IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_1f403d983e4a5248d567d72b56e8042e651081_edd3b515_9dc1ee04-6c80-4698-8c9e-e110a755b055\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nexus.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Sep 8 02:05:19 2022, mtime=Thu Oct 31 18:56:55 2024, atime=Thu Sep 8 02:05:19 2022, length=5141208, window=hide
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB5DA.tmp.dmp
Mini DuMP crash report, 16 streams, Thu Oct 31 19:56:56 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB86B.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8AA.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1njmi1ls.ism.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3phr1dxb.ozf.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aqyoqvhr.nq3.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bx5nuovw.a3f.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dut21tn0.lmf.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dyylvxkb.ixm.psm1
ASCII text, with no line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\file.exe" -Force
malicious
C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
 malicious
C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nexus.lnk'); $s.TargetPath = 'C:\Windows\explorer.exe'; $s.Save()"
malicious
C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5988 -s 1176
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
There are 1 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
 malicious
http://pesterbdd.com/images/Pester.png
unknown
 malicious
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
 malicious
https://go.micro
unknown
 malicious
https://github.com/Pester/Pester
unknown
 malicious
http://nuget.org/NuGet.exe
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://contoso.com/License
unknown
https://contoso.com/Icon
unknown
https://oneget.orgX
unknown
http://upx.sf.net
unknown
https://aka.ms/pscore68
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://oneget.org
unknown
There are 5 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.196.10.218
unknown
Switzerland
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProgramId
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
FileId
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LowerCaseLongPath
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LongPathHash
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Name
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
OriginalFileName
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Publisher
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Version
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinFileVersion
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinaryType
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductName
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductVersion
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LinkDate
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinProductVersion
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
AppxPackageFullName
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
AppxPackageRelativeId
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Size
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Language
 malicious
\REGISTRY\A\{7e85ee18-cbd4-bd91-6ce7-346844bd17fd}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Usn
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance
Enabled
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
LangID
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\explorerframe.dll.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\explorerframe.dll.ApplicationCompany
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\shell32.dll.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\shell32.dll.ApplicationCompany
There are 16 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
29903B12000
trusted library allocation
page read and write
 malicious
2F1A000
heap
page read and write
371B000
stack
page read and write
EA0000
heap
page read and write
1DF752C0000
heap
page read and write
1DF101B4000
trusted library allocation
page read and write
C0000D8000
direct allocation
page read and write
2991C6CB000
heap
page read and write
1DF77195000
heap
page read and write
7FF848FB0000
trusted library allocation
page read and write
C00018C000
direct allocation
page read and write
1DF10071000
trusted library allocation
page read and write
C00009E000
direct allocation
page read and write
7FF848FCA000
trusted library allocation
page read and write
1DF75350000
trusted library allocation
page read and write
7FF848EF6000
trusted library allocation
page execute and read and write
FB990FF000
stack
page read and write
F80000
heap
page read and write
7FF849110000
trusted library allocation
page read and write
2C4F000
stack
page read and write
C0000AE000
direct allocation
page read and write
E07000
heap
page read and write
1DF76EE3000
trusted library allocation
page read and write
C000002000
direct allocation
page read and write
1DF018E2000
trusted library allocation
page read and write
C000023000
direct allocation
page read and write
C8407FE000
stack
page read and write
C00004F000
direct allocation
page read and write
2F20000
heap
