Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
F072.dll
|
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_792f64dfd282ce5c1f3ccd2775d0d855d365cbe7_82810a17_0b56d8a5\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_792f64dfd282ce5c1f3ccd2775d0d855d365cbe7_82810a17_162eca2e\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_875735debeb93db2959d1fbfa047a3f67cf9964f_82810a17_1626d8b5\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_875735debeb93db2959d1fbfa047a3f67cf9964f_82810a17_1adebbd6\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_875735debeb93db2959d1fbfa047a3f67cf9964f_82810a17_1af2bbb7\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF34.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:09 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAF92.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:09 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB0FA.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB119.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB159.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB188.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3F5.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:14 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC51E.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC58D.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1FE.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:17 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD23D.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:17 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD338.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD368.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD376.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3D5.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\national[1].htm
|
HTML document, ASCII text, with very long lines (65212)
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
There are 14 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\loaddll32.exe
|
loaddll32.exe "C:\Users\user\Desktop\F072.dll"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\F072.dll",#1
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\F072.dll,mv_add_i
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F072.dll",#1
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 664
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 664
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\F072.dll,mv_add_q
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\F072.dll,mv_add_stable
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5708 -s 652
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F072.dll",mv_add_i
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F072.dll",mv_add_q
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F072.dll",mv_add_stable
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F072.dll",next
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F072.dll",mvutil_license
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F072.dll",mvutil_configuration
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 652
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 652
|
|
|
|
C:\Windows\SysWOW64\wermgr.exe
|
C:\Windows\SysWOW64\wermgr.exe
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
There are 9 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://www.xfinity.com/mobile/policies/broadband-disclosures
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
https://www.xfinity.com/learn/internet-service/acp
|
unknown
|
||
|
https://www.xfinity.com/networkmanagement
|
unknown
|
||
|
https://streams.videolan.org/upload/
|
unknown
|
||
|
https://xfinity.com/
|
68.87.41.40
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
xfinity.com
|
68.87.41.40
|
||
|
www.xfinity.com
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
2.82.8.80
|
unknown
|
Portugal
|
|
|
|
70.160.67.203
|
unknown
|
United States
|
|
|
|
75.143.236.149
|
unknown
|
United States
|
|
|
|
83.110.223.61
|
unknown
|
United Arab Emirates
|
|
|
|
86.195.14.72
|
unknown
|
France
|
|
|
|
84.215.202.8
|
unknown
|
Norway
|
|
|
|
184.182.66.109
|
unknown
|
United States
|
|
|
|
92.186.69.229
|
unknown
|
France
|
|
|
|
174.4.89.3
|
unknown
|
Canada
|
|
|
|
161.142.103.187
|
unknown
|
Malaysia
|
|
|
|
114.143.176.236
|
unknown
|
India
|
|
|
|
14.192.241.76
|
unknown
|
Malaysia
|
|
|
|
173.88.135.179
