IOC Report
Q0cWJo6Jvh.exe

loading gif

Files

File Path
Type
Category
Malicious
Q0cWJo6Jvh.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\5p9SnCM5jV\0101a.zip
data
dropped
C:\5p9SnCM5jV\0101a_decrypted.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\5p9SnCM5jV\7zxa.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ybtrrus.exe_683bff55a16640f67d09d21b465f995196f3a66_03a19419_e662bf84-689b-4b00-9f82-67420fdf90b1\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E17.tmp.dmp
Mini DuMP crash report, 15 streams, Mon Oct 7 20:42:48 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2452.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER24B1.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
C:\temp333\g2m.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\temp333\install_2.dll
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\5p9SnCM5jV\ybtrrus.exe
"C:\5p9SnCM5jV\ybtrrus.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /Query /TN "Boomer"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C SCHTASKS /Create /F /RL HIGHEST /TN "Boomer" /TR "C:\5p9SnCM5jV\ybtrrus.exe" /SC ONLOGON /DELAY 0001:00
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\5p9SnCM5jV\ybtrrus.exe" enable=yes profile=any
malicious
C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /Create /F /RL HIGHEST /TN "Boomer" /TR "C:\5p9SnCM5jV\ybtrrus.exe" /SC ONLOGON /DELAY 0001:00
 malicious
C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="ybtrrus" dir=in action=allow program="C:\5p9SnCM5jV\ybtrrus.exe" enable=yes profile=any
 malicious
C:\5p9SnCM5jV\ybtrrus.exe
C:\5p9SnCM5jV\ybtrrus.exe
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ipconfig /flushdns
 malicious
C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
 malicious
C:\Users\user\Desktop\Q0cWJo6Jvh.exe
"C:\Users\user\Desktop\Q0cWJo6Jvh.exe"
C:\temp333\install_2.dll
"C:\temp333\install_2.dll"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 556
There are 6 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://147.45.116.5:80/FANTASMA/g2m.dll
unknown
http://www.ghisler.com/plugins.htm
unknown
http://fontawesome.io
unknown
http://147.45.116.5/
unknown
http://www.scootersoftware.com/checkupdates.php?product=bc3&minor=
unknown
http://www.embarcadero.com/products/delphi
unknown
http://www.scootersoftware.com/bugRepMailer.php
unknown
http://147.45.116.5/FANTASMA/g2m.dll3:G
unknown
http://147.45.116.5/index.php
unknown
http://www.esegece.com
unknown
https://docs.rs/getrandom#nodejs-es-module-support
unknown
http://www.totalcmd.net/directory/packer.html
unknown
http://www.indyproject.org/
unknown
http://147.45.116.5/iq
unknown
http://www.scootersoftware.com/buynow?bld=%dS
unknown
http://147.45.116.5/mq
unknown
http://147.45.116.5/FANTASMA/install_2.exeUq
unknown
http://www.scootersoftware.com/
unknown
https://fontawesome.com/license/free
unknown
http://dev.w3.org/html5/websockets/
unknown
http://www.scootersoftware.com/buynow?bld=%d
unknown
http://147.45.116.5/FANTASMA/0101.zip
unknown
https://fontawesome.com
unknown
http://www.opensource.org/licenses/mit-license.php
unknown
http://www.scootersoftware.com/download.php
unknown
http://147.45.116.5/X
unknown
https://github.com/muaz-khan/RecordRTC
unknown
http://www.scootersoftware.com/v3formats
unknown
http://www.scootersoftware.com/upgradeite
unknown
http://gimite.net/en/
unknown
http://147.45.116.5/index.php_j
unknown
http://www.scootersoftware.com. 
unknown
http://www.scootersoftware.com/upgradeh
unknown
http://fontawesome.iohttp://fontawesome.iohttp://fontawesome.io/license/http://fontawesome.io/licens
unknown
http://147.45.116.5/index.php?user-PC
unknown
http://code.google.com/p/swfobject/
unknown
http://147.45.116.5/FANTASMA/0101.zipoE
unknown
http://tools.ietf.org/html/rfc6455
unknown
http://upx.sf.net
unknown
http://147.45.116.5/FANTASMA/g2m.dll
unknown
https://github.com/Yaffle/EventSource/
unknown
http://147.45.116.5/FANTASMA/install_2.exe
unknown
http://147.45.116.5:80/FANTASMA/install_2.exepZ
unknown
http://www.scootersoftware.com/upgrade
unknown
http://www.scootersoftware.com/support.php
unknown
http://fontawesome.io/license/
unknown
http://javascript.crockford.com/jsmin.html
unknown
http://www.scootersoftware.com/download.phpS
unknown
http://147.45.116.5/FANTASMA/install_2.exe9
unknown
http://www.scootersoftware.com/bugRepMailer.phpZ
unknown
http://www.scootersoftware.com/upgradeF
unknown
http://worldtimeapi.org/api/timezone/America/Sao_Paulo
213.188.196.246
https://github.com/muaz-khan/RTCMultiConnection/issues/778#issuecomment-524853468
unknown
http://147.45.116.5/1qd
unknown
http://147.45.116.5/FANTASMA/g2m.dllDownloadBinary/1.0147.45.116.5FANTASMA/g2m.dllhttp://147.45.116.
