IOC Report
tWitaq427K.exe

loading gif

Files

File Path
Type
Category
Malicious
tWitaq427K.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tWitaq427K.exe_ede55bcbdbc173d71a3dbb97cb9bdbf86b6df14_f3754e4a_b90d445d-99d0-4d9e-971e-4d3d1768a930\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\remcos\logs.dat
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tWitaq427K.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\CCSJ.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmp7D5C.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\znlzneAxBVd.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\znlzneAxBVd.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB814.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Jul 1 13:57:09 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC9A.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBCC9.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\znlzneAxBVd.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2avnx2jo.mry.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2moj532a.xg1.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ade5r5y1.zgn.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jscth40y.cts.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nn1igfkt.5cq.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvxq1atw.edz.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sndiob5v.yqx.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x5gviura.n3b.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\bhv6DEB.tmp
Extensible storage engine DataBase, version 0x620, checksum 0x0155ffb7, page size 32768, DirtyShutdown, Windows version 10.0
dropped
C:\Users\user\AppData\Local\Temp\bhv86CD.tmp
Extensible storage engine DataBase, version 0x620, checksum 0x0155ffb7, page size 32768, DirtyShutdown, Windows version 10.0
dropped
C:\Users\user\AppData\Local\Temp\gncx
Unicode text, UTF-16, little-endian text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\qtoymupgtjxsaaccmaaspxxfkmvim
Unicode text, UTF-16, little-endian text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp9076.tmp
XML 1.0 document, ASCII text
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 18 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\tWitaq427K.exe
"C:\Users\user\Desktop\tWitaq427K.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tWitaq427K.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\znlzneAxBVd.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\znlzneAxBVd" /XML "C:\Users\user\AppData\Local\Temp\tmp7D5C.tmp"
 malicious
C:\Users\user\Desktop\tWitaq427K.exe
"C:\Users\user\Desktop\tWitaq427K.exe"
 malicious
C:\Users\user\AppData\Roaming\znlzneAxBVd.exe
C:\Users\user\AppData\Roaming\znlzneAxBVd.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\znlzneAxBVd" /XML "C:\Users\user\AppData\Local\Temp\tmp9076.tmp"
 malicious
C:\Users\user\AppData\Roaming\znlzneAxBVd.exe
"C:\Users\user\AppData\Roaming\znlzneAxBVd.exe"
 malicious
C:\Users\user\Desktop\tWitaq427K.exe
C:\Users\user\Desktop\tWitaq427K.exe /stext "C:\Users\user\AppData\Local\Temp\qtoymupgtjxsaaccmaaspxxfkmvim"
 malicious
C:\Users\user\Desktop\tWitaq427K.exe
C:\Users\user\Desktop\tWitaq427K.exe /stext "C:\Users\user\AppData\Local\Temp\avtqnnaahrpfcgygdlmlsckwtsernvlr"
 malicious
C:\Users\user\Desktop\tWitaq427K.exe
C:\Users\user\Desktop\tWitaq427K.exe /stext "C:\Users\user\AppData\Local\Temp\dpyb"
 malicious
C:\Users\user\Desktop\tWitaq427K.exe
C:\Users\user\Desktop\tWitaq427K.exe /stext "C:\Users\user\AppData\Local\Temp\gncx"
 malicious
C:\Users\user\Desktop\tWitaq427K.exe
C:\Users\user\Desktop\tWitaq427K.exe /stext "C:\Users\user\AppData\Local\Temp\azftvwrumrngvelhzdysqkd"
 malicious
C:\Users\user\Desktop\tWitaq427K.exe
C:\Users\user\Desktop\tWitaq427K.exe /stext "C:\Users\user\AppData\Local\Temp\youltgrrcajydbitqwajywbyycxy"
 malicious
C:\Users\user\AppData\Local\Temp\CCSJ.exe
"C:\Users\user\AppData\Local\Temp\CCSJ.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7964 -s 1876
There are 11 hidden processes, click here to show them.

