IOC Report
rShipmentDocuments.exe

loading gif

Files

File Path
Type
Category
Malicious
rShipmentDocuments.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rShipmentDocuments.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmp44A0.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZOlmYtPdlO.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2avoa3gt.4q0.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4krynbdl.33r.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5t3bh3t3.ehn.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jycxlpzp.vxt.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_me3gq5m1.waw.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skfts1sn.dv5.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wysnqmj2.m2l.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xkydfyjv.g11.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp5356.tmp
XML 1.0 document, ASCII text
dropped
There are 6 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\rShipmentDocuments.exe
"C:\Users\user\Desktop\rShipmentDocuments.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rShipmentDocuments.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp44A0.tmp"
 malicious
C:\Users\user\Desktop\rShipmentDocuments.exe
"C:\Users\user\Desktop\rShipmentDocuments.exe"
 malicious
C:\Users\user\Desktop\rShipmentDocuments.exe
"C:\Users\user\Desktop\rShipmentDocuments.exe"
 malicious
C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZOlmYtPdlO" /XML "C:\Users\user\AppData\Local\Temp\tmp5356.tmp"
 malicious
C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
"C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
 malicious
C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
"C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
 malicious
C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe
"C:\Users\user\AppData\Roaming\ZOlmYtPdlO.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 6 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://api.telegram.org
unknown
https://api.telegram.org/bot
unknown
http://www.fontbureau.com/designers?
unknown
https://www.office.com/lB
unknown
https://chrome.google.com/webstore?hl=enp
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://www.goodfont.co.kr
unknown
https://chrome.google.com/webstore?hl=en
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20and%20Time:%2011/10/2024%20/%2015:30:22%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20301389%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
http://varders.kozow.com:8081
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20a
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://checkip.dyndns.org/
132.226.247.73
https://www.office.com/p
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
http://checkip.dyndns.org/q
unknown
https://chrome.google.com/webstore?hl=enlB
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
https://reallyfreegeoip.org/xml/
unknown
https://www.office.com/
unknown
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:301389%0D%0ADate%20and%20Time:%2011/10/2024%20/%2015:40:15%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20301389%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
http://checkip.dyndns.org
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://api.telegram.org/bot/sendMessage?chat_id=&text=
unknown
http://crl.microsoft.c62
unknown
http://www.carterandcone.coml
unknown
http://aborters.duckdns.org:8081
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://51.38.247.67:8081/_send_.php?L
unknown
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://anotherarmy.dns.army:8081
unknown
http://www.jiyu-kobo.co.jp/
unknown
https://reallyfreegeoip.org
unknown
http://www.fontbureau.com/designers8
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
There are 45 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
api.telegram.org
149.154.167.220
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
185.230.141.85
unknown
Russian Federation
malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rShipmentDocuments_RASMANCS
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ZOlmYtPdlO_RASMANCS
FileDirectory
There are 19 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
43CD000
trusted library allocation
page read and write
 malicious
390E000
trusted library allocation
page read and write
 malicious
2C11000
trusted library allocation
page read and write
 malicious
434000
remote allocation
page execute and read and write
 malicious
3061000
trusted library allocation
page read and write
 malicious
906000
trusted library allocation
page execute and read and write
4C94000
trusted library section
page readonly
2CCD000
trusted library allocation
page read and write
3111000
trusted library allocation
page read and write
1245000
heap
page read and write
1429000
heap
page read and write
3A47000
trusted library allocation
page read and write
AD5F000
stack
page read and write
5253000
heap
page read and write
2B61000
trusted library allocation
page read and write
5068000
trusted library allocation
page read and write
64A5000
heap
page read and write
4254000
trusted library allocation
page read and write
1220000
trusted library allocation
page read and write
43C4000
