IOC Report
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe

loading gif

Files

File Path
Type
Category
Malicious
a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\EHDHIDAEHC.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mine[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\BFCAAEHJDBKJ\AAKEGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BFCAAEHJDBKJ\CFCFHJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\BFCAAEHJDBKJ\CGDHIE
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\BFCAAEHJDBKJ\ECFHJK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BFCAAEHJDBKJ\FHDAEH
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\BFCAAEHJDBKJ\GCAFCA
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\BFCAAEHJDBKJ\IDGDAA
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BFCAAEHJDBKJ\IJKKKF
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BFCAAEHJDBKJ\IJKKKF-shm
data
dropped
C:\ProgramData\BFCAAEHJDBKJ\JDAKJD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\BFCAAEHJDBKJ\JDAKJD-shm
data
dropped
C:\ProgramData\HCBAKJEHDBGH\BGIJDG
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\HCBAKJEHDBGH\IIIEBG
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EHDHIDAEHC.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199747278259[1].htm
HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\76561199747278259[1].htm
HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
dropped
There are 15 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe
"C:\Users\user\Desktop\a8fb80b6e9d920c26922b29171e8301d5d4d9d4f20cd1b07cad94234b27c61be_payload.exe"
 malicious
C:\ProgramData\EHDHIDAEHC.exe
"C:\ProgramData\EHDHIDAEHC.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BFCAAEHJDBKJ" & exit
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout /t 10

URLs

Name
IP
Malicious
https://168.119.176.241/t
unknown
 malicious
https://168.119.176.241/s
unknown
 malicious
https://168.119.176.241/r
unknown
 malicious
https://168.119.176.241/r5
unknown
 malicious
https://168.119.176.241/sqls.dllI
unknown
 malicious
https://168.119.176.241/sqls.dll_
unknown
 malicious
http://arpdabl.zapto.org
unknown
 malicious
https://168.119.176.241/s_1l
unknown
 malicious
https://168.119.176.241/softokn3.dll
168.119.176.241
 malicious
https://168.119.176.241938.132
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://168.119.176.241/qo
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=Dbzy
unknown
https://duckduckgo.com/ac/?q=
unknown
https://168.119.176.241/z:O
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
http://tempuri.org/
unknown
https://www.gstatic.cn/recaptcha/
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
unknown
http://www.valvesoftware.com/legal.htm
unknown
https://www.youtube.com
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
unknown
http://5.0
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
unknown
http://arpdabl.DAECIIDGD
unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
unknown
https://steamcommunity.com/profiles/76561199747278259/badges
unknown
https://168.119.176.241/259H
unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
unknown
https://s.ytimg.com;
unknown
https://168.119.176.241/K
unknown
http://schemas.datacontract.org/2004/07/DInvalidGlobalDataContractNamespace
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
https://168.119.176.241/ECD
unknown
https://168.119.176.241/0
unknown
https://168.119.176.241/RCHAR
unknown
https://168.119.176.241/8
unknown
https://168.119.176.241/6
unknown
https://168.119.176.241/$
unknown
http://store.steampowered.com/privacy_agr
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://steamcommunity.com/profiles/76561199747278259gi_z2Mozilla/5.0
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://168.119.176.241/vcruntime140.dll
168.119.176.241
https://www.ecosia.org/newtab/
unknown
https://lv.queniujq.cn
unknown
https://www.youtube.com/
unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17ontdrvhost.exe
unknown
https://168.119.176.241/&
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
unknown
https://168.119.176.241ocal
unknown
https://168.119.176.241/msvcp140.dll
168.119.176.241
https://www.google.com/recaptcha/
unknown
https://checkout.steampowered.com/
unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