unknown
https://github.com/muaz-khan/RTCMultiConnection
unknown
http://www.secureblackbox.com
unknown
http://www.scootersoftware.com/upgrade0
unknown
http://www.scootersoftware.com/upgradeeow.
unknown
There are 49 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ntp1.glb.nist.gov
132.163.97.3
worldtimeapi.org
213.188.196.246
tgb5f522c40.servegame.com
208.76.221.217
time.nist.gov
unknown

IPs

IP
Domain
Country
Malicious
213.188.196.246
worldtimeapi.org
Italy
147.45.116.5
unknown
Russian Federation
208.76.221.217
tgb5f522c40.servegame.com
United States
132.163.97.3
ntp1.glb.nist.gov
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Scooter Software\Beyond Compare 3
CacheID
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
ProgramId
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
FileId
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
LowerCaseLongPath
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
LongPathHash
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
Name
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
OriginalFileName
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
Publisher
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
Version
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
BinFileVersion
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
BinaryType
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
ProductName
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
ProductVersion
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
LinkDate
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
BinProductVersion
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
AppxPackageFullName
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
AppxPackageRelativeId
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
Size
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
Language
\REGISTRY\A\{2984ff44-3051-bd8f-5013-9ff509ed6dd3}\Root\InventoryApplicationFile\ybtrrus.exe|a3bd24da8e2ec850
Usn
There are 10 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
24EA000
heap
page read and write
5430000
unkown
page readonly
2B81000
heap
page read and write
2B81000
heap
page read and write
75B8000
direct allocation
page read and write
1081000
heap
page read and write
2B21000
direct allocation
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
29EF000
stack
page read and write
2C01000
heap
page read and write
8E7E000
stack
page read and write
6BEF000
unkown
page read and write
2AEE000
direct allocation
page read and write
478000
heap
page read and write
24FD000
stack
page read and write
958E000
direct allocation
page read and write
2C01000
heap
page read and write
30FD000
stack
page read and write
9E7F000
stack
page read and write
2D3D000
stack
page read and write
2C01000
heap
page read and write
9159000
direct allocation
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
279C732D000
heap
page read and write
2C01000
heap
page read and write
6B6A000
unkown
page write copy
2C01000
heap
page read and write
6CAD2000
unkown
page readonly
34FF000
unkown
page read and write
756E000
unkown
page readonly
7590000
direct allocation
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
402000
unkown
page readonly
279C736D000
heap
page read and write
400000
unkown
page readonly
580000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
24D0000
heap
page read and write
495000
heap
page read and write
2C01000
heap
page read and write
478000
heap
page read and write
75C6000
direct allocation
page read and write
248F000
stack
page read and write
7679000
direct allocation
page read and write
2C01000
heap
page read and write
953E000
direct allocation
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
B28000
unkown
page write copy
476000
heap
page read and write
254D000
heap
page read and write
2A30000
heap
page read and write
75A1000
direct allocation
page read and write
2B81000
heap
page read and write
468000
heap
page read and write
487000
heap
page read and write
8DE000
unkown
page read and write
9510000
direct allocation
page read and write
6B4A000
unkown
page read and write
6C04000
unkown
page read and write
8EFA000
direct allocation
page read and write
2B66000
direct allocation
page read and write
320E000
stack
page read and write
6D1D0000
unkown
page readonly
6D455000
unkown
page readonly
24DE000
heap
page read and write
4B3000
heap
page read and write
2C01000
heap
page read and write
10FC000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
730000
heap
page read and write
24BE000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
6B3F000
unkown
page read and write
2ABD000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2BAF000
direct allocation
page read and write
2BA3000
heap
page read and write
7617000
direct allocation
page read and write
47A000
heap
page read and write
7FF779911000
unkown
page read and write
2C01000
heap
page read and write
7601000
direct allocation
page read and write
A178000
direct allocation
page read and write
108B000
heap
page read and write
2B81000
heap
page read and write
279C72E0000
heap
page read and write
6B75000
unkown
page read and write
2491000
heap
page read and write
93BB000
stack
page read and write
7627000
direct allocation
page read and write
8F12000
direct allocation
page read and write
850000
heap
