IOC Report
SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmp9A0C.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\eFzAvsOm.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\eFzAvsOm.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\eFzAvsOm.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2af2zu5v.rvd.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4f4wribb.41j.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5a2o4mph.ei2.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c1mcczme.v4h.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d00n0thz.x2s.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gtrmytf2.11h.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ip453cia.zu4.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lo1mk02m.3gr.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmpADE2.tmp
XML 1.0 document, ASCII text
dropped
There are 6 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
"C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\eFzAvsOm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eFzAvsOm" /XML "C:\Users\user\AppData\Local\Temp\tmp9A0C.tmp"
 malicious
C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe
"C:\Users\user\Desktop\SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe"
 malicious
C:\Users\user\AppData\Roaming\eFzAvsOm.exe
C:\Users\user\AppData\Roaming\eFzAvsOm.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eFzAvsOm" /XML "C:\Users\user\AppData\Local\Temp\tmpADE2.tmp"
 malicious
C:\Users\user\AppData\Roaming\eFzAvsOm.exe
"C:\Users\user\AppData\Roaming\eFzAvsOm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://api.telegram.org
unknown
 malicious
https://api.telegram.org/bot6712831410:AAHcAQdRCEA5D54-vSqmAsfuFOnMq6rPNCg/
unknown
 malicious
https://api.telegram.org/bot6712831410:AAHcAQdRCEA5D54-vSqmAsfuFOnMq6rPNCg/sendDocument
149.154.167.220
 malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://account.dyn.com/
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
There are 21 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
api.telegram.org
149.154.167.220
 malicious

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\eFzAvsOm_RASMANCS
FileDirectory
There are 19 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2B21000
trusted library allocation
page read and write
 malicious
35F2000
trusted library allocation
page read and write
 malicious
417000
remote allocation
page execute and read and write
 malicious
2FF9000
trusted library allocation
page read and write
 malicious
2B89000
trusted library allocation
page read and write
 malicious
3E63000
trusted library allocation
page read and write
 malicious
2B6E000
trusted library allocation
page read and write
 malicious
2FDE000
trusted library allocation
page read and write
 malicious
2F91000
trusted library allocation
page read and write
 malicious
756000
trusted library allocation
page execute and read and write
E44000
heap
page read and write
466C000
stack
page read and write
6FF0000
trusted library allocation
page read and write
2EDE000
stack
page read and write
2BF0000
trusted library allocation
page execute and read and write
53F1000
trusted library allocation
page read and write
6410000
trusted library allocation
page execute and read and write
FA3000
trusted library allocation
page read and write
52A2000
trusted library allocation
page read and write
EC1000
heap
page read and write
318A000
heap
page read and write
6F10000
trusted library allocation
page read and write
4EC0000
heap
page read and write
24ED000
trusted library allocation
page read and write
6CCE000
stack
page read and write
49F0000
trusted library allocation
page read and write
2C7E000
trusted library allocation
page read and write
2BA6000
trusted library allocation
page read and write
5B06000
trusted library allocation
page read and write
AAEE000
stack
page read and write
50D0000
trusted library allocation
page read and write
2BAA000
trusted library allocation
page read and write
2C8D000
trusted library allocation
page read and write
1059000
heap
page read and write
120D000
trusted library allocation
page read and write
2ACD000
stack
page read and write
130E000
stack
page read and write
3430000
heap
page read and write
743000
trusted library allocation
page read and write
A92E000
stack
page read and write
4A20000
trusted library allocation
page read and write
AF4E000
stack
page read and write
2500000
trusted library allocation
page read and write
4E3D000
stack
page read and write
3571000
trusted library allocation
page read and write
1327000
trusted library allocation
page execute and read and write
306F000
unkown
page read and write
10F9000
heap
page read and write
2CD0000
trusted library allocation
page read and write
73D000
