IOC Report
SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\QEGVANwj0k6bYEp2nEbzchm.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\rage131MP.tmp
ASCII text, with no line terminators
modified
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\02zdBXl47cvzcookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\21DwcKzffyvaHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\3b6N2Xdh3CYwplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\6IHWoe8lbZ9DHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\7_kVUmGHRa2QCookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\B3Goucp0LR0WHistory
SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\D4_tggVjtkMeHistory
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\D87fZN3R3jFeplaces.sqlite
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\G_ExU1umMCApWeb Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\H6IiOe1a4hMNWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\KBaxgQuPqXyZWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\VuhoTc5LnxleLogin Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\bIxp5h8t6jVCLogin Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\fcfJXGhjOs0_Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\pYWgEYS5jDmHWeb Data
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\yQm3EH6MY0Q2Web Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\spanDslgJunaCvTA\zMQYNC4o8CfOLogin Data For Account
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\trixyDslgJunaCvTA\Cookies\Chrome_Default.txt
ASCII text, with very long lines (769), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyDslgJunaCvTA\information.txt
ASCII text, with CRLF, LF line terminators
dropped
C:\Users\user\AppData\Local\Temp\trixyDslgJunaCvTA\passwords.txt
Unicode text, UTF-8 text, with CRLF, LF line terminators
dropped
There are 17 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.2624.6335.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
 malicious
C:\ProgramData\MPGPH131\MPGPH131.exe
C:\ProgramData\MPGPH131\MPGPH131.exe
 malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
malicious
C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://193.233.132.167/cost/lenin.exe
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://ipinfo.io:443/widget/demo/149.18.24.96
unknown
https://duckduckgo.com/ac/?q=
unknown
https://ipinfo.io/:Z
unknown
http://193.233.132.167/cost/lenin.exe.exe
unknown
http://147.45.47.102:57893/hera/amadka.exe
unknown
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
unknown
https://db-ip.com/
unknown
https://t.me/riseproAD
unknown
http://147.45.47.102:57893/hera/amadka.ex
unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://ipinfo.io/widget/demo/149.18.24.96R
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://t.me/risepro
unknown
https://support.microsoft..
unknown
http://193.233.132.167/cost/go.exe.1
unknown
https://ipinfo.io/widget/demo/149.18.24.96J
unknown
http://193.233.132.167/cost/go.exe
unknown
https://db-ip.com/demo/home.php?s=149.18.24.96omdW
unknown
https://ipinfo.io/widget/demo/149.18.24.96;74
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://ipinfo.io/u
unknown
https://ipinfo.io/j
unknown
https://t.me/risepro_bot:g
unknown
https://db-ip.com/demo/home.php?s=149.18.24.96
104.26.5.15
https://ipinfo.io/ch
unknown
https://t.me/risepro_bot.961740
unknown
https://t.me/risepro_botlaterH
unknown
https://t.me/risepro_bot)f
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://ipinfo.io:443/widget/demo/149.18.24.96o
unknown
https://support.microsoft.
