IOC Report
iThmbConverterSetup.exe

loading gifFilesProcessesURLsDomainsIPsRegistryMemdumps1010010Label

Files

File Path
Type
Category
Malicious
Download
iThmbConverterSetup.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
C:\Program Files (x86)\iThmb Converter\iThmbConverter.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Program Files (x86)\iThmb Converter\is-5NVPK.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files (x86)\iThmb Converter\is-84GU4.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files (x86)\iThmb Converter\unins000.dat
InnoSetup Log iThmb Converter {AC7FF208-CE56-455E-96CB-1D96A0AF33EF}, version 0x418, 3129 bytes, LAPTOP-MJ\user\37, C:\Program Files (x86)\iThmb Converter\376
dropped
C:\Program Files (x86)\iThmb Converter\unins000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iThmb Converter\iThmb Converter on the Web.url
MS Windows 95 Internet shortcut text (URL=<http://www.ithmbconverter.com/>), ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iThmb Converter\iThmb Converter.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Apr 19 00:09:48 2025, mtime=Sat Apr 19 00:09:49 2025, atime=Sun Mar 13 17:46:14 2016, length=10256384, window=hide
dropped
C:\Users\user\AppData\Local\Temp\is-EJOM6.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\is-EJOM6.tmp\_isetup\_shfoldr.dll
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\is-HFEFH.tmp\iThmbConverterSetup.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Users\Public\Desktop\iThmb Converter.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Apr 19 00:09:48 2025, mtime=Sat Apr 19 00:09:49 2025, atime=Sun Mar 13 17:46:14 2016, length=10256384, window=hide
dropped
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files (x86)\iThmb Converter\iThmbConverter.exe
"C:\Program Files (x86)\iThmb Converter\iThmbConverter.exe"
 malicious
C:\Users\user\Desktop\iThmbConverterSetup.exe
"C:\Users\user\Desktop\iThmbConverterSetup.exe"
C:\Users\user\AppData\Local\Temp\is-HFEFH.tmp\iThmbConverterSetup.tmp
"C:\Users\user\AppData\Local\Temp\is-HFEFH.tmp\iThmbConverterSetup.tmp" /SL5="$10428,10009787,119296,C:\Users\user\Desktop\iThmbConverterSetup.exe"

URLs

Name
IP
Malicious
http://www.innosetup.com/
unknown
http://www.server.com/dir1/dirN/iPod%20Photo%20Cache/Photo%20Database
unknown
http://www.ithmbconverter.com/U
unknown
http://www.ithmbconverter.com/update.txt=z
unknown
http://www.ithmbconverter.coma
unknown
http://www.ithmbconverter.com/update.txt
37.140.192.138
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
unknown
https://www.ithmbconverter.com/update.txt
unknown
http://www.ithmbconverter.com/AppData
unknown
http://www.ithmbconverter.com/
unknown
http://www.ithmbconverter.com/from-app/en/buy/a
unknown
http://www.ithmbconverter.com/update.txtta
unknown
http://www.palkornel.hu/innosetup%1
unknown
http://www.remobjects.com/ps
unknown
http://www.ithmbconverter.com
unknown
http://www.ithmbconverter.com/from-app/
unknown
http://www.ithmbconverter.comSV
unknown
http://www.ithmbconverter.com/q
unknown
http://www.dk-soft.org/
unknown
There are 9 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ithmbconverter.com
37.140.192.138
www.ithmbconverter.com
unknown

IPs

IP
Domain
Country
Malicious
37.140.192.138
ithmbconverter.com
Russian Federation

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Owner
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
SessionHash
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Sequence
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
RegFiles0000
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
RegFilesHash
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ithmb
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iThmbConverter.ITHMB
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iThmbConverter.ITHMB\DefaultIcon
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\iThmbConverter.ITHMB\Shell\Open\Command
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
Inno Setup: Setup Version
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
Inno Setup: App Path
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
InstallLocation
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
Inno Setup: Icon Group
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
Inno Setup: User
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
Inno Setup: Selected Tasks
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
Inno Setup: Deselected Tasks
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
Inno Setup: Language
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
DisplayIcon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
UninstallString
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
QuietUninstallString
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
DisplayVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
