IOC Report
7KVoLQr.exe

loading gif

Files

File Path
Type
Category
Malicious
7KVoLQr.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
data
dropped
 malicious
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm
data
dropped
 malicious
C:\ProgramData\CAAEBKEGHJKEBFHJDBFC
ASCII text, with very long lines (1769), with CRLF line terminators
dropped
C:\ProgramData\DAECGCGH
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\FHDAFIIDAKJDGDHIDAKJ
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FIDHCFBAKFBGDGDHJKJJEGIDAA
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\GHJEGCAE
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 4, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\HDAFBGIJKEGIECAAFHDH
SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JJJEGCGDGHCBFHIDHDAAFBGCFB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\12df6854-239d-451e-83e3-0cf5d3180a9a.tmp
JSON data
modified
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1adab192-bd55-4241-80db-3fc062d2b7fb.tmp
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\29547204-3186-41fc-9b84-63a7fdaee168.tmp
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67D3FA5F-1E04.pma
data
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67D3FA61-1F60.pma
data
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
data
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF20313.TMP (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF21488.TMP (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF214f5.TMP (copy)
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a28d2024-478c-4515-9c75-7dfc6d5e6838.tmp
JSON data
modified
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json
JSON data
dropped
Chrome Cache Entry: 107
ASCII text, with very long lines (5162), with no line terminators
downloaded
Chrome Cache Entry: 108
ASCII text
downloaded
Chrome Cache Entry: 109
ASCII text, with very long lines (1437)
downloaded
Chrome Cache Entry: 110
ASCII text, with very long lines (65531)
downloaded
Chrome Cache Entry: 111
ASCII text, with very long lines (2412)
downloaded
Chrome Cache Entry: 112
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 113
ASCII text, with very long lines (863)
downloaded
There are 33 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\7KVoLQr.exe
"C:\Users\user\Desktop\7KVoLQr.exe"
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2148,i,464690638854917401,3531861548356657985,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2252 /prefetch:3
malicious
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
 malicious
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
malicious
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2592 --field-trial-handle=2236,i,12764412967853214206,3382370563510622868,262144 /prefetch:3
malicious
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2032,i,2847710879292302999,15459927812646094336,262144 /prefetch:3
malicious

URLs

Name
IP
Malicious
http://dug.chickenkiller.com//kj2h34kj23h4/sqlite3.dll
45.132.206.251
 malicious
http://dug.chickenkiller.com//kj2h34kj23h4/vcruntime140.dll
45.132.206.251
 malicious
http://dug.chickenkiller.com//kj2h34kj23h4/freebl3.dll
45.132.206.251
 malicious
chickenkiller.com//gtthfbsb2h.php
malicious
http://dug.chickenkiller.com//kj2h34kj23h4/nss3.dll
45.132.206.251
 malicious
http://dug.chickenkiller.com//kj2h34kj23h4/softokn3.dll
45.132.206.251
 malicious
http://dug.chickenkiller.com/
45.132.206.251
 malicious
http://dug.chickenkiller.com//kj2h34kj23h4/mozglue.dll
45.132.206.251
 malicious
http://dug.chickenkiller.com//gtthfbsb2h.php
45.132.206.251
 malicious
http://dug.chickenkiller.com//kj2h34kj23h4/msvcp140.dll
45.132.206.251
 malicious
https://apis.google.com/domainreliability/upload
142.250.185.110
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
unknown
https://duckduckgo.com/ac/?q=
unknown
http://www.broofa.com
unknown
http://dug.chickenkiller.com//kj2h34kj23h4/nss3.dll0
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpy
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpowser
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpata
unknown
http://dug.chickenkiller.com/l
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpnit.exe
unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
unknown
http://dug.chickenkiller.com/al4859b3ecfa3271e4d5aba091dbb0fc141baafbc.exe
unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpF)
unknown
http://dug.chickenkiller.com//kj2h34kj23h4/msvcp140.dllE
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpminuser-l1-1-05
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpodus.wallet
unknown
http://dug.chickenkiller.com//gtthfbsb2h.php.
unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
142.250.185.196
https://apis.google.com
unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
142.250.185.196
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
unknown
https://domains.google.com/suggest/flow
unknown
http://www.sqlite.org/copyright.html.
unknown
http://dug.chickenkiller.com/gtthfbsb2h.phpd
unknown
http://dug.chickenkiller.com//kj2h34kj23h4/vcruntime140.dllgO
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpA
unknown
http://dug.chickenkiller
unknown
http://dug.chickenkiller.com//kj2h34kj23h4/freebl3.dll(
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
unknown
http://dug.chickenkiller.com/0;q
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ac.ecosia.org?q=
unknown
https://www.google.com/async/newtab_promos
142.250.185.196
http://dug.chickenkiller.com//gtthfbsb2h.phpystem
unknown
http://dug.chickenkiller.com//kj2h34kj23h4/msvcp140.dllT
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpF
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://dug.chickenkiller.com//kj2h34kj23h4/nss3.dlld
unknown
https://plus.google.com
unknown
https://www.google.com/async/ddljson?async=ntp:2
142.250.185.196
https://play.google.com/log?format=json&hasfast=true
unknown
http://dug.chickenkiller.com//kj2h34kj23h4/vcruntime140.dllGO
unknown
https://www.ecosia.org/newtab/v20
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpd
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpGN
unknown
http://dug.chickenkiller.com/esk
unknown
http://dug.chickenkiller.com//gtthfbsb2h.phpa
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://duckduckgo.com/chrome_newtabv20
unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0
142.250.185.110
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
unknown
https://support.mozilla.org
unknown
http://dug.chickenkiller.com//kj2h34kj23h4/freebl3.dll;
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://gemini.google.com/app?q=
unknown
http://dug.chickenkiller.com/ontdesk
unknown
http://dug.chickenkiller.com/al
unknown
https://clients6.google.com
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
unknown
There are 66 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
dug.chickenkiller.com
45.132.206.251
 malicious
plus.l.google.com
142.250.185.110
play.google.com
142.250.185.206
beacons-handoff.gcp.gvt2.com
142.250.180.99
e2c76.gcp.gvt2.com
34.1.52.129
www.google.com
142.250.185.196
beacons.gvt2.com
142.251.143.35
beacons.gcp.gvt2.com
unknown
apis.google.com
unknown

IPs

IP
Domain
Country
Malicious
192.168.2.7
unknown
unknown
malicious
45.132.206.251
dug.chickenkiller.com
Russian Federation
malicious
142.250.185.110
plus.l.google.com
United States
142.250.185.196
www.google.com
United States
192.168.2.12
unknown
unknown
142.250.186.100
unknown
United States
127.0.0.1
unknown
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\MSUTB
Left
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\MSUTB
Top
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
state
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
StatusCodes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
StatusCodes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
state
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
state
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
StatusCodes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
StatusCodes
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
state
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
user_experience_metrics.stability.exited_cleanly
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
321000
unkown
page execute and read and write
 malicious
4B40000
direct allocation
page read and write
 malicious
DEE000
heap
page read and write
 malicious
46C1000
heap
page read and write
50DE000
stack
page read and write
61E00000
direct allocation
page execute and read and write
D44000
heap
page read and write
4B40000
direct allocation
page read and write
31BE000
stack
page read and write
5650000
heap
page read and write
46C1000
heap
page read and write
4CD0000
direct allocation
page execute and read and write
46C1000
heap
page read and write
5650000
heap
page read and write
41BF000
stack
page read and write
5740000
trusted library allocation
page read and write
D44000
heap
page read and write
61ED3000
direct allocation
page read and write
6CE85000
