IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
initial sample
 malicious
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\l2[1].exe
MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
dropped
 malicious
C:\Users\user\AppData\Local\Temp\9VicU2EcsIoeWuNiSqblWRg.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe
MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
dropped
 malicious
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\KSExO5GhJ2KIj6jiDKtz.exe
MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
dropped
 malicious
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\AUbJyYTe1V8SLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\KqbMb6uMMrllLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\NrGxmJ6iR8w5Cookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\OWiKacYEmjRRHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\TqjUl9qFEgEVWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\Wfn1uIfP6NkqWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\XvdgmyzD0nC_Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\ZepIH9NMcVOsWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\_7f6olETKF02Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\_OJ8_1ctZal9Cookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\dEbuxUy_xTGYWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\qFcDgTpDJA6rHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\r9QPSi3M8TE3History
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\vNnwTwjWIvfBLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\w7roHjejHsXEHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\trixyCPXDj512V5iG\Cookies\Chrome_Default.txt
ASCII text, with very long lines (369), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyCPXDj512V5iG\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyCPXDj512V5iG\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyCPXDj512V5iG\screenshot.png
PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Wed May 22 17:06:34 2024, mtime=Wed May 22 17:06:34 2024, atime=Wed May 22 17:06:32 2024, length=4563640, window=hide
dropped
There are 21 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG" /sc ONLOGON /rl HIGHEST
malicious
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
 malicious
C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\KSExO5GhJ2KIj6jiDKtz.exe
"C:\Users\user\AppData\Local\Temp\spanCPXDj512V5iG\KSExO5GhJ2KIj6jiDKtz.exe"
malicious
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
"C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe"
malicious
C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
"C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe"
malicious
C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe
"C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 9 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://185.172.128.82/server/k/l2.exe
185.172.128.82
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://ipinfo.io:443/widget/demo/8.46.123.175
unknown
https://t.me/RiseProSUPPORTNOq
unknown
https://duckduckgo.com/ac/?q=
unknown
https://sectigo.com/CPS0
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://ocsp.sectigo.com0
unknown
https://t.;k
unknown
https://github.com/golang/protobuf/issues/1609):
unknown
https://login.microsoftonline.com/illegal
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://db-ip.com/4
unknown
https://t.me/RiseProSUPPORT
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://protobuf.dev/reference/go/faq#namespace-conflictin
unknown
http://185.172.128.82/server/k/l2.exe:(
unknown
https://www.ecosia.org/newtab/
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
https://t.me/risepro_bot
unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.175
unknown
https://ipinfo.io/
unknown
https://login.microsoftonline.us/indefinite
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://login.chinacloudapi.cn/in
unknown
https://www.maxmind.com/en/locate-my-ip-address
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://ns.adobe.0/g/ima:0m
unknown
https://ipinfo.io/widget/demo/8.46.123.175
34.117.186.192
https://t.me/risepro_botisepro_bot
unknown
http://www.winimage.com/zLibDll
unknown
https://support.mozilla.org
unknown
https://db-ip.com/demo/home.php?s=8.46.123.175AS3356
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://db-ip.com/demo/home.php?s=8.46.123.175
172.67.75.166
There are 30 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ipinfo.io
34.117.186.192
db-ip.com
172.67.75.166

IPs

IP
Domain
Country
Malicious
185.172.128.82
unknown
Russian Federation
malicious
185.172.128.136
unknown
Russian Federation
malicious
