IOC Report
tMO4FVIc9l.exe

loading gif

Files

File Path
Type
Category
Malicious
tMO4FVIc9l.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\lumma2305[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\KBHGMwjOItm_DLNJJFRnML7.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\xq6J5KlULX6jlR3rET0T.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tMO4FVIc9l.exe_be92bb1bff38c722ec185b4fdc72fbebbec7f39_390e5ac0_3dbca512-effe-4dee-98ea-d0774586cddc\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E97.tmp.dmp
Mini DuMP crash report, 15 streams, Thu May 23 22:22:06 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20AB.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20DB.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\3P7JnOlL1OlXHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\B0316QB33WdRCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\D7xhTl4YAcm4Login Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\K2bxMwkdLZUwCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\NiTuuJ95v89DHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\Oh9vbPMur9FiLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\RzvNVqGUEpJhWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\S4ECHZA8NR3oWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\ZvP9NIG0u2hrWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\_mL6_rRT6Cx2History
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\dP6LfDcELUJXWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\jsSil7KsrPQ9History
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\rg706_nABxIULogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\uFScRKoRnRdZWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\z0bEzvXuiSwcWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\Users\user\AppData\Local\Temp\trixyDxygJpUhAdhw\Cookies\Chrome_Default.txt
ASCII text, with very long lines (369), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyDxygJpUhAdhw\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyDxygJpUhAdhw\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyDxygJpUhAdhw\screenshot.png
PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 23 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\tMO4FVIc9l.exe
"C:\Users\user\Desktop\tMO4FVIc9l.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 HR" /sc HOURLY /rl HIGHEST
malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe" /tn "MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 LG" /sc ONLOGON /rl HIGHEST
malicious
C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\xq6J5KlULX6jlR3rET0T.exe
"C:\Users\user\AppData\Local\Temp\spanDxygJpUhAdhw\xq6J5KlULX6jlR3rET0T.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
 malicious
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe
"C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe"
malicious
C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe
"C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe
"C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe"
malicious
C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe
"C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 2688
There are 8 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://5.42.65.116/lumma2305.exeMeleonCH
unknown
 malicious
http://5.42.65.116/lumma2305.exej
unknown
 malicious
http://5.42.65.116/lumma2305.exe~
unknown
 malicious
averageaattractiionsl.shop
malicious
buttockdecarderwiso.shop
malicious
employhabragaomlsp.shop
malicious
http://5.42.65.116/lumma2305.exe
5.42.65.116
 malicious
roomabolishsnifftwk.shop
malicious
https://employhabragaomlsp.shop/api
188.114.96.3
 malicious
femininiespywageg.shop
malicious
civilianurinedtsraov.shop
malicious
museumtespaceorsp.shop
malicious
stalfbaclcalorieeis.shop
malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://employhabragaomlsp.shop:443/api
unknown
https://t.me/risepro_botD
unknown
https://db-ip.com/
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://employhabragaomlsp.shop/apih
unknown
https://employhabragaomlsp.shop/apiY
unknown
https://employhabragaomlsp.shop/pi
unknown
https://employhabragaomlsp.shop/aibcnf
unknown
https://employhabragaomlsp.shop/l
unknown
https://employhabragaomlsp.shop/i
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://employhabragaomlsp.shop/s
unknown
https://db-ip.com/demo/home.php?s=8.46.123.175
104.26.5.15
http://5.42.65.116/lumma2305.exeaTTm
unknown
https://ipinfo.io/Y
unknown
http://5.42.65.116/lumma2305.exeEWPz
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://employhabragaomlsp.shop:443/apihrome
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
https://t.me/RiseProSUPPORT
