IOC Report
xenn.ps1

loading gifFilesProcessesURLsDomainsIPsRegistryMemdumps54321010010Label

Files

File Path
Type
Category
Malicious
Download
xenn.ps1
ASCII text, with very long lines (65475), with CRLF line terminators
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\VZCXGHSDSD.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VZCXGHSDSD.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bt4aw41e.w2c.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l44cex1f.2vx.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp2657.tmp
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp2668.tmp
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp2669.tmp
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp2679.tmp
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp267A.tmp
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp267B.tmp
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp3BEA.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp3BEB.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp3BFC.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmp3C0D.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmp3C2D.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmp3C3E.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmp3C4E.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmp532.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmp543.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmp554.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmp555.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmp575.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp586.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp587.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp597.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp7234.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmp7254.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmp7265.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmp7276.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmp7296.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmp967C.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp968D.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp969E.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp96AE.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp96AF.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp96C0.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmp96D0.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmp96E1.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmpA80E.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmpA81F.tmp
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
dropped
C:\Users\user\AppData\Local\Temp\tmpA830.tmp
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\tmpA840.tmp
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\tmpCE0F.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmpCE20.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmpCE30.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmpCE41.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmpCE61.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Local\Temp\tmpCE72.tmp
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\50ES8YZ1T33502VEI65Z.temp
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms (copy)
data
dropped
There are 42 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\xenn.ps1"
 malicious
C:\Users\user\AppData\Local\Temp\VZCXGHSDSD.exe
"C:\Users\user\AppData\Local\Temp\VZCXGHSDSD.exe"
malicious
C:\Users\user\AppData\Local\Temp\VZCXGHSDSD.exe
"C:\Users\user\AppData\Local\Temp\VZCXGHSDSD.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://176.65.144.135:65012/
176.65.144.135
 malicious
176.65.144.135:65012
malicious
https://api.ipify.orgcookies//settinString.Removeg
unknown
 malicious
https://ipinfo.io/ip%appdata%
unknown
http://nuget.org/NuGet.exe
unknown
https://duckduckgo.com/ac/?q=
unknown
http://pesterbdd.com/images/Pester.png
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
unknown
http://tempuri.org/Endpoint/CheckConnectResponse
unknown
http://schemas.datacontract.org/2004/07/
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
http://tempuri.org/Endpoint/EnvironmentSettings
unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%
unknown
https://api.ip.sb/geoip
104.26.13.31
https://contoso.com/License
unknown
http://176.65.144.135:65012
unknown
http://176.65.144.3
unknown
http://schemas.xmlsoap.org/soap/envelope/
unknown
https://contoso.com/Icon
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ac.ecosia.org?q=
unknown
http://tempuri.org/
unknown
http://tempuri.org/Endpoint/CheckConnect
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse
unknown
http://tempuri.org/Endpoint/SetEnvironment
unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse
unknown
https://github.com/Pester/Pester
unknown
http://tempuri.org/Endpoint/GetUpdates
unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico
unknown
https://www.ecosia.org/newtab/v20
unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing
unknown
https://aka.ms/pscore6lB
unknown