trusted library allocation
page read and write
AEA0000
heap
page read and write
DE8000
heap
page read and write
4133000
trusted library allocation
page read and write
1730000
trusted library allocation
page read and write
1742000
trusted library allocation
page read and write
2922000
trusted library allocation
page read and write
55A0000
trusted library allocation
page read and write
29E0000
trusted library allocation
page read and write
9C4000
heap
page read and write
FFA000
stack
page read and write
2DF8000
trusted library allocation
page read and write
1430000
heap
page read and write
1432000
heap
page read and write
1515000
heap
page read and write
42E6000
trusted library allocation
page read and write
DC0000
heap
page read and write
D60000
heap
page read and write
5A60000
trusted library section
page read and write
5130000
heap
page read and write
29F6000
trusted library allocation
page execute and read and write
3101000
trusted library allocation
page read and write
3F09000
trusted library allocation
page read and write
41A8000
trusted library allocation
page read and write
135E000
stack
page read and write
4316000
trusted library allocation
page read and write
68D6000
trusted library allocation
page read and write
E5E000
stack
page read and write
270F000
stack
page read and write
6F00000
trusted library allocation
page read and write
D40000
trusted library allocation
page read and write
990000
heap
page read and write
900000
trusted library allocation
page read and write
13C0000
trusted library allocation
page read and write
6A60000
trusted library allocation
page read and write
2F9A000
trusted library allocation
page read and write
BB4F000
stack
page read and write
43FA000
trusted library allocation
page read and write
1770000
trusted library allocation
page execute and read and write
3ACD000
trusted library allocation
page read and write
1760000
trusted library allocation
page read and write
1747000
trusted library allocation
page execute and read and write
4154000
trusted library allocation
page read and write
23FE000
stack
page read and write
4CC0000
trusted library allocation
page read and write
7DB0000
trusted library section
page read and write
3F4C000
trusted library allocation
page read and write
3EC7000
trusted library allocation
page read and write
4C59000
trusted library allocation
page read and write
5A3B000
stack
page read and write
42DE000
trusted library allocation
page read and write
65FE000
stack
page read and write
6940000
trusted library allocation
page execute and read and write
3EE4000
trusted library allocation
page read and write
800000
heap
page read and write
3D46000
trusted library allocation
page read and write
3F52000
trusted library allocation
page read and write
5430000
heap
page execute and read and write
BDCD000
stack
page read and write
62FD000
stack
page read and write
19B0000
heap
page read and write
10EE000
stack
page read and write
6D64000
trusted library allocation
page read and write
1780000
heap
page read and write
32D1000
trusted library allocation
page read and write
E8F000
heap
page read and write
49A000
stack
page read and write
67BE000
stack
page read and write
2A07000
trusted library allocation
page execute and read and write
58F0000
trusted library allocation
page read and write
327D000
trusted library allocation
page read and write
302C000
trusted library allocation
page read and write
69E0000
trusted library allocation
page read and write
5A50000
trusted library allocation
page read and write
5B65000
heap
page read and write
8E3000
trusted library allocation
page execute and read and write
3E87000
trusted library allocation
page read and write
7F660000
trusted library allocation
page execute and read and write
6AC0000
heap
page read and write
3ED4000
trusted library allocation
page read and write
6F20000
trusted library allocation
page execute and read and write
2BF0000
trusted library allocation
page read and write
3105000
trusted library allocation
page read and write
434E000
trusted library allocation
page read and write
2F6D000
trusted library allocation
page read and write
6E60000
trusted library allocation
page read and write
174B000
trusted library allocation
page execute and read and write
A12000
heap
page read and write
EB2000
unkown
page readonly
2C84000
trusted library allocation
page read and write
2DA8000
trusted library allocation
page read and write
1200000
heap
page read and write
316B000
trusted library allocation
page read and write
6F50000
heap
page read and write
6DF0000
trusted library allocation
page execute and read and write
5D69000
heap
page read and write
4156000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
534E000
stack
page read and write
2DC7000
trusted library allocation
page read and write
13B0000
trusted library allocation
page read and write
41B7000
trusted library allocation
page read and write
4F20000
heap
page read and write
8C6000
heap
page read and write
2A40000
trusted library allocation
page read and write
BD8F000
stack
page read and write
530B000
stack
page read and write
42C5000
trusted library allocation
page read and write
960000
heap
page execute and read and write
2BAE000
stack
page read and write
88E000
stack
page read and write
