IOC Report
ij4YvAl59D.exe

loading gifFilesProcessesURLsDomainsIPsRegistryMemdumps2015105010010Label

Files

File Path
Type
Category
Malicious
Download
ij4YvAl59D.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Local\LinkGuard Dynamics\r
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\369580\Z
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Bdsm
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Convenience
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Dental
OpenPGP Public Key
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Falls
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Fight
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Fighting
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Joke
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\June
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Mask
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Massachusetts
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Outreach
hp200 (68010) BSD
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Radius
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Severe
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Sig
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Stockings
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Vendor
data
dropped
 malicious
C:\Windows\System32\GroupPolicy\GPT.INI
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\369580\Origin.pif
PE32 executable (GUI) Intel 80386, for MS Windows
modified
C:\Users\user\AppData\Local\Temp\Alot
data
dropped
C:\Users\user\AppData\Local\Temp\Beginning
DOS executable (COM)
dropped
C:\Users\user\AppData\Local\Temp\Buck
data
dropped
C:\Users\user\AppData\Local\Temp\Chad
data
dropped
C:\Users\user\AppData\Local\Temp\Consecutive
data
dropped
C:\Users\user\AppData\Local\Temp\Creator
data
dropped
C:\Users\user\AppData\Local\Temp\Cruises
data
dropped
C:\Users\user\AppData\Local\Temp\Double
data
dropped
C:\Users\user\AppData\Local\Temp\Emotions
ASCII text, with very long lines (1341), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Emotions.cmd
ASCII text, with very long lines (1341), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Favourite
data
dropped
C:\Users\user\AppData\Local\Temp\Genre
data
dropped
C:\Users\user\AppData\Local\Temp\Hay
data
dropped
C:\Users\user\AppData\Local\Temp\Instance
data
dropped
C:\Users\user\AppData\Local\Temp\Kde
data
dropped
C:\Users\user\AppData\Local\Temp\Lcd
data
dropped
C:\Users\user\AppData\Local\Temp\Older
data
dropped
C:\Users\user\AppData\Local\Temp\Opposition
data
dropped
C:\Users\user\AppData\Local\Temp\Participants
data
dropped
C:\Users\user\AppData\Local\Temp\Portraits
data
dropped
C:\Users\user\AppData\Local\Temp\Quebec
data
dropped
C:\Users\user\AppData\Local\Temp\Race
data
dropped
C:\Users\user\AppData\Local\Temp\Referring
data
dropped
C:\Users\user\AppData\Local\Temp\Richmond
data
dropped
C:\Users\user\AppData\Local\Temp\Seek
data
dropped
C:\Users\user\AppData\Local\Temp\Sn
data
dropped
C:\Users\user\AppData\Local\Temp\Studios
data
dropped
C:\Users\user\AppData\Local\Temp\Tags
data
dropped
C:\Users\user\AppData\Local\Temp\Thereof
Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
dropped
C:\Users\user\AppData\Local\Temp\Things
data
dropped
C:\Users\user\AppData\Local\Temp\Tokyo
data
dropped
C:\Users\user\AppData\Local\Temp\Violence
data
dropped
C:\Windows\SysWOW64\GroupPolicy\gpt.ini
ASCII text, with CRLF line terminators
dropped
C:\Windows\System32\GroupPolicy\Machine\Registry.pol
RAGE Package Format (RPF),
dropped
There are 47 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ij4YvAl59D.exe
"C:\Users\user\Desktop\ij4YvAl59D.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit
 malicious
C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
malicious
C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
malicious
C:\Windows\SysWOW64\cmd.exe
cmd /c md 369580
 malicious
C:\Windows\SysWOW64\findstr.exe
findstr /V "MaskBathroomsCompoundInjection" Participants
malicious
C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z
malicious
C:\Users\user\AppData\Local\Temp\369580\Origin.pif
369580\Origin.pif 369580\Z
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST
malicious
C:\Windows\System32\wscript.exe
C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"
 malicious
C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif
"C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r"
 malicious
C:\Users\user\AppData\Local\Temp\369580\Origin.pif