unkown
page readonly
DCD000
stack
page read and write
5634000
heap
page read and write
46C1000
heap
page read and write
2CBE000
stack
page read and write
5611000
heap
page read and write
D44000
heap
page read and write
46C1000
heap
page read and write
6CE7F000
unkown
page write copy
B758000
heap
page read and write
5634000
heap
page read and write
61E01000
direct allocation
page execute read
D40000
heap
page read and write
61ECD000
direct allocation
page readonly
3A7E000
stack
page read and write
46C1000
heap
page read and write
BBCC000
heap
page read and write
61ED4000
direct allocation
page readonly
B700000
heap
page read and write
357E000
stack
page read and write
D44000
heap
page read and write
5611000
heap
page read and write
4B00000
heap
page read and write
5650000
heap
page read and write
46C1000
heap
page read and write
32FE000
stack
page read and write
9C8000
stack
page read and write
46C1000
heap
page read and write
320000
unkown
page readonly
D44000
heap
page read and write
46C1000
heap
page read and write
D44000
heap
page read and write
564B000
heap
page read and write
3D5000
unkown
page execute and read and write
46C1000
heap
page read and write
5642000
heap
page read and write
46C1000
heap
page read and write
562D000
heap
page read and write
46D7000
heap
page read and write
29D0000
direct allocation
page read and write
126A0000
heap
page read and write
6CC00000
unkown
page readonly
561A000
heap
page read and write
5629000
heap
page read and write
46C1000
heap
page read and write
2A3C000
stack
page read and write
28BE000
stack
page read and write
E63000
heap
page read and write
D8D000
stack
page read and write
4B00000
trusted library allocation
page read and write
5629000
heap
page read and write
D44000
heap
page read and write
41FE000
stack
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
9C2000
stack
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
BB30000
trusted library allocation
page read and write
46C1000
heap
page read and write
536D000
stack
page read and write
5618000
heap
page read and write
ECF000
heap
page read and write
D44000
heap
page read and write
4CA0000
direct allocation
page execute and read and write
D44000
heap
page read and write
46C1000
heap
page read and write
42FF000
stack
page read and write
D44000
heap
page read and write
5637000
heap
page read and write
546D000
stack
page read and write
D44000
heap
page read and write
353F000
stack
page read and write
562F000
heap
page read and write
37FE000
stack
page read and write
4CE0000
direct allocation
page execute and read and write
46C1000
heap
page read and write
562E000
heap
page read and write
3F7E000
stack
page read and write
6CC7D000
unkown
page readonly
561A000
heap
page read and write
833000
unkown
page execute and read and write
46C0000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
487000
unkown
page execute and read and write
46C1000
heap
page read and write
5634000
heap
page read and write
3A3F000
stack
page read and write
532C000
stack
page read and write
5643000
heap
page read and write
38FF000
stack
page read and write
564C000
heap
page read and write
562C000
heap
page read and write
407F000
stack
page read and write
562E000
heap
page read and write
5610000
heap
page read and write
5633000
heap
page read and write
5647000
heap
page read and write
522E000
stack
page read and write
B720000
heap
page read and write
5644000
heap
page read and write
D44000
heap
page read and write
46C1000
heap
page read and write
B6C0000
heap
page read and write
29F7000
heap
page read and write
5650000
heap
page read and write
29D0000
direct allocation
page read and write
46C1000
heap
page read and write
507F000
stack
page read and write
EC9000
heap
page read and write
D44000
heap
page read and write
4C90000
direct allocation
page execute and read and write
D44000
heap
page read and write
29D0000
direct allocation
page read and write
2C7F000
stack
page read and write
443F000
stack
page read and write
29D0000
direct allocation
page read and write
61EB7000
direct allocation
page readonly
5642000
heap
page read and write
B6B0000
trusted library allocation
page read and write
4F3F000
stack
page read and write
D44000
heap
page read and write
70F000
unkown
page execute and read and write
FDE000
stack
page read and write
5600000
heap
page read and write
46C1000
heap
page read and write
4B40000
direct allocation
page read and write
