IOC Report
imfsbSvc.exe

loading gif

Files

File Path
Type
Category
Malicious
imfsbSvc.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\ProgramData\IObit\DgApi.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\ProgramData\IObit\imfsbDll.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\ProgramData\IObit\imfsbSvc.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\ProgramData\IObit\imfsbSvc.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\IObit\dbindex.dat
data
modified
C:\ProgramData\Microsoft\Network\Downloader\edb.chk
data
dropped
C:\ProgramData\Microsoft\Network\Downloader\edb.log
data
dropped
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
Extensible storage engine DataBase, version 0x620, checksum 0x0bb51b49, page size 16384, Windows version 10.0
dropped
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
data
dropped
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
JSON data
dropped
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log
Unicode text, UTF-16, little-endian text, with CRLF line terminators
modified
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\ProgramData\IObit\imfsbSvc.exe
C:\ProgramData\IObit\imfsbSvc.exe
 malicious
C:\Windows\System32\winlogon.exe
C:\Windows\system32\winlogon.exe
 malicious
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
 malicious
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
 malicious
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
 malicious
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
 malicious
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
 malicious
C:\Users\user\Desktop\imfsbSvc.exe
"C:\Users\user\Desktop\imfsbSvc.exe"
C:\Windows\System32\cmd.exe
C:\Windows\system32\cmd.exe
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\sc.exe
sc create "IObit" DisplayName= "Platinum user session wrapper" binPath= "C:\ProgramData\IObit\imfsbSvc.exe" type= own start= auto error= ignore
C:\Windows\System32\SgrmBroker.exe
C:\Windows\system32\SgrmBroker.exe
C:\Windows\System32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 5 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8
160.16.200.77
 malicious
http://esh.hoovernamosong.com/000000000039F835000000000039F835
160.16.200.77
 malicious
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD
160.16.200.77
 malicious
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF
160.16.200.77
 malicious
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8
160.16.200.77
 malicious
https://esh.hoovernamosong.com/000000000039F130000000000039F130
160.16.200.77
 malicious
HTTP://esh.hoovernamosong.com:806
unknown
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF(
unknown
https://dev.ditu.live.com/REST/v1/Routes/
unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving
unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
unknown
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CDIDInfo
unknown
HTTP://esh.hoovernamosong.com:80B
unknown
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAF1
unknown
https://dev.virtualearth.net/REST/v1/Routes/Walking
unknown
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD#
unknown
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8G
unknown
https://esh.hoovernamosong.com/
unknown
https://esh.hoovernamosong.com/r
unknown
https://esh.hoovernamosong.com/00000000003BB6CD00000000003BB6CD(
unknown
https://esh.hoovernamosong.com/ernamosong.com/00000000003BB6CD00000000003BB6CD#
unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx
unknown
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
unknown
https://esh.hoovernamosong.com/000000000039F130000000000039F130c
unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
unknown
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8g(P#
unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/
unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=
unknown
HTTP://esh.hoovernamosong.com:80%
unknown
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8#
unknown
HTTP://esh.hoovernamosong.com:80
unknown
https://ocsp.quovadisoffshore.com0
unknown
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8M
unknown
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE83.0.30729;
unknown
http://www.bingmapsportal.com
unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
unknown
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
unknown
http://esh.hoovernamosong.com/00000000003BBBAF00000000003BBBAFa
unknown
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
unknown
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8t
unknown
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D81
unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/
unknown
https://dev.virtualearth.net/REST/v1/Routes/
unknown
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
unknown
http://crl.ver)
unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
unknown
http://esh.hoovernamosong.com/000000000039F835000000000039F835M
unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
unknown
https://dev.virtualearth.net/REST/v1/Locations
unknown
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
unknown
https://dev.virtualearth.net/mapcontrol/logging.ashx
unknown
https://esh.hoovernamosong.com/00000000003C68D800000000003C68D8(
unknown
https://g.live.com/odclientsettings/Prod/C:
unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
unknown
http://esh.hoovernamosong.com/00000000003C6DE800000000003C6DE8Y
unknown
https://dynamic.t
unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit
unknown
https://dev.ditu.live.com/webservices/v1/LoggingService/LoggingService.svc/Log?
unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
unknown
https://dev.ditu.live.com/REST/v1/Transit/Schedules/
unknown
http://www.quovadis.bm0
unknown
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
unknown
https://dev.ditu.live.com/REST/v1/Locations
unknown
https://t0.ssl.ak.dynamic.tiles.virtu
unknown
http://esh.hoovernamosong.com/000000000039F835000000000039F835(
unknown
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
unknown
There are 60 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
esh.hoovernamosong.com
160.16.200.77
 malicious

IPs

IP
Domain
Country
Malicious
160.16.200.77
esh.hoovernamosong.com
Japan
malicious
127.0.0.1
unknown
unknown

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
cval
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IObit\TMLYVTXTB
BPRJQEJQ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IObit\VSUBVZEHXI
YUVJYXLU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IObit\VSUBVZEHXI
YUVJYXLU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IObit\VSUBVZEHXI
YUVJYXLU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
PerfMMFileName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Security
c688cf83-9945-5ff6-0e1e-1ff1f8a2ec9a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
ServiceSessionId

Memdumps

Base Address
Regiontype
Protect
Malicious
19173C79000
heap
page read and write
70000
direct allocation
page read and write
79E9A7D000
stack
page read and write
19174713000
heap
page read and write
93000
direct allocation
page read and write
60000
direct allocation
page execute read
1917DCD0000
trusted library allocation
page read and write
1917DD50000
remote allocation
page read and write
289D0A23000
heap
page read and write
19173C6E000
heap
page read and write
1E6CF300000
heap
page read and write
289D1534000
heap
page read and write
1EB6AA87000
heap
page read and write
1BB26685000
heap
page read and write
60000
direct allocation
page execute read
219A682B000
heap
page read and write
26A09B00000
unclassified section
page readonly
100017000
direct allocation
page read and write
19173CA9000
heap
page read and write
289D0A0C000
heap
page read and write
96D8DBE000
stack
page read and write
1E6CF213000
heap
page read and write
1E6CFA15000
heap
page read and write
19175980000
trusted library allocation
page read and write
22000
direct allocation
page read and write
19173CDE000
heap
page read and write
1EB6AA6B000
heap
page read and write
289D0957000
heap
page read and write
219A67E0000
unclassified section
page readonly
289D0A0C000
heap
page read and write
3D4E30B000
stack
page read and write
B3D1A7D000
stack
page read and write
19175C00000
trusted library allocation
page read and write
7FF7EE198000
unkown
page readonly
1EB6AA0B000
heap
page read and write
93000
direct allocation
page read and write
19175A43000
heap
page read and write
1E6CF283000
heap
page read and write
13000
direct allocation
page read and write
1EB6AA13000
heap
page read and write
19175970000
trusted library allocation
page read and write
19173CC7000
heap
page read and write
1EB6AAAA000
heap
page read and write
26A09C00000
heap
page read and write
3D4E7FE000
stack
page read and write
289D09DC000
heap
page read and write
E8A90FE000
stack
page read and write
30000
direct allocation
page execute read
29F009E6000
heap
page read and write
289D0A0F000
heap
page read and write
19175A51000
heap
page read and write
1E6CFA00000
heap
page read and write
289D152B000
heap
page read and write
50000
direct allocation
page execute read
B3D18FD000
stack
page read and write
19175B02000
heap
page read and write
289D155B000
heap
page read and write
289D09DC000
heap
page read and write
289D098D000
heap
page read and write
19173CB2000
heap
page read and write
1917DF50000
trusted library allocation
page read and write
1E6CF1C0000
heap
page read and write
55A4E000
unkown
page readonly
26A09C85000
heap
page read and write
7FF797EA8000
unkown
page readonly
289D0A0C000
heap
page read and write
1E6CF200000
heap
page read and write
1EB6AA58000
heap
page read and write
7FF797E71000
unkown
page execute read
289D0975000
heap
page read and write
1917DC1C000
trusted library allocation
page read and write
1917DC0A000
trusted library allocation
page read and write
E8A8CFC000
stack
page read and write
219A6885000
heap
page read and write
55A4B000
unkown
page read and write
219A687D000
heap
page read and write
1BB26531000
direct allocation