C:\Users\user\AppData\Local\Temp\369580\Origin.pif
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\timeout.exe
timeout 15
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 7 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
http://www.autoitscript.com/autoit3/J
unknown
http://www.winimage.com/zLibDll
unknown
https://t.me/RiseProSUPPORT
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
https://ipinfo.io/
unknown
https://www.maxmind.com/en/locate-my-ip-address
unknown
http://www.autoitscript.com/autoit3/0
unknown

Domains

Name
IP
Malicious
jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD
unknown
 malicious

IPs

IP
Domain
Country
Malicious
3.36.173.8
unknown
United States
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions
Exclusions_Extensions
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions
exe
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender
DisableAntiSpyware
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender
DisableRoutinelyTakingAction
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableOnAccessProtection
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableScanOnRealtimeEnable
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableRealtimeMonitoring
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableIOAVProtection
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{581A8394-A0F5-4CA9-9527-C29248E9064A}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableRawWriteNotification
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
JScriptSetScriptStateStarted
There are 1 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
48B3000
trusted library allocation
page read and write
5AF000
heap
page read and write
5AF000
heap
page read and write
2360000
heap
page read and write
19BE000
stack
page read and write
891000
unkown
page execute read
5AF000
heap
page read and write
4601000
heap
page read and write
4427000
heap
page read and write
518F000
stack
page read and write
604000
heap
page read and write
1C84000
trusted library allocation
page read and write
1A80000
trusted library allocation
page read and write
5BB000
heap
page read and write
DCD000
stack
page read and write
5AF000
heap
page read and write
1000000
heap
page read and write
27BE000
heap
page read and write
890000
unkown
page readonly
3270000
trusted library allocation
page read and write
27B2000
heap
page read and write
5BB000
heap
page read and write
3270000
trusted library allocation
page read and write
3EF1000
heap
page read and write
6B0000
unkown
page readonly
497E000
trusted library allocation
page read and write
4953000
trusted library allocation
page read and write
30F9000
heap
page read and write
3FB0000
trusted library allocation
page read and write
5BB000
heap
page read and write
3C4A000
heap
page read and write
27B4000
heap
page read and write
6E8000
unkown
page readonly
DBEB0FF000
stack
page read and write
5BB000
heap
page read and write
2DB24428000
heap
page read and write
4601000
heap
page read and write
1400000
remote allocation
page execute and read and write
19B1000
trusted library allocation
page read and write
17FD000
heap
page read and write
4601000
heap
page read and write
4947000
trusted library allocation
page read and write
3EF1000
heap
page read and write
4965000
trusted library allocation
page read and write
3AED000
heap
page read and write
33AC000
stack
page read and write
495B000
trusted library allocation
page read and write
3FB0000
trusted library allocation
page read and write
945000
unkown
page readonly
E8E000
stack
page read and write
5BB000
heap
page read and write
3270000
trusted library allocation
page read and write
32D4000
heap
page read and write
494B000
trusted library allocation
page read and write
DBEA9FE000
stack
page read and write
3EF1000
heap
page read and write
1464000
heap
page read and write
3270000
trusted library allocation
page read and write
1806000
heap
page read and write
494D000
trusted library allocation
page read and write
48B0000
trusted library allocation
page read and write
43CD000
heap
page read and write
621000
unkown
page execute read
48BF000
trusted library allocation
page read and write
5BB000
heap
page read and write
5BB000
heap
page read and write
5BB000
heap
page read and write
30F9000
heap
page read and write
5AF000
heap
page read and write
5D7000
heap
page read and write
3F6E000
stack
page read and write
48B3000
trusted library allocation
page read and write
496B000
