IOC Report
BqqQh4Jr7L.exe

loading gif

Files

File Path
Type
Category
Malicious
BqqQh4Jr7L.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Oh3LlYeM6Hc4fU6JG8kBRXb.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER464C.tmp.dmp
Mini DuMP crash report, 15 streams, Sat Jun 22 21:42:00 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4803.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4852.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\rage131MP.tmp
ASCII text, with no line terminators
modified
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\0KkfNlrcRm1qWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\O7KE8nvUodlUWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\OD5iAVeDXtaqWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\RPeiaMgqE3WHWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\Vw4BVaQyHMhtLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\Vx_X0jnKJEwoCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\WG8uD7f7bdsYWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\WLZTFMBUMZWbHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\aeDD7pYnP_3THistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\bzE_GuQuX4wzLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\gCOPRjU6mlYqLogin Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\gLk3dE9_lXR1History
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\n6RXdwyEVS1qHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\span7AaJtvoQ2WL1\tcATMc9tGZ4JWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\trixy7AaJtvoQ2WL1\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixy7AaJtvoQ2WL1\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixy7AaJtvoQ2WL1\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
There are 20 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\BqqQh4Jr7L.exe
"C:\Users\user\Desktop\BqqQh4Jr7L.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 1912

URLs

Name
IP
Malicious
http://77.91.77.81/mine/amadka.exe
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://ipinfo.io:443/widget/demo/8.46.123.33
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://77.91.77.81/mine/amadka.exe.com
unknown
https://duckduckgo.com/ac/?q=
unknown
http://77.91.77.81/cost/go.exe
unknown
https://ipinfo.io/widget/demo/8.46.123.33K
unknown
https://t.me/RiseProSUPPORTl
unknown
https://db-ip.com/
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://db-ip.com/Exb
unknown
https://ipinfo.io/widget/demo/8.46.123.338
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://t.me/risepro
unknown
https://t.me/risepro_botU
unknown
https://ipinfo.io/widget/demo/8.46.123.33
34.117.186.192
https://db-ip.com:443/demo/home.php?s=8.46.123.33d
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.33
unknown
https://t.me/risepro_botisepro_bot
unknown
https://db-ip.com/S
unknown
https://ipinfo.io/d
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://ipinfo.io/Q
unknown
http://77.91.77.81/cost/go.exeq
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://t.me/RiseProSUPPORT
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://www.ecosia.org/newtab/
unknown
http://77.91.77.81/mine/amadka.exeY
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://db-ip.com/g
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://t.me/risepro_bot
unknown
https://t.me/risepro_botlater
unknown
https://ipinfo.io/
34.117.186.192
http://77.91.77.81/cost/lenin.exe00.1
unknown
https://ipinfo.io/0
unknown
https://www.maxmind.com/en/locate-my-ip-address
unknown
https://t.O
unknown
https://db-ip.com/demo/home.php?s=8.46.123.33t
unknown
http://www.winimage.com/zLibDll
unknown
http://77.91.77.81/cost/lenin.exectrum
unknown
https://support.mozilla.org
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
https://db-ip.com/demo/home.php?s=8.46.123.33
104.26.4.15
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://ipinfo.io/widget/demo/8.46.123.33y6
unknown
http://77.91.77.81/cost/lenin.exe
unknown
There are 43 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ipinfo.io
34.117.186.192
db-ip.com
104.26.4.15

IPs

IP
Domain
Country
Malicious
77.91.77.66
unknown
Russian Federation
malicious
34.117.186.192
ipinfo.io
United States
104.26.4.15