page read and write
1EB6A9C0000
heap
page read and write
E8A8FFE000
stack
page read and write
1917DC10000
trusted library allocation
page read and write
289D1510000
remote allocation
page read and write
1BB261D0000
heap
page read and write
30000
direct allocation
page execute read
19175B61000
heap
page read and write
19175A75000
heap
page read and write
80000
direct allocation
page execute read
100010000
direct allocation
page execute read
26A09C83000
heap
page read and write
83000
direct allocation
page read and write
1EB6AA63000
heap
page read and write
26A09C3E000
heap
page read and write
19173D06000
heap
page read and write
1BB26430000
heap
page read and write
1EB6AA61000
heap
page read and write
19173D16000
heap
page read and write
7FF94B651000
unkown
page execute read
289D0969000
heap
page read and write
7FF94B48F000
unkown
page readonly
19173CD8000
heap
page read and write
29F00AC1000
direct allocation
page read and write
1EB6AA4C000
heap
page read and write
7FF7EE160000
unkown
page readonly
289D099B000
heap
page read and write
1BB26369000
heap
page read and write
1EB6AA99000
heap
page read and write
875C77B000
stack
page read and write
289D09DC000
heap
page read and write
1E6CF1B0000
unclassified section
page readonly
19175A43000
heap
page read and write
289D1620000
trusted library allocation
page read and write
1EB6AB02000
heap
page read and write
289D0A0F000
heap
page read and write
7FF94B68F000
unkown
page read and write
1EB6AA5C000
heap
page read and write
26A09B60000
trusted library allocation
page read and write
1E6CF273000
heap
page read and write
219A6855000
heap
page read and write
26A09D02000
heap
page read and write
289D08A1000
remote allocation
page read and write
19175A84000
heap
page read and write
26A09C41000
heap
page read and write
1E6CF030000
heap
page read and write
19173C6C000
heap
page read and write
94C7B8B000
stack
page read and write
191759A0000
trusted library allocation
page read and write
10000
direct allocation
page execute read
3D4E9FE000
stack
page read and write
19174470000
trusted library allocation
page read and write
559C1000
unkown
page execute read
1EB6AA9E000
heap
page read and write
1EB6B280000
trusted library allocation
page read and write
1EB6AA55000
heap
page read and write
19173C00000
heap
page read and write
19173C9D000
heap
page read and write
191759C0000
trusted library allocation
page read and write
28348F19000
heap
page read and write
19173C52000
heap
page read and write
70000
direct allocation
page read and write
1EB6A9B0000
unclassified section
page readonly
96D937E000
stack
page read and write
1EB6AA66000
heap
page read and write
875C378000
stack
page read and write
93000
direct allocation
page read and write
1EB6AA34000
heap
page read and write
1EB6AA59000
heap
page read and write
19174700000
heap
page read and write
7FF7EE161000
unkown
page execute read
289D1510000
remote allocation
page read and write
1E6CF27E000
heap
page read and write
19174600000
heap
page read and write
26A09BD0000
remote allocation
page read and write
B3D17FF000
stack
page read and write
875CEFA000
stack
page read and write
289D14C0000
trusted library allocation
page read and write
289D0BD0000
direct allocation
page read and write
1917475A000
heap
page read and write
1BB2636B000
heap
page read and write
79E9B7E000
stack
page read and write
289D098D000
heap
page read and write
79E9BFD000
stack
page read and write
289D0A24000
heap
page read and write
19175A54000
heap
page read and write
219A6740000
heap
page read and write
1E6CF24C000
heap
page read and write
19173CC2000
heap
page read and write
40000
direct allocation
page execute read
289D09BF000
heap
page read and write
55A61000
unkown
page execute read
19174702000
heap
page read and write
26A09C28000
heap
page read and write
20000
direct allocation
page execute read
19173BA0000
heap
page read and write
10000
direct allocation
page execute read
7FF7EE1AC000
unkown
page read and write
19173B50000
heap
page read and write
D2767F000
stack
page read and write
1BB26530000
direct allocation
page execute read
19175B5C000
heap
page read and write
289D1578000
heap
page read and write
191758D1000
trusted library allocation
page read and write
1EB6AA98000
heap
page read and write
289D0A0F000
heap
page read and write
19173CBA000
heap
page read and write
19173CA3000
heap
page read and write
1E6CF265000
heap
page read and write
219A6850000
heap
page read and write
55A4A000
unkown
