IOC Report
7ZthFNAqYp.exe

loading gif

Files

File Path
Type
Category
Malicious
7ZthFNAqYp.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\Music\AttoDesignerUpdater\AttoConvertVideo.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\JJJJEBGDAFHJ\CFCFHJ
ASCII text, with very long lines (1717), with CRLF line terminators
modified
C:\ProgramData\JJJJEBGDAFHJ\CGDHIE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJJJEBGDAFHJ\DGDAEH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\JJJJEBGDAFHJ\DGDBFB
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJJJEBGDAFHJ\DHCBGD
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJJJEBGDAFHJ\DHCBGD-shm
data
dropped
C:\ProgramData\JJJJEBGDAFHJ\ECBGCG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJJJEBGDAFHJ\FBFIDB
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JJJJEBGDAFHJ\FBFIDB-shm
data
dropped
C:\ProgramData\JJJJEBGDAFHJ\GDBKJD
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\JJJJEBGDAFHJ\HDAFBA
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\JJJJEBGDAFHJ\HIJJEG
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJJJEBGDAFHJ\IJDGII
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199786602107[1].htm
HTML document, Unicode text, UTF-8 text, with very long lines (3035), with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\delays.tmp
Non-ISO extended-ASCII text, with very long lines (65536), with no line terminators
dropped
There are 13 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\7ZthFNAqYp.exe
"C:\Users\user\Desktop\7ZthFNAqYp.exe"
 malicious
C:\Users\user\Desktop\7ZthFNAqYp.exe
"C:\Users\user\Desktop\7ZthFNAqYp.exe"
 malicious

URLs

Name
IP
Malicious
https://95.217.220.103/freebl3.dll
95.217.220.103
 malicious
https://95.217.220.103/nss3.dll
95.217.220.103
 malicious
https://95.217.220.103/vcruntime140.dll
95.217.220.103
 malicious
https://95.217.220.103/mozglue.dll
95.217.220.103
 malicious
https://t.me/
unknown
 malicious
https://t.me/fun88rockskek
149.154.167.99
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://player.vimeo.com
unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199786602107
unknown
https://duckduckgo.com/ac/?q=
unknown
http://107.191.36.218/0
unknown
https://community.steamstatic.com/public/javascript/promo/stickers.js?v=W8NP8aTVqtms&l=english
unknown
https://steamcommunity.com/?subsection=broadcasts
unknown
https://95.217.220.103/G
unknown
http://cowod.hopto.org
unknown
http://cowod.hopto.orgJJK
unknown
https://community.steamstatic.com/public/shared/css/motiva_sans.css?v=v7XTmVzbLV33&l=english
unknown
https://95.217.220.103/?
unknown
https://community.steamstatic.com/public/css/globalv2.css?v=dQy8Omh4p9PH&l=english
unknown
https://store.steampowered.com/subscriber_agreement/
unknown
https://www.gstatic.cn/recaptcha/
unknown
http://www.valvesoftware.com/legal.htm
unknown
https://www.youtube.com
unknown
https://www.google.com
unknown
https://community.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&l=english
unknown
http://cowod.hopto.org_DEBUG.zip/c
unknown
http://cowod.ECBGCBFHIJJK
unknown
https://community.steamstatic.com/public/shared/css/shared_global.css?v=_CwtgIbuqQ1L&l=english
unknown
https://community.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
unknown
http://cowod.hopto.
unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
unknown
https://t.me/lpnjokeg0b4cMozilla/5.0
unknown
https://community.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
unknown
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
unknown
https://95.217.220.103/a
unknown
http://cowod.hopto
unknown
https://s.ytimg.com;
unknown
https://steam.tv/
unknown
https://community.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
http://107.191.36.218/r
unknown
https://community.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
unknown
http://store.steampowered.com/privacy_agreement/
unknown
https://community.steamstatic.com/public/css/skin_1/profilev2.css?v=t9xiI4DlPpEB&l=english
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://store.steampowered.com/points/shop/
unknown
https://t.me/lpnjoke
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://107.191.36.218/b
unknown
http://107.191.36.218:80
unknown
https://sketchfab.com
unknown
https://www.ecosia.org/newtab/
unknown
https://lv.queniujq.cn
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.youtube.com/
unknown
https://95.217.220.103/vcruntime140.dllnV
unknown
https://community.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
unknown
https://store.steampowered.com/privacy_agreement/
unknown
https://95.217.220.103AEB
unknown
https://community.steamstatic.com/public/javascript/applications/community/main.js?v=W9BXs_p_aD4Y&am
unknown
https://95.217.220.103CAA
unknown
https://steamcommunity.com/profiles/76561199786602107/inventory/
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://95.217.220.103/%
unknown
https://www.google.com/recaptcha/
unknown
https://checkout.steampowered.com/
unknown
https://community.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
unknown
https://95.217.220.103
unknown
https://t.me/fun88rockskekHn
unknown
http://107.191.36.218/
107.191.36.218
https://store.steampo
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
https://store.steampowered.com/;
unknown
https://95.217.220.103/en-GB
unknown
https://community.steamstatic.com/public/css/promo/summer2017/stickers.css?v=P8gOPraCSjV6&l=engl
unknown
https://store.steampowered.com/about/
unknown
https://steamcommunity.com/my/wishlist/
unknown
https://community.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL&l=
unknown
http://cowod.hopto.FHIJJK
unknown
https://web.telegram.org
unknown
https://help.steampowered.com/en/
unknown
https://steamcommunity.com/market/
unknown
https://store.steampowered.com/news/
unknown
https://community.steamstatic.com/public/javascript/global.js?v=7qlUmHSJhPRN&l=english
unknown
https://steamcommunity.com/profiles/76561199786602107g0b4cMozilla/5.0
unknown
https://community.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://store.steampowered.com/subscriber_agreement/
unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://recaptcha.net/recaptcha/;
unknown
https://steamcommunity.com/discussions/
unknown
https://store.steampowered.com/stats/
unknown
https://medal.tv
unknown
https://broadcast.st.dl.eccdnx.com
unknown
https://store.steampowered.com/steam_refunds/
unknown
https://community.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
unknown
https://community.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
unknown
https://community.steamstatic.com/public/shared/css/buttons.css?v=-WV9f1LdxEjq&l=english
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
steamcommunity.com
23.192.247.89
 malicious
t.me
149.154.167.99
 malicious
cowod.hopto.org
unknown

