IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\DGHIECGCBK.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\IDGDAAKFHI.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\KECFIDGCBF.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\userBAEBGCFIEH.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\userBGDBKKFHIE.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
CSV text
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2ae906657_snd[1].exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2afc5abea_vasd[1].exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\66fa2b049020f_ldnf[1].exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2afc5abea_vasd[1].exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\66fa2b049020f_ldnf[1].exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\AKJDGIEHCAEHIEBFBKKKKFIDBK
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\BGDAKEHIIDGD\HCBFIJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\BKKKEGIDBGHIDGDHDBFH
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FBFIDBFHDBGI\AAFHII
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\FBFIDBFHDBGI\AAKKEC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FBFIDBFHDBGI\BAEBGH
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FBFIDBFHDBGI\BAEBGH-shm
data
dropped
C:\ProgramData\FBFIDBFHDBGI\CBKJJJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FBFIDBFHDBGI\DAKFID
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FBFIDBFHDBGI\DAKFID-shm
data
dropped
C:\ProgramData\FBFIDBFHDBGI\ECFHJK
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FBFIDBFHDBGI\HJJEHJ
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\FBFIDBFHDBGI\KEGDAK
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\FHDAFIIDAKJDGDHIDAKJJJEHCF
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\FIEHIIIJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GDGIJECGDGCBKECAKFBG
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\HDAFBAEBKJKF\AFCBKF
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\HDHCGHDHIDHCBGCBGCAE
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\IECGHJKKJDHIEBFHCAKEHIDGHC
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\JJECGHJD
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DGHIECGCBK.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IDGDAAKFHI.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KECFIDGCBF.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userBAEBGCFIEH.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\userBGDBKKFHIE.exe.log
CSV text
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\delays.tmp
OpenPGP Secret Key
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 49 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\IDGDAAKFHI.exe
"C:\ProgramData\IDGDAAKFHI.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\DGHIECGCBK.exe
"C:\ProgramData\DGHIECGCBK.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\KECFIDGCBF.exe
"C:\ProgramData\KECFIDGCBF.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\userBGDBKKFHIE.exe
"C:\Users\userBGDBKKFHIE.exe"
malicious
C:\Users\userBAEBGCFIEH.exe
"C:\Users\userBAEBGCFIEH.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FBFIDBFHDBGI" & exit
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout /t 10
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGDBKKFHIE.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBAEBGCFIEH.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 19 hidden processes, click here to show them.

URLs

Name
IP
Malicious
commandejorsk.site
malicious
http://urusvisa.com/mozglue.dll
5.42.101.62
 malicious
http://46.8.231.109/c4754d4f680ead72.php
46.8.231.109
 malicious
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
46.8.231.109
 malicious
http://urusvisa.com/softokn3.dll
5.42.101.62
 malicious
http://files.veritas.org.ng/ldms/66fa2ae906657_snd.exe)
unknown
 malicious
agentyanlark.site
malicious
http://files.veritas.org.ng/ldms/66fa2afc5abea_vasd.exeta;
unknown
 malicious
http://files.veritas.org.ng/ldms/66fa2ae906657_snd.exe
147.45.44.104
 malicious
http://urusvisa.com/sql.dll
5.42.101.62
 malicious
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
46.8.231.109
 malicious
http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exe
147.45.44.104
 malicious
underlinemdsj.site
malicious
http://urusvisa.com/freebl3.dll
5.42.101.62
 malicious
possiwreeste.site
malicious
https://steamcommunity.com/profiles/76561199724331900
104.102.49.254
 malicious
https://possiwreeste.site/api
172.67.205.129
 malicious
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
46.8.231.109
 malicious
http://urusvisa.com/vcruntime140.dll
5.42.101.62
 malicious
bellykmrebk.site
malicious
http://46.8.231.109
unknown
 malicious
http://files.veritas.org.ng/ldms/66fa2b049020f_ldnf.exeommonProxyStub.dll
unknown
 malicious
https://t.me/jamsemlg
149.154.167.99
 malicious
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
46.8.231.109
 malicious
https://steamcommunity.com/profiles/76561199724331900J2
unknown
 malicious
https://t.me/
unknown
 malicious
https://player.vimeo.com
unknown
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cd7fb65801182a5f
unknown
http://urusvisa.com/Z
unknown
http://cowod.hopto.org
unknown
http://urusvisa.com:80Local
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
http://urusvisa.com/ones
unknown
http://46.8.231.109/c4754d4f680ead72.phpp
unknown
https://www.gstatic.cn/recaptcha/
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
unknown
https://www.youtube.com
unknown
https://www.google.com
unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllX6
unknown
https://t.me/jamsemlg8
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli
unknown
http://cowod.hopto.org_DEBUG.zip/c
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
unknown
http://cowod.hopto.
unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
unknown
http://urusvisa.com/B
unknown
http://urusvisa.com:80CAE
unknown
http://cowod.hopto
unknown
https://steamcommunity.com/ion1
unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
unknown
https://s.ytimg.com;
unknown
http://46.8.231.109/c4754d4f680ead72.phpG
unknown
https://steam.tv/
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://urusvisa.com/G
unknown
http://urusvisa.com/6B
unknown
https://t.me/ae5ed
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
unknown
https://mozilla.org0/
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=WnGP
unknown
http://store.steampowered.com/privacy_agreement/
unknown
https://steamcommunity.com:443/profiles/76561199724331900
unknown
http://46.8.231.109/g
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://possiwreeste.site/com/pk
unknown
https://sketchfab.com
unknown
https://lv.queniujq.cn
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.youtube.com/
unknown
http://cowod.hopto.orgAFB
unknown
http://urusvisa.com:80om24
unknown
https://agentyanlark.site/api
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
unknown
https://writekdmsnu.site/y9
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
unknown
https://writekdmsnu.site/
unknown
https://agentyanlark.site/
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
unknown
https://www.google.com/recaptcha/
unknown
https://checkout.steampowered.com/
unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
unknown
http://urusvisa.com:80xe
unknown
http://urusvisa.com/sql.dllg
unknown
http://cowod.HJDGCBFHDAFB
unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
unknown
https://store.steampowered.com/;
unknown
https://steamcommunity.com/x
unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
unknown
https://steamcommunity.com/0
unknown
https://steamcommunity.com/profiles/76561199780418869u55uMozilla/5.0
unknown
https://web.telegram.org
unknown
http://urusvisa.com:80DHC
unknown
https://t.me/3
unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
unknown
https://community.akamai.steamstatic.com/
unknown
https://writekdmsnu.site/api
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
possiwreeste.site
172.67.205.129
 malicious
steamcommunity.com
104.102.49.254
 malicious
urusvisa.com
5.42.101.62
 malicious
cowod.hopto.org
45.132.206.251
 malicious
t.me
149.154.167.99
 malicious
underlinemdsj.site
104.21.1.169
 malicious
commandejorsk.site
unknown
 malicious
famikyjdiag.site
unknown
 malicious
writekdmsnu.site
unknown
 malicious
agentyanlark.site
unknown
 malicious
delaylacedmn.site
unknown
 malicious
bellykmrebk.site
unknown
 malicious
files.veritas.org.ng
147.45.44.104
There are 3 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
46.8.231.109
unknown
Russian Federation
malicious
104.102.49.254
steamcommunity.com
United States
malicious
172.67.205.129
possiwreeste.site
United States
malicious
5.42.101.62
urusvisa.com
Russian Federation
malicious
104.21.1.169
underlinemdsj.site
United States
malicious
149.154.167.99
t.me
United Kingdom
malicious
45.132.206.251
cowod.hopto.org
Russian Federation
malicious
147.45.44.104
files.veritas.org.ng
Russian Federation

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214EF-0000-0000-C000-000000000046} 0xFFFF

Memdumps

Base Address
Regiontype
Protect
Malicious
43A000
remote allocation
page execute and read and write
 malicious
42BE000
trusted library allocation
page read and write
 malicious
D90000
heap
page read and write
 malicious
3715000
trusted library allocation
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
38E5000
trusted library allocation
page read and write
 malicious
122A000
heap
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
FA0000
heap
page read and write
4E6000
remote allocation
page execute and read and write
1C095000
heap
page read and write
3050000
trusted library allocation
page execute and read and write
3985000
trusted library allocation
page read and write
14C5000
heap
page read and write
6C0F1000
unkown
page execute read
503000
remote allocation
page execute and read and write
D01000
heap
page read and write
EF3000
heap
page read and write
A4E000
stack
page read and write
129E000
heap
page read and write
537D000
stack
page read and write
EED000
heap
page read and write
6C32F000
unkown
page readonly
17A3D000
stack
page read and write
A8C000
heap
page read and write
8F8000
stack
page read and write
A69000
heap
page read and write
3711000
