IOC Report
E-DEKONT.exe

loading gif

Files

File Path
Type
Category
Malicious
E-DEKONT.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
malicious
C:\Users\user\AppData\Local\Temp\444685002784711619507383.tmp
SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 3, database pages 22, 1st free page 7, free pages 2, cookie 0x10, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-console-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-datetime-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-debug-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-errorhandling-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-file-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-file-l1-2-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-file-l2-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-handle-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-heap-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-interlocked-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-libraryloader-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-localization-l1-2-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-memory-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-namedpipe-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-processenvironment-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-processthreads-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-processthreads-l1-1-1.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-profile-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-rtlsupport-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-string-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-synch-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-synch-l1-2-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-sysinfo-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-timezone-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-core-util-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-conio-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-convert-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-environment-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-filesystem-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-heap-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-locale-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-math-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-multibyte-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-private-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-process-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-runtime-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-stdio-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-string-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-time-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\api-ms-win-crt-utility-l1-1-0.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\nssdbm3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\ucrtbase.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\75C649CD\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsx82F6.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Ydervgg\Superassume\dodecaheddra\Internalisere\Brnesangen.End
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Ydervgg\Superassume\dodecaheddra\Sldede\memstat.c
C source, ASCII text
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Ydervgg\Superassume\dodecaheddra\Sldede\selection-end-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Ydervgg\Superassume\dodecaheddra\logicalization\libxml2-2.0.typelib
HTML document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Ydervgg\Superassume\dodecaheddra\logicalization\sgelngdernes.Dep74
data
dropped
There are 46 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\E-DEKONT.exe
C:\Users\user\Desktop\E-DEKONT.exe
malicious
C:\Users\user\Desktop\E-DEKONT.exe
C:\Users\user\Desktop\E-DEKONT.exe
malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "E-DEKONT.exe
malicious
C:\Windows\SysWOW64\timeout.exe
C:\Windows\system32\timeout.exe 3
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://dbxo1.shop/db1/index.php
104.21.44.194
malicious
http://www.mozilla.com/en-US/blocklist/
unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
unknown
http://dbxo1.shop/db1/index.phpl
unknown
http://dbxo1.shop/db1/index.phpM
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0
unknown
http://dbxo1.shop/
unknown
http://ocsp.thawte.com0
unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
unknown
http://www.mozilla.com0
unknown
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
http://dbxo1.shop/db1/index.php~
unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
unknown
http://www.gopher.ftp://ftp.
unknown
http://dbxo1.shop/db1/index.phpe
unknown
https://aapancart.com/DOHx
unknown
https://aapancart.com/qO
unknown
There are 9 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
dbxo1.shop
104.21.44.194
malicious
aapancart.com
103.14.99.114

IPs

IP
Domain
Country
Malicious
104.21.44.194
dbxo1.shop
United States
malicious
103.14.99.114
aapancart.com
Singapore

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fivefoldness\Endosseringerne\Fouragen
Arigue
HKEY_CURRENT_USER\SOFTWARE\Fruticeta\Lavandin\Kingliest\Ernringsenhed
Legating

Memdumps

Base Address
Regiontype
Protect
Malicious
2B60000
direct allocation
page execute and read and write
malicious