unknown
http://arpdabl.FCBFHIIDGD
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
unknown
https://168.119.176.241/graphy
unknown
https://t.me/armad2ahellosqls.dllsqlite3.dllIn
unknown
https://help.steampowered.com/en/
unknown
https://community.akamai.steamstatic.com/
unknown
https://steamcommunity.com/profiles/76561199747278259/inventory/
unknown
https://recaptcha.net/recaptcha/;
unknown
https://168.119.176.241
unknown
https://168.119.176.241/nss3.dllf
unknown
https://168.119.176.241/41
unknown
https://broadcast.st.dl.eccdnx.com
unknown
http://147.45.44.104/steals/mine.exea
unknown
https://steamcommunity.com/workshop/
unknown
https://login.steampowered.com/
unknown
https://store.steampowered.com/legal/
unknown
http://64532127VdtSrezylanAPTHSymMatchStringInternetSetOptionAHttpQueryInfoAdbghelp.dllSetThreadCont
unknown
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://147.45.44.104/steals/mine.exe1kkkkles
unknown
http://arpdabl.zaptoIIDGD
unknown
https://store.steampowered.com/
unknown
https://168.119.176.241/key%
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=GG0UCGgA
unknown
https://168.119.176.241/(%f
unknown
http://127.0.0.1:27060
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
unknown
http://arpdabl.zapto.IDGD
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://168.119.176.241/mozglue.dllU
unknown
https://api.steampowered.com/
unknown
https://store.steampowered.com/mobile
unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199747278259
unknown
http://147.45.44.104/steals/mine.exe
147.45.44.104
https://168.119.176.241/Microsoft
unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=zGRpBs82SFHJ&a
unknown
https://player.vimeo.com
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17exe
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
steamcommunity.com
104.102.49.249
 malicious
arpdabl.zapto.org
38.180.132.96
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
104.102.49.249
steamcommunity.com
United States
malicious
38.180.132.96
arpdabl.zapto.org
United States
147.45.44.104
unknown
Russian Federation
168.119.176.241
unknown
Germany

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214EF-0000-0000-C000-000000000046} 0xFFFF

Memdumps

Base Address
Regiontype
Protect
Malicious
436C000
trusted library allocation
page read and write
 malicious
3EC0000
trusted library allocation
page read and write
 malicious
2FC9000
trusted library allocation
page read and write
 malicious
325C000
heap
page read and write
 malicious
3F0000
unkown
page readonly
 malicious
439A000
trusted library allocation
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
3F0000
unkown
page readonly
 malicious
3E93000
trusted library allocation
page read and write
 malicious
3237000
heap
page read and write
 malicious
3310000
heap
page read and write
5BFE000
stack
page read and write
3321000
heap
page read and write
32BC000
heap
page read and write
3319000
heap
page read and write
3307000
heap
page read and write
358C9000
heap
page read and write
32C4000
heap
page read and write
2DDF000
stack
page read and write
12D6000
trusted library allocation
page read and write
2EF9000
trusted library allocation
page read and write
3315000
heap
page read and write
F7D000
stack
page read and write
31BA000
heap
page read and write
5820000
heap
page read and write
32C4000
heap
page read and write
3B838000
heap
page read and write
32B4000
heap
page read and write
14B0000
trusted library allocation
page execute and read and write
32BA000
heap
page read and write
331A000
heap
page read and write
6C330000
unkown
page readonly
102DE000
stack
page read and write
2272C000
heap
page read and write
3074000
heap
page read and write
3074000
heap
page read and write
1FF76000
direct allocation
page execute read
12EA000
trusted library allocation
page execute and read and write
62A000
remote allocation
page execute and read and write
600000
unkown
page readonly
331B000
heap
page read and write
3074000
heap
page read and write
14E0E000
stack
page read and write
1344000
heap
page read and write
2F14000
trusted library allocation
page read and write
1540000
trusted library allocation
page read and write
2D50000
heap
page read and write
3136000
heap
page read and write
426C000
trusted library allocation
