IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\Users\Public\Details.au3
Unicode text, UTF-8 (with BOM) text, with very long lines (1266)
dropped
 malicious
C:\Users\Public\InformationCheck.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\Public\ProfileDetails.ps1
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js
ASCII text, with no line terminators
dropped
 malicious
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url
MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >), ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bv201eo.3bw.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eamjnkh2.zwk.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\WordGenius Technologies\G
ASCII text, with very long lines (1266)
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"
 malicious
C:\Users\Public\InformationCheck.exe
"C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3
malicious
C:\Windows\SysWOW64\cmd.exe
cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
malicious
C:\Windows\System32\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
malicious
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://www.autoitscript.com/autoit3/J
unknown
http://nuget.org/NuGet.exe
unknown
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://pesterbdd.com/images/Pester.png
unknown
https://go.microsoft.co-
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
https://go.micro
unknown
https://my.cloH
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://contoso.com/License
unknown
https://contoso.com/Icon
unknown
https://oneget.orgX
unknown
https://aka.ms/pscore68
unknown
https://my.cloudme.com
unknown
https://my.cloudme.com/v1/ws2/:updatemake/:reality/reality.txt
83.140.241.4
https://www.autoitscript.com/autoit3/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://github.com/Pester/Pester
unknown
http://my.cloudme.com
unknown
https://oneget.org
unknown
There are 11 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
my.cloudme.com
83.140.241.4
nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs
unknown

IPs

IP
Domain
Country
Malicious
83.140.241.4
my.cloudme.com
Sweden

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
JScriptSetScriptStateStarted
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
51E6000
heap
page read and write
4516000
heap
page read and write
5E11000
heap
page read and write
2FE2000
heap
page read and write
529000
unkown
page readonly
2B50FBB0000
heap
page read and write
5E11000
heap
page read and write
4A7C000
heap
page read and write
2B511F60000
heap
page read and write
2B511ECE000
heap
page read and write
5E10000
heap
page read and write
2B50FE58000
heap
page read and write
FE9000
unkown
page readonly
2B511FB1000
heap
page read and write
603F000
stack
page read and write
7FF797908000
unkown
page readonly
448DBCD000
stack
page read and write
36C2000
heap
page read and write
1270000
heap
page read and write
630F000
stack
page read and write
3F06000
heap
page read and write
2B50FE69000
heap
page read and write
F04000
heap
page read and write
2B50FE67000
heap
page read and write
F00000
heap
page read and write
1C71C644000
trusted library allocation
page read and write
1C71A8DC000
heap
page read and write
5E11000
heap
page read and write
3E56000
heap
page read and write
7FFD9B950000
trusted library allocation
page read and write
F04000
heap
page read and write
399E000
heap
page read and write
3480000
heap
page read and write
1C71DEDB000
trusted library allocation
page read and write
1C72D840000
trusted library allocation
page read and write
3A55000
heap
page read and write
48E2000
heap
page read and write
4C92000
heap
page read and write
FD0000
heap
page read and write
4F3E000
heap
page read and write
7FFD9B8F0000
trusted library allocation
page read and write
2B51211F000
heap
page read and write
1C71A8AD000
heap
page read and write
2B511CF2000
heap
page read and write
1C71DC7E000
trusted library allocation
page read and write
3A80000
heap
page read and write
EA4000
heap
page read and write
4ED2000
heap
page read and write
3470000
heap
page read and write
3546000
heap
page read and write
5E11000
heap
page read and write
2B50FDAE000
heap
page read and write
2B511F14000
heap
page read and write
F04000
heap
page read and write