http://176.65.144.3/dev/xenbuild.exe
176.65.144.3
http://tempuri.org/Endpoint/GetUpdatesResponse
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://duckduckgo.com/chrome_newtabv209h
unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse
unknown
http://tempuri.org/Endpoint/VerifyUpdate
unknown
http://tempuri.org/0
unknown
http://176.65.144.3/dev/xenbuild.exeP
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://gemini.google.com/app?q=
unknown
http://schemas.xmlsoap.org/soap/actor/next
unknown
There are 38 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
api.ip.sb.cdn.cloudflare.net
104.26.13.31
api.ip.sb
unknown

IPs

IP
Domain
Country
Malicious
176.65.144.135
unknown
Germany
malicious
104.26.13.31
api.ip.sb.cdn.cloudflare.net
United States
176.65.144.3
unknown
Germany

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\VZCXGHSDSD_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
402000
remote allocation
page execute and read and write
 malicious
4079000
trusted library allocation
page read and write
 malicious
28FF000
trusted library allocation
page read and write
 malicious
2FF0000
trusted library allocation
page read and write
 malicious
4099000
trusted library allocation
page read and write
 malicious
73B0000
trusted library allocation
page read and write
5560000
trusted library allocation
page read and write
68DB000
heap
page read and write
7C98000
heap
page read and write
3871000
trusted library allocation
page read and write
CD0000
trusted library allocation
page read and write
2871000
trusted library allocation
page read and write
811C000
stack
page read and write
8680000
trusted library allocation
page execute and read and write
6C22000
trusted library allocation
page read and write
6A6E000
stack
page read and write
6E80000
trusted library allocation
page read and write
1390000
heap
page read and write
59B9000
trusted library allocation
page read and write
CDD000
trusted library allocation
page execute and read and write
3FAE000
trusted library allocation
page read and write
3434000
trusted library allocation
page read and write
729E000
stack
page read and write
29B6000
heap
page read and write
7ED0000
trusted library allocation
page read and write
3446000
trusted library allocation
page read and write
4D0000
unkown
page readonly
475E000
stack
page read and write
58D0000
trusted library allocation
page read and write
6AA4000
trusted library allocation
page read and write
1176000
heap
page read and write
168E000
stack
page read and write
9C6000
heap
page read and write
A30E000
stack
page read and write
5910000
trusted library allocation
page read and write
70CC000
heap
page read and write
5890000
trusted library allocation
page read and write
7360000
trusted library allocation
page read and write
33AB000
trusted library allocation
page read and write
13D3000
trusted library allocation
page execute and read and write
79B0000
trusted library allocation
page read and write
2580000
heap
page read and write
6BF4000
trusted library allocation
page read and write
7160000
trusted library allocation
page read and write
70F2000
heap
page read and write
26C0000
trusted library allocation
page execute and read and write
79C0000
trusted library allocation
page read and write
F58000
stack
page read and write
7990000
trusted library allocation
page read and write
3FCA000
trusted library allocation
page read and write
7320000
trusted library allocation
page read and write
6E7C000
stack
page read and write
43C0000
trusted library allocation
page read and write
3542000
trusted library allocation
page read and write
6BFC000
trusted library allocation
page read and write
A40E000
stack
page read and write
CAF000
stack
page read and write
67F0000
heap
page read and write
4465000
trusted library allocation
page read and write
2830000
trusted library allocation
page read and write
2F90000
heap
page read and write
4860000
trusted library allocation
page read and write
3359000
trusted library allocation
page read and write
157E000
stack
page read and write
52E8000
trusted library allocation
page read and write
728F000
stack
page read and write
6B6D000
stack
page read and write
1517000
trusted library allocation
page execute and read and write
43D0000
heap
page read and write
294E000
stack
page read and write
7EB0000
trusted library allocation
page execute and read and write
58B2000
trusted library allocation
page read and write
28ED000
trusted library allocation
page read and write
116A000
heap
page read and write
7170000
trusted library allocation
page read and write
1502000
trusted library allocation
page read and write
435E000
stack
page read and write
990000
heap
page read and write
9EB000
heap
page read and write
4470000
trusted library allocation
page read and write
7370000
trusted library allocation
page read and write
689A000
heap
page read and write
72DE000
stack
page read and write
5E0000
heap
page read and write
7BE0000
heap
page read and write
33A2000
trusted library allocation
page read and write
5564000
trusted library allocation
page read and write
68E4000
heap
page read and write
24F9000
stack
page read and write
43CD000
