Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
|
initial sample
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\AutoHotkey32.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\AutoHotkey64.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\Templates\Minimal for v2.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\WindowSpy.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\CommandLineToArgs.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\CreateAppShortcut.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\EnableUIAccess.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\GetGitHubReleaseAssetURL.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\HashFile.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\README.txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\ShellRun.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\bounce-v1.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\common.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\config.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\identify.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\identify_regex.ahk
|
ASCII text, with very long lines (3982), with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\launcher-common.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\spy.ico
|
MS Windows icon resource - 4 icons, 32x32 with PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 48x48
with PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\inc\ui-base.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\install-ahk2exe.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\install-version.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\install.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\launcher.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\reload-v1.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\reset-assoc.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\ui-dash.ahk
|
C source, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\ui-editor.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\ui-launcherconfig.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\ui-newscript.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\ui-setup.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\ui-uninstall.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\license.txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\v2\AutoHotkey.chm
|
MS Windows HtmlHelp Data
|
dropped
|
||
C:\Program Files\AutoHotkey\v2\AutoHotkey32.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\AutoHotkey\v2\AutoHotkey32_UIA.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\AutoHotkey\v2\AutoHotkey64.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
C:\Program Files\AutoHotkey\v2\AutoHotkey64_UIA.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
C:\Program Files\AutoHotkey\v2\RCXC5C8.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\AutoHotkey\v2\RCXC6B3.tmp
|
PE32+ executable (GUI) x86-64, for MS Windows
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\AutoHotkey.chm
|
MS Windows HtmlHelp Data
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\Install.cmd
|
DOS batch file, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\Templates\Minimal for v2.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\WindowSpy.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\CommandLineToArgs.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\CreateAppShortcut.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\EnableUIAccess.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\GetGitHubReleaseAssetURL.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\HashFile.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\README.txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\ShellRun.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\bounce-v1.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\common.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\config.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\identify.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\identify_regex.ahk
|
ASCII text, with very long lines (3982), with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\launcher-common.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\spy.ico
|
MS Windows icon resource - 4 icons, 32x32 with PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 48x48
with PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\inc\ui-base.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\install-ahk2exe.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\install-version.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\install.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\launcher.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\reload-v1.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\reset-assoc.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\ui-dash.ahk
|
C source, Unicode text, UTF-8 text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\ui-editor.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\ui-launcherconfig.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\ui-newscript.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\ui-setup.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\UX\ui-uninstall.ahk
|
C source, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\WindowSpy.ahk
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\.staging\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe\license.txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\AutoHotkey\UX\installed-files.csv
|
CSV text
|
dropped
|
||
C:\Program Files\AutoHotkey\WindowSpy.ahk
|
C source, ASCII text
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey Dash.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command
line arguments, Archive, ctime=Fri Mar 29 00:22:55 2024, mtime=Fri Mar 29 00:22:55 2024, atime=Fri Mar 29 00:22:54 2024, length=1256448,
window=hide
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoHotkey Window Spy.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command
line arguments, Icon number=0, Archive, ctime=Fri Mar 29 00:22:55 2024, mtime=Fri Mar 29 00:22:56 2024, atime=Fri Mar 29 00:22:54
2024, length=1256448, window=hide
|
dropped
|
||
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\f213bf5a8af890680781f9b7261613ea_9e146be9-c76a-4720-bcdb-53011b87bd06
|
data
|
dropped
|
There are 69 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe
|
"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe"
|
||
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe
|
"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop26.40031.10750.20331.exe" /to "C:\Program Files\AutoHotkey"
|
||
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
|
"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\reset-assoc.ahk" /check
|
||
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
|
"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" UX\ui-dash.ahk
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://autohotkey.com/board/topic/66139-ahk-l-calculating-md5sha-checksum-from-file/
|
unknown
|
||
https://www.autohotkey.com/download/
|
unknown
|
||
https://www.autohotkey.com/docs/v2/
|
unknown
|
||
https://autohotkey.com5
|
unknown
|
||
https://www.autohotkey.com/docs/v1/
|
unknown
|
||
http://msdn.com/library/bb756929
|
unknown
|
||
https://autohotkey.comr
|
unknown
|
||
https://autohotkey.com
|
unknown
|
||
https://api.github.com/repos/
|
unknown
|
||
https://autohotkey.comCould
|
unknown
|
||
https://autohotkey.com0h
|
unknown
|
||
https://www.autohotkey.com/docs/v2/misc/Editors.htm
|
unknown
|
There are 2 hidden URLs, click here to show them.
