IOC Report
IB9876789000.bat.exe

loading gif

Files

File Path
Type
Category
Malicious
IB9876789000.bat.exe
PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\remcos\logs.dat
data
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_IB9876789000.bat_b854b23560dba27c1cb7185199216bec2bfd1ca2_226d7daf_c2132685-611e-4aee-b972-67669eddeee5\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBAFE.tmp.dmp
Mini DuMP crash report, 16 streams, Sun Dec 8 07:42:10 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD21.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD61.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0u2u5nvc.hpi.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a3o4asqo.zpo.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_la4dn2oz.lid.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vw4nikdb.iie.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\bhvCBB7.tmp
Extensible storage engine DataBase, version 0x620, checksum 0x43d71b72, page size 32768, DirtyShutdown, Windows version 10.0
dropped
C:\Users\user\AppData\Local\Temp\jzszgephmrwnuwaygkssej
Unicode text, UTF-16, little-endian text, with no line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped
There are 6 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\IB9876789000.bat.exe
"C:\Users\user\Desktop\IB9876789000.bat.exe"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\IB9876789000.bat.exe" -Force
malicious
C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
 malicious
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
 malicious
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
 malicious
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\user\AppData\Local\Temp\jzszgephmrwnuwaygkssej"
 malicious
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\user\AppData\Local\Temp\jzszgephmrwnuwaygkssej"
 malicious
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\user\AppData\Local\Temp\luyrhxabazosxcocxvflpvzau"
 malicious
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\user\AppData\Local\Temp\wwdciplcohgxhqkohgsnsamrdphe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1220 -s 1600
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://geoplugin.net/json.gpQM
unknown
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P
unknown
https://www.office.com/
unknown
http://www.imvu.comr
unknown
http://geoplugin.net/json.gpl;
unknown
https://fp-afd.azurefd.us/apc/trans.gif?0cf92be82316943650f2ee723bc6949e
unknown
http://www.imvu.com
unknown
http://upx.sf.net
unknown
http://www.nirsoft.net
unknown
https://aefd.nelreports.net/api/report?cat=bingaotak
unknown
https://deff.nelreports.net/api/report?cat=msn
unknown
http://geoplugin.net/json.gpy
unknown
http://geoplugin.net/json.gpSystem32
unknown
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
unknown
http://geoplugin.net/json.gp
178.237.33.50
https://www.google.com
unknown
https://fp-afd.azurefd.us/apc/trans.gif?94fb5ac9609bcb4cda0bf8acf1827073
unknown
https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-LAX31r5a&FrontEnd=AF
unknown
http://geoplugin.net/
unknown
https://aefd.nelreports.net/api/report?cat=bingaot
unknown
http://geoplugin.net/json.gp/C
unknown
https://maps.windows.com/windows-app-web-link
unknown
http://geoplugin.net/json.gp&V
unknown
http://geoplugin.net/json.gp=M
unknown
http://geoplugin.net/p
unknown
https://aefd.nelreports.net/api/report?cat=bingrms
unknown
https://www.google.com/accounts/servicelogin
unknown
https://login.yahoo.com/config/login
unknown
http://www.nirsoft.net/
unknown
http://www.imvu.comata
unknown
http://geoplugin.net/json.gpGM
unknown
http://www.ebuddy.com
unknown
There are 22 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
geoplugin.net
178.237.33.50

IPs

IP
Domain
Country
Malicious
192.210.150.26
unknown
United States
malicious
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance
Enabled
HKEY_CURRENT_USER\SOFTWARE\Rmc-MKYDDH
exepath
HKEY_CURRENT_USER\SOFTWARE\Rmc-MKYDDH
licence
HKEY_CURRENT_USER\SOFTWARE\Rmc-MKYDDH
time
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
ProgramId
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
FileId
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
LowerCaseLongPath
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
LongPathHash
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
Name
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
OriginalFileName
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
Publisher
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
Version
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
BinFileVersion
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
BinaryType
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
ProductName
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
ProductVersion
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