URLs

Name
IP
Malicious
antfly50.sytes.net
malicious
http://geoplugin.net/json.gp
178.237.33.50
https://www.google.com
unknown
http://www.imvu.comr
unknown
https://account.dyn.com/
unknown
http://geoplugin.net/json.gp/C
unknown
http://www.imvu.com
unknown
http://secure.globals
unknown
https://www.google.com/accounts/servicelogin
unknown
http://upx.sf.net
unknown
https://login.yahoo.com/config/login
unknown
http://www.nirsoft.net
unknown
http://www.nirsoft.net/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
unknown
http://smtp.yandex.com
unknown
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
unknown
http://www.ebuddy.com
unknown
There are 8 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
antfly50.sytes.net
80.85.154.121
 malicious
smtp.yandex.com
unknown
 malicious
smtp.yandex.ru
77.88.21.158
geoplugin.net
178.237.33.50

IPs

IP
Domain
Country
Malicious
80.85.154.121
antfly50.sytes.net
Russian Federation
malicious
77.88.21.158
smtp.yandex.ru
Russian Federation
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-BW3KDF
exepath
HKEY_CURRENT_USER\SOFTWARE\Rmc-BW3KDF
licence
HKEY_CURRENT_USER\SOFTWARE\Rmc-BW3KDF
time
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
ProgramId
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
FileId
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
LowerCaseLongPath
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
LongPathHash
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
Name
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
OriginalFileName
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
Publisher
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
Version
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
BinFileVersion
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
BinaryType
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
ProductName
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
ProductVersion
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
LinkDate
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
BinProductVersion
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
AppxPackageFullName
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
AppxPackageRelativeId
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
Size
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
Language
\REGISTRY\A\{2f1e1abb-7718-9e89-4f45-6235b22f84eb}\Root\InventoryApplicationFile\twitaq427k.exe|167a85f170ebf73f
Usn
There are 12 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3B4C000
trusted library allocation
page read and write
 malicious
2DC9000
trusted library allocation
page read and write
 malicious
8F2000
unkown
page readonly
 malicious
3CDC000
trusted library allocation
page read and write
 malicious
2D9E000
trusted library allocation
page read and write
 malicious
C07000
heap
page read and write
 malicious
BBA000
heap
page read and write
 malicious
299F000
stack
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
2D51000
trusted library allocation
page read and write
 malicious
474000
remote allocation
page execute and read and write
2C5E000
stack
page read and write
372F000
stack
page read and write
E80000
heap
page read and write
52C0000
heap
page read and write
F97000
trusted library allocation
page execute and read and write
BF0000
heap
page read and write
2D1B000
trusted library allocation
page read and write
549B000
stack
page read and write
5AAF000
heap
page read and write
5020000
heap
page read and write
3CBE000
trusted library allocation
page read and write
5726000
trusted library allocation
page read and write
E40000
heap
page read and write
FDC000
heap
page read and write
2A40000
heap
page execute and read and write
F3C000
stack
page read and write
8F4E000
stack
page read and write
313E000
stack
page read and write
387F000
stack
page read and write
429B000
stack
page read and write
10B7000
heap
page read and write
D8F000
stack
page read and write
112F000
stack
page read and write
854E000
stack
page read and write
168E000
heap
page read and write
C3E000
stack
page read and write
E60000
heap
page read and write
92FD000
stack
page read and write
F80000
trusted library allocation
page read and write
1310000
trusted library allocation
page read and write
FDE000
stack
page read and write
2B60000
heap
page read and write
9E0000
heap
page read and write
1680000
heap
page read and write
7F880000
trusted library allocation
page execute and read and write
12D6000
stack
page read and write
5730000
trusted library allocation
page execute and read and write
130C000
stack
page read and write
12B0000
heap
page read and write
5830000
trusted library section
page read and write
F2C000
stack
page read and write
AC0000
heap
page read and write
147E000
stack
page read and write
FF4000
heap
page read and write
5550000
trusted library section
page read and write
