IOC Report
random.exe

loading gif

Files

File Path
Type
Category
Malicious
random.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\random.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\cEp3d38.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\random.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\random.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\autoit3.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\autoit3.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\common files.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\common files.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\google.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\google.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\internet explorer.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\internet explorer.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\java.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\java.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\jdownloader.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\jdownloader.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\microsoft office.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\microsoft office.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\microsoft.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\microsoft.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\microsoft.net.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\microsoft.net.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\mozilla maintenance service.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\mozilla maintenance service.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\msbuild.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\msbuild.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\msecache.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\msecache.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\reference assemblies.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\reference assemblies.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\OneDrive\windows defender.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\windows mail.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\windows media player.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\windows multimedia platform.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\windows nt.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\windows photo viewer.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\windows portable devices.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\windows sidebar.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\OneDrive\windowspowershell.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\random.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 5 08:16:09 2023, mtime=Wed Jan 15 16:10:42 2025, atime=Wed Jan 15 16:09:58 2025, length=38400, window=hide
dropped
C:\Users\user\OneDrive\windows defender.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\OneDrive\windows mail.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\OneDrive\windows media player.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\OneDrive\windows multimedia platform.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\OneDrive\windows nt.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\OneDrive\windows photo viewer.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\OneDrive\windows portable devices.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\OneDrive\windows sidebar.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\OneDrive\windowspowershell.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
\Device\Null
ASCII text, with CRLF line terminators
dropped
There are 43 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\random.exe
"C:\Users\user\Desktop\random.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /SC ONLOGON /TN "TaskHelper" /TR "C:\Users\user\Desktop\random.exe" /F
 malicious
C:\Users\user\Desktop\random.exe
C:\Users\user\Desktop\random.exe
 malicious
C:\Users\user\Desktop\random.exe
"C:\Users\user\Desktop\random.exe"
malicious
C:\Users\user\Desktop\random.exe
"C:\Users\user\Desktop\random.exe"
malicious
C:\Users\user\AppData\Roaming\cEp3d38.exe
"C:\Users\user\AppData\Roaming\cEp3d38.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C ping 1.1.1.1 -n 1 -w 4000 > Nul & Del "C:\Users\user\Desktop\random.exe"
 malicious
C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 4000
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://87.120.126.5/VmCetSC7/page.php
87.120.126.5
 malicious
http://tmpfiles.org/dl/19480319/anubis.exe
104.21.21.16
http://87.120.126.5
unknown
http://tmpfiles.orgd
unknown
https://tmpfiles.org
unknown
http://tmpfiles.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://87.120.126.5/VmCetSC7/page.phpP
unknown
https://tmpfiles.org/dl/19480319/anubis.exe
104.21.21.16

Domains

Name
IP
Malicious
tmpfiles.org
104.21.21.16
s-part-0017.t-0009.t-msedge.net
13.107.246.45