db-ip.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RageMP131

Memdumps

Base Address
Regiontype
Protect
Malicious
57C6000
heap
page read and write
 malicious
57B8000
heap
page read and write
 malicious
57C6000
heap
page read and write
 malicious
57C7000
heap
page read and write
 malicious
57C7000
heap
page read and write
 malicious
E2E000
heap
page read and write
 malicious
57B8000
heap
page read and write
 malicious
57C7000
heap
page read and write
 malicious
57B8000
heap
page read and write
 malicious
5760000
heap
page read and write
 malicious
57C6000
heap
page read and write
 malicious
57BD000
heap
page read and write
E20000
heap
page read and write
5761000
heap
page read and write
400000
unkown
page readonly
2860000
direct allocation
page read and write
5AF0000
trusted library allocation
page read and write
4DCD000
stack
page read and write
980000
unkown
page execute read
2910000
heap
page read and write
E8C000
heap
page read and write
9C000
stack
page read and write
CD0000
heap
page read and write
7A8000
unkown
page execute and read and write
2A20000
direct allocation
page read and write
747000
unkown
page execute and read and write
5AF0000
trusted library allocation
page read and write
57BF000
heap
page read and write
57AC000
heap
page read and write
E7A000
heap
page read and write
499B000
heap
page read and write
5AF0000
trusted library allocation
page read and write
C9C000
heap
page read and write
749000
unkown
page execute and read and write
580E000
heap
page read and write
D70000
heap
page read and write
5AF0000
trusted library allocation
page read and write
C3E000
heap
page read and write
745000
unkown
page execute and read and write
EBE000
heap
page read and write
DB0000
direct allocation
page read and write
57B5000
heap
page read and write
596000
unkown
page read and write
5796000
heap
page read and write
DE0000
heap
page read and write
18E000
stack
page read and write
9B000
stack
page read and write
5818000
heap
page read and write
D0E000
stack
page read and write
749000
unkown
page execute and read and write
58A000
unkown
page readonly
D90000
direct allocation
page read and write
E8F000
heap
page read and write
596000
unkown
page write copy
19C000
stack
page read and write
57E0000
heap
page read and write
585000
unkown
page read and write
779000
unkown
page execute and read and write
4CCE000
stack
page read and write
D7E000
stack
page read and write
DA0000
direct allocation
page read and write
D80000
heap
page read and write
747000
unkown
page execute and read and write
F1A000
heap
page read and write
757000
unkown
page execute and read and write
C82000
heap
page read and write
DA0000
direct allocation
page read and write
CA9000
heap
page read and write
F0D000
heap
page read and write
CA4000
heap
page read and write
561F000
stack
page read and write
5AF0000
trusted library allocation
page read and write
E77000
heap
page read and write
57E7000
heap
page read and write
57D4000
heap
page read and write
585000
unkown
page read and write
5170000
remote allocation
page read and write
73F000
unkown
page execute and read and write
F1A000
heap
page read and write
292E000
stack
page read and write
F16000
heap
page read and write
E91000
heap
page read and write
4F0D000
stack
page read and write
585000
unkown
page read and write
74F000
unkown
page execute and read and write
57BD000
heap
page read and write
5AF0000
trusted library allocation
page read and write
4E0E000
stack
page read and write
DB0000
direct allocation
page read and write
57D4000
heap
page read and write
C6F000
heap
page read and write
19C000
stack
page read and write
5170000
remote allocation
page read and write
5766000
heap
page read and write
58A000
unkown
page readonly
57AC000
heap
page read and write
E75000
heap
page read and write
57DD000
heap
page read and write
BF0000
heap
page read and write
551E000
stack
page read and write
2990000
direct allocation
page read and write
7A2000
unkown
page execute and read and write
4C8E000
stack
page read and write
78E000
unkown
page execute and read and write
C73000
heap
page read and write
EA7000
heap
page read and write
400000
unkown
page readonly
58A000
unkown
page readonly
504E000
stack
page read and write
596000
unkown