unknown
http://5.42.65.116/lumma2305.exeto.de
unknown
https://employhabragaomlsp.shop/api(
unknown
https://www.ecosia.org/newtab/
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://t.me/risepro_bot
unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.175
unknown
https://ipinfo.io/
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://employhabragaomlsp.shop/apiO
unknown
https://ipinfo.io:443/widget/demo/8.46.123.175F
unknown
https://employhabragaomlsp.shop/apiP
unknown
https://ipinfo.io/widget/demo/8.46.123.175
34.117.186.192
http://www.winimage.com/zLibDll
unknown
https://employhabragaomlsp.shop/8
unknown
https://support.mozilla.org
unknown
https://employhabragaomlsp.shop/
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 46 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
employhabragaomlsp.shop
188.114.96.3
 malicious
ipinfo.io
34.117.186.192
db-ip.com
104.26.5.15

IPs

IP
Domain
Country
Malicious
188.114.96.3
employhabragaomlsp.shop
European Union
malicious
5.42.65.116
unknown
Russian Federation
malicious
34.117.186.192
ipinfo.io
United States
104.26.5.15
db-ip.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
ProgramId
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
FileId
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
LowerCaseLongPath
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
LongPathHash
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
Name
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
OriginalFileName
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
Publisher
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
Version
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
BinFileVersion
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
BinaryType
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
ProductName
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
ProductVersion
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
LinkDate
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
BinProductVersion
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
AppxPackageFullName
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
AppxPackageRelativeId
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
Size
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
Language
\REGISTRY\A\{4819d288-05c0-9f84-fc62-993736b7e798}\Root\InventoryApplicationFile\tmo4fvic9l.exe|a87cfe458dcbba8b
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018000DDABBE6B3
There are 14 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
C17000
unkown
page read and write
 malicious
6044000
heap
page read and write
 malicious
611B000
heap
page read and write
 malicious
617A000
heap
page read and write
B90000
heap
page read and write
E90000
unkown
page readonly
13E5000
heap
page read and write
153E000
heap
page read and write
26EE000
stack
page read and write
6136000
heap
page read and write
6149000
heap
page read and write
1090000
direct allocation
page execute and read and write
6166000
heap
page read and write
27DD000
stack
page read and write
35CE000
stack
page read and write
F60000
heap
page read and write
EB7000
unkown
page write copy
E73000
unkown
page readonly
612B000
heap
page read and write
970000
heap
page read and write
6158000
heap
page read and write
CC0000
heap
page read and write
6149000
heap
page read and write
5FDE000
stack
page read and write
302F000
stack
page read and write
614F000
heap
page read and write
3636000
trusted library allocation
page read and write
2AF0000
heap
page read and write
6128000
heap
page read and write
613B000
heap
page read and write
619A000
heap
page read and write
617A000
heap
page read and write
612E000
heap
page read and write
14D8000
heap
page read and write
3876000
trusted library allocation
page read and write
6210000
trusted library allocation
page read and write
5E6E000
stack
page read and write
2DEF000
trusted library allocation
page read and write
DE7000
unkown
page readonly
EB8000
unkown
page readonly
1548000
heap
page read and write
F05000
unkown
page readonly
612B000
heap
page read and write
619E000
heap
page read and write
E5D000
unkown
page readonly
5D2F000
stack
page read and write
615B000
heap
page read and write
C1A000
heap
page read and write
269D000
stack
page read and write
333F000
stack
page read and write
6140000
heap
page read and write
611B000
heap
page read and write
155C000
heap
page read and write
6ED4000
heap
page read and write
1300000
heap
page read and write
303E000
stack
page read and write
4FD000
unkown
page readonly
35DA000
trusted library allocation
page read and write
1400000
heap
page read and write
612D000
