IOC Report
202404294766578200.xlam.xlsx

loading gif

Files

File Path
Type
Category
Malicious
202404294766578200.xlam.xlsx
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\AppData\Local\silvexes\deblaterate.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\CKK.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deblaterate.vbs
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Temp\aut24D0.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut252E.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut904E.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut90BC.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autC301.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autC3BE.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\bhvA870.tmp
Extensible storage engine DataBase, version 0x620, checksum 0x2f8d0607, page size 32768, DirtyShutdown, Windows version 6.1
dropped
C:\Users\user\AppData\Local\Temp\disturb
data
dropped
C:\Users\user\AppData\Local\Temp\ppotysrwfeteuiatikevqdgejj
Unicode text, UTF-16, little-endian text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\proximobuccal
ASCII text, with very long lines (29744), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\~$imgs.xlsx
data
dropped
C:\Users\user\AppData\Roaming\logs.dat
data
dropped
C:\Users\user\Desktop\~$202404294766578200.xlam.xls
data
dropped
C:\Users\user\Desktop\~$202404294766578200.xlam.xlsx
data
dropped
There are 9 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
 malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
 malicious
C:\Users\user\AppData\Roaming\CKK.exe
"C:\Users\user\AppData\Roaming\CKK.exe"
 malicious
C:\Users\user\AppData\Local\silvexes\deblaterate.exe
"C:\Users\user\AppData\Roaming\CKK.exe"
 malicious
C:\Windows\SysWOW64\svchost.exe
"C:\Users\user\AppData\Roaming\CKK.exe"
 malicious
C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\ppotysrwfeteuiatikevqdgejj"
 malicious
C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\sjtmzkcptmljfowfsvrxbqbvspfxg"
 malicious
C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\user\AppData\Local\Temp\cmzeadnjpudohckjjfeyevvebepghjumz"
 malicious
C:\Windows\System32\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deblaterate.vbs"
malicious
C:\Users\user\AppData\Local\silvexes\deblaterate.exe
"C:\Users\user\AppData\Local\silvexes\deblaterate.exe"
malicious
C:\Windows\SysWOW64\svchost.exe
"C:\Users\user\AppData\Local\silvexes\deblaterate.exe"
malicious
There are 1 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://23.94.54.101/GVV.exe
23.94.54.101
 malicious
http://geoplugin.net/json.gp/C
unknown
 malicious
http://geoplugin.net/json.gp
178.237.33.50
 malicious
yuahdgbceja.sytes.net
malicious
http://b.scorecardresearch.com/beacon.js
unknown
http://acdn.adnxs.com/ast/ast.js
unknown
http://www.imvu.comr
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_167%2Cw_312%2Cc_fill%2Cg_faces%2Ce_
unknown
https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
unknown
https://support.google.com
unknown
http://geoplugin.net/json.gp/
unknown
https://support.google.com/chrome/?p=plugin_flash
unknown
http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
unknown
https://cvision.media.net/new/286x175/2/137/169/197/852af93e-e705-48f1-93ba-6ef64c8308e6.jpg?v=9
unknown
http://23.94.54.101/GVV.exeXC
unknown
http://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
unknown
http://www.nirsoft.net
unknown
https://deff.nelreports.net/api/report?cat=msn
unknown
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
unknown
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
unknown
http://cache.btrll.com/default/Pix-1x1.gif
unknown
http://pr-bh.ybp.yahoo.com/sync/msft/1614522055312108683
unknown
https://www.google.com
unknown
http://o.aolcdn.com/ads/adswrappermsni.js
unknown
http://cdn.taboola.com/libtrc/msn-home-network/loader.js
unknown
http://www.msn.com/?ocid=iehp
unknown
https://www.msn.com/en-us/homepage/secure/silentpassport?secure=false&lc=1033
unknown
http://static.chartbeat.com/js/chartbeat.js
unknown
http://www.msn.com/de-de/?ocid=iehp
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_90%2Cw_120%2Cc_fill%2Cg_faces:auto%
unknown
http://www.nirsoft.net/
unknown
https://contextual.media.net/803288796/fcmain.js?&gdpr=1&cid=8CUT39MWR&cpcd=2K6DOtg60bLnBhB3D4RSbQ%3