34.117.186.192
ipinfo.io
United States
172.67.75.166
db-ip.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26

Memdumps

Base Address
Regiontype
Protect
Malicious
749F000
heap
page read and write
 malicious
749F000
heap
page read and write
 malicious
77EF000
heap
page read and write
 malicious
400000
unkown
page readonly
C0000EC000
direct allocation
page read and write
78EE000
stack
page read and write
7FDB000
stack
page read and write
7527000
heap
page read and write
19161650000
direct allocation
page read and write
C00014A000
direct allocation
page read and write
74FF000
heap
page read and write
74FE000
heap
page read and write
C0007D0000
direct allocation
page read and write
74B6000
heap
page read and write
7503000
heap
page read and write
C000E0C000
direct allocation
page read and write
74CF000
heap
page read and write
A42000
unkown
page readonly
C0003CA000
direct allocation
page read and write
74FD000
heap
page read and write
C000033000
direct allocation
page read and write
74DE000
heap
page read and write
7F29000
heap
page read and write
C000D9C000
direct allocation
page read and write
9C000
stack
page read and write
74D9000
heap
page read and write
74D3000
heap
page read and write
3450000
heap
page read and write
74CC000
heap
page read and write
74D1000
heap
page read and write
EDF000
stack
page read and write
7FF6DDAB2000
unkown
page write copy
79BA000
heap
page read and write
753C000
heap
page read and write
1916163A000
direct allocation
page read and write
5B4000
unkown
page execute and read and write
C000230000
direct allocation
page read and write
C0003DC000
direct allocation
page read and write
7500000
heap
page read and write
403000
unkown
page readonly
74EE000
heap
page read and write
2AB0000
heap
page read and write
751C000
heap
page read and write
B5D000
unkown
page readonly
B78000
unkown
page execute and read and write
C000006000
direct allocation
page read and write
C00037E000
direct allocation
page read and write
C000E9C000
direct allocation
page read and write
C00001E000
direct allocation
page read and write
C000314000
direct allocation
page read and write
E8E000
stack
page read and write
80B1000
heap
page read and write
4CE0000
heap
page read and write
C000EFC000
direct allocation
page read and write
1916123B000
direct allocation
page read and write
74F2000
heap
page read and write
74C1000
heap
page read and write
77D0000
trusted library allocation
page read and write
EC0000
heap
page read and write
405000
unkown
page execute read
C000314000
direct allocation
page read and write
738E000
stack
page read and write
2FDE000
stack
page read and write
C0000D2000
direct allocation
page read and write
81A15FD000
stack
page read and write
7FF6DDAAC000
unkown
page write copy
2BFE000
stack
page read and write
30BE000
unkown
page read and write
403000
unkown
page readonly
283B000
heap
page read and write
74D5000
heap
page read and write
81A0FFF000
stack
page read and write
74CC000
heap
page read and write
19161254000
direct allocation
page read and write
74D7000
heap
page read and write
74C9000
heap
page read and write
74D9000
heap
page read and write
74FE000
heap
page read and write
C000308000
direct allocation
page read and write
76E0000
heap
page read and write
C000E4C000
direct allocation
page read and write
7FF6DE1C2000
unkown
page read and write
7F10000
direct allocation
page execute and read and write
2B7D000
stack
page read and write
404000
unkown
page execute and read and write
7500000
heap
page read and write
C000045000
direct allocation
page read and write
C000096000
direct allocation
page read and write
74FD000
heap
page read and write
9C000
stack
page read and write
C80000
heap
page read and write
C00036E000
direct allocation
page read and write
C000004000
direct allocation
page read and write
C0002E2000
direct allocation
page read and write
D4E000
stack
page read and write
3110000
heap
page read and write
C0007F0000
direct allocation
page read and write
405000
unkown
page execute read
341E000
stack
page read and write
C0002FE000
direct allocation
page read and write
C000BAE000
direct allocation
page read and write
74D5000
heap
page read and write
7497000
heap
page read and write
74B6000
heap
page read and write
31A7000
heap
page read and write
C00001C000
direct allocation
page read and write
7505000
heap
page read and write
F4E000
heap
page read and write
C000376000
direct allocation
page read and write
77D0000
trusted library allocation
page read and write
751C000
heap
page read and write
74DE000
heap
page read and write
31A4000
heap
page read and write
19161670000
direct allocation
page read and write
7C80000
heap