1D9E0000
direct allocation
page read and write
malicious
1660000
remote allocation
page execute and read and write
malicious
1D4D0000
direct allocation
page read and write
malicious
1D4D4000
direct allocation
page read and write
1DDCC000
direct allocation
page read and write
1E798000
direct allocation
page read and write
1E724000
direct allocation
page read and write
1DAE0000
direct allocation
page read and write
1CA31000
heap
page read and write
1DDD8000
direct allocation
page read and write
1E2B4000
direct allocation
page read and write
1DDC0000
direct allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
400000
unkown
page readonly
1DDC0000
direct allocation
page read and write
1970000
trusted library allocation
page read and write
1CA31000
heap
page read and write
1E788000
direct allocation
page read and write
1D560000
direct allocation
page read and write
1DDC0000
direct allocation
page read and write
1DC68000
direct allocation
page read and write
1CA31000
heap
page read and write
1D5B0000
direct allocation
page read and write
1AC1000
heap
page read and write
43C000
unkown
page read and write
10001000
unkown
page execute read
1CA31000
heap
page read and write
649000
unkown
page write copy
50000
heap
page read and write
408000
unkown
page readonly
1DDC0000
direct allocation
page read and write
1DDC4000
direct allocation
page read and write
1CA31000
heap
page read and write
1DDC4000
direct allocation
page read and write
1E704000
direct allocation
page read and write
1CBB0000
trusted library allocation
page read and write
1CE0000
heap
page read and write
1D570000
direct allocation
page read and write
476000
unkown
page readonly
1D4D4000
direct allocation
page read and write
1AB5000
heap
page read and write
790000
heap
page read and write
5F5000
heap
page read and write
5F7000
heap
page read and write
1D7E0000
direct allocation
page read and write
1D570000
direct allocation
page read and write
476000
unkown
page readonly
1D16F000
stack
page read and write
1E780000
direct allocation
page read and write
1CA31000
heap
page read and write
1D4D4000
direct allocation
page read and write
40A000
unkown
page write copy
431000
unkown
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1A72000
heap
page read and write
1DDD0000
direct allocation
page read and write
1AC1000
heap
page read and write
1AC2000
heap
page read and write
40A000
unkown
page write copy
1DDC8000
direct allocation
page read and write
1D4D8000
direct allocation
page read and write
1E720000
direct allocation
page read and write
1DDC4000
direct allocation
page read and write
1D500000
direct allocation
page read and write
1DDC8000
direct allocation
page read and write
1AC8000
heap
page read and write
1E7CC000
direct allocation
page read and write
1DF30000
direct allocation
page read and write
2AB0000
trusted library allocation
page read and write
1A72000
heap
page read and write
5F2000
unkown
page write copy
1E740000
direct allocation
page read and write
1E744000
direct allocation
page read and write
1D39C000
stack
page read and write
401000
unkown
page execute read
1DDCC000
direct allocation
page read and write
1CFAF000
stack
page read and write
2E00000
trusted library allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
6B0000
heap
page read and write
1D570000
direct allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
670000
heap
page read and write
1CA31000
heap
page read and write
1DDC0000
direct allocation
page read and write
1DDC0000
direct allocation
page read and write
1D500000
direct allocation
page read and write
1D4E0000
direct allocation
page read and write
1D180000
heap
page read and write
1CA31000
heap
page read and write
1AC1000
heap
page read and write
1AC1000
heap
page read and write
196E000
stack
page read and write
1D4E4000
direct allocation
page read and write
1CA31000
heap
page read and write
1DDC4000
direct allocation
page read and write
1DDC8000
direct allocation
page read and write
1D4D4000
direct allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1D530000
direct allocation
page read and write
1CA31000
heap
page read and write
439000
unkown
page write copy
1CA31000
heap
page read and write
1C0000
remote allocation
page read and write
1D4E0000
direct allocation
page read and write
1CA31000
heap
page read and write
1D530000
direct allocation
page read and write
1D580000
direct allocation
page read and write
401000
unkown
page execute read
1DDD0000
direct allocation
page read and write
1CA31000
heap
page read and write
401000
unkown
page execute read
1AB5000
heap
page read and write
5EA000
unkown
page write copy
1CA31000
heap
page read and write
10003000
unkown
page readonly
1AC9000
heap
page read and write
1D580000
direct allocation
page read and write
1D5A0000
direct allocation
page read and write
1DA34000
direct allocation
page read and write
1864000
heap
page read and write
1CA31000
heap
page read and write
23D5000
heap
page read and write
1CA31000
heap
page read and write
1DE68000
direct allocation
page read and write
4340000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
10005000
unkown
page readonly
1D5A0000
direct allocation
page read and write
19EE000
stack
page read and write
1CA31000
heap
page read and write
1D30E000
stack
page read and write
1E730000
direct allocation
page read and write
1D4F0000
direct allocation
page read and write
1D12E000
stack
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1A67000
