IOC Report
202404294766578200.xlam.xlsx

loading gif

Files

File Path
Type
Category
Malicious
202404294766578200.xlam.xlsx
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\AppData\Local\eupolyzoan\Bactris.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bactris.vbs
data
dropped
 malicious
C:\Users\user\AppData\Roaming\YED.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Temp\Charley
ASCII text, with very long lines (29744), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\aut8862.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut88B1.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut9924.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut9982.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\bhvA8BE.tmp
Extensible storage engine DataBase, version 0x620, checksum 0x33b00c01, page size 32768, DirtyShutdown, Windows version 6.1
dropped
C:\Users\user\AppData\Local\Temp\chp8DDF.tmp
SQLite 3.x database, last written using SQLite version 3039004, page size 2048, file counter 11, database pages 51, cookie 0x5a, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\chp8E2E.tmp
SQLite 3.x database, last written using SQLite version 3039004, page size 2048, file counter 4, database pages 23, cookie 0x23, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\eupolyzoan
data
dropped
C:\Users\user\AppData\Local\Temp\qcbxbnrr
Unicode text, UTF-16, little-endian text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\~$imgs.xlsx
data
dropped
C:\Users\user\AppData\Roaming\logs.dat
data
dropped
C:\Users\user\Desktop\~$202404294766578200.xlam.xls
data
dropped
C:\Users\user\Desktop\~$202404294766578200.xlam.xlsx
data
dropped
Chrome Cache Entry: 95
ASCII text, with very long lines (4122)
downloaded
There are 10 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
 malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
 malicious
C:\Users\user\AppData\Roaming\YED.exe
C:\Users\user\AppData\Roaming\YED.exe
 malicious
C:\Users\user\AppData\Local\eupolyzoan\Bactris.exe
C:\Users\user\AppData\Roaming\YED.exe
 malicious
C:\Windows\SysWOW64\svchost.exe
C:\Users\user\AppData\Roaming\YED.exe
 malicious
C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\qcbxbnrr"
 malicious
C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\seghufctinb"
 malicious
C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\dyuauqnmwvtskce"
 malicious
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1364 --field-trial-handle=1452,i,15568989383610033621,8608539169459799112,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=892 --field-trial-handle=1396,i,13358231411772672971,2555512376125685792,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
There are 2 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://23.94.54.101/GVV.exe
23.94.54.101
 malicious
http://geoplugin.net/json.gp/C
unknown
 malicious
http://geoplugin.net/json.gp
178.237.33.50
 malicious
yuahdgbceja.sytes.net
malicious
http://b.scorecardresearch.com/beacon.js
unknown
https://duckduckgo.com/chrome_newtab
unknown
http://acdn.adnxs.com/ast/ast.js
unknown
http://www.imvu.comr
unknown
https://duckduckgo.com/ac/?q=
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_
unknown
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgS_YJbhGMuBzLEGIjDHkOYETEkfpPO5BNVM4qFB3EzErW1N_BxHwWaZNSSd6fpa03DeWClTlQmn-8-Tj7IyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
172.217.1.4
https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
unknown
http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
unknown
https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9
unknown
http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
unknown
http://www.nirsoft.net
unknown
https://deff.nelreports.net/api/report?cat=msn
unknown
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
unknown
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
unknown
http://cache.btrll.com/default/Pix-1x1.gif
unknown
http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683
unknown
https://www.google.com
unknown
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgS_YJbhGMqBzLEGIjAmi-UIIFqSTjkw-RfWXi2GfkOK6xdeNQDHNk-OB5e4eww8XVW3FAYyUUV3pTR2uxYyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
172.217.1.4
http://o.aolcdn.com/ads/adswrappermsni.js
unknown
http://cdn.taboola.com/libtrc/msn-home-network/loader.js
unknown
http://www.msn.com/?ocid=iehp
unknown
https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033
unknown
