IOC Report
bRlvBJEl6T.exe

loading gif

Files

File Path
Type
Category
Malicious
bRlvBJEl6T.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\334343\Holdem.pif
PE32 executable (GUI) Intel 80386, for MS Windows
modified
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\FIJKEHJJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\GHJDGDBFCBKFHJKFHCBK
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\IIIJECAEGDHIDHJKKKKFIEGIJK
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\JEBKJDAF
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJECAAEHCFIEBGCBGHIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJJKEHCA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KKJJEBFC
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
modified
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\334343\e
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Classics
ASCII text, with very long lines (1426), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Classics.cmd (copy)
ASCII text, with very long lines (1426), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Creating
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Experiences
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199680449169[1].htm
HTML document, Unicode text, UTF-8 text, with very long lines (2969), with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lease
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Oil
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Pharmacy
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Relatives
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Returned
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Rolled
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Supervision
data
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\bRlvBJEl6T.exe
"C:\Users\user\Desktop\bRlvBJEl6T.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k move Classics Classics.cmd & Classics.cmd & exit
 malicious
C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
malicious
C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
malicious
C:\Windows\SysWOW64\cmd.exe
cmd /c md 334343
 malicious
C:\Windows\SysWOW64\findstr.exe
findstr /V "BbcAdvisorsAndaleNowhere" Lease
malicious
C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Pharmacy + Experiences + Creating 334343\e
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\334343\Holdem.pif
334343\Holdem.pif 334343\e
 malicious
C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\tasklist.exe
tasklist
There are 2 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://duckduckgo.com/chrome_newtab
unknown
https://65.108.152.56:9000/(
unknown
https://65.108.152.56:9000/)
unknown
https://duckduckgo.com/ac/?q=
unknown
https://steamcommunity.com/?subsection=broadcasts
unknown
https://65.108.152.56:9000/mozglue.dll
unknown
https://65.108.152.56:9000/softokn3.dlldge
unknown
https://65.108.152.56:9000
unknown
https://store.steampowered.com/subscriber_agreement/
unknown
https://65.108.152.56:9000/vcruntime140.dll
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
unknown
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ZQOnBoEs
unknown
https://www.autoitscript.com/autoit3/
unknown
https://steamcommunity.com/profiles/76561199680449169
23.195.238.96
http://www.valvesoftware.com/legal.htm
unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=rG2l
unknown
https://65.108.152.56:9000/nss3.dll_
unknown
https://65.108.152.56:9000/vcruntime140.dllw
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
unknown
https://65.108.152.56:9000/nss3.dll
unknown
https://65.108.152.56:9000/nss3.dllft
unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
unknown
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en
unknown
https://65.108.152.56:9000el
unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
unknown
https://65.108.152.56:9000/freebl3.dll
unknown
http://www.autoitscript.com/autoit3/J
unknown
https://65.108.152.56:9000/i
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
unknown
https://steamcommunity.com/q
unknown
http://store.steampowered.com/privacy_agreement/
unknown
https://store.steampowered.com/points/shop/
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
https://steamcommunity.com/profiles/76561199680449169/badges
unknown
https://www.ecosia.org/newtab/
unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
unknown
https://store.steampowered.com/privacy_agreement/
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
unknown
https://65.108.152.56:9000/f35bosoft
unknown
https://65.108.152.56:9000/D
unknown
https://steamcommunity.com/profiles/76561199680449169I~
unknown
https://community.akamai.steamstatic
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
