IOC Report
vulkan-1.dll

loading gif

Files

File Path
Type
Category
Malicious
vulkan-1.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
initial sample
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_8a98533a1ee59e3066e2be1dd9ba698f1f7c53_20b95fe6_efed0deb-ab6a-419b-abdf-f64dadf15c15\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_8a98533a1ee59e3066e2be1dd9ba698f1f7c53_20b95fe6_f1d6bd2e-9a5c-402a-bf9b-fffb0991a373\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_d2be42f9ca26f5b1c98ace275864247822806def_20b95fe6_fb6bb36d-6fd7-4e37-9ac7-808a63498779\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_vul_f81a78fb38adc0648cfeb4514965597f248381b_20b95fe6_2b7c5b8b-ad79-4160-9e69-1ee53bd9092b\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER677D.tmp.dmp
Mini DuMP crash report, 14 streams, Wed Apr 24 12:40:22 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER67FB.tmp.dmp
Mini DuMP crash report, 14 streams, Wed Apr 24 12:40:22 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6849.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6879.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6898.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6906.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7335.tmp.dmp
Mini DuMP crash report, 14 streams, Wed Apr 24 12:40:25 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7430.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7460.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F1C.tmp.dmp
Mini DuMP crash report, 14 streams, Wed Apr 24 12:40:28 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F7A.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F9B.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 8 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\loaddll64.exe
loaddll64.exe "C:\Users\user\Desktop\vulkan-1.dll"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImage2KHR
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",#1
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7352 -s 316
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7368 -s 348
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAcquireNextImageKHR
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7632 -s 340
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\vulkan-1.dll,vkAllocateCommandBuffers
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7776 -s 348
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAcquireNextImage2KHR
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAcquireNextImageKHR
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkAllocateCommandBuffers
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkWaitSemaphores
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkWaitForFences
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUpdateDescriptorSets
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUpdateDescriptorSetWithTemplate
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkUnmapMemory
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkTrimCommandPool
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSignalSemaphore
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSetPrivateData
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkSetEvent
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetQueryPool
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetFences
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\vulkan-1.dll",vkResetEvent
There are 16 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
ProgramId
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
FileId
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
LowerCaseLongPath
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
LongPathHash
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Name
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
OriginalFileName
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Publisher
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Version
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
BinFileVersion
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
BinaryType
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
ProductName
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
ProductVersion
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
LinkDate
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
BinProductVersion
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
AppxPackageFullName
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
AppxPackageRelativeId
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Size
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Language