http://static.chartbeat.com/js/chartbeat.js
unknown
http://www.msn.com/de-de/?ocid=iehp
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%
unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
172.217.1.4
http://www.nirsoft.net/
unknown
https://www.google.com/chrome/whats-new/m109?internal=true
172.217.1.4
https://www.google.com/sorry/index?continue=https://www.google.com/async/ddljson%3Fasync%3Dntp:2&q=EgS_YJbhGMmBzLEGIjB5NrDOyf958iCbJpAJxeAyyHGDgUuUJYBV60K9olc20v99BBChXQUVByr6JLh_QvcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
172.217.1.4
https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3
unknown
http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683
unknown
http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(
unknown
https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh
unknown
http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js
unknown
https://www.ccleaner.com/go/app_cc_pro_trialkey
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://contextual.media.net/8/nrrV73987.js
unknown
http://www.imvu.com
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.google.com/async/newtab_promos
172.217.1.4
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
unknown
https://contextual.media.net/
unknown
https://www.ecosia.org/newtab/
unknown
http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
unknown
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
unknown
http://www.msn.com/
unknown
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://search.yahoo.com?fr=crmas_sfp
unknown
https://www.google.com/async/ddljson?async=ntp:2
172.217.1.4
http://www.imvu.com/T
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
172.217.1.4
https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549
unknown
http://cdn.at.atwola.com/_media/uac/msn.html
unknown
http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://policies.yahoo.com/w3c/p3p.xml
unknown
http://www.msn.com/advertisement.ad.js
unknown
http://www.ebuddy.com
unknown
There are 56 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
yuahdgbceja.sytes.net
23.94.53.100
 malicious
geoplugin.net
178.237.33.50
 malicious
www.google.com
172.217.1.4

IPs

IP
Domain
Country
Malicious
192.168.2.22
unknown
unknown
malicious
23.94.54.101
unknown
United States
malicious
23.94.53.100
yuahdgbceja.sytes.net
United States
malicious
178.237.33.50
geoplugin.net
Netherlands
malicious
239.255.255.250
unknown
Reserved
172.217.1.4
www.google.com
United States
127.0.0.1
unknown
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Rmc-E70NOS
exepath
 malicious
HKEY_CURRENT_USER\Software\Rmc-E70NOS
licence
 malicious
HKEY_CURRENT_USER\Software\Rmc-E70NOS
time
 malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
u/)
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
Enabled
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
h4)
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
There are 7 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
system
page execute and read and write
 malicious
2990000
direct allocation
page read and write
 malicious
2C60000
direct allocation
page read and write
953000
heap
page read and write
8DB000
heap
page read and write
2641000
heap
page read and write
8F0000
heap
page read and write
114C000
unkown
page read and write
3129000
heap
page read and write
25E000
stack
page read and write
2D2000
unkown
page readonly
66B0000
direct allocation
page read and write
564000
heap
page read and write
473000
system
page execute and read and write
9BE000
heap
page read and write
89000
stack
page read and write
9EC000
heap
page read and write
2550000
heap
page read and write
50B0000
heap
page read and write
947000
heap
page read and write
30B0000
heap
page read and write
10000
heap
page read and write
9FA000
heap
page read and write
5D1000
heap
page read and write
E56000
heap
page read and write
ADD000
heap
page read and write
9CD000
heap
page read and write
2BEA000
direct allocation
page read and write
2E4000
unkown
page readonly
2D64000
direct allocation
page read and write
16E000
heap
page read and write
94A000
heap
page read and write
2C70000
direct allocation
page read and write
B01000
heap
page read and write
2BEA000
direct allocation
page read and write
594000
heap
page read and write
A3A000
heap
page read and write
2D0E000
stack
page read and write
2C70000
direct allocation
page read and write
958000
heap
page read and write
58C000
stack
page read and write
8CA000
heap
