IOC Report
GestorRemesasCONFIRMIMING.exe

loading gif

Files

File Path
Type
Category
Malicious
GestorRemesasCONFIRMIMING.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\tmpCF9B.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\XNYbGrcoFr.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GestorRemesasCONFIRMIMING.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XNYbGrcoFr.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
modified
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4vyaklqy.ki0.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h53jaw2f.hxe.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jop3u3bv.oez.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jz1e4ree.lva.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfcgyhhu.3dc.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngi45rvk.y1t.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ogdpofzj.txq.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xwnnny1s.qpf.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmpE0F1.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Roaming\XNYbGrcoFr.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
There are 6 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\GestorRemesasCONFIRMIMING.exe
"C:\Users\user\Desktop\GestorRemesasCONFIRMIMING.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\GestorRemesasCONFIRMIMING.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\XNYbGrcoFr.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XNYbGrcoFr" /XML "C:\Users\user\AppData\Local\Temp\tmpCF9B.tmp"
 malicious
C:\Users\user\Desktop\GestorRemesasCONFIRMIMING.exe
"C:\Users\user\Desktop\GestorRemesasCONFIRMIMING.exe"
 malicious
C:\Users\user\AppData\Roaming\XNYbGrcoFr.exe
C:\Users\user\AppData\Roaming\XNYbGrcoFr.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XNYbGrcoFr" /XML "C:\Users\user\AppData\Local\Temp\tmpE0F1.tmp"
 malicious
C:\Users\user\AppData\Roaming\XNYbGrcoFr.exe
"C:\Users\user\AppData\Roaming\XNYbGrcoFr.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
http://smtp.santonswitchgears.com
unknown
https://api.ipify.org/t
unknown
http://us2.smtp.mailhostbox.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://tempuri.org/DataSet1.xsdIDataAccessLayer.Properties.Resources
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
us2.smtp.mailhostbox.com
208.91.198.143
 malicious
ip-api.com
208.95.112.1
 malicious
smtp.santonswitchgears.com
unknown
 malicious
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
208.91.198.143
us2.smtp.mailhostbox.com
United States
malicious
208.95.112.1
ip-api.com
United States
malicious
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\GestorRemesasCONFIRMIMING_RASMANCS
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\XNYbGrcoFr_RASMANCS
FileDirectory
There are 19 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
38C0000
trusted library allocation
page read and write
 malicious
2B4D000
trusted library allocation
page read and write
 malicious
3065000
trusted library allocation
page read and write
 malicious
41E8000
trusted library allocation
page read and write
 malicious
308D000
trusted library allocation
page read and write
 malicious
3B11000
trusted library allocation
page read and write
 malicious
2B24000
trusted library allocation
page read and write
 malicious
437000
remote allocation
page execute and read and write
 malicious
4FE0000
trusted library allocation
page execute and read and write
429000
remote allocation
page execute and read and write
3089000
trusted library allocation
page read and write
CD0000
trusted library allocation
page read and write
6D2F000
stack
page read and write
CB0000
trusted library allocation
page read and write
5000000
heap
page read and write
C20000
heap
page execute and read and write
325D000
stack
page read and write
C00000
trusted library allocation
page read and write
B94D000
stack
page read and write
D08000
heap
page read and write
4D40000
trusted library allocation
page read and write
6D00000
trusted library allocation
page read and write
F0E000
stack
page read and write
2710000
heap
page read and write
D37000
heap
page read and write
A28000
heap
page read and write
3B0000
heap
page read and write
5021000
trusted library allocation
page read and write
285A000
trusted library allocation
page read and write
CD7000
heap
page read and write
8BA000
stack
page read and write
67AE000
heap
page read and write
4FD0000
trusted library allocation
page execute and read and write
1092000
trusted library allocation
page read and write
500B000
trusted library allocation
page read and write
C9E000
stack
page read and write
B92000
trusted library allocation
page read and write
2B5D000
trusted library allocation
page read and write
9C2F000
stack
page read and write
AF50000
heap
page read and write
6493000
heap
page read and write
2F0E000
unkown