page read and write
2498000
heap
page read and write
24BC000
heap
page read and write
2B81000
heap
page read and write
24D2000
heap
page read and write
24CA000
heap
page read and write
89EE000
stack
page read and write
2C01000
heap
page read and write
6BDA000
unkown
page read and write
1038000
heap
page read and write
7FF7798E0000
unkown
page readonly
405000
unkown
page readonly
2B81000
heap
page read and write
3323000
heap
page read and write
2C01000
heap
page read and write
EA4000
heap
page read and write
24BE000
heap
page read and write
279C7345000
heap
page read and write
279C7398000
heap
page read and write
254E000
heap
page read and write
2BBF000
unkown
page read and write
768F000
direct allocation
page read and write
24E2000
heap
page read and write
24F2000
heap
page read and write
6D39D000
unkown
page readonly
2C01000
heap
page read and write
2A10000
heap
page read and write
2C01000
heap
page read and write
76A4000
direct allocation
page read and write
2C01000
heap
page read and write
766B000
direct allocation
page read and write
769D000
direct allocation
page read and write
6C10000
unkown
page readonly
3323000
heap
page read and write
480000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2ABA000
direct allocation
page read and write
6C09000
unkown
page write copy
F50000
heap
page read and write
7FF77990F000
unkown
page read and write
279C75C0000
heap
page read and write
410000
heap
page read and write
2C01000
heap
page read and write
2AB2000
direct allocation
page read and write
254D000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
330C000
heap
page read and write
8F29000
direct allocation
page read and write
B0A000
unkown
page read and write
473000
heap
page read and write
2C01000
heap
page read and write
9B000
stack
page read and write
2491000
heap
page read and write
279C7394000
heap
page read and write
279C7370000
heap
page read and write
6AD000
stack
page read and write
9FBE000
stack
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
6B53000
unkown
page write copy
400000
unkown
page readonly
F49000
heap
page read and write
910000
heap
page read and write
2B81000
heap
page read and write
2B5F000
direct allocation
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
9740000
trusted library allocation
page read and write
2C01000
heap
page read and write
AB3000
unkown
page write copy
468000
heap
page read and write
254C000
heap
page read and write
2C01000
heap
page read and write
469000
heap
page read and write
7679000
direct allocation
page read and write
EA4000
heap
page read and write
A1A7000
direct allocation
page read and write
19A000
stack
page read and write
2B81000
heap
page read and write
10EE000
heap
page read and write
476000
heap
page read and write
24F4000
heap
page read and write
7620000
direct allocation
page read and write
75CD000
direct allocation
page read and write
2B81000
heap
page read and write
7FF779915000
unkown
page readonly
2B81000
heap
page read and write
FD9CBFE000
stack
page read and write
2C01000
heap
page read and write
2A6E000
direct allocation
page read and write
2B82000
heap
page read and write
2491000
heap
page read and write
6BC9000
unkown
page read and write
279C734F000
heap
page read and write
2AD1000
direct allocation
page read and write
279C7371000
heap
page read and write
9A40000
heap
page read and write
2A35000
heap
page read and write
2B81000
heap
page read and write
279C737E000
heap
page read and write
103B000
heap
page read and write
2C01000
heap
page read and write
E9A2000
heap
page read and write
279C734F000
heap
page read and write
24C8000
heap
page read and write
EA0000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
460000
heap
page read and write
ACF000
unkown
page read and write
2C01000
heap
page read and write
24D2000
heap
page read and write
AF8000
unkown
page read and write
6EC000
stack
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
76E0000
direct allocation
page execute and read and write
1031000
heap
page read and write
6CAC9000
unkown
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
24A1000
heap
page read and write
9A2C000
stack
page read and write
2C01000
heap
page read and write
279C737B000
heap
page read and write
2B81000
heap
page read and write
10E1000
heap
page read and write
249E000
heap
page read and write
2C01000
heap
page read and write
24A0000
heap
page read and write
F58000
heap
page read and write
6CAA1000
unkown
page execute read
44E000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
6CAC5000
unkown
page readonly
7FF779911000
unkown
page write copy
2B81000
heap
page read and write
2BD3000
direct allocation
page read and write
2B81000
heap
page read and write
995F000
stack
page read and write
2AA4000
direct allocation
page read and write
9161000
direct allocation
page read and write
2B81000
heap
page read and write
75C6000
direct allocation
page read and write
29C0000
heap
page read and write
2B81000
heap
page read and write
B16000
unkown
page read and write
765B000
direct allocation
page read and write
2B3D000
direct allocation
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2AA0000
heap
page read and write
279C7440000
remote allocation
page read and write
8F21000
direct allocation
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2AAB000
direct allocation
page read and write
2B4C000