trusted library allocation
page read and write
136F000
heap
page read and write
204BB000
direct allocation
page readonly
6C38E000
unkown
page read and write
3A34D000
heap
page read and write
1399000
heap
page read and write
1494000
trusted library allocation
page read and write
709E000
stack
page read and write
2F1F000
stack
page read and write
306E000
stack
page read and write
26DF000
stack
page read and write
BAC000
heap
page read and write
BB4000
heap
page read and write
272E000
stack
page read and write
4C84D000
stack
page read and write
FAC000
stack
page read and write
1BED6000
heap
page read and write
1390000
heap
page read and write
503000
remote allocation
page execute and read and write
12DC000
heap
page read and write
1130000
heap
page read and write
2226A000
direct allocation
page readonly
880000
heap
page read and write
C94000
trusted library allocation
page read and write
6C375000
unkown
page execute read
2700000
heap
page read and write
C92000
heap
page read and write
A68000
heap
page read and write
3BA0000
heap
page read and write
2FA0000
trusted library allocation
page read and write
65C000
remote allocation
page execute and read and write
1C09C000
heap
page read and write
CBD000
stack
page read and write
6C370000
unkown
page read and write
11A0000
heap
page read and write
5F2000
unkown
page readonly
229A5000
direct allocation
page execute read
1560000
trusted library allocation
page execute and read and write
6C36F000
unkown
page write copy
52C000
remote allocation
page execute and read and write
AA0000
trusted library allocation
page read and write
4281000
trusted library allocation
page read and write
CF0000
heap
page read and write
4C4000
remote allocation
page execute and read and write
2FC6000
trusted library allocation
page read and write
112D000
stack
page read and write
28B7000
heap
page read and write
1AECD000
stack
page read and write
42BB000
trusted library allocation
page read and write
6C3A0000
unkown
page readonly
2983000
trusted library allocation
page read and write
7D8000
stack
page read and write
299E000
stack
page read and write
61EB7000
direct allocation
page readonly
A84000
heap
page read and write
288F000
stack
page read and write
2800000
heap
page read and write
22A3B000
direct allocation
page readonly
10EE000
stack
page read and write
203F6000
direct allocation
page execute read
C7D000
stack
page read and write
22028000
direct allocation
page execute read
F50000
heap
page read and write
C75000
heap
page read and write
D60000
heap
page read and write
61ED3000
direct allocation
page read and write
3BED000
heap
page read and write
3170000
heap
page execute and read and write
FB0000
heap
page read and write
12FC000
heap
page read and write
204A3000
direct allocation
page readonly
132A000
heap
page read and write
61EB4000
direct allocation
page read and write
154BE000
stack
page read and write
A0E000
stack
page read and write
19F5C000
heap
page read and write
13F3000
heap
page read and write
1AD8F000
stack
page read and write
202DA000
direct allocation
page execute read
100CB000
stack
page read and write
13CC000
heap
page read and write
CE0000
trusted library allocation
page execute and read and write
1008F000
stack
page read and write
F40000
heap
page read and write
151E000
stack
page read and write
42CF000
stack
page read and write
A94000
trusted library allocation
page read and write
4EF000
remote allocation
page execute and read and write
1270000
trusted library allocation
page read and write
C70000
trusted library allocation
page read and write
90E000
stack
page read and write
6C331000
unkown
page execute read
6C17E000
unkown
page read and write
B88000
heap
page read and write
2770000
heap
page read and write
20425000
direct allocation
page execute read
12B7000
heap
page read and write
EB0000
unkown
page readonly
1C060000
heap
page read and write
27401000
heap
page read and write
316D000
stack
page read and write
E7F000
stack
page read and write
1310000
heap
page read and write
1670000
heap
page read and write
6C336000
unkown
page execute read
F60000
heap
page read and write
20466000
direct allocation
page execute read
1310000
heap
page read and write
22C6D000
stack
page read and write
21381000
heap
page read and write
C5E000
stack
page read and write
FAE000
heap
page read and write
22883000
direct allocation
page execute read
BEC000
stack
page read and write
22A52000
direct allocation
page read and write
1BEF0000
heap
page read and write
ACB000
trusted library allocation