trusted library allocation
page read and write
3440000
heap
page read and write
48B0000
trusted library allocation
page read and write
5BB000
heap
page read and write
4601000
heap
page read and write
5AF000
heap
page read and write
27BB000
heap
page read and write
5D7000
heap
page read and write
27C0000
heap
page read and write
4946000
trusted library allocation
page read and write
408000
unkown
page readonly
ECF000
heap
page read and write
3FB0000
trusted library allocation
page read and write
658000
heap
page read and write
19B1000
trusted library allocation
page read and write
401000
unkown
page execute read
30C8000
heap
page read and write
48B9000
trusted library allocation
page read and write
3EF1000
heap
page read and write
443B000
heap
page read and write
494D000
trusted library allocation
page read and write
34AC000
stack
page read and write
19B1000
trusted library allocation
page read and write
15DE000
stack
page read and write
3270000
trusted library allocation
page read and write
21DE000
stack
page read and write
920000
unkown
page readonly
94F000
unkown
page write copy
51A000
stack
page read and write
2FDE000
stack
page read and write
3AF5000
heap
page read and write
621000
unkown
page execute read
5AF000
heap
page read and write
2DB24416000
heap
page read and write
5BB000
heap
page read and write
DBEACFF000
stack
page read and write
D06000
heap
page read and write
27BB000
heap
page read and write
554E000
stack
page read and write
580000
heap
page read and write
500000
heap
page read and write
27BE000
heap
page read and write
5AF000
heap
page read and write
5BB000
heap
page read and write
118E000
heap
page read and write
4961000
trusted library allocation
page read and write
5AF000
heap
page read and write
48BD000
trusted library allocation
page read and write
620000
unkown
page readonly
4943000
trusted library allocation
page read and write
380A000
heap
page read and write
1B89000
trusted library allocation
page read and write
3270000
trusted library allocation
page read and write
4A0F000
trusted library allocation
page read and write
1A8C000
trusted library allocation
page read and write
4601000
heap
page read and write
5BB000
heap
page read and write
2190000
heap
page read and write
1122000
heap
page read and write
50CE000
stack
page read and write
496D000
trusted library allocation
page read and write
495B000
trusted library allocation
page read and write
1625000
heap
page read and write
4956000
trusted library allocation
page read and write
27BC000
heap
page read and write
3ACE000
heap
page read and write
4601000
heap
page read and write
3FB0000
trusted library allocation
page read and write
5BB000
heap
page read and write
48B7000
trusted library allocation
page read and write
19B1000
trusted library allocation
page read and write
30E2000
heap
page read and write
27AF000
stack
page read and write
48B7000
trusted library allocation
page read and write
333E000
stack
page read and write
2DB24380000
heap
page read and write
3EF1000
heap
page read and write
3265000
heap
page read and write
27BB000
heap
page read and write
4E20000
heap
page read and write
5F0000
heap
page read and write
48B6000
trusted library allocation
page read and write
37F0000
heap
page read and write
3270000
trusted library allocation
page read and write
2230000
heap
page read and write
43C7000
heap
page read and write
497D000
trusted library allocation
page read and write
11FC000
heap
page read and write
1829000
heap
page read and write
48BB000
trusted library allocation
page read and write
161D000
stack
page read and write
4962000
trusted library allocation
page read and write
4954000
trusted library allocation
page read and write
3EF1000
heap
page read and write
33E0000
heap
page read and write
48B3000
trusted library allocation
page read and write
2FF0000
heap
page read and write
32FE000
stack
page read and write
30DE000
heap
page read and write
5BB000
heap
page read and write
5BB000
heap
page read and write
5890000
trusted library allocation
page read and write
408000
unkown
page readonly
620000
unkown
page readonly
510000
heap
page read and write
DBEAAFF000
stack
page read and write
5BB000
heap
page read and write
48BC000
trusted library allocation
page read and write
1464000
heap
page read and write
3C08000
heap
page read and write
27BB000
heap
page read and write
3019000
heap
page read and write
2DB243A0000
heap
page read and write
27B3000
heap
page read and write
E70000
heap
page read and write
2DB2440C000