311D000
trusted library allocation
page read and write
3C7D000
trusted library allocation
page read and write
556B000
trusted library allocation
page read and write
A99E000
stack
page read and write
4121000
trusted library allocation
page read and write
6D5E000
stack
page read and write
2B1E000
unkown
page read and write
5800000
heap
page read and write
30DC000
trusted library allocation
page read and write
1488000
heap
page read and write
2C88000
trusted library allocation
page read and write
5820000
trusted library allocation
page read and write
43E8000
trusted library allocation
page read and write
80CE000
heap
page read and write
3251000
trusted library allocation
page read and write
557E000
trusted library allocation
page read and write
3DFC000
trusted library allocation
page read and write
406B000
trusted library allocation
page read and write
1700000
trusted library allocation
page read and write
1713000
trusted library allocation
page execute and read and write
5581000
trusted library allocation
page read and write
6A5F000
stack
page read and write
835E000
stack
page read and write
2B5F000
unkown
page read and write
2DC9000
trusted library allocation
page read and write
950000
trusted library allocation
page read and write
1990000
trusted library allocation
page read and write
321A000
trusted library allocation
page read and write
16EE000
stack
page read and write
10AF000
stack
page read and write
1167000
stack
page read and write
66FE000
stack
page read and write
414E000
trusted library allocation
page read and write
2DF6000
trusted library allocation
page read and write
511D000
trusted library allocation
page read and write
3F3B000
trusted library allocation
page read and write
2796000
trusted library allocation
page read and write
3811000
trusted library allocation
page read and write
6ED0000
trusted library allocation
page read and write
4336000
trusted library allocation
page read and write
6DE0000
trusted library allocation
page execute and read and write
69F4000
trusted library allocation
page read and write
6E77000
trusted library allocation
page read and write
112D000
trusted library allocation
page execute and read and write
3148000
trusted library allocation
page read and write
1723000
trusted library allocation
page read and write
1770000
heap
page execute and read and write
3050000
heap
page read and write
3F9B000
trusted library allocation
page read and write
65BE000
stack
page read and write
3F75000
trusted library allocation
page read and write
328E000
stack
page read and write
6920000
trusted library allocation
page read and write
3EA2000
trusted library allocation
page read and write
510E000
trusted library allocation
page read and write
4C50000
trusted library allocation
page read and write
1980000
trusted library allocation
page read and write
99A000
heap
page read and write
4401000
trusted library allocation
page read and write
7B4E000
stack
page read and write
43EA000
trusted library allocation
page read and write
6980000
trusted library allocation
page read and write
2DF2000
trusted library allocation
page read and write
974000
trusted library allocation
page read and write
C5E000
stack
page read and write
42D1000
trusted library allocation
page read and write
42F8000
trusted library allocation
page read and write
9B7000
heap
page read and write
5030000
trusted library allocation
page execute and read and write
6DD0000
trusted library allocation
page execute and read and write
38AA000
trusted library allocation
page read and write
6A50000
trusted library allocation
page read and write
1240000
heap
page read and write
2D4B000
heap
page read and write
2A0B000
trusted library allocation
page execute and read and write
55D0000
heap
page execute and read and write
6900000
trusted library allocation
page read and write
279D000
trusted library allocation
page read and write
3B53000
trusted library allocation
page read and write
68DF000
stack
page read and write
C5FC000
stack
page read and write
6990000
trusted library allocation
page read and write
5250000
heap
page read and write
43D0000
trusted library allocation
page read and write
3243000
trusted library allocation
page read and write
1130000
heap
page read and write
5F0000
heap
page read and write
30B2000
trusted library allocation
page read and write
B70D000
stack
page read and write
1710000
trusted library allocation
page read and write
334E000
trusted library allocation
page read and write
3C34000
trusted library allocation
page read and write
438A000
trusted library allocation
page read and write
5540000
heap
page read and write
3C1C000
trusted library allocation
page read and write
5566000
trusted library allocation
page read and write
1740000
trusted library allocation
page read and write
310A000
trusted library allocation
page read and write
14B3000
heap
page read and write
3256000
trusted library allocation
page read and write
4334000
trusted library allocation
page read and write
4F00000
trusted library allocation
page read and write
3F8E000
trusted library allocation
page read and write
5210000
heap
page read and write
4192000
trusted library allocation
page read and write
3220000
trusted library allocation
page read and write
4ED0000
trusted library allocation