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59035B3240D968349D17DB60715C89F7A2481102
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59035B3240D968349D17DB60715C89F7A2481102
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59035B3240D968349D17DB60715C89F7A2481102
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59035B3240D968349D17DB60715C89F7A2481102
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59035B3240D968349D17DB60715C89F7A2481102
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59035B3240D968349D17DB60715C89F7A2481102
|
Blob
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
|
DisplayName
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
|
UninstallString
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
|
QuietUninstallString
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
|
NoModify
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
|
DisplayIcon
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
|
DisplayVersion
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
|
URLInfoAbout
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
|
Publisher
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
|
InstallLocation
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\AutoHotkey
|
InstallDir
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\AutoHotkey
|
InstallCommand
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\AutoHotkey
|
Version
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ahk
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ahk\ShellNew
|
Command
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ahk\PersistentHandler
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript
|
AppUserModelID
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\DefaultIcon
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open
|
FriendlyAppName
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open\Command
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Open
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\RunAs\Command
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\RunAs
|
HasLUAShield
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\UIAccess\Command
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\UIAccess
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch\Command
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Launch
|
ProgrammaticAccessOnly
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit\Command
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoHotkeyScript\Shell\Edit
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer
|
GlobalAssocChangedCounter
|
There are 28 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
4C48000
|
heap
|
page read and write
|
||
3396000
|
heap
|
page read and write
|
||
2F73000
|
heap
|
page read and write
|
||
8C6000
|
unkown
|
page execute and read and write
|
||
3054000
|
heap
|
page read and write
|
||
3397000
|
heap
|
page read and write
|
||
E4000
|
heap
|
page read and write
|
||
53C0000
|
heap
|
page read and write
|
||
FD000
|
heap
|
page read and write
|
||
4D45000
|
heap
|
page read and write
|
||
6C70000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
EF0000
|
heap
|
page read and write
|
||
D47000
|
stack
|
page read and write
|
||
4D5B000
|
heap
|
page read and write
|
||
3393000
|
heap
|
page read and write
|
||
3399000
|
heap
|
page read and write
|
||
93A000
|
unkown
|
page write copy
|
||
4D5B000
|
heap
|
page read and write
|
||
4D48000
|
heap
|
page read and write
|
||
F4000