Publisher
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
URLInfoAbout
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
HelpLink
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
URLUpdateInfo
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
NoModify
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
NoRepair
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
InstallDate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
MajorVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
MinorVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC7FF208-CE56-455E-96CB-1D96A0AF33EF}_is1
EstimatedSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter
There are 23 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
797A000
heap
page read and write
7FD30000
direct allocation
page read and write
3941000
heap
page read and write
1C49000
heap
page read and write
199000
stack
page read and write
79A3000
heap
page read and write
76E000
heap
page read and write
1C35000
heap
page read and write
24A9000
heap
page read and write
614000
heap
page read and write
3921000
heap
page read and write
7944000
heap
page read and write
7A15000
heap
page read and write
225E000
direct allocation
page read and write
2300000
direct allocation
page read and write
614000
heap
page read and write
7951000
heap
page read and write
1C8A000
heap
page read and write
B5E000
stack
page read and write
79E9000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
7922000
heap
page read and write
44C8000
direct allocation
page read and write
4522000
direct allocation
page read and write
3921000
heap
page read and write
7A9000
heap
page read and write
3921000
heap
page read and write
797000
heap
page read and write
610000
heap
page read and write
7DA000
heap
page read and write
7EE000
heap
page read and write
7CD000
heap
page read and write
397D000
heap
page read and write
3921000
heap
page read and write
79A1000
heap
page read and write
23B2000
direct allocation
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
230E000
direct allocation
page read and write
7E6000
heap
page read and write
41A000
unkown
page execute read
79B0000
heap
page read and write
79FF000
heap
page read and write
797C000
heap
page read and write
79B2000
heap
page read and write
614000
heap
page read and write
1BB4000
heap
page read and write
1BB4000
heap
page read and write
797A000
heap
page read and write
29A0000
heap
page read and write
4CAF000
stack
page read and write
3921000
heap
page read and write
6882000
direct allocation
page read and write
3921000
heap
page read and write
7966000
heap
page read and write
7FE41000
direct allocation
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
793A000
heap
page read and write
2340000
direct allocation
page read and write
3350000
direct allocation
page read and write
79D5000
heap
page read and write
17E000
stack
page read and write
1161000
unkown
page execute and write copy
2373000
direct allocation
page read and write
3647000
direct allocation
page read and write
7BC000
heap
page read and write
23F8000
direct allocation
page read and write
792D000
heap
page read and write
1C7D000
heap
page read and write
3921000
heap
page read and write
3683000
direct allocation
page read and write
2274000
direct allocation
page read and write
4561000
direct allocation
page read and write
1BB4000
heap
page read and write
2356000
direct allocation
page read and write
23AA000
direct allocation
page read and write
79A5000
heap
page read and write
1C54000
heap
page read and write
18D000
stack
page read and write
A39000
unkown
page read and write
4533000
direct allocation
page read and write
A6E000
unkown
page execute and read and write
23C5000
direct allocation
page read and write
73BF000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
417000
unkown
page read and write
7951000
heap
page read and write
15E000
stack
page read and write
1BB4000
heap
page read and write
7966000
heap
page read and write
1CA5000
heap
page read and write
3AB8000
heap
page read and write
614000
heap
page read and write
1ADD000
unkown
page execute and read and write
3921000
heap
page read and write
2423000
direct allocation
page read and write
2431000
direct allocation
page read and write
79B4000
heap
page read and write
401000
unkown
page execute read
3921000
heap
page read and write
3921000
heap
page read and write
7A15000
heap
page read and write
3921000
heap
page read and write
1BB5000
heap
page read and write
1C30000
heap
page read and write
79A5000
heap
page read and write
796E000
heap
page read and write
3BF1000
direct allocation
page read and write
79DC000
heap
page read and write
4A6E000
stack
page read and write
614000
heap
page read and write
7944000
heap
page read and write
1C7D000
heap
page read and write
1C87000
heap
page read and write
54A000
heap