page read and write
57BD000
heap
page read and write
E17000
heap
page read and write
57D4000
heap
page read and write
C20000
direct allocation
page read and write
598000
unkown
page execute and read and write
757000
unkown
page execute and read and write
58A000
unkown
page readonly
57BB000
heap
page read and write
58A000
unkown
page readonly
DB0000
direct allocation
page read and write
D90000
direct allocation
page read and write
574F000
stack
page read and write
401000
unkown
page execute read
749000
unkown
page execute and read and write
C9A000
heap
page read and write
297B000
heap
page read and write
57E6000
heap
page read and write
FAD000
heap
page read and write
57B1000
heap
page read and write
7E2000
unkown
page execute and read and write
400000
unkown
page readonly
C84000
heap
page read and write
D19000
heap
page read and write
55E000
unkown
page readonly
57D2000
heap
page read and write
57C9000
heap
page read and write
400000
unkown
page readonly
C00000
heap
page read and write
980000
unkown
page execute read
57D4000
heap
page read and write
4F0E000
stack
page read and write
4B4E000
stack
page read and write
400000
unkown
page readonly
779000
unkown
page execute and read and write
745000
unkown
page execute and read and write
7E2000
unkown
page execute and read and write
789000
unkown
page execute and read and write
F1D000
heap
page read and write
55D000
unkown
page readonly
575E000
stack
page read and write
764000
unkown
page execute and read and write
743000
unkown
page execute and read and write
58A000
unkown
page readonly
C65000
heap
page read and write
57E3000
heap
page read and write
745000
unkown
page execute and read and write
585000
unkown
page write copy
F16000
heap
page read and write
57AC000
heap
page read and write
2960000
remote allocation
page read and write
57E7000
heap
page read and write
5808000
heap
page read and write
779000
unkown
page execute and read and write
4DCE000
stack
page read and write
796000
unkown
page execute and read and write
743000
unkown
page execute and read and write
111F000
stack
page read and write
400000
unkown
page readonly
73D000
unkown
page execute and read and write
E97000
heap
page read and write
DC0000
heap
page read and write
796000
unkown
page execute and read and write
E91000
heap
page read and write
DA0000
direct allocation
page read and write
57CB000
heap
page read and write
57D0000
heap
page read and write
583000
unkown
page execute and read and write
514F000
stack
page read and write
73D000
unkown
page execute and read and write
764000
unkown
page execute and read and write
74F000
unkown
page execute and read and write
E97000
heap
page read and write
764000
unkown
page execute and read and write
57AC000
heap
page read and write
796000
unkown
page execute and read and write
789000
unkown
page execute and read and write
766000
unkown
page execute and read and write
74D000
unkown
page execute and read and write
583000
unkown
page execute and read and write
581C000
heap
page read and write
5D81000
heap
page read and write
57CA000
heap
page read and write
BF0000
heap
page read and write
596000
unkown
page read and write
2980000
heap
page read and write
D70000
heap
page read and write
57DA000
heap
page read and write
58A000
unkown
page readonly
57C9000
heap
page read and write
C89000
heap
page read and write
74F000
unkown
page execute and read and write
401000
unkown
page execute read
55D000
unkown
page readonly
2860000
direct allocation
page read and write
57E2000
heap
page read and write
57B1000
heap
page read and write
5818000
heap
page read and write
7A8000
unkown
page execute and read and write
57BD000
heap
page read and write
DA0000
direct allocation
page read and write
5824000
heap
page read and write
57D8000
heap
page read and write
5818000
heap
page read and write
F1C000
heap
page read and write
D37000
heap
page read and write
75C000
unkown
page execute and read and write
E61000
heap
page read and write
F1D000
heap
page read and write
F1A000
heap
page read and write
D0C000
heap
page read and write
980000
unkown
page execute read
9C000
stack
page read and write
565E000
stack
page read and write
CA2000
heap
page read and write
73F000
unkown
page execute and read and write
D90000
