IOC Report
cbqF2LKJ5jjucHN.exe

FilesProcessesURLsDomainsIPsRegistryMemdumps108642010010Label

Files

File Path
Type
Category
Malicious
Download
cbqF2LKJ5jjucHN.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cbqF2LKJ5jjucHN.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmpF52D.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\IHiaAvYFRgo.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\IHiaAvYFRgo.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Network\Downloader\edb.chk
data
dropped
C:\ProgramData\Microsoft\Network\Downloader\edb.log
data
dropped
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
Extensible storage engine DataBase, version 0x620, checksum 0x7065b79e, page size 16384, Windows version 10.0
dropped
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
data
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vbc.exe_227c876fd641335ffe8c8292e3b2c22256746fd3_390950d7_dc768b20-d021-4416-956e-309e6178249c\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA74.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Mar 27 15:49:11 2025, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC2A.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC89.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IHiaAvYFRgo.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1i5rns5d.sxs.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2kzxiikj.pir.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ggw2s4l5.p2l.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i43lfs21.2lk.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i5q4bwrj.rxb.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2tkicuf.jnv.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p4p0zst3.eub.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rvi5x3qx.u3f.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmpA3C.tmp
XML 1.0 document, ASCII text
dropped
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
JSON data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 16 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\cbqF2LKJ5jjucHN.exe
"C:\Users\user\Desktop\cbqF2LKJ5jjucHN.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\cbqF2LKJ5jjucHN.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\IHiaAvYFRgo.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IHiaAvYFRgo" /XML "C:\Users\user\AppData\Local\Temp\tmpF52D.tmp"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
 malicious
C:\Users\user\AppData\Roaming\IHiaAvYFRgo.exe
C:\Users\user\AppData\Roaming\IHiaAvYFRgo.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IHiaAvYFRgo" /XML "C:\Users\user\AppData\Local\Temp\tmpA3C.tmp"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 1476
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
There are 7 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://www.office.com/
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:648351%0D%0ADate%20a
unknown
https://duckduckgo.com/ac/?q=
unknown
https://api.telegram.org
unknown
https://api.telegram.org/bot
unknown
https://www.office.com/lB
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://g.live.com/odclientsettings/ProdV21C:
unknown
http://crl.ver)
unknown
https://ac.ecosia.org?q=
unknown
http://upx.sf.net
unknown
http://checkip.dyndns.org
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://chrome.google.com/webstore?hl=en4
unknown
https://reallyfreegeoip.org/xml/45.92.229.138$
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=
unknown
https://chrome.google.com/webstore?hl=en
unknown
https://chrome.google.com/webstore?hl=en8
unknown
http://varders.kozow.com:8081
unknown
http://aborters.duckdns.org:8081
unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico
unknown
https://www.office.com/8
unknown
https://g.live.com/odclientsettings/Prod1C:
unknown
https://www.ecosia.org/newtab/v20
unknown
http://checkip.dyndns.org/
193.122.130.0
https://www.office.com/4
unknown
http://anotherarmy.dns.army:8081
unknown
https://duckduckgo.com/chrome_newtabv20
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:648351%0D%0ADate%20and%20Time:%2027/03/2025%20/%2020:46:37%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20648351%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://checkip.dyndns.org/q
unknown
https://chrome.google.com/webstore?hl=enlB
unknown
https://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/45.92.229.138
104.21.64.1
http://checkip.dyndns.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://gemini.google.com/app?q=
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 30 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
104.21.64.1
api.telegram.org
149.154.167.220
checkip.dyndns.com
193.122.130.0
checkip.dyndns.org
unknown

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
193.122.130.0
checkip.dyndns.com