heap
page read and write
3666000
trusted library allocation
page read and write
6126000
heap
page read and write
615B000
heap
page read and write
6111000
heap
page read and write
6161000
heap
page read and write
6136000
heap
page read and write
6111000
heap
page read and write
129A000
heap
page read and write
3160000
heap
page read and write
F90000
heap
page read and write
6134000
heap
page read and write
760000
heap
page read and write
6185000
heap
page read and write
614F000
heap
page read and write
112E000
stack
page read and write
E90000
unkown
page readonly
255F000
stack
page read and write
8C0000
heap
page read and write
4E1000
unkown
page execute read
13B0000
heap
page read and write
6132000
heap
page read and write
6194000
heap
page read and write
10FB000
heap
page read and write
12F7000
stack
page read and write
6210000
trusted library allocation
page read and write
9A5000
unkown
page read and write
2FAD000
stack
page read and write
6111000
heap
page read and write
B20000
heap
page read and write
614B000
heap
page read and write
2A5E000
stack
page read and write
AF9000
stack
page read and write
EFC000
stack
page read and write
14CF000
heap
page read and write
615B000
heap
page read and write
6155000
heap
page read and write
6180000
heap
page read and write
615D000
heap
page read and write
6136000
heap
page read and write
6162000
heap
page read and write
619A000
heap
page read and write
30EE000
stack
page read and write
615C000
heap
page read and write
612F000
heap
page read and write
35D3000
trusted library allocation
page read and write
555000
unkown
page readonly
6166000
heap
page read and write
612F000
heap
page read and write
618A000
heap
page read and write
C17000
unkown
page read and write
615A000
heap
page read and write
507000
unkown
page write copy
6135000
heap
page read and write
155A000
heap
page read and write
616C000
heap
page read and write
53C000
stack
page read and write
F9B000
stack
page read and write
1350000
heap
page read and write
5F95000
heap
page read and write
6125000
heap
page read and write
AD4000
unkown
page execute read
3856000
trusted library allocation
page read and write
B98000
heap
page read and write
615B000
heap
page read and write
640F000
stack
page read and write
6210000
trusted library allocation
page read and write
309D000
trusted library allocation
page read and write
BC1000
heap
page read and write
F05000
unkown
page readonly
F96000
heap
page read and write
6134000
heap
page read and write
614A000
heap
page read and write
12D2000
heap
page read and write
615B000
heap
page read and write
615B000
heap
page read and write
613F000
heap
page read and write
CFC000
stack
page read and write
F05000
unkown
page readonly
6134000
heap
page read and write
614B000
heap
page read and write
616B000
heap
page read and write
5F70000
heap
page read and write
1440000
heap
page read and write
2710000
heap
page read and write
616D000
heap
page read and write
C17000
unkown
page write copy
10C0000
heap
page read and write
613F000
heap
page read and write
C17000
unkown
page write copy
612C000
heap
page read and write
6150000
heap
page read and write
E61000
unkown
page readonly
E91000
unkown
page execute read
170E000
stack
page read and write
35AE000
stack
page read and write
312E000
stack
page read and write
118F000
heap
page read and write
5D6E000
stack
page read and write
9AA000
unkown
page execute read
155C000
heap
page read and write
6162000
heap
page read and write
2DEE000
stack
page read and write
C20000
heap
page read and write
6111000
heap
page read and write
C43000
heap
page read and write
614F000
heap
page read and write
572F000
stack
page read and write
155D000
heap
page read and write
155D000
heap
page read and write
EAD000
unkown
page readonly
1491000
heap
page read and write
301E000
stack
page read and write
6136000
heap
page read and write
AA0000
heap
page read and write
F8D000
stack
page read and write
8CA000
heap
page read and write
6210000
trusted library allocation
page read and write
E93000
unkown
page readonly
613F000
heap
page read and write
2E4F000
stack
page read and write
3150000
heap
page read and write
6131000
heap
page read and write
2FED000
stack
page read and write
1050000
heap
page read and write
6135000
heap
page read and write
2EF0000
trusted library allocation
page read and write
621A000
heap
page read and write
615D000
heap
page read and write
69CA000
heap
page read and write
6149000
heap
page read and write
630F000
stack
page read and write
613C000
heap
page read and write
30C7000
trusted library allocation
page read and write
B70000
heap
page read and write
6136000
heap
page read and write
61A6000