trusted library allocation
page execute and read and write
53F6000
trusted library allocation
page read and write
96E000
stack
page read and write
6770000
trusted library allocation
page read and write
7199000
heap
page read and write
2CA2000
trusted library allocation
page read and write
3579000
trusted library allocation
page read and write
6E0E000
stack
page read and write
DBD000
trusted library allocation
page execute and read and write
73DF000
heap
page read and write
58FE000
stack
page read and write
2CC5000
trusted library allocation
page read and write
F20000
heap
page read and write
11CE000
stack
page read and write
1322000
trusted library allocation
page read and write
4B90000
heap
page read and write
3080000
heap
page read and write
3E00000
trusted library allocation
page read and write
F80000
trusted library allocation
page read and write
B32E000
stack
page read and write
740000
trusted library allocation
page read and write
11EE000
trusted library allocation
page read and write
EC9000
heap
page read and write
6CCE000
stack
page read and write
1066000
heap
page read and write
E86000
heap
page read and write
7020000
trusted library allocation
page read and write
790000
heap
page read and write
11FE000
trusted library allocation
page read and write
7390000
heap
page read and write
3016000
trusted library allocation
page read and write
554C000
stack
page read and write
6790000
trusted library allocation
page read and write
2BE3000
heap
page read and write
53D6000
trusted library allocation
page read and write
80B000
heap
page read and write
6F60000
heap
page read and write
2E85000
trusted library allocation
page read and write
2FE2000
trusted library allocation
page read and write
880D000
stack
page read and write
2FE6000
trusted library allocation
page read and write
4ED0000
heap
page read and write
2F30000
heap
page read and write
E7A000
heap
page read and write
2DE1000
trusted library allocation
page read and write
5220000
trusted library allocation
page read and write
CC3000
trusted library allocation
page execute and read and write
6F17000
trusted library allocation
page read and write
1664000
trusted library allocation
page read and write
2F33000
heap
page read and write
C0000
unkown
page readonly
24E6000
trusted library allocation
page read and write
403000
remote allocation
page execute and read and write
2428000
trusted library allocation
page read and write
2DD0000
heap
page read and write
11D0000
heap
page execute and read and write
1310000
trusted library allocation
page read and write
60E000
stack
page read and write
11EB000
trusted library allocation
page read and write
53D0000
trusted library allocation
page read and write
F70000
heap
page read and write
1680000
heap
page read and write
5FED000
stack
page read and write
1663000
trusted library allocation
page execute and read and write
1108000
trusted library allocation
page read and write
7B8000
heap
page read and write
5F4D000
stack
page read and write
4FD0000
heap
page read and write
2571000
trusted library allocation
page read and write
2B0A000
stack
page read and write
6800000
heap
page read and write
6F0F000
stack
page read and write
30FB000
heap
page read and write
6910000
heap
page read and write
71D0000
trusted library allocation
page read and write
6EBE000
stack
page read and write
3F8D000
trusted library allocation
page read and write
4D10000
heap
page read and write
B0AF000
stack
page read and write
302E000
unkown
page read and write
5060000
heap
page read and write
A17000
heap
page read and write
5480000
trusted library allocation
page read and write
CC4000
trusted library allocation
page read and write
3E20000
trusted library allocation
page read and write
4D21000
trusted library allocation
page read and write
69D0000
heap
page read and write
11A0000
trusted library allocation
page read and write
73C2000
heap
page read and write
70F4000
heap
page read and write
67CE000
stack
page read and write
CB0000
trusted library allocation
page read and write
AD2F000
stack
page read and write
4087000
trusted library allocation
page read and write
742F000
heap
page read and write
52AA000
trusted library allocation
page read and write
5250000
trusted library allocation
page read and write
2C81000
trusted library allocation
page read and write
E58000
heap
page read and write
EDA000
heap
page read and write
723E000
stack
page read and write
6C30000
trusted library allocation
page read and write
3DE9000
trusted library allocation
page read and write
AFAE000
stack
page read and write
2F50000
trusted library allocation
page read and write
54F4000
trusted library section
page readonly
6934000
heap
page read and write
6FE0000
trusted library allocation
page read and write
4B50000
heap
page read and write
3FFB000