LinkDate
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
BinProductVersion
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
AppxPackageFullName
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
AppxPackageRelativeId
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
Size
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
Language
\REGISTRY\A\{562ab146-c613-5b29-a147-c429c8e12f08}\Root\InventoryApplicationFile\ib9876789000.bat|20cfe5a514abec18
Usn
There are 14 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
D6F000
stack
page read and write
 malicious
24311421000
trusted library allocation
page read and write
 malicious
DAB000
heap
page read and write
 malicious
2430177C000
trusted library allocation
page read and write
 malicious
D78000
heap
page read and write
 malicious
DAB000
heap
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
1AC000
stack
page read and write
4F78000
heap
page read and write
5483000
heap
page read and write
4F7F000
heap
page read and write
570D000
unclassified section
page execute and read and write
DE8000
heap
page read and write
4FC7000
heap
page read and write
E00000
heap
page read and write
24301506000
trusted library allocation
page read and write
552B000
heap
page read and write
4ABB000
stack
page read and write
4F4C000
heap
page read and write
D06000
stack
page read and write
4F60000
heap
page read and write
DE8000
heap
page read and write
83C000
stack
page read and write
4FAA000
heap
page read and write
7FF848A44000
trusted library allocation
page read and write
DD5000
heap
page read and write
70E000
heap
page read and write
DD4000
heap
page read and write
BE0000
heap
page read and write
4F66000
heap
page read and write
5301000
heap
page read and write
2437F235000
heap
page read and write
DD4000
heap
page read and write
DD5000
heap
page read and write
4C3E000
stack
page read and write
DD4000
heap
page read and write
4F6A000
heap
page read and write
4F3C000
heap
page read and write
4F60000
heap
page read and write
24311411000
trusted library allocation
page read and write
B00000
heap
page readonly
7FF848C3C000
trusted library allocation
page read and write
4F85000
heap
page read and write
510E000
stack
page read and write
DD4000
heap
page read and write
4F48000
heap
page read and write
4F60000
heap
page read and write
4F4C000
heap
page read and write
4F41000
heap
page read and write
6F0000
heap
page read and write
4F50000
heap
page read and write
4F5C000
heap
page read and write
4F4F000
heap
page read and write
4FC7000
heap
page read and write
8C5A7FE000
stack
page read and write
4F67000
heap
page read and write
4F54000
heap
page read and write
DD5000
heap
page read and write
DD1000
heap
page read and write
4F8A000
heap
page read and write
52F0000
heap
page read and write
4AFF000
stack
page read and write
4F4A000
heap
page read and write
24311417000
trusted library allocation
page read and write
8C59943000
stack
page read and write
DD4000
heap
page read and write
4F60000
heap
page read and write
473000
remote allocation
page execute and read and write
4D0B000
unclassified section
page execute and read and write
DD5000
heap
page read and write
56B0000
unclassified section
page execute and read and write
5309000
heap
page read and write
F40000
heap
page read and write
DD4000
heap
page read and write
24319482000
heap
page read and write
E6D000
heap
page read and write
4FC7000
heap
page read and write
2437F230000
heap
page read and write
4F60000
heap
page read and write
4F7D000
heap
page read and write
2437EFC3000
trusted library allocation
page read and write
52F1000
heap
page read and write
4F5C000
heap
page read and write
24301411000
trusted library allocation
page read and write
DF3000
heap
page read and write
4F60000
heap
page read and write
3560000
trusted library allocation
page read and write
4F93000
heap
page read and write
4FAA000
heap
page read and write
4F49000
heap
page read and write
5201000
heap
page read and write
D90000
heap
page read and write
4F66000
heap
page read and write
2437EE4A000
heap
page read and write
559C000
heap
page read and write
4F49000
heap
page read and write
7FF848C40000
trusted library allocation
page execute and read and write
2437ED50000
heap
page read and write
4F4D000
heap
page read and write
52F1000
heap
page read and write
2437EFC0000
trusted library allocation
page read and write
4F5C000
heap
page read and write
8C59EFE000
stack
page read and write
4F41000
heap
page read and write
BF0000
heap
page read and write
4F60000
heap
page read and write
55D0000
heap
page read and write
4F5A000
heap
page read and write
2437EBC2000
unkown
page readonly
4F61000
heap
page read and write
4F66000
heap
page read and write
4F66000
heap
page read and write
E6B000
heap
page read and write
2437EE1F000
heap
page read and write
4F79000
heap
page read and write
2437ED70000
heap