page read and write
74F2000
heap
page read and write
C00024A000
direct allocation
page read and write
191612A0000
direct allocation
page read and write
74EF000
heap
page read and write
C0000FE000
direct allocation
page read and write
7BC8000
heap
page read and write
74FD000
heap
page read and write
D4E000
stack
page read and write
2B86000
stack
page read and write
85D000
stack
page read and write
7FF6DDAB0000
unkown
page read and write
81A0DFD000
stack
page read and write
C00002E000
direct allocation
page read and write
7FF6DE1C3000
unkown
page write copy
BF0000
heap
page read and write
74D7000
heap
page read and write
74F2000
heap
page read and write
753D000
heap
page read and write
404000
unkown
page execute and read and write
401000
unkown
page execute and write copy
C000080000
direct allocation
page read and write
C0003C0000
direct allocation
page read and write
74B9000
heap
page read and write
CC0000
heap
page read and write
C00008F000
direct allocation
page read and write
C0000A4000
direct allocation
page read and write
401000
unkown
page execute and write copy
C000324000
direct allocation
page read and write
7FF6DDAB7000
unkown
page write copy
74CF000
heap
page read and write
74E1000
heap
page read and write
A42000
unkown
page readonly
7512000
heap
page read and write
C00001A000
direct allocation
page read and write
C000DC8000
direct allocation
page read and write
C000F4C000
direct allocation
page read and write
7860000
trusted library allocation
page read and write
2AA0000
heap
page read and write
C00013E000
direct allocation
page read and write
401000
unkown
page execute read
19161280000
direct allocation
page read and write
74EE000
heap
page read and write
C0003BE000
direct allocation
page read and write
B79000
unkown
page write copy
74EE000
heap
page read and write
74C0000
heap
page read and write
C000073000
direct allocation
page read and write
401000
unkown
page execute read
C0003C0000
direct allocation
page read and write
C000D2C000
direct allocation
page read and write
751A000
heap
page read and write
19161110000
direct allocation
page read and write
74D5000
heap
page read and write
C000D3C000
direct allocation
page read and write
74E1000
heap
page read and write
D70000
heap
page read and write
B5D000
unkown
page readonly
74D7000
heap
page read and write
CC0000
heap
page read and write
193000
stack
page read and write
C000128000
direct allocation
page read and write
7936000
heap
page read and write
786E000
heap
page read and write
74CD000
heap
page read and write
C00015A000
direct allocation
page read and write
C0003EE000
direct allocation
page read and write
C000D0C000
direct allocation
page read and write
7FF6DDAA6000
unkown
page read and write
C000A1A000
direct allocation
page read and write
74EF000
heap
page read and write
74FE000
heap
page read and write
7550000
heap
page read and write
C000026000
direct allocation
page read and write
74D1000
heap
page read and write
74C9000
heap
page read and write
7508000
heap
page read and write
7509000
heap
page read and write
B5D000
unkown
page readonly
74D1000
heap
page read and write
ECA000
heap
page read and write
30C0000
heap
page read and write
74EF000
heap
page read and write
74F2000
heap
page read and write
74CB000
heap
page read and write
29B0000
heap
page read and write
C00013C000
direct allocation
page read and write
30E0000
heap
page read and write
74D9000
heap
page read and write
74DE000
heap
page read and write
4DE0000
heap
page read and write
74D7000
heap
page read and write
331E000
stack
page read and write
D10000
heap
page read and write
74C8000
heap
page read and write
74D5000
heap
page read and write
400000
unkown
page readonly
C000269000
direct allocation
page read and write
B79000
unkown
page write copy
74D4000
heap
page read and write
750E000
heap
page read and write
D30000
heap
page read and write
EAF000
stack
page read and write
74E1000
heap
page read and write
74F2000
heap
page read and write
C001800000
direct allocation
page read and write
CC0000
heap
page read and write
C0003E6000
direct allocation
page read and write
74E1000
heap
page read and write
8149000
stack
page read and write
74B9000
heap
page read and write
C0012FA000
direct allocation
page read and write
74F2000
heap
page read and write
74D5000
heap
page read and write
74D9000
heap
page read and write
77D0000
trusted library allocation
page read and write
191613DA000
direct allocation
page read and write
C00010A000
direct allocation
page read and write
74EC000
heap
page read and write
2FE0000
heap
page read and write
B79000
unkown
page write copy
77D0000
trusted library allocation
page read and write
74F2000
heap