page execute and read and write
1BE6D000
heap
page read and write
1C2A1000
heap
page read and write
2713000
trusted library allocation
page read and write
179FE000
stack
page read and write
1570000
trusted library allocation
page read and write
63C000
stack
page read and write
A40000
heap
page read and write
1580000
heap
page read and write
19F7E000
heap
page read and write
27D0000
heap
page execute and read and write
1496000
trusted library allocation
page read and write
CF0000
heap
page execute and read and write
1220000
heap
page read and write
F79000
heap
page read and write
4C5000
remote allocation
page execute and read and write
5F0000
unkown
page readonly
2730000
trusted library allocation
page read and write
28B0000
heap
page read and write
1527C000
stack
page read and write
2FC0000
trusted library allocation
page read and write
4C0000
remote allocation
page execute and read and write
32A0000
heap
page read and write
25DE000
stack
page read and write
6C378000
unkown
page execute read
2138D000
heap
page read and write
C7E000
heap
page read and write
CBB000
trusted library allocation
page execute and read and write
9E4000
trusted library allocation
page read and write
1320000
heap
page read and write
128B000
heap
page read and write
4ABD000
stack
page read and write
492000
remote allocation
page execute and read and write
1067E000
stack
page read and write
259C000
stack
page read and write
2620000
heap
page read and write
107BE000
stack
page read and write
139D000
stack
page read and write
6C30B000
unkown
page execute read
21377000
heap
page read and write
229D5000
direct allocation
page execute read
22021000
direct allocation
page execute read
EFF000
stack
page read and write
297E000
stack
page read and write
BB0000
heap
page read and write
1C552000
heap
page read and write
1C8AD000
heap
page read and write
2FE0000
trusted library allocation
page read and write
16FE000
stack
page read and write
3290000
heap
page read and write
E34000
heap
page read and write
2E10000
heap
page read and write
4C50B000
stack
page read and write
1C2A3000
heap
page read and write
CFB000
heap
page read and write
11A4000
heap
page read and write
BDE000
heap
page read and write
790000
heap
page read and write
1A1AD000
stack
page read and write
BCC000
stack
page read and write
14D0000
trusted library allocation
page read and write
940000
heap
page read and write
A87000
heap
page read and write
9F0000
heap
page read and write
EFC000
stack
page read and write
4C0000
remote allocation
page execute and read and write
1BE68000
heap
page read and write
BD8000
heap
page read and write
204B6000
direct allocation
page readonly
255C000
stack
page read and write
1283000
trusted library allocation
page execute and read and write
472000
unkown
page readonly
B59000
stack
page read and write
12F2000
stack
page read and write
A60000
heap
page read and write
2750000
trusted library allocation
page read and write
10A5000
heap
page read and write
21375000
heap
page read and write
4E6000
remote allocation
page execute and read and write
304E000
stack
page read and write
61E00000
direct allocation
page execute and read and write
204C6000
direct allocation
page readonly
1C582000
heap
page read and write
4C6F000
stack
page read and write
1451000
heap
page read and write
49BE000
stack
page read and write
1320000
heap
page read and write
13C7000
heap
page read and write
13DE000
stack
page read and write
BC3000
heap
page read and write
A60000
heap
page read and write
1989E000
stack
page read and write
14BEE000
stack
page read and write
E9A000
heap
page read and write
EEA000
heap
page read and write
11ED000
stack
page read and write
2D5D000
stack
page read and write
1264E000
stack
page read and write
3735000
trusted library allocation
page read and write
10E5000
heap
page read and write
1082D000
stack
page read and write
32EF000
stack
page read and write
1C04A000
stack
page read and write
126E000
heap
page read and write
1320000
heap
page read and write
1260D000
stack
page read and write
19F9E000
heap
page read and write
1A1E9000
heap
page read and write
EBA000
heap
page read and write
E7A000
heap
page read and write
AFC000
stack
page read and write
1077F000
stack
page read and write
1B2E0000
heap
page read and write
1A0AC000
stack
page read and write
738000
stack
page read and write
1544F000
stack
page read and write
B60000
heap
page read and write
A2B0000
unclassified section
page read and write
3BE7000
heap
page read and write
