1AC8F677000
heap
page read and write
6A5000
heap
page read and write
1CAB6055000
heap
page read and write
25FFF42D000
heap
page read and write
F63000
heap
page read and write
22AB080F000
heap
page read and write
F8C000
heap
page read and write
F98000
heap
page read and write
1AC8F67E000
heap
page read and write
29D6AE29000
heap
page read and write
1AC8F646000
heap
page read and write
21CE6CC5000
heap
page read and write
379B5CC000
stack
page read and write
1AC8F684000
heap
page read and write
21CE85C0000
direct allocation
page read and write
1AC8F4F0000
heap
page read and write
3084000
heap
page read and write
25FFF43C000
heap
page read and write
21CE6CB0000
heap
page readonly
18007D000
unkown
page readonly
9E2000
heap
page read and write
21CE6CC5000
heap
page read and write
1800DB000
unkown
page readonly
22AB07B0000
heap
page read and write
25FFF6B5000
heap
page read and write
1CAB603F000
heap
page read and write
FEE000
heap
page read and write
1B8AC4E0000
heap
page read and write
A10000
heap
page read and write
27B43D00000
heap
page read and write
2E40000
trusted library allocation
page read and write
21A67A8A000
heap
page read and write
21CE6D18000
heap
page read and write
1AC8F665000
heap
page read and write
21CE6CF0000
heap
page read and write
21CE6CC5000
heap
page read and write
F22000
heap
page read and write
1800D8000
unkown
page read and write
1AC8F66F000
heap
page read and write
550E000
stack
page read and write
1EEF9DD0000
heap
page read and write
3081000
heap
page read and write
1AC8F640000
heap
page read and write
329C0FD000
stack
page read and write
27B43E13000
heap
page read and write
21CE85ED000
direct allocation
page readonly
FAF000
heap
page read and write
18007D000
unkown
page readonly
1800D8000
unkown
page read and write
329C17E000
stack
page read and write
21CE6CA0000
direct allocation
page execute and read and write
6A0000
heap
page read and write
1AC8F649000
heap
page read and write
2111DFC000
stack
page read and write
68DA30E000
stack
page read and write
27B43DC7000
heap
page read and write
B8388FF000
stack
page read and write
79F1DFB000
stack
page read and write
180000000
unkown
page readonly
F70000
heap
page read and write
21CE6D52000
heap
page read and write
F6B000
heap
page read and write
F78000
heap
page read and write
6559DFE000
stack
page read and write
F6C000
heap
page read and write
21CE6AF0000
unkown
page read and write
F8C000
heap
page read and write
1D74CC5A000
heap
page read and write
27B43D96000
heap
page read and write
1AC8FE02000
trusted library allocation
page read and write
25FFF6BB000
heap
page read and write
3070000
heap
page read and write
1B8AC600000
heap
page read and write
21CE6C30000
heap
page read and write
21CE6CC0000
heap
page read and write
9B8000
heap
page read and write
1800DB000
unkown
page readonly
27B435B9000
heap
page read and write
A42000
heap
page read and write
1D74E5F0000
remote allocation
page read and write
FC9000
heap
page read and write
1EEF6A93000
heap
page read and write
2D82B5A2000
heap
page read and write
11C0000
heap
page read and write
2430000
trusted library allocation
page read and write
22AB084C000
heap
page read and write
1AC8F659000
heap
page read and write
27B43E30000
heap
page read and write
1AC8F658000
heap
page read and write
22D0000
heap
page read and write
22AB07E6000
heap
page read and write
27B43494000
heap
page read and write
1800D8000
unkown
page read and write
F72000
heap
page read and write
1CAB5E20000
heap
page read and write
2ADE000
stack
page read and write
22AB080F000
heap
page read and write
29D6AF02000
heap
page read and write
21CE6CC0000
heap
page read and write
8AC31FE000
stack
page read and write
1B8AC629000
heap
page read and write
2A5F000
direct allocation
page readonly
22AB09BD000
direct allocation
page readonly
8AC38FF000
stack
page read and write
22AB2290000
remote allocation
page read and write
1800DB000
unkown
page readonly
1800DB000
unkown
page readonly
2FEE000
stack
page read and write
F8C000
heap
page read and write
F8C000
heap
page read and write
21A68300000
heap
page read and write
A02000
heap
page read and write
1AC8F62F000
heap
page read and write