trusted library allocation
page execute and read and write
47A0000
trusted library allocation
page read and write
3FD3000
trusted library allocation
page read and write
D07000
trusted library allocation
page execute and read and write
6902000
trusted library allocation
page read and write
7320000
trusted library allocation
page read and write
13ED000
trusted library allocation
page execute and read and write
5BC0000
trusted library allocation
page read and write
5980000
trusted library allocation
page execute and read and write
980000
heap
page read and write
79D0000
heap
page read and write
A44E000
stack
page read and write
47F0000
heap
page readonly
7EA0000
heap
page read and write
444E000
trusted library allocation
page read and write
7AD0000
heap
page read and write
B1EE000
stack
page read and write
FB0000
heap
page read and write
43B5000
trusted library allocation
page read and write
6C25000
trusted library allocation
page read and write
5950000
trusted library allocation
page execute and read and write
73E0000
trusted library allocation
page read and write
58E1000
trusted library allocation
page read and write
485E000
stack
page read and write
5920000
trusted library allocation
page read and write
CC0000
trusted library allocation
page read and write
6ABE000
stack
page read and write
3019000
trusted library allocation
page read and write
7C28000
heap
page read and write
70A5000
heap
page read and write
58BE000
trusted library allocation
page read and write
7330000
trusted library allocation
page read and write
29A8000
heap
page read and write
442B000
trusted library allocation
page read and write
9FE000
heap
page read and write
6BD6000
trusted library allocation
page read and write
5A20000
trusted library allocation
page execute and read and write
555E000
stack
page read and write
25FE000
heap
page read and write
72CF000
stack
page read and write
14FE000
stack
page read and write
47EE000
stack
page read and write
4290000
heap
page read and write
73A0000
trusted library allocation
page read and write
7330000
trusted library allocation
page execute and read and write
5570000
trusted library allocation
page read and write
43B0000
trusted library allocation
page read and write
7DD6000
trusted library allocation
page read and write
711E000
stack
page read and write
B0EE000
stack
page read and write
70D1000
heap
page read and write
4810000
heap
page execute and read and write
CD3000
trusted library allocation
page execute and read and write
5480000
trusted library allocation
page read and write
43A5000
trusted library allocation
page read and write
2A3B000
heap
page read and write
7210000
trusted library allocation
page read and write
4782000
trusted library allocation
page read and write
3020000
trusted library allocation
page read and write
B470000
heap
page read and write
1500000
trusted library allocation
page read and write
7C08000
heap
page read and write
2F2F000
stack
page read and write
7350000
trusted library allocation
page read and write
7C02000
heap
page read and write
4900000
trusted library allocation
page read and write
2850000
trusted library section
page read and write
32A3000
trusted library allocation
page read and write
443A000
trusted library allocation
page read and write
D0B000
trusted library allocation
page execute and read and write
30B1000
trusted library allocation
page read and write
7E00000
trusted library allocation
page read and write
B22E000
stack
page read and write
6AB5000
trusted library allocation
page read and write
7390000
trusted library allocation
page read and write
5490000
trusted library allocation
page read and write
4461000
trusted library allocation
page read and write
4FA8000
trusted library allocation
page read and write
1148000
heap
page read and write
13D4000
trusted library allocation
page read and write
43C3000
trusted library allocation
page execute and read and write
67FC000
heap
page read and write
AACE000
stack
page read and write
6C30000
trusted library allocation
page read and write
513D000
stack
page read and write
42C0000
heap
page read and write
33E1000
trusted library allocation
page read and write
3875000
trusted library allocation
page read and write
5EA0000
trusted library allocation
page read and write
68C4000
heap
page read and write
325B000
trusted library allocation
page read and write
59B1000
trusted library allocation
page read and write
3FC7000
trusted library allocation
page read and write
68D4000
heap
page read and write
2F30000
trusted library allocation
page execute and read and write
97E000
stack
page read and write
998000
heap
page read and write
A98E000
stack
page read and write
3FA1000
trusted library allocation
page read and write
4149000
trusted library allocation
page read and write
11BF000
heap
page read and write
27EF000
stack
page read and write
6B25000
heap
page execute and read and write
6C1D000
trusted library allocation
page read and write
71E0000
trusted library allocation
page read and write
4137000
trusted library allocation
page read and write
6BC0000
heap
page read and write
70C6000
heap
page read and write
400000
remote allocation