United States
104.21.64.1
reallyfreegeoip.org
United States
127.0.0.1
unknown
unknown

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vbc_RASMANCS
FileDirectory
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
ProgramId
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
FileId
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
LowerCaseLongPath
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
LongPathHash
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
Name
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
OriginalFileName
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
Publisher
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
Version
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
BinFileVersion
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
BinaryType
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
ProductName
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
ProductVersion
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
LinkDate
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
BinProductVersion
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
AppxPackageFullName
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
AppxPackageRelativeId
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
Size
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
Language
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
IsOsComponent
\REGISTRY\A\{bea2cd6e-14b9-b609-183c-56acd66615dc}\Root\InventoryApplicationFile\vbc.exe|d14eb4b34a786388
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
00184012D27EB83F
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
PerfMMFileName
There are 31 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
402000
remote allocation
page execute and read and write
 malicious
6CD1000
trusted library allocation
page read and write
 malicious
47A2000
trusted library allocation
page read and write
 malicious
6BF1000
trusted library allocation
page read and write
 malicious
4784000
trusted library allocation
page read and write
 malicious
2CDE000
trusted library allocation
page read and write
252D000
stack
page read and write
14C42A94000
heap
page read and write
6AA0000
trusted library allocation
page read and write
4F09000
heap
page read and write
2D30000
trusted library allocation
page read and write
6AAB000
trusted library allocation
page read and write
B00000
unkown
page readonly
5102000
trusted library allocation
page read and write
50E0000
trusted library allocation
page read and write
6AE0000
trusted library allocation
page read and write
9FF87E000
unkown
page readonly
7012000
heap
page read and write
922D000
trusted library allocation
page read and write
50ED000
trusted library allocation
page execute and read and write
7040D000
unkown
page read and write
5700000
heap
page read and write
1382000
trusted library allocation
page read and write
A6F0000
trusted library allocation
page read and write
14C48252000
heap
page read and write
2B50000
heap
page read and write
7F5C000
trusted library allocation
page read and write
12A0000
heap
page read and write
7B9D000
stack
page read and write
7FE3000
trusted library allocation
page read and write
5117000
trusted library allocation
page execute and read and write
56FC000
stack
page read and write
14C482F6000
heap
page read and write
703F1000
unkown
page execute read
14C43313000
heap
page read and write
7CF0000
trusted library section
page read and write
5500000
trusted library allocation
page read and write
A400000
heap
page read and write
6D80000
trusted library allocation
page read and write
14C48029000
trusted library allocation
page read and write
5710000
trusted library allocation
page read and write
1055000
heap
page read and write
5430000
trusted library allocation
page read and write
14C42B17000
heap
page read and write
9FDE7E000
unkown
page readonly
1010000
heap
page read and write
2D06000
trusted library allocation
page read and write
3F44000
trusted library allocation
page read and write
14C42AA5000
heap
page read and write
14C0000
trusted library allocation
page read and write
9FED79000
stack
page read and write
56A5000
heap
page read and write
6FF8000
trusted library allocation
page read and write
14E0000
trusted library allocation
page read and write
3EB2000
trusted library allocation
page read and write
14C42A6C000
heap
page read and write
5650000
trusted library allocation
page read and write
14AD000
trusted library allocation
page execute and read and write
7A0D000
stack
page read and write
8034000
trusted library allocation
page read and write
6E5D000
trusted library allocation
page read and write
6E81000
trusted library allocation
page read and write
2E4C000
stack
page read and write
10C3000
heap
page read and write
71CE000
stack