unknown
https://65.108.152.56:9000/soft
unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
unknown
https://65.108.152.56:9000/softokn3.dll
unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
unknown
https://65.108.152.56:9000/
unknown
https://65.108.152.56:9000/mozglue.dllEdge
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
https://www.valvesoftware.com/en/contact?contact-person=T
unknown
https://65.108.152.56:9000/B
unknown
https://65.108.152.56:9000/vcruntime140.dllser
unknown
https://65.108.152.56:9000ing
unknown
https://65.108.152.56:9000/A
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
unknown
https://store.steampowered.com/about/
unknown
https://steamcommunity.com/my/wishlist/
unknown
http://ocsp.sectigo.com0
unknown
https://65.108.152.56/
unknown
https://65.108.152.56:9000/vcruntime140.dll_7)
unknown
https://help.steampowered.com/en/
unknown
https://steamcommunity.com/market/
unknown
https://store.steampowered.com/news/
unknown
https://65.108.152.56:9000/vcruntime140.dll=cv6
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://store.steampowered.com/subscriber_agreement/
unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199680449169
unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
unknown
https://steamcommunity.com/discussions/
unknown
https://65.108.152.56:9000/freebl3.dllB
unknown
https://t.me/r1g1o
unknown
https://store.steampowered.com/stats/
unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
unknown
https://store.steampowered.com/steam_refunds/
unknown
https://65.108.152.56:9000/.152.56:9000/softokn3.dllessionKeyBackwarda_1
unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=yXrh2LzpDwct&l=e
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://65.108.152.56:9000l
unknown
https://65.108.152.56:9000/msvcp140.dll
unknown
https://steamcommunity.com/A
unknown
https://steamcommunity.com/workshop/
unknown
https://store.steampowered.com/legal/
unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
steamcommunity.com
23.195.238.96
ekyLBwoLvc.ekyLBwoLvc
unknown

IPs

IP
Domain
Country
Malicious
127.0.0.1
unknown
unknown
malicious
65.108.152.56
unknown
United States
23.195.238.96
steamcommunity.com
United States

Memdumps

Base Address
Regiontype
Protect
Malicious
11D6000
trusted library allocation
page read and write
 malicious
38AB000
trusted library allocation
page read and write
 malicious
11D7000
trusted library allocation
page read and write
 malicious
10B0000
heap
page read and write
 malicious
1141000
trusted library allocation
page read and write
 malicious
13A5000
trusted library allocation
page read and write
 malicious
38A1000
direct allocation
page execute and read and write
 malicious
1141000
trusted library allocation
page read and write
 malicious
13A5000
trusted library allocation
page read and write
 malicious
1006000
heap
page read and write
 malicious
35D1000
heap
page read and write
AE2000
heap
page read and write
10AC000
heap
page read and write
35D1000
heap
page read and write
1349000
trusted library allocation
page read and write
12F0000
trusted library allocation
page read and write
12DD000
trusted library allocation
page read and write
AA0000
unkown
page readonly
12EE000
trusted library allocation
page read and write
118C000
trusted library allocation
page read and write
401000
unkown
page execute read
11D7000
trusted library allocation
page read and write
12FA000
trusted library allocation
page read and write
709000
heap
page read and write
106C000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
1060000
heap
page read and write
35D1000
heap
page read and write
12FA000
trusted library allocation
page read and write
35D1000
heap
page read and write
1441000
trusted library allocation
page read and write
35D1000
heap
page read and write
DF3000
heap
page read and write
1205000
trusted library allocation
page read and write
1663000
trusted library allocation
page read and write
35D0000
heap
page read and write
AC8000
heap
page read and write
35D1000
heap
page read and write
10AA000
heap
page read and write
1441000
trusted library allocation
page read and write
1441000
trusted library allocation
page read and write
A8F000
heap
page read and write
1097000
heap
page read and write
6F4000
heap
page read and write
1241000
trusted library allocation
page read and write
22F0000
heap
page read and write
1517000
trusted library allocation
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
B60000
unkown
page write copy
61BA000
trusted library allocation
page read and write
CC0000
heap
page read and write
354D000
stack
page read and write
A6D000
heap
page read and write
4A2E000
stack
page read and write
709000
heap
page read and write
1400000
trusted library allocation