unknown
https://t.me/RiseProSUPPORTAT
unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://t.me/RiseProSUPPORT
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://www.ecosia.org/newtab/
unknown
https://ipinfo.io/Mozilla/5.0
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://t.me/risepro_bot
unknown
https://t.me/risepro_bot/M1
unknown
https://db-ip.com/demo/home.php?s=149.18.24.96L
unknown
https://ipinfo.io/
unknown
http://pki-ocsp.symauth.com0
unknown
https://www.maxmind.com/en/locate-my-ip-address
unknown
http://147.45.47.102:57893/hera
unknown
https://db-ip.com:443/demo/home.php?s=149.18.24.96
unknown
http://www.winimage.com/zLibDll
unknown
https://ipinfo.io/widget/demo/149.18.24.96
34.117.186.192
https://support.mozilla.org
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
https://t.me/RiseProSUPPORTKue
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 49 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ipinfo.io
34.117.186.192
db-ip.com
104.26.5.15

IPs

IP
Domain
Country
Malicious
147.45.47.93
unknown
Russian Federation
malicious
34.117.186.192
ipinfo.io
United States
104.26.5.15
db-ip.com
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RageMP131

Memdumps

Base Address
Regiontype
Protect
Malicious
17A7000
heap
page read and write
 malicious
1897000
heap
page read and write
 malicious
1898000
heap
page read and write
 malicious
18F0000
heap
page read and write
7F480000
direct allocation
page execute and read and write
37A0000
direct allocation
page execute and read and write
CD0000
unkown
page execute and read and write
16FA000
heap
page read and write
18DA000
heap
page read and write
3930000
direct allocation
page execute and read and write
18AC000
heap
page read and write
794000
unkown
page readonly
3AA0000
direct allocation
page execute and read and write
93D000
heap
page read and write
7AC0000
trusted library allocation
page read and write
18FA000
heap
page read and write
18E9000
heap
page read and write
1A8C000
heap
page read and write
189D000
heap
page read and write
19E0000
heap
page read and write
191B000
heap
page read and write
AE2000
unkown
page execute and read and write
1820000
heap
page read and write
37A8000
direct allocation
page execute and read and write
730E000
stack
page read and write
63CE000
heap
page read and write
7AC0000
trusted library allocation
page read and write
3C90000
heap
page read and write
3A90000
direct allocation
page execute and read and write
7AC0000
trusted library allocation
page read and write
3C3E000
stack
page read and write
389E000
stack
page read and write
39E3000
heap
page read and write
1920000
heap
page read and write
1A32000
heap
page read and write
19A2000
heap
page read and write
1919000
heap
page read and write
3870000
heap
page read and write
F62000
unkown
page execute and write copy
5F0000
unkown
page readonly
19FA000
heap
page read and write
1925000
heap
page read and write
18E6000
heap
page read and write
17E7000
heap
page read and write
18AC000
heap
page read and write
1755000
heap
page read and write
1150000
unkown
page execute and read and write
1945000
heap
page read and write
95E000
heap
page read and write
7AC0000
trusted library allocation
page read and write
1906000
heap
page read and write
8CE000
heap
page read and write
3570000
direct allocation
page execute and read and write
18CE000
heap
page read and write
16FF000
unkown
page execute and write copy
1903000
heap
page read and write
3574000
direct allocation
page execute and read and write
18F8000
heap
page read and write
9A3000
heap
page read and write
1912000
heap
page read and write
F22000
unkown
page execute and write copy
1951000
heap
page read and write
1A12000
heap
page read and write
189A000
heap
page read and write
1920000
heap
page read and write
997000
heap
page read and write
18C3000
heap
page read and write
1987000
heap
page read and write
18FB000
heap
page read and write
6C40000
remote allocation
page read and write
191F000
heap
page read and write
772000
unkown
page execute and write copy
3574000
direct allocation
page execute and read and write
337E000
stack
page read and write
1949000
heap
page read and write
1906000
heap
page read and write
72BD000
stack
page read and write
3934000
direct allocation
page execute and read and write
1A0A000
heap
page read and write
6ABE000
stack
page read and write