2C20000
heap
page read and write
10D5000
heap
page read and write
1000000
trusted library allocation
page read and write
FCE000
heap
page read and write
11BE000
stack
page read and write
2A92000
trusted library allocation
page read and write
2CCA000
trusted library allocation
page read and write
52A0000
trusted library allocation
page execute and read and write
12DB000
stack
page read and write
FE7000
heap
page read and write
103C000
stack
page read and write
FC6000
trusted library allocation
page execute and read and write
5520000
heap
page read and write
1610000
heap
page read and write
EB5000
heap
page read and write
61EF000
stack
page read and write
FA4000
trusted library allocation
page read and write
CD5000
heap
page read and write
CF8000
stack
page read and write
127C000
stack
page read and write
FC8000
heap
page read and write
CE0000
heap
page read and write
29FE000
stack
page read and write
16A6000
heap
page read and write
2CD6000
trusted library allocation
page read and write
1047000
trusted library allocation
page execute and read and write
1045000
trusted library allocation
page execute and read and write
2AA0000
heap
page read and write
439D000
stack
page read and write
5FFE000
stack
page read and write
2C71000
trusted library allocation
page read and write
F63000
trusted library allocation
page execute and read and write
FF0000
trusted library allocation
page read and write
3EA2000
heap
page read and write
FAD000
trusted library allocation
page execute and read and write
C6D000
heap
page read and write
92AC000
stack
page read and write
1040000
trusted library allocation
page execute and read and write
CE0000
heap
page read and write
F50000
trusted library allocation
page read and write
600E000
stack
page read and write
92B0000
heap
page read and write
3530000
heap
page read and write
87CD000
stack
page read and write
5154000
trusted library allocation
page read and write
53EC000
stack
page read and write
F82000
trusted library allocation
page read and write
471000
remote allocation
page execute and read and write
BA7000
heap
page read and write
1080000
trusted library allocation
page read and write
2CB0000
trusted library allocation
page read and write
478000
remote allocation
page execute and read and write
8F3E000
stack
page read and write
266F000
stack
page read and write
CBC000
stack
page read and write
2E28000
trusted library allocation
page read and write
E3C000
stack
page read and write
103E000
stack
page read and write
1750000
heap
page read and write
102D000
trusted library allocation
page execute and read and write
271D000
stack
page read and write
400000
system
page execute and read and write
3020000
heap
page read and write
FC8000
heap
page read and write
1042000
trusted library allocation
page read and write
10000000
direct allocation
page read and write
1134000
stack
page read and write
2710000
heap
page read and write
565E000
stack
page read and write
8C4E000
stack
page read and write
BD0000
heap
page read and write
104B000
trusted library allocation
page execute and read and write
1140000
heap
page read and write
1050000
heap
page read and write
5280000
heap
page read and write
515B000
trusted library allocation
page read and write
566F000
stack
page read and write
FC0000
heap
page read and write
4CCE000
stack
page read and write
FC2000
trusted library allocation
page read and write
1130000
heap
page read and write
1198000
heap
page read and write
1350000
heap
page read and write
4C70000
trusted library allocation
page read and write
363F000
stack
page read and write
353F000
stack
page read and write
3073000
heap
page read and write
59B0000
heap
page read and write
56FF000
stack
page read and write
3ADD000
stack
page read and write
2D90000
heap
page read and write
45DE000
stack
page read and write
5D35000
trusted library allocation
page read and write
98C000
stack
page read and write
95B000
stack
page read and write
107F000
heap
page read and write
5841000
trusted library allocation
page read and write
B77000
stack
page read and write
2DA6000
trusted library allocation
page read and write
F60000
trusted library allocation
page read and write
3360000
heap
page read and write
301D000
heap
page read and write
6310000
heap
page read and write
13F0000
heap
page read and write
333E000
unkown
page read and write
5D40000
trusted library allocation
page execute and read and write
5176000
trusted library allocation
page read and write
140E000
stack
page read and write
F80000
heap
page read and write
31E0000
heap
page read and write
112E000
stack
page read and write
35BF000
stack
page read and write
474000
remote allocation
page execute and read and write
4600000
heap
page read and write
2AC0000
trusted library allocation
page read and write
D37000
stack
page read and write
5171000
trusted library allocation
page read and write
11AE000
