IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Roaming\msvcp110.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\BGCAAFHIEBKJ\AEHIEC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BGCAAFHIEBKJ\AFHDHC
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BGCAAFHIEBKJ\DHCAAE
SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
dropped
C:\ProgramData\BGCAAFHIEBKJ\EBAFBG
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\BGCAAFHIEBKJ\EBAFBG-shm
data
dropped
C:\ProgramData\BGCAAFHIEBKJ\ECBGCB
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\BGCAAFHIEBKJ\FHDAFI
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\BGCAAFHIEBKJ\GIECFI
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BGCAAFHIEBKJ\IJKFCF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\BGCAAFHIEBKJ\KFHCAE
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\BGCAAFHIEBKJ\KFHCAE-shm
data
dropped
C:\ProgramData\IEHCAKKJDB.exe
ASCII text, with no line terminators
modified
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\a43486128347[1].exe
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\76561199780418869[1].htm
HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\delays.tmp
ASCII text, with very long lines (65536), with no line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 15 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://49.12.197.9/
49.12.197.9
 malicious
https://49.12.197.9/freebl3.dll
49.12.197.9
 malicious
https://49.12.197.9/sqlp.dll
49.12.197.9
 malicious
https://49.12.197.9/softokn3.dll
49.12.197.9
 malicious
https://49.12.197.9/vcruntime140.dll
49.12.197.9
 malicious
https://49.12.197.9/nss3.dll
49.12.197.9
 malicious
https://49.12.197.9/mozglue.dll
49.12.197.9
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://player.vimeo.com
unknown
https://duckduckgo.com/ac/?q=
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
unknown
https://49.12.197.9/b
unknown
https://steamcommunity.com/?subsection=broadcasts
unknown
https://49.12.197.9/g
unknown
https://49.12.197.9/nss3.dll.9#
unknown
https://store.steampowered.com/subscriber_agreement/
unknown
https://www.gstatic.cn/recaptcha/
unknown
https://49.12.197.9/N
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
unknown
https://49.12.197.9/S
unknown
https://49.12.197.9/freebl3.dll6
unknown
https://steamcommunity.com/profiles/76561199780418869/badges
unknown
https://49.12.197.9/W
unknown
http://www.valvesoftware.com/legal.htm
unknown
https://www.youtube.com
unknown
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
unknown
https://49.12.197.9/;
unknown
https://www.google.com
unknown
http://cowod.hopto.org_DEBUG.zip/c
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
unknown
https://49.12.197.9
unknown
https://49.12.197.9/A
unknown
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=HeLxjRDbQrcV&l=e
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
unknown
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
unknown
https://49.12.197.9FHIEHDGI--
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=2ZRoxzol
unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a
unknown
https://s.ytimg.com;
unknown
https://steam.tv/
unknown
https://49.12.197.9/-end-point:f
unknown
https://49.12.197.9/5
unknown
https://49.12.197.9HIEBAK
unknown
https://49.12.197.9/CAAFHIEBKJ
unknown
https://t.me/ae5ed
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
unknown
https://mozilla.org0/
unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=fWwP
unknown
http://store.steampowered.com/privacy_agreement/
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://49.12.197.9/$
unknown
https://store.steampowered.com/points/shop/
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
unknown
https://sketchfab.com
unknown
https://www.ecosia.org/newtab/
unknown
https://lv.queniujq.cn
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.youtube.com/
unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
unknown
https://store.steampowered.com/privacy_agreement/
unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=ezWS9te9Zwm9&l=en
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
unknown
https://steamcommunity.com/$b
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
unknown
https://www.google.com/recaptcha/
unknown
https://checkout.steampowered.com/
unknown
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
unknown
https://store.steampowered.com/;
unknown
https://store.steampowered.com/about/
unknown
https://steamcommunity.com/my/wishlist/
unknown
https://community.akamai.steamstatic.com/public/javascript/global.js?v=9OzcxMXbaV84&l=english
unknown
http://ocsp.sectigo.com0
unknown
https://help.steampowered.com/en/
unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
unknown
https://steamcommunity.com/market/
unknown