heap
page read and write
1A97000
trusted library allocation
page read and write
27B9000
heap
page read and write
C7C000
stack
page read and write
5D0000
heap
page read and write
495A000
trusted library allocation
page read and write
19B1000
trusted library allocation
page read and write
27B7000
heap
page read and write
5AF000
heap
page read and write
48B6000
trusted library allocation
page read and write
27BB000
heap
page read and write
1827000
heap
page read and write
514E000
stack
page read and write
3EF1000
heap
page read and write
27B3000
heap
page read and write
17F4000
heap
page read and write
DD0000
heap
page read and write
5BB000
heap
page read and write
38F0000
heap
page read and write
2DB24680000
heap
page read and write
27B6000
heap
page read and write
3EF1000
heap
page read and write
4F4000
unkown
page readonly
2FF6000
heap
page read and write
3FB0000
trusted library allocation
page read and write
E5F000
stack
page read and write
48BB000
trusted library allocation
page read and write
310D000
heap
page read and write
19B1000
trusted library allocation
page read and write
550000
heap
page read and write
4601000
heap
page read and write
5ECF000
stack
page read and write
3932000
heap
page read and write
953000
unkown
page write copy
2DB2442D000
heap
page read and write
3EF1000
heap
page read and write
3270000
trusted library allocation
page read and write
5DCE000
stack
page read and write
309E000
stack
page read and write
3FB0000
trusted library allocation
page read and write
5BF000
heap
page read and write
4971000
trusted library allocation
page read and write
101B000
heap
page read and write
3B74000
heap
page read and write
E90000
heap
page read and write
1464000
heap
page read and write
4951000
trusted library allocation
page read and write
401000
unkown
page execute read
C3C000
stack
page read and write
1B70000
trusted library allocation
page read and write
5BB000
heap
page read and write
3EF1000
heap
page read and write
3EF0000
heap
page read and write
48B3000
trusted library allocation
page read and write
5BB000
heap
page read and write
5BB000
heap
page read and write
3270000
trusted library allocation
page read and write
48B4000
trusted library allocation
page read and write
1A9A000
trusted library allocation
page read and write
442A000
heap
page read and write
4601000
heap
page read and write
17B0000
heap
page read and write
5D7000
heap
page read and write
3C3F000
heap
page read and write
33DD000
stack
page read and write
4601000
heap
page read and write
1801000
heap
page read and write
3FB0000
trusted library allocation
page read and write
3C7A000
heap
page read and write
336F000
stack
page read and write
2DB2440D000
heap
page read and write
4601000
heap
page read and write
5AF000
heap
page read and write
27B2000
heap
page read and write
5AF000
heap
page read and write
2DB24416000
heap
page read and write
33AA000
heap
page read and write
5BB000
heap
page read and write
2DB243F7000
heap
page read and write
5AF000
heap
page read and write
48B7000
trusted library allocation
page read and write
43D5000
heap
page read and write
3270000
trusted library allocation
page read and write
2DB243DC000
heap
page read and write
30C0000
heap
page read and write
2DB243E1000
heap
page read and write
890000
unkown
page readonly
4601000
heap
page read and write
48B4000
trusted library allocation
page read and write
27BB000
heap
page read and write
5BB000
heap
page read and write
5AF000
heap
page read and write
D00000
heap
page read and write
1C36000
trusted library allocation
page read and write
48B6000
trusted library allocation
page read and write
4397000
heap
page read and write
5890000
trusted library allocation
page read and write
2DB243F7000
heap
page read and write
43D3000
heap
page read and write
4601000
heap
page read and write
4961000
trusted library allocation
page read and write
3010000
heap
page read and write
48BA000
trusted library allocation
page read and write
3FB0000
trusted library allocation
page read and write
480000
heap
page read and write
3FB0000
trusted library allocation
page read and write
4601000
heap
page read and write
87F000
stack
page read and write
E50000
heap
page read and write
9B000
stack
page read and write
3EF1000
heap
page read and write
5BB000
heap
page read and write
3270000
trusted library allocation
page read and write
48B1000
trusted library allocation
page read and write
19B1000
trusted library allocation
page read and write
1464000
heap
page read and write