page read and write
5130000
heap
page read and write
A56E000
stack
page read and write
5830000
trusted library allocation
page execute and read and write
5740000
trusted library allocation
page read and write
7EF6000
trusted library allocation
page read and write
5E10000
heap
page read and write
14C43F11000
trusted library allocation
page read and write
137A000
trusted library allocation
page execute and read and write
4FD5000
heap
page read and write
77CE000
stack
page read and write
A770000
trusted library allocation
page read and write
50E4000
trusted library allocation
page read and write
14C43302000
heap
page read and write
6DB6000
trusted library allocation
page read and write
9FDB7C000
stack
page read and write
4F9A000
heap
page read and write
4EA0000
heap
page read and write
7003000
trusted library allocation
page read and write
A780000
trusted library allocation
page read and write
14C48200000
heap
page read and write
135D000
trusted library allocation
page execute and read and write
9FD577000
stack
page read and write
14C42B02000
heap
page read and write
7CF9000
trusted library allocation
page read and write
AA1E000
stack
page read and write
A760000
trusted library allocation
page execute and read and write
51F0000
heap
page read and write
5660000
trusted library allocation
page read and write
14C47FF0000
trusted library allocation
page read and write
14C48014000
trusted library allocation
page read and write
7C7E000
stack
page read and write
7C1D000
stack
page read and write
A6C0000
trusted library allocation
page execute and read and write
9E8E000
stack
page read and write
1140000
heap
page read and write
7FAF000
trusted library allocation
page read and write
14C47FB0000
trusted library allocation
page read and write
14C42A9F000
heap
page read and write
14C48284000
heap
page read and write
1018000
heap
page read and write
53E0000
trusted library allocation
page read and write
517E000
stack
page read and write
56B0000
heap
page execute and read and write
14C4822C000
heap
page read and write
6D8C000
trusted library allocation
page read and write
779E000
stack
page read and write
14C4825F000
heap
page read and write
6F3B000
trusted library allocation
page read and write
525B000
trusted library allocation
page read and write
51BC000
stack
page read and write
5320000
heap
page read and write
14C47FD0000
trusted library allocation
page read and write
FC0000
heap
page read and write
14F7000
heap
page read and write
790D000
stack
page read and write
14C43215000
heap
page read and write
14C48240000
heap
page read and write
722E000
stack
page read and write
14C42AB5000
heap
page read and write
A750000
trusted library allocation
page read and write
71D0000
trusted library allocation
page read and write
53B2000
trusted library allocation
page read and write
14C48170000
remote allocation
page read and write
4D75000
heap
page read and write
50F7000
trusted library allocation
page execute and read and write
6AAE000
trusted library allocation
page read and write
52E0000
heap
page execute and read and write
12D5000
heap
page read and write
14C47F40000
trusted library allocation
page read and write
2E70000
heap
page read and write
25D0000
heap
page read and write
2CB0000
trusted library allocation
page read and write
5590000
heap
page read and write
A0B0000
heap
page read and write
2D20000
trusted library allocation
page read and write
5EA000
stack
page read and write
14C42C10000
heap
page read and write
A6FE000
stack
page read and write
3E79000
trusted library allocation
page read and write
A230000
heap
page read and write
95B0000
trusted library allocation
page read and write
2D43000
heap
page read and write
5840000
trusted library allocation
page execute and read and write
4E50000
heap
page read and write
A52E000
stack
page read and write
5370000
trusted library allocation
page read and write
A2A1000
heap
page read and write
2EB4000
trusted library allocation
page read and write
3E91000
trusted library allocation
page read and write
14C42B02000
heap
page read and write
A6B0000
trusted library allocation
page execute and read and write
A12E000
stack
page read and write
7C19000
trusted library allocation
page read and write
6F73000
trusted library allocation
page read and write
52D0000
trusted library allocation
page read and write
50F2000
trusted library allocation
page read and write
6CAC000
trusted library allocation
page read and write
5470000
heap
page read and write
51D0000
trusted library allocation
page read and write
7410000
trusted library allocation
page execute and read and write
51C0000
trusted library allocation
page execute and read and write
5250000
trusted library allocation
page read and write
6D4A000
trusted library allocation
page read and write
7D7F000
stack
page read and write
517E000
stack