page read and write
3921000
heap
page read and write
A44000
unkown
page read and write
1BB4000
heap
page read and write
363F000
direct allocation
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
79B4000
heap
page read and write
44FC000
direct allocation
page read and write
25CC000
direct allocation
page read and write
7C2000
heap
page read and write
3AC0000
direct allocation
page read and write
191000
stack
page read and write
792D000
heap
page read and write
79B4000
heap
page read and write
500000
unkown
page read and write
500000
unkown
page write copy
3921000
heap
page read and write
887000
unkown
page read and write
4552000
direct allocation
page read and write
1ABD000
unkown
page execute and read and write
614000
heap
page read and write
1C7D000
heap
page read and write
3921000
heap
page read and write
796D000
heap
page read and write
614000
heap
page read and write
7E1000
heap
page read and write
79B4000
heap
page read and write
79B2000
heap
page read and write
1C32000
heap
page read and write
18F000
stack
page read and write
397D000
heap
page read and write
1C79000
heap
page read and write
7D9000
heap
page read and write
44DF000
direct allocation
page read and write
1C4D000
heap
page read and write
A5F000
stack
page read and write
43ED000
stack
page read and write
9C3000
unkown
page read and write
793A000
heap
page read and write
7B1000
heap
page read and write
3611000
direct allocation
page read and write
3981000
heap
page read and write
AB4F000
stack
page read and write
A190000
trusted library allocation
page read and write
3C40000
heap
page read and write
3921000
heap
page read and write
3916000
heap
page read and write
3921000
heap
page read and write
798C000
heap
page read and write
3921000
heap
page read and write
226D000
direct allocation
page read and write
1C8E000
heap
page read and write
7D5000
heap
page read and write
3921000
heap
page read and write
781000
heap
page read and write
30000
heap
page read and write
415000
unkown
page execute read
3921000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
79B000
heap
page read and write
79A1000
heap
page read and write
614000
heap
page read and write
3921000
heap
page read and write
7972000
heap
page read and write
3AF0000
direct allocation
page read and write
614000
heap
page read and write
614000
heap
page read and write
3941000
heap
page read and write
397F000
heap
page read and write
3983000
heap
page read and write
1CA9000
heap
page read and write
3921000
heap
page read and write
79F000
heap
page read and write
30000
heap
page read and write
614000
heap
page read and write
614000
heap
page read and write
1C54000
heap
page read and write
24A0000
heap
page read and write
3921000
heap
page read and write
614000
heap
page read and write
EFB0000
trusted library allocation
page read and write
19D000
stack
page read and write
400000
unkown
page readonly
614000
heap
page read and write
614000
heap
page read and write
614000
heap
page read and write
614000
heap
page read and write
795B000
heap
page read and write
3BCD000
direct allocation
page read and write
50B000
unkown
page write copy
73B0000
heap
page read and write
3921000
heap
page read and write
367A000
direct allocation
page read and write
614000
heap
page read and write
365D000
direct allocation
page read and write
347E000
stack
page read and write
3921000
heap
page read and write
795A000
heap
page read and write
3921000
heap
page read and write
25C0000
heap
page read and write
1BB4000
heap
page read and write
3B52000
direct allocation
page read and write
A8C000
unkown
page execute and read and write
784000
heap
page read and write
614000
heap
page read and write
3B59000
direct allocation
page read and write
79B2000
heap
page read and write
66C0000
direct allocation
page read and write
A3F000
unkown
page read and write
3921000
heap
page read and write
1C9C000
heap
page read and write
34BE000
stack
page read and write
792D000
heap
page read and write
227B000
direct allocation
page read and write
7D7000
heap
page read and write
1C7D000
heap
page read and write
412000
unkown
page read and write
796D000
heap
page read and write
2315000
direct allocation
page read and write
7931000
heap
page read and write
2A90000
heap
page read and write
50B000
unkown
page read and write
3983000
heap
page read and write
232E000
direct allocation
page read and write
614000
heap
page read and write
3982000
heap
page read and write
3921000
heap
page read and write
76A000
heap
page read and write
1B30000
heap
page read and write
3BB8000
direct allocation
page read and write
7C6000
heap
page read and write
79BE000
heap
page read and write
42AD000
stack
page read and write
22A0000
direct allocation
page read and write
8F000
stack
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
1BB4000
heap
page read and write
795F000
heap
page read and write
3673000
direct allocation