392000
unkown
page readonly
28508000
heap
page read and write
22238000
direct allocation
page readonly
229DD000
direct allocation
page execute read
12FC000
stack
page read and write
1441000
heap
page read and write
1BDF0000
heap
page read and write
F80000
heap
page read and write
1C550000
heap
page read and write
12FC000
stack
page read and write
402BE000
heap
page read and write
C04000
heap
page read and write
EDA000
heap
page read and write
B06000
trusted library allocation
page read and write
61E01000
direct allocation
page execute read
9C7F000
stack
page read and write
B8E000
stack
page read and write
166E000
stack
page read and write
10A0000
heap
page read and write
65D000
remote allocation
page execute and read and write
6C385000
unkown
page readonly
C83000
trusted library allocation
page execute and read and write
A48000
heap
page read and write
A13F000
stack
page read and write
6C191000
unkown
page execute read
151E000
heap
page read and write
3080000
heap
page read and write
153CF000
stack
page read and write
A4E000
heap
page read and write
1300000
heap
page read and write
6DC000
stack
page read and write
17FF000
stack
page read and write
1BE6A000
heap
page read and write
59C000
remote allocation
page execute and read and write
2E478000
heap
page read and write
E5C000
stack
page read and write
E90000
trusted library allocation
page read and write
C5A000
heap
page read and write
1B00E000
stack
page read and write
480E000
stack
page read and write
C90000
trusted library allocation
page read and write
7FC000
stack
page read and write
20298000
direct allocation
page execute read
1C5BE000
heap
page read and write
6C190000
unkown
page readonly
2731000
trusted library allocation
page execute and read and write
1542D000
stack
page read and write
482D000
stack
page read and write
1BF4B000
stack
page read and write
295F000
stack
page read and write
1B10F000
stack
page read and write
D80000
heap
page read and write
2FB3000
trusted library allocation
page execute and read and write
342000
unkown
page readonly
B7E000
stack
page read and write
2F63000
trusted library allocation
page read and write
1027000
heap
page read and write
EA0000
heap
page read and write
14B0000
trusted library allocation
page read and write
22976000
direct allocation
page execute read
F30000
heap
page read and write
B00000
trusted library allocation
page read and write
139E000
stack
page read and write
22A4B000
direct allocation
page readonly
1C1DC000
heap
page read and write
CAA000
heap
page read and write
19F7C000
stack
page read and write
122E000
stack
page read and write
F20000
trusted library allocation
page read and write
6C3A1000
unkown
page execute read
138E000
stack
page read and write
A5C000
stack
page read and write
B8E000
heap
page read and write
13A8000
heap
page read and write
BE0000
heap
page read and write
AA3000
heap
page read and write
6C57C000
unkown
page readonly
2259A000
heap
page read and write
D7C000
heap
page read and write
C25000
heap
page read and write
2A9D000
stack
page read and write
6C580000
unkown
page read and write
E70000
heap
page read and write
1BEE4000
heap
page read and write
2FEB000
trusted library allocation
page execute and read and write
26D0000
trusted library allocation
page read and write
9E3000
trusted library allocation
page execute and read and write
229E6000
direct allocation
page execute read
3F65000
trusted library allocation
page read and write
2B21000
trusted library allocation
page read and write
4C60C000
stack
page read and write
D1A000
heap
page read and write
BDE000
stack
page read and write
2F1E000
stack
page read and write
1A94E000
stack
page read and write
A240000
unclassified section
page read and write
271E000
stack
page read and write
DEE000
heap
page read and write
11AC000
heap
page read and write
3283000
trusted library allocation
page read and write
EF6000
heap
page read and write
118E000
stack
page read and write
9B0000
heap
page read and write
5C5000
remote allocation
page execute and read and write
FF8E000
stack
page read and write
1AE8C000
stack
page read and write
1BDDF000
stack
page read and write
5E0000
heap
page read and write
E90000
heap
page read and write
C10000
heap
page read and write
1B3E4000
heap
page read and write
4285000
trusted library allocation
page read and write
2E5D000
stack
page read and write
514E000
stack
page read and write
9D0000
trusted library allocation
page read and write
BFC000
heap
page read and write
28E3000
trusted library allocation