page read and write
14C49000000
heap
page read and write
A08E000
stack
page read and write
50E0000
trusted library allocation
page read and write
A3EE000
stack
page read and write
2D00000
trusted library allocation
page read and write
136D000
trusted library allocation
page execute and read and write
4EC3000
trusted library allocation
page execute and read and write
6BCE000
stack
page read and write
FCE000
stack
page read and write
4ED0000
trusted library allocation
page read and write
54E0000
trusted library allocation
page execute and read and write
7D76000
trusted library allocation
page read and write
14B2000
trusted library allocation
page read and write
10C5000
heap
page read and write
558E000
trusted library section
page readonly
A096000
heap
page read and write
14C42A69000
heap
page read and write
14C43304000
heap
page read and write
7459000
trusted library allocation
page read and write
2CE6000
trusted library allocation
page read and write
6CB6000
trusted library allocation
page read and write
7DCE000
stack
page read and write
120E000
stack
page read and write
7B5D000
stack
page read and write
7E82000
trusted library allocation
page read and write
6F3F000
trusted library allocation
page read and write
556B000
stack
page read and write
14C48120000
trusted library allocation
page read and write
14C482E3000
heap
page read and write
6D7C000
trusted library allocation
page read and write
7440000
trusted library allocation
page read and write
1354000
trusted library allocation
page read and write
BD0000
unkown
page readonly
304A000
heap
page read and write
5330000
trusted library allocation
page execute and read and write
14C47F50000
trusted library allocation
page read and write
5570000
heap
page read and write
73B0000
trusted library allocation
page execute and read and write
1130000
trusted library allocation
page read and write
53A1000
trusted library allocation
page read and write
2CA0000
heap
page read and write
109C000
heap
page read and write
8002000
trusted library allocation
page read and write
2D0E000
stack
page read and write
75FE000
stack
page read and write
7CD1000
trusted library allocation
page read and write
5EE0000
heap
page read and write
2ED4000
trusted library allocation
page read and write
2D60000
heap
page execute and read and write
4744000
trusted library allocation
page read and write
50E3000
trusted library allocation
page execute and read and write
14C42A8B000
heap
page read and write
4E98000
trusted library allocation
page read and write
9240000
heap
page execute and read and write
4D74000
heap
page read and write
50EA000
trusted library allocation
page execute and read and write
14C4824D000
heap
page read and write
A87E000
stack
page read and write
2BA8000
trusted library allocation
page read and write
25E0000
heap
page read and write
5765000
heap
page read and write
14C48110000
trusted library allocation
page read and write
14C47FD2000
trusted library allocation
page read and write
124E000
stack
page read and write
6B18000
trusted library allocation
page read and write
A2BF000
heap
page read and write
5100000
trusted library allocation
page read and write
128E000
stack
page read and write
14C48000000
trusted library allocation
page read and write
14C429F0000
heap
page read and write
A6D0000
trusted library allocation
page execute and read and write
305C000
heap
page read and write
5630000
trusted library allocation
page execute and read and write
14C482F8000
heap
page read and write
14C482F1000
heap
page read and write
5130000
trusted library allocation
page read and write
6FFA000
trusted library allocation
page read and write
942E000
stack
page read and write
A6AE000
stack
page read and write
E6E000
stack
page read and write
13F4000
heap
page read and write
2A30000
heap
page read and write
6E58000
trusted library allocation
page read and write
14C482A8000
heap
page read and write
14C43500000
trusted library allocation
page read and write
5620000
trusted library allocation
page read and write
6CB9000
trusted library allocation
page read and write
50F0000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
6FC0000
trusted library allocation
page read and write
14C42A59000
heap
page read and write
5730000
trusted library allocation
page read and write
2F7F000
trusted library allocation
page read and write
14C43200000
heap
page read and write
6D84000
trusted library allocation
page read and write
2CEC000
trusted library allocation
page read and write
1350000
trusted library allocation
page read and write
2E91000
trusted library allocation
page read and write
299E000
stack
page read and write
14B6000
trusted library allocation
page execute and read and write
650000
heap
page read and write
91CD000
stack
page read and write
573E000
stack
page read and write
9FD77E000
stack
page read and write