direct allocation
page read and write
7A2000
unkown
page execute and read and write
5824000
heap
page read and write
7A2000
unkown
page execute and read and write
2A6E000
stack
page read and write
57C4000
heap
page read and write
57DF000
heap
page read and write
401000
unkown
page execute read
19A000
stack
page read and write
57BD000
heap
page read and write
596000
unkown
page write copy
E6F000
heap
page read and write
57B5000
heap
page read and write
580E000
heap
page read and write
5783000
heap
page read and write
CD0000
heap
page read and write
57BD000
heap
page read and write
57B1000
heap
page read and write
596000
unkown
page write copy
5AF0000
trusted library allocation
page read and write
E8C000
heap
page read and write
C7D000
heap
page read and write
5824000
heap
page read and write
57BD000
heap
page read and write
75C000
unkown
page execute and read and write
585000
unkown
page write copy
F1E000
heap
page read and write
550E000
stack
page read and write
741000
unkown
page execute and read and write
5AF0000
trusted library allocation
page read and write
57B8000
heap
page read and write
585000
unkown
page read and write
E7C000
heap
page read and write
598000
unkown
page execute and read and write
55D000
unkown
page readonly
57E9000
heap
page read and write
766000
unkown
page execute and read and write
57E9000
heap
page read and write
596000
unkown
page read and write
57CC000
heap
page read and write
5786000
heap
page read and write
561F000
stack
page read and write
400000
unkown
page readonly
74F000
unkown
page execute and read and write
57E0000
heap
page read and write
73D000
unkown
page execute and read and write
57E6000
heap
page read and write
7A2000
unkown
page execute and read and write
57C0000
heap
page read and write
57CB000
heap
page read and write
DC5000
heap
page read and write
78E000
unkown
page execute and read and write
564E000
stack
page read and write
596000
unkown
page read and write
7A8000
unkown
page execute and read and write
4C4E000
stack
page read and write
57CE000
heap
page read and write
980000
unkown
page execute read
5170000
remote allocation
page read and write
5860000
trusted library allocation
page read and write
57AC000
heap
page read and write
401000
unkown
page execute read
5860000
trusted library allocation
page read and write
E9F000
heap
page read and write
55D000
unkown
page execute and read and write
FA0000
heap
page read and write
C3A000
heap
page read and write
57F8000
heap
page read and write
2A10000
heap
page read and write
57F8000
heap
page read and write
E89000
heap
page read and write
F1A000
heap
page read and write
C60000
heap
page read and write
E93000
heap
page read and write
57B5000
heap
page read and write
581C000
heap
page read and write
789000
unkown
page execute and read and write
E70000
heap
page read and write
DA0000
direct allocation
page read and write
766000
unkown
page execute and read and write
401000
unkown
page execute read
596000
unkown
page write copy
757000
unkown
page execute and read and write
74D000
unkown
page execute and read and write
C8C000
heap
page read and write
5809000
heap
page read and write
57AA000
heap
page read and write
57BA000
heap
page read and write
101F000
stack
page read and write
796000
unkown
page execute and read and write
980000
unkown
page execute read
D6E000
stack
page read and write
57B8000
heap
page read and write
796000
unkown
page execute and read and write
57E7000
heap
page read and write
401000
unkown
page execute read
745000
unkown
page execute and read and write
57D4000
heap
page read and write
2840000
heap
page read and write
4ECD000
stack
page read and write
57EC000
heap
page read and write
57D9000
heap
page read and write
508E000
stack
page read and write
E37000
heap
page read and write
749000
unkown
page execute and read and write
28D0000
direct allocation
page read and write
504F000
stack
page read and write
57C9000
heap
page read and write
DB0000
direct allocation
page read and write
5AF0000
trusted library allocation
page read and write
19D000
stack
page read and write
74B000
unkown
page execute and read and write
C40000
heap
page read and write
2950000
remote allocation
page read and write
D80000
direct allocation
page read and write
