IOC Report
Halkbank_Ekstre_20241022_081224_563756.exe

loading gif

Files

File Path
Type
Category
Malicious
Halkbank_Ekstre_20241022_081224_563756.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Halkbank_Ekstre_20241022_081224_563756.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmpD8B4.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\bAZAANr.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\bAZAANr.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bAZAANr.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_142fxk0j.umy.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4spchqge.hrw.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_czultcis.eod.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gtciswzl.v5s.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h1ju5ih4.n5h.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i43rkmla.x5m.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljruqizx.5re.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oilutxhm.dll.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmpF6AC.tmp
XML 1.0 document, ASCII text
dropped
There are 6 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Halkbank_Ekstre_20241022_081224_563756.exe
"C:\Users\user\Desktop\Halkbank_Ekstre_20241022_081224_563756.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Halkbank_Ekstre_20241022_081224_563756.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\bAZAANr.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bAZAANr" /XML "C:\Users\user\AppData\Local\Temp\tmpD8B4.tmp"
 malicious
C:\Users\user\Desktop\Halkbank_Ekstre_20241022_081224_563756.exe
"C:\Users\user\Desktop\Halkbank_Ekstre_20241022_081224_563756.exe"
 malicious
C:\Users\user\AppData\Roaming\bAZAANr.exe
C:\Users\user\AppData\Roaming\bAZAANr.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bAZAANr" /XML "C:\Users\user\AppData\Local\Temp\tmpF6AC.tmp"
 malicious
C:\Users\user\AppData\Roaming\bAZAANr.exe
"C:\Users\user\AppData\Roaming\bAZAANr.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://checkip.dyndns.org/
132.226.247.73
http://checkip.dyndns.comd
unknown
https://reallyfreegeoip.org/xml/173.254.250.71d
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.orgd
unknown
http://tempuri.org/DataSet1.xsd
unknown
http://reallyfreegeoip.org
unknown
http://checkip.dyndns.orgd
unknown
https://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/173.254.250.71
188.114.96.3
https://reallyfreegeoip.org/xml/173.254.250.71l
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.com
unknown
http://checkip.dyndns.org/d
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
unknown
https://api.telegram.org/bot-/sendDocument?chat_id=
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 8 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20241022_081224_563756_RASMANCS
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\bAZAANr_RASMANCS
FileDirectory
There are 19 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
37B9000
trusted library allocation
page read and write
 malicious
4FD0000
trusted library section
page read and write
 malicious
2AD4000
trusted library allocation
page read and write
AC0000
heap
page execute and read and write
B50E000
stack
page read and write
B8D000
trusted library allocation
page execute and read and write
4E81000
trusted library allocation
page read and write
3989000
trusted library allocation
page read and write
28F1000
trusted library allocation
page read and write
712E000
stack
page read and write
2BA8000
trusted library allocation
page read and write
1000000
heap
page read and write
FD7000
heap
page read and write
5FF9000
heap
page read and write
635E000
stack
page read and write
4F26000
trusted library allocation
page read and write
B92B000
stack
page read and write
5DE000
stack
page read and write
AD0000
trusted library allocation
page execute and read and write
5A20000
heap
page read and write
E13000
trusted library allocation
page execute and read and write
C90000
heap
page read and write
51C0000
heap
page execute and read and write
6F9E000
stack
page read and write
4F60000
heap
page read and write
CF0000
heap
page read and write
2B81000
trusted library allocation
page read and write
5E9E000
stack
page read and write
BB2000
trusted library allocation
page read and write
76ED000
stack
page read and write
2981000
trusted library allocation
page read and write
10DE000
stack
page read and write
4F7C000
trusted library allocation
page read and write
39F1000
trusted library allocation
page read and write
FB0000
trusted library allocation
page read and write
B95000
heap
page read and write
6150000