page read and write
32A3000
heap
page read and write
A20000
heap
page read and write
ABF000
heap
page read and write
2670000
heap
page read and write
10000
heap
page read and write
2C70000
direct allocation
page read and write
3EB0000
direct allocation
page read and write
890000
heap
page read and write
9BA000
heap
page read and write
ADD000
heap
page read and write
ADE000
heap
page read and write
211000
unkown
page execute read
2550000
trusted library allocation
page read and write
2853000
heap
page read and write
48B0000
direct allocation
page read and write
CC0000
heap
page read and write
56E000
stack
page read and write
5E4000
heap
page read and write
2DC000
unkown
page read and write
1C7000
stack
page read and write
61D000
heap
page read and write
8CC000
heap
page read and write
270F000
stack
page read and write
2550000
trusted library allocation
page read and write
2D50000
direct allocation
page read and write
298C000
stack
page read and write
114C000
unkown
page write copy
530000
heap
page read and write
110000
direct allocation
page execute and read and write
8FC000
heap
page read and write
2C70000
direct allocation
page read and write
2E6E000
stack
page read and write
AFD000
heap
page read and write
DD0000
heap
page read and write
349000
heap
page read and write
9EF000
heap
page read and write
2D2000
unkown
page readonly
9E7000
heap
page read and write
10001000
direct allocation
page execute and read and write
A5D000
stack
page read and write
82E000
stack
page read and write
3FE000
stack
page read and write
2DD0000
direct allocation
page read and write
14C000
stack
page read and write
98A000
heap
page read and write
3500000
heap
page read and write
ABF000
heap
page read and write
3324000
heap
page read and write
2EBE000
stack
page read and write
2550000
heap
page read and write
AB8000
heap
page read and write
2D50000
direct allocation
page read and write
AB5000
heap
page read and write
9EC000
heap
page read and write
4BE000
stack
page read and write
C2F000
stack
page read and write
8C0000
heap
page read and write
62C000
heap
page read and write
A2A000
heap
page read and write
3128000
heap
page read and write
890000
heap
page read and write
3440000
heap
page read and write
2BEA000
direct allocation
page read and write
100000
trusted library allocation
page read and write
2C60000
direct allocation
page read and write
33B0000
heap
page read and write
31B0000
heap
page read and write
988000
heap
page read and write
341000
heap
page read and write
2C60000
direct allocation
page read and write
2C70000
direct allocation
page read and write
AB8000
heap
page read and write
1164000
unkown
page readonly
3896000
unclassified section
page execute and read and write
2F6000
heap
page read and write
2853000
heap
page read and write
343000
heap
page read and write
459000
system
page execute and read and write
2BEA000
direct allocation
page read and write
1CB000
stack
page read and write
7CF000
heap
page read and write
2854000
heap
page read and write
652000
heap
page read and write
9BE000
heap
page read and write
285E000
stack
page read and write
2D61000
direct allocation
page read and write
98A000
heap
page read and write
B01000
heap
page read and write
474000
system
page execute and read and write
10000
heap
page read and write
AB7000
heap
page read and write
26E000
stack
page read and write
D60000
heap
page read and write
AFA000
heap
page read and write
3020000
unclassified section
page execute and read and write
B4F000
stack
page read and write
B4E000
heap
page read and write
964000
heap
page read and write
2550000
trusted library allocation
page read and write
90C000
heap
page read and write
1142000
unkown
page readonly
218000
heap
page read and write
2D50000
direct allocation
page read and write
988000
heap
page read and write
AAC000
heap
page read and write
21B000
heap
page read and write
CBF000
stack
page read and write
2DD0000
direct allocation
page read and write
23C000
stack
page read and write
18B000
stack
page read and write
2D67000
direct allocation
page read and write
34FF000
stack
page read and write
284F000
heap
page read and write
9DB000
heap
page read and write
10000
heap
page read and write
A2A000
heap
page read and write
16D000
heap
page read and write
528E000
stack
page read and write
5AE000
stack
page read and write
1081000
unkown
page execute read
21D000
heap
page read and write
25F0000
heap
page read and write
8DC000
heap
page read and write
84F000
stack
page read and write