heap
page read and write
5F0000
unkown
page write copy
1DDD0000
direct allocation
page read and write
1CFEE000
stack
page read and write
23D0000
heap
page read and write
1CA31000
heap
page read and write
1DDC8000
direct allocation
page read and write
96E000
stack
page read and write
30000
heap
page read and write
1DDC8000
direct allocation
page read and write
1EBE0000
trusted library allocation
page read and write
10059000
trusted library allocation
page read and write
1D02E000
stack
page read and write
1CA31000
heap
page read and write
1DDC8000
direct allocation
page read and write
1CA31000
heap
page read and write
50E000
stack
page read and write
5E0000
heap
page read and write
1DDA8000
direct allocation
page read and write
1DDC8000
direct allocation
page read and write
1AC1000
heap
page read and write
1D26F000
stack
page read and write
1D5B0000
direct allocation
page read and write
1CA31000
heap
page read and write
5E8000
unkown
page write copy
1DDD0000
direct allocation
page read and write
1E90E000
direct allocation
page read and write
1CA31000
heap
page read and write
1E72C000
direct allocation
page read and write
1E774000
direct allocation
page read and write
1DA3C000
direct allocation
page read and write
20000
unclassified section
page readonly
1D590000
direct allocation
page read and write
1AE0000
heap
page read and write
797000
heap
page read and write
1CA31000
heap
page read and write
1E7AC000
direct allocation
page read and write
1CA31000
heap
page read and write
2A30000
trusted library allocation
page read and write
1D4E0000
direct allocation
page read and write
1DAB8000
direct allocation
page read and write
1CA31000
heap
page read and write
1D4E0000
direct allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1C0000
remote allocation
page read and write
1BF000
stack
page read and write
1CA31000
heap
page read and write
1D4F0000
direct allocation
page read and write
1D540000
direct allocation
page read and write
1CA31000
heap
page read and write
1D520000
direct allocation
page read and write
192E000
stack
page read and write
1DDCC000
direct allocation
page read and write
1CA31000
heap
page read and write
45C000
unkown
page read and write
1D5E0000
direct allocation
page read and write
1D4F0000
direct allocation
page read and write
1DDF8000
direct allocation
page read and write
1DDC8000
direct allocation
page read and write
1D580000
direct allocation
page read and write
1CA31000
heap
page read and write
1DA30000
direct allocation
page read and write
1D550000
direct allocation
page read and write
1CF6E000
stack
page read and write
1CA31000
heap
page read and write
476000
unkown
page readonly
1E748000
direct allocation
page read and write
1DDD8000
direct allocation
page read and write
1DDC8000
direct allocation
page read and write
58E000
stack
page read and write
1AC1000
heap
page read and write
1E770000
direct allocation
page read and write
1CA31000
heap
page read and write
476000
unkown
page readonly
1D580000
direct allocation
page read and write
1D4D4000
direct allocation
page read and write
1D510000
direct allocation
page read and write
1C0000
remote allocation
page read and write
1D0000
unclassified section
page readonly
1A6E000
heap
page read and write
1D22E000
stack
page read and write
1D520000
direct allocation
page read and write
1DDD8000
direct allocation
page read and write
1DDC0000
direct allocation
page read and write
1CA40000
heap
page read and write
18AE000
stack
page read and write
1DDD4000
direct allocation
page read and write
1E750000
direct allocation
page read and write
1E74C000
direct allocation
page read and write
1DDC4000
direct allocation
page read and write
1D5A0000
direct allocation
page read and write
1CA31000
heap
page read and write
1DDC0000
direct allocation
page read and write
1D4D4000
direct allocation
page read and write
1DDCC000
direct allocation
page read and write
1E728000
direct allocation
page read and write
1AB5000
heap
page read and write
1DDC4000
direct allocation
page read and write
1D4D4000
direct allocation
page read and write
1DDC4000
direct allocation
page read and write
1E7D0000
direct allocation
page read and write
1B2F000
stack
page read and write
1D34F000
stack
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1DDD0000
direct allocation
page read and write
281F000
stack
page read and write
F0000
trusted library allocation
page read and write
30000
heap
page read and write
1DDC0000
direct allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
19F0000
heap
page read and write
1CA31000
heap
page read and write
1A72000
heap
page read and write
1D550000
direct allocation
page read and write
1D4D4000
direct allocation
page read and write
10020000
trusted library allocation
page read and write
1CA31000
heap
page read and write
1AB5000
heap
page read and write
1CB70000
trusted library allocation
page read and write
231E000
stack
page read and write
1CA31000
heap
page read and write
1DDD4000
direct allocation
page read and write
1D4D4000
direct allocation
page read and write
1CA31000
heap
page read and write
AAF000
stack
page read and write
1CA31000
heap
page read and write
400000
unkown
page readonly
1DDC4000
direct allocation
page read and write
1D510000
direct allocation
page read and write
1D520000
direct allocation
page read and write
1D560000
direct allocation
page read and write
1CA31000
heap
page read and write
1DDC4000
direct allocation
page read and write