heap
page read and write
612B000
heap
page read and write
2B6E000
stack
page read and write
3A6E000
stack
page read and write
6139000
heap
page read and write
5C0000
heap
page read and write
F05000
unkown
page readonly
613F000
heap
page read and write
586F000
stack
page read and write
10AE000
stack
page read and write
6210000
trusted library allocation
page read and write
820000
unkown
page readonly
1447000
heap
page read and write
6145000
heap
page read and write
617A000
heap
page read and write
2F2D000
stack
page read and write
14F3000
heap
page read and write
6136000
heap
page read and write
10EE000
stack
page read and write
6136000
heap
page read and write
12CB000
heap
page read and write
1140000
heap
page read and write
6115000
heap
page read and write
C0D000
unkown
page readonly
4E0000
unkown
page readonly
6141000
heap
page read and write
6164000
heap
page read and write
EAA000
unkown
page readonly
3616000
trusted library allocation
page read and write
8FA000
stack
page read and write
10F0000
heap
page read and write
616B000
heap
page read and write
614F000
heap
page read and write
E91000
unkown
page execute read
14B5000
heap
page read and write
612A000
heap
page read and write
3058000
trusted library allocation
page read and write
3190000
heap
page read and write
6137000
heap
page read and write
2AAD000
stack
page read and write
EB7000
unkown
page write copy
295E000
stack
page read and write
6133000
heap
page read and write
4E0000
unkown
page readonly
31A0000
heap
page read and write
1405000
heap
page read and write
613C000
heap
page read and write
36C0000
heap
page read and write
FBB000
stack
page read and write
13E0000
heap
page read and write
6150000
heap
page read and write
14A5000
heap
page read and write
33AF000
stack
page read and write
612B000
heap
page read and write
6161000
heap
page read and write
2EAD000
stack
page read and write
DD6000
heap
page read and write
EAD000
unkown
page readonly
613C000
heap
page read and write
6161000
heap
page read and write
155C000
heap
page read and write
D80000
heap
page read and write
590000
heap
page read and write
E90000
unkown
page readonly
322F000
stack
page read and write
63C000
stack
page read and write
6151000
heap
page read and write
C30000
heap
page read and write
14AB000
heap
page read and write
614F000
heap
page read and write
6159000
heap
page read and write
DA0000
heap
page read and write
F05000
unkown
page readonly
4E1000
unkown
page execute read
616D000
heap
page read and write
EAD000
unkown
page readonly
6176000
heap
page read and write
14E5000
heap
page read and write
6210000
trusted library allocation
page read and write
14F8000
heap
page read and write
2E60000
heap
page read and write
2DC0000
trusted library allocation
page read and write
1730000
heap
page read and write
155B000
heap
page read and write
6156000
heap
page read and write
616B000
heap
page read and write
113E000
stack
page read and write
E4A000
unkown
page readonly
6117000
heap
page read and write
1370000
heap
page read and write
8FC000
stack
page read and write
11E6000
heap
page read and write
BF0000
unkown
page readonly
14A8000
heap
page read and write
2FB0000
heap
page read and write
C65000
unkown
page readonly
51B9000
heap
page read and write
821000
unkown
page execute read
770000
heap
page read and write
C7E000
heap
page read and write
5F5000
heap
page read and write
5F85000
heap
page read and write
6411000
heap
page read and write
245F000
stack
page read and write
6137000
heap
page read and write
10F9000
stack
page read and write
396E000
stack
page read and write
EDB000
unkown
page readonly
2A60000
trusted library allocation
page read and write
6111000
heap
page read and write
12E3000
heap
page read and write
6131000
heap
page read and write
615B000
heap
page read and write
FFE000
stack
page read and write
6137000
heap
page read and write
6141000
heap
page read and write
BF1000
unkown
page execute read
613F000
heap
page read and write
12F9000
stack
page read and write
EC0000
unkown
page readonly
6178000
heap
page read and write
120E000
stack
page read and write
1357000
heap
page read and write
555000
unkown
page readonly
6136000
heap
page read and write
C0D000
unkown
page readonly
1540000
heap
page read and write
615D000
heap
page read and write
6156000
heap
page read and write
6121000
heap
page read and write
6210000
trusted library allocation
page read and write
BF0000
unkown
page readonly
6140000
heap
page read and write
EBA000
unkown
page readonly
615B000
heap
page read and write
2C10000
trusted library allocation
page read and write
616F000
heap
page read and write
612D000
heap
page read and write
3A70000
heap