trusted library allocation
page read and write
69B2000
heap
page read and write
734E000
stack
page read and write
2F0E000
stack
page read and write
734000
trusted library allocation
page read and write
1250000
heap
page execute and read and write
2F60000
trusted library allocation
page read and write
FA0000
trusted library allocation
page read and write
3180000
heap
page read and write
DC0000
trusted library allocation
page read and write
720000
trusted library allocation
page read and write
2C60000
trusted library allocation
page read and write
167D000
trusted library allocation
page execute and read and write
767000
trusted library allocation
page execute and read and write
1206000
trusted library allocation
page read and write
F79000
stack
page read and write
1212000
trusted library allocation
page read and write
53EE000
trusted library allocation
page read and write
5450000
trusted library allocation
page read and write
56CE000
stack
page read and write
2DDE000
stack
page read and write
5130000
trusted library section
page read and write
752000
trusted library allocation
page read and write
DC2000
trusted library allocation
page read and write
DD5000
trusted library allocation
page execute and read and write
652E000
stack
page read and write
1316000
trusted library allocation
page execute and read and write
53FD000
trusted library allocation
page read and write
5228000
trusted library allocation
page read and write
76B000
trusted library allocation
page execute and read and write
B88E000
stack
page read and write
AC2E000
stack
page read and write
11B6000
trusted library allocation
page read and write
7F010000
trusted library allocation
page execute and read and write
DF0000
trusted library allocation
page read and write
7122000
heap
page read and write
7B2000
heap
page read and write
11FA000
trusted library allocation
page read and write
6DCE000
stack
page read and write
73F0000
heap
page read and write
24E1000
trusted library allocation
page read and write
25B0000
trusted library allocation
page read and write
E10000
heap
page read and write
5F00000
trusted library allocation
page execute and read and write
1670000
trusted library allocation
page read and write
5EF6000
trusted library allocation
page read and write
62FF000
heap
page read and write
6780000
trusted library allocation
page read and write
10A0000
heap
page read and write
2B6C000
trusted library allocation
page read and write
2D28000
trusted library allocation
page read and write
51DE000
stack
page read and write
523C000
trusted library allocation
page read and write
6C40000
trusted library allocation
page read and write
6FD5000
trusted library allocation
page read and write
2CA0000
trusted library allocation
page read and write
2F1C000
stack
page read and write
2F40000
trusted library allocation
page read and write
730000
trusted library allocation
page read and write
7010000
trusted library allocation
page execute and read and write
602E000
stack
page read and write
1270000
heap
page read and write
7160000
heap
page read and write
4D30000
heap
page execute and read and write
719B000
heap
page read and write
5EF0000
trusted library allocation
page read and write
4B40000
heap
page read and write
4F24000
heap
page read and write
61DF000
stack
page read and write
6D80000
heap
page read and write
1686000
heap
page read and write
1397000
heap
page read and write
138E000
stack
page read and write
593E000
stack
page read and write
5B00000
trusted library allocation
page read and write
5402000
trusted library allocation
page read and write
3090000
heap
page read and write
301A000
trusted library allocation
page read and write
4EE0000
heap
page read and write
64EE000
stack
page read and write
548C000
stack
page read and write
4C1E000
stack
page read and write
B04E000
stack
page read and write
E7A000
stack
page read and write
6030000
trusted library allocation
page execute and read and write
1090000
trusted library allocation
page read and write
6FD0000
trusted library allocation
page read and write
637C000
heap
page read and write
6424000
trusted library allocation
page read and write
53EA000
trusted library allocation
page read and write
2F54000
trusted library allocation
page read and write
704C000
trusted library allocation
page read and write
6C50000
trusted library allocation
page execute and read and write
519C000
stack
page read and write
402000
remote allocation
page execute and read and write
537000
stack
page read and write
2667000
trusted library allocation
page read and write
1175000
heap
page read and write
508D000
stack
page read and write
71E0000
trusted library allocation
page read and write
3F91000
trusted library allocation
page read and write
3DE1000
trusted library allocation
page read and write