IPs

IP
Domain
Country
Malicious
87.120.126.5
unknown
Bulgaria
malicious
104.21.21.16
tmpfiles.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
TaskHelper
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\random_RASMANCS
FileDirectory
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
69B9000
heap
page read and write
 malicious
CF2000
unkown
page readonly
 malicious
30C4000
trusted library allocation
page read and write
50AE000
stack
page read and write
10D4000
trusted library allocation
page read and write
19C000
stack
page read and write
1510000
trusted library allocation
page execute and read and write
4D4E000
stack
page read and write
11C0000
heap
page read and write
6DFE000
stack
page read and write
12B3000
trusted library allocation
page execute and read and write
30D0000
trusted library allocation
page read and write
3121000
trusted library allocation
page read and write
233F000
stack
page read and write
32C7000
trusted library allocation
page read and write
3380000
trusted library allocation
page read and write
5B5B000
stack
page read and write
7ED000
stack
page read and write
11B0000
trusted library allocation
page read and write
1316000
heap
page read and write
C8E000
stack
page read and write
2A3D000
stack
page read and write
7EE000
stack
page read and write
32CA000
trusted library allocation
page read and write
11A0000
trusted library allocation
page execute and read and write
64E000
heap
page read and write
760000
trusted library allocation
page read and write
33B1000
trusted library allocation
page read and write
ED0000
heap
page read and write
504E000
stack
page read and write
9CF000
stack
page read and write
12B0000
trusted library allocation
page read and write
4F4E000
stack
page read and write
518D000
stack
page read and write
6110000
heap
page read and write
7E4000
heap
page read and write
673000
heap
page read and write
54AE000
stack
page read and write
12D6000
trusted library allocation
page execute and read and write
F07000
heap
page read and write
9D0000
trusted library allocation
page read and write
2BCA000
heap
page read and write
16AE000
stack
page read and write
52DF000
stack
page read and write
267E000
stack
page read and write
2BC0000
heap
page read and write
119D000
stack
page read and write
4ECF000
stack
page read and write
3365000
trusted library allocation
page read and write
3681000
trusted library allocation
page read and write
38C000
stack
page read and write
9DD000
trusted library allocation
page execute and read and write
4E9F000
stack
page read and write
880000
heap
page read and write
2681000
trusted library allocation
page read and write
12CD000
trusted library allocation
page execute and read and write
9F0000
heap
page read and write
5E99000
stack
page read and write
ED8000
heap
page read and write
4D8E000
stack
page read and write
9E4000
trusted library allocation
page read and write
572E000
stack
page read and write
4FAE000
stack
page read and write
2C6E000
stack
page read and write
2B80000
heap
page read and write
687000
heap
page read and write
7EB000
heap
page read and write
3F0000
heap
page read and write
750000
trusted library allocation
page read and write
4B3E000
stack
page read and write
599E000
stack
page read and write
BCE000
stack
page read and write
190000
heap
page read and write
695F000
heap
page read and write
301E000
stack
page read and write
14EB000
trusted library allocation
page execute and read and write
48EE000
stack
page read and write
AD0000
trusted library allocation
page read and write
78B000
trusted library allocation
page execute and read and write
7F9000
heap
page read and write
6F5F000
stack
page read and write
3098000
trusted library allocation
page read and write
145E000
unkown
page read and write
A0B000
trusted library allocation
page execute and read and write
339F000
trusted library allocation
page read and write
32DE000
trusted library allocation
page read and write
DF0000
heap
page read and write
48DE000
stack
page read and write
31A2000
trusted library allocation
page read and write
564F000
stack
page read and write
10F7000
trusted library allocation
page execute and read and write
3361000
trusted library allocation
page read and write
787000
trusted library allocation
page execute and read and write
40ED000
trusted library allocation
page read and write
641E000
stack
page read and write
491E000
stack
page read and write
7C0000
heap
page read and write
655E000
stack
page read and write
4A7E000
stack
page read and write
1500000
trusted library allocation
page read and write
753000
trusted library allocation
page execute and read and write
5B1E000
stack
page read and write
14E5000
trusted library allocation
page execute and read and write
B30000
trusted library allocation
page execute and read and write
CF0000
unkown
page readonly
9E0000
heap
page read and write
1323000
heap
page read and write
3326000
trusted library allocation
page read and write
14E7000
trusted library allocation
page execute and read and write
2420000
heap
page read and write
2340000
trusted library allocation
page read and write
500000
heap
page read and write
2E90000
heap
page execute and read and write
12EE000
heap
page read and write
14E0000
trusted library allocation
page read and write
70DE000
stack
page read and write
D90000
heap
page read and write
443E000
stack
page read and write
2B7E000
stack
page read and write
C4F000
stack
page read and write
2F5F000
unkown