page execute and read and write
CF7000
trusted library allocation
page execute and read and write
A585000
trusted library allocation
page read and write
3FDE000
trusted library allocation
page read and write
6DEE000
stack
page read and write
CD4000
trusted library allocation
page read and write
28DB000
trusted library allocation
page read and write
6E10000
trusted library allocation
page read and write
73D0000
trusted library allocation
page read and write
59FD000
trusted library allocation
page read and write
34B1000
trusted library allocation
page read and write
A88E000
stack
page read and write
31A5000
trusted library allocation
page read and write
13F0000
heap
page read and write
7C15000
heap
page read and write
3FC0000
trusted library allocation
page read and write
54DE000
stack
page read and write
AD0000
heap
page read and write
842E000
stack
page read and write
6BB0000
heap
page read and write
13D0000
trusted library allocation
page read and write
70D0000
heap
page read and write
4A0C000
trusted library allocation
page read and write
73C0000
trusted library allocation
page read and write
443E000
trusted library allocation
page read and write
FFBF0000
trusted library allocation
page execute and read and write
AD5000
heap
page read and write
695E000
stack
page read and write
413E000
trusted library allocation
page read and write
4244000
trusted library allocation
page read and write
6AB0000
trusted library allocation
page read and write
49A0000
heap
page read and write
68E0000
heap
page read and write
6AFE000
stack
page read and write
48FE000
stack
page read and write
59E0000
trusted library allocation
page read and write
290E000
stack
page read and write
7DC0000
trusted library allocation
page execute and read and write
65CE000
stack
page read and write
CFA000
trusted library allocation
page execute and read and write
59D0000
trusted library allocation
page read and write
FFE000
stack
page read and write
5E5E000
stack
page read and write
3440000
trusted library allocation
page read and write
7BD0000
heap
page read and write
7BD4000
heap
page read and write
3573000
trusted library allocation
page read and write
6BF2000
trusted library allocation
page read and write
A74D000
stack
page read and write
A564000
trusted library allocation
page read and write
6C16000
trusted library allocation
page read and write
137D000
stack
page read and write
5AB0000
trusted library allocation
page execute and read and write
70FC000
heap
page read and write
6910000
trusted library allocation
page execute and read and write
7DD0000
trusted library allocation
page read and write
A79000
heap
page read and write
6C18000
trusted library allocation
page read and write
731D000
stack
page read and write
6960000
trusted library allocation
page execute and read and write
49B1000
trusted library allocation
page read and write
7BF6000
heap
page read and write
7C49000
heap
page read and write
589B000
trusted library allocation
page read and write
E5B000
stack
page read and write
7310000
trusted library allocation
page execute and read and write
70EC000
heap
page read and write
7E10000
trusted library allocation
page read and write
9D3000
heap
page read and write
856E000
stack
page read and write
A579000
trusted library allocation
page read and write
79E6000
heap
page read and write
99E000
heap
page read and write
57C000
stack
page read and write
5970000
trusted library allocation
page read and write
715E000
stack
page read and write
3FD0000
trusted library allocation
page read and write
AA0000
heap
page read and write
3229000
trusted library allocation
page read and write
1512000
trusted library allocation
page read and write
495E000
stack
page read and write
6F51000
heap
page read and write
6A8A000
trusted library allocation
page read and write
E3F000
stack
page read and write
34CD000
trusted library allocation
page read and write
4440000
trusted library allocation
page read and write
6AA0000
trusted library allocation
page read and write
6A7B000
stack
page read and write
425D000
trusted library allocation
page read and write
58A1000
trusted library allocation
page read and write
6BD0000
trusted library allocation
page read and write
13E0000
trusted library allocation
page read and write
414D000
trusted library allocation
page read and write
686F000
heap
page read and write
439E000
stack
page read and write
25DE000
stack
page read and write
3FD6000
trusted library allocation
page read and write
7C92000
heap
page read and write
7C36000
heap
page read and write
7C1E000
heap
page read and write
7E10000
trusted library allocation
page read and write
4D2000
unkown
page readonly
7082000
heap
page read and write
25F6000
heap
page read and write
578E000
stack
page read and write
261E000
stack
page read and write
4DF0000
trusted library allocation
page read and write
7BE9000
heap
page read and write
4E2000
unkown
page readonly
68A3000
heap
page read and write
6D6E000
stack
page read and write
282E000
stack
page read and write
4785000
trusted library allocation
page execute and read and write
29A0000
heap
page read and write
446E000
trusted library allocation
page read and write
1515000