|
heap
|
page read and write
|
||
D29000
|
stack
|
page read and write
|
||
4D49000
|
heap
|
page read and write
|
||
3490000
|
heap
|
page read and write
|
||
7BE000
|
stack
|
page read and write
|
||
4D93000
|
heap
|
page read and write
|
||
11A000
|
heap
|
page read and write
|
||
7F8000
|
stack
|
page read and write
|
||
4D10000
|
heap
|
page read and write
|
||
8F3000
|
heap
|
page read and write
|
||
556F000
|
stack
|
page read and write
|
||
3420000
|
heap
|
page read and write
|
||
4D72000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
1400FB000
|
unkown
|
page readonly
|
||
339D000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
EB2000
|
heap
|
page read and write
|
||
4D69000
|
heap
|
page read and write
|
||
4D18000
|
heap
|
page read and write
|
||
140000000
|
unkown
|
page readonly
|
||
172F000
|
stack
|
page read and write
|
||
7BE000
|
stack
|
page read and write
|
||
4D00000
|
heap
|
page read and write
|
||
4D29000
|
heap
|
page read and write
|
||
EC0000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
F16000
|
heap
|
page read and write
|
||
3394000
|
heap
|
page read and write
|
||
4D5B000
|
heap
|
page read and write
|
||
4D59000
|
heap
|
page read and write
|
||
320F000
|
stack
|
page read and write
|
||
4D3F000
|
heap
|
page read and write
|
||
EE0000
|
heap
|
page read and write
|
||
4D08000
|
heap
|
page read and write
|
||
7F9000
|
stack
|
page read and write
|
||
810000
|
trusted library section
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
4E2000
|
unkown
|
page execute and read and write
|
||
3390000
|
trusted library allocation
|
page read and write
|
||
17B0000
|
heap
|
page read and write
|
||
3391000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
4D18000
|
heap
|
page read and write
|
||
F10000
|
heap
|
page read and write
|
||
968000
|
heap
|
page read and write
|
||
99000
|
stack
|
page read and write
|
||
4D18000
|
heap
|
page read and write
|
||
14011F000
|
unkown
|
page read and write
|
||
90000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
339D000
|
heap
|
page read and write
|
||
90000
|
heap
|
page read and write
|
||
34DE000
|
heap
|
page read and write
|
||
34C0000
|
heap
|
page read and write
|
||
E34000
|
heap
|
page read and write
|
||
3396000
|
heap
|
page read and write
|
||
3390000
|
heap
|
page read and write
|
||
4D08000
|
heap
|
page read and write
|
||
4DC8000
|
heap
|
page read and write
|
||
D23000
|
stack
|
page read and write
|
||
4D69000
|
heap
|
page read and write
|
||
4D00000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
14011C000
|
unkown
|
page read and write
|
||
4DB0000
|
heap
|
page read and write
|
||
3398000
|
heap
|
page read and write
|
||
122B000
|
heap
|
page read and write
|
||
EE8000
|
heap
|
page read and write
|
||
F9000
|
heap
|
page read and write
|
||
E4000
|
heap
|
page read and write
|
||
E3F000
|
heap
|
page read and write
|
||
ED9000
|
heap
|
page read and write
|
||
132F000
|
stack
|
page read and write
|
||
4DDB000
|
heap
|
page read and write
|
||
356E000
|
stack
|
page read and write
|
||
666000
|
unkown
|
page execute and write copy
|
||
F03000
|
heap
|
page read and write
|
||
4DC8000
|
heap
|
page read and write
|
||
E20000
|
heap
|
page read and write
|
||
93A000
|
unkown
|
page write copy
|
||
830000
|
heap
|
page read and write
|
||
140120000
|
unkown
|
page write copy
|
||
EED000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
14011F000
|
unkown
|
page read and write
|
||
4D3F000
|
heap
|
page read and write
|
||
4DC8000
|
heap