page read and write
332C000
heap
page read and write
2F31000
stack
page read and write
3241000
heap
page read and write
43C7000
trusted library allocation
page read and write
6C50E000
unkown
page read and write
2E4E000
stack
page read and write
3307000
heap
page read and write
32B2000
heap
page read and write
10C3000
trusted library allocation
page execute and read and write
3241000
heap
page read and write
3074000
heap
page read and write
2F61000
trusted library allocation
page read and write
3275000
heap
page read and write
250C6000
direct allocation
page execute read
2F29000
trusted library allocation
page read and write
3074000
heap
page read and write
251A2000
direct allocation
page read and write
32EE000
heap
page read and write
3310000
heap
page read and write
3074000
heap
page read and write
54F000
remote allocation
page execute and read and write
32FF000
heap
page read and write
5A5E000
stack
page read and write
1152000
heap
page read and write
6C331000
unkown
page execute read
201AE000
stack
page read and write
B912000
heap
page read and write
2F2B000
trusted library allocation
page read and write
2016D000
stack
page read and write
2FB5000
trusted library allocation
page read and write
1468F000
stack
page read and write
2D9E000
stack
page read and write
B7B000
stack
page read and write
253D0000
trusted library allocation
page read and write
323F000
heap
page read and write
275F4000
heap
page read and write
1019E000
stack
page read and write
12F0000
trusted library allocation
page read and write
3307000
heap
page read and write
32E9000
heap
page read and write
2F4A000
trusted library allocation
page read and write
341E000
heap
page read and write
2F7F000
trusted library allocation
page read and write
24F50000
heap
page read and write
3074000
heap
page read and write
3321000
heap
page read and write
2F0C000
trusted library allocation
page read and write
33B8000
heap
page read and write
1196000
heap
page read and write
B912000
heap
page read and write
4FA000
unkown
page read and write
139E000
stack
page read and write
32C0000
heap
page read and write
417A2000
heap
page read and write
1DBCD000
stack
page read and write
341B000
heap
page read and write
3307000
heap
page read and write
527000
remote allocation
page execute and read and write
2FBB000
trusted library allocation
page read and write
5715000
heap
page read and write
1112000
heap
page read and write
51F000
unkown
page read and write
2F8D000
trusted library allocation
page read and write
10FE000
stack
page read and write
1310000
trusted library allocation
page read and write
5E3E000
stack
page read and write
FE0000
heap
page read and write
1164000
heap
page read and write
276B9000
heap
page read and write
104D000
stack
page read and write
10D8000
heap
page read and write
135E000
stack
page read and write
305E000
stack
page read and write
19EA9000
heap
page read and write
3319000
heap
page read and write
33BD000
heap
page read and write
2FA6000
trusted library allocation
page read and write
7C2E000
stack
page read and write
12C0000
heap
page read and write
3320000
heap
page read and write
22710000
heap
page read and write
32B2000
heap
page read and write
3319000
heap
page read and write
530000
remote allocation
page execute and read and write
12DD000
trusted library allocation
page execute and read and write
117A000
heap
page read and write
710000
heap
page read and write
1753E000
stack
page read and write
B911000
heap
page read and write
25178000
direct allocation
page readonly
3074000
heap
page read and write
3315000
heap
page read and write
32C1000
heap
page read and write
EF7000
stack
page read and write
32C3000
heap
page read and write
6C30D000
unkown
page readonly
2FBF000
trusted library allocation
page read and write
3310000
heap
page read and write
201AE000
stack
page read and write
32BC000
heap
page read and write
1414000
heap
page read and write
3320000
heap
page read and write
32AF000
heap
page read and write
19ABC000
heap
page read and write
30FE000
stack
page read and write
6C50F000
unkown
page write copy
6C291000
unkown
page execute read
3315000
heap
page read and write
19AA0000
heap
page read and write
3074000
heap
page read and write
323C000
heap
page read and write
3074000
heap
page read and write
3310000
heap
page read and write