heap
page read and write
456000
system
page execute and read and write
FFE000
stack
page read and write
557B000
heap
page read and write
341A000
stack
page read and write
52E0000
heap
page execute and read and write
29DB000
stack
page read and write
35AE000
stack
page read and write
8A30000
heap
page read and write
11F0000
heap
page read and write
109E000
heap
page read and write
CD5000
heap
page read and write
51A0000
trusted library allocation
page read and write
5050000
trusted library allocation
page read and write
F4E000
stack
page read and write
878F000
stack
page read and write
2D9C000
trusted library allocation
page read and write
CFC000
stack
page read and write
1170000
heap
page read and write
BF0000
heap
page read and write
552F000
stack
page read and write
160E000
heap
page read and write
1360000
heap
page read and write
406F000
trusted library allocation
page read and write
353F000
stack
page read and write
556E000
stack
page read and write
16A1000
heap
page read and write
382F000
stack
page read and write
2A81000
trusted library allocation
page read and write
455E000
stack
page read and write
1032000
trusted library allocation
page read and write
12FA000
stack
page read and write
18BE000
stack
page read and write
128F000
stack
page read and write
2C60000
heap
page execute and read and write
169A000
heap
page read and write
2A8D000
trusted library allocation
page read and write
5720000
trusted library allocation
page read and write
88EE000
stack
page read and write
4E4D000
stack
page read and write
4C75000
trusted library allocation
page read and write
CE3000
heap
page read and write
285B000
stack
page read and write
1059000
heap
page read and write
D1B000
heap
page read and write
2C1F000
stack
page read and write
2FB8000
trusted library allocation
page read and write
8DAE000
stack
page read and write
2AD0000
heap
page read and write
109A000
heap
page read and write
332E000
stack
page read and write
4AE8000
trusted library allocation
page read and write
12CE000
stack
page read and write
FFF000
heap
page read and write
4FC0000
trusted library allocation
page read and write
644E000
stack
page read and write
1070000
trusted library allocation
page execute and read and write
8E0C000
stack
page read and write
660E000
stack
page read and write
654E000
stack
page read and write
5032000
trusted library allocation
page read and write
5554000
heap
page read and write
2B0F000
unkown
page read and write
3488000
heap
page read and write
4C80000
trusted library allocation
page execute and read and write
3DB0000
heap
page read and write
59A0000
heap
page read and write
1146000
heap
page read and write
3E3F000
trusted library allocation
page read and write
45C000
system
page execute and read and write
3340000
heap
page read and write
2A6B000
trusted library allocation
page read and write
165F000
stack
page read and write
3EFA000
trusted library allocation
page read and write
5E4E000
heap
page read and write
1626000
heap
page read and write
FE0000
heap
page read and write
D44000
heap
page read and write
F7D000
trusted library allocation
page execute and read and write
FC0000
heap
page read and write
1132000
stack
page read and write
FCA000
trusted library allocation
page execute and read and write
5FCF000
stack
page read and write
1040000
trusted library allocation
page read and write
AC8000
heap
page read and write
4E0C000
stack
page read and write
4FE0000
trusted library allocation
page read and write
3C6D000
stack
page read and write
2CBB000
trusted library allocation
page read and write
6890000
heap
page read and write
2CCE000
trusted library allocation
page read and write
93C000
stack
page read and write
5212000
trusted library allocation
page read and write
5559000
heap
page read and write
1320000
heap
page read and write
6850000
trusted library allocation
page read and write
31DF000
stack
page read and write
2BAE000
stack
page read and write
2D9E000
stack
page read and write
5D8E000
stack
page read and write
7F660000
trusted library allocation
page execute and read and write
545E000
stack
page read and write
1060000
trusted library allocation
page read and write
2CC2000
trusted library allocation
page read and write
FD2000
trusted library allocation
page read and write
93FE000
stack
page read and write
15CE000
stack
page read and write
D28000
heap
page read and write
51C0000
trusted library allocation
page read and write
5220000
trusted library allocation
page execute and read and write
158F000
stack
page read and write
5FF0000
trusted library section
page read and write
F86000
trusted library allocation
page execute and read and write
E4E000
stack
page read and write
904E000
stack
page read and write
533B000
stack
page read and write
289E000
stack
page read and write
3FB2000
heap
page read and write
5DCE000
stack
page read and write
1134000
heap
page read and write