|
page read and write
|
||
30A0000
|
heap
|
page read and write
|
||
EBE000
|
heap
|
page read and write
|
||
4D69000
|
heap
|
page read and write
|
||
4CF0000
|
heap
|
page read and write
|
||
4CF3000
|
heap
|
page read and write
|
||
4DB2000
|
heap
|
page read and write
|
||
10CF000
|
stack
|
page read and write
|
||
3390000
|
trusted library allocation
|
page read and write
|
||
4DE9000
|
heap
|
page read and write
|
||
51EF000
|
stack
|
page read and write
|
||
EF3000
|
heap
|
page read and write
|
||
EEE000
|
heap
|
page read and write
|
||
33D0000
|
heap
|
page read and write
|
||
910000
|
heap
|
page read and write
|
||
3497000
|
heap
|
page read and write
|
||
D3C000
|
stack
|
page read and write
|
||
EE1000
|
heap
|
page read and write
|
||
4DB2000
|
heap
|
page read and write
|
||
4D48000
|
heap
|
page read and write
|
||
2BE0000
|
heap
|
page read and write
|
||
EF2000
|
heap
|
page read and write
|
||
7CE000
|
stack
|
page read and write
|
||
3391000
|
heap
|
page read and write
|
||
140121000
|
unkown
|
page read and write
|
||
4D48000
|
heap
|
page read and write
|
||
7D7000
|
stack
|
page read and write
|
||
2FEE000
|
stack
|
page read and write
|
||
EBA000
|
heap
|
page read and write
|
||
1400FB000
|
unkown
|
page readonly
|
||
F10000
|
heap
|
page read and write
|
||
339E000
|
heap
|
page read and write
|
||
30A4000
|
heap
|
page read and write
|
||
F03000
|
heap
|
page read and write
|
||
6C6D000
|
stack
|
page read and write
|
||
EE1000
|
heap
|
page read and write
|
||
EB7000
|
heap
|
page read and write
|
||
EA000
|
heap
|
page read and write
|
||
4D3F000
|
heap
|
page read and write
|
||
4F4000
|
unkown
|
page execute and read and write
|
||
EE0000
|
heap
|
page read and write
|
||
EA000
|
heap
|
page read and write
|
||
4DC0000
|
trusted library allocation
|
page read and write
|
||
4D2A000
|
heap
|
page read and write
|
||
9A000
|
stack
|
page read and write
|
||
63CC000
|
stack
|
page read and write
|
||
EB7000
|
heap
|
page read and write
|
||
29C3000
|
heap
|
page read and write
|
||
4D59000
|
heap
|
page read and write
|
||
1228000
|
heap
|
page read and write
|
||
7D7000
|
stack
|
page read and write
|
||
173F000
|
stack
|
page read and write
|
||
2C20000
|
heap
|
page read and write
|
||
D1E000
|
stack
|
page read and write
|
||
4DE5000
|
heap
|
page read and write
|
||
EEE000
|
heap
|
page read and write
|
||
4D13000
|
heap
|
page read and write
|
||
4D3F000
|
heap
|
page read and write
|
||
F4000
|
heap
|
page read and write
|
||
14011C000
|
unkown
|
page write copy
|
||
4D22000
|
heap
|
page read and write
|
||
100000
|
heap
|
page read and write
|
||
350C000
|
stack
|
page read and write
|
||
4DD4000
|
heap
|
page read and write
|
||
97F000
|
heap
|
page read and write
|
||
8C6000
|
unkown
|
page execute and read and write
|
||
E37000
|
heap
|
page read and write
|
||
7AA000
|
unkown
|
page execute and read and write
|
||
BF000
|
heap
|
page read and write
|
||
4D93000
|
heap
|
page read and write
|
||
D8E000
|
stack
|
page read and write
|
||
4D18000
|
heap
|
page read and write
|
||
140001000
|
unkown
|
page execute read
|
||
EF3000
|
heap
|
page read and write
|
||
4DE3000
|
heap
|
page read and write
|
||
339B000
|
heap
|
page read and write
|
||
6C72000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
4DB4000
|
heap
|
page read and write
|
||
4D5B000
|
heap
|
page read and write
|
||
17D0000
|
heap
|
page read and write
|
||
4D08000
|
heap
|
page read and write
|
||
F20000
|
heap
|
page read and write
|
||
998000
|
heap
|