1C71C150000
trusted library allocation
page read and write
1C71A88F000
heap
page read and write
7FFD9BA80000
trusted library allocation
page read and write
1C71DED7000
trusted library allocation
page read and write
2B50FCD6000
heap
page read and write
448CD78000
stack
page read and write
2B50FD37000
heap
page read and write
1A58000
heap
page read and write
F94000
heap
page read and write
122C7E80000
heap
page read and write
2B5120FA000
heap
page read and write
467E000
heap
page read and write
2B50FD25000
heap
page read and write
7FF797924000
unkown
page readonly
2B50FCF5000
heap
page read and write
4280000
heap
page read and write
1690000
trusted library allocation
page read and write
5E11000
heap
page read and write
F20000
unkown
page readonly
2B512066000
heap
page read and write
2B51226B000
heap
page read and write
1713000
heap
page read and write
1C71A840000
trusted library allocation
page read and write
2B50FBC0000
heap
page read and write
5E11000
heap
page read and write
368A000
heap
page read and write
2B5120FA000
heap
page read and write
122C7D97000
heap
page read and write
448D07E000
stack
page read and write
1C71C316000
trusted library allocation
page read and write
2B3E000
unkown
page read and write
1690000
trusted library allocation
page read and write
5700000
heap
page read and write
1C71C291000
trusted library allocation
page read and write
F04000
heap
page read and write
7FFD9B901000
trusted library allocation
page read and write
3588000
heap
page read and write
21F1EFF000
stack
page read and write
F21000
unkown
page execute read
5E11000
heap
page read and write
1C7349C0000
heap
page read and write
F20000
heap
page read and write
F05000
heap
page read and write
2B50FF60000
heap
page read and write
4382000
heap
page read and write
177D000
heap
page read and write
2B5118D0000
heap
page read and write
3446000
heap
page read and write
4C40000
heap
page read and write
1C734747000
heap
page execute and read and write
F04000
heap
page read and write
2B511EF0000
heap
page read and write
1C71A820000
heap
page read and write
EA4000
heap
page read and write
2B50FD8B000
heap
page read and write
4FA2000
heap
page read and write
DCF000
stack
page read and write
438C000
heap
page read and write
5E11000
heap
page read and write
122C7C70000
heap
page read and write
122C96F0000
heap
page read and write
4A72000
heap
page read and write
275D000
stack
page read and write
7FFD9BAA0000
trusted library allocation
page read and write
DFC000
stack
page read and write
51D5000
heap
page read and write
50EE000
heap
page read and write
1C734A92000
heap
page read and write
3746000
heap
page read and write
2B50FE6D000
heap
page read and write
4CD4000
heap
page read and write
2B50FB78000
heap
page read and write
F04000
heap
page read and write
3AC0000
heap
page read and write
1690000
trusted library allocation
page read and write
2B50FDB5000
heap
page read and write
2B511CB0000
heap
page read and write
2B511DB1000
heap
page read and write
2B50FCFF000
heap
page read and write
4942000
heap
page read and write
1C72C58D000
trusted library allocation
page read and write
1C71A920000
heap
page read and write
4624000
heap
page read and write
7FFD9BA40000
trusted library allocation
page read and write
529000
unkown
page readonly
2B511DA2000
heap
page read and write
F40000
trusted library allocation
page read and write
37CA000
heap
page read and write
2B51210C000
heap
page read and write
2B5120E8000
heap
page read and write
487C000
heap
page read and write
2B50FF60000
heap
page read and write
1C71C646000
trusted library allocation
page read and write
2B50FB9E000
heap
page read and write
5082000
heap
page read and write
2B50FC75000
heap
page read and write
2B50FCD0000
heap
page read and write
2B51205D000
heap
page read and write
4077000
heap
page read and write
461000
unkown
page execute read
448CB7C000
stack
page read and write
F40000
trusted library allocation
page read and write
2B511E26000
heap
page read and write
4A79000
heap
page read and write
4262000
heap
page read and write
2B50FDB5000
heap
page read and write
122C7E11000
heap
page read and write
4BE6000
heap
page read and write
43D8000
heap
page read and write
7FFD9B910000
trusted library allocation
page execute and read and write
34C2000
heap
page read and write