560F000
heap
page read and write
46C1000
heap
page read and write
5602000
heap
page read and write
5604000
heap
page read and write
3F3F000
stack
page read and write
29D0000
direct allocation
page read and write
29D0000
direct allocation
page read and write
BBD2000
heap
page read and write
4CC0000
direct allocation
page execute and read and write
54EE000
stack
page read and write
2EFF000
stack
page read and write
D44000
heap
page read and write
D44000
heap
page read and write
46C1000
heap
page read and write
561A000
heap
page read and write
46C1000
heap
page read and write
5618000
heap
page read and write
2B7E000
stack
page read and write
46C1000
heap
page read and write
564A000
heap
page read and write
46C1000
heap
page read and write
3EC000
unkown
page execute and read and write
D00000
heap
page read and write
B752000
heap
page read and write
5648000
heap
page read and write
B746000
heap
page read and write
6CE80000
unkown
page read and write
5643000
heap
page read and write
46C1000
heap
page read and write
33FF000
stack
page read and write
5634000
heap
page read and write
36BE000
stack
page read and write
B7F4000
heap
page read and write
B6B6000
heap
page read and write
46C1000
heap
page read and write
562C000
heap
page read and write
46C1000
heap
page read and write
E35000
heap
page read and write
B6C2000
heap
page read and write
5638000
heap
page read and write
D44000
heap
page read and write
46C1000
heap
page read and write
562E000
heap
page read and write
B6C8000
heap
page read and write
4CCE000
stack
page read and write
46C1000
heap
page read and write
D44000
heap
page read and write
46D0000
heap
page read and write
561A000
heap
page read and write
561A000
heap
page read and write
46C1000
heap
page read and write
D44000
heap
page read and write
367F000
stack
page read and write
B7AC000
heap
page read and write
B73C000
heap
page read and write
5642000
heap
page read and write
4E3E000
stack
page read and write
DEA000
heap
page read and write
287E000
stack
page read and write
29FB000
heap
page read and write
E80000
heap
page read and write
722000
unkown
page execute and write copy
5634000
heap
page read and write
4CC0000
direct allocation
page execute and read and write
4C7F000
stack
page read and write
564B000
heap
page read and write
562A000
heap
page read and write
BBCA000
heap
page read and write
722000
unkown
page execute and read and write
29D0000
direct allocation
page read and write
5650000
heap
page read and write
3A4000
unkown
page execute and read and write
3BBE000
stack
page read and write
6E4000
unkown
page execute and read and write
D44000
heap
page read and write
3E3E000
stack
page read and write
562C000
heap
page read and write
56C000
unkown
page execute and read and write
5634000
heap
page read and write
29D0000
direct allocation
page read and write
5650000
heap
page read and write
D44000
heap
page read and write
5637000
heap
page read and write
46C1000
heap
page read and write
5606000
heap
page read and write
5650000
heap
page read and write
37BF000
stack
page read and write
B6E0000
heap
page read and write
29BF000
stack
page read and write
56AD000
heap
page read and write
D44000
heap
page read and write
C20000
heap
page read and write
126AA000
heap
page read and write
6CC92000
unkown
page readonly
393E000
stack
page read and write
562B000
heap
page read and write
B7C0000
trusted library allocation
page read and write
46C1000
heap
page read and write
5629000
heap
page read and write
5634000
heap
page read and write
561A000
heap
page read and write
6CC8E000
unkown
page read and write
564D000
heap
page read and write
61ECC000
direct allocation
page read and write
46C1000
heap
page read and write
6CE3F000
unkown
page readonly
46C1000
heap
page read and write
562A000
heap
page read and write
ECD000
heap
page read and write
46C1000
heap
page read and write
4DFF000
stack
page read and write
561A000
heap
page read and write
5650000
heap
page read and write
4CB0000
direct allocation
page execute and read and write
E6D000
heap
page read and write
5637000
heap
page read and write
29D0000
direct allocation
page read and write
6CC01000
unkown
page execute read
D44000
heap
page read and write
457F000
stack
page read and write
558000
unkown
page execute and read and write
B7E0000
heap
page read and write
B7C0000
heap
page read and write
46C1000
heap
page read and write
55ED000
stack
page read and write