page read and write
50EE000
stack
page read and write
223E000
stack
page read and write
121C000
stack
page read and write
2A7A000
stack
page read and write
A50000
heap
page read and write
3384000
trusted library allocation
page read and write
6A4D000
stack
page read and write
7FB000
heap
page read and write
2DCD000
stack
page read and write
75D000
trusted library allocation
page execute and read and write
13BC000
heap
page read and write
65A0000
heap
page read and write
4D0D000
stack
page read and write
32C1000
trusted library allocation
page read and write
651E000
stack
page read and write
AE0000
trusted library allocation
page read and write
30DB000
trusted library allocation
page read and write
745000
heap
page read and write
A70000
trusted library allocation
page read and write
13DD000
heap
page read and write
5F9D000
stack
page read and write
66C000
heap
page read and write
60A0000
trusted library allocation
page execute and read and write
4FC000
stack
page read and write
97C000
stack
page read and write
84F000
stack
page read and write
3315000
trusted library allocation
page read and write
6CBE000
stack
page read and write
2B90000
heap
page read and write
9D3000
trusted library allocation
page execute and read and write
3EA1000
trusted library allocation
page read and write
59DD000
stack
page read and write
1590000
trusted library allocation
page read and write
7DF000
heap
page read and write
4F2E000
stack
page read and write
2D81000
heap
page read and write
5510000
trusted library allocation
page read and write
453E000
stack
page read and write
12B4000
trusted library allocation
page read and write
D50000
heap
page execute and read and write
6B50000
trusted library allocation
page execute and read and write
7F890000
trusted library allocation
page execute and read and write
536F000
stack
page read and write
2340000
trusted library allocation
page read and write
AD4000
trusted library allocation
page read and write
4B7E000
stack
page read and write
10D0000
trusted library allocation
page read and write
33A7000
trusted library allocation
page read and write
1520000
trusted library allocation
page read and write
5530000
trusted library allocation
page execute and read and write
550E000
stack
page read and write
1777000
heap
page read and write
3431000
trusted library allocation
page read and write
195000
heap
page read and write
6F9E000
stack
page read and write
4B3E000
stack
page read and write
709F000
stack
page read and write
6BBD000
stack
page read and write
AC0000
trusted library allocation
page read and write
14BE000
stack
page read and write
640000
heap
page read and write
15A7000
heap
page read and write
ECD000
trusted library allocation
page execute and read and write
3070000
trusted library allocation
page read and write
67A000
heap
page read and write
32CD000
trusted library allocation
page read and write
4B7E000
stack
page read and write
5D9F000
stack
page read and write
6910000
heap
page read and write
64A000
heap
page read and write
4AFE000
stack
page read and write
5ADD000
stack
page read and write
6BC000
heap
page read and write
30C6000
trusted library allocation
page read and write
4E4E000
stack
page read and write
3076000
trusted library allocation
page read and write
12A0000
trusted library allocation
page read and write
4F6E000
stack
page read and write
452E000
stack
page read and write
740000
heap
page read and write
53A0000
heap
page execute and read and write
40B5000
trusted library allocation
page read and write
126E000
stack
page read and write
2B3E000
unkown
page read and write
2370000
heap
page execute and read and write
2CAE000
stack
page read and write
63D9000
stack
page read and write
32E3000
trusted library allocation
page read and write
6981000
heap
page read and write
3080000
heap
page execute and read and write
4D4E000
stack
page read and write
11D0000
heap
page read and write
233E000
stack
page read and write
2EA1000
trusted library allocation
page read and write
12BD000
trusted library allocation
page execute and read and write
2D60000
heap
page read and write
DB0000
trusted library allocation
page read and write
60E000
stack
page read and write
4C9F000
stack
page read and write
3373000
trusted library allocation
page read and write
CFC000
unkown
page readonly
2E8D000
stack
page read and write
A4E000
stack
page read and write
A50000
heap
page read and write
595E000
stack
page read and write
A30000
heap
page execute and read and write
2D67000
heap
page read and write
1380000
trusted library allocation
page read and write
A90000
heap
page read and write
AA0000
heap
page read and write
870000
trusted library allocation
page read and write
D7E000
stack
page read and write
12E0000
heap
page read and write
55AE000
stack
page read and write
48AE000
stack
page read and write
CFC000
stack
page read and write
4970000
heap
page execute and read and write
A90000
heap
page read and write
13CA000
heap
page read and write
630000
heap
page read and write
681000
heap
page read and write
12D2000
trusted library allocation
page read and write
5C9A000
stack
page read and write
477E000
stack
page read and write
1220000
heap
page read and write
2CC0000
heap
page read and write
78D000
stack
page read and write
4D0E000
stack
page read and write
12D0000
trusted library allocation
page read and write
141E000
unkown
page read and write
EC3000
trusted library allocation
page execute and read and write
33AF000