page read and write
DE0000
heap
page read and write
575B000
trusted library allocation
page read and write
669E000
stack
page read and write
3E96000
trusted library allocation
page read and write
2D10000
heap
page read and write
CF7000
stack
page read and write
1720000
trusted library allocation
page read and write
3E71000
trusted library allocation
page read and write
BECD000
stack
page read and write
4C52000
trusted library allocation
page read and write
64B0000
heap
page read and write
42FA000
trusted library allocation
page read and write
3212000
trusted library allocation
page read and write
6A70000
trusted library allocation
page read and write
7492000
trusted library allocation
page read and write
433000
remote allocation
page execute and read and write
6B9E000
stack
page read and write
5080000
heap
page read and write
673E000
stack
page read and write
171D000
trusted library allocation
page execute and read and write
413A000
trusted library allocation
page read and write
41F7000
trusted library allocation
page read and write
69DB000
trusted library allocation
page read and write
7470000
trusted library allocation
page read and write
AB5E000
stack
page read and write
3FBA000
trusted library allocation
page read and write
3E9E000
trusted library allocation
page read and write
510A000
trusted library allocation
page read and write
3473000
trusted library allocation
page read and write
ED3000
heap
page read and write
1496000
heap
page read and write
917000
trusted library allocation
page execute and read and write
6960000
trusted library allocation
page execute and read and write
2CC1000
trusted library allocation
page read and write
50F6000
trusted library allocation
page read and write
4146000
trusted library allocation
page read and write
2CD1000
trusted library allocation
page read and write
EB0000
unkown
page readonly
4409000
trusted library allocation
page read and write
1120000
trusted library allocation
page read and write
69D7000
trusted library allocation
page read and write
57B0000
trusted library allocation
page read and write
1425000
heap
page read and write
148E000
heap
page read and write
43E4000
trusted library allocation
page read and write
64C6000
heap
page read and write
698A000
trusted library allocation
page read and write
1234000
trusted library allocation
page read and write
A44000
heap
page read and write
912000
trusted library allocation
page read and write
43B9000
trusted library allocation
page read and write
13EE000
stack
page read and write
F64000
unkown
page readonly
6D70000
trusted library allocation
page read and write
3D5F000
trusted library allocation
page read and write
50F0000
trusted library allocation
page read and write
9250000
heap
page read and write
BC4F000
stack
page read and write
A95E000
stack
page read and write
360000
heap
page read and write
5B60000
heap
page read and write
C14E000
stack
page read and write
8E0000
trusted library allocation
page read and write
A0E000
heap
page read and write
439B000
trusted library allocation
page read and write
9D2000
heap
page read and write
34FD000
trusted library allocation
page read and write
50FE000
trusted library allocation
page read and write
8F0000
trusted library allocation
page read and write
8FD000
trusted library allocation
page execute and read and write
3247000
trusted library allocation
page read and write
BED0000
heap
page read and write
3F95000
trusted library allocation
page read and write
1350000
heap
page read and write
352C000
trusted library allocation
page read and write
3CCD000
trusted library allocation
page read and write
8E4000
trusted library allocation
page read and write
31E000
unkown
page read and write
68BE000
stack
page read and write
278E000
trusted library allocation
page read and write
8ED000
trusted library allocation
page execute and read and write
2DCF000
trusted library allocation
page read and write
B80F000
stack
page read and write
3EA8000
trusted library allocation
page read and write
AFDE000
stack
page read and write
93AE000
stack
page read and write
2E8D000
trusted library allocation
page read and write
6910000
trusted library allocation
page execute and read and write
2D1A000
trusted library allocation
page read and write
1790000
heap
page read and write
8D0000
trusted library allocation
page read and write
3D67000
trusted library allocation
page read and write
5810000
heap
page read and write
176C000
stack
page read and write
2A00000
heap
page read and write
69E7000
trusted library allocation
page read and write
42EA000
trusted library allocation
page read and write
4180000
trusted library allocation
page read and write
6D90000
trusted library allocation
page read and write
2C79000
trusted library allocation
page read and write
3CFE000
trusted library allocation
page read and write
A7C000
heap
page read and write
5230000
trusted library allocation
page read and write
6D66000
trusted library allocation
page read and write
302E000
stack
page read and write
13F0000
heap
page read and write
4CD0000
heap
page execute and read and write
A1C000
heap
page read and write
1233000
trusted library allocation
page execute and read and write
18DE000
stack
page read and write
679E000
stack
page read and write
2C6E000