577000
heap
page read and write
90B000
heap
page read and write
2DD0000
direct allocation
page read and write
953000
heap
page read and write
1150000
unkown
page write copy
4FB000
heap
page read and write
552000
heap
page read and write
2B2D000
stack
page read and write
2D67000
direct allocation
page read and write
507F000
stack
page read and write
4F8000
heap
page read and write
570000
heap
page read and write
ADE000
heap
page read and write
9D1000
heap
page read and write
640000
heap
page read and write
9DC000
heap
page read and write
26E2000
heap
page read and write
897000
heap
page read and write
9DB000
heap
page read and write
30B1000
heap
page read and write
27C1000
heap
page read and write
A0F000
unclassified section
page execute and read and write
990000
heap
page read and write
2C4D000
stack
page read and write
5EF000
heap
page read and write
8E4000
heap
page read and write
A3D000
heap
page read and write
692000
heap
page read and write
AF5000
heap
page read and write
275E000
stack
page read and write
636000
heap
page read and write
2BED000
direct allocation
page read and write
2D61000
direct allocation
page read and write
457000
heap
page read and write
2550000
trusted library allocation
page read and write
2D50000
direct allocation
page read and write
AAC000
heap
page read and write
E0000
heap
page read and write
2F4000
unkown
page readonly
43A000
heap
page read and write
9E8000
heap
page read and write
210000
unkown
page readonly
10000
heap
page read and write
90C000
heap
page read and write
280000
heap
page read and write
400000
system
page execute and read and write
90A000
heap
page read and write
6E0000
heap
page read and write
70B0000
direct allocation
page read and write
2BED000
direct allocation
page read and write
897000
heap
page read and write
2BED000
direct allocation
page read and write
5210000
heap
page read and write
2D61000
direct allocation
page read and write
8DB000
heap
page read and write
31B1000
heap
page read and write
260D000
stack
page read and write
2630000
heap
page read and write
2858000
heap
page read and write
27F000
stack
page read and write
41F000
system
page execute and read and write
979000
heap
page read and write
94A000
heap
page read and write
ABE000
heap
page read and write
4F0000
heap
page read and write
2BED000
direct allocation
page read and write
2D61000
direct allocation
page read and write
2A9E000
direct allocation
page read and write
3EF000
stack
page read and write
A0A000
heap
page read and write
9DB000
heap
page read and write
2850000
heap
page read and write
90B000
heap
page read and write
2D64000
direct allocation
page read and write
5B0000
heap
page read and write
561F000
stack
page read and write
30B1000
heap
page read and write
2DD0000
direct allocation
page read and write
57E000
stack
page read and write
29D0000
direct allocation
page read and write
1081000
unkown
page execute read
10000000
direct allocation
page read and write
7C0000
heap
page read and write
1CC000
stack
page read and write
1154000
unkown
page readonly
3516000
heap
page read and write
ADD000
heap
page read and write
170000
direct allocation
page read and write
120000
heap
page read and write
59F000
stack
page read and write
9DB000
heap
page read and write
986000
heap
page read and write
34B0000
direct allocation
page read and write
D1E000
stack
page read and write
5C7000
heap
page read and write
2E4000
unkown
page readonly
2B10000
direct allocation
page read and write
45D000
system
page execute and read and write
965000
heap
page read and write
ABF000
heap
page read and write
983000
heap
page read and write
1080000
unkown
page readonly
10000
heap
page read and write
1DF000
stack
page read and write
A0B000
heap
page read and write
979000
heap
page read and write
977000
heap
page read and write
200000
heap
page read and write
2D70000
direct allocation
page read and write
301E000
stack
page read and write
3165000
heap
page read and write
1080000
unkown
page readonly
111C000
unkown
page readonly
450000
direct allocation
page execute and read and write
138000
stack
page read and write
ADE000
heap
page read and write
31B1000
heap
page read and write
3093000
unclassified section
page execute and read and write
680000
heap
page read and write
2D50000
direct allocation
page read and write
2F4000
unkown
page readonly
8F7000
heap
page read and write
2B0000
heap
page read and write
A90000
heap
page read and write
300000
heap
page read and write
2D61000
direct allocation