5220000
trusted library allocation
page read and write
71CE000
stack
page read and write
2617000
trusted library allocation
page read and write
E84000
heap
page read and write
762000
trusted library allocation
page read and write
6FE1000
trusted library allocation
page read and write
4F0E000
heap
page read and write
B84C000
stack
page read and write
5510000
heap
page read and write
1312000
trusted library allocation
page read and write
FB0000
heap
page read and write
23CE000
stack
page read and write
6420000
trusted library allocation
page read and write
414000
remote allocation
page execute and read and write
B62D000
stack
page read and write
822000
heap
page read and write
5B26000
trusted library allocation
page read and write
62EF000
stack
page read and write
5243000
heap
page read and write
6C8E000
stack
page read and write
310F000
stack
page read and write
B98F000
stack
page read and write
F94000
trusted library allocation
page read and write
5630000
heap
page read and write
49D0000
trusted library allocation
page execute and read and write
B251000
heap
page read and write
4B70000
trusted library allocation
page read and write
2CB0000
trusted library allocation
page read and write
2B48000
trusted library allocation
page read and write
1390000
heap
page read and write
4EC5000
heap
page read and write
2B86000
trusted library allocation
page read and write
67C0000
heap
page read and write
70F0000
heap
page read and write
7000000
trusted library allocation
page execute and read and write
B4EC000
stack
page read and write
666E000
stack
page read and write
ECC000
heap
page read and write
415000
remote allocation
page execute and read and write
57BC000
stack
page read and write
EB2000
heap
page read and write
5230000
trusted library allocation
page read and write
5240000
heap
page read and write
7040000
trusted library allocation
page read and write
837000
heap
page read and write
C70000
heap
page read and write
2CB7000
trusted library allocation
page execute and read and write
E1A000
heap
page read and write
10CE000
stack
page read and write
43E000
remote allocation
page execute and read and write
3009000
trusted library allocation
page read and write
2B70000
heap
page read and write
2CAA000
trusted library allocation
page execute and read and write
2B72000
trusted library allocation
page read and write
1170000
heap
page read and write
B0ED000
stack
page read and write
B72E000
stack
page read and write
CD0000
heap
page read and write
5CE000
stack
page read and write
53E2000
trusted library allocation
page read and write
2CA6000
trusted library allocation
page read and write
B9CE000
stack
page read and write
1201000
trusted library allocation
page read and write
750000
trusted library allocation
page read and write
7140000
heap
page read and write
23F0000
trusted library allocation
page read and write
7F550000
trusted library allocation
page execute and read and write
23D0000
trusted library allocation
page execute and read and write
62E0000
trusted library allocation
page execute and read and write
E40000
trusted library allocation
page execute and read and write
640D000
stack
page read and write
2C6B000
trusted library allocation
page read and write
F9D000
trusted library allocation
page execute and read and write
2665000
trusted library allocation
page read and write
798000
heap
page read and write
521D000
stack
page read and write
2E79000
trusted library allocation
page read and write
49EA000
trusted library allocation
page read and write
2F80000
heap
page execute and read and write
B22E000
stack
page read and write
75A000
trusted library allocation
page execute and read and write
8440000
trusted library section
page read and write
DCA000
trusted library allocation
page execute and read and write
CC0000
trusted library allocation
page read and write
54EC000
stack
page read and write
5500000
heap
page read and write
7B5000
heap
page read and write
6700000
trusted library allocation
page read and write
69B0000
trusted library allocation
page execute and read and write
24C0000
trusted library allocation
page read and write
57FE000
stack
page read and write
4EDC000
stack
page read and write
2CBB000
trusted library allocation
page execute and read and write
404000
remote allocation
page execute and read and write
2F50000
heap
page read and write
2E6D000
stack
page read and write
570000
heap
page read and write
6C00000
trusted library allocation
page execute and read and write
53DE000
trusted library allocation
page read and write
770000
heap
page read and write
400A000
trusted library allocation
page read and write
ABEE000
stack
page read and write
733000
trusted library allocation
page execute and read and write
E6E000
heap
page read and write
120D000
stack
page read and write