page read and write
1096000
trusted library allocation
page execute and read and write
1E2000
unkown
page readonly
24A6000
trusted library allocation
page execute and read and write
424000
remote allocation
page execute and read and write
993C000
trusted library allocation
page read and write
2581000
trusted library allocation
page read and write
56A0000
heap
page read and write
4ED0000
heap
page read and write
2DBA000
trusted library allocation
page read and write
4A6B000
trusted library allocation
page read and write
662E000
stack
page read and write
3625000
trusted library allocation
page read and write
6ADF000
stack
page read and write
3035000
trusted library allocation
page read and write
802C000
heap
page read and write
2A80000
trusted library allocation
page read and write
27B0000
trusted library allocation
page read and write
4D50000
trusted library allocation
page read and write
42A000
remote allocation
page execute and read and write
4F90000
trusted library allocation
page read and write
43B000
remote allocation
page execute and read and write
3C38000
trusted library allocation
page read and write
35D7000
trusted library allocation
page read and write
5450000
trusted library allocation
page read and write
2B49000
trusted library allocation
page read and write
B80000
trusted library allocation
page read and write
10A7000
trusted library allocation
page execute and read and write
2DA0000
trusted library allocation
page read and write
278D000
trusted library allocation
page read and write
4A86000
trusted library allocation
page read and write
980000
heap
page read and write
309E000
stack
page read and write
2D9E000
stack
page read and write
85FE000
stack
page read and write
10A5000
trusted library allocation
page execute and read and write
5032000
trusted library allocation
page read and write
4438000
trusted library allocation
page read and write
2E00000
heap
page read and write
434000
remote allocation
page execute and read and write
375E000
trusted library allocation
page read and write
435000
remote allocation
page execute and read and write
546D000
trusted library allocation
page read and write
304D000
trusted library allocation
page read and write
6A10000
trusted library allocation
page read and write
58D0000
trusted library allocation
page execute and read and write
10B5000
heap
page read and write
BEE000
stack
page read and write
B73000
trusted library allocation
page read and write
5458000
trusted library allocation
page read and write
B5CD000
stack
page read and write
CE0000
trusted library allocation
page read and write
6970000
trusted library allocation
page read and write
D00000
heap
page read and write
1060000
trusted library allocation
page read and write
800000
heap
page read and write
9A9000
heap
page read and write
14A0000
trusted library allocation
page read and write
68F0000
trusted library allocation
page execute and read and write
540C000
stack
page read and write
6486000
heap
page read and write
C30000
heap
page read and write
50D0000
heap
page read and write
4A92000
trusted library allocation
page read and write
837000
heap
page read and write
2A5F000
stack
page read and write
69DE000
stack
page read and write
2560000
trusted library allocation
page read and write
AF4D000
stack
page read and write
2786000
trusted library allocation
page read and write
9CA000
heap
page read and write
510D000
stack
page read and write
B28D000
stack
page read and write
FE5000
trusted library allocation
page execute and read and write
2B0D000
trusted library allocation
page read and write
4C10000
trusted library allocation
page read and write
1070000
trusted library allocation
page read and write
6D6E000
stack
page read and write
4B00000
heap
page read and write
FE7000
trusted library allocation
page execute and read and write
B50000
trusted library allocation
page read and write
360F000
stack
page read and write
501E000
trusted library allocation
page read and write
6890000
trusted library allocation
page read and write
5780000
heap
page read and write
50C3000
heap
page read and write
260A000
trusted library allocation
page read and write
645E000
stack
page read and write
667D000
stack
page read and write
B3A000
stack
page read and write
6897000
trusted library allocation
page read and write
B5CD000
stack
page read and write
D70000
heap
page read and write
4BC0000
trusted library section
page readonly
3AB4000
trusted library allocation
page read and write
422000
remote allocation
page execute and read and write
2DA6000
trusted library allocation
page read and write
4AA0000
trusted library allocation
page read and write
5150000
heap
page read and write
B38E000
stack
page read and write
4B60000
trusted library allocation
page execute and read and write
FE2000
trusted library allocation
page read and write
B80E000
stack
page read and write
843000
heap
page read and write
27C0000