1989000
heap
page read and write
38C0000
heap
page read and write
1934000
heap
page read and write
1936000
heap
page read and write
1979000
heap
page read and write
3AA8000
direct allocation
page execute and read and write
933000
heap
page read and write
8E1000
unkown
page execute and read and write
F6C000
unkown
page readonly
C27000
unkown
page execute and read and write
9AE000
heap
page read and write
18ED000
heap
page read and write
1906000
heap
page read and write
6EAF000
stack
page read and write
1702000
unkown
page execute and write copy
1914000
heap
page read and write
18E7000
heap
page read and write
191E000
heap
page read and write
710000
heap
page read and write
1916000
heap
page read and write
18FE000
heap
page read and write
74A000
unkown
page execute and write copy
174E000
heap
page read and write
1889000
heap
page read and write
1D9D000
stack
page read and write
3D90000
heap
page read and write
3B80000
remote allocation
page read and write
36F3000
heap
page read and write
3950000
direct allocation
page execute and read and write
19F3000
heap
page read and write
38D0000
heap
page read and write
AF1000
unkown
page readonly
3948000
direct allocation
page execute and read and write
7FC000
stack
page read and write
797000
unkown
page execute and write copy
190B000
heap
page read and write
3794000
direct allocation
page execute and read and write
1908000
heap
page read and write
1770000
heap
page read and write
38E0000
heap
page read and write
67AF000
stack
page read and write
737E000
stack
page read and write
8FE000
stack
page read and write
176B000
heap
page read and write
18E7000
heap
page read and write
950000
unkown
page readonly
1B2D000
stack
page read and write
6D4F000
stack
page read and write
75E000
stack
page read and write
6EEE000
stack
page read and write
18AC000
heap
page read and write
1906000
heap
page read and write
3D1D000
stack
page read and write
AE2000
unkown
page execute and read and write
3430000
direct allocation
page execute and read and write
1916000
heap
page read and write
1937000
heap
page read and write
10C1000
unkown
page execute and read and write
AEC000
unkown
page readonly
3A88000
direct allocation
page execute and read and write
1906000
heap
page read and write
33B0000
heap
page read and write
18F2000
heap
page read and write
1937000
heap
page read and write
5F3C000
heap
page read and write
AF7000
unkown
page execute and read and write
5F1000
unkown
page execute and read and write
1925000
heap
page read and write
74A000
unkown
page execute and write copy
1A1D000
heap
page read and write
18DF000
heap
page read and write
1815000
heap
page read and write
649E000
heap
page read and write
951000
unkown
page execute and write copy
1736000
heap
page read and write
738F000
stack
page read and write
73CD000
stack
page read and write
1926000
heap
page read and write
1908000
heap
page read and write
C81000
unkown
page execute and read and write
70EF000
stack
page read and write
38AE000
stack
page read and write
950000
unkown
page readonly
820000
direct allocation
page execute and read and write
18AC000
heap
page read and write
17F0000
heap
page read and write
1987000
heap
page read and write
18CE000
heap
page read and write
344D000
stack
page read and write
1A1F000
heap
page read and write
3923000
direct allocation
page execute and read and write
67B1000
heap
page read and write
1914000
heap
page read and write
772000
unkown
page execute and write copy
18FF000
heap
page read and write
1917000
heap
page read and write
78C000
unkown
page readonly
8C7000
unkown
page execute and read and write
39E0000
heap
page read and write
18F2000
heap
page read and write
782000
unkown
page execute and read and write
5F1000
unkown
page execute and write copy
3580000
direct allocation
page execute and read and write
3750000
heap
page read and write
7AC0000
trusted library allocation
page read and write
3564000
direct allocation
page execute and read and write
1937000
heap
page read and write
1945000
heap
page read and write
190C000
heap
page read and write
1AED000
stack
page read and write
1A75000
heap
page read and write
1A8C000
heap
page read and write
18FA000
heap
page read and write
127F000
unkown
page execute and write copy
18AC000
heap
page read and write
1889000
heap
page read and write
1904000
heap
page read and write
C88000
unkown