IPs

IP
Domain
Country
Malicious
23.192.247.89
steamcommunity.com
United States
malicious
95.217.220.103
unknown
Germany
malicious
149.154.167.99
t.me
United Kingdom
malicious
107.191.36.218
unknown
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AttoDesignerEditor
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214EF-0000-0000-C000-000000000046} 0xFFFF

Memdumps

Base Address
Regiontype
Protect
Malicious
920000
remote allocation
page execute and read and write
 malicious
27E0000
direct allocation
page execute and read and write
 malicious
833000
unkown
page execute and read and write
 malicious
10B7000
heap
page read and write
 malicious
11D0000
heap
page read and write
11DC000
heap
page read and write
704000
unkown
page readonly
17670000
remote allocation
page read and write
8A5000
unkown
page execute and write copy
6CC1F000
unkown
page write copy
E94000
heap
page read and write
9B51000
heap
page read and write
11DB000
heap
page read and write
4CDDB000
heap
page read and write
1195000
heap
page read and write
6CC20000
unkown
page read and write
11A5000
heap
page read and write
111A000
heap
page read and write
19C2E000
heap
page read and write
9B51000
heap
page read and write
1132000
heap
page read and write
1195000
heap
page read and write
ABE000
remote allocation
page execute and read and write
898000
unkown
page execute and write copy
118B000
heap
page read and write
19F70000
heap
page read and write
9B51000
heap
page read and write
EB0000
heap
page read and write
1117000
heap
page read and write
9B50000
heap
page read and write
10C8000
heap
page read and write
918000
unkown
page readonly
19F7E000
heap
page read and write
400000
unkown
page readonly
1139000
heap
page read and write
C9D000
stack
page read and write
11AD000
heap
page read and write
1195000
heap
page read and write
11A2000
heap
page read and write
1086000
heap
page read and write
111C000
heap
page read and write
1A21B000
heap
page read and write
9C50000
trusted library allocation
page read and write
19E90000
trusted library allocation
page read and write
E94000
heap
page read and write
109C000
heap
page read and write
E94000
heap
page read and write
9B51000
heap
page read and write
8B2000
unkown
page execute and read and write
114A000
heap
page read and write
2C66D000
heap
page read and write
1195000
heap
page read and write
9B51000
heap
page read and write
19D00000
heap
page read and write
11A6000
heap
page read and write
11C6000
heap
page read and write
1187000
heap
page read and write
1088000
heap
page read and write
19FA0000
heap
page read and write
8EC000
unkown
page readonly
E94000
heap
page read and write
9B51000
heap
page read and write
19E5B000
stack
page read and write
11D1000
heap
page read and write
11A5000
heap
page read and write
920000
heap
page read and write
1139000
heap
page read and write
11A2000
heap
page read and write
E37000
heap
page read and write
11A5000
heap
page read and write
9B51000
heap
page read and write
110A000
heap
page read and write
6CC1E000
unkown
page read and write
1030000
heap
page read and write
9B51000
heap
page read and write
11D4000
heap
page read and write
B52000
heap
page read and write
4CB0D000
stack
page read and write
704000
unkown
page readonly
1186000
heap
page read and write
E94000
heap
page read and write
1109000
heap
page read and write
17670000
remote allocation
page read and write
1508D000
stack
page read and write
2EF4000
direct allocation
page read and write
11C6000
heap
page read and write
E94000
heap
page read and write
1030E000
stack
page read and write
6CA40000
unkown
page readonly
11DE000
heap
page read and write
19C6E000
heap
page read and write
8A5000
unkown
page readonly
3E4BB000
heap
page read and write
11A2000
heap
page read and write
E94000
heap
page read and write
1140000
heap
page read and write
325D8000
heap
page read and write
9B51000
heap
page read and write
11A2000
heap
page read and write
9B51000
heap
page read and write
1198000
heap
page read and write
9B51000
heap
page read and write
11A2000
heap