https://store.steampowered.com/news/
unknown
https://community.akamai.steamstatic.com/
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://store.steampowered.com/subscriber_agreement/
unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
unknown
https://49.12.197.9/ta_
unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
https://recaptcha.net/recaptcha/;
unknown
https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
unknown
https://steamcommunity.com/profiles/76561199780418869/inventory/
unknown
https://steamcommunity.com/discussions/
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
steamcommunity.com
104.102.49.254
 malicious

IPs

IP
Domain
Country
Malicious
49.12.197.9
unknown
Germany
malicious
104.102.49.254
steamcommunity.com
United States
malicious
147.45.44.104
unknown
Russian Federation

Memdumps

Base Address
Regiontype
Protect
Malicious
6E820000
unkown
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
2F0E000
heap
page read and write
 malicious
30E9000
heap
page read and write
4071000
trusted library allocation
page read and write
31AB000
unkown
page read and write
2FBE000
heap
page read and write
1BD91000
heap
page read and write
2E90000
heap
page read and write
7ABE000
stack
page read and write
2FBD000
heap
page read and write
1BA8D000
heap
page read and write
2FD8000
heap
page read and write
2F7B000
heap
page read and write
2FCA000
heap
page read and write
BC01000
heap
page read and write
5A1000
remote allocation
page execute and read and write
BC01000
heap
page read and write
2FA7000
heap
page read and write
2DC4000
heap
page read and write
2F8C000
heap
page read and write
2F80000
heap
page read and write
2FB8000
heap
page read and write
2FB3000
heap
page read and write
2F80000
heap
page read and write
2FE4000
heap
page read and write
BC01000
heap
page read and write
4EDDE000
stack
page read and write
2FC8000
heap
page read and write
55D000
remote allocation
page execute and read and write
307A000
trusted library allocation
page read and write
2DC4000
heap
page read and write
5559B000
heap
page read and write
1BB45000
heap
page read and write
3091000
heap
page read and write
BC01000
heap
page read and write
BC01000
heap
page read and write
FAD000
heap
page read and write
2FC0000
heap
page read and write
2F6B000
heap
page read and write
55AE000
stack
page read and write
2DC4000
heap
page read and write
2FAD000
heap
page read and write
FEF000
heap
page read and write
BC01000
heap
page read and write
555AD000
heap
page read and write
3201000
unkown
page read and write
AE8000
unkown
page readonly
BC01000
heap
page read and write
2FE8000
heap
page read and write
2FC8000
heap
page read and write
463000
remote allocation
page execute and read and write
2FC8000
heap
page read and write
2DB0000
heap
page readonly
14E0000
heap
page read and write
2D3D000
stack
page read and write
2F86000
heap
page read and write
2F13000
heap
page read and write
2DC4000
heap
page read and write
BC01000
heap
page read and write
1BFF8000
heap
page read and write
A92000
unkown
page execute and read and write
BC01000
heap
page read and write
3020000
trusted library section
page read and write
2DC4000
heap
page read and write
194D0000
remote allocation
page read and write
2FC8000
heap
page read and write
2DC4000
heap
page read and write
2DC4000
heap
page read and write
4029C000
heap
page read and write
2FE8000
heap
page read and write
555CC000
heap
page read and write
31B2000
unkown
page read and write
555AA000
heap
page read and write
5FBE000
trusted library allocation
page read and write
1530000
trusted library allocation
page read and write
6E882000
unkown
page readonly
670000
remote allocation
page execute and read and write
2F79000
heap
page read and write
BC01000
heap
page read and write
2FC0000
heap
page read and write
2204F000
direct allocation
page readonly
6C80D000
unkown
page readonly
1BA7C000
heap
page read and write
2F90000
heap
page read and write
BC01000
heap
page read and write
2FF9000
heap
page read and write
16EEF000
stack
page read and write
F4E000
heap
page read and write
2FBB000
heap
page read and write
2F90000
heap
page read and write
2DC4000
heap
page read and write
2FB5000
heap
page read and write
3168000
unkown
page read and write
BC01000
heap
page read and write
55EE000
stack
page read and write
1217E000
stack
page read and write
BC01000
heap
page read and write
2E456000
heap
page read and write
501D0000
trusted library allocation
page read and write
2FCC000
heap
page read and write
F81000
heap
page read and write
BC01000
heap
page read and write
2D31000
stack
page read and write
343C9000
heap
page read and write
2FF9000
heap
page read and write
21E08000
direct allocation
page execute read
2FF9000
heap
page read and write
2FD8000
heap
page read and write
2FB8000
heap
page read and write
582000