495A000
trusted library allocation
page read and write
33BC000
heap
page read and write
48BE000
trusted library allocation
page read and write
27B0000
heap
page read and write
1620000
heap
page read and write
3390000
heap
page read and write
13FB000
stack
page read and write
4601000
heap
page read and write
3EF1000
heap
page read and write
1464000
heap
page read and write
3EF1000
heap
page read and write
5AF000
heap
page read and write
891000
unkown
page execute read
1829000
heap
page read and write
4601000
heap
page read and write
48B3000
trusted library allocation
page read and write
5D8F000
stack
page read and write
19B1000
trusted library allocation
page read and write
48B8000
trusted library allocation
page read and write
27B5000
heap
page read and write
1827000
heap
page read and write
D5B000
stack
page read and write
4601000
heap
page read and write
5BB000
heap
page read and write
4397000
heap
page read and write
EE1000
heap
page read and write
3EF1000
heap
page read and write
E98000
heap
page read and write
3FB0000
trusted library allocation
page read and write
27B4000
heap
page read and write
4397000
heap
page read and write
1B3C000
trusted library allocation
page read and write
3270000
trusted library allocation
page read and write
43D0000
heap
page read and write
2DB2441F000
heap
page read and write
4959000
trusted library allocation
page read and write
3EF1000
heap
page read and write
233E000
stack
page read and write
4A6E000
trusted library allocation
page read and write
5BB000
heap
page read and write
DBEAFFF000
stack
page read and write
ED0000
heap
page read and write
3270000
trusted library allocation
page read and write
2DB243F7000
heap
page read and write
3EF1000
heap
page read and write
CE0000
heap
page read and write
5C8E000
stack
page read and write
2DB24427000
heap
page read and write
27B0000
heap
page read and write
2DB24429000
heap
page read and write
1464000
heap
page read and write
5AF000
heap
page read and write
604000
heap
page read and write
449B000
heap
page read and write
4539000
heap
page read and write
DBEA8FA000
stack
page read and write
3EF1000
heap
page read and write
6E3000
unkown
page write copy
4A4A000
trusted library allocation
page read and write
128D000
heap
page read and write
604000
heap
page read and write
5EF000
stack
page read and write
5AF000
heap
page read and write
3EF1000
heap
page read and write
5BB000
heap
page read and write
495B000
trusted library allocation
page read and write
958000
unkown
page readonly
441F000
heap
page read and write
305F000
stack
page read and write
48B7000
trusted library allocation
page read and write
49E9000
trusted library allocation
page read and write
4601000
heap
page read and write
30F9000
heap
page read and write
48B1000
trusted library allocation
page read and write
27B6000
heap
page read and write
27B0000
heap
page read and write
891000
unkown
page execute read
2DB24370000
heap
page read and write
400000
unkown
page readonly
953000
unkown
page write copy
2DB2441C000
heap
page read and write
48B6000
trusted library allocation
page read and write
3EF1000
heap
page read and write
3EF1000
heap
page read and write
604000
heap
page read and write
2DB243F7000
heap
page read and write
2DB243E1000
heap
page read and write
9BF000
stack
page read and write
DDC000
stack
page read and write
600000
heap
page read and write
27BB000
heap
page read and write
1464000
heap
page read and write
6D5000
unkown
page readonly
4397000
heap
page read and write
27BB000
heap
page read and write
27B1000
heap
page read and write
510F000
stack
page read and write
4960000
trusted library allocation
page read and write
40B000
unkown
page read and write
1B55000
trusted library allocation
page read and write
4945000
trusted library allocation
page read and write
5AF000
heap
page read and write
3270000
trusted library allocation
page read and write
19B1000
trusted library allocation
page read and write
3BB6000
heap
page read and write
920000
unkown
page readonly
2DB243F7000
heap
page read and write
4961000
trusted library allocation
page read and write
3EF1000
heap
page read and write
2F0E000
stack
page read and write
5BF000
heap
page read and write
43C000
stack
page read and write
44C3000
heap
page read and write
2DB2468C000
heap
page read and write
DBEADFF000
stack
page read and write
17B5000
heap
page read and write
3FB0000
trusted library allocation
page read and write
48BD000
trusted library allocation
page read and write
F88000
heap
page read and write