page write copy
14921450000
heap
page read and write
875CDFB000
stack
page read and write
29F00760000
heap
page read and write
19174602000
heap
page read and write
29F00AE0000
direct allocation
page read and write
29F00940000
heap
page read and write
1BB26680000
heap
page read and write
1EB6AA00000
heap
page read and write
289D0941000
heap
page read and write
289D1578000
heap
page read and write
1BB2633C000
heap
page read and write
1E6CF263000
heap
page read and write
1BB26369000
heap
page read and write
19175A88000
heap
page read and write
289D0930000
heap
page read and write
7FF797EA8000
unkown
page readonly
7FF797E70000
unkown
page readonly
B3D1B7E000
stack
page read and write
19175A46000
heap
page read and write
1EB6AA68000
heap
page read and write
965CAFE000
unkown
page read and write
19173C41000
heap
page read and write
875CC7F000
stack
page read and write
1917DC16000
trusted library allocation
page read and write
289D0B20000
heap
page readonly
83000
direct allocation
page read and write
1EB6AA62000
heap
page read and write
96D8D3E000
stack
page read and write
79E9E7D000
stack
page read and write
19175A73000
heap
page read and write
100010000
direct allocation
page execute read
289D0996000
heap
page read and write
1E6CF23B000
heap
page read and write
289D0A1A000
heap
page read and write
19175B65000
heap
page read and write
22000
direct allocation
page read and write
875CAFB000
stack
page read and write
1EB6AA52000
heap
page read and write
289D0BB0000
direct allocation
page read and write
19175910000
trusted library allocation
page read and write
26A09D17000
heap
page read and write
19173B90000
unclassified section
page readonly
1EB6AA56000
heap
page read and write
289D09DB000
heap
page read and write
3D4E6FD000
stack
page read and write
14921710000
heap
page read and write
219A683E000
heap
page read and write
14921620000
heap
page read and write
1917DC70000
trusted library allocation
page read and write
289D09DB000
heap
page read and write
289D1567000
heap
page read and write
1BB26396000
heap
page read and write
1E6CF9B0000
trusted library allocation
page read and write
50000
direct allocation
page execute read
219A6889000
heap
page read and write
19174719000
heap
page read and write
3D4E8FE000
stack
page read and write
33CBFCB000
stack
page read and write
7FF7EE1AE000
unkown
page readonly
26A09CA2000
heap
page read and write
1917DC0D000
trusted library allocation
page read and write
1BB264B0000
heap
page read and write
1E6CF22A000
heap
page read and write
1EB6AA5D000
heap
page read and write
19173CDE000
heap
page read and write
26A09D00000
heap
page read and write
1917DC1F000
trusted library allocation
page read and write
289D0937000
heap
page read and write
875C67C000
stack
page read and write
28348D47000
heap
page read and write
100017000
direct allocation
page read and write
1E6CF240000
heap
page read and write
34000
direct allocation
page read and write
19175990000
trusted library allocation
page read and write
7FF797EBC000
unkown
page read and write
29F00AC0000
direct allocation
page execute read
289D09A9000
heap
page read and write
1E6CF279000
heap
page read and write
289D0A0C000
heap
page read and write
26A09C13000
heap
page read and write
42000
direct allocation
page read and write
289D0969000
heap
page read and write
B3D13CE000
stack
page read and write
19175900000
trusted library allocation
page read and write
D2731D000
stack
page read and write
7FF797E71000
unkown
page execute read
1EB6AA5B000
heap
page read and write
26A09C79000
heap
page read and write
1BB26570000
direct allocation
page read and write
1EB6AA4F000
heap
page read and write
100017000
direct allocation
page read and write
1917DD50000
remote allocation
page read and write
219A6902000
heap
page read and write
19175A9B000
heap
page read and write
34000
direct allocation
page read and write
19175ADF000
heap
page read and write
875C47E000
stack
page read and write
28348D47000
heap
page read and write
1EB6AA42000
heap
page read and write
289D1520000
heap
page read and write
19175A00000
heap
page read and write
19173D13000
heap
page read and write
1EB6AA31000
heap
page read and write
289D09DC000
heap
page read and write
55ACE000
unkown
page readonly
289D095C000
heap
page read and write
219A6813000
heap
page read and write
34000
direct allocation
page read and write
26A099F0000
heap
page read and write
19175B58000
heap
page read and write
7FF797EBC000
unkown