50A0000
trusted library allocation
page read and write
1340000
heap
page read and write
18E0000
heap
page read and write
174E000
stack
page read and write
50C0000
heap
page read and write
8B4E000
stack
page read and write
2A3C000
stack
page read and write
D20000
heap
page read and write
88CD000
stack
page read and write
8C50000
heap
page read and write
3078000
heap
page read and write
2AA0000
trusted library allocation
page read and write
356E000
stack
page read and write
CAA000
heap
page read and write
1031000
heap
page read and write
9F0000
heap
page read and write
86AE000
stack
page read and write
32B0000
heap
page read and write
9190000
trusted library allocation
page read and write
2730000
heap
page read and write
45D000
system
page execute and read and write
3340000
heap
page read and write
2ADF000
stack
page read and write
BA0000
heap
page read and write
FDB000
trusted library allocation
page execute and read and write
302F000
heap
page read and write
2CBE000
trusted library allocation
page read and write
400000
system
page execute and read and write
F9B000
trusted library allocation
page execute and read and write
1010000
trusted library allocation
page read and write
36AF000
stack
page read and write
6017000
trusted library allocation
page read and write
B10000
heap
page read and write
1338000
trusted library allocation
page read and write
12EF000
stack
page read and write
B8B000
stack
page read and write
101D000
trusted library allocation
page execute and read and write
3C71000
trusted library allocation
page read and write
3FE5000
heap
page read and write
E00000
heap
page read and write
C3A000
stack
page read and write
32EE000
stack
page read and write
581E000
stack
page read and write
E80000
heap
page read and write
2B20000
heap
page read and write
13E0000
trusted library allocation
page read and write
2AB0000
trusted library allocation
page read and write
1388000
heap
page read and write
F4F000
stack
page read and write
5FC3000
heap
page read and write
2D82000
trusted library allocation
page read and write
1190000
heap
page read and write
1036000
trusted library allocation
page execute and read and write
168C000
heap
page read and write
87AE000
stack
page read and write
5F2E000
stack
page read and write
389E000
stack
page read and write
EB0000
heap
page read and write
571E000
stack
page read and write
9B9000
stack
page read and write
5230000
trusted library allocation
page read and write
12F2000
stack
page read and write
916F000
stack
page read and write
10001000
direct allocation
page execute and read and write
5D30000
trusted library allocation
page read and write
BE0000
heap
page read and write
38A0000
heap
page read and write
5D3F000
trusted library allocation
page read and write
27B0000
heap
page read and write
1368000
heap
page read and write
DBA000
stack
page read and write
2DC5000
trusted library allocation
page read and write
5DEE000
stack
page read and write
3000000
heap
page read and write
32FE000
unkown
page read and write
908E000
stack
page read and write
32AE000
stack
page read and write
8A2D000
stack
page read and write
85C000
stack
page read and write
3480000
heap
page read and write
918E000
stack
page read and write
5D2E000
stack
page read and write
3DAF000
trusted library allocation
page read and write
1380000
heap
page read and write
2D5F000
stack
page read and write
3D84000
trusted library allocation
page read and write
EC0000
heap
page read and write
2720000
heap
page read and write
400000
system
page execute and read and write
6381000
heap
page read and write
4450000
heap
page read and write
60EE000
stack
page read and write
88C000
stack
page read and write
9410000
trusted library allocation
page read and write
2ABF000
trusted library allocation
page read and write
2D33000
heap
page read and write
E70000
heap
page read and write
5560000
heap
page read and write
A8C000
stack
page read and write
12AF000
trusted library allocation
page read and write
459000
system
page execute and read and write
5671000
trusted library allocation
page read and write
1480000
heap
page read and write
155F000
stack
page read and write
445B000
heap
page read and write
FA3000
trusted library allocation
page execute and read and write
2D2C000
stack
page read and write
2BEF000
stack
page read and write
27FE000
unkown
page read and write
91AB000
stack
page read and write
FBD000
trusted library allocation
page execute and read and write
FA0000
trusted library allocation
page read and write
2D30000
heap
page read and write
9DE000
stack
page read and write
A80000
heap
page read and write
8B6E000
stack
page read and write
5F30000
trusted library allocation
page execute and read and write
5030000
trusted library allocation
page read and write
C81000
heap
page read and write
990000
heap
page read and write
BE0000
heap
page read and write
2717000
heap