2B511ECE000
heap
page read and write
5E11000
heap
page read and write
2B511D46000
heap
page read and write
2B511F95000
heap
page read and write
F04000
heap
page read and write
7FFD9B870000
trusted library allocation
page execute and read and write
40A5000
heap
page read and write
1C734740000
heap
page execute and read and write
2B50FF0E000
heap
page read and write
2B511E7A000
heap
page read and write
380C000
heap
page read and write
430C000
heap
page read and write
1C71D8B2000
trusted library allocation
page read and write
2B50FDB5000
heap
page read and write
2B50FE9D000
heap
page read and write
1C734A55000
heap
page read and write
2B511DA0000
heap
page read and write
FE4000
unkown
page write copy
1ADC000
heap
page read and write
448DC8E000
stack
page read and write
5802000
heap
page read and write
2B5129D3000
heap
page read and write
F04000
heap
page read and write
51F4000
heap
page read and write
5C2D000
heap
page read and write
7FF797831000
unkown
page execute read
5E11000
heap
page read and write
2B511FF2000
heap
page read and write
F05000
heap
page read and write
F04000
heap
page read and write
634E000
stack
page read and write
4916000
heap
page read and write
7FFD9BA50000
trusted library allocation
page read and write
1059000
heap
page read and write
F04000
heap
page read and write
2F8F000
stack
page read and write
21F22FF000
stack
page read and write
375A000
heap
page read and write
7FFD9BA20000
trusted library allocation
page read and write
2B50FE67000
heap
page read and write
4AE0000
heap
page read and write
1C71D8AE000
trusted library allocation
page read and write
1C71A92C000
heap
page read and write
4B36000
heap
page read and write
47C2000
heap
page read and write
F04000
heap
page read and write
F04000
heap
page read and write
2B51205F000
heap
page read and write
2B511D35000
heap
page read and write
2B512094000
heap
page read and write
460000
unkown
page readonly
471C000
heap
page read and write
4782000
heap
page read and write
3504000
heap
page read and write
5979000
heap
page read and write
5809000
heap
page read and write
3A4B000
heap
page read and write
448CE79000
stack
page read and write
41B2000
heap
page read and write
42EA000
heap
page read and write
7FFD9BA70000
trusted library allocation
page read and write
1C73480D000
heap
page read and write
1C72C2A0000
trusted library allocation
page read and write
5E11000
heap
page read and write
2B51205F000
heap
page read and write
5129000
heap
page read and write
2B50FCD5000
heap
page read and write
1690000
trusted library allocation
page read and write
1C72C95E000
trusted library allocation
page read and write
2B50FD37000
heap
page read and write
40B5000
heap
page read and write
7FFD9B990000
trusted library allocation
page read and write
7FFD9B75D000
trusted library allocation
page execute and read and write
448C73E000
stack
page read and write
5143000
heap
page read and write
4A05000
heap
page read and write
58EA000
heap
page read and write
4135000
heap
page read and write
16E0000
heap
page read and write
DDD000
stack
page read and write
EA4000
heap
page read and write
F04000
heap
page read and write
2B511F03000
heap
page read and write
4954000
heap
page read and write
7FFD9B932000
trusted library allocation
page read and write
1A9A000
heap
page read and write
27D0000
heap
page read and write
4934000
heap
page read and write
2B511FAE000
heap
page read and write
2B50FC75000
heap
page read and write
EA0000
heap
page read and write
F05000
heap
page read and write
6325000
heap
page read and write
2B51218C000
heap
page read and write
2B511F82000
heap
page read and write
4B92000
heap
page read and write
F04000
heap
page read and write
F04000
heap
page read and write
19CA000
heap
page read and write
452A000
heap
page read and write
EA4000
heap
page read and write
2B511FAE000
heap
page read and write
2B50FD48000
heap
page read and write
49DC000
heap
page read and write
516000
unkown
page readonly
448DD8F000
stack
page read and write
2C9A000
heap
page read and write
2B50FDE4000
heap
page read and write
4274000
heap
page read and write
4830000
heap
page read and write
2C90000
heap
page read and write
C1E2DFE000
stack
page read and write
F04000
heap
page read and write
3680000
heap
page read and write
2B50FF0E000
heap