unknown
http://p.rfihub.com/cm?in=1&pub=345&userid=1614522055312108683
unknown
http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids(
unknown
https://cvision.media.net/new/286x175/3/72/42/210/948f45db-f5a0-41ce-a6b6-5cc9e8c93c16.jpg?v=9
unknown
http://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_80%2Ch_334%2Cw_312%2Cc_fill%2Cg_faces%2Ce_sh
unknown
http://cdn.taboola.com/libtrc/impl.thin.277-63-RELEASE.js
unknown
https://www.ccleaner.com/go/app_cc_pro_trialkey
unknown
http://www.imvu.com/
unknown
https://contextual.media.net/8/nrrV73987.js
unknown
http://www.imvu.com
unknown
https://contextual.media.net/
unknown
http://widgets.outbrain.com/external/publishers/msn/MSNIdSync.js
unknown
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
unknown
http://www.msn.com/
unknown
https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
unknown
https://dc.ads.linkedin.com/collect/?pid=6883&opid=7850&fmt=gif&ck=&3pc=true&an_user_id=591650497549
unknown
http://cdn.at.atwola.com/_media/uac/msn.html
unknown
http://dis.criteo.com/dis/usersync.aspx?r=7&p=3&cp=appnexus&cu=1&url=http%3A%2F%2Fib.adnxs.com%2Fset
unknown
https://policies.yahoo.com/w3c/p3p.xml
unknown
http://www.msn.com/advertisement.ad.js
unknown
http://www.ebuddy.com
unknown
There are 42 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
yuahdgbceja.sytes.net
23.94.53.100
 malicious
geoplugin.net
178.237.33.50
 malicious

IPs

IP
Domain
Country
Malicious
23.94.54.101
unknown
United States
malicious
23.94.53.100
yuahdgbceja.sytes.net
United States
malicious
178.237.33.50
geoplugin.net
Netherlands
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Rmc-E70NOS
exepath
 malicious
HKEY_CURRENT_USER\Software\Rmc-E70NOS
licence
 malicious
HKEY_CURRENT_USER\Software\Rmc-E70NOS
time
 malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
yd#
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
Enabled
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
7i#
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
There are 7 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
720000
direct allocation
page read and write
 malicious
400000
system
page execute and read and write
 malicious
1070000
direct allocation
page read and write
 malicious
400000
system
page execute and read and write
 malicious
9EF000
heap
page read and write
16C000
stack
page read and write
220000
heap
page read and write
2E70000
direct allocation
page read and write
62A000
heap
page read and write
3560000
heap
page read and write
864000
heap
page read and write
670000
heap
page read and write
31D2000
heap
page read and write
64BF000
stack
page read and write
36BE000
direct allocation
page read and write
1D78000
heap
page read and write
206000
stack
page read and write
1D7E000
heap
page read and write
2A50000
unclassified section
page execute and read and write
679000
heap
page read and write
670000
heap
page read and write
317000
heap
page read and write
D11000
heap
page read and write
1291000
unkown
page execute read
446000
heap
page read and write
2970000
heap
page read and write
251F000
stack
page read and write
2C20000
direct allocation
page read and write
3430000
heap
page read and write
3710000
trusted library allocation
page read and write
2D80000
direct allocation
page read and write
1D6B000
heap
page read and write
28D000
stack
page read and write
310000
heap
page read and write
10000
heap
page read and write
17A000
stack
page read and write
3231000
heap
page read and write
670000
heap
page read and write
1D47000
heap
page read and write
22E0000
heap
page read and write
11C3000
heap
page read and write
2D20000
direct allocation
page read and write
397000
heap
page read and write
25C1000
heap
page read and write
1D40000
heap
page read and write
2EF000
stack
page read and write
2B0000
heap
page read and write
1DD9000
heap
page read and write
2E6F000
unkown
page read and write
6D2000
heap
page read and write
639000
heap
page read and write
478000
system
page execute and read and write
9F0000
unkown
page readonly
6AC000
heap
page read and write
1E35000
heap
page read and write
2B9A000
direct allocation
page read and write
474000
system
page execute and read and write
40BE000
direct allocation
page read and write
11E2000
heap
page read and write
93B000
heap
page read and write
1D6D000
heap