trusted library allocation
page execute and read and write
B17E000
stack
page read and write
D6A000
trusted library allocation
page execute and read and write
6140000
heap
page read and write
3060000
heap
page read and write
4C30000
trusted library allocation
page read and write
3320000
heap
page read and write
4EA5000
trusted library allocation
page read and write
9D5000
heap
page read and write
5170000
heap
page read and write
580000
heap
page read and write
25F8000
trusted library allocation
page read and write
F00000
heap
page read and write
304E000
unkown
page read and write
6B12000
trusted library allocation
page read and write
5180000
trusted library allocation
page execute and read and write
D80000
heap
page read and write
EB0000
trusted library allocation
page read and write
DCE000
stack
page read and write
EC0000
heap
page read and write
402000
remote allocation
page execute and read and write
5190000
trusted library allocation
page read and write
26D0000
trusted library allocation
page read and write
39BB000
trusted library allocation
page read and write
299E000
stack
page read and write
2710000
trusted library allocation
page read and write
6E1E000
stack
page read and write
7260000
trusted library allocation
page execute and read and write
26FB000
trusted library allocation
page execute and read and write
839000
stack
page read and write
963000
trusted library allocation
page execute and read and write
6250000
trusted library allocation
page read and write
3AEA000
trusted library allocation
page read and write
28DE000
trusted library allocation
page read and write
3981000
trusted library allocation
page read and write
39A5000
trusted library allocation
page read and write
4CB0000
trusted library allocation
page read and write
2BC5000
trusted library allocation
page read and write
488000
unkown
page readonly
5170000
heap
page read and write
2B3C000
trusted library allocation
page read and write
B27F000
stack
page read and write
63C5000
heap
page read and write
2BA4000
trusted library allocation
page read and write
2D5D000
stack
page read and write
2BFB000
trusted library allocation
page read and write
EF0000
heap
page execute and read and write
6700000
trusted library allocation
page read and write
3050000
heap
page read and write
295B000
trusted library allocation
page read and write
2B86000
trusted library allocation
page read and write
5010000
trusted library allocation
page execute and read and write
2A7C000
trusted library allocation
page read and write
26A0000
heap
page read and write
BA2C000
stack
page read and write
6C20000
heap
page read and write
5280000
heap
page read and write
6910000
heap
page read and write
AA0000
heap
page read and write
2AA3000
trusted library allocation
page read and write
51A0000
heap
page read and write
4DA0000
heap
page read and write
29E1000
trusted library allocation
page read and write
4EB3000
heap
page read and write
96D000
trusted library allocation
page execute and read and write
A20000
heap
page read and write
7670000
trusted library allocation
page execute and read and write
4E74000
trusted library allocation
page read and write
D43000
trusted library allocation
page execute and read and write
C80000
heap
page read and write
2690000
trusted library allocation
page read and write
631E000
stack
page read and write
3AC1000
trusted library allocation
page read and write
E20000
heap
page read and write
65DE000
stack
page read and write
4EB0000
heap
page read and write
6F50000
heap
page read and write
73EE000
stack
page read and write
4F2D000
trusted library allocation
page read and write
4E60000
trusted library allocation
page read and write
2A6E000
trusted library allocation
page read and write
2A97000
trusted library allocation
page read and write
8F7000
stack
page read and write
26EA000
trusted library allocation
page execute and read and write
29FC000
trusted library allocation
page read and write
4F40000
trusted library section
page readonly
4D30000
trusted library allocation
page read and write
C86000
heap
page read and write
4FF0000
trusted library allocation
page read and write
4F40000
trusted library allocation
page read and write
D66000
trusted library allocation
page execute and read and write
B3E000
stack
page read and write
6F36000
heap
page read and write
613E000
stack
page read and write
E14000
trusted library allocation
page read and write
60B4000
trusted library allocation
page read and write
AD2000
heap
page read and write
B4AF000
stack
page read and write
4C3B000
trusted library allocation
page read and write
B4CC000
stack
page read and write
2BB8000
trusted library allocation