page read and write
7FF848C09000
trusted library allocation
page read and write
2437EFB0000
trusted library allocation
page read and write
7FF848A52000
trusted library allocation
page read and write
5500000
trusted library allocation
page read and write
4F41000
heap
page read and write
4F50000
heap
page read and write
550B000
heap
page read and write
7FF848C04000
trusted library allocation
page read and write
24319463000
heap
page read and write
5120000
heap
page read and write
4FA9000
heap
page read and write
5730000
unclassified section
page execute and read and write
7FF848A9C000
trusted library allocation
page execute and read and write
4F4C000
heap
page read and write
24319410000
heap
page read and write
DD1000
heap
page read and write
8C5A2FE000
stack
page read and write
4F50000
heap
page read and write
511E000
stack
page read and write
4F67000
heap
page read and write
4F58000
heap
page read and write
4F63000
heap
page read and write
5500000
trusted library allocation
page read and write
4F5C000
heap
page read and write
D0B000
stack
page read and write
24319560000
heap
page read and write
BB0000
heap
page read and write
4F52000
heap
page read and write
8B0000
heap
page read and write
4F60000
heap
page read and write
563A000
heap
page read and write
DD5000
heap
page read and write
4F41000
heap
page read and write
440000
heap
page read and write
550E000
heap
page read and write
54FB000
heap
page read and write
7FF848A4D000
trusted library allocation
page execute and read and write
EFE000
stack
page read and write
5401000
heap
page read and write
5202000
heap
page read and write
4F4C000
heap
page read and write
576F000
heap
page read and write
4F7E000
heap
page read and write
E6D000
heap
page read and write
A20000
heap
page read and write
555D000
heap
page read and write
7FF848BE3000
trusted library allocation
page read and write
7FF848A50000
trusted library allocation
page read and write
4F5C000
heap
page read and write
F3E000
stack
page read and write
DAB000
heap
page read and write
4F5C000
heap
page read and write
7FF848C70000
trusted library allocation
page read and write
D1F000
stack
page read and write
2437F030000
heap
page execute and read and write
45C000
system
page execute and read and write
4F5C000
heap
page read and write
DD4000
heap
page read and write
9E0000
heap
page read and write
3560000
trusted library allocation
page read and write
DD1000
heap
page read and write
530F000
heap
page read and write
4F41000
heap
page read and write
4F60000
heap
page read and write
680000
heap
page read and write
7FF848C33000
trusted library allocation
page read and write
4F41000
heap
page read and write
DA0000
heap
page readonly
DF3000
heap
page read and write
4F72000
heap
page read and write
52F1000
heap
page read and write
4F60000
heap
page read and write
5409000
heap
page read and write
DD5000
heap
page read and write
456000
system
page execute and read and write
5373000
heap
page read and write
8C5A1FE000
stack
page read and write
4F60000
heap
page read and write
5369000
heap
page read and write
559B000
heap
page read and write
4F85000
heap
page read and write
7FF848A5D000
trusted library allocation
page execute and read and write
4F5C000
heap
page read and write
4F41000
heap
page read and write
24319454000
heap
page read and write
4F61000
heap
page read and write
B50000
heap
page read and write
4F63000
heap
page read and write
520000
heap
page readonly
2437EDEC000
heap
page read and write
7FF848BF0000
trusted library allocation
page read and write
41B000
system
page execute and read and write
4F50000
heap
page read and write
35CE000
heap
page read and write
5300000
heap
page read and write
4F50000
heap
page read and write
B00000
heap
page read and write
4F41000
heap
page read and write
4CBF000
stack
page read and write
550A000
heap
page read and write
2437ED30000
heap
page read and write
45AF000
stack
page read and write
4F5A000
heap
page read and write
8C5A8FB000
stack
page read and write
4F6A000
heap
page read and write
D24000
stack
page read and write
8C59CFE000
stack
page read and write
7FF848A6D000
trusted library allocation
page execute and read and write
4F5B000
heap
page read and write
4F60000
heap
page read and write
4F52000
heap
page read and write
4F60000
heap
page read and write
16C000
stack
page read and write
54FB000
heap
page read and write
4F5C000
heap
page read and write
4F4C000
heap
page read and write
DD4000
heap
page read and write
7FF848B26000
trusted library allocation
page execute and read and write
4F60000
heap
page read and write
4F50000
heap
page read and write
55D0000
heap
page read and write
4F50000
heap
page read and write
4F41000
heap
page read and write
400000
system
page execute and read and write
4F50000
heap
page read and write
7BC000
stack
page read and write
4F61000
heap
page read and write
4F5B000
heap
page read and write
2437FE10000