page read and write
2D20000
direct allocation
page read and write
620000
heap
page read and write
AB2000
unkown
page readonly
26CD000
heap
page read and write
34E000
heap
page read and write
2D0A000
direct allocation
page read and write
39A000
heap
page read and write
25C0000
trusted library allocation
page read and write
3D6000
heap
page read and write
2D90000
direct allocation
page read and write
28A0000
heap
page read and write
64F000
stack
page read and write
110000
direct allocation
page execute and read and write
3BB000
heap
page read and write
3E7000
heap
page read and write
6A0000
heap
page read and write
1D85000
heap
page read and write
35A000
heap
page read and write
36C000
heap
page read and write
3DB000
heap
page read and write
65AF000
stack
page read and write
9F1000
unkown
page execute read
6B8000
heap
page read and write
D41000
unkown
page execute read
670000
heap
page read and write
FC0000
heap
page read and write
5D7000
heap
page read and write
3710000
trusted library allocation
page read and write
35F000
heap
page read and write
3323000
heap
page read and write
6E0000
heap
page read and write
2EF0000
direct allocation
page read and write
221E000
stack
page read and write
2D0A000
direct allocation
page read and write
6E4000
heap
page read and write
6B0000
heap
page read and write
67F000
stack
page read and write
2E70000
direct allocation
page read and write
2D7000
heap
page read and write
1C0000
heap
page read and write
2D80000
direct allocation
page read and write
2E84000
direct allocation
page read and write
2B9A000
direct allocation
page read and write
E02000
unkown
page readonly
14D000
heap
page read and write
663000
heap
page read and write
2A9000
heap
page read and write
33D9000
heap
page read and write
2AC0000
direct allocation
page read and write
2C00000
unclassified section
page execute and read and write
89000
stack
page read and write
22A4000
heap
page read and write
2B0000
heap
page read and write
EA0000
heap
page read and write
2819000
trusted library allocation
page read and write
87C000
heap
page read and write
39E000
heap
page read and write
72BE000
direct allocation
page read and write
2D0000
heap
page read and write
396000
heap
page read and write
D40000
unkown
page readonly
222000
stack
page read and write
1110000
heap
page read and write
6B0000
heap
page read and write
19B000
stack
page read and write
132C000
unkown
page readonly
107A000
heap
page read and write
A8C000
unkown
page readonly
2D20000
direct allocation
page read and write
258E000
stack
page read and write
237E000
stack
page read and write
FC4000
heap
page read and write
1D75000
heap
page read and write
2D20000
direct allocation
page read and write
1D6E000
heap
page read and write
309F000
stack
page read and write
DD6000
heap
page read and write
2C10000
direct allocation
page read and write
3431000
heap
page read and write
1D48000
heap
page read and write
2BB0000
heap
page read and write
1D85000
heap
page read and write
1D68000
heap
page read and write
18B000
stack
page read and write
AC4000
unkown
page readonly
2B0000
remote allocation
page read and write
107B000
heap
page read and write
2E70000
direct allocation
page read and write
45C000
system
page execute and read and write
67C0000
heap
page read and write
66C000
stack
page read and write
A8C000
unkown
page readonly
2D14000
direct allocation
page read and write
897000
heap
page read and write
31AA000
heap
page read and write
2D11000
direct allocation
page read and write
D11000
heap
page read and write
11D9000
heap
page read and write
679000
heap
page read and write
10ED000
heap
page read and write
88C000
heap
page read and write
2CBE000
direct allocation
page read and write
2D00000
direct allocation
page read and write
14F000
heap
page read and write
45D000
system
page execute and read and write
FE2000
heap
page read and write
25BF000
stack
page read and write
26CD000
stack
page read and write
B9C000
heap
page read and write
2D14000
direct allocation
page read and write
3DE000
stack
page read and write
1360000
unkown
page write copy
632000
heap
page read and write
1E4B000
unclassified section
page execute and read and write
6B0000
heap
page read and write
2B9A000
direct allocation
page read and write
1E30000
heap
page read and write
1D6D000
heap
page read and write
8FC000
heap
page read and write