page read and write
5195000
trusted library allocation
page read and write
2CD1000
trusted library allocation
page read and write
FB3000
trusted library allocation
page read and write
3AE9000
trusted library allocation
page read and write
4D0E000
stack
page read and write
459E000
stack
page read and write
EC5000
heap
page read and write
1129000
heap
page read and write
275A000
stack
page read and write
45D000
system
page execute and read and write
5190000
heap
page read and write
1280000
trusted library allocation
page read and write
5350000
heap
page execute and read and write
CAE000
heap
page read and write
1320000
heap
page execute and read and write
392F000
stack
page read and write
2C2A000
heap
page read and write
C39000
heap
page read and write
5710000
trusted library allocation
page read and write
3160000
heap
page read and write
FB0000
trusted library allocation
page read and write
1014000
trusted library allocation
page read and write
1780000
heap
page read and write
F0E000
stack
page read and write
C6A000
heap
page read and write
868E000
stack
page read and write
377E000
stack
page read and write
CCC000
heap
page read and write
45A000
system
page execute and read and write
F73000
trusted library allocation
page read and write
FE0000
heap
page read and write
13D0000
trusted library allocation
page read and write
F6E000
stack
page read and write
1001000
heap
page read and write
167D000
heap
page read and write
FB0000
trusted library allocation
page read and write
5200000
heap
page read and write
2CDD000
trusted library allocation
page read and write
892000
unkown
page readonly
10D2000
heap
page read and write
88E0000
heap
page read and write
5EFE000
stack
page read and write
3FB4000
trusted library allocation
page read and write
8F0C000
stack
page read and write
566E000
stack
page read and write
8C6F000
stack
page read and write
15F0000
heap
page read and write
CCA000
heap
page read and write
4675000
heap
page read and write
F64000
trusted library allocation
page read and write
2C5E000
stack
page read and write
FBF000
stack
page read and write
2B92000
trusted library allocation
page read and write
56AE000
stack
page read and write
103A000
trusted library allocation
page execute and read and write
FC0000
trusted library allocation
page read and write
3E4E000
trusted library allocation
page read and write
2CC4000
trusted library allocation
page read and write
1290000
trusted library allocation
page read and write
8B0E000
stack
page read and write
55FF000
stack
page read and write
1013000
trusted library allocation
page execute and read and write
322B000
stack
page read and write
892D000
stack
page read and write
B0E000
stack
page read and write
ADC000
heap
page read and write
3F35000
heap
page read and write
88D0000
heap
page read and write
39DD000
stack
page read and write
9FE000
stack
page read and write
3C99000
trusted library allocation
page read and write
1628000
heap
page read and write
1330000
heap
page read and write
2B10000
heap
page read and write
D72000
heap
page read and write
2B1C000
stack
page read and write
517D000
trusted library allocation
page read and write
35D0000
heap
page read and write
138F000
stack
page read and write
A90000
heap
page read and write
12AE000
stack
page read and write
890000
unkown
page readonly
F6D000
trusted library allocation
page execute and read and write
5850000
trusted library allocation
page read and write
F8A000
trusted library allocation
page execute and read and write
C90000
heap
page read and write
1020000
trusted library allocation
page read and write
3041000
heap
page read and write
B50000
heap
page read and write
2A60000
trusted library allocation
page read and write
15F8000
heap
page read and write
3FE2000
heap
page read and write
C00000
heap
page read and write
A40000
heap
page read and write
5EEB000
stack
page read and write
12F4000
stack
page read and write
6870000
heap
page read and write
13D4000
trusted library allocation
page read and write
50B0000
heap
page read and write
5190000
trusted library allocation
page read and write
D9F000
stack
page read and write
670E000
stack
page read and write
6020000
trusted library allocation
page read and write
D15000
heap
page read and write
D1D000
heap
page read and write
1010000
heap
page read and write
165F000
stack
page read and write
373F000
stack
page read and write
3D51000
trusted library allocation
page read and write
B9E000
stack
page read and write
FCE000
stack
page read and write
5820000
trusted library allocation
page execute and read and write
13CE000
stack
page read and write
54A0000
heap
page execute and read and write
516E000
trusted library allocation
page read and write
31E0000
heap
page read and write
8A0D000
stack
page read and write
3340000
heap
page read and write
1480000
heap
page read and write
12BA000
heap
page read and write
5210000