D9C000
stack
page read and write
4967000
trusted library allocation
page read and write
17F9000
heap
page read and write
5AF000
heap
page read and write
300E000
stack
page read and write
5AF000
heap
page read and write
30F9000
heap
page read and write
5AF000
heap
page read and write
48BA000
trusted library allocation
page read and write
4601000
heap
page read and write
3FB0000
trusted library allocation
page read and write
958000
unkown
page readonly
10DD000
heap
page read and write
E40000
heap
page read and write
DFC000
stack
page read and write
27B1000
heap
page read and write
2DB24630000
heap
page read and write
5BB000
heap
page read and write
920000
unkown
page readonly
39F8000
heap
page read and write
4952000
trusted library allocation
page read and write
4601000
heap
page read and write
3EF1000
heap
page read and write
3FB0000
trusted library allocation
page read and write
11E1000
heap
page read and write
32B0000
heap
page read and write
2DB24430000
heap
page read and write
5BB000
heap
page read and write
5D7000
heap
page read and write
4959000
trusted library allocation
page read and write
27B2000
heap
page read and write
5AF000
heap
page read and write
1464000
heap
page read and write
4962000
trusted library allocation
page read and write
3270000
trusted library allocation
page read and write
4971000
trusted library allocation
page read and write
5AF000
heap
page read and write
27B7000
heap
page read and write
604000
heap
page read and write
4601000
heap
page read and write
48B7000
trusted library allocation
page read and write
4397000
heap
page read and write
4988000
trusted library allocation
page read and write
6B0000
unkown
page readonly
48B8000
trusted library allocation
page read and write
5AF000
heap
page read and write
326E000
stack
page read and write
3EF1000
heap
page read and write
1464000
heap
page read and write
3270000
trusted library allocation
page read and write
2FCF000
stack
page read and write
33A1000
heap
page read and write
2DB2440D000
heap
page read and write
3AF0000
heap
page read and write
3FF0000
heap
page read and write
400000
unkown
page readonly
30DE000
heap
page read and write
48B8000
trusted library allocation
page read and write
27B4000
heap
page read and write
3370000
heap
page read and write
DDD000
stack
page read and write
5AF000
heap
page read and write
1464000
heap
page read and write
27BA000
heap
page read and write
3B32000
heap
page read and write
5BB000
heap
page read and write
1ABE000
stack
page read and write
48B1000
trusted library allocation
page read and write
48B7000
trusted library allocation
page read and write
48B6000
trusted library allocation
page read and write
3EF1000
heap
page read and write
3EF1000
heap
page read and write
3FB0000
trusted library allocation
page read and write
2F8E000
stack
page read and write
EDF000
heap
page read and write
4397000
heap
page read and write
495B000
trusted library allocation
page read and write
4970000
trusted library allocation
page read and write
494D000
trusted library allocation
page read and write
110A000
heap
page read and write
945000
unkown
page readonly
497F000
trusted library allocation
page read and write
3A7C000
heap
page read and write
2DB2441F000
heap
page read and write
48B5000
trusted library allocation
page read and write
5BB000
heap
page read and write
4E1F000
stack
page read and write
4601000
heap
page read and write
27BA000
heap
page read and write
496E000
trusted library allocation
page read and write
3EF1000
heap
page read and write
4601000
heap
page read and write
17C0000
heap
page read and write
4397000
heap
page read and write
5AF000
heap
page read and write
5AE000
stack
page read and write
27B0000
heap
page read and write
2F4F000
stack
page read and write
5BF000
heap
page read and write
27BB000
heap
page read and write
1222000
heap
page read and write
3EF1000
heap
page read and write
5AF000
heap
page read and write
6E8000
unkown
page readonly
490000
heap
page read and write
4A3F000
trusted library allocation
page read and write
4601000
heap
page read and write
77E000
stack
page read and write
650000
heap
page read and write
48BE000
trusted library allocation
page read and write
5BB000
heap
page read and write
3FB0000
trusted library allocation
page read and write
DC0000
heap
page read and write
27B9000
heap
page read and write
5E2000
heap
page read and write
39B6000
heap
page read and write
2DB24429000
heap
page read and write
535000
heap
page read and write
4964000