page read and write
2F31000
direct allocation
page read and write
1186000
heap
page read and write
11B8000
heap
page read and write
1115000
heap
page read and write
9B51000
heap
page read and write
114C000
heap
page read and write
20020000
direct allocation
page execute and read and write
6FD00000
unkown
page readonly
400000
unkown
page readonly
2022D000
direct allocation
page execute read
9B51000
heap
page read and write
1142000
heap
page read and write
11C3000
heap
page read and write
101CE000
stack
page read and write
401000
unkown
page execute read
1196000
heap
page read and write
1047E000
stack
page read and write
9B51000
heap
page read and write
9B51000
heap
page read and write
11A2000
heap
page read and write
2A60000
direct allocation
page read and write
65E000
unkown
page readonly
11AB000
heap
page read and write
82F000
unkown
page readonly
E94000
heap
page read and write
1140000
heap
page read and write
DF0000
heap
page read and write
1195000
heap
page read and write
10C5000
heap
page read and write
E30000
heap
page read and write
38547000
heap
page read and write
AFC000
remote allocation
page execute and read and write
1113000
heap
page read and write
198000
stack
page read and write
1115000
heap
page read and write
9AE000
stack
page read and write
8AF000
unkown
page readonly
9B51000
heap
page read and write
82F000
unkown
page readonly
E94000
heap
page read and write
9B51000
heap
page read and write
96E000
stack
page read and write
11C6000
heap
page read and write
400000
unkown
page readonly
111A000
heap
page read and write
11AD000
heap
page read and write
9B51000
heap
page read and write
2026D000
direct allocation
page readonly
2EEA000
direct allocation
page read and write
12D7000
heap
page read and write
109C000
heap
page read and write
119A000
heap
page read and write
1F0000
heap
page read and write
E94000
heap
page read and write
19C76000
heap
page read and write
12B0E000
stack
page read and write
11DB000
heap
page read and write
1187000
heap
page read and write
111F000
heap
page read and write
9B51000
heap
page read and write
11B5000
heap
page read and write
19F90000
heap
page read and write
1196000
heap
page read and write
1186000
heap
page read and write
9E0000
heap
page read and write
1186000
heap
page read and write
1178000
heap
page read and write
19F78000
heap
page read and write
1FC000
stack
page read and write
11A2000
heap
page read and write
1109000
heap
page read and write
102CF000
stack
page read and write
9B51000
heap
page read and write
114B000
heap
page read and write
1A1FD000
heap
page read and write
99D000
remote allocation
page execute and read and write
8EC000
unkown
page execute and write copy
1196000
heap
page read and write
4CC0D000
stack
page read and write
114C000
heap
page read and write
11A2000
heap
page read and write
11EF000
heap
page read and write
19EF0000
trusted library allocation
page read and write
19EE0000
trusted library allocation
page read and write
11B1000
heap
page read and write
1186000
heap
page read and write
11A2000
heap
page read and write
1156000
heap
page read and write
9B51000
heap
page read and write
9B51000
heap
page read and write
B1A000
heap
page read and write
20186000
direct allocation
page execute read
11C6000
heap
page read and write
20284000
heap
page read and write
C89000
stack
page read and write
11A5000
heap
page read and write
2022F000
direct allocation
page readonly
1186000
heap
page read and write
1159000
heap
page read and write
19C0D000
heap
page read and write
898000
unkown
page readonly
9B51000
heap
page read and write
6E4000
unkown
page read and write
11DC000
heap
page read and write
1109000
heap
page read and write
E3E000
heap
page read and write
AB5000
remote allocation
page execute and read and write
B7D000
remote allocation
page execute and read and write
9C000
stack
page read and write
82F000
unkown
page readonly
1159000
heap
page read and write
11AE000
heap
page read and write
8A5000
unkown
page readonly
E94000
heap
page read and write
1260000
heap
page read and write