page execute and read and write
7AC0000
trusted library allocation
page read and write
8E1000
unkown
page execute and read and write
6C40000
remote allocation
page read and write
189E000
heap
page read and write
1975000
heap
page read and write
18FB000
heap
page read and write
1282000
unkown
page execute and write copy
1982000
heap
page read and write
F71000
unkown
page readonly
3794000
direct allocation
page execute and read and write
18D6000
heap
page read and write
11DB000
stack
page read and write
375E000
stack
page read and write
1925000
heap
page read and write
1890000
heap
page read and write
1926000
heap
page read and write
333E000
stack
page read and write
3574000
direct allocation
page execute and read and write
1918000
heap
page read and write
18D0000
heap
page read and write
18CD000
heap
page read and write
F1F000
unkown
page execute and write copy
3934000
direct allocation
page execute and read and write
1A17000
heap
page read and write
18F2000
heap
page read and write
9A9000
heap
page read and write
91C000
heap
page read and write
410F000
stack
page read and write
5FEE000
heap
page read and write
6565000
heap
page read and write
6B0F000
stack
page read and write
17CC000
heap
page read and write
3940000
direct allocation
page execute and read and write
782000
unkown
page execute and read and write
3ACE000
stack
page read and write
664F000
heap
page read and write
3A94000
direct allocation
page execute and read and write
951000
unkown
page execute and write copy
1A11000
heap
page read and write
3BFD000
stack
page read and write
1951000
heap
page read and write
3720000
heap
page read and write
16FD000
heap
page read and write
18D8000
heap
page read and write
1817000
heap
page read and write
63D1000
heap
page read and write
F71000
unkown
page readonly
6026000
heap
page read and write
3A88000
direct allocation
page execute and read and write
1936000
heap
page read and write
1720000
trusted library allocation
page read and write
18C3000
heap
page read and write
1A0F000
heap
page read and write
1A32000
heap
page read and write
36D0000
heap
page read and write
1775000
heap
page read and write
18C5000
heap
page read and write
630000
heap
page read and write
F52000
unkown
page execute and write copy
19E9000
heap
page read and write
17DF000
heap
page read and write
CBD000
stack
page read and write
3B5E000
stack
page read and write
1720000
heap
page read and write
18E5000
heap
page read and write
74BF000
stack
page read and write
7EB00000
direct allocation
page execute and read and write
7F810000
direct allocation
page execute and read and write
18E5000
heap
page read and write
3D10000
heap
page read and write
18CD000
heap
page read and write
18C3000
heap
page read and write
18E6000
heap
page read and write
1A25000
heap
page read and write
3A94000
direct allocation
page execute and read and write
18E6000
heap
page read and write
3930000
direct allocation
page execute and read and write
F1F000
unkown
page execute and write copy
1908000
heap
page read and write
AEC000
unkown
page readonly
18E5000
heap
page read and write
5FB000
stack
page read and write
1A8C000
heap
page read and write
181A000
heap
page read and write
5FEB000
heap
page read and write
18F4000
heap
page read and write
AF4000
unkown
page readonly
99F000
heap
page read and write
1912000
heap
page read and write
3934000
direct allocation
page execute and read and write
18F9000
heap
page read and write
18CB000
heap
page read and write
1909000
heap
page read and write
173A000
heap
page read and write
18FB000
heap
page read and write
17DF000
heap
page read and write
16F0000
heap
page read and write
3350000
heap
page read and write
757E000
stack
page read and write
18B9000
heap
page read and write
970000
unkown
page execute and read and write
AF7000
unkown
page execute and write copy
1A17000
heap
page read and write
3530000
direct allocation
page execute and read and write
191C000
heap
page read and write
1860000
heap
page read and write
194A000
heap
page read and write
18E6000
heap
page read and write
184B000
heap
page read and write
3A30000
direct allocation
page execute and read and write
18D8000
heap
page read and write
1825000
heap
page read and write
3A94000
direct allocation
page execute and read and write
681E000
stack
page read and write
710F000
stack
page read and write
18C3000
heap
page read and write