B0000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1AB5000
heap
page read and write
1D590000
direct allocation
page read and write
1D520000
direct allocation
page read and write
1CA31000
heap
page read and write
401000
unkown
page execute read
1DDCC000
direct allocation
page read and write
1E734000
direct allocation
page read and write
437000
unkown
page read and write
1E764000
direct allocation
page read and write
1D530000
direct allocation
page read and write
1D590000
direct allocation
page read and write
1CA31000
heap
page read and write
1DDC4000
direct allocation
page read and write
1CA31000
heap
page read and write
20000
unclassified section
page readonly
1D500000
direct allocation
page read and write
40A000
unkown
page write copy
1DDC4000
direct allocation
page read and write
2A70000
trusted library allocation
page read and write
19A000
stack
page read and write
1CA31000
heap
page read and write
40000
unclassified section
page readonly
1DDC4000
direct allocation
page read and write
408000
unkown
page readonly
1D540000
direct allocation
page read and write
1CA31000
heap
page read and write
1D4E0000
direct allocation
page read and write
5EC000
unkown
page write copy
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1DF30000
direct allocation
page read and write
1AB5000
heap
page read and write
1D06E000
stack
page read and write
1E380000
direct allocation
page read and write
1DA28000
direct allocation
page read and write
1D5B0000
direct allocation
page read and write
130000
unclassified section
page readonly
1CA31000
heap
page read and write
1ACD000
heap
page read and write
1D4F4000
direct allocation
page read and write
1D550000
direct allocation
page read and write
400000
unkown
page readonly
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1DDF4000
direct allocation
page read and write
1CA31000
heap
page read and write
86F000
stack
page read and write
1A72000
heap
page read and write
1CA31000
heap
page read and write
1D500000
direct allocation
page read and write
96000
stack
page read and write
1CA31000
heap
page read and write
1DC50000
direct allocation
page read and write
1CA31000
heap
page read and write
1E7A8000
direct allocation
page read and write
1CA31000
heap
page read and write
1DDCC000
direct allocation
page read and write
1E7CC000
direct allocation
page read and write
1EADC000
stack
page read and write
1DDCC000
direct allocation
page read and write
1CA31000
heap
page read and write
1D510000
direct allocation
page read and write
1D6E0000
direct allocation
page read and write
1DB20000
direct allocation
page read and write
400000
unkown
page readonly
1DDC8000
direct allocation
page read and write
2260000
heap
page read and write
400000
unkown
page readonly
1D570000
direct allocation
page read and write
1DDCC000
direct allocation
page read and write
1E708000
direct allocation
page read and write
1D560000
direct allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1AC1000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1AC8000
heap
page read and write
1E76C000
direct allocation
page read and write
1DC8C000
direct allocation
page read and write
1CA31000
heap
page read and write
5F0000
heap
page read and write
1CA31000
heap
page read and write
1C0000
remote allocation
page read and write
1E78C000
direct allocation
page read and write
1E75C000
direct allocation
page read and write
1E800000
direct allocation
page read and write
6BC000
heap
page read and write
1E6F8000
direct allocation
page read and write
6AA000
heap
page read and write
1CA31000
heap
page read and write
1CA30000
heap
page read and write
1A3B000
heap
page read and write
1AC1000
heap
page read and write
1D500000
direct allocation
page read and write
1CE6000
heap
page read and write
5CF000
stack
page read and write
1E758000
direct allocation
page read and write
1A5B000
heap
page read and write
1CA31000
heap
page read and write
1AB5000
heap
page read and write
1E714000
direct allocation
page read and write
1CA31000
heap
page read and write
1A5B000
heap
page read and write
408000
unkown
page readonly
1CA31000
heap
page read and write
1AC1000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1AC1000
heap
page read and write
1DAE0000
direct allocation
page read and write
1DDD0000
direct allocation
page read and write
510000
trusted library allocation
page read and write
476000
unkown
page readonly
1DDC8000
direct allocation
page read and write
1DDC8000
direct allocation
page read and write
1D2D0000
remote allocation
page read and write
1CA31000
heap
page read and write
677000
heap
page read and write
59E000
stack
page read and write
1DDC4000
direct allocation
page read and write
1DDC4000
direct allocation
page read and write
1E700000
direct allocation
page read and write
1DDC4000
direct allocation
page read and write
60000
direct allocation
page read and write
1CA31000
heap
page read and write
1E754000
direct allocation
page read and write
60000
trusted library allocation
page read and write
1A72000
heap
page read and write
1CA31000
heap
page read and write
473000
unkown
page read and write
1DDC8000
direct allocation
page read and write
1D500000
direct allocation
page read and write
1EBE1000
trusted library allocation
page read and write
1CA31000
heap
page read and write
9AE000
stack
page read and write
1DA90000
direct allocation
page read and write
1DA38000
direct allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
2CC0000
heap