direct allocation
page read and write
2B81000
heap
page read and write
24F0000
heap
page read and write
75A1000
direct allocation
page read and write
2B80000
heap
page read and write
766B000
direct allocation
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
487000
heap
page read and write
2F90000
heap
page read and write
900000
heap
page read and write
2B81000
heap
page read and write
2B70000
direct allocation
page read and write
7620000
direct allocation
page read and write
2C01000
heap
page read and write
AF8000
unkown
page read and write
7664000
direct allocation
page read and write
F8F000
heap
page read and write
279C7380000
heap
page read and write
95D7000
direct allocation
page read and write
7696000
direct allocation
page read and write
279C7394000
heap
page read and write
1038000
heap
page read and write
255C000
heap
page read and write
279C7380000
heap
page read and write
10CA000
heap
page read and write
6B66000
unkown
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
279C734F000
heap
page read and write
AFD000
unkown
page read and write
6C00000
unkown
page read and write
422000
unkown
page execute read
279C75C5000
heap
page read and write
5442000
unkown
page execute read
469000
heap
page read and write
254D000
heap
page read and write
2C01000
heap
page read and write
2B3A000
direct allocation
page read and write
9AA4000
heap
page read and write
B18000
unkown
page read and write
2AC7000
direct allocation
page read and write
254D000
heap
page read and write
279C7394000
heap
page read and write
6D440000
unkown
page write copy
2B81000
heap
page read and write
5431000
unkown
page execute read
440000
heap
page read and write
279C734B000
heap
page read and write
6B82000
unkown
page read and write
76C1000
direct allocation
page read and write
2C01000
heap
page read and write
478000
heap
page read and write
2B81000
heap
page read and write
24D0000
heap
page read and write
478000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
765B000
direct allocation
page read and write
2B81000
heap
page read and write
24E0000
heap
page read and write
B13000
unkown
page read and write
ACF000
unkown
page read and write
9A63000
heap
page read and write
7627000
direct allocation
page read and write
2A66000
direct allocation
page read and write
2C01000
heap
page read and write
5459000
unkown
page execute and read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
8F77000
stack
page read and write
7596000
direct allocation
page read and write
2A47000
direct allocation
page read and write
B31000
unkown
page readonly
76A4000
direct allocation
page read and write
E64000
heap
page read and write
2C01000
heap
page read and write
2C00000
heap
page read and write
2C01000
heap
page read and write
47A000
heap
page read and write
2B81000
heap
page read and write
3990000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2CFF000
stack
page read and write
6D454000
unkown
page read and write
8E37000
stack
page read and write
254D000
heap
page read and write
E20000
heap
page read and write
2C01000
heap
page read and write
2AC1000
direct allocation
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
FD9C5FC000
stack
page read and write
2C01000
heap
page read and write
2B3E000
stack
page read and write
2C01000
heap
page read and write
AEC000
unkown
page write copy
6B78000
unkown
page write copy
7636000
direct allocation
page read and write
762E000
direct allocation
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2490000
heap
page read and write
108B000
heap
page read and write
48A000
unkown
page execute read
B26000
unkown
page read and write
279C7200000
heap
page read and write
2C01000
heap
page read and write
76B3000
direct allocation
page read and write
2C01000
heap
page read and write
488000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
ACB000
unkown
page read and write
2C01000
heap
page read and write
2A8E000
direct allocation
page read and write
2B81000
heap
page read and write
279C739B000
heap
page read and write
2B81000
heap
page read and write
9A7B000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
F92000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2ABE000
unkown
page read and write
2DA0000
heap
page read and write
EB9D000
trusted library allocation
page read and write
2B81000
heap
page read and write
279C7346000
heap
page read and write
2B81000
heap
page read and write
ACB000
unkown
page write copy
279C7357000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
ACB000
unkown
page read and write
279C733A000
heap
page read and write
2B81000
heap
page read and write
108F000
heap
page read and write
279C7373000
heap
page read and write
2C01000
heap
page read and write
EAE000
stack
page read and write
2C01000
heap
page read and write
2B16000
direct allocation
page read and write
2B32000
direct allocation
page read and write
29A2000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
401000
unkown
page execute read
9A6E000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
76AC000
direct allocation
page read and write
768F000
direct allocation
page read and write
2C01000
heap
page read and write
279C7372000
heap
page read and write
AD2000
unkown
page read and write
6215000
unkown
page execute read
2D10000
heap
page read and write
2B28000
direct allocation
page read and write
460000
heap
page read and write