3784000
direct allocation
page execute and read and write
66C7000
heap
page read and write
1A0E000
heap
page read and write
17FB000
heap
page read and write
1917000
heap
page read and write
6463000
heap
page read and write
17FF000
heap
page read and write
192B000
heap
page read and write
3574000
direct allocation
page execute and read and write
923000
heap
page read and write
5F1000
unkown
page execute and write copy
1917000
heap
page read and write
3794000
direct allocation
page execute and read and write
18E6000
heap
page read and write
36F0000
heap
page read and write
1968000
heap
page read and write
36E0000
heap
page read and write
181F000
heap
page read and write
3D40000
remote allocation
page read and write
3750000
direct allocation
page execute and read and write
18FD000
heap
page read and write
797000
unkown
page execute and read and write
631F000
heap
page read and write
330E000
stack
page read and write
3A94000
direct allocation
page execute and read and write
7AC0000
trusted library allocation
page read and write
9B2000
heap
page read and write
1777000
heap
page read and write
AF1000
unkown
page readonly
8C7000
unkown
page execute and read and write
F22000
unkown
page execute and write copy
3BE0000
heap
page read and write
15ED000
stack
page read and write
18ED000
heap
page read and write
733F000
stack
page read and write
7EF70000
direct allocation
page execute and read and write
1983000
heap
page read and write
1680000
heap
page read and write
3D40000
remote allocation
page read and write
67DE000
stack
page read and write
178B000
heap
page read and write
9B1000
heap
page read and write
18DD000
heap
page read and write
DD1000
unkown
page execute and read and write
C81000
unkown
page execute and read and write
1929000
heap
page read and write
1778000
heap
page read and write
8CA000
heap
page read and write
18CD000
heap
page read and write
970000
unkown
page execute and read and write
18AC000
heap
page read and write
7F690000
direct allocation
page execute and read and write
35B0000
direct allocation
page execute and read and write
6D0D000
stack
page read and write
3F2F000
stack
page read and write
63B4000
heap
page read and write
927000
heap
page read and write
3A8E000
stack
page read and write
39D0000
remote allocation
page read and write
3A74000
direct allocation
page execute and read and write
18F4000
heap
page read and write
17F9000
heap
page read and write
928000
unkown
page execute and read and write
1906000
heap
page read and write
F22000
unkown
page execute and read and write
1889000
heap
page read and write
CD0000
unkown
page execute and read and write
1765000
heap
page read and write
36C0000
heap
page read and write
18F4000
heap
page read and write
18FD000
heap
page read and write
1939000
heap
page read and write
1903000
heap
page read and write
1918000
heap
page read and write
78C000
unkown
page readonly
1740000
unclassified section
page read and write
191C000
heap
page read and write
928000
unkown
page execute and read and write
1904000
heap
page read and write
782000
unkown
page execute and write copy
3934000
direct allocation
page execute and read and write
6776000
heap
page read and write
3D40000
remote allocation
page read and write
1A78000
heap
page read and write
1903000
heap
page read and write
1805000
heap
page read and write
35B000
stack
page read and write
11DB000
stack
page read and write
18B8000
heap
page read and write
1665000
heap
page read and write
38A0000
heap
page read and write
18E5000
heap
page read and write
18CD000
heap
page read and write
70BE000
stack
page read and write
3790000
direct allocation
page execute and read and write
AD2000
unkown
page execute and read and write
10A7000
unkown
page execute and read and write
1906000
heap
page read and write
3AA8000
direct allocation
page execute and read and write
6A1F000
stack
page read and write
18CD000
heap
page read and write
1928000
heap
page read and write
770000
heap
page read and write
1918000
heap
page read and write
18D8000
heap
page read and write
192E000
heap
page read and write
386E000
stack
page read and write
AE2000
unkown
page execute and write copy
1790000
heap
page read and write
18D8000
heap
page read and write
127F000
unkown
page execute and write copy
AAA000
unkown
page execute and write copy
188A000
heap
page read and write
3D0D000
stack