page read and write
711000
heap
page read and write
35D1000
heap
page read and write
105B000
heap
page read and write
6F4000
heap
page read and write
1140000
trusted library allocation
page read and write
6E8000
heap
page read and write
39C8000
direct allocation
page execute and read and write
E4B000
heap
page read and write
1523000
trusted library allocation
page read and write
1502000
trusted library allocation
page read and write
1302000
trusted library allocation
page read and write
BFF000
stack
page read and write
B64000
unkown
page write copy
105D000
heap
page read and write
92E000
stack
page read and write
43A000
unkown
page readonly
87C000
stack
page read and write
35D1000
heap
page read and write
1358000
trusted library allocation
page read and write
14AB000
trusted library allocation
page read and write
3880000
trusted library allocation
page read and write
12DD000
trusted library allocation
page read and write
1026000
heap
page read and write
27A0000
heap
page read and write
A80000
heap
page read and write
10A1000
heap
page read and write
8E0000
heap
page read and write
1297000
trusted library allocation
page read and write
1095000
heap
page read and write
12FA000
trusted library allocation
page read and write
AA1000
unkown
page execute read
10AB000
heap
page read and write
1026000
heap
page read and write
35D1000
heap
page read and write
1241000
trusted library allocation
page read and write
711000
heap
page read and write
EFA000
heap
page read and write
1241000
trusted library allocation
page read and write
A7A000
heap
page read and write
F32000
heap
page read and write
1523000
trusted library allocation
page read and write
6F9000
heap
page read and write
1441000
trusted library allocation
page read and write
709000
heap
page read and write
401000
unkown
page execute read
12E7000
trusted library allocation
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
14B0000
trusted library allocation
page read and write
1241000
trusted library allocation
page read and write
6F4000
heap
page read and write
35D1000
heap
page read and write
B30000
unkown
page readonly
1441000
trusted library allocation
page read and write
8CC000
stack
page read and write
1141000
trusted library allocation
page read and write
1441000
trusted library allocation
page read and write
4AA0000
heap
page read and write
6FD000
heap
page read and write
535000
heap
page read and write
1026000
heap
page read and write
1273000
trusted library allocation
page read and write
A7C000
heap
page read and write
3A0C000
direct allocation
page execute and read and write
39CE000
direct allocation
page execute and read and write
A05000
heap
page read and write
105E000
heap
page read and write
10F6000
heap
page read and write
6FD000
heap
page read and write
35D1000
heap
page read and write
5C93000
trusted library allocation
page read and write
49EF000
stack
page read and write
A71000
heap
page read and write
1241000
trusted library allocation
page read and write
118C000
trusted library allocation
page read and write
9FE000
stack
page read and write
530000
heap
page read and write
83C000
stack
page read and write
AFD000
heap
page read and write
1400000
trusted library allocation
page read and write
1024D000
direct allocation
page readonly
3880000
heap
page read and write
35D1000
heap
page read and write
1223000
trusted library allocation
page read and write
35D1000
heap
page read and write
6E8000
heap
page read and write
6DF000
heap
page read and write
18BC000
stack
page read and write
109B000
heap
page read and write
35D1000
heap
page read and write
1522000
trusted library allocation
page read and write
10F8000
heap
page read and write
AFD000
heap
page read and write
6F4000
heap
page read and write
974000
heap
page read and write
132C000
trusted library allocation
page read and write
12EF000
trusted library allocation
page read and write
1026000
heap
page read and write
A48000
heap
page read and write
1026000
heap
page read and write
2788000
heap
page read and write
14A5000
trusted library allocation
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
709000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
10F1000
heap
page read and write
539E000
stack
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
6318000
trusted library allocation
page read and write
709000
heap
page read and write
10F8000
heap
page read and write
114F000
trusted library allocation
page read and write
6B0000
heap
page read and write
10F8000
heap
page read and write
9BE000
stack
page read and write
137D000
trusted library allocation
page read and write
22E0000
heap
page read and write
1502000
trusted library allocation
page read and write
A8F000
heap
page read and write
97D000
stack
page read and write