page read and write
74D5000
heap
page read and write
28DF000
stack
page read and write
81A19FE000
stack
page read and write
7FF6DDC76000
unkown
page readonly
7511000
heap
page read and write
7511000
heap
page read and write
2E00000
remote allocation
page execute and read and write
5B4000
unkown
page execute and read and write
C000376000
direct allocation
page read and write
C000DCC000
direct allocation
page read and write
B79000
unkown
page write copy
2DFA000
stack
page read and write
403000
unkown
page readonly
1913B560000
heap
page read and write
74C8000
heap
page read and write
405000
unkown
page execute read
E4E000
stack
page read and write
C0000DE000
direct allocation
page read and write
312F000
heap
page read and write
1913B570000
direct allocation
page read and write
C0007E0000
direct allocation
page read and write
310C000
heap
page read and write
74C8000
heap
page read and write
74D6000
heap
page read and write
74F7000
heap
page read and write
C0003EA000
direct allocation
page read and write
1D0000
heap
page read and write
C000D8C000
direct allocation
page read and write
7C05000
heap
page read and write
311B000
heap
page read and write
C0003BE000
direct allocation
page read and write
C000104000
direct allocation
page read and write
1913B7DB000
direct allocation
page read and write
7FF6DE1C7000
unkown
page readonly
400000
unkown
page readonly
C000DFC000
direct allocation
page read and write
7512000
heap
page read and write
74F2000
heap
page read and write
7FF6DE1BD000
unkown
page read and write
7FF6DE191000
unkown
page read and write
74EF000
heap
page read and write
405000
unkown
page execute read
1913B593000
heap
page read and write
401000
unkown
page execute and write copy
C000F0C000
direct allocation
page read and write
31DA000
heap
page read and write
C000124000
direct allocation
page read and write
7E9D000
heap
page read and write
404000
unkown
page execute and read and write
C000160000
direct allocation
page read and write
B79000
unkown
page write copy
7509000
heap
page read and write
3191000
heap
page read and write
74CD000
heap
page read and write
74D6000
heap
page read and write
74CD000
heap
page read and write
7512000
heap
page read and write
74D7000
heap
page read and write
C000CFC000
direct allocation
page read and write
7550000
heap
page read and write
B5D000
unkown
page readonly
272E000
stack
page read and write
D4E000
stack
page read and write
C000002000
direct allocation
page read and write
19161235000
direct allocation
page read and write
74D1000
heap
page read and write
751F000
heap
page read and write
2A90000
heap
page read and write
74D3000
heap
page read and write
405000
unkown
page execute read
77D0000
trusted library allocation
page read and write
7559000
heap
page read and write
331E000
stack
page read and write
751F000
heap
page read and write
74D6000
heap
page read and write
BF0000
heap
page read and write
74E1000
heap
page read and write
74D9000
heap
page read and write
C0003AA000
direct allocation
page read and write
C000E2C000
direct allocation
page read and write
C0003D6000
direct allocation
page read and write
9C000
stack
page read and write
C0001C6000
direct allocation
page read and write
403000
unkown
page readonly
751F000
heap
page read and write
29E0000
heap
page read and write
3100000
heap
page read and write
9C000
stack
page read and write
B78000
unkown
page execute and read and write
7524000
heap
page read and write
400000
unkown
page readonly
B78000
unkown
page execute and write copy
F4F000
stack
page read and write
C0003E6000
direct allocation
page read and write
D5E000
stack
page read and write
752A000
heap
page read and write
74E1000
heap
page read and write
1E0000
heap
page read and write
C000048000
direct allocation
page read and write
DA0000
heap
page read and write
74E1000
heap
page read and write
7561000
heap
page read and write
3125000
heap
page read and write
8138000
heap
page read and write
C00002A000
direct allocation
page read and write
D0E000
stack
page read and write
C3E000
stack
page read and write
7503000
heap
page read and write
74C8000
heap
page read and write
C00026E000
direct allocation
page read and write
76D0000
heap
page read and write
1913B7D9000
direct allocation
page read and write
7FF6DDABC000
unkown
page readonly
C000E3C000
direct allocation
page read and write
F4E000
stack
page read and write
400000
unkown
page readonly
7524000
heap
page read and write
74F2000
heap
page read and write
C000091000
direct allocation
page read and write
C000130000
direct allocation
page read and write
C000028000
direct allocation
page read and write
787F000
stack
page read and write
C000DDC000