1660000
trusted library allocation
page read and write
1030000
heap
page read and write
5635000
heap
page read and write
5B20000
trusted library allocation
page read and write
11C0000
trusted library allocation
page read and write
7030000
trusted library allocation
page read and write
2CB2000
trusted library allocation
page read and write
5570000
heap
page execute and read and write
7050000
trusted library allocation
page execute and read and write
49E0000
trusted library allocation
page read and write
2F4E000
stack
page read and write
24DE000
trusted library allocation
page read and write
6722000
trusted library allocation
page read and write
131A000
trusted library allocation
page execute and read and write
3B49000
trusted library allocation
page read and write
2CA4000
trusted library allocation
page read and write
6338000
heap
page read and write
6777000
trusted library allocation
page read and write
B14E000
stack
page read and write
2C00000
heap
page read and write
A10000
heap
page read and write
416000
remote allocation
page execute and read and write
11F2000
trusted library allocation
page read and write
53DB000
trusted library allocation
page read and write
E3E000
stack
page read and write
FE0000
heap
page read and write
2BBE000
unkown
page read and write
2CA6000
trusted library allocation
page execute and read and write
57C0000
trusted library allocation
page execute and read and write
54F0000
trusted library section
page readonly
2CC0000
trusted library allocation
page read and write
5A7E000
stack
page read and write
2D1E000
stack
page read and write
3B8C000
trusted library allocation
page read and write
71D5000
trusted library allocation
page read and write
4B60000
trusted library allocation
page execute and read and write
5B10000
heap
page read and write
4B30000
trusted library section
page readonly
ABA000
stack
page read and write
5490000
trusted library allocation
page execute and read and write
6F30000
trusted library allocation
page read and write
FAD000
trusted library allocation
page execute and read and write
7194000
heap
page read and write
4EB0000
trusted library allocation
page read and write
2CB0000
trusted library allocation
page read and write
512E000
stack
page read and write
C2000
unkown
page readonly
1127000
heap
page read and write
B24D000
stack
page read and write
676E000
stack
page read and write
980000
trusted library allocation
page read and write
6FF0000
trusted library allocation
page execute and read and write
E56000
heap
page read and write
5640000
heap
page read and write
AE6D000
stack
page read and write
2BE0000
heap
page read and write
AD6D000
stack
page read and write
A8EE000
stack
page read and write
2CB5000
trusted library allocation
page execute and read and write
1630000
heap
page read and write
1038000
heap
page read and write
2410000
heap
page read and write
4104000
trusted library allocation
page read and write
DC6000
trusted library allocation
page execute and read and write
5650000
heap
page read and write
400000
remote allocation
page execute and read and write
6F20000
trusted library allocation
page read and write
70CE000
stack
page read and write
CCD000
trusted library allocation
page execute and read and write
2FF6000
trusted library allocation
page read and write
7350000
heap
page read and write
558E000
stack
page read and write
6FBE000
stack
page read and write
2C86000
trusted library allocation
page read and write
DB0000
trusted library allocation
page read and write
6C20000
trusted library allocation
page read and write
1063000
heap
page read and write
5AD0000
trusted library allocation
page read and write
2CD0000
heap
page execute and read and write
BB7000
stack
page read and write
2C50000
trusted library allocation
page read and write
1320000
trusted library allocation
page read and write
C20000
heap
page read and write
5A3E000
stack
page read and write
2DC0000
trusted library allocation
page execute and read and write
5410000
heap
page read and write
742C000
heap
page read and write
E50000
heap
page read and write
B2F000
stack
page read and write
87CE000
stack
page read and write
620000
heap
page read and write
70FC000
heap
page read and write
6D8E000
heap
page read and write
2EAA000
stack
page read and write
6980000
heap
page read and write
2505000
trusted library allocation
page read and write
1340000
trusted library allocation
page read and write
BACE000
stack
page read and write
166D000
trusted library allocation
page execute and read and write
30CE000
stack
page read and write
70E4000
heap
page read and write
6040000
trusted library allocation
page read and write
52B0000
heap
page execute and read and write
DD2000
trusted library allocation
page read and write
568E000
stack
page read and write
1276000