E0C000
unkown
page read and write
6B0000
heap
page read and write
88C000
heap
page read and write
672000
heap
page read and write
4D3000
heap
page read and write
5EBE000
direct allocation
page read and write
2D17000
direct allocation
page read and write
25C0000
trusted library allocation
page read and write
2C10000
direct allocation
page read and write
300000
heap
page read and write
1D6B000
heap
page read and write
1D7A000
heap
page read and write
400000
system
page execute and read and write
27D000
heap
page read and write
71F000
stack
page read and write
1D49000
heap
page read and write
507000
heap
page read and write
2E81000
direct allocation
page read and write
18C000
heap
page read and write
2C10000
direct allocation
page read and write
2610000
heap
page read and write
2E84000
direct allocation
page read and write
1D6D000
heap
page read and write
1DD2000
heap
page read and write
2D17000
direct allocation
page read and write
20CF000
stack
page read and write
41B000
system
page execute and read and write
B67000
heap
page read and write
2E87000
direct allocation
page read and write
2BFD000
stack
page read and write
670000
heap
page read and write
1D4A000
heap
page read and write
2D14000
direct allocation
page read and write
E10000
unkown
page write copy
2E90000
direct allocation
page read and write
2D80000
direct allocation
page read and write
395000
heap
page read and write
BBC000
heap
page read and write
2D11000
direct allocation
page read and write
36F000
stack
page read and write
1C6000
heap
page read and write
2D20000
direct allocation
page read and write
2C30000
direct allocation
page read and write
2C5D000
unclassified section
page execute and read and write
564000
heap
page read and write
395000
heap
page read and write
1D69000
heap
page read and write
2E70000
direct allocation
page read and write
3710000
trusted library allocation
page read and write
3E7000
heap
page read and write
2C30000
direct allocation
page read and write
C5B000
heap
page read and write
1D72000
heap
page read and write
10000
heap
page read and write
67F000
heap
page read and write
1D6E000
heap
page read and write
B84000
heap
page read and write
21F000
stack
page read and write
2D0A000
direct allocation
page read and write
3710000
trusted library allocation
page read and write
3D9000
heap
page read and write
1FDF000
stack
page read and write
3D9000
heap
page read and write
33D9000
heap
page read and write
1D81000
heap
page read and write
2E87000
direct allocation
page read and write
3DB000
heap
page read and write
3710000
trusted library allocation
page read and write
120000
heap
page read and write
9F0000
unkown
page readonly
1F8E000
stack
page read and write
33CB000
heap
page read and write
6D3000
heap
page read and write
6DF000
stack
page read and write
3710000
trusted library allocation
page read and write
CC000
stack
page read and write
232F000
stack
page read and write
1037000
heap
page read and write
3710000
trusted library allocation
page read and write
2D90000
direct allocation
page read and write
241F000
stack
page read and write
1D4F000
heap
page read and write
2D17000
direct allocation
page read and write
10000
heap
page read and write
2E87000
direct allocation
page read and write
BAB000
heap
page read and write
3230000
heap
page read and write
3710000
trusted library allocation
page read and write
C3B000
heap
page read and write
110B000
heap
page read and write
632000
heap
page read and write
E0C000
unkown
page write copy
2C59000
unclassified section
page execute and read and write
61E000
heap
page read and write
3710000
trusted library allocation
page read and write
6B0000
heap
page read and write
BAD000
heap
page read and write
2AFE000
stack
page read and write
1D4F000
heap
page read and write
69B000
heap
page read and write
2E81000
direct allocation
page read and write
38E4000
heap
page read and write
456000
system
page execute and read and write
3B4000
heap
page read and write
57A000
heap
page read and write
2E84000
direct allocation
page read and write
1EB0000
heap
page read and write
24BF000
stack
page read and write
2D17000
direct allocation
page read and write
107D000
heap
page read and write
25C0000
trusted library allocation
page read and write
22B000
stack
page read and write
22A8000
heap
page read and write
62A000
heap