page read and write
4220000
heap
page read and write
457E000
heap
page read and write
1C71A790000
heap
page read and write
F04000
heap
page read and write
2B511E15000
heap
page read and write
4990000
heap
page read and write
43D6000
heap
page read and write
C1E2DEF000
stack
page read and write
2B511FAE000
heap
page read and write
448C6B3000
stack
page read and write
3C56000
heap
page read and write
499A000
heap
page read and write
2B512160000
heap
page read and write
7FFD9BA30000
trusted library allocation
page read and write
460000
unkown
page readonly
1690000
trusted library allocation
page read and write
5E11000
heap
page read and write
44D6000
heap
page read and write
2B511E7B000
heap
page read and write
446A000
heap
page read and write
1C71C63E000
trusted library allocation
page read and write
2B511DA0000
heap
page read and write
2B511DF2000
heap
page read and write
7FFD9B80C000
trusted library allocation
page execute and read and write
5E11000
heap
page read and write
F04000
heap
page read and write
4A47000
heap
page read and write
7FF7978E5000
unkown
page readonly
2B5120FA000
heap
page read and write
1690000
trusted library allocation
page read and write
F40000
trusted library allocation
page read and write
2B50FBA9000
heap
page read and write
4780000
heap
page read and write
2B50FDF3000
heap
page read and write
37CD000
heap
page read and write
1C73479C000
heap
page read and write
15BF000
stack
page read and write
7FFD9B760000
trusted library allocation
page read and write
C1E2DCF000
stack
page read and write
41FA000
heap
page read and write
F40000
trusted library allocation
page read and write
2B511E8C000
heap
page read and write
7FF797908000
unkown
page readonly
7FFD9BA10000
trusted library allocation
page read and write
1C71DB34000
trusted library allocation
page read and write
2B50FD24000
heap
page read and write
1C71A88D000
heap
page read and write
7FFD9BAB0000
trusted library allocation
page read and write
4ABB000
heap
page read and write
2FE0000
heap
page read and write
F04000
heap
page read and write
2B512063000
heap
page read and write
7FFD9BA60000
trusted library allocation
page read and write
2B511E8D000
heap
page read and write
2B50FE67000
heap
page read and write
1690000
trusted library allocation
page read and write
4A8E000
heap
page read and write
2B512160000
heap
page read and write
7FFD9B960000
trusted library allocation
page read and write
5BFF000
stack
page read and write
2B51211E000
heap
page read and write
EA4000
heap
page read and write
448DC0E000
stack
page read and write
35CA000
heap
page read and write
2B50FE36000
heap
page read and write
2B50FBAF000
heap
page read and write
DBF000
stack
page read and write
2B50FCF4000
heap
page read and write
2B50FDF3000
heap
page read and write
4528000
heap
page read and write
58B6000
heap
page read and write
15FC000
stack
page read and write
4D98000
heap
page read and write
1C734A2C000
heap
page read and write
4B80000
heap
page read and write
2B5120FA000
heap
page read and write
5E11000
heap
page read and write
2B50FF64000
heap
page read and write
467A000
heap
page read and write
C1E35FE000
stack
page read and write
3A8A000
heap
page read and write
5701000
heap
page read and write
428A000
heap
page read and write
F40000
trusted library allocation
page read and write
FB0000
unkown
page readonly
2B50FDA1000
heap
page read and write
2B512095000
heap
page read and write
44D4000
heap
page read and write
48C8000
heap
page read and write
1C71A893000
heap
page read and write
2B50FEAF000
heap
page read and write
2B50FD24000
heap
page read and write
C1E2DD8000
stack
page read and write
3BA4000
heap
page read and write
5E11000
heap
page read and write
43AE000
heap
page read and write
2B50FCF4000
heap
page read and write
1C72F640000
trusted library allocation
page read and write
2B511D96000
heap
page read and write
4D2E000
heap
page read and write
FD6000
unkown
page readonly
2B511E68000
heap
page read and write
1C71C631000
trusted library allocation
page read and write
7FFD9B9C0000
trusted library allocation
page read and write
F40000
trusted library allocation
page read and write
2B512078000
heap
page read and write
2B50FDB5000
heap
page read and write
2B512078000
heap
page read and write
2B50FD75000
heap
page read and write
3C78000
heap