page read and write
4E2000
remote allocation
page execute and read and write
B30000
heap
page read and write
A1B0000
heap
page read and write
50F000
remote allocation
page execute and read and write
343E0000
heap
page read and write
A93000
trusted library allocation
page execute and read and write
1AFCD000
stack
page read and write
22262000
direct allocation
page read and write
437000
remote allocation
page execute and read and write
ABC000
heap
page read and write
1C1FA000
heap
page read and write
A80000
trusted library allocation
page read and write
485000
remote allocation
page execute and read and write
6C0F0000
unkown
page readonly
179FE000
stack
page read and write
14B8C000
stack
page read and write
A76000
heap
page read and write
4E4000
remote allocation
page execute and read and write
19FA0000
heap
page read and write
1030000
heap
page read and write
6C38B000
unkown
page readonly
FB0000
heap
page read and write
EF8000
stack
page read and write
AA6000
trusted library allocation
page read and write
284E000
stack
page read and write
6C301000
unkown
page execute read
FC2000
heap
page read and write
F40000
heap
page read and write
CF0000
heap
page read and write
12F8000
stack
page read and write
EFA000
heap
page read and write
213A2000
heap
page read and write
4D6000
unkown
page readonly
204CB000
direct allocation
page readonly
2052D000
stack
page read and write
45E000
remote allocation
page execute and read and write
7BFE000
stack
page read and write
CD0000
heap
page read and write
A1C0000
heap
page read and write
400000
remote allocation
page execute and read and write
2870000
heap
page execute and read and write
1C81E000
stack
page read and write
1BE1E000
heap
page read and write
273E0000
heap
page read and write
B4D000
stack
page read and write
C20000
heap
page read and write
1401000
heap
page read and write
F2C000
stack
page read and write
51B000
remote allocation
page execute and read and write
C9E000
heap
page read and write
12F9000
stack
page read and write
140A000
heap
page read and write
428E000
stack
page read and write
6C371000
unkown
page execute read
2981000
trusted library allocation
page execute and read and write
A153000
heap
page read and write
12CFD000
stack
page read and write
28A0000
heap
page read and write
532000
remote allocation
page execute and read and write
271B000
trusted library allocation
page execute and read and write
13C0000
heap
page read and write
2740000
trusted library allocation
page execute and read and write
530000
remote allocation
page execute and read and write
1A050000
heap
page read and write
6C16D000
unkown
page readonly
505E000
stack
page read and write
22A36000
direct allocation
page readonly
12D6E000
stack
page read and write
33BD000
heap
page read and write
26F4000
trusted library allocation
page read and write
11EF000
stack
page read and write
490000
remote allocation
page execute and read and write
61ECC000
direct allocation
page read and write
20303000
direct allocation
page execute read
6C544000
unkown
page readonly
1290000
heap
page read and write
1400000
heap
page read and write
22A1F000
direct allocation
page readonly
328E000
stack
page read and write
45A000
remote allocation
page execute and read and write
C96000
trusted library allocation
page read and write
AA4000
trusted library allocation
page read and write
2046A000
direct allocation
page execute read
D10000
heap
page read and write
5F8000
stack
page read and write
14CEF000
stack
page read and write
2745D000
heap
page read and write
26F0000
trusted library allocation
page read and write
C50000
heap
page read and write
E80000
trusted library allocation
page execute and read and write
146D000
heap
page read and write
22A23000
direct allocation
page readonly
2E1E000
stack
page read and write
2062D000
stack
page read and write
6C57F000
unkown
page write copy
A6E000
heap
page read and write
2ADF000
stack
page read and write
6C309000
unkown
page execute read
4E4000
remote allocation
page execute and read and write
13A0000
heap
page read and write
1BE64000
heap
page read and write
B2B000
trusted library allocation
page execute and read and write
1BE0D000
heap
page read and write
2222D000
direct allocation
page execute read
1C6AB000
stack
page read and write
33B7000
heap
page read and write
26F6000
trusted library allocation
page read and write
1BE66000
heap
page read and write
FB2000
heap
page read and write
536000
remote allocation
page execute and read and write
65D000
remote allocation