page read and write
33D9000
heap
page read and write
5C7000
heap
page read and write
2C20000
direct allocation
page read and write
33D9000
heap
page read and write
1132000
heap
page read and write
1F00000
heap
page read and write
72C000
stack
page read and write
3BB000
heap
page read and write
500000
heap
page read and write
DDC000
unkown
page readonly
14E000
heap
page read and write
29EF000
stack
page read and write
110C000
heap
page read and write
2E84000
direct allocation
page read and write
650000
heap
page read and write
6B0000
heap
page read and write
5E4000
heap
page read and write
2D80000
direct allocation
page read and write
10016000
direct allocation
page execute and read and write
90000
heap
page read and write
356B000
heap
page read and write
2E90000
direct allocation
page read and write
3E7000
heap
page read and write
62F000
heap
page read and write
37E000
stack
page read and write
7E0000
heap
page read and write
1FB0000
heap
page read and write
2632000
heap
page read and write
663000
heap
page read and write
22A0000
heap
page read and write
1EF000
stack
page read and write
2C20000
direct allocation
page read and write
5A6000
heap
page read and write
CE3000
heap
page read and write
2EF0000
direct allocation
page read and write
1E4F000
unclassified section
page execute and read and write
205D000
stack
page read and write
24CF000
stack
page read and write
4ABE000
direct allocation
page read and write
5F4000
heap
page read and write
1D81000
heap
page read and write
238D000
stack
page read and write
10000
heap
page read and write
2E87000
direct allocation
page read and write
22AB000
heap
page read and write
50F000
stack
page read and write
5FF000
stack
page read and write
2D11000
direct allocation
page read and write
840000
heap
page read and write
2E90000
direct allocation
page read and write
1D49000
heap
page read and write
1030000
heap
page read and write
2E90000
direct allocation
page read and write
371000
heap
page read and write
1D8A000
heap
page read and write
228000
stack
page read and write
2D80000
direct allocation
page read and write
25F0000
heap
page read and write
9D1000
heap
page read and write
2D17000
direct allocation
page read and write
1EE6000
heap
page read and write
25CE000
stack
page read and write
2D11000
direct allocation
page read and write
2390000
heap
page read and write
6780000
heap
page read and write
2302000
heap
page read and write
108C000
heap
page read and write
2D14000
direct allocation
page read and write
2CB1000
direct allocation
page read and write
670000
heap
page read and write
190000
direct allocation
page execute and read and write
1D80000
heap
page read and write
6B0000
heap
page read and write
670000
heap
page read and write
371000
heap
page read and write
670000
heap
page read and write
225000
stack
page read and write
25C0000
heap
page read and write
2D0D000
direct allocation
page read and write
1D7C000
heap
page read and write
D01000
heap
page read and write
3D9000
heap
page read and write
BAC000
heap
page read and write
1220000
heap
page read and write
1D3C000
heap
page read and write
10000
heap
page read and write
1D6E000
heap
page read and write
6B0000
heap
page read and write
100000
trusted library allocation
page read and write
6EA000
heap
page read and write
395000
heap
page read and write
54F000
heap
page read and write
670000
heap
page read and write
395000
heap
page read and write
AB2000
unkown
page readonly
4AD000
heap
page read and write
10000
heap
page read and write
672F000
stack
page read and write
2AC0000
direct allocation
page read and write
1290000
unkown
page readonly
28EF000
stack
page read and write
1D85000
heap
page read and write
679000
heap
page read and write
9E8000
heap
page read and write
2D00000
direct allocation
page read and write
14E000
heap
page read and write
1291000
unkown
page execute read
670000
heap
page read and write
230000
trusted library allocation
page read and write
E14000
unkown
page readonly
63BE000
stack
page read and write
2AAC000
unclassified section
page execute and read and write
2D0A000
direct allocation
page read and write
674000
heap
page read and write
371000
heap
page read and write
670000
heap
page read and write
355F000
stack
page read and write
2C30000
direct allocation
page read and write
2EF0000
direct allocation
page read and write