page read and write
1630000
heap
page read and write
2B512061000
heap
page read and write
4A30000
heap
page read and write
7FF797830000
unkown
page readonly
429E000
heap
page read and write
5C3E000
stack
page read and write
487A000
heap
page read and write
2B511F02000
heap
page read and write
15DD000
stack
page read and write
3E98000
heap
page read and write
448DB4E000
stack
page read and write
1C72C291000
trusted library allocation
page read and write
1C72E240000
trusted library allocation
page read and write
6287000
heap
page read and write
7FFD9B806000
trusted library allocation
page read and write
4156000
heap
page read and write
4E86000
heap
page read and write
1C734A07000
heap
page read and write
1C71A850000
heap
page read and write
2B50FEB6000
heap
page read and write
7FF79791A000
unkown
page write copy
2B511FAE000
heap
page read and write
5899000
heap
page read and write
1680000
heap
page read and write
524000
unkown
page write copy
520000
unkown
page write copy
4418000
heap
page read and write
1C72C304000
trusted library allocation
page read and write
3FFC000
heap
page read and write
5E11000
heap
page read and write
1C72FBA6000
trusted library allocation
page read and write
2B51216A000
heap
page read and write
F04000
heap
page read and write
59AD000
heap
page read and write
2B511E7A000
heap
page read and write
7FF79791A000
unkown
page read and write
F05000
heap
page read and write
5E11000
heap
page read and write
370E000
heap
page read and write
7FFD9B9B0000
trusted library allocation
page read and write
FD6000
unkown
page readonly
F04000
heap
page read and write
38FF000
heap
page read and write
5E11000
heap
page read and write
2B50FCF4000
heap
page read and write
3680000
heap
page read and write
448CF7E000
stack
page read and write
448CEFA000
stack
page read and write
E90000
heap
page read and write
F04000
heap
page read and write
4ADA000
heap
page read and write
1C71D8D8000
trusted library allocation
page read and write
5E11000
heap
page read and write
21F25F7000
stack
page read and write
4A0F000
heap
page read and write
4DDA000
heap
page read and write
43C4000
heap
page read and write
13A0000
heap
page read and write
2B511D84000
heap
page read and write
EA4000
heap
page read and write
21F26FB000
stack
page read and write
3EB4000
heap
page read and write
44E8000
heap
page read and write
2B50FE37000
heap
page read and write
21F24FE000
stack
page read and write
F04000
heap
page read and write
2B50FF4F000
heap
page read and write
1690000
trusted library allocation
page read and write
F04000
heap
page read and write
3966000
heap
page read and write
1C71DB09000
trusted library allocation
page read and write
520000
unkown
page read and write
2B50FD3C000
heap
page read and write
12BC000
heap
page read and write
461A000
heap
page read and write
EA4000
heap
page read and write
2B50FD75000
heap
page read and write
16E8000
heap
page read and write
2B90000
heap
page read and write
F04000
heap
page read and write
1C73479E000
heap
page read and write
2B511E26000
heap
page read and write
2B512004000
heap
page read and write
2B5118E9000
heap
page read and write
5E11000
heap
page read and write
D70000
heap
page read and write
2B50FF20000
heap
page read and write
1C71C190000
trusted library allocation
page read and write
40BA000
heap
page read and write
7FFD9B9E0000
trusted library allocation
page read and write
1C71D8F2000
trusted library allocation
page read and write
F04000
heap
page read and write
448DD0D000
stack
page read and write
3CDA000
heap
page read and write
4058000
heap
page read and write
1C71C100000
trusted library allocation
page read and write
1052000
heap
page read and write
3D1C000
heap
page read and write
1C734750000
heap
page read and write
2B5120FA000
heap
page read and write
4A19000
heap
page read and write
2B511E7A000
heap
page read and write
41C4000
heap
page read and write
7FF797924000
unkown
page readonly
49EE000
heap
page read and write
4928000
heap
page read and write
4816000
heap
page read and write
FE0000
unkown
page read and write
448CCFD000
stack
page read and write
3BD2000
heap
page read and write
2B50FD77000
heap
page read and write
38BD000
heap
page read and write
4E90000
heap
page read and write
7DF49B8C0000
trusted library allocation
page execute and read and write