page write copy
1EB6A970000
heap
page read and write
289D1510000
remote allocation
page read and write
19175AA2000
heap
page read and write
80000
direct allocation
page execute read
1EB6AA6E000
heap
page read and write
219A7202000
trusted library allocation
page read and write
191759A0000
trusted library allocation
page read and write
1917DC90000
trusted library allocation
page read and write
1917DC60000
trusted library allocation
page read and write
54000
direct allocation
page read and write
28348D2B000
heap
page read and write
55A2E000
unkown
page readonly
60000
direct allocation
page execute read
289D1538000
heap
page read and write
1917DC13000
trusted library allocation
page read and write
1EB6AA69000
heap
page read and write
289D09D2000
heap
page read and write
55AEE000
unkown
page readonly
1EB6AA43000
heap
page read and write
289D09B1000
heap
page read and write
7FF7EE161000
unkown
page execute read
E8A8DFD000
stack
page read and write
79E9D7E000
stack
page read and write
19175A65000
heap
page read and write
1EB6AA70000
heap
page read and write
29F008C0000
heap
page read and write
1BB26365000
heap
page read and write
1917DC23000
trusted library allocation
page read and write
7FF7EE198000
unkown
page readonly
19173C84000
heap
page read and write
7FF94B49F000
unkown
page read and write
20000
direct allocation
page execute read
26A09980000
heap
page read and write
289D098D000
heap
page read and write
1E6CF302000
heap
page read and write
19175A4E000
heap
page read and write
875D0FF000
stack
page read and write
28348F20000
heap
page read and write
1BB26369000
heap
page read and write
289D09B0000
heap
page read and write
875BEEB000
stack
page read and write
D2739E000
stack
page read and write
7FF94B693000
unkown
page readonly
19175A46000
heap
page read and write
1917DF40000
trusted library allocation
page read and write
1EB6AA5A000
heap
page read and write
83000
direct allocation
page read and write
1EB6AA89000
heap
page read and write
289D0B35000
heap
page read and write
1917DD50000
remote allocation
page read and write
7FF797EBE000
unkown
page readonly
1917DC26000
trusted library allocation
page read and write
26A09D13000
heap
page read and write
10000
direct allocation
page execute read
289D0A0C000
heap
page read and write
219A6800000
heap
page read and write
289D09DC000
heap
page read and write
289D0966000
heap
page read and write
28348D20000
heap
page read and write
50000
direct allocation
page execute read
29F00C30000
heap
page read and write
26A09C9B000
heap
page read and write
219A6876000
heap
page read and write
1EB6A900000
heap
page read and write
19173CCE000
heap
page read and write
1917475A000
heap
page read and write
55AEB000
unkown
page read and write
1917DCC0000
trusted library allocation
page read and write
1EB6AA4A000
heap
page read and write
42000
direct allocation
page read and write
1BB26550000
direct allocation
page read and write
1BB26330000
heap
page read and write
26A09C63000
heap
page read and write
54000
direct allocation
page read and write
219A6802000
heap
page read and write
96D927F000
stack
page read and write
33CC2FF000
stack
page read and write
26A09BD0000
remote allocation
page read and write
219A6AD0000
heap
page read and write
219A687F000
heap
page read and write
1917DC00000
trusted library allocation
page read and write
96D8CBC000
stack
page read and write
29F00B00000
direct allocation
page read and write
19174615000
heap
page read and write
289D0B30000
heap
page read and write
7FF94B67F000
unkown
page readonly
1E6CFA02000
heap
page read and write
100010000
direct allocation
page execute read
1EB6AA5F000
heap
page read and write
19173CE1000
heap
page read and write
289D1538000
heap
page read and write
90000
direct allocation
page execute read
28348B90000
heap
page read and write
29F009DB000
heap
page read and write
19173CA5000
heap
page read and write
289D099B000
heap
page read and write
289D1578000
heap
page read and write
30000
direct allocation
page execute read
79E949B000
stack
page read and write
19174704000
heap
page read and write
94C817E000
stack
page read and write
289D0A0F000
heap
page read and write
289D09A9000
heap
page read and write
191754B0000
trusted library allocation
page read and write
7FF7EE1AE000
unkown
page readonly
7FF7EE1AC000
unkown
page write copy
14921715000
heap
page read and write
1917DC19000
trusted library allocation
page read and write
19173C13000
heap
page read and write
54000