6B80000
heap
page read and write
7D8B000
trusted library allocation
page read and write
7D8A000
trusted library allocation
page read and write
53F0000
trusted library allocation
page read and write
CF6000
stack
page read and write
2CAB000
stack
page read and write
7D3B000
trusted library allocation
page read and write
6F66000
trusted library allocation
page read and write
6F36000
trusted library allocation
page read and write
6B00000
heap
page read and write
A5AE000
stack
page read and write
2A3A000
heap
page read and write
920D000
stack
page read and write
14C42AFD000
heap
page read and write
13F0000
heap
page read and write
6FC9000
trusted library allocation
page read and write
76B8000
heap
page read and write
5690000
heap
page read and write
2E60000
trusted library allocation
page read and write
7650000
trusted library allocation
page execute and read and write
5910000
trusted library allocation
page execute and read and write
A090000
heap
page read and write
5510000
trusted library allocation
page read and write
5519000
trusted library allocation
page read and write
907D000
stack
page read and write
2AEA000
stack
page read and write
5180000
trusted library allocation
page read and write
A7D0000
heap
page read and write
95A0000
trusted library allocation
page execute and read and write
5110000
trusted library allocation
page read and write
6F18000
trusted library allocation
page read and write
F66000
stack
page read and write
2E6F000
stack
page read and write
14C480D0000
trusted library allocation
page read and write
7EE0000
trusted library allocation
page read and write
6AF0000
heap
page read and write
9FF7FE000
stack
page read and write
134B000
heap
page read and write
14C480D0000
trusted library allocation
page read and write
1052000
heap
page read and write
4EE8000
heap
page read and write
14C4331A000
heap
page read and write
A790000
trusted library allocation
page read and write
5720000
trusted library allocation
page read and write
78DE000
stack
page read and write
7D80000
trusted library allocation
page read and write
7040F000
unkown
page readonly
14C48640000
trusted library allocation
page read and write
1360000
trusted library allocation
page read and write
4ECD000
trusted library allocation
page execute and read and write
4D20000
heap
page readonly
706E000
heap
page read and write
290E000
unkown
page read and write
502C000
stack
page read and write
6CA3000
trusted library allocation
page read and write
5680000
trusted library section
page readonly
75BD000
stack
page read and write
2D40000
heap
page read and write
EB0000
trusted library allocation
page read and write
A6E0000
trusted library allocation
page execute and read and write
5900000
trusted library allocation
page execute and read and write
A9DC000
stack
page read and write
12DF000
heap
page read and write
14C43180000
trusted library allocation
page read and write
2F61000
trusted library allocation
page read and write
14C482FC000
heap
page read and write
AB1E000
stack
page read and write
778E000
stack
page read and write
53A6000
trusted library allocation
page read and write
5580000
trusted library section
page readonly
763E000
stack
page read and write
57F0000
trusted library allocation
page read and write
7FB2000
trusted library allocation
page read and write
14C43F40000
trusted library allocation
page read and write
78CE000
stack
page read and write
585A000
trusted library allocation
page read and write
6E4E000
trusted library allocation
page read and write
7450000
trusted library allocation
page read and write
1294000
trusted library allocation
page read and write
2E80000
heap
page read and write
4D3E000
stack
page read and write
2C40000
trusted library allocation
page execute and read and write
93EE000
stack
page read and write
14C42A9D000
heap
page read and write
135D000
heap
page read and write
3E99000
trusted library allocation
page read and write
9230000
trusted library allocation
page execute and read and write
946E000
stack
page read and write
660000
heap
page readonly
6DBC000
trusted library allocation
page read and write
149F000
stack
page read and write
AC70000
heap
page read and write
14C482FA000
heap
page read and write
5400000
trusted library allocation
page read and write
921A000
trusted library allocation
page read and write
550A000
trusted library allocation
page read and write
9FD87E000
unkown
page readonly
4F70000
heap
page read and write
7EAE000
trusted library allocation
page read and write
6DD4000
trusted library allocation
page read and write
5112000
trusted library allocation
page read and write
7040000
heap
page read and write
14C2000
trusted library allocation
page read and write
10BD000
heap
page read and write
50DF000
stack
page read and write
7DD1000
trusted library allocation
page read and write
14C42CF0000