direct allocation
page read and write
74FE000
heap
page read and write
191614A0000
direct allocation
page read and write
2FE7000
heap
page read and write
1913B589000
heap
page read and write
7BC9000
heap
page read and write
B78000
unkown
page execute and read and write
74F2000
heap
page read and write
74FC000
heap
page read and write
1913B7D4000
direct allocation
page read and write
C000350000
direct allocation
page read and write
7531000
heap
page read and write
B78000
unkown
page execute and read and write
272E000
stack
page read and write
C000594000
direct allocation
page read and write
335F000
stack
page read and write
400000
unkown
page readonly
7FF6DE1C6000
unkown
page write copy
74B7000
heap
page read and write
74FD000
heap
page read and write
74EC000
heap
page read and write
81A17FE000
stack
page read and write
7493000
heap
page read and write
7FF6DD5C0000
unkown
page readonly
C000ECC000
direct allocation
page read and write
C000D1C000
direct allocation
page read and write
B78000
unkown
page execute and write copy
C00035E000
direct allocation
page read and write
C00037E000
direct allocation
page read and write
4DA0000
remote allocation
page read and write
C000DBC000
direct allocation
page read and write
1913B7D0000
direct allocation
page read and write
74EE000
heap
page read and write
7FF6DDABC000
unkown
page readonly
754A000
heap
page read and write
74B9000
heap
page read and write
97F000
unkown
page read and write
403000
unkown
page readonly
1913B580000
heap
page read and write
7FF6DE1C7000
unkown
page readonly
2AC0000
heap
page read and write
787E000
heap
page read and write
282F000
stack
page read and write
C1E000
heap
page read and write
C48000
heap
page read and write
C0002E2000
direct allocation
page read and write
C000728000
direct allocation
page read and write
2B4B000
stack
page read and write
B78000
unkown
page execute and read and write
C0002E8000
direct allocation
page read and write
74E9000
heap
page read and write
C00004C000
direct allocation
page read and write
C00012C000
direct allocation
page read and write
74D9000
heap
page read and write
C000320000
direct allocation
page read and write
C0002E8000
direct allocation
page read and write
B79000
unkown
page write copy
C000CAE000
direct allocation
page read and write
C000E8C000
direct allocation
page read and write
753D000
heap
page read and write
74D9000
heap
page read and write
5B4000
unkown
page execute and read and write
400000
unkown
page readonly
C0000EE000
direct allocation
page read and write
10BF000
stack
page read and write
74E1000
heap
page read and write
77D0000
trusted library allocation
page read and write
74E1000
heap
page read and write
805C000
stack
page read and write
401000
unkown
page execute read
C000024000
direct allocation
page read and write
2DA0000
heap
page read and write
7FF6DDC76000
unkown
page readonly
CC0000
heap
page read and write
7B5A000
heap
page read and write
B78000
unkown
page execute and write copy
754A000
heap
page read and write
C0017B6000
direct allocation
page read and write
C001000000
direct allocation
page read and write
74D1000
heap
page read and write
404000
unkown
page execute and read and write
B5D000
unkown
page readonly
C000037000
direct allocation
page read and write
C40000
heap
page read and write
405000
unkown
page execute read
C00115B000
direct allocation
page read and write
74CF000
heap
page read and write
5B4000
unkown
page execute and read and write
C00035E000
direct allocation
page read and write
74D5000
heap
page read and write
7511000
heap
page read and write
F0F000
stack
page read and write
74DE000
heap
page read and write
830A000
heap
page read and write
C000308000
direct allocation
page read and write
C000390000
direct allocation
page read and write
C0003CA000
direct allocation
page read and write
B79000
unkown
page write copy
C00026B000
direct allocation
page read and write
74F3000
heap
page read and write
C000278000
direct allocation
page read and write
74D5000
heap
page read and write
19161660000
direct allocation
page read and write
74FD000
heap
page read and write
C00003E000
direct allocation
page read and write
7FF6DE1C2000
unkown
page write copy
B78000
unkown
page execute and write copy
2BF0000
heap
page read and write
7C2A000
heap
page read and write
282F000
stack
page read and write
7490000
heap
page read and write
A42000
unkown
page readonly
1913B750000
heap
page read and write
74FE000
heap
page read and write
C000F3C000
direct allocation
page read and write
C0000BC000
direct allocation
page read and write
B79000
unkown
page write copy
9C000
stack
page read and write
74F2000
heap
page read and write
7E12000
heap