trusted library section
page read and write
7FF848C51000
trusted library allocation
page read and write
4F3C000
heap
page read and write
77C000
stack
page read and write
5709000
unclassified section
page execute and read and write
4F60000
heap
page read and write
4F4C000
heap
page read and write
4F66000
heap
page read and write
5603000
heap
page read and write
6B3000
heap
page read and write
2437EBC0000
unkown
page readonly
5786000
unclassified section
page execute and read and write
4F54000
heap
page read and write
E6B000
heap
page read and write
5500000
trusted library allocation
page read and write
5723000
unclassified section
page execute and read and write
564C000
heap
page read and write
4F8B000
heap
page read and write
DD5000
heap
page read and write
555D000
heap
page read and write
7FF848C30000
trusted library allocation
page read and write
7FF848A43000
trusted library allocation
page execute and read and write
B1C000
heap
page read and write
7FF848AF6000
trusted library allocation
page read and write
2437EE0A000
heap
page read and write
2437ED20000
heap
page read and write
DE8000
heap
page read and write
4F4F000
heap
page read and write
C00000
heap
page read and write
7FF848B00000
trusted library allocation
page execute and read and write
B4E000
stack
page read and write
7FF848A64000
trusted library allocation
page read and write
5483000
heap
page read and write
57E000
stack
page read and write
41F000
system
page execute and read and write
24301472000
trusted library allocation
page read and write
D22000
stack
page read and write
5500000
trusted library allocation
page read and write
67F000
stack
page read and write
55D0000
heap
page read and write
4F50000
heap
page read and write
4F8B000
heap
page read and write
4F8B000
heap
page read and write
7FF848A40000
trusted library allocation
page read and write
4F84000
heap
page read and write
8C59DFE000
stack
page read and write
473000
system
page execute and read and write
4F41000
heap
page read and write
4F5C000
heap
page read and write
2437EE48000
heap
page read and write
6F8000
heap
page read and write
DDC000
heap
page read and write
4F51000
heap
page read and write
4F3C000
heap
page read and write
533F000
heap
page read and write
4F41000
heap
page read and write
4F48000
heap
page read and write
7FF848BE0000
trusted library allocation
page read and write
55D0000
heap
page read and write
533F000
heap
page read and write
4F60000
heap
page read and write
35CE000
heap
page read and write
DD4000
heap
page read and write
4F95000
heap
page read and write
7FF848C20000
trusted library allocation
page read and write
E6B000
heap
page read and write
7FF848A6B000
trusted library allocation
page execute and read and write
DD4000
heap
page read and write
5506000
heap
page read and write
400000
system
page execute and read and write
4F44000
heap
page read and write
DDE000
heap
page read and write
DE8000
heap
page read and write
4F4C000
heap
page read and write
4F3C000
heap
page read and write
459000
system
page execute and read and write
4F41000
heap
page read and write
4F4F000
heap
page read and write
4F60000
heap
page read and write
BE5000
heap
page read and write
4F5C000
heap
page read and write
87C000
stack
page read and write
35C0000
heap
page read and write
DB0000
heap
page read and write
2437EE21000
heap
page read and write
4F5A000
heap
page read and write
4F20000
heap
page read and write
552B000
heap
page read and write
4F51000
heap
page read and write
4F85000
heap
page read and write
2437FE97000
trusted library section
page read and write
7FF848AF0000
trusted library allocation
page read and write
7FF848AFC000
trusted library allocation
page execute and read and write
7FF4A1670000
trusted library allocation
page execute and read and write
4F5C000
heap
page read and write
4F8A000
heap
page read and write
5500000
trusted library allocation
page read and write
35C6000
heap
page read and write
5372000
heap
page read and write
990000
heap
page readonly
4F41000
heap
page read and write
2437F740000
heap
page read and write
DD5000
heap
page read and write
4F51000
heap
page read and write
6BD000
heap
page read and write
400000
system
page execute and read and write
5122000
heap
page read and write
4FA3000
heap
page read and write
4BFF000
stack
page read and write
45D000
system
page execute and read and write
2437F0D0000
heap
page read and write
4F5C000
heap
page read and write
DD4000
heap
page read and write
2431944E000
heap
page read and write
2437EDE0000
heap
page read and write
E1F000
heap
page read and write
2437EE51000
heap
page read and write
5638000
heap
page read and write
E6B000
heap
page read and write
4F50000
heap
page read and write
514F000
stack
page read and write
4F60000
heap
page read and write
2FDE000
stack
page read and write
4F60000
heap
page read and write
10016000
direct allocation
page execute and read and write