page read and write
1D8E0000
direct allocation
page read and write
1CA31000
heap
page read and write
1E768000
direct allocation
page read and write
1AB5000
heap
page read and write
1DDD0000
direct allocation
page read and write
1CA31000
heap
page read and write
1E7C0000
direct allocation
page read and write
1CA31000
heap
page read and write
1E7C4000
direct allocation
page read and write
1CA31000
heap
page read and write
1DDC8000
direct allocation
page read and write
1DDC8000
direct allocation
page read and write
1DDC4000
direct allocation
page read and write
408000
unkown
page readonly
1ACA000
heap
page read and write
1C0000
remote allocation
page read and write
1CA31000
heap
page read and write
1D540000
direct allocation
page read and write
1D560000
direct allocation
page read and write
10000000
unkown
page readonly
1D4D4000
direct allocation
page read and write
18EF000
stack
page read and write
1DDC8000
direct allocation
page read and write
401000
unkown
page execute read
1D510000
direct allocation
page read and write
1CA31000
heap
page read and write
5EE000
unkown
page write copy
2CC1000
heap
page read and write
1CA31000
heap
page read and write
1A72000
heap
page read and write
1D0000
unclassified section
page readonly
40A000
unkown
page write copy
408000
unkown
page readonly
1D0AD000
stack
page read and write
1DDC0000
direct allocation
page read and write
1D530000
direct allocation
page read and write
1D590000
direct allocation
page read and write
1A6E000
heap
page read and write
1FE000
stack
page read and write
1C0000
remote allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
600000
trusted library allocation
page read and write
1DA28000
direct allocation
page read and write
1CA31000
heap
page read and write
408000
unkown
page readonly
1DDCC000
direct allocation
page read and write
1D4F0000
direct allocation
page read and write
1D510000
direct allocation
page read and write
1CA31000
heap
page read and write
1AC1000
heap
page read and write
1CA31000
heap
page read and write
1D4D4000
direct allocation
page read and write
1CA31000
heap
page read and write
1DDC0000
direct allocation
page read and write
1CA31000
heap
page read and write
1DDC8000
direct allocation
page read and write
1E900000
direct allocation
page read and write
1DDC0000
direct allocation
page read and write
1E79C000
direct allocation
page read and write
1D550000
direct allocation
page read and write
1D4F0000
direct allocation
page read and write
42F000
unkown
page read and write
1D2D0000
remote allocation
page read and write
FC000
stack
page read and write
3359000
trusted library allocation
page read and write
17E000
stack
page read and write
1CA31000
heap
page read and write
1E70C000
direct allocation
page read and write
1DDC8000
direct allocation
page read and write
40A000
unkown
page read and write
1DDCC000
direct allocation
page read and write
2264000
heap
page read and write
1CA31000
heap
page read and write
1D4E0000
direct allocation
page read and write
1D48C000
stack
page read and write
60000
direct allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1D540000
direct allocation
page read and write
1CA31000
heap
page read and write
1D49B000
stack
page read and write
1E784000
direct allocation
page read and write
1AD1000
heap
page read and write
1E710000
direct allocation
page read and write
5DE000
stack
page read and write
1CA31000
heap
page read and write
1A72000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
2E40000
trusted library allocation
page read and write
43F000
unkown
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
1E912000
direct allocation
page read and write
400000
unkown
page readonly
1CA31000
heap
page read and write
235E000
stack
page read and write
291F000
stack
page read and write
1DDC4000
direct allocation
page read and write
1CA31000
heap
page read and write
1D4F0000
direct allocation
page read and write
476000
unkown
page readonly
1CA31000
heap
page read and write
1DDC0000
direct allocation
page read and write
1DDC4000
direct allocation
page read and write
1660000
remote allocation
page execute and read and write
1CA31000
heap
page read and write
1EBDD000
stack
page read and write
1DE6C000
direct allocation
page read and write
1CA31000
heap
page read and write
1AB5000
heap
page read and write
1CA31000
heap
page read and write
1D520000
direct allocation
page read and write
1AB5000
heap
page read and write
1CA31000
heap
page read and write
1DDCC000
direct allocation
page read and write
19F8000
heap
page read and write
1DDC4000
direct allocation
page read and write
1DDC0000
direct allocation
page read and write
1D2D0000
remote allocation
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
2270000
heap
page read and write
1CA31000
heap
page read and write
401000
unkown
page execute read
1CA31000
heap
page read and write
650000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
626000
unkown
page write copy
1E7D0000
direct allocation
page read and write
1A72000
heap
page read and write
40A000
unkown
page write copy
1049000
unkown
page write copy
1A52000
heap
page read and write
1DDD0000
direct allocation
page read and write
1860000
heap
page read and write
1CA31000
heap
page read and write
1CA31000
heap
page read and write
BC000
stack
page read and write
1DDD0000
direct allocation
page read and write
1CA31000
heap
page read and write
1A6F000
heap
page read and write
There are 565 hidden memdumps, click here to show them.