page read and write
3574000
direct allocation
page execute and read and write
18F4000
heap
page read and write
3794000
direct allocation
page execute and read and write
455F000
stack
page read and write
1917000
heap
page read and write
3A94000
direct allocation
page execute and read and write
1690000
direct allocation
page execute and read and write
18CE000
heap
page read and write
3DAE000
stack
page read and write
3D13000
heap
page read and write
3574000
direct allocation
page execute and read and write
1926000
heap
page read and write
6617000
heap
page read and write
18AC000
heap
page read and write
93B000
heap
page read and write
18E6000
heap
page read and write
3B80000
remote allocation
page read and write
3A84000
direct allocation
page execute and read and write
18D8000
heap
page read and write
18EC000
heap
page read and write
33C0000
direct allocation
page execute and read and write
34B0000
direct allocation
page execute and read and write
951000
unkown
page execute and read and write
18CF000
heap
page read and write
810000
heap
page read and write
F62000
unkown
page execute and read and write
18C3000
heap
page read and write
3934000
direct allocation
page execute and read and write
17D9000
heap
page read and write
FE1000
unkown
page execute and read and write
5F0000
unkown
page readonly
176D000
heap
page read and write
1817000
heap
page read and write
3330000
heap
page read and write
415F000
stack
page read and write
1918000
heap
page read and write
3794000
direct allocation
page execute and read and write
18E6000
heap
page read and write
AF4000
unkown
page readonly
3A64000
direct allocation
page execute and read and write
92B000
heap
page read and write
1843000
heap
page read and write
791000
unkown
page readonly
DD0000
unkown
page readonly
1915000
heap
page read and write
6132000
heap
page read and write
19D1000
heap
page read and write
18E5000
heap
page read and write
AD2000
unkown
page execute and write copy
17A0000
heap
page read and write
3410000
heap
page read and write
17DD000
heap
page read and write
39D0000
remote allocation
page read and write
6779000
heap
page read and write
1917000
heap
page read and write
190F000
heap
page read and write
38C0000
heap
page read and write
3783000
direct allocation
page execute and read and write
7AC0000
trusted library allocation
page read and write
7BD000
stack
page read and write
18F2000
heap
page read and write
1904000
heap
page read and write
3A94000
direct allocation
page execute and read and write
833000
heap
page read and write
1951000
heap
page read and write
1640000
heap
page read and write
18EE000
heap
page read and write
3730000
heap
page read and write
1282000
unkown
page execute and read and write
3D40000
remote allocation
page read and write
1904000
heap
page read and write
46BF000
stack
page read and write
18D8000
heap
page read and write
AEC000
unkown
page readonly
3A74000
direct allocation
page execute and read and write
1A01000
heap
page read and write
C88000
unkown
page execute and read and write
44BF000
stack
page read and write
78C000
unkown
page readonly
797000
unkown
page execute and write copy
7AC0000
trusted library allocation
page read and write
1904000
heap
page read and write
AD2000
unkown
page execute and read and write
18CD000
heap
page read and write
7AC0000
trusted library allocation
page read and write
3510000
heap
page read and write
78C000
unkown
page readonly
694E000
stack
page read and write
1915000
heap
page read and write
3A74000
direct allocation
page execute and read and write
3C0000
heap
page read and write
90E000
heap
page read and write
19F5000
heap
page read and write
950000
unkown
page readonly
3860000
heap
page read and write
1840000
heap
page read and write
1912000
heap
page read and write
1896000
heap
page read and write
18E5000
heap
page read and write
3A63000
direct allocation
page execute and read and write
8FB000
heap
page read and write
17C6000
heap
page read and write
1914000
heap
page read and write
18E5000
heap
page read and write
18E7000
heap
page read and write
16C0000
heap
page read and write
190F000
heap
page read and write
1921000
heap
page read and write
1A32000
heap
page read and write
970000
unkown
page execute and read and write
1903000
heap
page read and write
65DD000
stack
page read and write
F74000
unkown
page readonly
3C93000
heap