page read and write
2853000
heap
page read and write
A69000
heap
page read and write
623000
heap
page read and write
2DD0000
direct allocation
page read and write
B55000
heap
page read and write
160000
heap
page read and write
2D70000
direct allocation
page read and write
949000
heap
page read and write
32E000
heap
page read and write
2D67000
direct allocation
page read and write
2BEA000
direct allocation
page read and write
979000
heap
page read and write
994000
heap
page read and write
81E000
stack
page read and write
27C0000
heap
page read and write
A39000
heap
page read and write
8DC000
heap
page read and write
B06000
heap
page read and write
2FDF000
stack
page read and write
2D64000
direct allocation
page read and write
56E000
stack
page read and write
16E000
heap
page read and write
B01000
heap
page read and write
2F0000
heap
page read and write
167000
heap
page read and write
A0A000
heap
page read and write
3AD000
stack
page read and write
400000
system
page execute and read and write
10016000
direct allocation
page execute and read and write
275F000
stack
page read and write
62E000
heap
page read and write
456000
system
page execute and read and write
22C000
stack
page read and write
1DE0000
direct allocation
page read and write
2C0000
remote allocation
page read and write
52B0000
direct allocation
page read and write
85F000
stack
page read and write
551F000
stack
page read and write
2AC000
unkown
page readonly
B01000
heap
page read and write
23BF000
stack
page read and write
2B7000
heap
page read and write
2819000
trusted library allocation
page read and write
547000
heap
page read and write
3325000
heap
page read and write
9BE000
heap
page read and write
2AB0000
direct allocation
page read and write
AAC000
heap
page read and write
90C000
heap
page read and write
340000
heap
page read and write
BA000
stack
page read and write
957000
heap
page read and write
284F000
heap
page read and write
4F4000
heap
page read and write
2DD0000
direct allocation
page read and write
2C60000
direct allocation
page read and write
914000
heap
page read and write
2500000
trusted library allocation
page read and write
B06000
heap
page read and write
5E3000
heap
page read and write
AB7000
heap
page read and write
2844000
heap
page read and write
995000
heap
page read and write
2813000
trusted library allocation
page read and write
211000
unkown
page execute read
ADD000
heap
page read and write
300000
heap
page read and write
9DB000
heap
page read and write
A3B000
heap
page read and write
30A0000
heap
page read and write
18F000
stack
page read and write
34C000
heap
page read and write
6E0000
heap
page read and write
45C000
system
page execute and read and write
958000
heap
page read and write
2D50000
direct allocation
page read and write
16F000
heap
page read and write
67E000
stack
page read and write
8DA000
heap
page read and write
5AF000
stack
page read and write
31D000
heap
page read and write
24BF000
stack
page read and write
AF2000
heap
page read and write
254E000
stack
page read and write
2D64000
direct allocation
page read and write
9F0000
unclassified section
page execute and read and write
2AD0000
heap
page read and write
AED000
stack
page read and write
2E1F000
stack
page read and write
8DC000
heap
page read and write
130000
trusted library allocation
page read and write
94A000
heap
page read and write
958000
heap
page read and write
AB5000
heap
page read and write
953000
heap
page read and write
90C000
heap
page read and write
2B10000
direct allocation
page read and write
2BEA000
direct allocation
page read and write
389C000
unclassified section
page execute and read and write
1E3000
stack
page read and write
CBE000
stack
page read and write
41B000
system
page execute and read and write
400000
system
page execute and read and write
948000
heap
page read and write
AB8000
heap
page read and write
51EF000
stack
page read and write
A50000
heap
page read and write
2D70000
direct allocation
page read and write
2EF000
stack
page read and write
5C0000
heap
page read and write
2F0000
heap
page read and write
25F0000
heap
page read and write
2D70000
direct allocation
page read and write
AF1000
heap
page read and write
A59000
heap
page read and write
3840000
unclassified section
page execute and read and write
284F000
heap
page read and write
987000
heap
page read and write
2A91000
direct allocation
page read and write
1BC000
stack
page read and write
2B10000
direct allocation
page read and write