9B51000
heap
page read and write
6E3000
unkown
page write copy
8AF000
unkown
page execute and write copy
6CC25000
unkown
page readonly
E94000
heap
page read and write
C99000
stack
page read and write
20262000
direct allocation
page read and write
111F000
heap
page read and write
898000
unkown
page readonly
6FD7D000
unkown
page readonly
704000
unkown
page readonly
1050000
heap
page read and write
980F000
stack
page read and write
11A2000
heap
page read and write
B90000
remote allocation
page execute and read and write
767000
unkown
page readonly
11CD000
heap
page read and write
8AF000
unkown
page readonly
9B51000
heap
page read and write
1196000
heap
page read and write
6CBDF000
unkown
page readonly
E94000
heap
page read and write
6E5000
unkown
page write copy
2EDD000
direct allocation
page read and write
2E74000
direct allocation
page read and write
9B51000
heap
page read and write
19BEF000
stack
page read and write
9B51000
heap
page read and write
1A0B6000
heap
page read and write
11A2000
heap
page read and write
9B51000
heap
page read and write
11DB000
heap
page read and write
1195000
heap
page read and write
9B51000
heap
page read and write
1196000
heap
page read and write
2DAC000
direct allocation
page read and write
11C7000
heap
page read and write
9B51000
heap
page read and write
10CB000
heap
page read and write
266F2000
heap
page read and write
114C000
heap
page read and write
1114000
heap
page read and write
1134000
heap
page read and write
9B51000
heap
page read and write
9B51000
heap
page read and write
8EC000
unkown
page readonly
1186000
heap
page read and write
11AC000
heap
page read and write
767000
unkown
page readonly
1196000
heap
page read and write
176AE000
stack
page read and write
11A2000
heap
page read and write
E94000
heap
page read and write
1196000
heap
page read and write
9B51000
heap
page read and write
E94000
heap
page read and write
1149000
heap
page read and write
5ACE000
stack
page read and write
19C1D000
heap
page read and write
1198000
heap
page read and write
9B51000
heap
page read and write
19EDE000
stack
page read and write
8EF000
unkown
page execute and read and write
9B51000
heap
page read and write
1057F000
stack
page read and write
898000
unkown
page readonly
8A8000
unkown
page execute and read and write
1196000
heap
page read and write
20021000
direct allocation
page execute read
119A000
heap
page read and write
111A000
heap
page read and write
E90000
heap
page read and write
1A2C4000
heap
page read and write
111C000
heap
page read and write
11A6000
heap
page read and write
1A0BD000
heap
page read and write
11A6000
heap
page read and write
9B51000
heap
page read and write
9B51000
heap
page read and write
9B51000
heap
page read and write
B1E000
heap
page read and write
10C9000
heap
page read and write
11B1000
heap
page read and write
10B7000
heap
page read and write
1510E000
stack
page read and write
9B51000
heap
page read and write
9B51000
heap
page read and write
6E3000
unkown
page write copy
1058000
heap
page read and write
C91000
stack
page read and write
111C000
heap
page read and write
11A5000
heap
page read and write
2026A000
direct allocation
page readonly
27D0000
heap
page read and write
2043C000
stack
page read and write
9B51000
heap
page read and write
11C6000
heap
page read and write
1109000
heap
page read and write
10D4000
heap
page read and write
9B51000
heap
page read and write
105CE000
stack
page read and write
E94000
heap
page read and write
2026F000
direct allocation
page readonly
1113000
heap
page read and write
9C50000
unclassified section
page read and write
11BD000
heap
page read and write
B10000
heap
page read and write
E7E000
stack
page read and write
6E3000
unkown
page write copy
1140000
heap
page read and write
10D4000
heap
page read and write
11A2000
heap
page read and write
2EFE000
direct allocation
page read and write
20238000
direct allocation
page readonly
11C6000
heap
page read and write
8A5000
unkown
page readonly
401000
unkown
page execute read
8B8000
unkown
page readonly
9B51000
heap