1D68000
heap
page read and write
2E87000
direct allocation
page read and write
1D90000
direct allocation
page read and write
3C7D000
stack
page read and write
410000
heap
page read and write
20B000
stack
page read and write
9D3000
heap
page read and write
3710000
trusted library allocation
page read and write
3710000
trusted library allocation
page read and write
D41000
unkown
page execute read
1D79000
heap
page read and write
1D45000
heap
page read and write
1D48000
heap
page read and write
19D000
stack
page read and write
2B9A000
direct allocation
page read and write
112B000
heap
page read and write
10FC000
heap
page read and write
130000
direct allocation
page read and write
21AE000
stack
page read and write
31A8000
heap
page read and write
31A8000
heap
page read and write
4CE000
heap
page read and write
D22000
heap
page read and write
474000
system
page execute and read and write
88A000
heap
page read and write
2614000
heap
page read and write
11B3000
heap
page read and write
2C10000
direct allocation
page read and write
670000
heap
page read and write
675000
heap
page read and write
2B9A000
direct allocation
page read and write
25C1000
heap
page read and write
6B0000
heap
page read and write
22E4000
heap
page read and write
2BF0000
direct allocation
page read and write
68E000
heap
page read and write
C2E000
heap
page read and write
B60000
heap
page read and write
2D00000
direct allocation
page read and write
270000
heap
page read and write
1F10000
heap
page read and write
62F000
heap
page read and write
2C30000
direct allocation
page read and write
2D0A000
direct allocation
page read and write
31AA000
heap
page read and write
1D85000
heap
page read and write
C3C000
heap
page read and write
594000
heap
page read and write
270000
heap
page read and write
31D2000
heap
page read and write
524000
heap
page read and write
11C2000
heap
page read and write
90B000
heap
page read and write
257F000
stack
page read and write
6B0000
heap
page read and write
CF2000
heap
page read and write
2E70000
direct allocation
page read and write
88C000
heap
page read and write
90B000
heap
page read and write
2D0A000
direct allocation
page read and write
180000
heap
page read and write
1EAC000
stack
page read and write
459000
system
page execute and read and write
1364000
unkown
page readonly
2C20000
direct allocation
page read and write
1DD2000
heap
page read and write
1D97000
heap
page read and write
1D4F000
heap
page read and write
5D0000
heap
page read and write
243E000
stack
page read and write
8B0000
heap
page read and write
1290000
unkown
page readonly
24F000
stack
page read and write
260000
heap
page read and write
3E0F000
stack
page read and write
1D6D000
heap
page read and write
1D6D000
heap
page read and write
3DB000
heap
page read and write
86BE000
direct allocation
page read and write
2B9D000
direct allocation
page read and write
3710000
trusted library allocation
page read and write
11E1000
heap
page read and write
4D1000
heap
page read and write
3231000
heap
page read and write
4BE000
heap
page read and write
1D76000
heap
page read and write
400000
system
page execute and read and write
62F000
heap
page read and write
107B000
heap
page read and write
656E000
stack
page read and write
370F000
stack
page read and write
675000
heap
page read and write
71F000
stack
page read and write
273F000
stack
page read and write
31DA000
heap
page read and write
2C73000
unclassified section
page execute and read and write
65F0000
heap
page read and write
679000
heap
page read and write
10000
heap
page read and write
3130000
heap
page read and write
9C2000
heap
page read and write
760000
heap
page read and write
473000
system
page execute and read and write
6A8000
heap
page read and write
140000
heap
page read and write
6B0000
heap
page read and write
31AA000
heap
page read and write
11F000
stack
page read and write
1D47000
heap
page read and write
140000
heap
page read and write
679000
heap
page read and write
670000
heap
page read and write
368000
heap
page read and write
2AC0000
direct allocation
page read and write
1DC000
stack
page read and write
2E81000
direct allocation
page read and write
540000
heap
page read and write
6A4000
heap
page read and write
90BE000
direct allocation
page read and write
2B9D000
direct allocation
page read and write
2700000