2B81000
heap
page read and write
2B0E000
direct allocation
page read and write
2BCC000
direct allocation
page read and write
8EFD000
direct allocation
page read and write
F38000
heap
page read and write
2C01000
heap
page read and write
24A0000
heap
page read and write
2C01000
heap
page read and write
100E000
heap
page read and write
2C01000
heap
page read and write
298C000
heap
page read and write
122F000
stack
page read and write
76C8000
direct allocation
page read and write
1000000
heap
page read and write
43B0000
heap
page read and write
279C7394000
heap
page read and write
2B0B000
direct allocation
page read and write
476000
heap
page read and write
401000
unkown
page execute read
2D20000
heap
page read and write
2C01000
heap
page read and write
738000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2B41000
direct allocation
page read and write
2558000
heap
page read and write
2AB5000
heap
page read and write
1089000
heap
page read and write
AD2000
unkown
page read and write
2080000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2B2B000
direct allocation
page read and write
2498000
heap
page read and write
7596000
direct allocation
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
A198000
direct allocation
page read and write
279C7306000
heap
page read and write
24E8000
heap
page read and write
6B79000
unkown
page read and write
2C01000
heap
page read and write
7577000
unkown
page readonly
ABC000
unkown
page read and write
279C737B000
heap
page read and write
487000
heap
page read and write
407000
unkown
page execute read
2C01000
heap
page read and write
2B6D000
direct allocation
page read and write
35FF000
stack
page read and write
2C01000
heap
page read and write
6B58000
unkown
page write copy
2B81000
heap
page read and write
279C7357000
heap
page read and write
B1F000
unkown
page read and write
2B81000
heap
page read and write
EB0000
heap
page read and write
279C7300000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
9A6C000
heap
page read and write
ADF000
unkown
page write copy
6CEF000
unkown
page readonly
2B81000
heap
page read and write
43B0000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
279C7367000
heap
page read and write
2C01000
heap
page read and write
112F000
stack
page read and write
9D00000
trusted library allocation
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
36F0000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2491000
heap
page read and write
9A75000
heap
page read and write
2B81000
heap
page read and write
2B8C000
heap
page read and write
2493000
heap
page read and write
2C01000
heap
page read and write
F30000
heap
page read and write
2B81000
heap
page read and write
279C737B000
heap
page read and write
2C01000
heap
page read and write
7688000
direct allocation
page read and write
B1C000
unkown
page read and write
2BFE000
stack
page read and write
9AC6000
heap
page read and write
493000
heap
page read and write
2B81000
heap
page read and write
B29000
unkown
page read and write
76B3000
direct allocation
page read and write
279C7440000
remote allocation
page read and write
6B48000
unkown
page write copy
279C7396000
heap
page read and write
279C7330000
heap
page read and write
2B7C000
direct allocation
page read and write
3700000
heap
page read and write
2C01000
heap
page read and write
2A20000
heap
page read and write
ABC000
unkown
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
3300000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2B84000
direct allocation
page read and write
460000
heap
page read and write
6D43F000
unkown
page read and write
478000
heap
page read and write
2C01000
heap
page read and write
2A0E000
unkown
page read and write
2B81000
heap
page read and write
2A5F000
direct allocation
page read and write
E1A0000
trusted library allocation
page read and write
24A0000
heap
page read and write
24E4000
heap
page read and write
9613000
direct allocation
page read and write
279C737B000
heap
page read and write
2B81000
heap
page read and write
20DE000
stack
page read and write
45B6000
heap
page read and write
2C01000
heap
page read and write
7672000
direct allocation
page read and write
254D000
heap
page read and write
102D000
heap
page read and write
487000
heap
page read and write
A189000
direct allocation
page read and write
2AF5000
direct allocation
page read and write
279C7311000
heap
page read and write
762E000
direct allocation
page read and write
2AD8000
direct allocation
page read and write
76C8000
direct allocation
page read and write
5441000
unkown
page execute and read and write
2556000
heap
page read and write
2940000
heap
page read and write
460000
heap
page read and write
ED3000
heap
page read and write
2B83000
heap
page read and write
7654000
direct allocation
page read and write
104C000
heap
page read and write
2B81000
heap
page read and write
9595000
direct allocation
page read and write
254D000
heap
page read and write
2C01000
heap
page read and write
2491000
heap
page read and write
91BE000
stack
page read and write
2AB0000
heap
page read and write
2B81000
heap
page read and write
2491000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
254D000
heap
page read and write
2C01000
heap
page read and write
6B50000
unkown
page read and write
2AFC000
direct allocation
page read and write
2B81000
heap
page read and write