327F000
heap
page read and write
408000
unkown
page read and write
33C7000
heap
page read and write
3319000
heap
page read and write
3321000
heap
page read and write
19A90000
heap
page read and write
3074000
heap
page read and write
19BEB000
stack
page read and write
174AE000
stack
page read and write
2CEC000
stack
page read and write
32FD000
heap
page read and write
12DA000
trusted library allocation
page read and write
AD2000
unkown
page readonly
32C4000
heap
page read and write
5DFBC000
stack
page read and write
3310000
heap
page read and write
1285D000
stack
page read and write
227F1000
heap
page read and write
2271B000
heap
page read and write
3319000
heap
page read and write
3074000
heap
page read and write
274AD000
heap
page read and write
32A6000
heap
page read and write
32F6000
heap
page read and write
2EF7000
trusted library allocation
page read and write
3305000
heap
page read and write
6C515000
unkown
page readonly
2FA2000
trusted library allocation
page read and write
2005A000
direct allocation
page readonly
4C10000
heap
page read and write
2005F000
direct allocation
page readonly
12A0000
heap
page read and write
2E50000
heap
page execute and read and write
2FAC000
trusted library allocation
page read and write
3307000
heap
page read and write
3319000
heap
page read and write
A16E000
stack
page read and write
BA10000
unclassified section
page read and write
20170000
remote allocation
page read and write
3220000
heap
page read and write
1055000
heap
page read and write
31BE000
heap
page read and write
32C1000
heap
page read and write
2F7E000
stack
page read and write
3320000
heap
page read and write
14F6D000
stack
page read and write
3241000
heap
page read and write
3307000
heap
page read and write
2F93000
trusted library allocation
page read and write
32C4000
heap
page read and write
2F2D000
stack
page read and write
1119000
heap
page read and write
13B6000
heap
page read and write
4D676000
heap
page read and write
19D62000
heap
page read and write
400000
unkown
page read and write
19D50000
heap
page read and write
47710000
heap
page read and write
2F40000
trusted library allocation
page read and write
32BF000
heap
page read and write
32AB000
heap
page read and write
6C31E000
unkown
page read and write
32C4000
heap
page read and write
314F000
stack
page read and write
B922000
heap
page read and write
4F7000
unkown
page read and write
2E61000
trusted library allocation
page read and write
3307000
heap
page read and write
14DE000
trusted library allocation
page read and write
2F5B000
trusted library allocation
page read and write
226EF000
stack
page read and write
2FD0000
trusted library allocation
page read and write
3074000
heap
page read and write
14F0F000
stack
page read and write
24F68000
direct allocation
page execute read
B912000
heap
page read and write
54B0000
trusted library allocation
page execute and read and write
3EEE000
trusted library allocation
page read and write
115E000
stack
page read and write
32FF000
heap
page read and write
19E9E000
stack
page read and write
11A0000
heap
page read and write
6C4CF000
unkown
page readonly
22785000
heap
page read and write
32ED000
heap
page read and write
3307000
heap
page read and write
3319000
heap
page read and write
3310000
heap
page read and write
4E68000
trusted library allocation
page read and write
332C000
heap
page read and write
2CAC000
stack
page read and write
3074000
heap
page read and write
6C322000
unkown
page readonly
19AAB000
heap
page read and write
1190000
heap
page read and write
25472000
heap
page read and write
2F1B000
trusted library allocation
page read and write
2516D000
direct allocation
page execute read
2FC1000
trusted library allocation
page read and write
434000
remote allocation
page execute and read and write
2F952000
heap
page read and write
3307000
heap
page read and write
15A0000
heap
page read and write
2F8B000
trusted library allocation
page read and write
32E8000
heap
page read and write
63B000
remote allocation
page execute and read and write
32B8000
heap
page read and write
3074000
heap
page read and write
2FBE000
stack
page read and write
331B000
heap
page read and write
2FC5000
trusted library allocation
page read and write
5D7000
unkown
page read and write
ADC000
unkown
page readonly
10DE000
heap