1059000
heap
page read and write
EDF000
heap
page read and write
109D000
heap
page read and write
35D1000
heap
page read and write
15C7000
trusted library allocation
page read and write
12F9000
trusted library allocation
page read and write
35D1000
heap
page read and write
1390000
trusted library allocation
page read and write
1441000
trusted library allocation
page read and write
105C000
heap
page read and write
427000
unkown
page read and write
716000
heap
page read and write
9C0000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
10B1000
heap
page read and write
10B1000
heap
page read and write
35D1000
heap
page read and write
1441000
trusted library allocation
page read and write
35D1000
heap
page read and write
2782000
heap
page read and write
A85000
heap
page read and write
1063000
heap
page read and write
88C000
stack
page read and write
1573000
trusted library allocation
page read and write
B30000
unkown
page readonly
1291000
trusted library allocation
page read and write
35D1000
heap
page read and write
106C000
heap
page read and write
5C3F000
stack
page read and write
6F9000
heap
page read and write
15DC000
trusted library allocation
page read and write
4A50000
heap
page read and write
35D1000
heap
page read and write
35E0000
heap
page read and write
1091000
heap
page read and write
408000
unkown
page readonly
35D1000
heap
page read and write
709000
heap
page read and write
1026000
heap
page read and write
6F4000
heap
page read and write
1441000
trusted library allocation
page read and write
1241000
trusted library allocation
page read and write
1026000
heap
page read and write
35D1000
heap
page read and write
A3C000
stack
page read and write
B69000
unkown
page readonly
60B4000
trusted library allocation
page read and write
62FA000
trusted library allocation
page read and write
D40000
heap
page read and write
6E8000
heap
page read and write
278A000
heap
page read and write
4AED000
stack
page read and write
731000
heap
page read and write
35D1000
heap
page read and write
12DD000
trusted library allocation
page read and write
15DB000
trusted library allocation
page read and write
40A000
unkown
page write copy
150C000
trusted library allocation
page read and write
2330000
heap
page read and write
1441000
trusted library allocation
page read and write
408000
unkown
page readonly
1093000
heap
page read and write
430000
unkown
page read and write
534F000
stack
page read and write
35D1000
heap
page read and write
6F9000
heap
page read and write
1344000
trusted library allocation
page read and write
6F9000
heap
page read and write
1441000
trusted library allocation
page read and write
35D1000
heap
page read and write
12E4000
trusted library allocation
page read and write
35D1000
heap
page read and write
11D7000
trusted library allocation
page read and write
10A8000
heap
page read and write
12E7000
trusted library allocation
page read and write
709000
heap
page read and write
61B3000
trusted library allocation
page read and write
AA1000
unkown
page execute read
A7C000
heap
page read and write
D2F000
stack
page read and write
10E0000
heap
page read and write
6FD000
heap
page read and write
43A000
unkown
page readonly
1141000
trusted library allocation
page read and write
A90000
heap
page read and write
35D1000
heap
page read and write
BFE000
stack
page read and write
CAE000
stack
page read and write
1026000
heap
page read and write
35D1000
heap
page read and write
1141000
trusted library allocation
page read and write
1141000
trusted library allocation
page read and write
35D1000
heap
page read and write
98000
stack
page read and write
AED000
heap
page read and write
10A5000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
15C8000
trusted library allocation
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
70F000
heap
page read and write
10F8000
heap
page read and write
C3E000
stack
page read and write
1502000
trusted library allocation
page read and write
35D1000
heap
page read and write
1241000
trusted library allocation
page read and write
49AE000
stack
page read and write
711000
heap
page read and write
A00000
heap
page read and write
3AA6000
direct allocation
page execute and read and write
15DC000
trusted library allocation
page read and write
60B0000
trusted library allocation
page read and write
A8B000
heap
page read and write
1056000
heap
page read and write
440000
heap
page read and write
AE9000
heap
page read and write
2792000
heap
page read and write
B0A000
heap
page read and write
10242000
direct allocation
page read and write
118C000
trusted library allocation
page read and write
1241000
trusted library allocation
page read and write
1241000
trusted library allocation
page read and write
13E6000
trusted library allocation