page read and write
4F50000
trusted library allocation
page read and write
31BE000
stack
page read and write
400000
remote allocation
page execute and read and write
2A9D000
trusted library allocation
page read and write
4CF0000
heap
page read and write
691E000
heap
page read and write
4E70000
trusted library allocation
page read and write
982000
trusted library allocation
page read and write
D4D000
trusted library allocation
page execute and read and write
51A000
stack
page read and write
4FA0000
heap
page execute and read and write
6177000
trusted library allocation
page read and write
6C8F000
heap
page read and write
3070000
heap
page read and write
D60000
trusted library allocation
page read and write
297E000
stack
page read and write
6CBC000
heap
page read and write
2B5F000
trusted library allocation
page read and write
5460000
trusted library allocation
page read and write
5A30000
heap
page read and write
2B8C000
trusted library allocation
page read and write
27B1000
trusted library allocation
page read and write
4C90000
trusted library allocation
page read and write
4D00000
heap
page read and write
79AE000
stack
page read and write
2A1B000
trusted library allocation
page read and write
AFE000
heap
page read and write
E5A000
heap
page read and write
D72000
trusted library allocation
page read and write
590000
heap
page read and write
D7B000
trusted library allocation
page execute and read and write
25EE000
stack
page read and write
28A0000
heap
page read and write
29E9000
trusted library allocation
page read and write
4F0E000
trusted library allocation
page read and write
B7E000
unkown
page read and write
4F12000
trusted library allocation
page read and write
3A30000
trusted library allocation
page read and write
2981000
trusted library allocation
page read and write
2910000
trusted library allocation
page read and write
F97000
heap
page read and write
751E000
trusted library allocation
page read and write
2970000
heap
page read and write
71DE000
stack
page read and write
2D5F000
stack
page read and write
7A0000
heap
page read and write
AF7000
stack
page read and write
29A0000
trusted library allocation
page read and write
BA6E000
stack
page read and write
4C51000
trusted library allocation
page read and write
970000
trusted library allocation
page read and write
29EC000
trusted library allocation
page read and write
6710000
heap
page read and write
B60000
heap
page read and write
29FE000
trusted library allocation
page read and write
6CAD000
heap
page read and write
26DD000
trusted library allocation
page execute and read and write
4FC5000
heap
page read and write
275E000
stack
page read and write
B32000
heap
page read and write
4D22000
trusted library allocation
page read and write
E30000
heap
page read and write
A8D000
stack
page read and write
FB6000
trusted library allocation
page read and write
4E64000
trusted library allocation
page read and write
2AC1000
trusted library allocation
page read and write
B5AE000
stack
page read and write
98A000
trusted library allocation
page execute and read and write
3B31000
trusted library allocation
page read and write
B70000
trusted library allocation
page read and write
60E0000
trusted library allocation
page read and write
2902000
trusted library allocation
page read and write
2A59000
trusted library allocation
page read and write
4F90000
trusted library allocation
page execute and read and write
93E000
stack
page read and write
6C57000
heap
page read and write
AFB000
heap
page read and write
5020000
heap
page read and write
26E0000
trusted library allocation
page read and write
66F0000
trusted library allocation
page execute and read and write
26F0000
trusted library allocation
page read and write
52B0000
heap
page execute and read and write
317E000
unkown
page read and write
D75000
trusted library allocation
page execute and read and write
BB0000
trusted library allocation
page read and write
BC2000
trusted library allocation
page read and write
2DF0000
heap
page read and write
4F42000
trusted library allocation
page read and write
6F64000
heap
page read and write
A49000
heap
page read and write
4C4E000
trusted library allocation
page read and write
31FF000
stack
page read and write
ACA000
stack
page read and write
5000000
trusted library allocation
page read and write
2A34000
trusted library allocation
page read and write
4BBE000
stack
page read and write
53BE000
stack
page read and write
28F6000
trusted library allocation
page read and write
FC0000
trusted library allocation
page read and write
75D0000
trusted library allocation
page read and write
60D0000
trusted library allocation
page execute and read and write