page read and write
1DC0C000
stack
page read and write
24F60000
direct allocation
page execute and read and write
3319000
heap
page read and write
323F000
heap
page read and write
24F61000
direct allocation
page execute read
13A0000
heap
page read and write
3310000
heap
page read and write
1333000
heap
page read and write
32B2000
heap
page read and write
3317000
heap
page read and write
2F89000
trusted library allocation
page read and write
3D1000
unkown
page execute read
2F35000
trusted library allocation
page read and write
1404000
heap
page read and write
3241000
heap
page read and write
330B000
heap
page read and write
32B2000
heap
page read and write
32EF000
heap
page read and write
2F79000
trusted library allocation
page read and write
3326000
heap
page read and write
32F9000
heap
page read and write
13C3000
heap
page read and write
55D0000
trusted library section
page read and write
255A0000
trusted library allocation
page read and write
BE0000
heap
page read and write
827F000
stack
page read and write
11B0000
heap
page read and write
2F72000
trusted library allocation
page read and write
19B0C000
heap
page read and write
AD0000
unkown
page readonly
323C000
heap
page read and write
32AB000
heap
page read and write
56E000
remote allocation
page execute and read and write
24D9B000
stack
page read and write
1FE11000
direct allocation
page execute read
331B000
heap
page read and write
2F42000
trusted library allocation
page read and write
3FFE000
trusted library allocation
page read and write
5BA7C000
stack
page read and write
3074000
heap
page read and write
1B64F000
stack
page read and write
1590000
trusted library allocation
page read and write
2F12000
trusted library allocation
page read and write
F73000
stack
page read and write
330A000
heap
page read and write
3319000
heap
page read and write
3307000
heap
page read and write
32AB000
heap
page read and write
1B68D000
stack
page read and write
2014C000
stack
page read and write
12C8000
heap
page read and write
12CF000
stack
page read and write
20028000
direct allocation
page readonly
3235000
heap
page read and write
53B0000
trusted library section
page read and write
500000
unkown
page read and write
2FAE000
trusted library allocation
page read and write
BF0000
heap
page read and write
32ED000
heap
page read and write
2FA8000
trusted library allocation
page read and write
25780000
heap
page read and write
404000
unkown
page read and write
2F48000
trusted library allocation
page read and write
AEA000
unkown
page readonly
B912000
heap
page read and write
12FB000
trusted library allocation
page execute and read and write
1FE18000
direct allocation
page execute read
2F76000
trusted library allocation
page read and write
2F70000
trusted library allocation
page read and write
3E61000
trusted library allocation
page read and write
32C4000
heap
page read and write
B912000
heap
page read and write
2F4C000
trusted library allocation
page read and write
4FFE000
stack
page read and write
B912000
heap
page read and write
3070000
heap
page read and write
1100000
heap
page read and write
341A000
heap
page read and write
323F000
heap
page read and write
3074000
heap
page read and write
2F44000
trusted library allocation
page read and write
2F91000
trusted library allocation
page read and write
2F33000
trusted library allocation
page read and write
32E8000
heap
page read and write
3318000
heap
page read and write
53D0000
trusted library allocation
page read and write
3D1000
unkown
page execute read
53E000
unkown
page read and write
1548000
trusted library allocation
page read and write
2277D000
heap
page read and write
32FF000
heap
page read and write
3235000
heap
page read and write
1412000
heap
page read and write
3E65000
trusted library allocation
page read and write
32F8000
heap
page read and write
55BE000
stack
page read and write
32B3000
heap
page read and write
3310000
heap
page read and write
1323000
heap
page read and write
3307000
heap
page read and write
3310000
heap
page read and write
14C1000
trusted library allocation
page read and write
14AF000
stack
page read and write
10B0000
trusted library allocation
page read and write
6C290000
unkown
page readonly
32CA000
heap
page read and write
10C4000
trusted library allocation
page read and write
323C000
heap