4BD4000
heap
page read and write
2B50FD11000
heap
page read and write
2B50FBA1000
heap
page read and write
F04000
heap
page read and write
580A000
heap
page read and write
42C2000
heap
page read and write
1C71C285000
heap
page read and write
674F000
stack
page read and write
1C71C250000
heap
page read and write
2B512067000
heap
page read and write
1C71A825000
heap
page read and write
36CC000
heap
page read and write
2B50FBA0000
heap
page read and write
21F21FF000
stack
page read and write
2B512004000
heap
page read and write
7FF7978E5000
unkown
page readonly
F04000
heap
page read and write
3EAA000
heap
page read and write
2B511CF2000
heap
page read and write
F04000
heap
page read and write
33C2000
heap
page read and write
F20000
unkown
page readonly
F04000
heap
page read and write
7FF797830000
unkown
page readonly
2B512083000
heap
page read and write
5E11000
heap
page read and write
1D60000
heap
page read and write
1C734D60000
heap
page read and write
F04000
heap
page read and write
5E11000
heap
page read and write
4A98000
heap
page read and write
427E000
heap
page read and write
1C71C110000
heap
page readonly
21F23FB000
stack
page read and write
2B50FD24000
heap
page read and write
4F90000
heap
page read and write
2B50FCD9000
heap
page read and write
7FF79791E000
unkown
page write copy
7FFD9B9D0000
trusted library allocation
page read and write
3C14000
heap
page read and write
2AFE000
stack
page read and write
3E14000
heap
page read and write
2B511F57000
heap
page read and write
3C98000
heap
page read and write
1C71D887000
trusted library allocation
page read and write
5E11000
heap
page read and write
21F1DFF000
stack
page read and write
4FEC000
heap
page read and write
599F000
heap
page read and write
3C26000
heap
page read and write
3788000
heap
page read and write
448D0FB000
stack
page read and write
2B50FE7E000
heap
page read and write
435E000
heap
page read and write
1C71D8B6000
trusted library allocation
page read and write
1C7349D4000
heap
page read and write
448DE0B000
stack
page read and write
4111000
heap
page read and write
5AB4000
heap
page read and write
360C000
heap
page read and write
448CFFE000
stack
page read and write
41C8000
heap
page read and write
2B50FF29000
heap
page read and write
448C7FE000
stack
page read and write
F04000
heap
page read and write
7FFD9BA00000
trusted library allocation
page read and write
3D92000
heap
page read and write
1C71A897000
heap
page read and write
F05000
heap
page read and write
F04000
heap
page read and write
2B512061000
heap
page read and write
4AF4000
heap
page read and write
122C8075000
heap
page read and write
F40000
trusted library allocation
page read and write
2B50FF4E000
heap
page read and write
3404000
heap
page read and write
49DB000
heap
page read and write
F04000
heap
page read and write
2B512082000
heap
page read and write
2B511D72000
heap
page read and write
122C7E60000
heap
page read and write
5E11000
heap
page read and write
F04000
heap
page read and write
F7E000
stack
page read and write
2B511D34000
heap
page read and write
1C7348E0000
heap
page read and write
1C71C120000
trusted library allocation
page read and write
3E9B000
heap
page read and write
48D4000
heap
page read and write
122C8070000
heap
page read and write
2B510120000
heap
page read and write
7FFD9B9A0000
trusted library allocation
page read and write
448DE8C000
stack
page read and write
F04000
heap
page read and write
7FF797831000
unkown
page execute read
2B511D96000
heap
page read and write
4872000
heap
page read and write
2B511EDF000
heap
page read and write
7FFD9B753000
trusted library allocation
page execute and read and write
5E11000
heap
page read and write
F04000
heap
page read and write
1C71A7B0000
heap
page read and write
F05000
heap
page read and write
1980000
heap
page read and write
EA4000
heap
page read and write
4170000
heap
page read and write
4776000
heap
page read and write
1340000
heap
page read and write
7FFD9B76B000
trusted library allocation
page read and write
1C71A8D8000
heap
page read and write
502E000
heap
page read and write
1C71CD74000
trusted library allocation
page read and write
2B50FD5B000
heap
page read and write
45C4000
heap
page read and write
3F60000
heap
page read and write
46CC000
heap
page read and write