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
IsOsComponent
\REGISTRY\A\{ad7913db-2518-55c1-88f3-776aa89331e9}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
Usn
There are 10 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
244CF8E9000
heap
page read and write
1BB3E7C000
stack
page read and write
1FAD1E30000
heap
page read and write
7FFDFF307000
unkown
page readonly
1F863390000
remote allocation
page read and write
17B50FB000
stack
page read and write
7FFDFF2F9000
unkown
page read and write
2348D3D0000
heap
page read and write
7FFDFF220000
unkown
page readonly
1E778010000
heap
page read and write
1CC0B6D8000
heap
page read and write
1E81A880000
heap
page read and write
7FFDFF2BA000
unkown
page readonly
17B51FF000
stack
page read and write
1E81AC90000
heap
page read and write
28A89068000
heap
page read and write
7FFDFF220000
unkown
page readonly
1305929E000
heap
page read and write
1B0C4440000
heap
page read and write
1CC0B6A0000
remote allocation
page read and write
1F8619C0000
heap
page read and write
7FFDFF307000
unkown
page readonly
2A0440FB000
heap
page read and write
1CC0B6D0000
heap
page read and write
E71C57F000
stack
page read and write
7FFDFF2FE000
unkown
page readonly
244CF7E0000
heap
page read and write
130D9750000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
7FFDFF2FE000
unkown
page readonly
1DC53FE0000
heap
page read and write
4FB298F000
stack
page read and write
7FFDFF2FE000
unkown
page readonly
7FFDFF220000
unkown
page readonly
130DAEA0000
remote allocation
page read and write
244CFBD0000
heap
page read and write
7FFDFF221000
unkown
page execute read
1FAD3900000
heap
page read and write
7FFDFF221000
unkown
page execute read
7FFDFF221000
unkown
page execute read
7FFDFF220000
unkown
page readonly
1F861840000
heap
page read and write
8848DB000
stack
page read and write
1F8619B5000
heap
page read and write
7FFDFF2FE000
unkown
page readonly
1FAD1FF0000
remote allocation
page read and write
7FFDFF30C000
unkown
page readonly
7FFDFF2BA000
unkown
page readonly
130D9560000
heap
page read and write
E71C47C000
stack
page read and write
8505DBF000
stack
page read and write
7FFDFF2FE000
unkown
page readonly
7FFDFF30C000
unkown
page readonly
191AE840000
heap
page read and write
1F863270000
heap
page read and write
20A30A00000
heap
page read and write
11498FE000
stack
page read and write
C76B9F000
stack
page read and write
7FFDFF307000
unkown
page readonly
1DC523F8000
heap
page read and write
7FFDFF221000
unkown
page execute read
244CF9F0000
heap
page read and write
1E7781C5000
heap
page read and write
1EB55B85000
heap
page read and write
244CF9D0000
heap
page read and write
7FFDFF220000
unkown
page readonly
7FFDFF2F9000
unkown
page read and write
130D9430000
heap
page read and write
13059470000
heap
page read and write
7FFDFF221000
unkown
page execute read
1DC525C0000
heap
page read and write
7FFDFF30C000
unkown
page readonly
3D27CFE000
stack
page read and write
24DED4E0000
heap
page read and write
130591F0000
heap
page read and write
2E1280C0000
heap
page read and write
1CC0B5F0000
heap
page read and write
2E127F10000
heap
page read and write
7FFDFF2FE000
unkown
page readonly
1BB3EFF000
stack
page read and write
CF3D29C000
stack
page read and write
2082A180000
heap
page read and write
1E778018000
heap
page read and write
2082A120000
remote allocation
page read and write
244CFBD5000
heap
page read and write
A2D4F6C000
stack
page read and write
7FFDFF307000
unkown
page readonly
7FFDFF30C000
unkown
page readonly
28A8AA40000
heap
page read and write
7FFDFF221000
unkown
page execute read
7FFDFF221000
unkown
page execute read
CF3D31F000
stack
page read and write
7FFDFF307000
unkown
page readonly
84E7B9B000
stack
page read and write
1BEDFBD5000
heap
page read and write
114987E000
stack
page read and write
A43017F000
stack
page read and write
2A044080000
heap
page read and write
1B0C4448000
heap
page read and write
2082A220000
heap
page read and write
24DED580000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
1F861920000
heap
page read and write
130D9468000
heap
page read and write
7FFDFF221000
unkown
page execute read
3D27C7E000
stack
page read and write
7FFDFF2BA000
unkown
page readonly
1CC0B5D0000
heap
page read and write
941C67C000
stack
page read and write
1B0C4410000
heap
page read and write
2E128025000
heap
page read and write
A2D4FEE000
stack
page read and write
7FFDFF220000
unkown
page readonly
1DC523F0000
heap
page read and write
7FFDFF220000
unkown
page readonly
1B0C4705000
heap
page read and write
20A309D0000
heap
page read and write
7FFDFF2BA000
unkown
page readonly
1DC523FE000
heap
page read and write
7FFDFF30C000
unkown
page readonly
2A043F80000
heap