page read and write
|
||
EF4000
|
heap
|
page read and write
|
||
140001000
|
unkown
|
page execute read
|
||
3393000
|
heap
|
page read and write
|
||
14011C000
|
unkown
|
page read and write
|
||
29C0000
|
heap
|
page read and write
|
||
1A0000
|
heap
|
page read and write
|
||
100000
|
heap
|
page read and write
|
||
D23000
|
stack
|
page read and write
|
||
3395000
|
heap
|
page read and write
|
||
EEA000
|
heap
|
page read and write
|
||
EE0000
|
heap
|
page read and write
|
||
97E000
|
heap
|
page read and write
|
||
4D3F000
|
heap
|
page read and write
|
||
4E2000
|
unkown
|
page execute and read and write
|
||
122E000
|
heap
|
page read and write
|
||
140122000
|
unkown
|
page write copy
|
||
1239000
|
heap
|
page read and write
|
||
964000
|
heap
|
page read and write
|
||
EC5000
|
heap
|
page read and write
|
||
986000
|
heap
|
page read and write
|
||
341E000
|
stack
|
page read and write
|
||
4D5B000
|
heap
|
page read and write
|
||
3610000
|
heap
|
page read and write
|
||
1239000
|
heap
|
page read and write
|
||
9A0000
|
heap
|
page read and write
|
||
EBA000
|
heap
|
page read and write
|
||
4EC000
|
unkown
|
page execute and read and write
|
||
14011D000
|
unkown
|
page write copy
|
||
4F4000
|
unkown
|
page execute and read and write
|
||
EE8000
|
heap
|
page read and write
|
||
98000
|
heap
|
page read and write
|
||
52EA000
|
heap
|
page read and write
|
||
4DEA000
|
heap
|
page read and write
|
||
4D38000
|
heap
|
page read and write
|
||
E28000
|
heap
|
page read and write
|
||
4D6E000
|
heap
|
page read and write
|
||
3396000
|
heap
|
page read and write
|
||
CCE000
|
stack
|
page read and write
|
||
140000000
|
unkown
|
page readonly
|
||
EF9000
|
heap
|
page read and write
|
||
7AA000
|
unkown
|
page execute and read and write
|
||
4D41000
|
heap
|
page read and write
|
||
EE8000
|
heap
|
page read and write
|
||
4D14000
|
heap
|
page read and write
|
||
DCE000
|
stack
|
page read and write
|
||
18D0000
|
heap
|
page read and write
|
||
339E000
|
heap
|
page read and write
|
||
14012A000
|
unkown
|
page readonly
|
||
3600000
|
heap
|
page read and write
|
||
4D59000
|
heap
|
page read and write
|
||
14012A000
|
unkown
|
page readonly
|
||
51F0000
|
heap
|
page read and write
|
||
124E000
|
heap
|
page read and write
|
||
4D08000
|
heap
|
page read and write
|
||
E38000
|
heap
|
page read and write
|
||
F30000
|
heap
|
page read and write
|
||
4D38000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute and read and write
|
||
1370000
|
heap
|
page read and write
|
||
8F0000
|
heap
|
page read and write
|
||
F20000
|
heap
|
page read and write
|
||
6C7E000
|
heap
|
page read and write
|
||
F8000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
D35000
|
stack
|
page read and write
|
||
7AD000
|
stack
|
page read and write
|
||
4D48000
|
heap
|
page read and write
|
||
4CE000
|
unkown
|
page execute and read and write
|
||
3397000
|
heap
|
page read and write
|
||
14011D000
|
unkown
|
page write copy
|
||
5BCF000
|
stack
|
page read and write
|
||
1230000
|
heap
|
page read and write
|
||
140121000
|
unkown
|
page read and write
|
||
BA000
|
heap
|
page read and write
|
||
5FCD000
|
stack
|
page read and write
|
||
3399000
|
heap
|
page read and write
|
||
3464000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
14011C000
|
unkown
|
page write copy
|
||
7DC000
|
stack
|
page read and write
|
||
52C2000
|
heap
|
page read and write
|
||
35B0000
|
heap
|
page read and write
|
||
140123000
|
unkown
|
page read and write
|
||
4D22000
|
heap