page read and write
3880000
trusted library allocation
page read and write
13A5000
trusted library allocation
page read and write
930000
heap
page read and write
583E000
stack
page read and write
133B000
trusted library allocation
page read and write
579D000
stack
page read and write
1020F000
direct allocation
page readonly
1241000
trusted library allocation
page read and write
1241000
trusted library allocation
page read and write
35D1000
heap
page read and write
DC0000
heap
page read and write
118C000
trusted library allocation
page read and write
35D1000
heap
page read and write
6F9000
heap
page read and write
13A4000
trusted library allocation
page read and write
B60000
unkown
page read and write
6FD000
heap
page read and write
B0B000
heap
page read and write
13F5000
trusted library allocation
page read and write
CEE000
stack
page read and write
10AD000
heap
page read and write
731000
heap
page read and write
11D7000
trusted library allocation
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
9C6000
heap
page read and write
709000
heap
page read and write
10000000
direct allocation
page execute and read and write
A94000
heap
page read and write
30E2000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
4A6F000
stack
page read and write
40A000
unkown
page read and write
10F8000
heap
page read and write
3200000
heap
page read and write
2785000
heap
page read and write
12FA000
trusted library allocation
page read and write
35D1000
heap
page read and write
C60000
trusted library allocation
page read and write
71B000
heap
page read and write
940000
heap
page read and write
35D1000
heap
page read and write
6E8000
heap
page read and write
193E000
stack
page read and write
38D5000
direct allocation
page execute and read and write
1069000
heap
page read and write
1141000
trusted library allocation
page read and write
970000
heap
page read and write
35D1000
heap
page read and write
13CE000
trusted library allocation
page read and write
35D1000
heap
page read and write
49EF000
stack
page read and write
1062000
heap
page read and write
15C8000
trusted library allocation
page read and write
12F0000
trusted library allocation
page read and write
35D1000
heap
page read and write
CC7000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
92E000
stack
page read and write
15F4000
trusted library allocation
page read and write
A83000
heap
page read and write
1293000
trusted library allocation
page read and write
DDF000
heap
page read and write
1026000
heap
page read and write
15DC000
trusted library allocation
page read and write
6E8000
heap
page read and write
12FA000
trusted library allocation
page read and write
10008000
direct allocation
page execute read
400000
unkown
page readonly
B56000
unkown
page readonly
A62000
heap
page read and write
A6C000
heap
page read and write
13A5000
trusted library allocation
page read and write
6F9000
heap
page read and write
709000
heap
page read and write
35D1000
heap
page read and write
150B000
trusted library allocation
page read and write
42B000
unkown
page read and write
12DD000
trusted library allocation
page read and write
35D1000
heap
page read and write
15DC000
trusted library allocation
page read and write
1400000
trusted library allocation
page read and write
AEE000
heap
page read and write
6EA000
heap
page read and write
10B1000
heap
page read and write
1441000
trusted library allocation
page read and write
6F9000
heap
page read and write
1440000
trusted library allocation
page read and write
19A000
stack
page read and write
930000
heap
page read and write
35D1000
heap
page read and write
6F4000
heap
page read and write
B0F000
heap
page read and write
71B000
heap
page read and write
1026000
heap
page read and write
B0F000
heap
page read and write
A94000
heap
page read and write
105B000
heap
page read and write
129C000
trusted library allocation
page read and write
277F000
stack
page read and write
D64000
heap
page read and write
A8A000
heap
page read and write
1043000
heap
page read and write
A71000
heap
page read and write
1516000
trusted library allocation
page read and write
4A70000
heap
page read and write
1441000
trusted library allocation
page read and write
15F3000
trusted library allocation
page read and write
106B000
heap
page read and write
35D1000
heap
page read and write
1441000
trusted library allocation
page read and write
A14000
stack
page read and write
1441000
trusted library allocation
page read and write
6FD000
heap
page read and write
1441000
trusted library allocation
page read and write
A7E000
heap
page read and write
7EE000
stack
page read and write
D0F000
stack
page read and write
5800000
remote allocation
page read and write
1241000
trusted library allocation