heap
page read and write
9FDC7E000
unkown
page readonly
14C4821F000
heap
page read and write
1350000
heap
page read and write
708E000
heap
page read and write
7010000
heap
page read and write
A9BE000
stack
page read and write
14B0000
trusted library allocation
page read and write
14C48640000
trusted library allocation
page read and write
4EB0000
heap
page read and write
14C42AAE000
heap
page read and write
1293000
trusted library allocation
page execute and read and write
14C48100000
trusted library allocation
page read and write
124E000
stack
page read and write
E20000
heap
page read and write
A28F000
heap
page read and write
5240000
trusted library allocation
page read and write
14C48170000
remote allocation
page read and write
2BE0000
heap
page read and write
14C47FC0000
trusted library allocation
page read and write
670000
heap
page read and write
6CAE000
stack
page read and write
9FD67E000
unkown
page readonly
6CC0000
heap
page execute and read and write
A5FE000
stack
page read and write
12A8000
heap
page read and write
7F71000
trusted library allocation
page read and write
9D8E000
stack
page read and write
138B000
trusted library allocation
page execute and read and write
2AAD000
stack
page read and write
A77D000
stack
page read and write
9FCFFB000
stack
page read and write
2D50000
trusted library allocation
page read and write
6F10000
heap
page read and write
73E0000
trusted library allocation
page read and write
6E7B000
trusted library allocation
page read and write
766A000
heap
page read and write
A7FE000
stack
page read and write
A48F000
stack
page read and write
50F0000
trusted library allocation
page read and write
6F1D000
trusted library allocation
page read and write
538B000
trusted library allocation
page read and write
14C42AB3000
heap
page read and write
3010000
heap
page read and write
3040000
heap
page read and write
6A9E000
stack
page read and write
92B0000
heap
page read and write
74B0000
trusted library allocation
page read and write
7660000
heap
page read and write
10C5000
heap
page read and write
5190000
heap
page read and write
5810000
trusted library allocation
page read and write
14C42A63000
heap
page read and write
6FCE000
trusted library allocation
page read and write
757D000
stack
page read and write
58FE000
stack
page read and write
5610000
trusted library allocation
page execute and read and write
14C482BF000
heap
page read and write
A73C000
stack
page read and write
6F2D000
trusted library allocation
page read and write
5115000
trusted library allocation
page execute and read and write
7DD4000
trusted library allocation
page read and write
9F8E000
stack
page read and write
A8BE000
stack
page read and write
14C42AA9000
heap
page read and write
5750000
trusted library allocation
page read and write
5EF0000
heap
page read and write
3ED2000
trusted library allocation
page read and write
51E4000
trusted library allocation
page read and write
14C4830A000
heap
page read and write
789E000
stack
page read and write
5920000
trusted library allocation
page execute and read and write
7BF5000
trusted library allocation
page read and write
6B50000
trusted library allocation
page read and write
2950000
heap
page read and write
7D39000
trusted library allocation
page read and write
7E50000
trusted library allocation
page read and write
7DA6000
trusted library allocation
page read and write
96BF000
stack
page read and write
539E000
trusted library allocation
page read and write
101E000
heap
page read and write
53AC000
trusted library allocation
page read and write
5740000
trusted library allocation
page read and write
29DF000
stack
page read and write
511B000
trusted library allocation
page execute and read and write
B02000
unkown
page readonly
53C0000
trusted library allocation
page read and write
5850000
trusted library allocation
page read and write
6AC1000
trusted library allocation
page read and write
2E73000
heap
page read and write
14C42A8D000
heap
page read and write
256A000
stack
page read and write
5460000
heap
page read and write
14C480B0000
trusted library allocation
page read and write
14C43A90000
trusted library allocation
page read and write
4764000
trusted library allocation
page read and write
7D9F000
trusted library allocation
page read and write
4CF7000
stack
page read and write
7060000
heap
page read and write
5244000
trusted library allocation
page read and write
7A11000
heap
page read and write
294F000
unkown
page read and write
70406000
unkown
page readonly
5800000
trusted library allocation
page read and write
2CE1000
trusted library allocation
page read and write
3E71000
trusted library allocation
page read and write
6ACD000
trusted library allocation
page read and write
A63B000
stack
page read and write
14C42A13000
heap
page read and write
703F0000
unkown
page readonly