|
page read and write
|
||
14012A000
|
unkown
|
page readonly
|
||
984000
|
heap
|
page read and write
|
||
1210000
|
heap
|
page read and write
|
||
D26000
|
stack
|
page read and write
|
||
D8E000
|
stack
|
page read and write
|
||
4D5B000
|
heap
|
page read and write
|
||
7D4000
|
stack
|
page read and write
|
||
D1E000
|
stack
|
page read and write
|
||
EE8000
|
heap
|
page read and write
|
||
31A0000
|
unkown
|
page read and write
|
||
3398000
|
heap
|
page read and write
|
||
339F000
|
heap
|
page read and write
|
||
EC3000
|
heap
|
page read and write
|
||
A0D000
|
heap
|
page read and write
|
||
3398000
|
heap
|
page read and write
|
||
4D45000
|
heap
|
page read and write
|
||
DCE000
|
stack
|
page read and write
|
||
666000
|
unkown
|
page execute and write copy
|
||
17D8000
|
heap
|
page read and write
|
||
988000
|
heap
|
page read and write
|
||
67CF000
|
stack
|
page read and write
|
||
1375000
|
heap
|
page read and write
|
||
938000
|
unkown
|
page execute and write copy
|
||
4DB2000
|
heap
|
page read and write
|
||
7E5000
|
stack
|
page read and write
|
||
1226000
|
heap
|
page read and write
|
||
99A000
|
heap
|
page read and write
|
||
3393000
|
heap
|
page read and write
|
||
3399000
|
heap
|
page read and write
|
||
3399000
|
heap
|
page read and write
|
||
1400DF000
|
unkown
|
page readonly
|
||
2FF0000
|
heap
|
page read and write
|
||
3440000
|
heap
|
page read and write
|
||
D3E000
|
stack
|
page read and write
|
||
63D9000
|
heap
|
page read and write
|
||
140120000
|
unkown
|
page write copy
|
||
170000
|
heap
|
page read and write
|
||
EE8000
|
heap
|
page read and write
|
||
4D69000
|
heap
|
page read and write
|
||
1C0000
|
heap
|
page read and write
|
||
11A000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
4DB4000
|
heap
|
page read and write
|
||
140001000
|
unkown
|
page execute read
|
||
918000
|
heap
|
page read and write
|
||
140122000
|
unkown
|
page write copy
|
||
34D6000
|
heap
|
page read and write
|
||
4D59000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
1400FB000
|
unkown
|
page readonly
|
||
4D69000
|
heap
|
page read and write
|
||
2F70000
|
heap
|
page read and write
|
||
800000
|
trusted library section
|
page read and write
|
||
63D9000
|
heap
|
page read and write
|
||
122C000
|
heap
|
page read and write
|
||
51F5000
|
heap
|
page read and write
|
||
4D18000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
7DE000
|
stack
|
page read and write
|
||
4D18000
|
heap
|
page read and write
|
||
1115000
|
heap
|
page read and write
|
||
4D2F000
|
heap
|
page read and write
|
||
DF8000
|
heap
|
page read and write
|
||
1400DF000
|
unkown
|
page readonly
|
||
938000
|
unkown
|
page execute and write copy
|
||
4D3F000
|
heap
|
page read and write
|
||
4D27000
|
heap
|
page read and write
|
||
53D0000
|
trusted library allocation
|
page read and write
|
||
1400DF000
|
unkown
|
page readonly
|
||
1E0000
|
heap
|
page read and write
|
||
4DCB000
|
heap
|
page read and write
|
||
190000
|
heap
|
page read and write
|
||
4D59000
|
heap
|
page read and write
|
||
4D69000
|
heap
|
page read and write
|
||
4D18000
|
heap
|
page read and write
|
||
D2C000
|
stack
|
page read and write
|
||
3390000
|
heap
|
page read and write
|
||
6C77000
|
heap
|
page read and write
|
||
D4A000
|
stack
|
page read and write
|
||
4D08000
|
heap
|
page read and write
|
||
1110000
|
heap
|
page read and write
|
||
29D0000
|
heap
|
page read and write
|
||
140123000
|
unkown
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
7EE000
|