page read and write
3074000
heap
page read and write
3300000
heap
page read and write
25C92000
heap
page read and write
22700000
heap
page read and write
3305000
heap
page read and write
5720000
heap
page read and write
2F0E000
trusted library allocation
page read and write
12F7000
trusted library allocation
page execute and read and write
B912000
heap
page read and write
3074000
heap
page read and write
2F31000
trusted library allocation
page read and write
27612000
heap
page read and write
1910E000
stack
page read and write
255DC000
stack
page read and write
3307000
heap
page read and write
2005D000
direct allocation
page readonly
2F46000
trusted library allocation
page read and write
3310000
heap
page read and write
3310000
heap
page read and write
14E0000
trusted library allocation
page read and write
2F8F000
trusted library allocation
page read and write
32B2000
heap
page read and write
2546A000
heap
page read and write
32B3000
heap
page read and write
323C000
heap
page read and write
1050000
heap
page read and write
2DE0000
heap
page read and write
20052000
direct allocation
page read and write
3332000
heap
page read and write
32C4000
heap
page read and write
32B6000
heap
page read and write
10F7000
heap
page read and write
3317000
heap
page read and write
1393000
heap
page read and write
6C510000
unkown
page read and write
1110000
heap
page read and write
3D0000
unkown
page readonly
100E000
stack
page read and write
327F000
heap
page read and write
2F3A000
stack
page read and write
32C4000
heap
page read and write
24F1E000
stack
page read and write
3321000
heap
page read and write
1351000
heap
page read and write
3307000
heap
page read and write
323C000
heap
page read and write
10C0000
trusted library allocation
page read and write
32CA000
heap
page read and write
55C0000
heap
page execute and read and write
3074000
heap
page read and write
B912000
heap
page read and write
2001D000
direct allocation
page execute read
2EFB000
trusted library allocation
page read and write
332D000
heap
page read and write
602000
unkown
page readonly
24DD1000
heap
page read and write
32FF000
heap
page read and write
1029F000
stack
page read and write
1308000
heap
page read and write
3130000
heap
page read and write
3306000
heap
page read and write
2F2F000
trusted library allocation
page read and write
1500000
trusted library allocation
page read and write
14D5000
trusted library allocation
page read and write
32BF000
heap
page read and write
3202000
heap
page read and write
1070000
heap
page read and write
3D0000
unkown
page readonly
32E8000
heap
page read and write
E7C000
stack
page read and write
3310000
heap
page read and write
2F10000
trusted library allocation
page read and write
3304000
heap
page read and write
19EB0000
heap
page read and write
1FE10000
direct allocation
page execute and read and write
158E000
stack
page read and write
3310000
heap
page read and write
3241000
heap
page read and write
32B9000
heap
page read and write
B912000
heap
page read and write
32B3000
heap
page read and write
119E000
heap
page read and write
5480000
heap
page read and write
202AE000
stack
page read and write
19CEC000
stack
page read and write
B911000
heap
page read and write
5ABE000
stack
page read and write
330C000
heap
page read and write
2FBD000
trusted library allocation
page read and write
251AD000
direct allocation
page readonly
60D000
unkown
page readonly
2559C000
stack
page read and write
2285B000
stack
page read and write
52A000
remote allocation
page execute and read and write
5CFF000
stack
page read and write
63D000
remote allocation
page execute and read and write
251AF000
direct allocation
page readonly
14D9D000
stack
page read and write
2F3C000
stack
page read and write
33C1000
heap
page read and write
10D0000
heap
page read and write
32AB000
heap
page read and write
32F6000
heap
page read and write
60B000
unkown
page read and write
2001F000
direct allocation
page readonly
13BE000
heap
page read and write
33C0000
heap
page read and write
9A20000
unclassified section
page read and write
14C6000
trusted library allocation
page read and write
B912000
heap
page read and write
14F0000
trusted library allocation
page read and write
3074000
heap
page read and write
2F5D000
trusted library allocation
page read and write