page read and write
61A6000
heap
page read and write
30DD000
trusted library allocation
page read and write
155B000
heap
page read and write
6711000
heap
page read and write
607E000
stack
page read and write
612F000
heap
page read and write
6137000
heap
page read and write
E47000
unkown
page readonly
6135000
heap
page read and write
C65000
unkown
page readonly
612B000
heap
page read and write
614C000
heap
page read and write
F30000
heap
page read and write
6140000
heap
page read and write
3BCE000
stack
page read and write
614B000
heap
page read and write
C65000
unkown
page readonly
E85000
unkown
page readonly
614F000
heap
page read and write
14D3000
heap
page read and write
3830000
trusted library allocation
page read and write
DF5000
unkown
page readonly
6167000
heap
page read and write
1320000
heap
page read and write
DCD000
unkown
page readonly
A32000
heap
page read and write
149D000
heap
page read and write
EAD000
unkown
page readonly
BF1000
unkown
page execute read
11FF000
heap
page read and write
E81000
unkown
page readonly
612D000
heap
page read and write
612B000
heap
page read and write
617D000
heap
page read and write
C70000
heap
page read and write
616E000
heap
page read and write
1494000
heap
page read and write
120E000
heap
page read and write
B7C000
stack
page read and write
613D000
heap
page read and write
820000
unkown
page readonly
54ED000
stack
page read and write
5D0000
direct allocation
page execute and read and write
615B000
heap
page read and write
DFC000
stack
page read and write
F05000
unkown
page readonly
2DAE000
stack
page read and write
AD3000
unkown
page read and write
1384000
heap
page read and write
507000
unkown
page read and write
C40000
direct allocation
page execute and read and write
6137000
heap
page read and write
5880000
remote allocation
page read and write
614F000
heap
page read and write
8F1000
heap
page read and write
E91000
unkown
page execute read
5E70000
heap
page read and write
155D000
heap
page read and write
612B000
heap
page read and write
6150000
heap
page read and write
7BB000
stack
page read and write
6145000
heap
page read and write
6129000
heap
page read and write
612B000
heap
page read and write
6128000
heap
page read and write
6171000
heap
page read and write
612F000
heap
page read and write
7B0000
heap
page read and write
616F000
heap
page read and write
E90000
unkown
page readonly
346F000
stack
page read and write
36CF000
stack
page read and write
2C0E000
stack
page read and write
371E000
stack
page read and write
6130000
heap
page read and write
13C0000
heap
page read and write
155A000
heap
page read and write
612D000
heap
page read and write
2EFE000
stack
page read and write
BDA000
heap
page read and write
6173000
heap
page read and write
155B000
heap
page read and write
DD0000
heap
page read and write
EB7000
unkown
page write copy
155C000
heap
page read and write
123A000
heap
page read and write
A48000
heap
page read and write
381E000
stack
page read and write
35C0000
trusted library allocation
page read and write
12B8000
heap
page read and write
E91000
unkown
page execute read
61A3000
heap
page read and write
6120000
heap
page read and write
614F000
heap
page read and write
6136000
heap
page read and write
14B3000
heap
page read and write
612B000
heap
page read and write
C7A000
heap
page read and write
69C0000
heap
page read and write
562E000
stack
page read and write
11F9000
heap
page read and write
F90000
heap
page read and write
F1A000
unkown
page readonly
35D8000
trusted library allocation
page read and write
1355000
heap
page read and write
615A000
heap
page read and write
155A000
heap
page read and write
EAD000
unkown
page readonly
14FB000
heap
page read and write
E1A000
unkown
page readonly
149D000
heap
page read and write
6138000
heap
page read and write
138E000
heap
page read and write
E3E000
unkown
page readonly
BF0000
unkown
page readonly
16DE000
stack
page read and write
4FD000
unkown
page readonly
EFC000
stack
page read and write
1470000
heap
page read and write
6134000
heap
page read and write
381E000
stack
page read and write
6150000
heap
page read and write
1559000
heap
page read and write
BF0000
unkown
page readonly
6210000
trusted library allocation
page read and write
E91000
unkown
page execute read
B7A000
heap
page read and write
618B000
heap
page read and write
117B000
heap
page read and write
1420000
heap
page read and write
6135000
heap
page read and write
C40000
heap
page read and write
6150000
heap
page read and write
EAD000
unkown
page readonly
BE0000
heap
page read and write
14CE000
heap
page read and write
14C7000
heap
page read and write
E0C000
unkown
page readonly