page read and write
403000
unkown
page readonly
7FF6DD5C0000
unkown
page readonly
74F3000
heap
page read and write
74D9000
heap
page read and write
77D0000
trusted library allocation
page read and write
C0003D4000
direct allocation
page read and write
74F8000
heap
page read and write
403000
unkown
page readonly
79B1000
heap
page read and write
118F000
stack
page read and write
C0003E8000
direct allocation
page read and write
C00008D000
direct allocation
page read and write
7531000
heap
page read and write
30FF000
unkown
page read and write
D3A000
heap
page read and write
19161230000
direct allocation
page read and write
7510000
heap
page read and write
7501000
heap
page read and write
74D7000
heap
page read and write
74F8000
heap
page read and write
ECE000
heap
page read and write
401000
unkown
page execute and write copy
7530000
heap
page read and write
7505000
heap
page read and write
7FF6DDA70000
unkown
page read and write
C000030000
direct allocation
page read and write
C0003EE000
direct allocation
page read and write
5B4000
unkown
page execute and read and write
C000C9E000
direct allocation
page read and write
C0017F0000
direct allocation
page read and write
783E000
stack
page read and write
77D0000
trusted library allocation
page read and write
7C40000
heap
page read and write
191616B0000
direct allocation
page read and write
B79000
unkown
page write copy
A42000
unkown
page readonly
C0000CE000
direct allocation
page read and write
7508000
heap
page read and write
74FD000
heap
page read and write
7B8D000
heap
page read and write
CF0000
heap
page read and write
F90000
heap
page read and write
750E000
heap
page read and write
81A1BFF000
stack
page read and write
BE0000
heap
page read and write
7FF6DE18A000
unkown
page read and write
796F000
stack
page read and write
C40000
heap
page read and write
C000E5C000
direct allocation
page read and write
74C9000
heap
page read and write
751C000
heap
page read and write
311F000
heap
page read and write
754A000
heap
page read and write
7516000
heap
page read and write
B78000
unkown
page execute and write copy
74EC000
heap
page read and write
751C000
heap
page read and write
B78000
unkown
page execute and read and write
C0000E2000
direct allocation
page read and write
3070000
heap
page read and write
77D0000
trusted library allocation
page read and write
7530000
heap
page read and write
C000DEC000
direct allocation
page read and write
30E8000
heap
page read and write
74FD000
heap
page read and write
7D5A000
heap
page read and write
C000060000
direct allocation
page read and write
19161257000
direct allocation
page read and write
C00002C000
direct allocation
page read and write
80C0000
heap
page read and write
74D3000
heap
page read and write
7C04000
heap
page read and write
7511000
heap
page read and write
C00000C000
direct allocation
page read and write
74D7000
heap
page read and write
74B6000
heap
page read and write
C0003D6000
direct allocation
page read and write
74F2000
heap
page read and write
74EC000
heap
page read and write
751C000
heap
page read and write
74ED000
heap
page read and write
9C000
stack
page read and write
C000051000
direct allocation
page read and write
74D5000
heap
page read and write
750E000
heap
page read and write
C00005E000
direct allocation
page read and write
C87000
heap
page read and write
F40000
heap
page read and write
7B50000
heap
page read and write
74E1000
heap
page read and write
C000D7C000
direct allocation
page read and write
7501000
heap
page read and write
7561000
heap
page read and write
74D0000
heap
page read and write
C0003FA000
direct allocation
page read and write
B78000
unkown
page execute and read and write
3188000
heap
page read and write
7BC8000
heap
page read and write
193000
stack
page read and write
753D000
heap
page read and write
7FF6DDA71000
unkown
page write copy
81A11FF000
stack
page read and write
C000262000
direct allocation
page read and write
C0000C0000
direct allocation
page read and write
C0000BE000
direct allocation
page read and write
C000CEC000
direct allocation
page read and write
7500000
heap
page read and write
C000D5C000
direct allocation
page read and write
74D4000
heap
page read and write
7500000
heap
page read and write
7531000
heap
page read and write
74F2000
heap
page read and write
7FF6DE1C6000
unkown
page write copy
74F1000
heap
page read and write
A42000
unkown
page readonly
74D9000
heap
page read and write
C000FD4000
direct allocation
page read and write
74C8000
heap
page read and write
751F000
heap
page read and write
750A000
heap
page read and write
1913B7C0000
heap
page read and write
B79000
unkown
page write copy
74DB000
heap