96000
stack
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
279C733A000
heap
page read and write
24BC000
heap
page read and write
75B8000
direct allocation
page read and write
2980000
heap
page read and write
6B6C000
unkown
page read and write
7645000
direct allocation
page read and write
EA4000
heap
page read and write
1091000
heap
page read and write
6D441000
unkown
page read and write
AFD000
unkown
page read and write
2496000
heap
page read and write
1089000
heap
page read and write
2B24000
direct allocation
page read and write
2C01000
heap
page read and write
7688000
direct allocation
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
420000
heap
page read and write
2B81000
heap
page read and write
2558000
heap
page read and write
2C01000
heap
page read and write
478000
heap
page read and write
295D000
stack
page read and write
75F1000
direct allocation
page read and write
2C01000
heap
page read and write
279C739B000
heap
page read and write
279C7400000
heap
page read and write
4B3000
heap
page read and write
5420000
heap
page read and write
7654000
direct allocation
page read and write
255E000
heap
page read and write
545A000
unkown
page execute read
6BE5000
unkown
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
43D0000
direct allocation
page execute and read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
B13000
unkown
page read and write
75CD000
direct allocation
page read and write
3BB6000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
B1C000
unkown
page read and write
254D000
heap
page read and write
2B81000
heap
page read and write
8F38000
direct allocation
page read and write
2C01000
heap
page read and write
7FF779918000
unkown
page readonly
2B81000
heap
page read and write
1092000
heap
page read and write
2C01000
heap
page read and write
2550000
heap
page read and write
2497000
heap
page read and write
254D000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
6BFA000
unkown
page read and write
3321000
heap
page read and write
2E7F000
stack
page read and write
2B89000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
7FF779912000
unkown
page write copy
2B81000
heap
page read and write
2B81000
heap
page read and write
6C0E000
unkown
page readonly
2B81000
heap
page read and write
6CACF000
unkown
page read and write
A1B0000
direct allocation
page read and write
75BF000
direct allocation
page read and write
279C730D000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
9A58000
heap
page read and write
2C01000
heap
page read and write
2499000
heap
page read and write
2498000
heap
page read and write
2C01000
heap
page read and write
2491000
heap
page read and write
24A8000
heap
page read and write
24D2000
heap
page read and write
2B81000
heap
page read and write
2B53000
direct allocation
page read and write
2AE6000
direct allocation
page read and write
9A50000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
E64000
heap
page read and write
2C01000
heap
page read and write
254D000
heap
page read and write
7680000
direct allocation
page read and write
AB3000
unkown
page read and write
2C01000
heap
page read and write
8F19000
direct allocation
page read and write
24AE000
heap
page read and write
F96000
heap
page read and write
E64000
heap
page read and write
279C7367000
heap
page read and write
2B81000
heap
page read and write
2BA5000
heap
page read and write
2C01000
heap
page read and write
2B61000
direct allocation
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
279C7357000
heap
page read and write
7FF779820000
unkown
page readonly
478000
heap
page read and write
2C01000
heap
page read and write
5410000
heap
page read and write
2BA8000
direct allocation
page read and write
2558000
heap
page read and write
2C01000
heap
page read and write
FD9BDF3000
stack
page read and write
2B81000
heap
page read and write
279C7376000
heap
page read and write
2B81000
heap
page read and write
6BBA000
unkown
page read and write
2B81000
heap
page read and write
6D1D1000
unkown
page execute read
2B60000
heap
page read and write
24EE000
heap
page read and write
1083000
heap
page read and write
B08000
unkown
page read and write
478000
heap
page read and write
2B69000
direct allocation
page read and write
2C01000
heap
page read and write
7608000
direct allocation
page read and write
2B81000
heap
page read and write
2ADF000
direct allocation
page read and write
EA4000
heap
page read and write
279C7380000
heap
page read and write
2C01000
heap
page read and write
29DE000
stack
page read and write
2B81000
heap
page read and write
2AED000
direct allocation
page read and write
2AC9000
direct allocation
page read and write
F84000
heap
page read and write
7FF7798DE000
unkown
page read and write
2B81000
heap
page read and write
9D00000
trusted library allocation
page read and write
2B81000
heap
page read and write
76C1000
direct allocation
page read and write
279C734F000
heap
page read and write
24AC000
heap
page read and write
ED0000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
279C7394000
heap
page read and write
2860000
heap
page read and write
44A000
heap
page read and write
2C01000
heap
page read and write
279C737B000
heap
page read and write
2C01000
heap
page read and write
285D000
stack
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
279C7367000
heap
page read and write
2B81000