trusted library allocation
page read and write
4248000
trusted library allocation
page read and write
30D8000
trusted library allocation
page read and write
5776000
trusted library allocation
page read and write
3F5D000
trusted library allocation
page read and write
43A1000
trusted library allocation
page read and write
3119000
trusted library allocation
page read and write
5C10000
trusted library allocation
page read and write
3E9A000
trusted library allocation
page read and write
3DBF000
trusted library allocation
page read and write
3DCA000
trusted library allocation
page read and write
14C8000
heap
page read and write
61FD000
stack
page read and write
4CA0000
heap
page read and write
6440000
heap
page read and write
11D0000
heap
page read and write
2DC5000
trusted library allocation
page read and write
3D58000
trusted library allocation
page read and write
2E05000
trusted library allocation
page read and write
6D6A000
trusted library allocation
page read and write
13C2000
trusted library allocation
page read and write
3418000
trusted library allocation
page read and write
5560000
trusted library allocation
page read and write
2C62000
trusted library allocation
page read and write
6ED2000
trusted library allocation
page read and write
B21E000
stack
page read and write
3CEA000
trusted library allocation
page read and write
3218000
trusted library allocation
page read and write
C63D000
stack
page read and write
902000
trusted library allocation
page read and write
2A30000
trusted library allocation
page execute and read and write
3F6A000
trusted library allocation
page read and write
4359000
trusted library allocation
page read and write
3CE3000
trusted library allocation
page read and write
29FA000
trusted library allocation
page execute and read and write
DAE000
stack
page read and write
55A4000
trusted library allocation
page read and write
172D000
trusted library allocation
page execute and read and write
2D0000
heap
page read and write
3D06000
trusted library allocation
page read and write
446000
remote allocation
page execute and read and write
57F0000
trusted library section
page readonly
444000
remote allocation
page execute and read and write
43BC000
trusted library allocation
page read and write
141C000
heap
page read and write
421A000
trusted library allocation
page read and write
4D90000
heap
page read and write
43A8000
trusted library allocation
page read and write
6EA6000
trusted library allocation
page read and write
402000
remote allocation
page execute and read and write
1123000
trusted library allocation
page execute and read and write
3274000
trusted library allocation
page read and write
6D7D000
trusted library allocation
page read and write
16EE000
stack
page read and write
33E0000
trusted library allocation
page read and write
ECC000
heap
page read and write
91B000
trusted library allocation
page execute and read and write
3249000
trusted library allocation
page read and write
3DF8000
trusted library allocation
page read and write
502D000
stack
page read and write
5085000
heap
page read and write
2F2E000
trusted library allocation
page read and write
13B2000
trusted library allocation
page read and write
84E000
stack
page read and write
3E04000
trusted library allocation
page read and write
6DC0000
trusted library allocation
page execute and read and write
69C0000
trusted library allocation
page execute and read and write
68C0000
trusted library allocation
page read and write
33BD000
trusted library allocation
page read and write
930000
trusted library allocation
page read and write
9214000
heap
page read and write
13BA000
trusted library allocation
page execute and read and write
B44F000
stack
page read and write
403000
remote allocation
page execute and read and write
276E000
stack
page read and write
91D0000
heap
page read and write
3051000
trusted library allocation
page read and write
5A80000
heap
page execute and read and write
4357000
trusted library allocation
page read and write
67DE000
stack
page read and write
3F67000
trusted library allocation
page read and write
42F2000
trusted library allocation
page read and write
2B9E000
stack
page read and write
2CB1000
trusted library allocation
page read and write
11C0000
heap
page read and write
576E000
trusted library allocation
page read and write
567F000
stack
page read and write
4C60000
trusted library allocation
page execute and read and write
8F3000
trusted library allocation
page read and write
123D000
trusted library allocation
page execute and read and write
9D0000
heap
page read and write
14CB000
heap
page read and write
7F3F000
stack
page read and write
31E3000
trusted library allocation
page read and write
5EAE000
stack
page read and write
307F000
trusted library allocation
page read and write
41AF000
trusted library allocation
page read and write
2811000
trusted library allocation
page read and write
970000
trusted library allocation
page read and write
13C7000
trusted library allocation
page execute and read and write
3D04000
trusted library allocation
page read and write
40CD000
trusted library allocation
page read and write
3115000
trusted library allocation
page read and write
2DFA000
trusted library allocation
page read and write
173A000