page execute and read and write
327F000
stack
page read and write
2710000
trusted library allocation
page read and write
38E1000
trusted library allocation
page read and write
152CE000
stack
page read and write
3060000
trusted library allocation
page read and write
773E000
stack
page read and write
4C29B000
stack
page read and write
D7F000
stack
page read and write
1090000
heap
page read and write
13AE000
heap
page read and write
6C300000
unkown
page readonly
1C53F000
stack
page read and write
273C0000
heap
page read and write
19FFE000
stack
page read and write
16A0000
heap
page read and write
2711000
trusted library allocation
page execute and read and write
1490000
trusted library allocation
page read and write
FAC000
stack
page read and write
C87000
heap
page read and write
27462000
heap
page read and write
49DD000
stack
page read and write
28DE000
stack
page read and write
21395000
heap
page read and write
4E4000
remote allocation
page execute and read and write
1284000
trusted library allocation
page read and write
10F5000
heap
page read and write
274AB000
heap
page read and write
2049D000
direct allocation
page execute read
A4F000
stack
page read and write
481000
remote allocation
page execute and read and write
14DE000
heap
page read and write
FCE000
heap
page read and write
2F6E000
stack
page read and write
D3E000
stack
page read and write
3BE0000
heap
page read and write
19F52000
heap
page read and write
ED0000
heap
page read and write
31EE000
stack
page read and write
1023000
heap
page read and write
670000
remote allocation
page execute and read and write
860000
heap
page read and write
1BE5E000
heap
page read and write
B70000
heap
page read and write
107EF000
stack
page read and write
DFE000
stack
page read and write
22A56000
direct allocation
page read and write
1C650000
heap
page read and write
98E000
stack
page read and write
2D1F000
stack
page read and write
768F000
stack
page read and write
10BE000
stack
page read and write
945000
heap
page read and write
21352000
heap
page read and write
8CE000
stack
page read and write
870000
heap
page read and write
400000
remote allocation
page execute and read and write
A94000
heap
page read and write
1534E000
stack
page read and write
10C0000
heap
page read and write
EB2000
unkown
page readonly
6C182000
unkown
page readonly
B2E000
stack
page read and write
64A000
remote allocation
page execute and read and write
19F3F000
stack
page read and write
A140000
heap
page read and write
22818000
direct allocation
page execute read
B5C000
stack
page read and write
EB0000
trusted library allocation
page read and write
FA5000
heap
page read and write
172FD000
stack
page read and write
1240000
heap
page read and write
12BC000
heap
page read and write
48F000
remote allocation
page execute and read and write
FC0000
heap
page read and write
61ED0000
direct allocation
page read and write
1B25D000
stack
page read and write
5D0000
heap
page read and write
51E000
remote allocation
page execute and read and write
12C4000
heap
page read and write
FB7000
heap
page read and write
6C38D000
unkown
page readonly
285E000
stack
page read and write
13E3000
heap
page read and write
488000
remote allocation
page execute and read and write
2137B000
heap
page read and write
C30000
heap
page read and write
4B1000
remote allocation
page execute and read and write
14D4D000
stack
page read and write
12F2000
stack
page read and write
D7D000
stack
page read and write
1C7AC000
stack
page read and write
14BB000
trusted library allocation
page execute and read and write
C84000
trusted library allocation
page read and write
BCE000
stack
page read and write
27BE000
stack
page read and write
10E0000
heap
page read and write
2FC4000
trusted library allocation
page read and write
F6E000
heap
page read and write
3F61000
trusted library allocation
page read and write
10F0000
heap
page read and write
19F50000
heap
page read and write
2BDC000
stack
page read and write
22A46000
direct allocation
page readonly
2226D000
direct allocation
page readonly
65D000
remote allocation
page execute and read and write
19F6D000
heap
page read and write
1A32C000
heap
page read and write
F58000
stack
page read and write
3AFD000
heap
page read and write
61ED4000
direct allocation
page readonly
1298000
heap
page read and write
281D000
stack
page read and write
6C375000
unkown
page readonly
204D2000
direct allocation
page read and write
2F61000
trusted library allocation
page execute and read and write