direct allocation
page read and write
40000
direct allocation
page execute read
79E9EFE000
stack
page read and write
96D907E000
stack
page read and write
7FF94B650000
unkown
page readonly
289D09DC000
heap
page read and write
1EB6AA6D000
heap
page read and write
B3D1876000
stack
page read and write
29F009CC000
heap
page read and write
19173CDA000
heap
page read and write
1917DC80000
trusted library allocation
page read and write
19173CD5000
heap
page read and write
19173CB0000
heap
page read and write
40000
direct allocation
page execute read
28348E20000
heap
page read and write
26A09BA0000
trusted library allocation
page read and write
1EB6AA25000
heap
page read and write
289D1578000
heap
page read and write
289D09D2000
heap
page read and write
B3D16FF000
stack
page read and write
19173AE0000
heap
page read and write
19175B2C000
heap
page read and write
55A60000
unkown
page readonly
42000
direct allocation
page read and write
19175A98000
heap
page read and write
1917DC29000
trusted library allocation
page read and write
1E6CF202000
heap
page read and write
191759C0000
trusted library allocation
page read and write
289D096E000
heap
page read and write
13000
direct allocation
page read and write
1EB6AA81000
heap
page read and write
289D0830000
heap
page read and write
19175A8E000
heap
page read and write
289D0A0C000
heap
page read and write
7FF94B4A3000
unkown
page readonly
289D1620000
trusted library allocation
page read and write
7FF797EBE000
unkown
page readonly
289D08C0000
heap
page read and write
28348F19000
heap
page read and write
289D0A0C000
heap
page read and write
219A6828000
heap
page read and write
19173D02000
heap
page read and write
28348D4A000
heap
page read and write
28348E90000
heap
page read and write
219A6840000
heap
page read and write
14921458000
heap
page read and write
26A09BD0000
remote allocation
page read and write
1EB6AA95000
heap
page read and write
22000
direct allocation
page read and write
289D0A0D000
heap
page read and write
26A09B10000
heap
page read and write
19174719000
heap
page read and write
289D0B40000
heap
page read and write
90000
direct allocation
page execute read
289D09D8000
heap
page read and write
289D09D9000
heap
page read and write
1EB6AA5E000
heap
page read and write
19173C5D000
heap
page read and write
80000
direct allocation
page execute read
19173D29000
heap
page read and write
219A67A0000
heap
page read and write
289D098D000
heap
page read and write
7FF797E70000
unkown
page readonly
26A0B602000
trusted library allocation
page read and write
7FF94B461000
unkown
page execute read
90000
direct allocation
page execute read
1E6CF28E000
heap
page read and write
1E6CF313000
heap
page read and write
14921390000
heap
page read and write
1EB6AA40000
heap
page read and write
289D098D000
heap
page read and write
7FF7EE160000
unkown
page readonly
7FF94B460000
unkown
page readonly
29F009C0000
heap
page read and write
289D09D2000
heap
page read and write
1EB6B402000
trusted library allocation
page read and write
289D08A0000
remote allocation
page execute read
14921320000
heap
page read and write
289D0969000
heap
page read and write
965C72A000
stack
page read and write
55AEA000
unkown
page write copy
96D947E000
stack
page read and write
70000
direct allocation
page read and write
1BB26356000
heap
page read and write
20000
direct allocation
page execute read
19175990000
trusted library allocation
page read and write
E8A8EFF000
stack
page read and write
559C0000
unkown
page readonly
1917DC60000
trusted library allocation
page read and write
875C57A000
stack
page read and write
19175B07000
heap
page read and write
191759D4000
trusted library allocation
page read and write
1EB6AA27000
heap
page read and write
289D1577000
heap
page read and write
B3D197F000
stack
page read and write
13000
direct allocation
page read and write
965CBFE000
stack
page read and write
1917E000000
heap
page read and write
191759D0000
trusted library allocation
page read and write
1917DC80000
trusted library allocation
page read and write
1EB6AA6C000
heap
page read and write
28348D4A000
heap
page read and write
94C7EFF000
stack
page read and write
289D0A24000
heap
page read and write
28348F10000
heap
page read and write
19173C2A000
heap
page read and write
79E9FFE000
stack
page read and write
219A70B0000
trusted library allocation
page read and write
1E6CF0A0000
heap
page read and write
There are 506 hidden memdumps, click here to show them.