page read and write
6FD000
heap
page read and write
35D1000
heap
page read and write
1099000
heap
page read and write
31D0000
heap
page read and write
46ED000
stack
page read and write
35D1000
heap
page read and write
6F4000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
1055000
heap
page read and write
10AD000
heap
page read and write
10001000
direct allocation
page execute read
6F9000
heap
page read and write
BBE000
stack
page read and write
6FD000
heap
page read and write
71B000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
150C000
trusted library allocation
page read and write
2784000
heap
page read and write
10DF000
heap
page read and write
1065000
heap
page read and write
1026000
heap
page read and write
1241000
trusted library allocation
page read and write
10B1000
heap
page read and write
717000
heap
page read and write
12ED000
trusted library allocation
page read and write
18FE000
stack
page read and write
278E000
heap
page read and write
35D1000
heap
page read and write
10B1000
heap
page read and write
6E8000
heap
page read and write
D20000
heap
page read and write
2788000
heap
page read and write
35D1000
heap
page read and write
B00000
heap
page read and write
1024A000
direct allocation
page readonly
109F000
heap
page read and write
35D1000
heap
page read and write
6E4000
heap
page read and write
3204000
heap
page read and write
1441000
trusted library allocation
page read and write
1241000
trusted library allocation
page read and write
10166000
direct allocation
page execute read
35D1000
heap
page read and write
5C70000
trusted library allocation
page read and write
63BF000
trusted library allocation
page read and write
1189000
trusted library allocation
page read and write
1584000
trusted library allocation
page read and write
709000
heap
page read and write
1067000
heap
page read and write
6FD000
heap
page read and write
133A000
trusted library allocation
page read and write
1517000
trusted library allocation
page read and write
35D1000
heap
page read and write
6F9000
heap
page read and write
1064000
heap
page read and write
121C000
trusted library allocation
page read and write
6F4000
heap
page read and write
DA0000
heap
page read and write
63C1000
trusted library allocation
page read and write
6E8000
heap
page read and write
12FB000
trusted library allocation
page read and write
10A3000
heap
page read and write
2787000
heap
page read and write
6F4000
heap
page read and write
35D1000
heap
page read and write
1441000
trusted library allocation
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
150C000
trusted library allocation
page read and write
1441000
trusted library allocation
page read and write
1517000
trusted library allocation
page read and write
11D7000
trusted library allocation
page read and write
C50000
direct allocation
page execute and read and write
1441000
trusted library allocation
page read and write
35D1000
heap
page read and write
AFD000
heap
page read and write
10ED000
heap
page read and write
1024F000
direct allocation
page readonly
A0E000
stack
page read and write
1241000
trusted library allocation
page read and write
134B000
trusted library allocation
page read and write
1223000
trusted library allocation
page read and write
330E000
stack
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
B7F000
stack
page read and write
731000
heap
page read and write
1441000
trusted library allocation
page read and write
1391000
trusted library allocation
page read and write
344C000
stack
page read and write
CAF000
stack
page read and write
B56000
unkown
page readonly
3ADC000
direct allocation
page execute and read and write
1020D000
direct allocation
page execute read
1241000
trusted library allocation
page read and write
B01000
heap
page read and write
340F000
stack
page read and write
E8B000
heap
page read and write
12F0000
trusted library allocation
page read and write
2788000
heap
page read and write
6F4000
heap
page read and write
A7C000
heap
page read and write
5800000
remote allocation
page read and write
10E9000
heap
page read and write
35D1000
heap
page read and write
A7F000
heap
page read and write
1517000
trusted library allocation
page read and write
6FD000
heap
page read and write
FE7000
heap
page read and write
1141000
trusted library allocation
page read and write
4F4E000
stack
page read and write
433000
unkown
page read and write
128D000
trusted library allocation
page read and write
A71000
heap
page read and write
1141000
trusted library allocation
page read and write
14A0000
trusted library allocation
page read and write
709000
heap
page read and write
6F9000
heap
page read and write
711000
heap
page read and write
10F0000
heap
page read and write
67F000
stack
page read and write
35D1000