4E34000
heap
page read and write
12FE000
heap
page read and write
7FFD9B836000
trusted library allocation
page execute and read and write
44AA000
heap
page read and write
5E11000
heap
page read and write
516000
unkown
page readonly
448CBFE000
stack
page read and write
2B511F94000
heap
page read and write
2B512A0C000
heap
page read and write
2B5119D4000
heap
page read and write
21F1CFA000
stack
page read and write
2B50FE25000
heap
page read and write
1C71D8A0000
trusted library allocation
page read and write
2B512025000
heap
page read and write
4620000
heap
page read and write
2B50FB40000
heap
page read and write
F04000
heap
page read and write
7FFD9B752000
trusted library allocation
page read and write
7FFD9B800000
trusted library allocation
page read and write
21F20FF000
stack
page read and write
497E000
heap
page read and write
5E11000
heap
page read and write
2B5119D8000
heap
page read and write
2B50FEB6000
heap
page read and write
456A000
heap
page read and write
2B511E69000
heap
page read and write
3D90000
heap
page read and write
1C73429B000
heap
page read and write
1C734A02000
heap
page read and write
7FFD9B810000
trusted library allocation
page execute and read and write
F21000
unkown
page execute read
461000
unkown
page execute read
2B512254000
heap
page read and write
2B50FDAA000
heap
page read and write
4104000
heap
page read and write
F04000
heap
page read and write
1C71A6B0000
heap
page read and write
2B511E04000
heap
page read and write
448CA7F000
stack
page read and write
5E11000
heap
page read and write
2B50FF64000
heap
page read and write
5E11000
heap
page read and write
790000
heap
page read and write
3704000
heap
page read and write
3380000
heap
page read and write
1C72EC40000
trusted library allocation
page read and write
2B5118D4000
heap
page read and write
7FFD9B90A000
trusted library allocation
page read and write
5701000
heap
page read and write
4FEF000
heap
page read and write
448CC7D000
stack
page read and write
3FBA000
heap
page read and write
7FFD9B940000
trusted library allocation
page execute and read and write
5701000
heap
page read and write
1C734835000
heap
page read and write
5E11000
heap
page read and write
2B51232E000
heap
page read and write
C1E31FE000
stack
page read and write
F04000
heap
page read and write
481E000
heap
page read and write
1C73481A000
heap
page read and write
D0A000
stack
page read and write
44B4000
heap
page read and write
2B50FBAF000
heap
page read and write
106F000
heap
page read and write
448C7BE000
stack
page read and write
F04000
heap
page read and write
F04000
heap
page read and write
4190000
heap
page read and write
122C9B30000
heap
page read and write
122C7DD0000
heap
page read and write
2B50FD1B000
heap
page read and write
448D17B000
stack
page read and write
2B511F60000
heap
page read and write
2B511FB0000
heap
page read and write
F40000
trusted library allocation
page read and write
2B511F71000
heap
page read and write
4F0000
unkown
page readonly
7FFD9BA90000
trusted library allocation
page read and write
5E11000
heap
page read and write
2B512191000
heap
page read and write
5E11000
heap
page read and write
1650000
heap
page read and write
2B50FC75000
heap
page read and write
1C71D11F000
trusted library allocation
page read and write
4828000
heap
page read and write
2B511E26000
heap
page read and write
5E11000
heap
page read and write
F04000
heap
page read and write
2B50FB99000
heap
page read and write
2B50FD55000
heap
page read and write
F04000
heap
page read and write
3DFE000
heap
page read and write
5E11000
heap
page read and write
7FFD9B980000
trusted library allocation
page read and write
3EDA000
heap
page read and write
2B511F14000
heap
page read and write
2B511F56000
heap
page read and write
2B7E000
stack
page read and write
4F2C000
heap
page read and write
2B511870000
heap
page read and write
2B512063000
heap
page read and write
3E58000
heap
page read and write
1C71DB8F000
trusted library allocation
page read and write
4740000
heap
page read and write
51CB000
heap
page read and write
2E8F000
unkown
page read and write
138A000
heap
page read and write
41BE000
heap
page read and write
45DE000
heap
page read and write
2B50FD90000
heap
page read and write
1C71D88F000
trusted library allocation
page read and write