22AB080F000
heap
page read and write
1AC8F642000
heap
page read and write
21A678E0000
heap
page read and write
1CAB6065000
heap
page read and write
F95000
heap
page read and write
21CE6CC0000
heap
page read and write
1EEF6A89000
heap
page read and write
1D74E5F0000
remote allocation
page read and write
C161FDD000
stack
page read and write
2D82B5DC000
heap
page read and write
F6C000
heap
page read and write
79F207E000
stack
page read and write
21A678D0000
heap
page read and write
F28000
heap
page read and write
1EF33270000
heap
page read and write
F42000
heap
page read and write
1EEF6CE5000
heap
page read and write
25F82C60000
trusted library allocation
page read and write
6AE000
heap
page read and write
8AC36FE000
stack
page read and write
22AB080F000
heap
page read and write
1CAB604F000
heap
page read and write
F169E79000
stack
page read and write
180000000
unkown
page readonly
1B907E79000
heap
page read and write
F78000
heap
page read and write
27B43443000
heap
page read and write
1B8AC5B0000
remote allocation
page read and write
18007D000
unkown
page readonly
8AC32FE000
stack
page read and write
21CE85EF000
direct allocation
page readonly
21CE6D26000
heap
page read and write
22AB07F5000
heap
page read and write
AB0000
heap
page read and write
21CE6C50000
heap
page read and write
1EEF6AA5000
heap
page read and write
6AA000
heap
page read and write
3075000
heap
page read and write
1AC8F65A000
heap
page read and write
2D82B850000
heap
page read and write
1EEF6A9E000
heap
page read and write
27B43D22000
heap
page read and write
F8C000
heap
page read and write
21A67A13000
heap
page read and write
22AB080F000
heap
page read and write
21CE6D52000
heap
page read and write
FC9000
heap
page read and write
21CE6CA0000
direct allocation
page execute and read and write
25FFF432000
heap
page read and write
27B43DD1000
heap
page read and write
29D6ADE0000
heap
page read and write
27B43413000
heap
page read and write
FF0000
heap
page read and write
21121FF000
stack
page read and write
242F000
direct allocation
page readonly
D80D94B000
stack
page read and write
22AB084C000
heap
page read and write
1EF33278000
heap
page read and write
21CE6D52000
heap
page read and write
1B907F02000
heap
page read and write
2D82B3C0000
trusted library allocation
page read and write
1EEF6A6C000
heap
page read and write
1D74CC59000
heap
page read and write
21CE6D18000
heap
page read and write
6559AFE000
stack
page read and write
29D6AE2E000
heap
page read and write
1B8AC702000
heap
page read and write
22AB07E3000
heap
page read and write
9F9000
heap
page read and write
21A67940000
heap
page read and write
F8C000
heap
page read and write
309B000
stack
page read and write
1AC8F660000
heap
page read and write
2D82B5D4000
heap
page read and write
478767F000
stack
page read and write
9F3000
heap
page read and write
21124FE000
stack
page read and write
1AC8F490000
heap
page read and write
F76000
heap
page read and write
A58000
heap
page read and write
EF0000
heap
page read and write
79F20FE000
stack
page read and write
F9A000
heap
page read and write
1EEF6A83000
heap
page read and write
180001000
unkown
page execute read
F78000
heap
page read and write
2D82C380000
trusted library allocation
page read and write
22AB07D5000
heap
page read and write
1B907E02000
heap
page read and write
990000
heap
page read and write
21CE85C0000
direct allocation
page read and write
1AC8F702000
heap
page read and write
F34000
heap
page read and write
2D82B599000
heap
page read and write
1D74CC2A000
heap
page read and write
1EEF9C40000
heap
page read and write
1D74CC00000
heap
page read and write
27B43468000
heap
page read and write
1D74E5B0000
trusted library allocation
page read and write
21A67B02000
heap
page read and write
22AB0AC0000
heap
page read and write
27B43DB1000
heap
page read and write
1D74CBE0000
trusted library allocation
page read and write
2430000
trusted library allocation
page read and write
22AB07D5000
heap
page read and write
2B57000
stack
page read and write
22AB0990000
direct allocation
page read and write
27B43E30000
heap
page read and write
There are 818 hidden memdumps, click here to show them.