heap
page execute and read and write
26AB000
trusted library allocation
page read and write
32E0000
heap
page read and write
4001000
trusted library allocation
page read and write
A2C000
heap
page read and write
7FC10000
trusted library allocation
page execute and read and write
4DDF000
trusted library section
page readonly
B24E000
stack
page read and write
43D000
remote allocation
page execute and read and write
2DAB000
trusted library allocation
page read and write
2BB0000
heap
page read and write
7FA50000
trusted library allocation
page execute and read and write
104E000
stack
page read and write
24D0000
trusted library allocation
page read and write
4B12000
trusted library allocation
page read and write
1480000
trusted library allocation
page read and write
30DF000
stack
page read and write
10FE000
stack
page read and write
C6E000
stack
page read and write
2A70000
trusted library allocation
page read and write
68DE000
stack
page read and write
2A60000
trusted library allocation
page read and write
3A0000
heap
page read and write
66BF000
stack
page read and write
50C0000
heap
page read and write
B7E000
stack
page read and write
5460000
trusted library allocation
page read and write
2E28000
trusted library allocation
page read and write
56D3000
heap
page read and write
BB0000
trusted library allocation
page read and write
805C000
heap
page read and write
B8A000
trusted library allocation
page execute and read and write
68A7000
trusted library allocation
page read and write
35CE000
stack
page read and write
B70000
trusted library allocation
page read and write
37D9000
trusted library allocation
page read and write
7B5000
heap
page read and write
39AE000
trusted library allocation
page read and write
45C0000
trusted library allocation
page read and write
5006000
trusted library allocation
page read and write
810000
heap
page read and write
4FA0000
trusted library allocation
page read and write
423000
remote allocation
page execute and read and write
2B6C000
trusted library allocation
page read and write
27A6000
trusted library allocation
page read and write
1220000
trusted library allocation
page execute and read and write
6A40000
trusted library allocation
page execute and read and write
6F7000
stack
page read and write
CC0000
trusted library allocation
page read and write
2B4B000
trusted library allocation
page read and write
988000
heap
page read and write
108D000
trusted library allocation
page execute and read and write
4C40000
trusted library allocation
page read and write
51B0000
trusted library allocation
page read and write
25F0000
trusted library allocation
page read and write
38C3000
trusted library allocation
page read and write
6DE0000
trusted library allocation
page execute and read and write
823E000
stack
page read and write
BE0000
heap
page read and write
1238000
heap
page read and write
6910000
trusted library allocation
page execute and read and write
4C80000
heap
page read and write
62EE000
stack
page read and write
2BE0000
heap
page read and write
290000
unkown
page readonly
C57000
heap
page read and write
6A10000
trusted library allocation
page execute and read and write
502D000
trusted library allocation
page read and write
3C5000
heap
page read and write
B70E000
stack
page read and write
12EE000
heap
page read and write
652E000
stack
page read and write
1E0000
unkown
page readonly
4B40000
trusted library allocation
page read and write
2F6B000
heap
page read and write
CC0000
trusted library allocation
page read and write
689D000
trusted library allocation
page read and write
28FB000
trusted library allocation
page read and write
3AD4000
trusted library allocation
page read and write
4E00000
trusted library allocation
page read and write
3884000
trusted library allocation
page read and write
CF5000
heap
page read and write
24AA000
trusted library allocation
page execute and read and write
2DBE000
trusted library allocation
page read and write
30AC000
trusted library allocation
page read and write
1074000
trusted library allocation
page read and write
421000
remote allocation
page execute and read and write
67A0000
heap
page read and write
28B3000
trusted library allocation
page read and write
6A20000
trusted library allocation
page execute and read and write
2AB0000
heap
page execute and read and write
6990000
trusted library allocation
page read and write
2DC1000
trusted library allocation
page read and write
C10000
trusted library allocation
page read and write
4066000
trusted library allocation
page read and write
B08E000
stack
page read and write
78E000
heap
page read and write
B86000
trusted library allocation
page execute and read and write
4E60000
trusted library allocation
page execute and read and write
14B0000
trusted library allocation
page read and write
8202000
trusted library allocation
page read and write
6D90000
heap
page read and write
9C8000