page read and write
928000
unkown
page execute and read and write
19A7000
heap
page read and write
5F0000
unkown
page readonly
3760000
direct allocation
page execute and read and write
7AC0000
trusted library allocation
page read and write
7AC0000
trusted library allocation
page read and write
1903000
heap
page read and write
18D8000
heap
page read and write
15FA000
stack
page read and write
5F1000
unkown
page execute and read and write
DD0000
unkown
page readonly
3A74000
direct allocation
page execute and read and write
3B80000
remote allocation
page read and write
75CE000
stack
page read and write
33D0000
heap
page read and write
39BD000
stack
page read and write
3B40000
heap
page read and write
794000
unkown
page readonly
3720000
direct allocation
page execute and read and write
791000
unkown
page readonly
3588000
direct allocation
page execute and read and write
18D8000
heap
page read and write
713E000
stack
page read and write
1920000
heap
page read and write
8E1000
unkown
page execute and read and write
613A000
heap
page read and write
1889000
heap
page read and write
794000
unkown
page readonly
19A0000
heap
page read and write
1763000
heap
page read and write
18E6000
heap
page read and write
6CBF000
stack
page read and write
6466000
heap
page read and write
19A0000
heap
page read and write
1912000
heap
page read and write
19E4000
heap
page read and write
718E000
stack
page read and write
430F000
stack
page read and write
1748000
heap
page read and write
F74000
unkown
page readonly
3BDD000
stack
page read and write
DD1000
unkown
page execute and write copy
1CB000
stack
page read and write
1780000
heap
page read and write
18B1000
heap
page read and write
C41000
unkown
page execute and read and write
35B0000
direct allocation
page execute and read and write
18D8000
heap
page read and write
173F000
heap
page read and write
8C7000
unkown
page execute and read and write
90A000
heap
page read and write
921000
heap
page read and write
1980000
direct allocation
page execute and read and write
3948000
direct allocation
page execute and read and write
AF1000
unkown
page readonly
AAA000
unkown
page execute and write copy
38B0000
heap
page read and write
99A000
heap
page read and write
8E7000
heap
page read and write
FE1000
unkown
page execute and read and write
19A2000
heap
page read and write
38F0000
direct allocation
page execute and read and write
714E000
stack
page read and write
1987000
heap
page read and write
C27000
unkown
page execute and read and write
18F5000
heap
page read and write
194A000
heap
page read and write
18F2000
heap
page read and write
3934000
direct allocation
page execute and read and write
797000
unkown
page execute and read and write
AE2000
unkown
page execute and write copy
3D40000
remote allocation
page read and write
3420000
heap
page read and write
8C0000
heap
page read and write
1A1C000
heap
page read and write
3A83000
direct allocation
page execute and read and write
7F0000
heap
page read and write
1660000
heap
page read and write
AF7000
unkown
page execute and write copy
3A94000
direct allocation
page execute and read and write
632E000
stack
page read and write
951000
heap
page read and write
18F2000
heap
page read and write
AF4000
unkown
page readonly
3588000
direct allocation
page execute and read and write
1A86000
heap
page read and write
1914000
heap
page read and write
65AE000
stack
page read and write
18E5000
heap
page read and write
772000
unkown
page execute and read and write
37A8000
direct allocation
page execute and read and write
5F0000
unkown
page readonly
17D5000
heap
page read and write
1774000
heap
page read and write
F2A000
unkown
page execute and write copy
17D1000
heap
page read and write
1750000
heap
page read and write
7AC0000
trusted library allocation
page read and write
18F9000
heap
page read and write
C41000
unkown
page execute and read and write
6409000
heap
page read and write
18C3000
heap
page read and write
1760000
heap
page read and write
3CCD000
stack
page read and write
1926000
heap
page read and write
3820000
heap
page read and write
3A50000
direct allocation
page execute and read and write
1832000
heap
page read and write
18DD000
heap
page read and write
191C000
heap
page read and write
830000
heap
page read and write
17EB000
heap
page read and write
175B000
heap
page read and write
3D2F000
stack
page read and write