trusted library allocation
page read and write
1D8A000
heap
page read and write
DD0000
heap
page read and write
1364000
unkown
page readonly
38E0000
heap
page read and write
2EF0000
direct allocation
page read and write
6B0000
heap
page read and write
110000
direct allocation
page execute and read and write
2D90000
direct allocation
page read and write
3DB000
heap
page read and write
2D0D000
direct allocation
page read and write
C2C000
heap
page read and write
ABC000
unkown
page read and write
9F2000
heap
page read and write
BAA000
heap
page read and write
2E81000
direct allocation
page read and write
146000
heap
page read and write
657000
heap
page read and write
214E000
stack
page read and write
10001000
direct allocation
page execute and read and write
675000
heap
page read and write
3120000
heap
page read and write
10000
heap
page read and write
2B9D000
direct allocation
page read and write
F70000
heap
page read and write
3710000
trusted library allocation
page read and write
28E000
stack
page read and write
2D11000
direct allocation
page read and write
639000
heap
page read and write
10000000
direct allocation
page read and write
2AA6000
unclassified section
page execute and read and write
3E7000
heap
page read and write
5A0000
heap
page read and write
2D80000
direct allocation
page read and write
28C000
heap
page read and write
547000
heap
page read and write
1D6D000
heap
page read and write
1D5E000
stack
page read and write
39E000
heap
page read and write
6FC000
stack
page read and write
24F0000
heap
page read and write
2EF0000
direct allocation
page read and write
BAB000
heap
page read and write
2C5000
heap
page read and write
847000
heap
page read and write
371000
heap
page read and write
2D0D000
direct allocation
page read and write
3131000
heap
page read and write
2EF0000
direct allocation
page read and write
1D79000
heap
page read and write
31E000
stack
page read and write
20A000
stack
page read and write
2C30000
direct allocation
page read and write
2E90000
direct allocation
page read and write
708000
heap
page read and write
639000
heap
page read and write
1D45000
heap
page read and write
2C30000
direct allocation
page read and write
2D80000
direct allocation
page read and write
2D0D000
direct allocation
page read and write
2E84000
direct allocation
page read and write
33DB000
heap
page read and write
73F000
stack
page read and write
91C000
heap
page read and write
64F0000
heap
page read and write
1D20000
heap
page read and write
9F1000
unkown
page execute read
69BF000
stack
page read and write
3D9000
heap
page read and write
2E70000
direct allocation
page read and write
13E000
stack
page read and write
31AA000
heap
page read and write
E14000
unkown
page readonly
590000
heap
page read and write
ABC000
unkown
page write copy
35D000
stack
page read and write
2AC0000
direct allocation
page read and write
1D6D000
heap
page read and write
1D1E000
stack
page read and write
AC4000
unkown
page readonly
11C3000
heap
page read and write
68F000
stack
page read and write
261D000
heap
page read and write
296E000
stack
page read and write
14F000
heap
page read and write
146000
heap
page read and write
107D000
heap
page read and write
33EB000
heap
page read and write
135C000
unkown
page read and write
2D0D000
direct allocation
page read and write
D40000
unkown
page readonly
135C000
unkown
page write copy
3710000
trusted library allocation
page read and write
3BB000
heap
page read and write
3BB000
heap
page read and write
3D6000
heap
page read and write
2D80000
direct allocation
page read and write
3D6000
heap
page read and write
840000
heap
page read and write
690000
direct allocation
page read and write
65F000
stack
page read and write
2D14000
direct allocation
page read and write
88B000
heap
page read and write
132C000
unkown
page readonly
24AF000
stack
page read and write
89B000
heap
page read and write
2D80000
direct allocation
page read and write
1352000
unkown
page readonly
1D6D000
heap
page read and write
25C0000
trusted library allocation
page read and write
3E7000
heap
page read and write
10000
heap
page read and write
27A000
stack
page read and write
68BE000
direct allocation
page read and write
1D3C000
heap
page read and write
663000
heap
page read and write
670000
heap
page read and write
3DF000
stack
page read and write