remote allocation
page execute and read and write
4B4E000
trusted library allocation
page read and write
BC01000
heap
page read and write
F00000
heap
page read and write
2F06000
heap
page read and write
2F1A000
heap
page read and write
BC01000
heap
page read and write
2E60000
heap
page read and write
2FE8000
heap
page read and write
2FC8000
heap
page read and write
2F70000
trusted library allocation
page read and write
F74000
heap
page read and write
2DA0000
heap
page read and write
5559A000
heap
page read and write
2DC0000
heap
page read and write
1570000
trusted library allocation
page read and write
6CA0F000
unkown
page write copy
2DC4000
heap
page read and write
555A4000
heap
page read and write
BC01000
heap
page read and write
555A4000
heap
page read and write
2DC4000
heap
page read and write
1947C000
stack
page read and write
16D7E000
stack
page read and write
2F78000
heap
page read and write
2FB5000
heap
page read and write
3060000
heap
page execute and read and write
AE8000
unkown
page execute and read and write
2FB5000
heap
page read and write
3013000
heap
page read and write
10C0000
heap
page read and write
2FC8000
heap
page read and write
2FC0000
heap
page read and write
555A9000
heap
page read and write
555C8000
heap
page read and write
14DF000
stack
page read and write
2F80000
trusted library allocation
page read and write
2F80000
heap
page read and write
F84000
heap
page read and write
2FCA000
heap
page read and write
2204A000
direct allocation
page readonly
15BE000
stack
page read and write
6E880000
unkown
page read and write
22576000
heap
page read and write
4ED3B000
stack
page read and write
1BADD000
heap
page read and write
3195000
unkown
page read and write
21E01000
direct allocation
page execute read
BC01000
heap
page read and write
3071000
trusted library allocation
page read and write
30E5000
heap
page read and write
2FC0000
heap
page read and write
55A000
remote allocation
page execute and read and write
2F1A000
heap
page read and write
2F1A000
heap
page read and write
49CE000
trusted library allocation
page read and write
2FE8000
heap
page read and write
2F18000
heap
page read and write
BC01000
heap
page read and write
1523000
trusted library allocation
page execute and read and write
BC00000
heap
page read and write
22340000
heap
page read and write
BC01000
heap
page read and write
4EA9C000
stack
page read and write
2FAE000
heap
page read and write
555C8000
heap
page read and write
107E000
stack
page read and write
BC01000
heap
page read and write
2FBD000
heap
page read and write
2FCC000
heap
page read and write
2FCA000
heap
page read and write
2FD8000
heap
page read and write
2DC4000
heap
page read and write
2F1A000
heap
page read and write
2DC4000
heap
page read and write
516D000
stack
page read and write
2FD8000
heap
page read and write
1BBBB000
stack
page read and write
2F73000
heap
page read and write
555C0000
heap
page read and write
31C2000
unkown
page read and write
BC01000
heap
page read and write
2FE8000
heap
page read and write
6CA15000
unkown
page readonly
2F79000
heap
page read and write
1BA62000
heap
page read and write
2F1A000
heap
page read and write
326F000
unkown
page read and write
BC01000
heap
page read and write
BC01000
heap
page read and write
2FE8000
heap
page read and write
321B000
unkown
page read and write
555AD000
heap
page read and write
16DEE000
stack
page read and write
6C791000
unkown
page execute read
300A000
heap
page read and write
2F1A000
heap
page read and write
2FC8000
heap
page read and write
BC01000
heap
page read and write
BC01000
heap
page read and write
1BE9A000
heap
page read and write
63A000
remote allocation
page execute and read and write
55590000
heap
page read and write
555BC000
heap
page read and write
284EA000
heap
page read and write
2FE8000
heap
page read and write
BF0000
heap
page read and write
2FBB000
heap
page read and write
F10000
heap
page read and write
129F000
stack
page read and write
2FC0000
heap
page read and write
2EDB000
heap
page read and write
6C831000
unkown
page execute read
2FFE000
heap
page read and write
BC10000
heap
page read and write
F48000
heap
page read and write
6CA10000
unkown
page read and write
BC01000
heap
page read and write
2FAF000
heap
page read and write
122BD000
stack
page read and write
ABBD000
stack
page read and write
BC01000
heap
page read and write
BC01000
heap
page read and write
31B6000
unkown
page read and write
10C5000
heap
page read and write
2F0C000
heap
page read and write
2FB0000
heap
page read and write
21E00000
direct allocation
page execute and read and write
1C0A1000
heap
page read and write
31C6000
unkown
page read and write
1557000
trusted library allocation
page execute and read and write
2FB5000
heap
page read and write
2FFA000
heap
page read and write
2FF9000
heap
page read and write