heap
page read and write
AB6000
unkown
page read and write
7608000
direct allocation
page read and write
2B81000
heap
page read and write
478000
heap
page read and write
7617000
direct allocation
page read and write
2B81000
heap
page read and write
2B12000
direct allocation
page read and write
2C01000
heap
page read and write
7680000
direct allocation
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
E60000
heap
page read and write
478000
heap
page read and write
9556000
direct allocation
page read and write
9A89000
heap
page read and write
764C000
direct allocation
page read and write
7663000
direct allocation
page read and write
D40000
heap
page read and write
2B2F000
direct allocation
page read and write
2AD4000
direct allocation
page read and write
256C000
heap
page read and write
488000
heap
page read and write
E9A0000
heap
page read and write
24C8000
heap
page read and write
7FF7798E0000
unkown
page readonly
92BE000
stack
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
1063000
heap
page read and write
7645000
direct allocation
page read and write
97FA000
trusted library allocation
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
279C734B000
heap
page read and write
2B81000
heap
page read and write
B16000
unkown
page read and write
2B81000
heap
page read and write
5E5A000
unkown
page execute read
2C01000
heap
page read and write
2C01000
heap
page read and write
24DA000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
A0BF000
stack
page read and write
279C7395000
heap
page read and write
937F000
stack
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
AB3000
unkown
page read and write
FD9C7FE000
stack
page read and write
2B81000
heap
page read and write
985E000
stack
page read and write
2BB6000
direct allocation
page read and write
6BA9000
unkown
page read and write
2B99000
direct allocation
page read and write
2B45000
direct allocation
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
255C000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
952F000
direct allocation
page read and write
75AE000
direct allocation
page read and write
9F7A000
trusted library allocation
page read and write
1030000
heap
page read and write
2B81000
heap
page read and write
6CAA0000
unkown
page readonly
2C01000
heap
page read and write
2590000
heap
page read and write
6C0C000
unkown
page read and write
100A000
heap
page read and write
2A54000
direct allocation
page read and write
2B81000
heap
page read and write
478000
heap
page read and write
2C01000
heap
page read and write
279C736D000
heap
page read and write
7580000
heap
page read and write
7696000
direct allocation
page read and write
2B80000
heap
page read and write
401000
unkown
page execute read
2180000
heap
page read and write
279C733F000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
7FF779918000
unkown
page readonly
29F0000
heap
page read and write
F5C000
heap
page read and write
2B81000
heap
page read and write
951E000
direct allocation
page read and write
47A000
heap
page read and write
279C7367000
heap
page read and write
279C732E000
heap
page read and write
94BF000
stack
page read and write
2C01000
heap
page read and write
279C7345000
heap
page read and write
2C01000
heap
page read and write
18D000
stack
page read and write
75DA000
direct allocation
page read and write
8E0000
heap
page read and write
2ADF000
direct allocation
page read and write
2BBD000
direct allocation
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
279C7380000
heap
page read and write
2AC0000
direct allocation
page read and write
400000
unkown
page readonly
2C01000
heap
page read and write
2B81000
heap
page read and write
414000
unkown
page execute read
2C01000
heap
page read and write
108C000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
10AA000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
7601000
direct allocation
page read and write
75E3000
direct allocation
page read and write
478000
heap
page read and write
89E000
unkown
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
10DA000
heap
page read and write
466000
heap
page read and write
2B83000
heap
page read and write
254D000
heap
page read and write
2B81000
heap
page read and write
10F4000
heap
page read and write
7FF779820000
unkown
page readonly
2B49000
direct allocation
page read and write
A1E6000
direct allocation
page read and write
76BA000
direct allocation
page read and write
76E0000
direct allocation
page execute and read and write
2C01000
heap
page read and write
2B8B000
direct allocation
page read and write
2C01000
heap
page read and write
2BC5000
direct allocation
page read and write
9A66000
heap
page read and write
2C01000
heap
page read and write
2DEE000
unkown
page read and write
6D442000
unkown
page write copy
2C01000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
29F3000
heap
page read and write
B0E000
unkown
page read and write
AB6000
unkown
page read and write
7FF7798DE000
unkown
page write copy
43D0000
direct allocation
page execute and read and write
2C01000
heap
page read and write
2564000
heap
page read and write
4FB6000
heap
page read and write
2A20000
heap
page read and write
3240000
heap
page read and write
2A77000
direct allocation
page read and write
75E3000
direct allocation
page read and write
405000
unkown
page readonly