24301517000
trusted library allocation
page read and write
DD4000
heap
page read and write
578C000
unclassified section
page execute and read and write
35CD000
heap
page read and write
5645000
heap
page read and write
DDC000
heap
page read and write
4F60000
heap
page read and write
10001000
direct allocation
page execute and read and write
5201000
heap
page read and write
8C5A0FE000
stack
page read and write
4F41000
heap
page read and write
C2C000
heap
page read and write
476000
remote allocation
page execute and read and write
C23000
heap
page read and write
4F30000
heap
page read and write
2437F780000
trusted library allocation
page read and write
4F52000
heap
page read and write
4F60000
heap
page read and write
586B000
heap
page read and write
2437F5D0000
trusted library section
page read and write
D70000
heap
page read and write
8C5A3FD000
stack
page read and write
4BBD000
stack
page read and write
4CF0000
unclassified section
page execute and read and write
4F86000
heap
page read and write
243014F9000
trusted library allocation
page read and write
4F5C000
heap
page read and write
4F85000
heap
page read and write
4F4F000
heap
page read and write
4B3C000
stack
page read and write
4D0F000
unclassified section
page execute and read and write
4F5A000
heap
page read and write
4F4F000
heap
page read and write
4F8B000
heap
page read and write
E6B000
heap
page read and write
5125000
heap
page read and write
559B000
heap
page read and write
4F4C000
heap
page read and write
4F59000
heap
page read and write
4F50000
heap
page read and write
4F48000
heap
page read and write
5513000
heap
page read and write
530000
heap
page read and write
5759000
heap
page read and write
4F41000
heap
page read and write
33CF000
stack
page read and write
AF0000
heap
page read and write
5310000
heap
page read and write
24319461000
heap
page read and write
4F61000
heap
page read and write
5500000
trusted library allocation
page read and write
DD0000
heap
page read and write
4F4F000
heap
page read and write
5201000
heap
page read and write
5482000
heap
page read and write
CEC000
stack
page read and write
4F60000
heap
page read and write
5401000
heap
page read and write
2437F0D5000
heap
page read and write
7FF848C00000
trusted library allocation
page read and write
4F41000
heap
page read and write
4F60000
heap
page read and write
DE8000
heap
page read and write
4F50000
heap
page read and write
4F60000
heap
page read and write
7FF848C10000
trusted library allocation
page read and write
5400000
heap
page read and write
4F4F000
heap
page read and write
4F41000
heap
page read and write
DD1000
heap
page read and write
7FF848A60000
trusted library allocation
page read and write
4F60000
heap
page read and write
2437F080000
heap
page execute and read and write
4F69000
heap
page read and write
4F4C000
heap
page read and write
4F4D000
heap
page read and write
5373000
heap
page read and write
B08000
heap
page read and write
8C59FFD000
stack
page read and write
DD4000
heap
page read and write
10000000
direct allocation
page read and write
5514000
heap
page read and write
E22000
heap
page read and write
2437EE0C000
heap
page read and write
DD4000
heap
page read and write
4F41000
heap
page read and write
4F41000
heap
page read and write
4F5C000
heap
page read and write
4F8B000
heap
page read and write
C20000
heap
page read and write
4F3F000
heap
page read and write
4F30000
heap
page read and write
552B000
heap
page read and write
8C5A6FE000
stack
page read and write
2437EDC0000
trusted library allocation
page read and write
4F55000
heap
page read and write
5514000
heap
page read and write
D2E000
stack
page read and write
7FF848A42000
trusted library allocation
page read and write
4F8A000
heap
page read and write
5880000
heap
page read and write
4F8B000
heap
page read and write
DAB000
heap
page read and write
4FC7000
heap
page read and write
4F5C000
heap
page read and write
4C70000
heap
page read and write
4F72000
heap
page read and write
4F60000
heap
page read and write
4B7F000
stack
page read and write
4F5C000
heap
page read and write
6B0000
heap
page read and write
4F44000
heap
page read and write
4F60000
heap
page read and write
7FF848C60000
trusted library allocation
page execute and read and write
DD4000
heap
page read and write
476000
remote allocation
page execute and read and write
4F60000
heap
page read and write
4F63000
heap
page read and write
55D0000
heap
page read and write
5200000
heap
page read and write
35C6000
heap
page read and write
DD4000
heap
page read and write
E08000
heap
page read and write
7FF848B60000
trusted library allocation
page execute and read and write
DD1000
heap
page read and write
DAB000
heap
page read and write
4F51000
heap
page read and write
F6F000
stack
page read and write
4F5C000
heap
page read and write
There are 489 hidden memdumps, click here to show them.