heap
page read and write
1230000
heap
page read and write
1477000
heap
page read and write
1258000
heap
page read and write
B97000
trusted library allocation
page execute and read and write
B44F000
stack
page read and write
4D50000
heap
page execute and read and write
2A90000
trusted library allocation
page read and write
2940000
trusted library allocation
page execute and read and write
1267000
heap
page read and write
6CE0000
trusted library allocation
page execute and read and write
1080000
trusted library allocation
page read and write
471C000
stack
page read and write
43E000
remote allocation
page execute and read and write
12C4000
heap
page read and write
436000
remote allocation
page execute and read and write
3450000
heap
page read and write
9B8000
stack
page read and write
FD2000
trusted library allocation
page read and write
2DC6000
trusted library allocation
page read and write
4A60000
trusted library allocation
page read and write
2490000
trusted library allocation
page read and write
4FDD000
stack
page read and write
6D10000
trusted library section
page read and write
303F000
trusted library allocation
page read and write
2FF0000
heap
page execute and read and write
24B7000
trusted library allocation
page execute and read and write
4DD0000
trusted library section
page readonly
6830000
heap
page read and write
121E000
stack
page read and write
7C7000
heap
page read and write
4AC0000
trusted library allocation
page read and write
58C7000
trusted library allocation
page read and write
807F000
heap
page read and write
83B000
heap
page read and write
6862000
heap
page read and write
B0CD000
stack
page read and write
7140000
heap
page read and write
257E000
stack
page read and write
428000
remote allocation
page execute and read and write
2750000
trusted library allocation
page read and write
4D70000
trusted library allocation
page execute and read and write
A5E000
heap
page read and write
4D20000
trusted library allocation
page read and write
12A3000
heap
page read and write
7FC90000
trusted library allocation
page execute and read and write
602F000
stack
page read and write
B60000
trusted library allocation
page read and write
D1D000
heap
page read and write
F4E000
stack
page read and write
2AF5000
trusted library allocation
page read and write
A75000
heap
page read and write
5670000
heap
page read and write
6467000
heap
page read and write
4BBB000
stack
page read and write
3430000
heap
page read and write
2480000
trusted library allocation
page read and write
1030000
heap
page read and write
CD7000
heap
page read and write
84E7000
heap
page read and write
6A3C000
trusted library allocation
page read and write
4FB0000
trusted library allocation
page read and write
63F0000
heap
page read and write
500E000
trusted library allocation
page read and write
5026000
trusted library allocation
page read and write
FD6000
trusted library allocation
page execute and read and write
43C000
remote allocation
page execute and read and write
68EE000
stack
page read and write
6DAD000
stack
page read and write
248D000
trusted library allocation
page execute and read and write
25AE000
stack
page read and write
CD0000
heap
page read and write
24A0000
trusted library allocation
page read and write
2743000
heap
page read and write
3673000
trusted library allocation
page read and write
CD4000
trusted library allocation
page read and write
687E000
heap
page read and write
7F9C0000
trusted library allocation
page execute and read and write
5000000
trusted library allocation
page read and write
1470000
heap
page read and write
6888000
trusted library allocation
page read and write
6FCE000
stack
page read and write
3B26000
trusted library allocation
page read and write
308B000
trusted library allocation
page read and write
A4F000
stack
page read and write
868000
heap
page read and write
B64000
trusted library allocation
page read and write
635D000
stack
page read and write
2E10000
heap
page read and write
4FF0000
trusted library allocation
page read and write
BF0000
heap
page read and write
2B0D000
stack
page read and write
66FE000
stack
page read and write
5012000
trusted library allocation
page read and write
2950000
heap
page read and write
433000
remote allocation
page execute and read and write
B80B000
stack
page read and write
519E000
stack
page read and write
891E000
stack
page read and write
5020000
trusted library section
page read and write
4A8D000
trusted library allocation
page read and write
45C5000
trusted library allocation
page read and write
460D000
stack
page read and write
45BE000
stack
page read and write
2740000
heap
page read and write
14F7000
heap
page read and write
4A7E000
trusted library allocation
page read and write
2781000
trusted library allocation
page read and write
B7D000
trusted library allocation
page execute and read and write
2484000
trusted library allocation