262E000
stack
page read and write
229E4000
direct allocation
page execute read
148F000
stack
page read and write
AFF000
stack
page read and write
12D3D000
stack
page read and write
19F82000
heap
page read and write
1390000
heap
page read and write
56C000
stack
page read and write
2FB4000
trusted library allocation
page read and write
2BBE000
stack
page read and write
6C36E000
unkown
page execute read
4C5000
remote allocation
page execute and read and write
9F5000
heap
page read and write
59C000
remote allocation
page execute and read and write
2E080000
heap
page read and write
2228E000
heap
page read and write
1C56D000
heap
page read and write
1BDF2000
heap
page read and write
12DAE000
stack
page read and write
C12000
heap
page read and write
1B15E000
stack
page read and write
6C53F000
unkown
page readonly
333E000
stack
page read and write
940000
heap
page read and write
4240000
heap
page read and write
155D000
stack
page read and write
4FC000
stack
page read and write
2222F000
direct allocation
page readonly
22A72000
heap
page read and write
229EA000
direct allocation
page execute read
FD1000
heap
page read and write
1BED2000
heap
page read and write
33B0000
heap
page read and write
3731000
trusted library allocation
page read and write
1BDFC000
heap
page read and write
1C55C000
heap
page read and write
22A1D000
direct allocation
page execute read
204D6000
direct allocation
page read and write
2745A000
heap
page read and write
F34000
trusted library allocation
page read and write
20455000
direct allocation
page execute read
1C890000
heap
page read and write
22020000
direct allocation
page execute and read and write
152EE000
stack
page read and write
E60000
trusted library allocation
page execute and read and write
F33000
trusted library allocation
page execute and read and write
B80000
heap
page read and write
2590000
heap
page execute and read and write
3981000
trusted library allocation
page read and write
9B50000
unclassified section
page read and write
59C000
remote allocation
page execute and read and write
A65000
heap
page read and write
3281000
trusted library allocation
page execute and read and write
1A310000
heap
page read and write
B04000
trusted library allocation
page read and write
470000
unkown
page readonly
BD0000
heap
page read and write
21350000
heap
page read and write
2136B000
heap
page read and write
F90000
heap
page read and write
F8A000
heap
page read and write
B40000
heap
page read and write
6C37D000
unkown
page readonly
2890000
heap
page read and write
61ECD000
direct allocation
page readonly
20464000
direct allocation
page execute read
2C1E000
stack
page read and write
106EE000
stack
page read and write
EF3000
stack
page read and write
2049F000
direct allocation
page readonly
503000
remote allocation
page execute and read and write
534000
remote allocation
page execute and read and write
2145A000
heap
page read and write
A6E000
heap
page read and write
28E1000
trusted library allocation
page execute and read and write
2226F000
direct allocation
page readonly
1728D000
stack
page read and write
5CB000
remote allocation
page execute and read and write
19FBE000
heap
page read and write
B45000
heap
page read and write
FA5000
heap
page read and write
2733000
trusted library allocation
page read and write
4C0000
remote allocation
page execute and read and write
1983E000
stack
page read and write
760E000
stack
page read and write
6C36E000
unkown
page read and write
2F50000
heap
page execute and read and write
4BD000
remote allocation
page execute and read and write
109E000
stack
page read and write
F05000
heap
page read and write
B50000
heap
page read and write
22186000
direct allocation
page execute read
2285A000
direct allocation
page execute read
1350000
heap
page read and write
B51000
stack
page read and write
12D2000
heap
page read and write
16B0000
heap
page read and write
1355000
heap
page read and write
1B2D0000
heap
page read and write
1796E000
stack
page read and write
2045D000
direct allocation
page execute read
5A5000
remote allocation
page execute and read and write
9B4E000
stack
page read and write
3AF7000
heap
page read and write
48F000
remote allocation
page execute and read and write
6C57E000
unkown
page read and write
920000
heap
page read and write
3AF0000
heap
page read and write
BC0000
heap
page read and write
340000
unkown
page readonly
2DD0000
heap
page read and write
343E000
stack
page read and write
There are 707 hidden memdumps, click here to show them.