page read and write
1040F000
stack
page read and write
1196000
heap
page read and write
65E000
unkown
page readonly
6FD01000
unkown
page execute read
1196000
heap
page read and write
19C01000
heap
page read and write
1186000
heap
page read and write
10C4000
heap
page read and write
118C000
heap
page read and write
9B51000
heap
page read and write
19F81000
heap
page read and write
1139000
heap
page read and write
AB8000
remote allocation
page execute and read and write
2078F000
heap
page read and write
11A2000
heap
page read and write
2730000
heap
page read and write
1149000
heap
page read and write
17670000
remote allocation
page read and write
401000
unkown
page execute read
8B8000
unkown
page readonly
11C7000
heap
page read and write
1111000
heap
page read and write
9B51000
heap
page read and write
9B51000
heap
page read and write
6FD92000
unkown
page readonly
114A000
heap
page read and write
11F8000
heap
page read and write
11DC000
heap
page read and write
1764D000
stack
page read and write
111A000
heap
page read and write
9B51000
heap
page read and write
11C1000
heap
page read and write
E94000
heap
page read and write
9B64000
heap
page read and write
1018F000
stack
page read and write
114B000
heap
page read and write
CD0000
heap
page read and write
C8D000
stack
page read and write
1008E000
stack
page read and write
65E000
unkown
page readonly
8BD000
unkown
page execute and read and write
82F000
unkown
page readonly
1186000
heap
page read and write
9B51000
heap
page read and write
9B51000
heap
page read and write
118C000
heap
page read and write
89B000
unkown
page execute and read and write
1186000
heap
page read and write
11C7000
heap
page read and write
114C000
heap
page read and write
11AC000
heap
page read and write
8B8000
unkown
page execute and write copy
111F000
heap
page read and write
1A2C2000
heap
page read and write
DEE000
stack
page read and write
19F9A000
heap
page read and write
11DB000
heap
page read and write
11C6000
heap
page read and write
11C7000
heap
page read and write
767000
unkown
page readonly
118E000
heap
page read and write
8AF000
unkown
page readonly
E94000
heap
page read and write
19CE3000
heap
page read and write
11A2000
heap
page read and write
19D5C000
stack
page read and write
12B4C000
stack
page read and write
119A000
heap
page read and write
117A000
heap
page read and write
11E7000
heap
page read and write
6FD8E000
unkown
page read and write
ADD000
remote allocation
page execute and read and write
9B51000
heap
page read and write
11B7000
heap
page read and write
8B8000
unkown
page readonly
11F3000
heap
page read and write
8EC000
unkown
page readonly
19C7E000
heap
page read and write
11B7000
heap
page read and write
20028000
direct allocation
page execute read
1195000
heap
page read and write
9B51000
heap
page read and write
767000
unkown
page readonly
6E3000
unkown
page write copy
11A5000
heap
page read and write
6CA41000
unkown
page execute read
118C000
heap
page read and write
1A0AC000
stack
page read and write
11AC000
heap
page read and write
19F79000
heap
page read and write
9B51000
heap
page read and write
11D1000
heap
page read and write
9B51000
heap
page read and write
9B51000
heap
page read and write
4695F000
stack
page read and write
1187000
heap
page read and write
9B70000
heap
page read and write
1196000
heap
page read and write
704000
unkown
page readonly
401000
unkown
page execute read
11B7000
heap
page read and write
1195000
heap
page read and write
1140000
heap
page read and write
1195000
heap
page read and write
9B60000
heap
page read and write
400000
unkown
page readonly
1195000
heap
page read and write
D0F000
stack
page read and write
2A50000
direct allocation
page execute and read and write
E94000
heap
page read and write
11AD000
heap
page read and write
11CD000
heap
page read and write
1147000
heap
page read and write
E0F000
stack
page read and write
65E000
unkown
page readonly
1140000
heap
page read and write
11E1000
heap
page read and write
There are 444 hidden memdumps, click here to show them.