615A000
heap
page read and write
1182000
heap
page read and write
5A0000
heap
page read and write
14C9000
heap
page read and write
1505000
heap
page read and write
E08000
unkown
page readonly
EA5000
unkown
page readonly
A50000
heap
page read and write
8CD000
stack
page read and write
615F000
heap
page read and write
6210000
trusted library allocation
page read and write
3440000
trusted library allocation
page read and write
6154000
heap
page read and write
73C000
stack
page read and write
BD0000
heap
page read and write
612F000
heap
page read and write
97A000
heap
page read and write
EB7000
unkown
page write copy
1250000
heap
page read and write
E90000
unkown
page readonly
612F000
heap
page read and write
615E000
heap
page read and write
6134000
heap
page read and write
1184000
heap
page read and write
DE3000
unkown
page readonly
699C000
stack
page read and write
1346000
heap
page read and write
6148000
heap
page read and write
9BD000
heap
page read and write
661B000
heap
page read and write
13E0000
heap
page read and write
614F000
heap
page read and write
BF1000
unkown
page execute read
2E17000
trusted library allocation
page read and write
613F000
heap
page read and write
302D000
stack
page read and write
6136000
heap
page read and write
36D0000
trusted library allocation
page read and write
689B000
stack
page read and write
26DD000
stack
page read and write
1363000
heap
page read and write
615F000
heap
page read and write
259D000
stack
page read and write
6125000
heap
page read and write
2EEF000
stack
page read and write
159E000
stack
page read and write
1225000
heap
page read and write
12ED000
stack
page read and write
55ED000
stack
page read and write
613F000
heap
page read and write
154B000
heap
page read and write
6197000
heap
page read and write
5FB0000
trusted library allocation
page read and write
EEA000
unkown
page readonly
32AE000
stack
page read and write
5880000
remote allocation
page read and write
612D000
heap
page read and write
5F0000
heap
page read and write
CC5000
heap
page read and write
612D000
heap
page read and write
2CFE000
stack
page read and write
291F000
stack
page read and write
6166000
heap
page read and write
6139000
heap
page read and write
6210000
trusted library allocation
page read and write
147C000
heap
page read and write
2E2D000
stack
page read and write
6134000
heap
page read and write
2BAE000
stack
page read and write
DA0000
heap
page read and write
6111000
heap
page read and write
2C6F000
stack
page read and write
DD5000
unkown
page readonly
FFC000
stack
page read and write
6134000
heap
page read and write
1330000
heap
page read and write
6210000
trusted library allocation
page read and write
615E000
heap
page read and write
C36000
heap
page read and write
97D000
unkown
page readonly
613F000
heap
page read and write
6137000
heap
page read and write
26AE000
stack
page read and write
6135000
heap
page read and write
1440000
heap
page read and write
2F3E000
stack
page read and write
2DCD000
trusted library allocation
page read and write
E91000
unkown
page execute read
281E000
stack
page read and write
E91000
unkown
page execute read
613F000
heap
page read and write
3CCF000
stack
page read and write
EB7000
unkown
page read and write
3654000
trusted library allocation
page read and write
C2E000
heap
page read and write
612D000
heap
page read and write
615B000
heap
page read and write
F12000
unkown
page readonly
614F000
heap
page read and write
391F000
stack
page read and write
7A0000
direct allocation
page execute and read and write
614C000
heap
page read and write
D2B000
stack
page read and write
614F000
heap
page read and write
613F000
heap
page read and write
613C000
heap
page read and write
155A000
heap
page read and write
B30000
heap
page read and write
6166000
heap
page read and write
EB7000
unkown
page read and write
BF0000
heap
page read and write
EB7000
unkown
page write copy
614F000
heap
page read and write
614C000
heap
page read and write
6125000
heap
page read and write
6132000
heap
page read and write
E2C000
unkown
page readonly
6136000
heap
page read and write
613F000
heap
page read and write
614A000
heap
page read and write
615B000
heap
page read and write
146E000
heap
page read and write
5880000
remote allocation
page read and write
17DE000
stack
page read and write
576E000
stack
page read and write
E41000
unkown
page readonly
DF9000
unkown
page readonly
151F000
heap
page read and write
BB0000
heap
page read and write
E1C000
unkown
page readonly
F05000
unkown
page readonly
F5E000
stack
page read and write
6175000
heap
page read and write
318D000
stack
page read and write
613F000
heap
page read and write
619A000