trusted library allocation
page read and write
2AA4000
trusted library allocation
page read and write
11C0000
heap
page read and write
2BE2000
trusted library allocation
page read and write
3BDF000
stack
page read and write
FD7000
trusted library allocation
page execute and read and write
87EE000
stack
page read and write
9B0000
heap
page read and write
3C79000
trusted library allocation
page read and write
2DB8000
trusted library allocation
page read and write
2CAF000
stack
page read and write
302C000
heap
page read and write
68A0000
trusted library allocation
page execute and read and write
7FA40000
trusted library allocation
page execute and read and write
2FFF000
stack
page read and write
2E9F000
stack
page read and write
542E000
stack
page read and write
D90000
heap
page read and write
136E000
stack
page read and write
1400000
heap
page read and write
2A64000
trusted library allocation
page read and write
18ED000
heap
page read and write
263F000
stack
page read and write
3D79000
trusted library allocation
page read and write
4410000
heap
page read and write
7201000
trusted library allocation
page read and write
1030000
trusted library allocation
page read and write
3D6B000
stack
page read and write
3AE1000
trusted library allocation
page read and write
61CE000
stack
page read and write
2D86000
trusted library allocation
page read and write
1057000
heap
page read and write
2A7E000
trusted library allocation
page read and write
5280000
trusted library allocation
page read and write
635A000
heap
page read and write
5040000
trusted library allocation
page execute and read and write
5460000
trusted library allocation
page execute and read and write
3440000
heap
page read and write
F70000
trusted library allocation
page read and write
399F000
stack
page read and write
CA0000
heap
page read and write
906E000
stack
page read and write
56EE000
stack
page read and write
1090000
heap
page read and write
323D000
stack
page read and write
41B000
system
page execute and read and write
41E000
system
page execute and read and write
5470000
heap
page read and write
3B09000
trusted library allocation
page read and write
8E3E000
stack
page read and write
11BF000
stack
page read and write
5E30000
heap
page read and write
3FF2000
heap
page read and write
F90000
trusted library allocation
page read and write
12A0000
trusted library allocation
page read and write
347E000
stack
page read and write
D20000
heap
page read and write
50C3000
heap
page read and write
256E000
stack
page read and write
3EC0000
heap
page read and write
52DC000
trusted library allocation
page read and write
CDE000
heap
page read and write
2AE1000
trusted library allocation
page read and write
10016000
direct allocation
page execute and read and write
FD0000
heap
page read and write
C7E000
stack
page read and write
2A86000
trusted library allocation
page read and write
178D000
heap
page read and write
6352000
heap
page read and write
123E000
stack
page read and write
5EB0000
trusted library allocation
page read and write
327A000
stack
page read and write
1660000
heap
page read and write
5150000
trusted library allocation
page read and write
12F0000
heap
page read and write
864F000
stack
page read and write
F90000
heap
page read and write
F3D000
stack
page read and write
2AC5000
trusted library allocation
page read and write
1118000
heap
page read and write
A7A000
stack
page read and write
1116000
stack
page read and write
E0E000
stack
page read and write
2DD2000
trusted library allocation
page read and write
111B000
stack
page read and write
4C7F000
trusted library allocation
page read and write
3A2F000
stack
page read and write
2AA6000
trusted library allocation
page read and write
5290000
heap
page read and write
5E7D000
heap
page read and write
8CAE000
stack
page read and write
D25000
heap
page read and write
6010000
trusted library allocation
page read and write
52C0000
trusted library allocation
page read and write
382E000
stack
page read and write
5260000
trusted library allocation
page execute and read and write
52C3000
heap
page read and write
473000
system
page execute and read and write
9E0000
heap
page read and write
115E000
stack
page read and write
2A50000
trusted library allocation
page read and write
2D40000
heap
page read and write
26E0000
heap
page read and write
1420000
heap
page read and write
43DE000
stack
page read and write
52D0000
trusted library allocation
page read and write
1190000
heap
page read and write
F92000
trusted library allocation
page read and write
8F0000
unkown
page readonly
11E0000
trusted library allocation
page execute and read and write
1050000
heap
page read and write
A00000
heap
page read and write
5182000
trusted library allocation
page read and write
4C7C000
stack
page read and write
12EE000
stack
page read and write
There are 640 hidden memdumps, click here to show them.