2950000
trusted library allocation
page read and write
5FA0000
heap
page read and write
2890000
trusted library allocation
page execute and read and write
D30000
trusted library allocation
page read and write
3AF9000
trusted library allocation
page read and write
6F8C000
heap
page read and write
3F0000
unkown
page readonly
CC5000
heap
page read and write
6CC3000
heap
page read and write
28D6000
trusted library allocation
page read and write
D5D000
trusted library allocation
page execute and read and write
39BC000
trusted library allocation
page read and write
5023000
heap
page read and write
3B43000
trusted library allocation
page read and write
66E0000
trusted library allocation
page read and write
51EE000
stack
page read and write
290E000
trusted library allocation
page read and write
F8C000
stack
page read and write
756E000
stack
page read and write
4FDD000
stack
page read and write
4C5D000
trusted library allocation
page read and write
6EF0000
heap
page read and write
288D000
stack
page read and write
3BF4000
trusted library allocation
page read and write
60BD000
trusted library allocation
page read and write
4D9B000
stack
page read and write
6E5E000
stack
page read and write
4B1B000
stack
page read and write
EEE000
stack
page read and write
4C80000
trusted library allocation
page read and write
4E87000
trusted library allocation
page read and write
4988000
trusted library allocation
page read and write
5F9F000
stack
page read and write
709E000
stack
page read and write
D44000
trusted library allocation
page read and write
6B2E000
heap
page read and write
4A7E000
stack
page read and write
F90000
heap
page execute and read and write
E1D000
trusted library allocation
page execute and read and write
2914000
trusted library allocation
page read and write
5270000
trusted library allocation
page read and write
6C48000
heap
page read and write
3AED000
trusted library allocation
page read and write
4C70000
trusted library allocation
page read and write
2ABE000
stack
page read and write
4EA0000
trusted library allocation
page read and write
639F000
stack
page read and write
AF0000
heap
page read and write
70DE000
stack
page read and write
37B1000
trusted library allocation
page read and write
7680000
trusted library allocation
page read and write
4F30000
trusted library allocation
page execute and read and write
415000
remote allocation
page execute and read and write
7520000
trusted library allocation
page read and write
E67000
heap
page read and write
B3CC000
stack
page read and write
7510000
trusted library allocation
page read and write
2AB1000
trusted library allocation
page read and write
992000
trusted library allocation
page read and write
766F000
stack
page read and write
2CD0000
heap
page read and write
964000
trusted library allocation
page read and write
514B000
stack
page read and write
772E000
stack
page read and write
980000
trusted library allocation
page read and write
BE0000
heap
page read and write
614A000
trusted library allocation
page read and write
538D000
stack
page read and write
F1F000
heap
page read and write
7270000
trusted library allocation
page execute and read and write
73AE000
stack
page read and write
AF7000
stack
page read and write
2ADE000
trusted library allocation
page read and write
60C0000
trusted library allocation
page execute and read and write
2A64000
trusted library allocation
page read and write
75DE000
trusted library allocation
page read and write
F28000
heap
page read and write
2DFA000
heap
page read and write
4F32000
trusted library allocation
page read and write
B17000
heap
page read and write
D62000
trusted library allocation
page read and write
2A91000
trusted library allocation
page read and write
EF0000
trusted library allocation
page execute and read and write
2A38000
trusted library allocation
page read and write
A28000
heap
page read and write
621E000
stack
page read and write
3A91000
trusted library allocation
page read and write
7B0000
heap
page read and write
7570000
trusted library section
page read and write
55C0000
trusted library allocation
page execute and read and write
55D0000
trusted library allocation
page read and write
4F1E000
trusted library allocation
page read and write
B90000
heap
page read and write
B6AE000
stack
page read and write
DFE000
stack
page read and write
BB6F000
stack
page read and write
7960000
trusted library allocation
page read and write
BEA000
heap
page read and write
6260000
trusted library allocation
page execute and read and write
7A0D000
stack
page read and write
2A5E000
trusted library allocation
page read and write
28DB000
trusted library allocation