page read and write
3123000
heap
page read and write
74D7000
heap
page read and write
A42000
unkown
page readonly
C000E6C000
direct allocation
page read and write
C00009A000
direct allocation
page read and write
F4F000
stack
page read and write
74D9000
heap
page read and write
74EC000
heap
page read and write
C000DAC000
direct allocation
page read and write
3100000
heap
page read and write
C000320000
direct allocation
page read and write
401000
unkown
page execute read
193000
stack
page read and write
C0003DC000
direct allocation
page read and write
405000
unkown
page execute read
7FF6DDA6F000
unkown
page write copy
4DA0000
remote allocation
page read and write
74D9000
heap
page read and write
D00000
heap
page read and write
C0000F0000
direct allocation
page read and write
C10000
heap
page read and write
B5D000
unkown
page readonly
19161112000
direct allocation
page read and write
74FD000
heap
page read and write
74D9000
heap
page read and write
7521000
heap
page read and write
7FF6DDA5F000
unkown
page write copy
404000
unkown
page execute and read and write
4DA0000
remote allocation
page read and write
74F2000
heap
page read and write
C000088000
direct allocation
page read and write
193000
stack
page read and write
814D000
stack
page read and write
BE0000
heap
page read and write
C000800000
direct allocation
page read and write
74D5000
heap
page read and write
C0003D0000
direct allocation
page read and write
B79000
unkown
page write copy
2DBD000
stack
page read and write
D3E000
heap
page read and write
D0E000
stack
page read and write
32DE000
stack
page read and write
400000
unkown
page readonly
C000035000
direct allocation
page read and write
C3E000
stack
page read and write
2FE5000
heap
page read and write
9C000
stack
page read and write
7502000
heap
page read and write
B79000
unkown
page write copy
754A000
heap
page read and write
4C37000
heap
page read and write
C0001FE000
direct allocation
page read and write
7503000
heap
page read and write
7535000
heap
page read and write
31DE000
heap
page read and write
77D0000
trusted library allocation
page read and write
C001400000
direct allocation
page read and write
317D000
heap
page read and write
77D0000
trusted library allocation
page read and write
4C3D000
heap
page read and write
401000
unkown
page execute read
809F000
stack
page read and write
1913B770000
heap
page read and write
74EC000
heap
page read and write
19161390000
direct allocation
page read and write
C00148E000
direct allocation
page read and write
7559000
heap
page read and write
74D9000
heap
page read and write
B79000
unkown
page write copy
104F000
stack
page read and write
7FF6DD5C1000
unkown
page execute read
7B51000
heap
page read and write
74E1000
heap
page read and write
8F0000
heap
page read and write
7507000
heap
page read and write
C000EAC000
direct allocation
page read and write
7517000
heap
page read and write
74D9000
heap
page read and write
C0000B0000
direct allocation
page read and write
193000
stack
page read and write
4E00000
heap
page read and write
7FF6DE157000
unkown
page read and write
317E000
heap
page read and write
C000C00000
direct allocation
page read and write
C000EEC000
direct allocation
page read and write
74D5000
heap
page read and write
C00006B000
direct allocation
page read and write
3115000
heap
page read and write
801E000
stack
page read and write
7E90000
direct allocation
page execute and read and write
401000
unkown
page execute read
C0003D4000
direct allocation
page read and write
B79000
unkown
page write copy
7D5D000
heap
page read and write
C0001D8000
direct allocation
page read and write
C000390000
direct allocation
page read and write
C0003EA000
direct allocation
page read and write
7501000
heap
page read and write
74D6000
heap
page read and write
7531000
heap
page read and write
3060000
heap
page read and write
C0000FA000
direct allocation
page read and write
B78000
unkown
page execute and write copy
5B4000
unkown
page execute and read and write
750E000
heap
page read and write
191613F2000
direct allocation
page read and write
2ACB000
heap
page read and write
74F2000
heap
page read and write
C0003D0000
direct allocation
page read and write
7B51000
heap
page read and write
93E000
unkown
page read and write
312A000
heap
page read and write
401000
unkown
page execute read
F4A000
heap
page read and write
400000
unkown
page readonly
754A000
heap
page read and write
BE0000
heap
page read and write
74FC000
heap
page read and write
C0002FE000
direct allocation
page read and write
C000400000
direct allocation
page read and write
76D1000
heap
page read and write
2980000
heap
page read and write
7531000
heap