heap
page read and write
2400000
trusted library allocation
page read and write
6965000
heap
page read and write
A0C000
stack
page read and write
1290000
heap
page read and write
73F8000
heap
page read and write
4A30000
trusted library allocation
page execute and read and write
7380000
heap
page read and write
F30000
heap
page read and write
5290000
trusted library allocation
page execute and read and write
3B21000
trusted library allocation
page read and write
B74C000
stack
page read and write
74D000
trusted library allocation
page execute and read and write
662E000
stack
page read and write
77E000
heap
page read and write
7044000
trusted library allocation
page read and write
5B0C000
trusted library allocation
page read and write
5B02000
trusted library allocation
page read and write
E58000
heap
page read and write
739C000
heap
page read and write
580000
heap
page read and write
23E0000
trusted library allocation
page read and write
61EE000
stack
page read and write
2B1E000
stack
page read and write
4A10000
trusted library allocation
page read and write
AE70000
heap
page read and write
2ED3000
trusted library allocation
page read and write
714B000
heap
page read and write
2C4B000
stack
page read and write
B5CE000
stack
page read and write
132B000
trusted library allocation
page execute and read and write
7A5000
heap
page read and write
5AD8000
trusted library allocation
page read and write
10F0000
heap
page read and write
8B9000
stack
page read and write
B5EC000
stack
page read and write
73A0000
heap
page read and write
B330000
heap
page read and write
5280000
heap
page read and write
6C10000
trusted library allocation
page execute and read and write
11E0000
trusted library allocation
page read and write
B38D000
stack
page read and write
57CE000
stack
page read and write
7140000
trusted library allocation
page execute and read and write
2CA0000
trusted library allocation
page read and write
2BFF000
unkown
page read and write
1650000
trusted library allocation
page read and write
2E25000
trusted library allocation
page read and write
2F70000
heap
page read and write
E1E000
heap
page read and write
5620000
heap
page read and write
2510000
trusted library allocation
page read and write
11B0000
trusted library allocation
page read and write
B4CE000
stack
page read and write
73E8000
heap
page read and write
4B93000
heap
page read and write
52AF000
trusted library allocation
page read and write
EEC000
heap
page read and write
6BFE000
stack
page read and write
5470000
trusted library allocation
page read and write
11B4000
trusted library allocation
page read and write
7143000
heap
page read and write
3070000
heap
page read and write
71F0000
trusted library allocation
page execute and read and write
2F20000
trusted library allocation
page read and write
DD7000
trusted library allocation
page execute and read and write
52A0000
trusted library allocation
page read and write
6DCE000
stack
page read and write
2F10000
heap
page read and write
10C8000
heap
page read and write
2B76000
trusted library allocation
page read and write
2E20000
trusted library allocation
page read and write
4F20000
heap
page read and write
62F0000
heap
page read and write
35B0000
trusted library allocation
page read and write
7F510000
trusted library allocation
page execute and read and write
F93000
trusted library allocation
page execute and read and write
B48E000
stack
page read and write
2B99000
trusted library allocation
page read and write
7B0000
heap
page read and write
2560000
heap
page execute and read and write
561D000
stack
page read and write
B1EE000
stack
page read and write
6A4E000
stack
page read and write
2FDC000
trusted library allocation
page read and write
108C000
stack
page read and write
2540000
trusted library allocation
page read and write
690F000
stack
page read and write
57F0000
heap
page read and write
6B4E000
stack
page read and write
DDB000
trusted library allocation
page execute and read and write
A20000
heap
page read and write
8750000
trusted library allocation
page read and write
F90000
trusted library allocation
page read and write
49E2000
trusted library allocation
page read and write
7170000
heap
page read and write
1250000
heap
page read and write
4B2B000
stack
page read and write
49C0000
heap
page read and write
439000
stack
page read and write
24CB000
trusted library allocation
page read and write
6B8E000
stack
page read and write
680E000
stack
page read and write
3FB9000
trusted library allocation
page read and write
7155000
heap
page read and write
9B9000
stack
page read and write
30F0000
heap
page read and write
9CE000
stack
page read and write
7F8C0000
trusted library allocation
page execute and read and write
There are 569 hidden memdumps, click here to show them.