57CB000
heap
page read and write
980000
unkown
page execute read
2B40000
heap
page read and write
743000
unkown
page execute and read and write
55D000
unkown
page readonly
779000
unkown
page execute and read and write
55D000
unkown
page readonly
5798000
heap
page read and write
58A000
unkown
page readonly
E7F000
heap
page read and write
575E000
stack
page read and write
57ED000
heap
page read and write
74D000
unkown
page execute and read and write
491A000
heap
page read and write
57E6000
heap
page read and write
55D000
unkown
page execute and read and write
E4B000
heap
page read and write
4B53000
heap
page read and write
F1A000
heap
page read and write
580E000
heap
page read and write
57DA000
heap
page read and write
2960000
remote allocation
page read and write
401000
unkown
page execute read
D10000
heap
page read and write
F12000
heap
page read and write
57ED000
heap
page read and write
D90000
direct allocation
page read and write
E8F000
heap
page read and write
576C000
heap
page read and write
5AF0000
trusted library allocation
page read and write
D85000
heap
page read and write
D7E000
stack
page read and write
5D80000
heap
page read and write
F04000
heap
page read and write
401000
unkown
page execute read
C30000
heap
page read and write
5784000
heap
page read and write
E73000
heap
page read and write
789000
unkown
page execute and read and write
D90000
heap
page read and write
F1E000
heap
page read and write
4990000
unclassified section
page read and write
F0B000
heap
page read and write
D70000
direct allocation
page read and write
57CA000
heap
page read and write
57C1000
heap
page read and write
57DD000
heap
page read and write
55D000
unkown
page readonly
75C000
unkown
page execute and read and write
518F000
stack
page read and write
7E2000
unkown
page execute and read and write
57CA000
heap
page read and write
55D000
unkown
page readonly
BF0000
heap
page read and write
73D000
unkown
page execute and read and write
585000
unkown
page read and write
BF0000
heap
page read and write
C78000
heap
page read and write
7E2000
unkown
page execute and read and write
9B000
stack
page read and write
789000
unkown
page execute and read and write
980000
unkown
page execute read
57D4000
heap
page read and write
28CF000
stack
page read and write
7A8000
unkown
page execute and read and write
E77000
heap
page read and write
E30000
heap
page read and write
57AC000
heap
page read and write
57AC000
heap
page read and write
4D8E000
stack
page read and write
598000
unkown
page execute and read and write
57C8000
heap
page read and write
4C8E000
stack
page read and write
DA0000
direct allocation
page read and write
2990000
direct allocation
page read and write
E63000
heap
page read and write
57CE000
heap
page read and write
D80000
direct allocation
page read and write
E5E000
heap
page read and write
19D000
stack
page read and write
CB6000
heap
page read and write
743000
unkown
page execute and read and write
5AF0000
trusted library allocation
page read and write
D30000
heap
page read and write
741000
unkown
page execute and read and write
DA0000
direct allocation
page read and write
57C7000
heap
page read and write
E66000
heap
page read and write
E7C000
heap
page read and write
78E000
unkown
page execute and read and write
57DD000
heap
page read and write
57E9000
heap
page read and write
596000
unkown
page write copy
57C9000
heap
page read and write
55D000
unkown
page readonly
57CA000
heap
page read and write
57D9000
heap
page read and write
57C5000
heap
page read and write
78E000
unkown
page execute and read and write
57C0000
heap
page read and write
766000
unkown
page execute and read and write
E10000
heap
page read and write
2880000
heap
page read and write
55E000
unkown
page readonly
C20000
direct allocation
page read and write
F1A000
heap
page read and write
764000
unkown
page execute and read and write
E72000
heap
page read and write
57CE000
heap
page read and write
5860000
trusted library allocation
page read and write
C20000
direct allocation
page read and write
5AF0000
trusted library allocation
page read and write
7A8000
unkown
page execute and read and write
58A000
unkown
page readonly
F10000
heap
page read and write
E2A000
heap
page read and write