27BF000
stack
page read and write
BFE000
stack
page read and write
8B4000
heap
page read and write
986000
heap
page read and write
16F000
heap
page read and write
AAE000
stack
page read and write
2800000
trusted library allocation
page read and write
979000
heap
page read and write
1020000
heap
page read and write
760000
heap
page read and write
B4E000
heap
page read and write
2845000
heap
page read and write
2D70000
direct allocation
page read and write
5D9000
heap
page read and write
2D64000
direct allocation
page read and write
674000
heap
page read and write
B27000
heap
page read and write
2C0000
remote allocation
page read and write
983000
heap
page read and write
27C1000
heap
page read and write
2D67000
direct allocation
page read and write
540000
heap
page read and write
A0B000
unclassified section
page execute and read and write
2D67000
direct allocation
page read and write
9FA000
heap
page read and write
AB0000
heap
page read and write
988000
heap
page read and write
16E000
stack
page read and write
534000
heap
page read and write
2AC000
unkown
page readonly
2E0000
unkown
page write copy
2580000
direct allocation
page read and write
2B10000
direct allocation
page read and write
5DC000
heap
page read and write
53A0000
heap
page read and write
2C9E000
stack
page read and write
8C7000
heap
page read and write
26C0000
heap
page read and write
27FF000
stack
page read and write
A48000
heap
page read and write
1142000
unkown
page readonly
9E7000
heap
page read and write
478000
system
page execute and read and write
2845000
heap
page read and write
A80000
heap
page read and write
8B4000
heap
page read and write
111C000
unkown
page readonly
2C60000
direct allocation
page read and write
A3A000
heap
page read and write
1154000
unkown
page readonly
BC0000
heap
page read and write
33E000
heap
page read and write
988000
heap
page read and write
AB7000
heap
page read and write
2D61000
direct allocation
page read and write
ADD000
heap
page read and write
2D64000
direct allocation
page read and write
983000
heap
page read and write
E50000
heap
page read and write
2D70000
direct allocation
page read and write
937000
heap
page read and write
9B6000
heap
page read and write
DCF000
stack
page read and write
DD6000
heap
page read and write
670000
heap
page read and write
16A000
stack
page read and write
5CB0000
direct allocation
page read and write
7C3000
heap
page read and write
538F000
stack
page read and write
10000
heap
page read and write
B50000
heap
page read and write
22FF000
stack
page read and write
8DC000
heap
page read and write
294F000
stack
page read and write
330000
heap
page read and write
331C000
heap
page read and write
990000
heap
page read and write
7BE000
stack
page read and write
3BE000
stack
page read and write
2BF000
stack
page read and write
2D67000
direct allocation
page read and write
A0B000
heap
page read and write
8CF000
stack
page read and write
958000
heap
page read and write
BDD000
stack
page read and write
2B10000
direct allocation
page read and write
3128000
heap
page read and write
2BED000
direct allocation
page read and write
3441000
heap
page read and write
288F000
stack
page read and write
9BE000
heap
page read and write
2845000
heap
page read and write
33AD000
heap
page read and write
98C000
heap
page read and write
26C4000
heap
page read and write
32F000
stack
page read and write
2B10000
direct allocation
page read and write
5D6000
heap
page read and write
307D000
unclassified section
page execute and read and write
5CB000
heap
page read and write
3079000
unclassified section
page execute and read and write
AE2000
heap
page read and write
2DC000
unkown
page write copy
ADE000
heap
page read and write
2A1F000
stack
page read and write
83C000
stack
page read and write
D7F000
stack
page read and write
1164000
unkown
page readonly
2C70000
direct allocation
page read and write
A7F000
stack
page read and write
210000
unkown
page readonly
9EF000
heap
page read and write
AFD000
heap
page read and write
A2A000
heap
page read and write
2BED000
direct allocation
page read and write
C70000
heap
page read and write
334B000
heap
page read and write
1EC000
stack
page read and write
3470000
heap
page read and write
2C60000
direct allocation
page read and write
53E0000
heap
page read and write
A39000
heap
page read and write
2680000
heap
page read and write
978000
heap
page read and write
AB8000
heap
page read and write
There are 528 hidden memdumps, click here to show them.