page read and write
FCC000
direct allocation
page read and write
7FF849000000
trusted library allocation
page execute and read and write
2FE5000
heap
page read and write
C8406FF000
stack
page read and write
C8408FD000
stack
page read and write
C000014000
direct allocation
page read and write
7FF848E3B000
trusted library allocation
page execute and read and write
29901FFC000
heap
page read and write
DA8000
heap
page read and write
C0000C2000
direct allocation
page read and write
C00002A000
direct allocation
page read and write
1DF77400000
heap
page read and write
7FF848E27000
trusted library allocation
page read and write
7FF848EC6000
trusted library allocation
page read and write
C840C3E000
stack
page read and write
467FF000
stack
page read and write
1080000
heap
page read and write
2991BB30000
trusted library allocation
page read and write
920000
heap
page read and write
C000028000
direct allocation
page read and write
306B000
heap
page read and write
7FF849070000
trusted library allocation
page read and write
D90000
heap
page read and write
C0000BA000
direct allocation
page read and write
29902064000
heap
page read and write
C8403DE000
stack
page read and write
FB98EFE000
stack
page read and write
DC3000
heap
page read and write
7FF848FC1000
trusted library allocation
page read and write
7FF848FC0000
trusted library allocation
page read and write
29901E82000
unkown
page readonly
7FF848FE0000
trusted library allocation
page read and write
C00000E000
direct allocation
page read and write
1DF10010000
trusted library allocation
page read and write
2FCC000
heap
page read and write
C0000DC000
direct allocation
page read and write
29902305000
heap
page read and write
C000186000
direct allocation
page read and write
C00005C000
direct allocation
page read and write
C000192000
direct allocation
page read and write
1DF01C2C000
trusted library allocation
page read and write
7FF848EC0000
trusted library allocation
page read and write
C000068000
direct allocation
page read and write
7FF849100000
trusted library allocation
page read and write
1DF751C0000
heap
page read and write
7FF849018000
trusted library allocation
page read and write
FC4000
direct allocation
page read and write
2991C6C7000
heap
page read and write
7FF848FD0000
trusted library allocation
page read and write
62D000
remote allocation
page execute and read and write
2F21000
heap
page read and write
2FC2000
heap
page read and write
1DF01631000
trusted library allocation
page read and write
C000010000
direct allocation
page read and write
7FF849000000
trusted library allocation
page execute and read and write
7FF848E2B000
trusted library allocation
page read and write
7FF848E20000
trusted library allocation
page read and write
C000180000
direct allocation
page read and write
C840977000
stack
page read and write
DED000
heap
page read and write
7FF848FF0000
trusted library allocation
page read and write
C0000C0000
direct allocation
page read and write
2991C2D0000
trusted library section
page read and write
1475000
heap
page read and write
1DF75145000
heap
page read and write
2E21000
heap
page read and write
C840D3E000
stack
page read and write
C000044000
direct allocation
page read and write
29902115000
heap
page read and write
FC8000
direct allocation
page read and write
29915311000
trusted library allocation
page read and write
1DF771F6000
heap
page read and write
C000092000
direct allocation
page read and write
29902140000
heap
page read and write
C000088000
direct allocation
page read and write
1DF7723C000
heap
page read and write
7FF848FEE000
trusted library allocation
page read and write
1DF76F80000
heap
page execute and read and write
1DF77290000
heap
page read and write
C0000C8000
direct allocation
page read and write
C00010B000
direct allocation
page read and write
1DF771FA000
heap
page read and write
C00003F000
direct allocation
page read and write
1DF00001000
trusted library allocation
page read and write
7FF848E1D000
trusted library allocation
page execute and read and write
1DF7510C000
heap
page read and write
7FF848FB0000
trusted library allocation
page read and write
2991C640000
heap
page read and write
7FF849050000
trusted library allocation
page read and write
1DF75390000
trusted library allocation
page read and write
C000110000
direct allocation
page read and write
7FF848E1D000
trusted library allocation
page execute and read and write
7FF848E10000
trusted library allocation
page read and write
29901FF6000
heap
page read and write
1DF0185B000
trusted library allocation
page read and write
1085000
heap
page read and write
1DF75310000
heap
page read and write
C000016000
direct allocation
page read and write
4687E000
stack
page read and write
1DF0008A000
trusted library allocation
page read and write
2990205E000
heap
page read and write
299039F0000
heap
page execute and read and write
29902034000
heap
page read and write
C840A39000
stack
page read and write
C0000B2000
direct allocation
page read and write
E04000
heap
page read and write
8DC000
stack
page read and write
7FF848E12000
trusted library allocation
page read and write
1DF752A0000
heap
page read and write
29903AF0000
heap
page read and write
306E000
heap
page read and write
C84067F000
stack
page read and write
DA0000
heap
page read and write