trusted library allocation
page execute and read and write
7C12000
heap
page read and write
68C9000
heap
page read and write
431D000
stack
page read and write
6E2E000
stack
page read and write
1000000
heap
page read and write
2A0D000
heap
page read and write
7EE1000
trusted library allocation
page read and write
CE0000
trusted library allocation
page read and write
7BE4000
heap
page read and write
852E000
stack
page read and write
B48C000
heap
page read and write
3FB2000
trusted library allocation
page read and write
7EF9000
trusted library allocation
page read and write
5900000
trusted library allocation
page read and write
1506000
trusted library allocation
page execute and read and write
2628000
trusted library allocation
page read and write
302D000
trusted library allocation
page read and write
43C4000
trusted library allocation
page read and write
4769000
trusted library allocation
page read and write
30AB000
trusted library allocation
page read and write
2570000
heap
page read and write
7EF0000
trusted library allocation
page read and write
1140000
heap
page read and write
6EA0000
trusted library allocation
page execute and read and write
7180000
heap
page read and write
70F9000
heap
page read and write
3163000
trusted library allocation
page read and write
30AF000
trusted library allocation
page read and write
2878000
trusted library allocation
page read and write
7BEC000
heap
page read and write
7E5D000
stack
page read and write
72CE000
stack
page read and write
34C7000
trusted library allocation
page read and write
8F9000
stack
page read and write
58A6000
trusted library allocation
page read and write
5AAE000
stack
page read and write
A590000
trusted library allocation
page read and write
3FE3000
trusted library allocation
page read and write
680C000
heap
page read and write
6E90000
trusted library allocation
page read and write
5580000
heap
page execute and read and write
59D9000
trusted library allocation
page read and write
7C70000
heap
page read and write
158B000
heap
page read and write
6A88000
trusted library allocation
page read and write
5E9E000
stack
page read and write
7EC0000
trusted library allocation
page read and write
499F000
stack
page read and write
2888000
trusted library allocation
page read and write
6EDE000
stack
page read and write
342A000
trusted library allocation
page read and write
1530000
trusted library allocation
page read and write
6A9A000
trusted library allocation
page read and write
7071000
heap
page read and write
B4B2000
heap
page read and write
6BAA000
stack
page read and write
B46F000
stack
page read and write
25F0000
heap
page read and write
6C0E000
trusted library allocation
page read and write
6B90000
trusted library allocation
page read and write
4431000
trusted library allocation
page read and write
2FA1000
trusted library allocation
page read and write
1065000
heap
page read and write
8035000
trusted library allocation
page read and write
7C3D000
heap
page read and write
496D000
stack
page read and write
26E0000
heap
page read and write
24BB000
stack
page read and write
A576000
trusted library allocation
page read and write
3031000
trusted library allocation
page read and write
1586000
heap
page read and write
3220000
trusted library allocation
page read and write
A9CD000
stack
page read and write
4DF6000
trusted library allocation
page read and write
4143000
trusted library allocation
page read and write
4424000
trusted library allocation
page read and write
59FA000
trusted library allocation
page read and write
D30000
heap
page read and write
6A95000
trusted library allocation
page read and write
68EE000
heap
page read and write
31D7000
trusted library allocation
page read and write
2884000
trusted library allocation
page read and write
6C34000
trusted library allocation
page read and write
4443000
trusted library allocation
page read and write
34BB000
trusted library allocation
page read and write
34F0000
trusted library allocation
page read and write
7F00000
trusted library allocation
page read and write
725E000
stack
page read and write
5BCE000
trusted library allocation
page read and write
6BFF000
trusted library allocation
page read and write
43AB000
trusted library allocation
page read and write
3FD8000
trusted library allocation
page read and write
447D000
trusted library allocation
page read and write
6F1E000
stack
page read and write
4800000
trusted library allocation
page execute and read and write
6B20000
heap
page execute and read and write
4478000
trusted library allocation
page read and write
4454000
trusted library allocation
page read and write
2F8C000
stack
page read and write
67CE000
stack
page read and write
7200000
heap
page execute and read and write
133E000
stack
page read and write
6A70000
trusted library allocation
page read and write
A554000
trusted library allocation
page read and write
A84F000
stack
page read and write
1060000
heap
page read and write
5A6D000
stack
page read and write
1580000
heap
page read and write
6A9F000
trusted library allocation
page read and write
486A000
trusted library allocation
page read and write
6A72000
trusted library allocation