47D4000
heap
page read and write
1C72CE40000
trusted library allocation
page read and write
1C71C1F0000
heap
page execute and read and write
1A4E000
heap
page read and write
2B50FD24000
heap
page read and write
FD8000
heap
page read and write
2B51205D000
heap
page read and write
2B50FDF4000
heap
page read and write
1C7349DC000
heap
page read and write
127A000
heap
page read and write
5C9E000
heap
page read and write
45C0000
heap
page read and write
15CF000
stack
page read and write
FE0000
unkown
page write copy
2B511CB1000
heap
page read and write
4574000
heap
page read and write
3B90000
heap
page read and write
506C000
heap
page read and write
FE9000
unkown
page readonly
2B511D73000
heap
page read and write
F05000
heap
page read and write
1C71C4B7000
trusted library allocation
page read and write
2B50FBB0000
heap
page read and write
5E11000
heap
page read and write
2B511D58000
heap
page read and write
2B50FD17000
heap
page read and write
F04000
heap
page read and write
2B511DA0000
heap
page read and write
1C7346E0000
heap
page execute and read and write
7FFD9B970000
trusted library allocation
page read and write
FB0000
unkown
page readonly
2B50FF64000
heap
page read and write
1C71C623000
trusted library allocation
page read and write
5F00000
heap
page read and write
2B510125000
heap
page read and write
47D4000
heap
page read and write
2B50FEF8000
heap
page read and write
46C0000
heap
page read and write
2B511FAE000
heap
page read and write
27C0000
heap
page read and write
7FFD9B754000
trusted library allocation
page read and write
58C4000
heap
page read and write
2B50FCD4000
heap
page read and write
2B50FDD6000
heap
page read and write
1C71C280000
heap
page read and write
1C71A7F0000
heap
page read and write
2B511DB0000
heap
page read and write
1C71C153000
trusted library allocation
page read and write
2B512320000
heap
page read and write
2B512191000
heap
page read and write
5801000
heap
page read and write
1C71DE12000
trusted library allocation
page read and write
2B511F14000
heap
page read and write
4886000
heap
page read and write
2B50FA40000
heap
page read and write
3750000
heap
page read and write
2B50FB20000
heap
page read and write
50AC000
heap
page read and write
122C807C000
heap
page read and write
4216000
heap
page read and write
C1E2DBF000
stack
page read and write
5E11000
heap
page read and write
F04000
heap
page read and write
4370000
heap
page read and write
2B50FEFD000
heap
page read and write
122C7D60000
heap
page read and write
4ACC000
heap
page read and write
F04000
heap
page read and write
2B50FD32000
heap
page read and write
2B512246000
heap
page read and write
4716000
heap
page read and write
1C7349D0000
heap
page read and write
122C7E37000
heap
page read and write
F90000
heap
page read and write
1A0C000
heap
page read and write
2B5120D6000
heap
page read and write
2B511F02000
heap
page read and write
3780000
heap
page read and write
51F1000
heap
page read and write
7FFD9B920000
trusted library allocation
page execute and read and write
364E000
heap
page read and write
1C71A870000
heap
page read and write
2B511EF0000
heap
page read and write
5E11000
heap
page read and write
2B50FBAF000
heap
page read and write
2B50FDB5000
heap
page read and write
4016000
heap
page read and write
4F0000
unkown
page readonly
7FFD9B9F0000
trusted library allocation
page read and write
448CAFE000
stack
page read and write
1C734A4D000
heap
page read and write
5169000
heap
page read and write
2B50FB70000
heap
page read and write
2B5126FF000
heap
page read and write
2B5126F9000
heap
page read and write
2B511F14000
heap
page read and write
46CA000
heap
page read and write
2B50FD02000
heap
page read and write
F40000
trusted library allocation
page read and write
16CE000
stack
page read and write
3DD2000
heap
page read and write
F04000
heap
page read and write
3D5E000
heap
page read and write
2B50FEF9000
heap
page read and write
3784000
heap
page read and write
F40000
trusted library allocation
page read and write
2B50FD7A000
heap
page read and write
448CDF6000
stack
page read and write
3DBC000
heap
page read and write
6DA000
stack
page read and write
1690000
trusted library allocation
page read and write
740000
heap
page read and write
There are 834 hidden memdumps, click here to show them.