page read and write
34C0000
direct allocation
page read and write
7956000
heap
page read and write
760000
heap
page read and write
400000
unkown
page readonly
2364000
direct allocation
page read and write
1BB4000
heap
page read and write
1C44000
heap
page read and write
3921000
heap
page read and write
2B50000
trusted library allocation
page read and write
234F000
direct allocation
page read and write
2601000
direct allocation
page read and write
3921000
heap
page read and write
397D000
heap
page read and write
2299000
direct allocation
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
79B2000
heap
page read and write
3B16000
direct allocation
page read and write
2320000
direct allocation
page read and write
3921000
heap
page read and write
3B06000
direct allocation
page read and write
500000
heap
page read and write
1C40000
heap
page read and write
4568000
direct allocation
page read and write
614000
heap
page read and write
7987000
heap
page read and write
3921000
heap
page read and write
2438000
direct allocation
page read and write
3921000
heap
page read and write
614000
heap
page read and write
3921000
heap
page read and write
3B8C000
direct allocation
page read and write
3B31000
direct allocation
page read and write
16B000
stack
page read and write
7F3000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
3B21000
direct allocation
page read and write
7923000
heap
page read and write
3921000
heap
page read and write
7961000
heap
page read and write
614000
heap
page read and write
614000
heap
page read and write
1BB4000
heap
page read and write
614000
heap
page read and write
3921000
heap
page read and write
7BC000
heap
page read and write
7951000
heap
page read and write
614000
heap
page read and write
3921000
heap
page read and write
7A9000
heap
page read and write
3921000
heap
page read and write
1C9E000
heap
page read and write
3921000
heap
page read and write
614000
heap
page read and write
1BB4000
heap
page read and write
3691000
direct allocation
page read and write
795A000
heap
page read and write
25E4000
direct allocation
page read and write
7961000
heap
page read and write
1B23000
unkown
page readonly
7951000
heap
page read and write
2610000
direct allocation
page read and write
7AD000
heap
page read and write
3AB0000
heap
page read and write
3BE3000
direct allocation
page read and write
4519000
direct allocation
page read and write
3921000
heap
page read and write
4570000
heap
page read and write
1AE1000
unkown
page readonly
240D000
direct allocation
page read and write
2725000
direct allocation
page read and write
614000
heap
page read and write
3942000
heap
page read and write
79B000
heap
page read and write
799F000
heap
page read and write
2450000
heap
page read and write
794D000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
6848000
direct allocation
page read and write
25C3000
heap
page read and write
7B5000
heap
page read and write
614000
heap
page read and write
1BB4000
heap
page read and write
39C0000
heap
page read and write
79D0000
heap
page read and write
235D000
direct allocation
page read and write
3921000
heap
page read and write
1C37000
heap
page read and write
228B000
direct allocation
page read and write
1C8E000
heap
page read and write
1CA7000
heap
page read and write
3921000
heap
page read and write
3A20000
trusted library allocation
page read and write
7987000
heap
page read and write
71E000
stack
page read and write
3921000
heap
page read and write
51D000
unkown
page readonly
614000
heap
page read and write
44F4000
direct allocation
page read and write
1BB4000
heap
page read and write
7EA000
heap
page read and write
7931000
heap
page read and write
48CE000
stack
page read and write
1CAF000
heap
page read and write
7966000
heap
page read and write
41C000
unkown
page readonly
93000
stack
page read and write
3921000
heap
page read and write
7A15000
heap
page read and write
3921000
heap
page read and write
1AE9000
unkown
page readonly
3BD4000
direct allocation
page read and write
1BB4000
heap
page read and write
44E6000
direct allocation
page read and write
3921000
heap
page read and write
1BB4000
heap
page read and write
A2E000
unkown
page read and write
23A5000
direct allocation
page read and write
614000
heap
page read and write
3942000
heap
page read and write
795F000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
3920000
heap
page read and write
2265000
direct allocation
page read and write
23F0000
direct allocation
page read and write
2406000
direct allocation
page read and write
9FF000
stack
page read and write
79D0000
heap
page read and write
7944000
heap
page read and write
69E000
stack
page read and write
7DE000
heap
page read and write
3BDC000
direct allocation
page read and write
7931000
heap
page read and write
787000
heap
page read and write
3921000
heap
page read and write
3B0F000
direct allocation