heap
page read and write
6E8000
heap
page read and write
1241000
trusted library allocation
page read and write
1241000
trusted library allocation
page read and write
1517000
trusted library allocation
page read and write
1141000
trusted library allocation
page read and write
5800000
remote allocation
page read and write
520000
heap
page read and write
1241000
trusted library allocation
page read and write
35D1000
heap
page read and write
1502000
trusted library allocation
page read and write
AC0000
heap
page read and write
40C000
unkown
page read and write
12F0000
trusted library allocation
page read and write
60B6000
trusted library allocation
page read and write
AA0000
unkown
page readonly
35D1000
heap
page read and write
A40000
heap
page read and write
1026000
heap
page read and write
1026000
heap
page read and write
1066000
heap
page read and write
2784000
heap
page read and write
930000
heap
page read and write
D25000
heap
page read and write
C60000
heap
page read and write
36D0000
trusted library allocation
page read and write
1026000
heap
page read and write
E11000
heap
page read and write
15F4000
trusted library allocation
page read and write
9BE000
stack
page read and write
106C000
heap
page read and write
946000
heap
page read and write
10F8000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
1501000
trusted library allocation
page read and write
10B1000
heap
page read and write
AE9000
heap
page read and write
400000
unkown
page readonly
ADF000
heap
page read and write
10B1000
heap
page read and write
15F4000
trusted library allocation
page read and write
A8F000
heap
page read and write
6FD000
heap
page read and write
D48000
heap
page read and write
6F9000
heap
page read and write
6F9000
heap
page read and write
FF2000
heap
page read and write
414000
unkown
page read and write
709000
heap
page read and write
35D2000
heap
page read and write
12E7000
trusted library allocation
page read and write
35D1000
heap
page read and write
6B8000
heap
page read and write
42D000
unkown
page read and write
AA0000
heap
page read and write
C5E000
stack
page read and write
13A5000
trusted library allocation
page read and write
C67000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
1564000
trusted library allocation
page read and write
35D3000
heap
page read and write
106C000
heap
page read and write
6FD000
heap
page read and write
35D1000
heap
page read and write
1026000
heap
page read and write
15C8000
trusted library allocation
page read and write
105C000
heap
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
1043000
heap
page read and write
35D1000
heap
page read and write
1441000
trusted library allocation
page read and write
8EF000
stack
page read and write
1026000
heap
page read and write
6E8000
heap
page read and write
1296000
trusted library allocation
page read and write
4EEF000
stack
page read and write
B10000
heap
page read and write
10A7000
heap
page read and write
131C000
trusted library allocation
page read and write
1344000
trusted library allocation
page read and write
1061000
heap
page read and write
B69000
unkown
page readonly
38D1000
direct allocation
page execute and read and write
118B000
trusted library allocation
page read and write
1026000
heap
page read and write
1240000
trusted library allocation
page read and write
57E000
stack
page read and write
12DC000
trusted library allocation
page read and write
22AF000
stack
page read and write
A5E000
heap
page read and write
35D1000
heap
page read and write
1441000
trusted library allocation
page read and write
A70000
heap
page read and write
105F000
heap
page read and write
435000
unkown
page read and write
1241000
trusted library allocation
page read and write
35D1000
heap
page read and write
35D1000
heap
page read and write
A1D000
stack
page read and write
6FD000
heap
page read and write
1313000
trusted library allocation
page read and write
10218000
direct allocation
page readonly
1026000
heap
page read and write
1241000
trusted library allocation
page read and write
35D1000
heap
page read and write
118C000
trusted library allocation
page read and write
6F4000
heap
page read and write
35D1000
heap
page read and write
106C000
heap
page read and write
137E000
trusted library allocation
page read and write
150C000
trusted library allocation
page read and write
12E6000
trusted library allocation
page read and write
6E8000
heap
page read and write
4A20000
heap
page read and write
49AE000
stack
page read and write
38A0000
direct allocation
page read and write
39C5000
direct allocation
page execute and read and write
35D1000
heap
page read and write
63A000
stack
page read and write
2780000
heap
page read and write
There are 668 hidden memdumps, click here to show them.