page read and write
4E00000
heap
page execute and read and write
43B0000
trusted library allocation
page read and write
6A8F000
trusted library allocation
page read and write
6C08000
trusted library allocation
page read and write
A54E000
stack
page read and write
7E9F000
stack
page read and write
2860000
heap
page execute and read and write
48BC000
stack
page read and write
6CEE000
stack
page read and write
58C1000
trusted library allocation
page read and write
4075000
trusted library allocation
page read and write
6B2D000
stack
page read and write
4131000
trusted library allocation
page read and write
5A00000
trusted library allocation
page read and write
6E92000
trusted library allocation
page read and write
8670000
heap
page read and write
4868000
trusted library allocation
page read and write
30B3000
trusted library allocation
page read and write
2F40000
heap
page execute and read and write
4CEE000
stack
page read and write
35C5000
trusted library allocation
page read and write
4DEF000
stack
page read and write
6A3D000
stack
page read and write
70CD000
stack
page read and write
6900000
trusted library allocation
page read and write
71CE000
stack
page read and write
28E3000
trusted library allocation
page read and write
3539000
trusted library allocation
page read and write
104E000
stack
page read and write
7050000
heap
page read and write
4435000
trusted library allocation
page read and write
6B6E000
stack
page read and write
93E000
stack
page read and write
2A01000
heap
page read and write
5A10000
trusted library allocation
page read and write
13DD000
trusted library allocation
page execute and read and write
5BCB000
trusted library allocation
page read and write
2595000
heap
page read and write
5A1E000
trusted library allocation
page read and write
298F000
stack
page read and write
4B06000
trusted library allocation
page read and write
4448000
trusted library allocation
page read and write
588E000
stack
page read and write
28F6000
trusted library allocation
page read and write
2590000
heap
page read and write
79D2000
heap
page read and write
6BC8000
heap
page read and write
551E000
stack
page read and write
3FBA000
trusted library allocation
page read and write
4760000
trusted library allocation
page read and write
3468000
trusted library allocation
page read and write
689F000
heap
page read and write
446A000
trusted library allocation
page read and write
26D0000
trusted library allocation
page read and write
6D2A000
stack
page read and write
4297000
heap
page read and write
3013000
trusted library allocation
page read and write
70E2000
heap
page read and write
7380000
trusted library allocation
page read and write
7DE0000
trusted library allocation
page execute and read and write
866E000
stack
page read and write
6A79000
trusted library allocation
page read and write
4473000
trusted library allocation
page read and write
30BC000
trusted library allocation
page read and write
6C11000
trusted library allocation
page read and write
7340000
trusted library allocation
page read and write
6C04000
trusted library allocation
page read and write
B32E000
stack
page read and write
13C0000
trusted library allocation
page read and write
6BF6000
trusted library allocation
page read and write
6AC0000
trusted library allocation
page read and write
3167000
trusted library allocation
page read and write
40C3000
trusted library allocation
page read and write
568E000
stack
page read and write
5F0000
heap
page read and write
70E6000
heap
page read and write
1510000
trusted library allocation
page read and write
33BF000
trusted library allocation
page read and write
42A0000
trusted library allocation
page read and write
79A0000
trusted library allocation
page execute and read and write
815C000
stack
page read and write
33B9000
trusted library allocation
page read and write
6A75000
trusted library allocation
page read and write
151B000
trusted library allocation
page execute and read and write
66CF000
stack
page read and write
32FE000
trusted library allocation
page read and write
6DAB000
stack
page read and write
319C000
trusted library allocation
page read and write
7C5D000
heap
page read and write
556A000
trusted library allocation
page read and write
71F0000
trusted library allocation
page execute and read and write
7C43000
heap
page read and write
28DE000
trusted library allocation
page read and write
4780000
trusted library allocation
page read and write
6832000
heap
page read and write
4270000
heap
page read and write
35BC000
trusted library allocation
page read and write
5BBF000
stack
page read and write
6B80000
trusted library allocation
page execute and read and write
445B000
trusted library allocation
page read and write
B36E000
stack
page read and write
287C000
trusted library allocation
page read and write
5960000
trusted library allocation
page read and write
32D9000
trusted library allocation
page read and write
68E8000
heap
page read and write
6AB2000
trusted library allocation
page read and write
7C2D000
heap
page read and write
6BE0000
trusted library allocation
page read and write
There are 522 hidden memdumps, click here to show them.