2FC0000
heap
page read and write
1950E000
stack
page read and write
BC01000
heap
page read and write
1BB54000
heap
page read and write
563000
remote allocation
page execute and read and write
300B000
heap
page read and write
31CA000
unkown
page read and write
501C0000
heap
page read and write
6CA0E000
unkown
page read and write
1BB41000
heap
page read and write
2FC8000
heap
page read and write
3007000
heap
page read and write
2F13000
heap
page read and write
2DC4000
heap
page read and write
2FBC000
heap
page read and write
4EDF0000
trusted library allocation
page read and write
2FC8000
heap
page read and write
1BAD6000
heap
page read and write
2EF7000
heap
page read and write
1C09F000
heap
page read and write
5E41000
trusted library allocation
page read and write
BC01000
heap
page read and write
BC01000
heap
page read and write
2DC4000
heap
page read and write
2204D000
direct allocation
page readonly
2FAE000
heap
page read and write
2FFB000
heap
page read and write
3244000
unkown
page read and write
2FE8000
heap
page read and write
2F1A000
heap
page read and write
2FC8000
heap
page read and write
BD00000
unclassified section
page read and write
6E819000
unkown
page readonly
1BD80000
heap
page read and write
555BA000
heap
page read and write
2FB5000
heap
page read and write
3083000
trusted library allocation
page read and write
1483B000
stack
page read and write
12120000
heap
page read and write
2E76000
heap
page read and write
1BCBC000
stack
page read and write
BC01000
heap
page read and write
301E000
stack
page read and write
2FBC000
heap
page read and write
2FC8000
heap
page read and write
2F6D000
heap
page read and write
2FCE000
stack
page read and write
30F9000
heap
page read and write
13DE000
stack
page read and write
2F19000
heap
page read and write
3A330000
heap
page read and write
BC01000
heap
page read and write
2FB5000
heap
page read and write
555BC000
heap
page read and write
BC01000
heap
page read and write
222F8000
heap
page read and write
2FBB000
heap
page read and write
2FC8000
heap
page read and write
2FCE000
heap
page read and write
4EB9F000
stack
page read and write
2F7E000
heap
page read and write
22042000
direct allocation
page read and write
2F4E000
heap
page read and write
4EBB1000
heap
page read and write
6E7F1000
unkown
page execute read
BC01000
heap
page read and write
2FF0000
heap
page read and write
2DC4000
heap
page read and write
2FC8000
heap
page read and write
46B000
remote allocation
page execute and read and write
555B0000
heap
page read and write
BC01000
heap
page read and write
312E000
unkown
page read and write
BC01000
heap
page read and write
2FAD000
heap
page read and write
555B2000
heap
page read and write
AF4000
unkown
page readonly
2F0C000
heap
page read and write
2E50000
heap
page read and write
BC01000
heap
page read and write
2F13000
heap
page read and write
2FAE000
heap
page read and write
2F58000
heap
page read and write
2256A000
stack
page read and write
2FD8000
heap
page read and write
50ACD000
stack
page read and write
22306000
heap
page read and write
1510000
trusted library allocation
page read and write
2D2D000
stack
page read and write
2F82000
heap
page read and write
2FF6000
heap
page read and write
2FD6000
heap
page read and write
319E000
unkown
page read and write
A90000
unkown
page execute and read and write
2DC4000
heap
page read and write
2FBC000
heap
page read and write
1540000
trusted library allocation
page read and write
2D39000
stack
page read and write
2FFA000
heap
page read and write
2FC0000
heap
page read and write
2F79000
heap
page read and write
2FC0000
heap
page read and write
2FC0000
heap
page read and write
1BB60000
heap
page read and write
2FC8000
heap
page read and write
2FB5000
heap
page read and write
1BCF0000
trusted library allocation
page read and write
16F3D000
stack
page read and write
2FAD000
heap
page read and write
2F6E000
stack
page read and write
139E000
stack
page read and write
2FC1000
heap
page read and write
BC01000
heap
page read and write
2C3C000
stack
page read and write
222FE000
heap
page read and write
2200F000
direct allocation
page readonly
2DC4000
heap
page read and write
1534000
trusted library allocation
page read and write
1BE93000
heap
page read and write
1227F000
stack
page read and write
2FC0000
heap
page read and write
2FC8000
heap
page read and write
4875000
trusted library allocation
page read and write
6C81E000
unkown
page read and write
7FAC0000
trusted library allocation
page execute read
2FFA000
heap
page read and write
194D0000
remote allocation
page read and write
BC01000
heap
page read and write
BC01000
heap
page read and write
147FD000
stack
page read and write
2FC8000
heap
page read and write
2F80000
heap
page read and write
2DC4000
heap
page read and write
4EB8000
trusted library allocation