561C000
heap
page read and write
625000
unkown
page execute and read and write
46C1000
heap
page read and write
307E000
stack
page read and write
5628000
heap
page read and write
3CBF000
stack
page read and write
5642000
heap
page read and write
3B7F000
stack
page read and write
6CCA0000
unkown
page readonly
32BF000
stack
page read and write
B74F000
heap
page read and write
46E0000
heap
page read and write
D44000
heap
page read and write
D44000
heap
page read and write
4CF0000
direct allocation
page execute and read and write
D44000
heap
page read and write
B741000
heap
page read and write
5631000
heap
page read and write
2F3E000
stack
page read and write
D44000
heap
page read and write
5634000
heap
page read and write
5612000
heap
page read and write
D44000
heap
page read and write
6CE7E000
unkown
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
40BE000
stack
page read and write
46C1000
heap
page read and write
61EB4000
direct allocation
page read and write
343E000
stack
page read and write
BA2E000
stack
page read and write
5650000
heap
page read and write
2DBF000
stack
page read and write
45BE000
stack
page read and write
DE0000
heap
page read and write
562D000
heap
page read and write
5634000
heap
page read and write
562B000
heap
page read and write
29D0000
direct allocation
page read and write
56AC000
heap
page read and write
BBC4000
heap
page read and write
433E000
stack
page read and write
B6CD000
heap
page read and write
562A000
heap
page read and write
5642000
heap
page read and write
29D0000
direct allocation
page read and write
B6B0000
heap
page read and write
B6BB000
heap
page read and write
5650000
heap
page read and write
D44000
heap
page read and write
6CCA1000
unkown
page execute read
46C1000
heap
page read and write
D44000
heap
page read and write
5629000
heap
page read and write
4B7C000
stack
page read and write
29D0000
direct allocation
page read and write
5626000
heap
page read and write
447E000
stack
page read and write
29D0000
direct allocation
page read and write
5642000
heap
page read and write
29F0000
heap
page read and write
46C1000
heap
page read and write
12BBA000
heap
page read and write
5610000
heap
page read and write
5626000
heap
page read and write
5650000
heap
page read and write
61ED0000
direct allocation
page read and write
46C1000
heap
page read and write
564C000
heap
page read and write
46C1000
heap
page read and write
2DFE000
stack
page read and write
46C1000
heap
page read and write
D44000
heap
page read and write
51DF000
stack
page read and write
317F000
stack
page read and write
320000
unkown
page read and write
BB2F000
stack
page read and write
3CFD000
stack
page read and write
5644000
heap
page read and write
46C1000
heap
page read and write
46C1000
heap
page read and write
5650000
heap
page read and write
723000
unkown
page execute and write copy
562E000
heap
page read and write
E49000
heap
page read and write
E70000
heap
page read and write
303F000
stack
page read and write
5647000
heap
page read and write
D44000
heap
page read and write
564B000
heap
page read and write
B7C0000
trusted library allocation
page read and write
46C1000
heap
page read and write
5626000
heap
page read and write
46C1000
heap
page read and write
5634000
heap
page read and write
471E000
heap
page read and write
46C1000
heap
page read and write
4F7E000
stack
page read and write
5649000
heap
page read and write
BB60000
heap
page read and write
D44000
heap
page read and write
46C1000
heap
page read and write
2B3F000
stack
page read and write
46C1000
heap
page read and write
5745000
heap
page read and write
5650000
heap
page read and write
46C1000
heap
page read and write
29D0000
direct allocation
page read and write
D44000
heap
page read and write
5642000
heap
page read and write
D44000
heap
page read and write
5642000
heap
page read and write
56BC000
heap
page read and write
B73E000
heap
page read and write
46C1000
heap
page read and write
562E000
heap
page read and write
8CB000
stack
page read and write
5650000
heap
page read and write
321000
unkown
page execute and write copy
5638000
heap
page read and write
D44000
heap
page read and write
29FE000
heap
page read and write
5634000
heap
page read and write
3DFF000
stack
page read and write
29C0000
heap
page read and write
BBD2000
heap
page read and write
46BF000
stack
page read and write
There are 388 hidden memdumps, click here to show them.