trusted library allocation
page read and write
1464000
heap
page read and write
338E000
stack
page read and write
5BB000
heap
page read and write
48B9000
trusted library allocation
page read and write
4601000
heap
page read and write
5890000
trusted library allocation
page read and write
4601000
heap
page read and write
461000
unkown
page read and write
4601000
heap
page read and write
4978000
trusted library allocation
page read and write
3378000
heap
page read and write
41F000
unkown
page read and write
221E000
stack
page read and write
2DB24430000
heap
page read and write
604000
heap
page read and write
2DB2442E000
heap
page read and write
44AB000
heap
page read and write
5AF000
heap
page read and write
32B7000
heap
page read and write
1A64000
trusted library allocation
page read and write
5BB000
heap
page read and write
48B6000
trusted library allocation
page read and write
43CA000
heap
page read and write
4601000
heap
page read and write
4397000
heap
page read and write
4A2A000
trusted library allocation
page read and write
5AF000
heap
page read and write
3FB0000
trusted library allocation
page read and write
48B1000
trusted library allocation
page read and write
5AF000
heap
page read and write
2DB24416000
heap
page read and write
5BB000
heap
page read and write
181B000
heap
page read and write
48BD000
trusted library allocation
page read and write
17C7000
heap
page read and write
5DC000
heap
page read and write
CF0000
heap
page read and write
4F4000
unkown
page readonly
2DB243C8000
heap
page read and write
27B0000
heap
page read and write
48BD000
trusted library allocation
page read and write
2DB2442C000
heap
page read and write
497A000
trusted library allocation
page read and write
2DB24429000
heap
page read and write
27B0000
heap
page read and write
4601000
heap
page read and write
4601000
heap
page read and write
2DB24685000
heap
page read and write
5190000
heap
page read and write
5AF000
heap
page read and write
DBE000
stack
page read and write
2DB24429000
heap
page read and write
3EF1000
heap
page read and write
496B000
trusted library allocation
page read and write
27B2000
heap
page read and write
30DF000
heap
page read and write
6DF000
unkown
page write copy
48B3000
trusted library allocation
page read and write
3EF1000
heap
page read and write
570000
heap
page read and write
4956000
trusted library allocation
page read and write
4397000
heap
page read and write
3318000
heap
page read and write
5BB000
heap
page read and write
6D5000
unkown
page readonly
945000
unkown
page readonly
3EF1000
heap
page read and write
19B1000
trusted library allocation
page read and write
2DB243C0000
heap
page read and write
57A000
heap
page read and write
5AF000
heap
page read and write
5BF000
heap
page read and write
3270000
trusted library allocation
page read and write
5BB000
heap
page read and write
94F000
unkown
page write copy
27B6000
heap
page read and write
2DB24427000
heap
page read and write
1B1F000
trusted library allocation
page read and write
4A1C000
trusted library allocation
page read and write
48B6000
trusted library allocation
page read and write
2DB243FF000
heap
page read and write
8BE000
stack
page read and write
497E000
trusted library allocation
page read and write
51B0000
heap
page read and write
1808000
heap
page read and write
E1E000
stack
page read and write
1C50000
heap
page read and write
1A7D000
trusted library allocation
page read and write
496A000
trusted library allocation
page read and write
49E9000
trusted library allocation
page read and write
27BC000
heap
page read and write
1A72000
trusted library allocation
page read and write
180D000
heap
page read and write
1464000
heap
page read and write
4601000
heap
page read and write
4975000
trusted library allocation
page read and write
105B000
heap
page read and write
4416000
heap
page read and write
3974000
heap
page read and write
37F6000
heap
page read and write
3017000
heap
page read and write
112F000
heap
page read and write
310C000
heap
page read and write
3A3A000
heap
page read and write
48B9000
trusted library allocation
page read and write
5BB000
heap
page read and write
4986000
trusted library allocation
page read and write
5D7000
heap
page read and write
310C000
heap
page read and write
94F000
unkown
page write copy
497A000
trusted library allocation
page read and write
1464000
heap
page read and write
4964000
trusted library allocation
page read and write
49DD000
trusted library allocation
page read and write
497000
unkown