page read and write
BA4E000
stack
page read and write
7A7000
heap
page read and write
146C000
stack
page read and write
2840000
trusted library allocation
page read and write
142E000
stack
page read and write
B48C000
stack
page read and write
681E000
stack
page read and write
56FC000
stack
page read and write
B90000
heap
page read and write
2A86000
trusted library allocation
page read and write
6C1E000
stack
page read and write
58E0000
trusted library allocation
page read and write
24BB000
trusted library allocation
page execute and read and write
1264000
heap
page read and write
1073000
trusted library allocation
page execute and read and write
10A0000
trusted library allocation
page read and write
68A0000
trusted library allocation
page read and write
27A0000
trusted library allocation
page read and write
6820000
heap
page read and write
5060000
heap
page execute and read and write
10D7000
heap
page read and write
3680000
heap
page read and write
2483000
trusted library allocation
page execute and read and write
32A000
stack
page read and write
6977000
trusted library allocation
page read and write
860000
heap
page read and write
4DF0000
heap
page read and write
B58E000
stack
page read and write
4E70000
trusted library allocation
page execute and read and write
108C000
stack
page read and write
400000
remote allocation
page execute and read and write
4C92000
trusted library allocation
page read and write
48CC000
stack
page read and write
5340000
heap
page read and write
6880000
trusted library allocation
page read and write
73E000
stack
page read and write
FEB000
trusted library allocation
page execute and read and write
4B30000
heap
page read and write
342E000
unkown
page read and write
10B0000
heap
page read and write
87DF000
stack
page read and write
251E000
stack
page read and write
B390000
heap
page read and write
6489000
heap
page read and write
6898000
heap
page read and write
6A5E000
stack
page read and write
8535000
heap
page read and write
C20000
heap
page read and write
6CDE000
stack
page read and write
2DB2000
trusted library allocation
page read and write
B82000
trusted library allocation
page read and write
84BE000
stack
page read and write
4FFE000
stack
page read and write
6900000
trusted library allocation
page read and write
6C0E000
stack
page read and write
6432000
heap
page read and write
CD3000
trusted library allocation
page execute and read and write
CAB000
stack
page read and write
2AFF000
trusted library allocation
page read and write
B90C000
stack
page read and write
564E000
stack
page read and write
A34000
heap
page read and write
7C4000
heap
page read and write
420000
remote allocation
page execute and read and write
881E000
stack
page read and write
83BE000
stack
page read and write
402000
remote allocation
page execute and read and write
50AC000
stack
page read and write
1090000
trusted library allocation
page read and write
249D000
trusted library allocation
page execute and read and write
3AE9000
trusted library allocation
page read and write
647C000
heap
page read and write
14C3000
heap
page read and write
3589000
trusted library allocation
page read and write
27D1000
trusted library allocation
page read and write
5030000
heap
page read and write
2760000
trusted library allocation
page read and write
8090000
heap
page read and write
3310000
heap
page read and write
64A5000
heap
page read and write
D29000
heap
page read and write
97E000
stack
page read and write
63EE000
stack
page read and write
100F000
stack
page read and write
14A4000
trusted library allocation
page read and write
270B000
stack
page read and write
597000
stack
page read and write
10D0000
heap
page read and write
2B11000
trusted library allocation
page read and write
56B0000
heap
page read and write
3190000
heap
page read and write
AF60000
heap
page read and write
6E30000
heap
page read and write
4D30000
trusted library allocation
page read and write
1490000
trusted library allocation
page read and write
84C0000
heap
page read and write
B63000
trusted library allocation
page execute and read and write
4C90000
trusted library allocation
page read and write
CD0000
heap
page read and write
695E000
stack
page read and write
2F60000
heap
page read and write
69D0000
heap
page read and write
B58C000
stack
page read and write
4BD0000
heap
page read and write
4B33000
heap
page read and write
98E000
heap
page read and write
FD0000
trusted library allocation
page read and write
4D00000
heap
page read and write
BA0000
heap
page read and write
2DAE000
trusted library allocation
page read and write
1000000
trusted library allocation
page read and write
3AC1000
trusted library allocation
page read and write
806E000
heap
page read and write
827E000
stack
page read and write
780000
heap
page read and write
255E000
stack
page read and write
DC4000
heap
page read and write
5035000
heap
page read and write