page read and write
3178000
heap
page read and write
193000
stack
page read and write
1050000
heap
page read and write
74D5000
heap
page read and write
C000267000
direct allocation
page read and write
C00034C000
direct allocation
page read and write
7FF6DE1B8000
unkown
page read and write
C000F2C000
direct allocation
page read and write
28B0000
heap
page read and write
7513000
heap
page read and write
404000
unkown
page execute and read and write
C000084000
direct allocation
page read and write
1916111B000
direct allocation
page read and write
401000
unkown
page execute and write copy
7535000
heap
page read and write
750E000
heap
page read and write
C000E7C000
direct allocation
page read and write
C00034C000
direct allocation
page read and write
7FF6DDA5F000
unkown
page read and write
4C30000
heap
page read and write
C000D4C000
direct allocation
page read and write
74CD000
heap
page read and write
C000366000
direct allocation
page read and write
74D0000
heap
page read and write
74EC000
heap
page read and write
C000057000
direct allocation
page read and write
1913B7C5000
heap
page read and write
401000
unkown
page execute and write copy
B78000
unkown
page execute and write copy
400000
unkown
page readonly
748F000
stack
page read and write
C0003E8000
direct allocation
page read and write
193000
stack
page read and write
74DB000
heap
page read and write
77D0000
trusted library allocation
page read and write
C000350000
direct allocation
page read and write
C000265000
direct allocation
page read and write
BE0000
heap
page read and write
79BE000
heap
page read and write
77D0000
trusted library allocation
page read and write
C000EBC000
direct allocation
page read and write
C00036E000
direct allocation
page read and write
191613C0000
direct allocation
page read and write
81A13FF000
stack
page read and write
7A51000
heap
page read and write
404000
unkown
page execute and read and write
400000
unkown
page readonly
74D3000
heap
page read and write
2C02000
heap
page read and write
77D0000
trusted library allocation
page read and write
74D9000
heap
page read and write
F9A000
heap
page read and write
74D3000
heap
page read and write
74D5000
heap
page read and write
C001622000
direct allocation
page read and write
7C20000
heap
page read and write
74B9000
heap
page read and write
1916123F000
direct allocation
page read and write
74D7000
heap
page read and write
7519000
heap
page read and write
B5D000
unkown
page readonly
74D3000
heap
page read and write
7512000
heap
page read and write
3176000
heap
page read and write
C000D6C000
direct allocation
page read and write
7500000
heap
page read and write
C000290000
direct allocation
page read and write
751F000
heap
page read and write
C000148000
direct allocation
page read and write
C000110000
direct allocation
page read and write
74D5000
heap
page read and write
BF0000
heap
page read and write
2C3F000
stack
page read and write
7A50000
heap
page read and write
74E1000
heap
page read and write
89A000
stack
page read and write
191614B0000
direct allocation
page read and write
74C8000
heap
page read and write
DD0000
heap
page read and write
74E1000
heap
page read and write
C000366000
direct allocation
page read and write
C000EDC000
direct allocation
page read and write
C00008B000
direct allocation
page read and write
BE0000
heap
page read and write
A42000
unkown
page readonly
400000
unkown
page readonly
5B4000
unkown
page execute and read and write
750E000
heap
page read and write
77D0000
trusted library allocation
page read and write
7FF6DD5C1000
unkown
page execute read
74ED000
heap
page read and write
401000
unkown
page execute and write copy
1913B7B0000
direct allocation
page read and write
810C000
stack
page read and write
400000
unkown
page readonly
980000
heap
page read and write
74C8000
heap
page read and write
400000
unkown
page readonly
74F2000
heap
page read and write
C000E1C000
direct allocation
page read and write
7FF6DDAB5000
unkown
page read and write
C000270000
direct allocation
page read and write
C0003AA000
direct allocation
page read and write
74EF000
heap
page read and write
74D5000
heap
page read and write
C000F1C000
direct allocation
page read and write
C000324000
direct allocation
page read and write
7513000
heap
page read and write
C1A000
heap
page read and write
C000022000
direct allocation
page read and write
191613B0000
direct allocation
page read and write
74C9000
heap
page read and write
C00011E000
direct allocation
page read and write
C000020000
direct allocation
page read and write
74E1000
heap
page read and write
F9E000
heap
page read and write
There are 831 hidden memdumps, click here to show them.