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
3BA2000
direct allocation
page read and write
614000
heap
page read and write
7987000
heap
page read and write
3350000
direct allocation
page read and write
44A9000
direct allocation
page read and write
1CA6000
heap
page read and write
7A15000
heap
page read and write
1BB4000
heap
page read and write
401000
unkown
page execute read
7973000
heap
page read and write
79B0000
heap
page read and write
614000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
1BCA000
heap
page read and write
23FF000
direct allocation
page read and write
3941000
heap
page read and write
614000
heap
page read and write
3921000
heap
page read and write
793A000
heap
page read and write
7C6000
heap
page read and write
4B6F000
stack
page read and write
AB50000
heap
page read and write
1C7D000
heap
page read and write
79E9000
heap
page read and write
3921000
heap
page read and write
518000
unkown
page readonly
79E9000
heap
page read and write
44A1000
direct allocation
page read and write
620000
heap
page read and write
3921000
heap
page read and write
3B4B000
direct allocation
page read and write
3921000
heap
page read and write
7C5000
heap
page read and write
7F2000
heap
page read and write
1CB5000
heap
page read and write
797A000
heap
page read and write
3AF9000
direct allocation
page read and write
3B6F000
direct allocation
page read and write
1C2A000
heap
page read and write
AA0000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
400000
unkown
page readonly
614000
heap
page read and write
614000
heap
page read and write
7C2000
heap
page read and write
1C48000
heap
page read and write
2292000
direct allocation
page read and write
504000
unkown
page read and write
2257000
direct allocation
page read and write
79D5000
heap
page read and write
3698000
direct allocation
page read and write
3921000
heap
page read and write
79B0000
heap
page read and write
7E3000
heap
page read and write
3921000
heap
page read and write
79F000
heap
page read and write
401000
unkown
page execute read
3921000
heap
page read and write
412000
unkown
page write copy
452A000
direct allocation
page read and write
1BB4000
heap
page read and write
242A000
direct allocation
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
3AF7000
direct allocation
page read and write
1AE9000
unkown
page readonly
4CB0000
heap
page read and write
400000
unkown
page readonly
1B23000
unkown
page readonly
23BD000
direct allocation
page read and write
241C000
direct allocation
page read and write
3A90000
direct allocation
page execute and read and write
3AC0000
heap
page read and write
3C00000
heap
page read and write
7BF000
heap
page read and write
7E8000
heap
page read and write
3618000
direct allocation
page read and write
23E9000
direct allocation
page read and write
7A3000
heap
page read and write
2250000
direct allocation
page read and write
3BC6000
direct allocation
page read and write
1CB5000
heap
page read and write
1C43000
heap
page read and write
38BF000
stack
page read and write
4542000
direct allocation
page read and write
8C2000
unkown
page read and write
3921000
heap
page read and write
3638000
direct allocation
page read and write
3932000
heap
page read and write
2414000
direct allocation
page read and write
4A2F000
stack
page read and write
614000
heap
page read and write
24D0000
direct allocation
page read and write
1C7F000
heap
page read and write
3921000
heap
page read and write
1CB0000
heap
page read and write
2282000
direct allocation
page read and write
1BB4000
heap
page read and write
7E8000
heap
page read and write
3941000
heap
page read and write
1C3E000
heap
page read and write
795F000
heap
page read and write
3921000
heap
page read and write
1ADE000
unkown
page execute and write copy
1ABE000
unkown
page execute and write copy
3921000
heap
page read and write
614000
heap
page read and write
79A9000
heap
page read and write
797A000
heap
page read and write
3921000
heap
page read and write
7972000
heap
page read and write
614000
heap
page read and write
1BB4000
heap
page read and write
39C1000
heap
page read and write
3921000
heap
page read and write
79D5000
heap
page read and write
614000
heap
page read and write
7961000
heap
page read and write
7927000
heap
page read and write
3B85000
direct allocation
page read and write
7A01000
heap
page read and write
3921000
heap
page read and write
368A000
direct allocation
page read and write
23CC000
direct allocation
page read and write
42EE000
stack
page read and write
3921000
heap
page read and write
44D8000
direct allocation
page read and write
1BB4000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
7CF000
heap
page read and write
3921000
heap
page read and write
511000
unkown
page readonly
614000
heap
page read and write
3B93000
direct allocation
page read and write
3CB3000
heap
page read and write