2E81000
direct allocation
page read and write
E02000
unkown
page readonly
107D000
heap
page read and write
3710000
trusted library allocation
page read and write
673000
heap
page read and write
2813000
trusted library allocation
page read and write
1352000
unkown
page readonly
1114000
heap
page read and write
8B4000
heap
page read and write
2E84000
direct allocation
page read and write
62A000
heap
page read and write
2E90000
direct allocation
page read and write
2D80000
direct allocation
page read and write
1054000
heap
page read and write
3710000
trusted library allocation
page read and write
2E81000
direct allocation
page read and write
2D90000
direct allocation
page read and write
1D6D000
heap
page read and write
C1C000
heap
page read and write
2AC0000
direct allocation
page read and write
3B4000
heap
page read and write
1E30000
unclassified section
page execute and read and write
3710000
trusted library allocation
page read and write
3B4000
heap
page read and write
2D00000
direct allocation
page read and write
9D2000
heap
page read and write
2B0000
remote allocation
page read and write
2C20000
direct allocation
page read and write
2D80000
direct allocation
page read and write
AC0000
unkown
page write copy
2B9D000
direct allocation
page read and write
59D000
heap
page read and write
1E2F000
stack
page read and write
BAD000
heap
page read and write
478000
system
page execute and read and write
1E6B000
heap
page read and write
2C20000
direct allocation
page read and write
1EC000
stack
page read and write
2AF000
stack
page read and write
2D17000
direct allocation
page read and write
1D49000
heap
page read and write
88C000
heap
page read and write
380000
heap
page read and write
1D0000
heap
page read and write
CF3000
heap
page read and write
890000
heap
page read and write
7CBE000
direct allocation
page read and write
230000
heap
page read and write
6A9000
heap
page read and write
2C10000
direct allocation
page read and write
10FC000
heap
page read and write
DDC000
unkown
page readonly
6AD000
heap
page read and write
2C10000
direct allocation
page read and write
2D14000
direct allocation
page read and write
70F000
stack
page read and write
6EF000
stack
page read and write
70F000
stack
page read and write
2500000
heap
page read and write
107C000
heap
page read and write
670000
heap
page read and write
3710000
trusted library allocation
page read and write
10FC000
heap
page read and write
490000
heap
page read and write
1D6E000
heap
page read and write
39E000
heap
page read and write
2AC0000
direct allocation
page read and write
400000
system
page execute and read and write
679000
heap
page read and write
2800000
trusted library allocation
page read and write
2D0D000
direct allocation
page read and write
41F000
system
page execute and read and write
2D0000
heap
page read and write
2A0000
heap
page read and write
CF3000
heap
page read and write
16C000
stack
page read and write
261C000
heap
page read and write
91B000
heap
page read and write
2B9D000
direct allocation
page read and write
C2B000
heap
page read and write
1D3C000
heap
page read and write
106C000
heap
page read and write
5C0000
heap
page read and write
2D80000
direct allocation
page read and write
3D6000
heap
page read and write
2D00000
direct allocation
page read and write
90C000
heap
page read and write
224000
stack
page read and write
339C000
heap
page read and write
212F000
stack
page read and write
23A1000
heap
page read and write
10000
heap
page read and write
2D90000
direct allocation
page read and write
1DAB000
heap
page read and write
88B000
heap
page read and write
2BF0000
heap
page read and write
2E87000
direct allocation
page read and write
31AE000
heap
page read and write
2D20000
direct allocation
page read and write
846000
heap
page read and write
4EF000
stack
page read and write
39E000
heap
page read and write
679000
heap
page read and write
632000
heap
page read and write
2D90000
direct allocation
page read and write
54BE000
direct allocation
page read and write
242F000
stack
page read and write
1D48000
heap
page read and write
74F000
stack
page read and write
2D11000
direct allocation
page read and write
2D00000
direct allocation
page read and write
3B4000
heap
page read and write
3DB000
heap
page read and write
There are 754 hidden memdumps, click here to show them.