67FE000
stack
page read and write
4A81000
trusted library allocation
page read and write
27A4000
trusted library allocation
page read and write
3299000
stack
page read and write
4CA0000
trusted library allocation
page execute and read and write
4029000
trusted library allocation
page read and write
6444000
heap
page read and write
6CF7000
trusted library allocation
page read and write
4C15000
trusted library allocation
page read and write
26CE000
stack
page read and write
6870000
heap
page read and write
CF0000
heap
page read and write
6CF0000
trusted library allocation
page read and write
3A36000
trusted library allocation
page read and write
2DCD000
trusted library allocation
page read and write
B9B000
trusted library allocation
page execute and read and write
37D1000
trusted library allocation
page read and write
C50000
heap
page read and write
3C0000
heap
page read and write
109A000
trusted library allocation
page execute and read and write
5770000
heap
page read and write
2493000
trusted library allocation
page read and write
50EE000
stack
page read and write
10A2000
trusted library allocation
page read and write
8563000
heap
page read and write
107D000
trusted library allocation
page execute and read and write
14C0000
heap
page read and write
BC0000
heap
page read and write
807D000
heap
page read and write
BF0000
trusted library allocation
page execute and read and write
69C0000
heap
page read and write
CC5000
trusted library allocation
page read and write
9B7000
heap
page read and write
CDD000
trusted library allocation
page execute and read and write
4C20000
trusted library allocation
page read and write
4DCC000
stack
page read and write
309D000
trusted library allocation
page read and write
6D10000
trusted library allocation
page read and write
3458000
heap
page read and write
358F000
unkown
page read and write
24A2000
trusted library allocation
page read and write
4B10000
trusted library allocation
page read and write
55FC000
stack
page read and write
390000
heap
page read and write
2B4A000
stack
page read and write
42B000
remote allocation
page execute and read and write
3001000
trusted library allocation
page read and write
671E000
stack
page read and write
B6D000
trusted library allocation
page execute and read and write
4EA0000
trusted library section
page read and write
5470000
heap
page execute and read and write
501A000
trusted library allocation
page read and write
24B2000
trusted library allocation
page read and write
25C0000
heap
page read and write
8555000
heap
page read and write
865000
heap
page read and write
A69000
heap
page read and write
8000000
heap
page read and write
77E000
stack
page read and write
4EC0000
trusted library allocation
page read and write
86DE000
stack
page read and write
4DE0000
heap
page read and write
5440000
heap
page read and write
58C0000
trusted library allocation
page read and write
B6CE000
stack
page read and write
B14E000
stack
page read and write
2888000
trusted library allocation
page read and write
10AB000
trusted library allocation
page execute and read and write
2FBD000
stack
page read and write
6980000
trusted library allocation
page read and write
4D10000
trusted library allocation
page read and write
4B20000
trusted library allocation
page execute and read and write
6B1E000
stack
page read and write
5155000
heap
page read and write
86FE000
stack
page read and write
2BC0000
heap
page read and write
C9E000
stack
page read and write
B4E000
stack
page read and write
B34E000
stack
page read and write
2F4F000
unkown
page read and write
63FC000
heap
page read and write
276B000
trusted library allocation
page read and write
24B0000
trusted library allocation
page read and write
3581000
trusted library allocation
page read and write
85E000
stack
page read and write
8055000
heap
page read and write
277E000
trusted library allocation
page read and write
2AC1000
trusted library allocation
page read and write
11D0000
trusted library allocation
page read and write
3051000
trusted library allocation
page read and write
CC0000
trusted library allocation
page read and write
4E10000
heap
page execute and read and write
832000
heap
page read and write
3BBA000
trusted library allocation
page read and write
6A9D000
stack
page read and write
14F0000
heap
page read and write
CED000
trusted library allocation
page execute and read and write
49A000
stack
page read and write
FDA000
trusted library allocation
page execute and read and write
D34000
heap
page read and write
B6CF000
stack
page read and write
2920000
heap
page read and write
837F000
stack
page read and write
2A84000
trusted library allocation
page read and write
2730000
trusted library allocation
page execute and read and write
4BBE000
stack
page read and write
501E000
stack
page read and write
EF8000
stack
page read and write
There are 573 hidden memdumps, click here to show them.