trusted library allocation
page execute and read and write
27F0000
heap
page read and write
68D4000
trusted library allocation
page read and write
2BF0000
heap
page read and write
3E9C000
trusted library allocation
page read and write
1714000
trusted library allocation
page read and write
3D42000
trusted library allocation
page read and write
3030000
trusted library allocation
page execute and read and write
6F10000
trusted library allocation
page read and write
4ECB000
stack
page read and write
3121000
trusted library allocation
page read and write
102C000
stack
page read and write
1360000
heap
page read and write
172E000
stack
page read and write
1780000
trusted library allocation
page read and write
3E75000
trusted library allocation
page read and write
2CB5000
trusted library allocation
page read and write
43B6000
trusted library allocation
page read and write
2730000
heap
page read and write
34CF000
trusted library allocation
page read and write
2791000
trusted library allocation
page read and write
2960000
heap
page read and write
3EAA000
trusted library allocation
page read and write
4123000
trusted library allocation
page read and write
540B000
stack
page read and write
E0B000
heap
page read and write
535D000
stack
page read and write
6AFE000
stack
page read and write
4148000
trusted library allocation
page read and write
6D80000
trusted library allocation
page execute and read and write
5C40000
heap
page read and write
68E6000
trusted library allocation
page read and write
5090000
heap
page read and write
1230000
trusted library allocation
page read and write
2CC9000
trusted library allocation
page read and write
C9E000
stack
page read and write
15EE000
stack
page read and write
33EA000
trusted library allocation
page read and write
42F6000
trusted library allocation
page read and write
55B0000
trusted library allocation
page read and write
68E0000
heap
page read and write
940000
trusted library allocation
page execute and read and write
3F07000
trusted library allocation
page read and write
5670000
heap
page read and write
4061000
trusted library allocation
page read and write
6E90000
trusted library allocation
page execute and read and write
980000
trusted library allocation
page read and write
5C20000
trusted library allocation
page read and write
3290000
trusted library allocation
page read and write
5750000
trusted library allocation
page read and write
5C30000
trusted library allocation
page read and write
8060000
heap
page read and write
30D4000
trusted library allocation
page read and write
558D000
trusted library allocation
page read and write
1057000
heap
page read and write
4CB0000
heap
page read and write
5771000
trusted library allocation
page read and write
BC8E000
stack
page read and write
3EFF000
trusted library allocation
page read and write
556E000
trusted library allocation
page read and write
5DA4000
heap
page read and write
2C00000
heap
page read and write
4196000
trusted library allocation
page read and write
71A0000
heap
page read and write
5B4E000
stack
page read and write
6950000
trusted library allocation
page execute and read and write
5673000
heap
page read and write
D50000
heap
page read and write
50FB000
trusted library allocation
page read and write
6DB0000
trusted library allocation
page read and write
557A000
trusted library allocation
page read and write
6940000
heap
page read and write
C47E000
stack
page read and write
12F7000
stack
page read and write
26A000
stack
page read and write
13CB000
trusted library allocation
page execute and read and write
1736000
trusted library allocation
page execute and read and write
3E77000
trusted library allocation
page read and write
2867000
trusted library allocation
page read and write
19A0000
trusted library allocation
page read and write
3D30000
trusted library allocation
page read and write
50A0000
heap
page read and write
5903000
heap
page read and write
139E000
stack
page read and write
7F830000
trusted library allocation
page execute and read and write
3C11000
trusted library allocation
page read and write
34A1000
trusted library allocation
page read and write
5A70000
trusted library allocation
page execute and read and write
13E0000
trusted library allocation
page read and write
7B0E000
stack
page read and write
CA8000
trusted library allocation
page read and write
2B60000
heap
page read and write
18E8000
trusted library allocation
page read and write
6E70000
trusted library allocation
page read and write
5C20000
trusted library allocation
page read and write
1510000
heap
page read and write
D50000
heap
page read and write
DB0000
heap
page read and write
3819000
trusted library allocation
page read and write
3F80000
trusted library allocation
page read and write
68F0000
trusted library allocation
page execute and read and write
3CF8000
trusted library allocation
page read and write
27B0000
trusted library allocation
page read and write
3FB2000
trusted library allocation
page read and write
B48C000
stack
page read and write
C10E000
stack
page read and write
2E5D000
trusted library allocation
page read and write
99E000
heap
page read and write
57C0000
trusted library allocation
page execute and read and write
6A80000
trusted library allocation
page read and write