page read and write
7FFDFF2FE000
unkown
page readonly
20A30D60000
heap
page read and write
8505D3F000
stack
page read and write
7FFDFF30C000
unkown
page readonly
7FFDFF30C000
unkown
page readonly
130D9755000
heap
page read and write
7FFDFF2BA000
unkown
page readonly
13059200000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
84E7EFF000
stack
page read and write
1BEDF878000
heap
page read and write
130594E5000
heap
page read and write
7B4348B000
stack
page read and write
4FB290C000
stack
page read and write
7FFDFF220000
unkown
page readonly
1FAD1E90000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
7FFDFF2F9000
unkown
page read and write
1F861940000
heap
page read and write
2E127FF0000
heap
page read and write
7FFDFF220000
unkown
page readonly
7FFDFF2F9000
unkown
page read and write
B15057F000
stack
page read and write
7FFDFF30C000
unkown
page readonly
84E7E7E000
stack
page read and write
C76A9B000
stack
page read and write
24DEEE90000
heap
page read and write
28A89060000
heap
page read and write
1E81A980000
heap
page read and write
7FFDFF221000
unkown
page execute read
7FFDFF2FE000
unkown
page readonly
20A30A08000
heap
page read and write
1CC0B4F0000
heap
page read and write
7FFDFF220000
unkown
page readonly
2348D3C0000
remote allocation
page read and write
7FFDFF221000
unkown
page execute read
A43007C000
stack
page read and write
7FFDFF307000
unkown
page readonly
7FFDFF2F9000
unkown
page read and write
7B4350F000
stack
page read and write
244CF8D8000
heap
page read and write
191AE820000
heap
page read and write
1BEDFBD0000
heap
page read and write
1B0C4310000
heap
page read and write
28A88FF0000
heap
page read and write
7FFDFF2BA000
unkown
page readonly
7FFDFF2FE000
unkown
page readonly
7FFDFF30C000
unkown
page readonly
7FFDFF2FE000
unkown
page readonly
7FFDFF220000
unkown
page readonly
7FFDFF2FE000
unkown
page readonly
A2D527F000
stack
page read and write
4FB2C7F000
stack
page read and write
1DC53F10000
remote allocation
page read and write
1BEE13B0000
heap
page read and write
1FAD1D50000
heap
page read and write
7FFDFF220000
unkown
page readonly
C1FD3CC000
stack
page read and write
7FFDFF2BA000
unkown
page readonly
2082A060000
heap
page read and write
E71C4FF000
stack
page read and write
7FFDFF2FE000
unkown
page readonly
7FFDFF30C000
unkown
page readonly
1E81A960000
heap
page read and write
24DED588000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
88495E000
stack
page read and write
191AEA10000
heap
page read and write
2A0440B0000
heap
page read and write
7FFDFF2FE000
unkown
page readonly
1E777FC0000
heap
page read and write
7B4358F000
stack
page read and write
191AEAE0000
heap
page read and write
1E81A9F8000
heap
page read and write
B1504FE000
stack
page read and write
24DEEE50000
remote allocation
page read and write
7FFDFF220000
unkown
page readonly
7FFDFF307000
unkown
page readonly
1BEDF7B0000
heap
page read and write
28A88FE0000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
2348D6C5000
heap
page read and write
1CC0B6DE000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
7FFDFF30C000
unkown
page readonly
7FFDFF30C000
unkown
page readonly
20A309C0000
heap
page read and write
1DC525E0000
heap
page read and write
1E81A9F0000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
1EB55B20000
heap
page read and write
7FFDFF220000
unkown
page readonly
20A326B0000
heap
page read and write
3EB711C000
stack
page read and write
1EB57670000
remote allocation
page read and write
1EB55B30000
heap
page read and write
130594E0000
heap
page read and write
24DED575000
heap
page read and write
7FFDFF2FE000
unkown
page readonly
11495BC000
stack
page read and write
1EB57560000
heap
page read and write
CF3D39F000
stack
page read and write
2A044060000
heap
page read and write
7FFDFF221000
unkown
page execute read
2348D220000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
1BEE12F0000
remote allocation
page read and write
1F8619C8000
heap
page read and write
8505CBC000
stack
page read and write
7FFDFF2BA000
unkown
page readonly
7FFDFF307000
unkown
page readonly
7FFDFF2BA000
unkown
page readonly
20A30D65000
heap
page read and write
7FFDFF220000
unkown
page readonly
191AEAE5000
heap
page read and write
28A88EE0000
heap
page read and write
7FFDFF221000
unkown
page execute read
7FFDFF221000
unkown
page execute read
1E779B60000
heap
page read and write
244D1260000
heap
page read and write
7FFDFF30C000
unkown
page readonly
7FFDFF221000
unkown
page execute read
7FFDFF2BA000
unkown
page readonly
13059290000
heap
page read and write
2348EE40000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
7FFDFF2BA000
unkown
page readonly
7FFDFF2BA000
unkown
page readonly
7FFDFF2FE000
unkown