3921000
heap
page read and write
614000
heap
page read and write
614000
heap
page read and write
7E1000
heap
page read and write
79B0000
heap
page read and write
7961000
heap
page read and write
3B7D000
direct allocation
page read and write
3921000
heap
page read and write
237A000
direct allocation
page read and write
23E2000
direct allocation
page read and write
7949000
heap
page read and write
3B3B000
direct allocation
page read and write
1BB4000
heap
page read and write
614000
heap
page read and write
7EA000
heap
page read and write
3921000
heap
page read and write
44ED000
direct allocation
page read and write
37BF000
stack
page read and write
4BAE000
stack
page read and write
1BB0000
heap
page read and write
3BF8000
direct allocation
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
3B68000
direct allocation
page read and write
614000
heap
page read and write
3921000
heap
page read and write
79E9000
heap
page read and write
231C000
direct allocation
page read and write
2324000
direct allocation
page read and write
2388000
direct allocation
page read and write
794E000
heap
page read and write
7966000
heap
page read and write
23DB000
direct allocation
page read and write
22A7000
direct allocation
page read and write
1AC4000
unkown
page execute and write copy
3921000
heap
page read and write
7972000
heap
page read and write
3921000
heap
page read and write
3360000
direct allocation
page read and write
79AA000
heap
page read and write
7987000
heap
page read and write
1C7D000
heap
page read and write
3921000
heap
page read and write
2339000
direct allocation
page read and write
3921000
heap
page read and write
95F000
stack
page read and write
3B76000
direct allocation
page read and write
614000
heap
page read and write
1C44000
heap
page read and write
41AE000
stack
page read and write
2307000
direct allocation
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
614000
heap
page read and write
3921000
heap
page read and write
1CB5000
heap
page read and write
3921000
heap
page read and write
1E0000
heap
page read and write
8FE000
stack
page read and write
614000
heap
page read and write
2608000
direct allocation
page read and write
7A9000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
A3EE000
stack
page read and write
508000
unkown
page read and write
1BB4000
heap
page read and write
3656000
direct allocation
page read and write
3921000
heap
page read and write
366C000
direct allocation
page read and write
30000
heap
page read and write
25EC000
direct allocation
page read and write
9B000
stack
page read and write
3921000
heap
page read and write
1BC0000
heap
page read and write
419000
unkown
page write copy
614000
heap
page read and write
54E000
heap
page read and write
614000
heap
page read and write
1C7D000
heap
page read and write
3921000
heap
page read and write
7BC000
heap
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
3A20000
heap
page read and write
3921000
heap
page read and write
2490000
direct allocation
page execute and read and write
79D0000
heap
page read and write
7C8000
heap
page read and write
1161000
unkown
page execute and write copy
79D5000
heap
page read and write
3921000
heap
page read and write
614000
heap
page read and write
3921000
heap
page read and write
79A1000
heap
page read and write
1AC3000
unkown
page execute and read and write
3921000
heap
page read and write
2381000
direct allocation
page read and write
3910000
heap
page read and write
3921000
heap
page read and write
1BCE000
heap
page read and write
1AE1000
unkown
page readonly
3921000
heap
page read and write
3921000
heap
page read and write
6DE000
stack
page read and write
614000
heap
page read and write
79EC000
heap
page read and write
3981000
heap
page read and write
3921000
heap
page read and write
24A5000
heap
page read and write
236C000
direct allocation
page read and write
3BEA000
direct allocation
page read and write
79BF000
heap
page read and write
3921000
heap
page read and write
7920000
heap
page read and write
3CB0000
heap
page read and write
3921000
heap
page read and write
7AB000
heap
page read and write
614000
heap
page read and write
614000
heap
page read and write
3921000
heap
page read and write
25F3000
direct allocation
page read and write
3941000
heap
page read and write
424000
unkown
page readonly
450B000
direct allocation
page read and write
3921000
heap
page read and write
3921000
heap
page read and write
7992000
heap
page read and write
3665000
direct allocation
page read and write
614000
heap
page read and write
3921000
heap
page read and write
79D0000
heap
page read and write
1C0F000
heap
page read and write
614000
heap
page read and write
540000
heap
page read and write
614000
heap
page read and write
38C0000
heap
page read and write
25FA000
direct allocation
page read and write
There are 669 hidden memdumps, click here to show them.