C00010D000
direct allocation
page read and write
29902015000
heap
page read and write
46A7F000
stack
page read and write
C000117000
direct allocation
page read and write
7FF849160000
trusted library allocation
page read and write
29902120000
heap
page read and write
C000066000
direct allocation
page read and write
7FF848ECC000
trusted library allocation
page execute and read and write
1DF76F87000
heap
page execute and read and write
C00000C000
direct allocation
page read and write
C000012000
direct allocation
page read and write
7FF849090000
trusted library allocation
page read and write
C00008A000
direct allocation
page read and write
C000119000
direct allocation
page read and write
29902032000
heap
page read and write
C000004000
direct allocation
page read and write
3079000
heap
page read and write
29903973000
trusted library allocation
page read and write
D1E000
stack
page read and write
1DF77419000
heap
page read and write
7FF8490C0000
trusted library allocation
page read and write
1DF77370000
heap
page execute and read and write
E7C000
stack
page read and write
29901E86000
unkown
page readonly
C000064000
direct allocation
page read and write
2FCE000
heap
page read and write
7FF8490B0000
trusted library allocation
page read and write
46903000
direct allocation
page read and write
29903BEE000
trusted library allocation
page read and write
C840B3A000
stack
page read and write
7FF848E22000
trusted library allocation
page read and write
1DF77160000
heap
page read and write
1DF7741B000
heap
page read and write
2FDB000
heap
page read and write
C00018E000
direct allocation
page read and write
2991C6AA000
heap
page read and write
C00004B000
direct allocation
page read and write
7FF848E13000
trusted library allocation
page execute and read and write
7FF848E30000
trusted library allocation
page read and write
7FF849130000
trusted library allocation
page read and write
29913B01000
trusted library allocation
page read and write
2990205B000
heap
page read and write
C8409BE000
stack
page read and write
1020000
direct allocation
page read and write
C00006C000
direct allocation
page read and write
C00008E000
direct allocation
page read and write
29901E80000
unkown
page readonly
C00003D000
direct allocation
page read and write
1040000
heap
page read and write
C84178E000
stack
page read and write
1DF75102000
heap
page read and write
1DF77258000
heap
page read and write
C000049000
direct allocation
page read and write
7FF8490E0000
trusted library allocation
page read and write
2E20000
heap
page read and write
7FF848ED0000
trusted library allocation
page execute and read and write
1DF753C0000
heap
page read and write
46900000
direct allocation
page read and write
7FF848FD0000
trusted library allocation
page execute and read and write
FB994FF000
stack
page read and write
C840BBE000
stack
page read and write
695000
remote allocation
page execute and read and write
1DF7510A000
heap
page read and write
1DF750FE000
heap
page read and write
1DF01C28000
trusted library allocation
page read and write
C000098000
direct allocation
page read and write
FB995FE000
stack
page read and write
29903B01000
trusted library allocation
page read and write
2BCF000
stack
page read and write
2990201C000
heap
page read and write
C000052000
direct allocation
page read and write
1DF75315000
heap
page read and write
7FF848EC6000
trusted library allocation
page read and write
C0000CE000
direct allocation
page read and write
C00001E000
direct allocation
page read and write
C000070000
direct allocation
page read and write
7FF849120000
trusted library allocation
page read and write
29903BDB000
trusted library allocation
page read and write
469BF000
stack
page read and write
FB996FF000
stack
page read and write
1DF75380000
heap
page readonly
C00000A000
direct allocation
page read and write
7FF8490F0000
trusted library allocation
page read and write
7FF849010000
trusted library allocation
page read and write
1DF750C8000
heap
page read and write
FB98BA2000
stack
page read and write
C00004D000
direct allocation
page read and write
400000
remote allocation
page execute and read and write
46A80000
direct allocation
page read and write
1DF75370000
trusted library allocation
page read and write
C84087E000
stack
page read and write
299020F0000
heap
page read and write
1DF01B63000
trusted library allocation
page read and write
29903970000
trusted library allocation
page read and write
7FF848E2B000
trusted library allocation
page read and write
2F1D000
heap
page read and write
C84077D000
stack
page read and write
29902110000
heap
page read and write
1DF1007D000
trusted library allocation
page read and write
699000
remote allocation
page execute and read and write
C00002F000
direct allocation
page read and write
C80000
heap
page read and write
7FF848FC9000
trusted library allocation
page read and write
7FF848E14000
trusted library allocation
page read and write
1DF01887000
trusted library allocation
page read and write
C00018A000
direct allocation
page read and write
1DF00231000
trusted library allocation
page read and write
7FF848ECC000
trusted library allocation
page execute and read and write
7FF848ED0000
trusted library allocation
page execute and read and write
1470000
heap
page read and write
2A56000
stack
page read and write