4E70000
heap
page read and write
53D0000
trusted library allocation
page read and write
129D000
trusted library allocation
page execute and read and write
6F60000
trusted library allocation
page read and write
14C48010000
trusted library allocation
page read and write
A8DC000
stack
page read and write
14C48302000
heap
page read and write
6CB0000
trusted library allocation
page read and write
14BA000
trusted library allocation
page execute and read and write
6B0E000
stack
page read and write
5E21000
heap
page read and write
74F0000
trusted library allocation
page read and write
9FDD7B000
stack
page read and write
6AA6000
trusted library allocation
page read and write
12BF000
heap
page read and write
14C480C0000
trusted library allocation
page read and write
6FFF000
trusted library allocation
page read and write
A36D000
stack
page read and write
7040D000
unkown
page read and write
9214000
trusted library allocation
page read and write
52F0000
heap
page read and write
2C50000
trusted library allocation
page read and write
14C42A9F000
heap
page read and write
79DE000
stack
page read and write
6E52000
trusted library allocation
page read and write
6E83000
trusted library allocation
page read and write
6C9E000
trusted library allocation
page read and write
6FBD000
trusted library allocation
page read and write
7D96000
trusted library allocation
page read and write
A4EE000
stack
page read and write
14C48120000
trusted library allocation
page read and write
6E89000
trusted library allocation
page read and write
2F0E000
stack
page read and write
2E0E000
stack
page read and write
6FB7000
trusted library allocation
page read and write
4EB0000
trusted library allocation
page read and write
6ABA000
trusted library allocation
page read and write
732E000
stack
page read and write
51E0000
trusted library allocation
page read and write
4D40000
heap
page read and write
6C9B000
trusted library allocation
page read and write
5110000
trusted library allocation
page read and write
2CC0000
trusted library allocation
page read and write
A3AE000
stack
page read and write
912F000
stack
page read and write
9220000
trusted library allocation
page read and write
14C42AFD000
heap
page read and write
E90000
heap
page read and write
7D61000
trusted library allocation
page read and write
9250000
heap
page read and write
4EB5000
heap
page read and write
14C42A2B000
heap
page read and write
14C480A0000
trusted library allocation
page read and write
4EE0000
heap
page read and write
1397000
heap
page read and write
A38E000
stack
page read and write
5260000
heap
page read and write
14C48170000
remote allocation
page read and write
9165000
trusted library allocation
page read and write
2BDF000
unkown
page read and write
E6A000
stack
page read and write
1046000
heap
page read and write
585C000
trusted library allocation
page read and write
8CEE000
stack
page read and write
6ABE000
trusted library allocation
page read and write
6E8E000
trusted library allocation
page read and write
72CF000
stack
page read and write
EC0000
heap
page read and write
56A0000
heap
page read and write
5340000
trusted library allocation
page read and write
6F6D000
trusted library allocation
page read and write
4E33000
heap
page read and write
6D91000
trusted library allocation
page read and write
7BF1000
trusted library allocation
page read and write
7B1E000
stack
page read and write
14C43300000
heap
page read and write
14C482C7000
heap
page read and write
764E000
stack
page read and write
6FF0000
trusted library allocation
page read and write
14C7000
trusted library allocation
page execute and read and write
4D48000
heap
page read and write
9470000
heap
page execute and read and write
A29B000
heap
page read and write
6D46000
trusted library allocation
page read and write
5820000
trusted library allocation
page execute and read and write
14C42A2F000
heap
page read and write
6F23000
trusted library allocation
page read and write
14C42AAE000
heap
page read and write
2CC0000
heap
page execute and read and write
7F84000
trusted library allocation
page read and write
5669000
trusted library allocation
page read and write
5247000
trusted library allocation
page read and write
2C60000
heap
page read and write
14C43840000
trusted library allocation
page read and write
1372000
trusted library allocation
page read and write
5760000
heap
page read and write
14C42AB3000
heap
page read and write
754E000
stack
page read and write
13EE000
stack
page read and write
6E7F000
trusted library allocation
page read and write
14C4331A000
heap
page read and write
5380000
trusted library allocation
page read and write
10A0000
heap
page read and write
D40000
heap
page read and write
14C48256000
heap
page read and write
6D2D000
trusted library allocation
page read and write
A22E000
stack