page read and write
EAE000
stack
page read and write
F26000
heap
page read and write
3F2000
unkown
page readonly
5150000
trusted library section
page readonly
2A27000
trusted library allocation
page read and write
52A0000
trusted library allocation
page read and write
B83000
trusted library allocation
page execute and read and write
6EF9000
heap
page read and write
C23000
heap
page read and write
FFF000
stack
page read and write
B84000
trusted library allocation
page read and write
BBA000
trusted library allocation
page execute and read and write
A71000
heap
page read and write
2D99000
stack
page read and write
97D000
trusted library allocation
page execute and read and write
6144000
trusted library allocation
page read and write
41A000
remote allocation
page execute and read and write
2920000
heap
page read and write
6C7D000
heap
page read and write
BBF000
unkown
page read and write
4F50000
trusted library allocation
page read and write
7FA000
stack
page read and write
5FA8000
heap
page read and write
960000
trusted library allocation
page read and write
5030000
heap
page execute and read and write
75E0000
trusted library allocation
page read and write
6240000
trusted library allocation
page read and write
E00000
trusted library allocation
page read and write
FB4000
trusted library allocation
page read and write
63A0000
heap
page read and write
4C56000
trusted library allocation
page read and write
2B40000
trusted library allocation
page read and write
7950000
trusted library allocation
page execute and read and write
9C0000
heap
page read and write
47EC000
stack
page read and write
2930000
trusted library allocation
page read and write
29E4000
trusted library allocation
page read and write
CEE000
stack
page read and write
3AE4000
trusted library allocation
page read and write
B6B0000
heap
page read and write
66DE000
stack
page read and write
2A80000
trusted library allocation
page read and write
CB9000
heap
page read and write
3981000
trusted library allocation
page read and write
28C0000
trusted library allocation
page read and write
C00000
heap
page read and write
60E7000
trusted library allocation
page read and write
4F80000
trusted library allocation
page read and write
F90000
heap
page read and write
BAA000
heap
page read and write
4F0B000
trusted library allocation
page read and write
AE0000
trusted library allocation
page read and write
2B9F000
trusted library allocation
page read and write
B24000
heap
page read and write
5285000
heap
page read and write
9D0000
heap
page read and write
6180000
trusted library allocation
page read and write
BA0000
trusted library allocation
page read and write
4F00000
trusted library allocation
page read and write
72AE000
stack
page read and write
416000
remote allocation
page execute and read and write
26F5000
trusted library allocation
page execute and read and write
6270000
trusted library allocation
page read and write
937000
stack
page read and write
6B95000
heap
page read and write
CC0000
heap
page read and write
4F1A000
trusted library allocation
page read and write
27AE000
stack
page read and write
74EE000
stack
page read and write
E38000
heap
page read and write
986000
trusted library allocation
page execute and read and write
B80000
trusted library allocation
page read and write
26F7000
trusted library allocation
page execute and read and write
BAD000
trusted library allocation
page execute and read and write
60FE000
stack
page read and write
997000
trusted library allocation
page execute and read and write
29B0000
heap
page execute and read and write
9CE000
stack
page read and write
6C3F000
heap
page read and write
B60E000
stack
page read and write
62A0000
heap
page read and write
4F50000
heap
page read and write
4EC0000
trusted library allocation
page read and write
D40000
trusted library allocation
page read and write
27CB000
trusted library allocation
page read and write
6C80000
heap
page read and write
513D000
stack
page read and write
6C35000
heap
page read and write
4D10000
trusted library allocation
page execute and read and write
4F44000
trusted library allocation
page read and write
39D0000
trusted library allocation
page read and write
950000
trusted library allocation
page read and write
6F53000
heap
page read and write
6146000
trusted library allocation
page read and write
4E92000
trusted library allocation
page read and write
716E000
stack
page read and write
3218000
heap
page read and write
39CF000
trusted library allocation
page read and write
CC1000
heap
page read and write
99B000
trusted library allocation
page execute and read and write
4F70000
trusted library allocation