page read and write
27BE000
heap
page read and write
4601000
heap
page read and write
48B3000
trusted library allocation
page read and write
27B6000
heap
page read and write
181E000
heap
page read and write
27BB000
heap
page read and write
3326000
heap
page read and write
5AF000
heap
page read and write
48B9000
trusted library allocation
page read and write
49BB000
trusted library allocation
page read and write
6DF000
unkown
page read and write
3EF1000
heap
page read and write
49D7000
trusted library allocation
page read and write
3EF1000
heap
page read and write
48B4000
trusted library allocation
page read and write
4A7C000
trusted library allocation
page read and write
496B000
trusted library allocation
page read and write
48B7000
trusted library allocation
page read and write
48B0000
trusted library allocation
page read and write
497E000
trusted library allocation
page read and write
5AF000
heap
page read and write
DBEAEFF000
stack
page read and write
3EF1000
heap
page read and write
5AF000
heap
page read and write
1BE6000
trusted library allocation
page read and write
5AF000
heap
page read and write
343E000
stack
page read and write
5D7000
heap
page read and write
2DB24430000
heap
page read and write
3FAF000
stack
page read and write
604000
heap
page read and write
3C54000
heap
page read and write
3FB0000
trusted library allocation
page read and write
57E000
heap
page read and write
4947000
trusted library allocation
page read and write
2DB2440D000
heap
page read and write
4601000
heap
page read and write
1DC000
stack
page read and write
ECF000
heap
page read and write
27B0000
heap
page read and write
327E000
stack
page read and write
494B000
trusted library allocation
page read and write
5D7000
heap
page read and write
4601000
heap
page read and write
5AB000
heap
page read and write
27B1000
heap
page read and write
4601000
heap
page read and write
27C2000
heap
page read and write
1464000
heap
page read and write
4963000
trusted library allocation
page read and write
323E000
stack
page read and write
2DB24400000
heap
page read and write
27B8000
heap
page read and write
4960000
trusted library allocation
page read and write
5D7000
heap
page read and write
2DB24427000
heap
page read and write
4E50000
heap
page read and write
3EF1000
heap
page read and write
5D7000
heap
page read and write
3AD8000
heap
page read and write
5BB000
heap
page read and write
400C000
heap
page read and write
4947000
trusted library allocation
page read and write
DBEB1FE000
stack
page read and write
32D0000
heap
page read and write
4601000
heap
page read and write
3FB0000
trusted library allocation
page read and write
48B8000
trusted library allocation
page read and write
953000
unkown
page write copy
E90000
heap
page read and write
4601000
heap
page read and write
5AF000
heap
page read and write
4601000
heap
page read and write
5BB000
heap
page read and write
48B5000
trusted library allocation
page read and write
3EF1000
heap
page read and write
2DB24416000
heap
page read and write
17EF000
heap
page read and write
48B9000
trusted library allocation
page read and write
4A2E000
trusted library allocation
page read and write
338E000
heap
page read and write
40B000
unkown
page write copy
4601000
heap
page read and write
49FB000
trusted library allocation
page read and write
5AF000
heap
page read and write
890000
unkown
page readonly
5AF000
heap
page read and write
3EF1000
heap
page read and write
27BE000
heap
page read and write
2DB24430000
heap
page read and write
48BC000
trusted library allocation
page read and write
497E000
trusted library allocation
page read and write
530000
heap
page read and write
19B1000
trusted library allocation
page read and write
1464000
heap
page read and write
3270000
trusted library allocation
page read and write
958000
unkown
page readonly
3FB0000
trusted library allocation
page read and write
2DB24416000
heap
page read and write
48B8000
trusted library allocation
page read and write
19A000
stack
page read and write
2DB24425000
heap
page read and write
2DB26260000
heap
page read and write
115A000
heap
page read and write
2DB24421000
heap
page read and write
5BB000
heap
page read and write
48BB000
trusted library allocation
page read and write
496F000
trusted library allocation
page read and write
48B3000
trusted library allocation
page read and write
32EA000
heap
page read and write
49D8000
trusted library allocation
page read and write
There are 757 hidden memdumps, click here to show them.