73F000
unkown
page execute and read and write
578E000
heap
page read and write
743000
unkown
page execute and read and write
980000
unkown
page execute read
75C000
unkown
page execute and read and write
741000
unkown
page execute and read and write
5784000
heap
page read and write
2970000
direct allocation
page read and write
7A2000
unkown
page execute and read and write
78E000
unkown
page execute and read and write
57F8000
heap
page read and write
F9F000
stack
page read and write
980000
unkown
page execute read
400000
unkown
page readonly
73D000
unkown
page execute and read and write
73F000
unkown
page execute and read and write
747000
unkown
page execute and read and write
747000
unkown
page execute and read and write
598000
unkown
page execute and read and write
598000
unkown
page execute and read and write
74F000
unkown
page execute and read and write
766000
unkown
page execute and read and write
2960000
remote allocation
page read and write
D1E000
stack
page read and write
E6C000
heap
page read and write
74B000
unkown
page execute and read and write
2950000
remote allocation
page read and write
57D1000
heap
page read and write
57D9000
heap
page read and write
401000
unkown
page execute read
585000
unkown
page write copy
2950000
remote allocation
page read and write
749000
unkown
page execute and read and write
57C8000
heap
page read and write
102F000
stack
page read and write
57CA000
heap
page read and write
D35000
heap
page read and write
980000
unkown
page execute read
57E3000
heap
page read and write
57C5000
heap
page read and write
57BA000
heap
page read and write
D80000
heap
page read and write
57E1000
heap
page read and write
585000
unkown
page write copy
576C000
heap
page read and write
401000
unkown
page execute read
2960000
heap
page read and write
7E2000
unkown
page execute and read and write
741000
unkown
page execute and read and write
57CE000
heap
page read and write
D90000
direct allocation
page read and write
779000
unkown
page execute and read and write
74D000
unkown
page execute and read and write
EAB000
heap
page read and write
FAA000
heap
page read and write
565E000
stack
page read and write
57A0000
heap
page read and write
400000
unkown
page readonly
500F000
stack
page read and write
57B5000
heap
page read and write
F1A000
heap
page read and write
57DC000
heap
page read and write
F16000
heap
page read and write
74D000
unkown
page execute and read and write
764000
unkown
page execute and read and write
4F4E000
stack
page read and write
745000
unkown
page execute and read and write
74B000
unkown
page execute and read and write
28F0000
heap
page read and write
58A000
unkown
page readonly
57C4000
heap
page read and write
57C8000
heap
page read and write
75C000
unkown
page execute and read and write
57C4000
heap
page read and write
747000
unkown
page execute and read and write
73F000
unkown
page execute and read and write
57F8000
heap
page read and write
F13000
heap
page read and write
F1C000
heap
page read and write
295E000
stack
page read and write
577B000
heap
page read and write
E99000
heap
page read and write
5808000
heap
page read and write
9B000
stack
page read and write
BF0000
heap
page read and write
57E8000
heap
page read and write
741000
unkown
page execute and read and write
757000
unkown
page execute and read and write
D80000
heap
page read and write
74B000
unkown
page execute and read and write
DE5000
heap
page read and write
57AC000
heap
page read and write
57CF000
heap
page read and write
57D4000
heap
page read and write
560F000
stack
page read and write
5AF0000
trusted library allocation
page read and write
57F8000
heap
page read and write
757000
unkown
page execute and read and write
57D5000
heap
page read and write
74B000
unkown
page execute and read and write
400000
unkown
page readonly
5792000
heap
page read and write
57C6000
heap
page read and write
57F2000
heap
page read and write
5809000
heap
page read and write
297A000
heap
page read and write
585000
unkown
page write copy
DA0000
direct allocation
page read and write
581D000
heap
page read and write
E66000
heap
page read and write
57CB000
heap
page read and write
551E000
stack
page read and write
There are 558 hidden memdumps, click here to show them.