2F52000
heap
page read and write
7FF848E34000
trusted library allocation
page read and write
1440000
heap
page read and write
7FF848F30000
trusted library allocation
page execute and read and write
1DF773A0000
heap
page read and write
1DF016B1000
trusted library allocation
page read and write
7FF848FE0000
trusted library allocation
page execute and read and write
C000038000
direct allocation
page read and write
7DF418660000
trusted library allocation
page execute and read and write
7FF848FF4000
trusted library allocation
page read and write
7FF8490D0000
trusted library allocation
page read and write
6DF000
remote allocation
page execute and read and write
C000113000
direct allocation
page read and write
1DF7511E000
heap
page read and write
1DF76FC0000
heap
page execute and read and write
1DF753C5000
heap
page read and write
29901F10000
heap
page read and write
2F1D000
heap
page read and write
2CCE000
stack
page read and write
FC0000
direct allocation
page read and write
FB999FD000
stack
page read and write
C840AB8000
stack
page read and write
3070000
heap
page read and write
7FF848F30000
trusted library allocation
page execute and read and write
2FD9000
heap
page read and write
C00009A000
direct allocation
page read and write
C00006E000
direct allocation
page read and write
29913B07000
trusted library allocation
page read and write
1DF75320000
heap
page read and write
1DF75106000
heap
page read and write
1048000
heap
page read and write
7FF849010000
trusted library allocation
page read and write
7FF848E14000
trusted library allocation
page read and write
7FF849170000
trusted library allocation
page read and write
FB0000
heap
page readonly
1DF00C31000
trusted library allocation
page read and write
7FF849020000
trusted library allocation
page read and write
7FF849080000
trusted library allocation
page read and write
2F1A000
heap
page read and write
29901FF0000
heap
page read and write
C840353000
stack
page read and write
299039B0000
heap
page execute and read and write
C7F000
stack
page read and write
C000198000
direct allocation
page read and write
7FF849040000
trusted library allocation
page read and write
7FF849140000
trusted library allocation
page read and write
C0000B7000
direct allocation
page read and write
1DF750C0000
heap
page read and write
7FF848E13000
trusted library allocation
page execute and read and write
C840DBB000
stack
page read and write
7FF849150000
trusted library allocation
page read and write
29902300000
heap
page read and write
C000006000
direct allocation
page read and write
7FF848EF6000
trusted library allocation
page execute and read and write
FCA000
direct allocation
page read and write
C000080000
direct allocation
page read and write
7FF848E6C000
trusted library allocation
page execute and read and write
1DF77406000
heap
page read and write
D20000
heap
page read and write
FB99BFB000
stack
page read and write
C0000DA000
direct allocation
page read and write
C000018000
direct allocation
page read and write
C00005A000
direct allocation
page read and write
FB99AFE000
stack
page read and write
1DF76EE0000
trusted library allocation
page read and write
C000109000
direct allocation
page read and write
7FF848E12000
trusted library allocation
page read and write
C000094000
direct allocation
page read and write
C00002C000
direct allocation
page read and write
2991C8F0000
heap
page read and write
C0000BE000
direct allocation
page read and write
7FF848E2D000
trusted library allocation
page execute and read and write
FB98FFE000
stack
page read and write
C0000CC000
direct allocation
page read and write
1DF77408000
heap
page read and write
1DF75149000
heap
page read and write
7FF848E3D000
trusted library allocation
page execute and read and write
C0000C6000
direct allocation
page read and write
2FB4000
heap
page read and write
C000056000
direct allocation
page read and write
7FF849060000
trusted library allocation
page read and write
C00001A000
direct allocation
page read and write
7FF849030000
trusted library allocation
page read and write
C000078000
direct allocation
page read and write
C000107000
direct allocation
page read and write
C0000C4000
direct allocation
page read and write
FB992FD000
stack
page read and write
2D7E000
stack
page read and write
1DF77040000
heap
page read and write
7FF848E20000
trusted library allocation
page read and write
7FF8490A0000
trusted library allocation
page read and write
C000058000
direct allocation
page read and write
29903940000
trusted library allocation
page read and write
FB991FE000
stack
page read and write
468FE000
stack
page read and write
29903BE3000
trusted library allocation
page read and write
2991C682000
heap
page read and write
DCE000
heap
page read and write
2E7A000
heap
page read and write
7FF848FF7000
trusted library allocation
page read and write
7FF849021000
trusted library allocation
page read and write
7FF848EC0000
trusted library allocation
page read and write
1DF7705B000
heap
page read and write
1DF10001000
trusted library allocation
page read and write
7FF848FF2000
trusted library allocation
page read and write
29903B8C000
trusted library allocation
page read and write
29903960000
trusted library allocation
page read and write
There are 350 hidden memdumps, click here to show them.