1702000
unkown
page execute and read and write
3924000
direct allocation
page execute and read and write
3A70000
direct allocation
page execute and read and write
9AD000
heap
page read and write
782000
unkown
page execute and write copy
17F4000
heap
page read and write
3563000
direct allocation
page execute and read and write
951000
unkown
page execute and read and write
435F000
stack
page read and write
196A000
heap
page read and write
3340000
heap
page read and write
1A25000
heap
page read and write
18DD000
heap
page read and write
18CF000
heap
page read and write
3A74000
direct allocation
page execute and read and write
18E7000
heap
page read and write
19A1000
heap
page read and write
1640000
heap
page read and write
1847000
heap
page read and write
945000
heap
page read and write
670E000
stack
page read and write
3C7E000
stack
page read and write
F52000
unkown
page execute and read and write
1282000
unkown
page execute and read and write
950000
unkown
page readonly
3D0000
heap
page read and write
6EBF000
stack
page read and write
191B000
heap
page read and write
3A74000
direct allocation
page execute and read and write
15FC000
stack
page read and write
385E000
stack
page read and write
AF1000
unkown
page readonly
397E000
stack
page read and write
6614000
heap
page read and write
3934000
direct allocation
page execute and read and write
8B0000
heap
page read and write
F6C000
unkown
page readonly
3630000
direct allocation
page execute and read and write
19FD000
heap
page read and write
39D0000
remote allocation
page read and write
900000
heap
page read and write
794000
unkown
page readonly
435F000
stack
page read and write
3880000
heap
page read and write
18C3000
heap
page read and write
85B000
stack
page read and write
AF7000
unkown
page execute and read and write
7AC0000
trusted library allocation
page read and write
17D0000
heap
page read and write
1830000
direct allocation
page execute and read and write
17E2000
heap
page read and write
18E7000
heap
page read and write
19EE000
heap
page read and write
1A1C000
heap
page read and write
772000
unkown
page execute and read and write
9AA000
heap
page read and write
1A25000
heap
page read and write
3A80000
direct allocation
page execute and read and write
791000
unkown
page readonly
17C3000
heap
page read and write
3574000
direct allocation
page execute and read and write
918000
heap
page read and write
1758000
heap
page read and write
3794000
direct allocation
page execute and read and write
F22000
unkown
page execute and read and write
1889000
heap
page read and write
AD2000
unkown
page execute and write copy
18F2000
heap
page read and write
791000
unkown
page readonly
3760000
heap
page read and write
1730000
heap
page read and write
1945000
heap
page read and write
1906000
heap
page read and write
89E000
stack
page read and write
90E000
stack
page read and write
1282000
unkown
page execute and write copy
1906000
heap
page read and write
34A0000
heap
page read and write
AF4000
unkown
page readonly
F77000
unkown
page execute and write copy
17DF000
heap
page read and write
3794000
direct allocation
page execute and read and write
17DF000
heap
page read and write
1912000
heap
page read and write
7AC0000
trusted library allocation
page read and write
1970000
heap
page read and write
F77000
unkown
page execute and read and write
6CAE000
stack
page read and write
1912000
heap
page read and write
3B90000
heap
page read and write
16AC000
stack
page read and write
1A08000
heap
page read and write
3EF0000
heap
page read and write
1108000
unkown
page execute and read and write
18E5000
heap
page read and write
1987000
heap
page read and write
1904000
heap
page read and write
AEC000
unkown
page readonly
6C40000
remote allocation
page read and write
797000
unkown
page execute and read and write
1461000
unkown
page execute and read and write
1902000
heap
page read and write
3C7E000
stack
page read and write
3D40000
remote allocation
page read and write
935000
heap
page read and write
CC0000
direct allocation
page execute and read and write
3B1E000
stack
page read and write
18CD000
heap
page read and write
1800000
heap
page read and write
198E000
heap
page read and write
3A74000
direct allocation
page execute and read and write
1A85000
heap
page read and write
There are 758 hidden memdumps, click here to show them.