trusted library allocation
page read and write
31D0000
heap
page read and write
6934000
heap
page read and write
EFA000
heap
page read and write
2E4E000
stack
page read and write
DC0000
heap
page read and write
4E8E000
stack
page read and write
8CE000
stack
page read and write
B40000
heap
page read and write
6B4D000
stack
page read and write
D8C000
stack
page read and write
5540000
heap
page execute and read and write
D9E000
stack
page read and write
10CE000
stack
page read and write
32BE000
trusted library allocation
page read and write
305F000
stack
page read and write
6B1000
heap
page read and write
B07000
trusted library allocation
page execute and read and write
12E8000
heap
page read and write
680E000
stack
page read and write
1344000
heap
page read and write
B0B000
trusted library allocation
page execute and read and write
674000
heap
page read and write
5520000
trusted library allocation
page read and write
115E000
stack
page read and write
EC0000
trusted library allocation
page read and write
690D000
stack
page read and write
9D4000
trusted library allocation
page read and write
2E0E000
stack
page read and write
56EF000
stack
page read and write
10FC000
stack
page read and write
657000
heap
page read and write
A07000
trusted library allocation
page execute and read and write
ADD000
trusted library allocation
page execute and read and write
4890000
trusted library allocation
page read and write
496D000
stack
page read and write
12C000
stack
page read and write
2DCE000
stack
page read and write
740000
trusted library allocation
page read and write
14E2000
trusted library allocation
page read and write
5B9D000
stack
page read and write
12C0000
trusted library allocation
page read and write
568E000
stack
page read and write
6ED000
stack
page read and write
D40000
trusted library allocation
page read and write
2361000
trusted library allocation
page read and write
A8F000
stack
page read and write
66CE000
stack
page read and write
4091000
trusted library allocation
page read and write
65C0000
heap
page read and write
DD0000
heap
page read and write
AE4000
trusted library allocation
page read and write
650000
heap
page read and write
A0F000
stack
page read and write
A40000
trusted library allocation
page execute and read and write
58CE000
stack
page read and write
4930000
heap
page execute and read and write
551A000
trusted library allocation
page read and write
319E000
trusted library allocation
page read and write
6B60000
heap
page read and write
EF2000
heap
page read and write
492E000
stack
page read and write
6FB000
stack
page read and write
550000
heap
page read and write
57CE000
stack
page read and write
C90000
heap
page read and write
5FA0000
heap
page read and write
10FB000
trusted library allocation
page execute and read and write
EC4000
trusted library allocation
page read and write
4E8E000
stack
page read and write
4D9E000
stack
page read and write
4B90000
heap
page execute and read and write
4FC000
stack
page read and write
576E000
stack
page read and write
4B7E000
stack
page read and write
EB0000
trusted library allocation
page read and write
9E0000
trusted library allocation
page read and write
2E10000
heap
page read and write
4A3F000
stack
page read and write
A9E000
unkown
page read and write
12CF000
stack
page read and write
10F0000
trusted library allocation
page read and write
1530000
heap
page read and write
7C8000
heap
page read and write
2431000
trusted library allocation
page read and write
32B6000
trusted library allocation
page read and write
73E000
stack
page read and write
30C9000
trusted library allocation
page read and write
754000
trusted library allocation
page read and write
13C0000
heap
page read and write
4ECE000
stack
page read and write
90F000
stack
page read and write
54E000
stack
page read and write
764000
trusted library allocation
page read and write
790000
heap
page read and write
1B0000
heap
page read and write
6CFE000
stack
page read and write
1110000
trusted library allocation
page read and write
30E1000
trusted library allocation
page read and write
1770000
heap
page read and write
60B0000
trusted library allocation
page read and write
3091000
trusted library allocation
page read and write
55EE000
stack
page read and write
512F000
stack
page read and write
58AF000
stack
page read and write
4F0E000
stack
page read and write
2350000
heap
page read and write
A50000
heap
page read and write
B80000
heap
page read and write
4C7E000
stack
page read and write
1FD000
stack
page read and write
2D84000
heap
page read and write
57AE000
stack
page read and write
71DF000
stack
page read and write
AD3000
trusted library allocation
page execute and read and write
DC5000
heap
page read and write
305B000
stack
page read and write
1470000
trusted library allocation
page read and write
578F000
stack
page read and write
30DE000
trusted library allocation
page read and write
12DA000
trusted library allocation
page execute and read and write
D3E000
stack
page read and write
157E000
stack
page read and write
2AB0000
heap
page read and write
7F0000
trusted library allocation
page execute and read and write
1A0000
heap
page read and write
800000
heap
page read and write
338F000
trusted library allocation
page read and write
15A0000
heap
page read and write
4C7E000
stack
page read and write
2AFE000
unkown
page read and write
6E5E000
stack
page read and write
There are 374 hidden memdumps, click here to show them.