page read and write
2FC0000
heap
page read and write
2DC4000
heap
page read and write
1550000
trusted library allocation
page read and write
31AD000
unkown
page read and write
2FD6000
heap
page read and write
BC01000
heap
page read and write
F6C000
heap
page read and write
BC01000
heap
page read and write
BC01000
heap
page read and write
2E98000
heap
page read and write
154A000
trusted library allocation
page execute and read and write
555BA000
heap
page read and write
2FB5000
heap
page read and write
2FE8000
heap
page read and write
2FC0000
heap
page read and write
2F13000
heap
page read and write
311B000
unkown
page read and write
3087000
trusted library allocation
page read and write
6E7F0000
unkown
page readonly
1BD84000
heap
page read and write
2F80000
heap
page read and write
2FC0000
heap
page read and write
ACBF000
stack
page read and write
B8C000
stack
page read and write
2FE8000
heap
page read and write
6C790000
unkown
page readonly
A90000
unkown
page readonly
2FF9000
heap
page read and write
2FC0000
heap
page read and write
BC01000
heap
page read and write
22306000
heap
page read and write
22018000
direct allocation
page readonly
BC01000
heap
page read and write
5559F000
heap
page read and write
BC20000
heap
page read and write
467000
remote allocation
page execute and read and write
2FF4000
heap
page read and write
2FD9000
heap
page read and write
FE1000
heap
page read and write
2F80000
heap
page read and write
2FBE000
heap
page read and write
2DC4000
heap
page read and write
2FE8000
heap
page read and write
555C0000
heap
page read and write
2FC8000
heap
page read and write
31A7000
unkown
page read and write
555B5000
heap
page read and write
2F80000
heap
page read and write
6C822000
unkown
page readonly
2FAE000
heap
page read and write
2FC0000
heap
page read and write
22300000
heap
page read and write
4E76000
trusted library allocation
page read and write
4E932000
stack
page read and write
2FBB000
heap
page read and write
2FEB000
heap
page read and write
4EA3C000
stack
page read and write
2FD1000
heap
page read and write
2F91000
heap
page read and write
21F66000
direct allocation
page execute read
2234A000
heap
page read and write
2FB5000
heap
page read and write
2FB5000
heap
page read and write
BC01000
heap
page read and write
2F8C000
heap
page read and write
2FD8000
heap
page read and write
1600000
trusted library allocation
page execute and read and write
1BA4F000
stack
page read and write
BD00000
trusted library allocation
page read and write
2FC0000
heap
page read and write
BC01000
heap
page read and write
3011000
heap
page read and write
4CD2000
trusted library allocation
page read and write
2F7A000
heap
page read and write
BC01000
heap
page read and write
555A9000
heap
page read and write
10BE000
stack
page read and write
15FE000
stack
page read and write
6C9CF000
unkown
page readonly
562E000
stack
page read and write
6C830000
unkown
page readonly
3010000
heap
page read and write
1BFDA000
heap
page read and write
2FE8000
heap
page read and write
2229A000
stack
page read and write
3011000
heap
page read and write
BC05000
heap
page read and write
4F76000
trusted library allocation
page read and write
BC01000
heap
page read and write
1BB5C000
heap
page read and write
FF2000
heap
page read and write
1BA6C000
heap
page read and write
57910000
trusted library allocation
page read and write
2DC4000
heap
page read and write
2FBB000
heap
page read and write
2FC0000
heap
page read and write
2FAE000
heap
page read and write
2FDE000
heap
page read and write
5630000
heap
page execute and read and write
31E6000
unkown
page read and write
2FC8000
heap
page read and write
2FBD000
heap
page read and write
1BD40000
trusted library allocation
page read and write
2FB5000
heap
page read and write
2FCA000
heap
page read and write
311F000
unkown
page read and write
555CC000
heap
page read and write
1610000
heap
page read and write
F40000
heap
page read and write
155B000
trusted library allocation
page execute and read and write
BC01000
heap
page read and write
2F13000
heap
page read and write
2200D000
direct allocation
page execute read
194D0000
remote allocation
page read and write
574C2000
trusted library allocation
page read and write
555C4000
heap
page read and write
3240000
unkown
page read and write
1BACD000
heap
page read and write
EFB000
stack
page read and write
A92000
unkown
page readonly
50170000
heap
page read and write
555C4000
heap
page read and write
1524000
trusted library allocation
page read and write
5550E000
stack
page read and write
2E70000
heap
page read and write
5559F000
heap
page read and write
2FBC000
heap
page read and write
2FBC000
heap
page read and write
2FAE000
heap
page read and write
BC01000
heap
page read and write
There are 498 hidden memdumps, click here to show them.