stack
|
page read and write
|
||
EE0000
|
heap
|
page read and write
|
||
4DB4000
|
heap
|
page read and write
|
||
4DD8000
|
heap
|
page read and write
|
||
4D11000
|
heap
|
page read and write
|
||
3390000
|
heap
|
page read and write
|
||
4C40000
|
heap
|
page read and write
|
||
3394000
|
heap
|
page read and write
|
||
133E000
|
stack
|
page read and write
|
||
DF0000
|
heap
|
page read and write
|
||
140000000
|
unkown
|
page readonly
|
||
4DEC000
|
heap
|
page read and write
|
||
4D11000
|
heap
|
page read and write
|
||
ED9000
|
heap
|
page read and write
|
||
820000
|
trusted library section
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
E42000
|
heap
|
page read and write
|
||
EF8000
|
heap
|
page read and write
|
||
4C49000
|
heap
|
page read and write
|
||
348C000
|
stack
|
page read and write
|
||
6C74000
|
heap
|
page read and write
|
||
14012A000
|
unkown
|
page readonly
|
||
7E5000
|
stack
|
page read and write
|
||
4EC000
|
unkown
|
page execute and read and write
|
||
3050000
|
heap
|
page read and write
|
||
3060000
|
heap
|
page read and write
|
||
1400FB000
|
unkown
|
page readonly
|
||
4D18000
|
heap
|
page read and write
|
||
123E000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute and read and write
|
||
35FC000
|
stack
|
page read and write
|
||
F10000
|
heap
|
page read and write
|
||
4D08000
|
heap
|
page read and write
|
||
93A000
|
unkown
|
page read and write
|
||
4CE000
|
unkown
|
page execute and read and write
|
||
140001000
|
unkown
|
page execute read
|
||
4D48000
|
heap
|
page read and write
|
||
140127000
|
unkown
|
page read and write
|
||
3398000
|
heap
|
page read and write
|
||
4970000
|
trusted library allocation
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
4D59000
|
heap
|
page read and write
|
||
4D06000
|
heap
|
page read and write
|
||
93A000
|
unkown
|
page read and write
|
||
51F0000
|
heap
|
page read and write
|
||
4D10000
|
heap
|
page read and write
|
||
140000000
|
unkown
|
page readonly
|
||
190000
|
heap
|
page read and write
|
||
4D30000
|
heap
|
page read and write
|
||
18D8000
|
heap
|
page read and write
|
||
4D92000
|
heap
|
page read and write
|
||
EE8000
|
heap
|
page read and write
|
||
4D5B000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
3399000
|
heap
|
page read and write
|
||
1232000
|
heap
|
page read and write
|
||
4DB0000
|
heap
|
page read and write
|
||
1400DF000
|
unkown
|
page readonly
|
||
1220000
|
heap
|
page read and write
|
||
4D59000
|
heap
|
page read and write
|
||
4DA2000
|
heap
|
page read and write
|
||
4D00000
|
heap
|
page read and write
|
||
3390000
|
heap
|
page read and write
|
||
1E0000
|
heap
|
page read and write
|
||
E37000
|
heap
|
page read and write
|
||
D26000
|
stack
|
page read and write
|
||
5200000
|
heap
|
page read and write
|
||
4D69000
|
heap
|
page read and write
|
||
F26000
|
heap
|
page read and write
|
||
EC5000
|
heap
|
page read and write
|
||
7B6000
|
stack
|
page read and write
|
||
339F000
|
heap
|
page read and write
|
||
7CE000
|
stack
|
page read and write
|
||
EBA000
|
heap
|
page read and write
|
||
4D00000
|
heap
|
page read and write
|
||
4DED000
|
heap
|
page read and write
|
||
DF0000
|
heap
|
page read and write
|
||
3390000
|
heap
|
page read and write
|
||
4C50000
|
heap
|
page read and write
|
||
2C29000
|
heap
|
page read and write
|
||
7ED000
|
stack
|
page read and write
|
||
981000
|
heap
|
page read and write
|
||
63D4000
|
heap
|
page read and write
|
There are 432 hidden memdumps, click here to show them.