heap
page read and write
311F000
stack
page read and write
619E000
heap
page read and write
E43000
unkown
page readonly
6132000
heap
page read and write
62C1000
heap
page read and write
E91000
unkown
page execute read
400000
remote allocation
page execute and read and write
EC7000
unkown
page readonly
613F000
heap
page read and write
3050000
trusted library allocation
page read and write
10FF000
stack
page read and write
6210000
trusted library allocation
page read and write
9CD000
stack
page read and write
C0D000
unkown
page readonly
6148000
heap
page read and write
615B000
heap
page read and write
616D000
heap
page read and write
2D2E000
stack
page read and write
F16000
unkown
page readonly
1220000
heap
page read and write
114A000
heap
page read and write
6110000
heap
page read and write
940000
heap
page read and write
C65000
unkown
page readonly
C01000
heap
page read and write
6175000
heap
page read and write
6210000
trusted library allocation
page read and write
123F000
stack
page read and write
6113000
heap
page read and write
1060000
heap
page read and write
1360000
direct allocation
page execute and read and write
DE0000
heap
page read and write
2BFF000
stack
page read and write
614C000
heap
page read and write
DCD000
unkown
page readonly
146A000
heap
page read and write
14A2000
heap
page read and write
9D0000
heap
page read and write
9A6000
heap
page read and write
613C000
heap
page read and write
E90000
unkown
page readonly
E6F000
unkown
page readonly
5C2E000
stack
page read and write
1330000
heap
page read and write
6134000
heap
page read and write
613F000
heap
page read and write
6111000
heap
page read and write
3090000
trusted library allocation
page read and write
9C0000
heap
page read and write
2C30000
heap
page read and write
612D000
heap
page read and write
6136000
heap
page read and write
14BB000
heap
page read and write
614E000
heap
page read and write
6210000
trusted library allocation
page read and write
6173000
heap
page read and write
616B000
heap
page read and write
616F000
heap
page read and write
126E000
stack
page read and write
6163000
heap
page read and write
2EC0000
heap
page read and write
1290000
heap
page read and write
6150000
heap
page read and write
E90000
unkown
page readonly
144A000
heap
page read and write
618B000
heap
page read and write
452000
remote allocation
page execute and read and write
6411000
heap
page read and write
6135000
heap
page read and write
614C000
heap
page read and write
343E000
stack
page read and write
54AB000
stack
page read and write
6710000
heap
page read and write
C0D000
unkown
page readonly
2DFD000
stack
page read and write
93E000
stack
page read and write
EAD000
unkown
page readonly
1460000
heap
page read and write
EAD000
unkown
page readonly
448000
remote allocation
page execute and read and write
155C000
heap
page read and write
6115000
heap
page read and write
2A5C000
stack
page read and write
614E000
heap
page read and write
2B6D000
stack
page read and write
155B000
heap
page read and write
3130000
heap
page read and write
613F000
heap
page read and write
6141000
heap
page read and write
6145000
heap
page read and write
54B000
stack
page read and write
6135000
heap
page read and write
AD4000
unkown
page execute read
B7E000
stack
page read and write
135E000
heap
page read and write
312E000
stack
page read and write
613D000
heap
page read and write
F05000
unkown
page readonly
6159000
heap
page read and write
155A000
heap
page read and write
615A000
heap
page read and write
A40000
heap
page read and write
E90000
unkown
page readonly
6134000
heap
page read and write
614F000
heap
page read and write
BF1000
unkown
page execute read
CAE000
stack
page read and write
ED7000
unkown
page readonly
35CD000
trusted library allocation
page read and write
F95000
heap
page read and write
6166000
heap
page read and write
614F000
heap
page read and write
6126000
heap
page read and write
2CAD000
stack
page read and write
614C000
heap
page read and write
6210000
trusted library allocation
page read and write
613F000
heap
page read and write
34AE000
stack
page read and write
12E0000
heap
page read and write
1736000
heap
page read and write
613F000
heap
page read and write
D90000
heap
page read and write
5B0000
heap
page read and write
169E000
stack
page read and write
6137000
heap
page read and write
61A6000
heap
page read and write
E30000
unkown
page readonly
612C000
heap
page read and write
2C20000
heap
page read and write
BAB000
heap
page read and write
EB7000
unkown
page write copy
613C000
heap
page read and write
6149000
heap
page read and write
There are 731 hidden memdumps, click here to show them.