page read and write
134E000
stack
page read and write
14C47FD0000
trusted library allocation
page read and write
14C42A00000
heap
page read and write
14F0000
heap
page read and write
5748000
trusted library allocation
page read and write
6EB9000
trusted library allocation
page read and write
50FB000
trusted library allocation
page execute and read and write
6ED1000
trusted library allocation
page read and write
14C47FD1000
trusted library allocation
page read and write
6D42000
trusted library allocation
page read and write
50D0000
trusted library allocation
page read and write
14A0000
trusted library allocation
page read and write
4D6A000
heap
page read and write
6FF5000
trusted library allocation
page read and write
6ECB000
trusted library allocation
page read and write
2B9E000
unkown
page read and write
958E000
stack
page read and write
110E000
stack
page read and write
9590000
trusted library allocation
page read and write
14C482A2000
heap
page read and write
4F16000
heap
page read and write
7A1E000
stack
page read and write
7ECF000
stack
page read and write
4F6C000
stack
page read and write
100D000
stack
page read and write
14C48000000
trusted library allocation
page read and write
14C485B0000
trusted library allocation
page read and write
804A000
trusted library allocation
page read and write
12AE000
heap
page read and write
74E0000
trusted library allocation
page execute and read and write
A490000
heap
page read and write
7E66000
trusted library allocation
page read and write
7330000
trusted library section
page read and write
14CB000
trusted library allocation
page execute and read and write
13A0000
trusted library allocation
page read and write
5106000
trusted library allocation
page execute and read and write
4EC4000
trusted library allocation
page read and write
2E71000
trusted library allocation
page read and write
3E92000
trusted library allocation
page read and write
A7B0000
trusted library allocation
page execute and read and write
50FD000
trusted library allocation
page execute and read and write
1290000
trusted library allocation
page read and write
6B4D000
stack
page read and write
14C42B13000
heap
page read and write
2F80000
heap
page read and write
6E4A000
trusted library allocation
page read and write
768E000
stack
page read and write
2D04000
trusted library allocation
page read and write
14C42A3F000
heap
page read and write
A777000
trusted library allocation
page read and write
12E2000
heap
page read and write
701E000
heap
page read and write
10C0000
heap
page read and write
2CCB000
trusted library allocation
page read and write
7490000
trusted library section
page read and write
50E6000
trusted library allocation
page execute and read and write
6AF3000
heap
page read and write
6D20000
trusted library allocation
page read and write
2F4F000
stack
page read and write
14C480C0000
trusted library allocation
page read and write
6AC6000
trusted library allocation
page read and write
6E50000
trusted library allocation
page read and write
4D10000
heap
page read and write
14C48263000
heap
page read and write
9FEE7E000
unkown
page readonly
1353000
trusted library allocation
page execute and read and write
14C43202000
heap
page read and write
9EA000
stack
page read and write
2CA0000
heap
page read and write
4E80000
heap
page read and write
7D50000
trusted library allocation
page read and write
2D10000
trusted library allocation
page read and write
6BE0000
heap
page execute and read and write
2E50000
trusted library allocation
page execute and read and write
14C480A0000
trusted library allocation
page read and write
1380000
trusted library allocation
page read and write
4D70000
heap
page read and write
4D77000
heap
page read and write
10F5000
heap
page read and write
4D6E000
stack
page read and write
6D88000
trusted library allocation
page read and write
4FBF000
stack
page read and write
1376000
trusted library allocation
page execute and read and write
1370000
trusted library allocation
page read and write
1387000
trusted library allocation
page execute and read and write
90A0000
trusted library allocation
page read and write
12C7000
heap
page read and write
49AB000
stack
page read and write
9216000
trusted library allocation
page read and write
4FCC000
heap
page read and write
4CF7000
stack
page read and write
510A000
trusted library allocation
page execute and read and write
5120000
trusted library allocation
page execute and read and write
14C48130000
trusted library allocation
page read and write
7FCE000
trusted library allocation
page read and write
14C42B06000
heap
page read and write
5750000
trusted library allocation
page read and write
6D38000
trusted library allocation
page read and write
5718000
trusted library allocation
page read and write
There are 686 hidden memdumps, click here to show them.