2B81000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
475000
heap
page read and write
478000
heap
page read and write
2C01000
heap
page read and write
490000
heap
page read and write
2554000
heap
page read and write
B29000
unkown
page read and write
2B81000
heap
page read and write
2491000
heap
page read and write
2B36000
direct allocation
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
763E000
direct allocation
page read and write
402000
unkown
page readonly
460000
heap
page read and write
2B75000
direct allocation
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
E5E000
stack
page read and write
2B07000
direct allocation
page read and write
76AC000
direct allocation
page read and write
9ABE000
heap
page read and write
2B92000
heap
page read and write
A1A5000
direct allocation
page read and write
585000
heap
page read and write
2B81000
heap
page read and write
279C7394000
heap
page read and write
2B81000
heap
page read and write
2558000
heap
page read and write
8AEE000
stack
page read and write
F58000
heap
page read and write
279C736D000
heap
page read and write
2C01000
heap
page read and write
2950000
heap
page read and write
2C01000
heap
page read and write
D40000
heap
page read and write
279C7377000
heap
page read and write
2D7F000
unkown
page read and write
477000
heap
page read and write
468000
heap
page read and write
2B1D000
direct allocation
page read and write
75DC000
direct allocation
page read and write
9A68000
heap
page read and write
2B81000
heap
page read and write
25FD000
stack
page read and write
279C736D000
heap
page read and write
2B81000
heap
page read and write
FD9C9FE000
stack
page read and write
2C10000
heap
page read and write
763E000
direct allocation
page read and write
2B81000
heap
page read and write
2A9D000
direct allocation
page read and write
24EC000
heap
page read and write
9169000
direct allocation
page read and write
76BA000
direct allocation
page read and write
2B81000
heap
page read and write
2B04000
direct allocation
page read and write
2A87000
direct allocation
page read and write
954D000
direct allocation
page read and write
954B000
direct allocation
page read and write
2491000
heap
page read and write
2B81000
heap
page read and write
75AE000
direct allocation
page read and write
2C01000
heap
page read and write
6B71000
unkown
page write copy
2E80000
heap
page read and write
8FBE000
stack
page read and write
2C01000
heap
page read and write
400000
unkown
page readonly
8EF6000
direct allocation
page read and write
108C000
heap
page read and write
2C01000
heap
page read and write
9178000
direct allocation
page read and write
5410000
heap
page read and write
2B81000
heap
page read and write
2C01000
heap
page read and write
9621000
direct allocation
page read and write
2550000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
6B4F000
unkown
page write copy
7636000
direct allocation
page read and write
75DA000
direct allocation
page read and write
2B51000
direct allocation
page read and write
75F1000
direct allocation
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
6B41000
unkown
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
FD9C3FD000
stack
page read and write
2C01000
heap
page read and write
24D2000
heap
page read and write
6B40000
unkown
page write copy
24E6000
heap
page read and write
64CF000
unkown
page execute read
7FF779821000
unkown
page execute read
2B81000
heap
page read and write
10E6000
heap
page read and write
2BA1000
heap
page read and write
24BE000
heap
page read and write
2C01000
heap
page read and write
2B19000
direct allocation
page read and write
2B81000
heap
page read and write
2B58000
direct allocation
page read and write
2B81000
heap
page read and write
A161000
direct allocation
page read and write
2C01000
heap
page read and write
2BA1000
direct allocation
page read and write
2C01000
heap
page read and write
6BC5000
unkown
page read and write
2491000
heap
page read and write
2AF7000
direct allocation
page read and write
2C01000
heap
page read and write
2491000
heap
page read and write
2C01000
heap
page read and write
8EFF000
direct allocation
page read and write
7FF779915000
unkown
page readonly
95E000
stack
page read and write
313F000
stack
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
279C7357000
heap
page read and write
2A96000
direct allocation
page read and write
7590000
direct allocation
page read and write
2C01000
heap
page read and write
460000
heap
page read and write
769D000
direct allocation
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
7FF779821000
unkown
page execute read
2B81000
heap
page read and write
2B81000
heap
page read and write
254D000
heap
page read and write
279C7440000
remote allocation
page read and write
464000
heap
page read and write
9A54000
heap
page read and write
279C7395000
heap
page read and write
2C01000
heap
page read and write
2C01000
heap
page read and write
9181000
stack
page read and write
483000
heap
page read and write
FD9BDFF000
stack
page read and write
764C000
direct allocation
page read and write
7672000
direct allocation
page read and write
2DF0000
heap
page read and write
2B81000
heap
page read and write
249C000
heap
page read and write
2C01000
heap
page read and write
2B81000
heap
page read and write
2B81000
heap
page read and write
There are 1080 hidden memdumps, click here to show them.