page readonly
2348D3D8000
heap
page read and write
1CC0B990000
heap
page read and write
2082A080000
heap
page read and write
7FFDFF2FE000
unkown
page readonly
B15047B000
stack
page read and write
AABCF9C000
stack
page read and write
7FFDFF220000
unkown
page readonly
2E1280D0000
remote allocation
page read and write
3D2799B000
stack
page read and write
7FFDFF221000
unkown
page execute read
7FFDFF307000
unkown
page readonly
191AE848000
heap
page read and write
7FFDFF2FE000
unkown
page readonly
7FFDFF221000
unkown
page execute read
7FFDFF2BA000
unkown
page readonly
2E128020000
heap
page read and write
130DADA0000
heap
page read and write
24DED570000
heap
page read and write
1FAD2050000
heap
page read and write
7FFDFF2BA000
unkown
page readonly
1DC523D0000
heap
page read and write
1FAD1E50000
heap
page read and write
7FFDFF220000
unkown
page readonly
7FFDFF221000
unkown
page execute read
941C6FF000
stack
page read and write
7FFDFF30C000
unkown
page readonly
2A0440E0000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
3EB719F000
stack
page read and write
7FFDFF2FE000
unkown
page readonly
7FFDFF30C000
unkown
page readonly
7FFDFF2FE000
unkown
page readonly
20A30BD0000
heap
page read and write
20829F60000
heap
page read and write
1E778180000
remote allocation
page read and write
7FFDFF221000
unkown
page execute read
7FFDFF220000
unkown
page readonly
191B03B0000
heap
page read and write
2E1280E0000
heap
page read and write
1F8619B0000
heap
page read and write
2A0440ED000
heap
page read and write
7FFDFF2BA000
unkown
page readonly
7FFDFF307000
unkown
page readonly
7FFDFF307000
unkown
page readonly
1B0C5E20000
heap
page read and write
1B0C43F0000
heap
page read and write
1E777FE0000
heap
page read and write
7FFDFF221000
unkown
page execute read
7FFDFF2F9000
unkown
page read and write
A4300FF000
stack
page read and write
2E1280E8000
heap
page read and write
24DED500000
heap
page read and write
8849DF000
stack
page read and write
C76B1F000
stack
page read and write
20829F67000
heap
page read and write
7FFDFF220000
unkown
page readonly
191AEA30000
heap
page read and write
1E7781C0000
heap
page read and write
7FFDFF307000
unkown
page readonly
7FFDFF221000
unkown
page execute read
1EB55B80000
heap
page read and write
1B0C4700000
heap
page read and write
7FFDFF307000
unkown
page readonly
1E81AC95000
heap
page read and write
1EB55BE8000
heap
page read and write
18321AF000
stack
page read and write
1BB3F7F000
stack
page read and write
7FFDFF30C000
unkown
page readonly
1BEDF7E0000
heap
page read and write
7FFDFF30C000
unkown
page readonly
2348D300000
heap
page read and write
1BEDF7C0000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
13059220000
heap
page read and write
7FFDFF2BA000
unkown
page readonly
20829E80000
heap
page read and write
7FFDFF30C000
unkown
page readonly
7FFDFF307000
unkown
page readonly
183212C000
stack
page read and write
1DC52675000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
7FFDFF220000
unkown
page readonly
7FFDFF307000
unkown
page readonly
28A88FC0000
heap
page read and write
3EB747F000
stack
page read and write
28A88FE5000
heap
page read and write
7FFDFF2FE000
unkown
page readonly
183247F000
stack
page read and write
1E777EE0000
heap
page read and write
130D9350000
heap
page read and write
7FFDFF307000
unkown
page readonly
1EB55BE0000
heap
page read and write
2348D320000
heap
page read and write
130D9460000
heap
page read and write
7FFDFF307000
unkown
page readonly
20A30D50000
remote allocation
page read and write
7FFDFF2BA000
unkown
page readonly
7FFDFF307000
unkown
page readonly
1EB55B50000
heap
page read and write
1FAD1E98000
heap
page read and write
7FFDFF307000
unkown
page readonly
7FFDFF30C000
unkown
page readonly
7FFDFF30C000
unkown
page readonly
C1FD67F000
stack
page read and write
1BEDF870000
heap
page read and write
1B0C5E60000
remote allocation
page read and write
2348D6C0000
heap
page read and write
7FFDFF2F9000
unkown
page read and write
941C77E000
stack
page read and write
7FFDFF2BA000
unkown
page readonly
7FFDFF2BA000
unkown
page readonly
1FAD2055000
heap
page read and write
244CF8D0000
heap
page read and write
24DED400000
heap
page read and write
1CC0B995000
heap
page read and write
7FFDFF2BA000
unkown
page readonly
13059298000
heap
page read and write
2082A225000
heap
page read and write
C1FD6FF000
stack
page read and write
1DC52670000
heap
page read and write
2E128030000
heap
page read and write
17B517F000
stack
page read and write
1CC0B690000
heap
page read and write
191AEAC0000
remote allocation
page read and write
1E81C440000
heap
page read and write
7FFDFF307000
unkown
page readonly
There are 366 hidden memdumps, click here to show them.