3327000
heap
page read and write
B912000
heap
page read and write
2578A000
heap
page read and write
2FAA000
trusted library allocation
page read and write
276BB000
heap
page read and write
2F27000
trusted library allocation
page read and write
323E000
heap
page read and write
2278D000
heap
page read and write
3310000
heap
page read and write
32B2000
heap
page read and write
20170000
remote allocation
page read and write
B911000
heap
page read and write
323C000
heap
page read and write
7F0000
heap
page read and write
2FC3000
trusted library allocation
page read and write
2273D000
heap
page read and write
2F87000
trusted library allocation
page read and write
2F5F000
trusted library allocation
page read and write
32BE000
heap
page read and write
20170000
remote allocation
page read and write
31B0000
heap
page read and write
3074000
heap
page read and write
31E0000
heap
page read and write
19FF0000
heap
page read and write
332D000
heap
page read and write
317E000
stack
page read and write
3FA000
unkown
page read and write
32C4000
heap
page read and write
6AC000
stack
page read and write
5D3F000
stack
page read and write
3310000
heap
page read and write
3319000
heap
page read and write
2EFE000
trusted library allocation
page read and write
32EF000
heap
page read and write
3319000
heap
page read and write
32BC000
heap
page read and write
19A7F000
stack
page read and write
3000000
heap
page read and write
2F95000
trusted library allocation
page read and write
3F8000
unkown
page write copy
12E6000
trusted library allocation
page execute and read and write
2516F000
direct allocation
page readonly
12D3000
trusted library allocation
page read and write
2F6C000
trusted library allocation
page read and write
274B4000
heap
page read and write
1A0B5000
heap
page read and write
32FF000
heap
page read and write
3F8000
unkown
page write copy
430000
remote allocation
page execute and read and write
14D9000
trusted library allocation
page read and write
10CD000
trusted library allocation
page execute and read and write
3074000
heap
page read and write
5634000
trusted library section
page read and write
3074000
heap
page read and write
331C000
heap
page read and write
595E000
stack
page read and write
114E000
heap
page read and write
2F4F000
trusted library allocation
page read and write
251AA000
direct allocation
page readonly
5BBE000
stack
page read and write
5710000
heap
page read and write
32B2000
heap
page read and write
32F1000
heap
page read and write
12E0000
trusted library allocation
page read and write
60D000
unkown
page readonly
331C000
heap
page read and write
3334000
heap
page read and write
2F18000
trusted library allocation
page read and write
323F000
heap
page read and write
30BE000
stack
page read and write
3334000
heap
page read and write
25466000
heap
page read and write
16BCF000
stack
page read and write
2FEF000
trusted library allocation
page read and write
32B2000
heap
page read and write
32F6000
heap
page read and write
2F2D000
trusted library allocation
page read and write
2F16000
trusted library allocation
page read and write
1110000
heap
page read and write
438000
remote allocation
page execute and read and write
3074000
heap
page read and write
3310000
heap
page read and write
25474000
heap
page read and write
2546E000
heap
page read and write
3074000
heap
page read and write
32A7000
heap
page read and write
3310000
heap
page read and write
2FB1000
trusted library allocation
page read and write
5A60000
trusted library allocation
page execute and read and write
2F94E000
stack
page read and write
2F74000
trusted library allocation
page read and write
310E000
stack
page read and write
1A0B7000
heap
page read and write
32E8000
heap
page read and write
607000
remote allocation
page execute and read and write
19ACD000
heap
page read and write
5D3E000
stack
page read and write
1281E000
stack
page read and write
2F6E000
trusted library allocation
page read and write
313E000
heap
page read and write
32ED000
heap
page read and write
1A00E000
heap
page read and write
33BD000
heap
page read and write
331C000
heap
page read and write
24DD0000
trusted library allocation
page read and write
32FC000
heap
page read and write
1530000
heap
page read and write
There are 594 hidden memdumps, click here to show them.