4C18000
trusted library allocation
page read and write
22D000
stack
page read and write
3327000
trusted library allocation
page read and write
5111000
trusted library allocation
page read and write
3CD3000
trusted library allocation
page read and write
6A9E000
stack
page read and write
68ED000
trusted library allocation
page read and write
426C000
trusted library allocation
page read and write
B0DE000
stack
page read and write
5A5E000
stack
page read and write
42C7000
trusted library allocation
page read and write
69D0000
trusted library allocation
page read and write
6ED5000
trusted library allocation
page read and write
6B3E000
stack
page read and write
13FA000
heap
page read and write
69AC000
trusted library allocation
page read and write
2DB4000
trusted library allocation
page read and write
6E50000
trusted library allocation
page execute and read and write
C00D000
stack
page read and write
68E0000
trusted library allocation
page read and write
3D40000
trusted library allocation
page read and write
6EE0000
heap
page read and write
4089000
trusted library allocation
page read and write
30C9000
trusted library allocation
page read and write
123E000
stack
page read and write
29ED000
trusted library allocation
page execute and read and write
B11E000
stack
page read and write
42C1000
trusted library allocation
page read and write
2BDC000
stack
page read and write
2BE0000
trusted library allocation
page read and write
5C3C000
trusted library allocation
page read and write
4198000
trusted library allocation
page read and write
3DC8000
trusted library allocation
page read and write
B34E000
stack
page read and write
2FC8000
trusted library allocation
page read and write
279A000
stack
page read and write
5572000
trusted library allocation
page read and write
2A9E000
stack
page read and write
147A000
heap
page read and write
E18000
heap
page read and write
521E000
heap
page read and write
3CF6000
trusted library allocation
page read and write
30DC000
trusted library allocation
page read and write
B5CE000
stack
page read and write
32AE000
trusted library allocation
page read and write
564D000
stack
page read and write
577D000
trusted library allocation
page read and write
2D40000
heap
page read and write
8074000
heap
page read and write
2DD4000
trusted library allocation
page read and write
4C90000
trusted library section
page readonly
310D000
trusted library allocation
page read and write
4218000
trusted library allocation
page read and write
6949000
heap
page read and write
3109000
trusted library allocation
page read and write
2CBD000
trusted library allocation
page read and write
30AD000
trusted library allocation
page read and write
2CC5000
trusted library allocation
page read and write
2A05000
trusted library allocation
page execute and read and write
4324000
trusted library allocation
page read and write
3023000
trusted library allocation
page read and write
C4FB000
stack
page read and write
42D7000
trusted library allocation
page read and write
6EF0000
trusted library allocation
page read and write
B58C000
stack
page read and write
13FE000
heap
page read and write
4190000
trusted library allocation
page read and write
657D000
stack
page read and write
3E8E000
trusted library allocation
page read and write
4DAD000
stack
page read and write
13AD000
trusted library allocation
page execute and read and write
4D93000
heap
page read and write
3D02000
trusted library allocation
page read and write
AD9D000
stack
page read and write
2A02000
trusted library allocation
page read and write
1050000
heap
page read and write
423000
remote allocation
page execute and read and write
2A20000
trusted library allocation
page read and write
2C8C000
trusted library allocation
page read and write
6A40000
trusted library allocation
page read and write
64DA000
heap
page read and write
4EE0000
trusted library allocation
page read and write
6A1D000
stack
page read and write
5D4E000
stack
page read and write
2EFD000
trusted library allocation
page read and write
976000
trusted library allocation
page read and write
5D50000
heap
page read and write
A4E000
heap
page read and write
2770000
trusted library allocation
page read and write
13F0000
heap
page read and write
AC5F000
stack
page read and write
1124000
trusted library allocation
page read and write
324B000
trusted library allocation
page read and write
1069000
stack
page read and write
3216000
trusted library allocation
page read and write
3C39000
trusted library allocation
page read and write
5900000
heap
page read and write
30CC000
trusted library allocation
page read and write
4387000
trusted library allocation
page read and write
3E1C000
trusted library allocation
page read and write
3FAB000
trusted library allocation
page read and write
3EA6000
trusted library allocation
page read and write
19E7000
heap
page read and write
5586000
trusted library allocation
page read and write
4CE0000
trusted library allocation
page execute and read and write
B6CF000
stack
page read and write
14D8000
heap
page read and write
3040000
trusted library allocation
page read and write
2CF7000
trusted library allocation
page read and write
9F9000
stack
page read and write
58D0000
trusted library allocation
page execute and read and write