page read and write
4F40000
trusted library allocation
page read and write
6B20000
heap
page read and write
2BB4000
trusted library allocation
page read and write
7969000
trusted library allocation
page read and write
279E000
stack
page read and write
CF0000
heap
page read and write
48EC000
stack
page read and write
5150000
heap
page read and write
60BA000
trusted library allocation
page read and write
D77000
trusted library allocation
page execute and read and write
ACB000
heap
page read and write
4DA3000
heap
page read and write
5FA2000
heap
page read and write
2D1E000
stack
page read and write
26F2000
trusted library allocation
page read and write
702E000
stack
page read and write
5160000
heap
page read and write
27C9000
trusted library allocation
page read and write
412000
remote allocation
page execute and read and write
C7E000
stack
page read and write
4E6C000
trusted library allocation
page read and write
3B9B000
trusted library allocation
page read and write
6C4F000
heap
page read and write
28EA000
trusted library allocation
page read and write
762E000
stack
page read and write
27A0000
trusted library allocation
page execute and read and write
4EE0000
trusted library allocation
page read and write
E10000
trusted library allocation
page read and write
28BE000
stack
page read and write
28D0000
trusted library allocation
page read and write
B30000
heap
page read and write
4F70000
trusted library allocation
page execute and read and write
2A3C000
trusted library allocation
page read and write
CEE000
stack
page read and write
4E7E000
trusted library allocation
page read and write
DD0000
heap
page read and write
BCB000
trusted library allocation
page execute and read and write
AF9000
heap
page read and write
4D20000
trusted library allocation
page read and write
543E000
stack
page read and write
6F62000
heap
page read and write
772E000
stack
page read and write
5020000
trusted library allocation
page execute and read and write
B0D000
heap
page read and write
4E8D000
trusted library allocation
page read and write
BC7000
trusted library allocation
page execute and read and write
6F5E000
stack
page read and write
3000000
heap
page read and write
2C81000
trusted library allocation
page read and write
3B59000
trusted library allocation
page read and write
26E6000
trusted library allocation
page execute and read and write
7FE000
stack
page read and write
2BBE000
trusted library allocation
page read and write
A55000
heap
page read and write
2997000
trusted library allocation
page read and write
2A77000
trusted library allocation
page read and write
28EE000
trusted library allocation
page read and write
726F000
stack
page read and write
9C5000
heap
page read and write
4C62000
trusted library allocation
page read and write
ED0000
heap
page read and write
27B0000
heap
page read and write
5140000
heap
page read and write
3210000
heap
page read and write
6740000
heap
page read and write
C08000
heap
page read and write
4C34000
trusted library allocation
page read and write
2B95000
trusted library allocation
page read and write
4F21000
trusted library allocation
page read and write
4F46000
trusted library allocation
page read and write
BB6000
trusted library allocation
page execute and read and write
4C85000
trusted library allocation
page read and write
4FC0000
heap
page read and write
28FD000
trusted library allocation
page read and write
4E1D000
stack
page read and write
C15000
heap
page read and write
4F20000
heap
page read and write
FD0000
heap
page read and write
2D60000
heap
page read and write
C96000
heap
page read and write
9B0000
trusted library allocation
page read and write
4F80000
trusted library allocation
page read and write
6F01000
heap
page read and write
F4E000
stack
page read and write
28E2000
trusted library allocation
page read and write
3B70000
trusted library allocation
page read and write
73A000
stack
page read and write
BEE000
heap
page read and write
2923000
heap
page read and write
62B0000
heap
page read and write
FA0000
trusted library allocation
page read and write
4F06000
trusted library allocation
page read and write
60B6000
trusted library allocation
page read and write
6170000
trusted library allocation
page read and write
980000
heap
page read and write
7A4E000
stack
page read and write
ADE000
heap
page read and write
6160000
trusted library allocation
page execute and read and write
2BCB000
trusted library allocation
page read and write
60A0000
trusted library allocation
page read and write
64A0000
heap
page read and write
D50000
trusted library allocation
page read and write
There are 533 hidden memdumps, click here to show them.