68E8000
trusted library allocation
page read and write
2DC1000
trusted library allocation
page read and write
5070000
trusted library allocation
page execute and read and write
189E000
stack
page read and write
D45000
trusted library allocation
page read and write
35F000
unkown
page read and write
4083000
trusted library allocation
page read and write
6E84000
trusted library allocation
page read and write
3EE6000
trusted library allocation
page read and write
8C0000
heap
page read and write
38CA000
trusted library allocation
page read and write
677F000
stack
page read and write
3F99000
trusted library allocation
page read and write
2A00000
trusted library allocation
page read and write
3F58000
trusted library allocation
page read and write
43AC000
trusted library allocation
page read and write
643F000
stack
page read and write
6AA0000
trusted library allocation
page execute and read and write
19A5000
trusted library allocation
page read and write
2800000
heap
page read and write
3F6D000
trusted library allocation
page read and write
1110000
trusted library allocation
page read and write
6A00000
trusted library allocation
page execute and read and write
4152000
trusted library allocation
page read and write
411D000
trusted library allocation
page read and write
296A000
heap
page read and write
19E0000
heap
page read and write
3F38000
trusted library allocation
page read and write
5592000
trusted library allocation
page read and write
6B7E000
stack
page read and write
3D48000
trusted library allocation
page read and write
633E000
stack
page read and write
6C1E000
stack
page read and write
3CD1000
trusted library allocation
page read and write
3445000
trusted library allocation
page read and write
DFF000
heap
page read and write
490B000
stack
page read and write
5D60000
heap
page read and write
1732000
trusted library allocation
page read and write
2A50000
heap
page execute and read and write
5116000
trusted library allocation
page read and write
19C0000
trusted library allocation
page read and write
ED8000
heap
page read and write
4142000
trusted library allocation
page read and write
6C5E000
stack
page read and write
13B6000
trusted library allocation
page execute and read and write
51FE000
stack
page read and write
64A3000
heap
page read and write
147D000
heap
page read and write
6BDE000
stack
page read and write
2FF5000
trusted library allocation
page read and write
2E00000
trusted library allocation
page read and write
55A6000
trusted library allocation
page read and write
3CFA000
trusted library allocation
page read and write
80C3000
heap
page read and write
90A000
trusted library allocation
page execute and read and write
337E000
trusted library allocation
page read and write
277B000
trusted library allocation
page read and write
32C0000
heap
page execute and read and write
355A000
trusted library allocation
page read and write
597000
stack
page read and write
1030000
trusted library allocation
page read and write
2E2C000
trusted library allocation
page read and write
69C0000
trusted library allocation
page execute and read and write
57A0000
heap
page read and write
420F000
trusted library allocation
page read and write
3D22000
trusted library allocation
page read and write
5B50000
trusted library allocation
page execute and read and write
7870000
heap
page read and write
27A0000
heap
page read and write
42EC000
trusted library allocation
page read and write
29F0000
trusted library allocation
page read and write
AE9D000
stack
page read and write
275D000
stack
page read and write
3CF2000
trusted library allocation
page read and write
55C0000
trusted library allocation
page read and write
68DA000
trusted library allocation
page read and write
6DA0000
trusted library allocation
page execute and read and write
57B2000
trusted library allocation
page read and write
30BE000
trusted library allocation
page read and write
32DE000
trusted library allocation
page read and write
2BE4000
trusted library allocation
page read and write
5E60000
trusted library allocation
page execute and read and write
13A0000
trusted library allocation
page read and write
6930000
trusted library allocation
page execute and read and write
5720000
heap
page read and write
8081000
heap
page read and write
5D8E000
heap
page read and write
13AE000
stack
page read and write
58E0000
trusted library allocation
page read and write
C73F000
stack
page read and write
42D9000
trusted library allocation
page read and write
422000
remote allocation
page execute and read and write
5754000
trusted library allocation
page read and write
3DA7000
trusted library allocation
page read and write
C24E000
stack
page read and write
69A0000
trusted library allocation
page read and write
C37E000
stack
page read and write
43DD000
trusted library allocation
page read and write
6A45000
trusted library allocation
page read and write
4172000
trusted library allocation
page read and write
29F2000
trusted library allocation
page read and write
3225000
trusted library allocation
page read and write
2BEF000
stack
page read and write
2CB9000
trusted library allocation
page read and write
6EE0000
trusted library allocation
page read and write
There are 769 hidden memdumps, click here to show them.