|
unknown
|
United States
|
|
|
|
84.108.200.161
|
unknown
|
Israel
|
|
|
|
47.34.30.133
|
unknown
|
United States
|
|
|
|
183.87.163.165
|
unknown
|
India
|
|
|
|
184.181.75.148
|
unknown
|
United States
|
|
|
|
124.149.143.189
|
unknown
|
Australia
|
|
|
|
84.35.26.14
|
unknown
|
Netherlands
|
|
|
|
73.29.92.128
|
unknown
|
United States
|
|
|
|
68.203.69.96
|
unknown
|
United States
|
|
|
|
82.131.141.209
|
unknown
|
Hungary
|
|
|
|
64.121.161.102
|
unknown
|
United States
|
|
|
|
178.175.187.254
|
unknown
|
Moldova Republic of
|
|
|
|
96.56.197.26
|
unknown
|
United States
|
|
|
|
186.64.67.30
|
unknown
|
Argentina
|
|
|
|
188.28.19.84
|
unknown
|
United Kingdom
|
|
|
|
125.99.76.102
|
unknown
|
India
|
|
|
|
81.101.185.146
|
unknown
|
United Kingdom
|
|
|
|
59.28.84.65
|
unknown
|
Korea Republic of
|
|
|
|
105.186.128.181
|
unknown
|
South Africa
|
|
|
|
76.86.31.59
|
unknown
|
United States
|
|
|
|
147.147.30.126
|
unknown
|
United Kingdom
|
|
|
|
96.87.28.170
|
unknown
|
United States
|
|
|
|
75.109.111.89
|
unknown
|
United States
|
|
|
|
78.92.133.215
|
unknown
|
Hungary
|
|
|
|
124.122.47.148
|
unknown
|
Thailand
|
|
|
|
88.126.94.4
|
unknown
|
France
|
|
|
|
85.57.212.13
|
unknown
|
Spain
|
|
|
|
51.14.29.227
|
unknown
|
United Kingdom
|
|
|
|
47.205.25.170
|
unknown
|
United States
|
|
|
|
95.45.50.93
|
unknown
|
Ireland
|
|
|
|
80.12.88.148
|
unknown
|
France
|
|
|
|
69.133.162.35
|
unknown
|
United States
|
|
|
|
86.132.236.117
|
unknown
|
United Kingdom
|
|
|
|
151.62.238.176
|
unknown
|
Italy
|
|
|
|
70.112.206.5
|
unknown
|
United States
|
|
|
|
205.237.67.69
|
unknown
|
Canada
|
|
|
|
102.159.188.125
|
unknown
|
Tunisia
|
|
|
|
151.65.167.77
|
unknown
|
Italy
|
|
|
|
76.178.148.107
|
unknown
|
United States
|
|
|
|
89.36.206.69
|
unknown
|
Italy
|
|
|
|
69.242.31.249
|
unknown
|
United States
|
|
|
|
193.253.100.236
|
unknown
|
France
|
|
|
|
76.16.49.134
|
unknown
|
United States
|
|
|
|
94.207.104.225
|
unknown
|
United Arab Emirates
|
|
|
|
201.244.108.183
|
unknown
|
Colombia
|
|
|
|
103.42.86.42
|
unknown
|
India
|
|
|
|
78.18.105.11
|
unknown
|
Ireland
|
|
|
|
80.6.50.34
|
unknown
|
United Kingdom
|
|
|
|
103.144.201.56
|
unknown
|
unknown
|
|
|
|
27.0.48.233
|
unknown
|
India
|
|
|
|
70.28.50.223
|
unknown
|
Canada
|
|
|
|
98.145.23.67
|
unknown
|
United States
|
|
|
|
47.149.134.231
|
unknown
|
United States
|
|
|
|
82.125.44.236
|
unknown
|
France
|
|
|
|
81.229.117.95
|
unknown
|
Sweden
|
|
|
|
89.129.109.27
|
unknown
|
Spain
|
|
|
|
122.186.210.254
|
unknown
|
India
|
|
|
|
79.77.142.22
|
unknown
|
United Kingdom
|
|
|
|
90.78.147.141
|
unknown
|
France
|
|
|
|
122.184.143.86
|
unknown
|
India
|
|
|
|
186.75.95.6
|
unknown
|
Panama
|
|
|
|
50.68.186.195
|
unknown
|
Canada
|
|
|
|
12.172.173.82
|
unknown
|
United States
|
|
|
|
213.64.33.61
|
unknown
|
Sweden
|
|
|
|
79.168.224.165
|
unknown
|
Portugal
|
|
|
|
86.97.55.89
|
unknown
|
United Arab Emirates
|
|
|
|
176.142.207.63
|
unknown
|
France
|
|
|
|
92.154.17.149
|
unknown
|
France
|
|
|
|
174.58.146.57
|
unknown
|
United States
|
|
|
|
78.160.146.127
|
unknown
|
Turkey
|
|
|
|
58.186.75.42
|
unknown
|
Viet Nam
|
|
|
|
223.166.13.95
|
unknown
|
China
|
|
|
|
65.95.141.84
|
unknown
|
Canada
|
|
|
|
50.68.204.71
|
unknown
|
Canada
|
|
|
|
71.38.155.217
|
unknown
|
United States
|
|
|
|
104.35.24.154
|
unknown
|
United States
|
|
|
|
220.240.164.182
|
unknown
|
Australia
|
|
|
|
103.123.223.133
|
unknown
|
India
|
|
|
|
24.198.114.130
|
unknown
|
United States
|
|
|
|
2.36.64.159
|
unknown
|
Italy
|
|
|
|
198.2.51.242
|
unknown
|
United States
|
|
|
|
92.9.45.20
|
unknown
|
United Kingdom
|
|
|
|
113.11.92.30
|
unknown
|
Bangladesh
|
|
|
|
69.119.123.159
|
unknown
|
United States
|
|
|
|
69.123.4.221
|
unknown
|
United States
|
|
|
|
172.115.17.50
|
unknown
|
United States
|
|
|
|
68.87.41.40
|
xfinity.com
|
United States
|
||
|
192.168.2.1
|
unknown
|
unknown
|
There are 90 hidden IPs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProgramId
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
FileId
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LongPathHash
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Name
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Publisher
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Version
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinFileVersion
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinaryType
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductName
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductVersion
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LinkDate
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinProductVersion
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Size
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Language
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsPeFile
|
||
|
\REGISTRY\A\{ff901a40-4dca-83b7-88cb-25a3b7644b7f}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsOsComponent
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceId
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
ApplicationFlags
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
00184008C5A0EBAC
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHivePermissionsCorrect
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHiveOwnerCorrect
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
00184008C5A0EBAC
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
d7e439c6
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
e27be988
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
e03ac9f4
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
5886ae91
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
258ee11b
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
9d32867e
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
5ac78eed
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
a8ad5630
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
d7e439c6
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
d7e439c6
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
d7e439c6
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Urjykoiz
|
d7e439c6
|
There are 33 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4980000
|
heap
|
page read and write
|
|
|
|
2C3A000
|
heap
|
page read and write
|
|
|
|
101E3000
|
unkown
|
page write copy
|
||
|
3380000
|
heap
|
page read and write
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
180000
|
heap
|
page read and write
|
||
|
58A0000
|
trusted library allocation
|
page read and write
|
||
|
2045D285000
|
heap
|
page read and write
|
||
|
2E7F000
|
stack
|
page read and write
|
||
|
2BA0000
|
heap
|
page read and write
|
||
|
2045D100000
|
heap
|
page read and write
|
||
|
730D000
|
heap
|
page read and write
|
||
|
495A000
|
direct allocation
|
page readonly
|
||
|
2045D502000
|
heap
|
page read and write
|
||
|
3FF000
|
stack
|
page read and write
|
||
|
2045D24A000
|
heap
|
page read and write
|
||
|
5864000
|
heap
|
page read and write
|
||
|
2045D0A0000
|
trusted library allocation
|
page read and write
|
||
|
347A000
|
heap
|
page read and write
|
||
|
2045D285000
|
unkown
|
page read and write
|
||
|
4962000
|
direct allocation
|
page readonly
|
||
|
67CD000
|
heap
|
page read and write
|
||
|
1252000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
1258000
|
heap
|
page read and write
|
||
|
D3D000
|
stack
|
page read and write
|
||
|
5DA0000
|
trusted library allocation
|
page read and write
|
||
|
2EC0000
|
heap
|
page read and write
|
||
|
67CD000
|
heap
|
page read and write
|
||
|
5721000
|
heap
|
page read and write
|
||
|
2D1E000
|
stack
|
page read and write
|
||
|
6758000
|
heap
|
page read and write
|
||
|
3190000
|
heap
|
page read and write
|
||
|
4B20000
|
trusted library allocation
|
page read and write
|
||
|
29FF000
|
stack
|
page read and write
|
||
|
2CA0000
|
heap
|
page read and write
|
||
|
67CD000
|
heap
|
page read and write
|
||
|
2BF0000
|
heap
|
page readonly
|
||
|
5DA0000
|
trusted library allocation
|
page read and write
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
67FB000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
2045D513000
|
heap
|
page read and write
|
||
|
2DB4000
|
heap
|
page read and write
|
||
|
3390000
|
heap
|
page read and write
|
||
|
3F54979000
|
stack
|
page read and write
|
||
|
54E000
|
stack
|
page read and write
|
||
|
2A7A000
|
heap
|
page read and write
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
48FB000
|
heap
|
page read and write
|
||
|
5CB000
|
stack
|
page read and write
|
||
|
340000
|
heap
|
page read and write
|
||
|
DA0000
|
heap
|
page read and write
|
||
|
46FE000
|
stack
|
page read and write
|
||
|
48FB000
|
heap
|
page read and write
|
||
|
98B000
|
stack
|
page read and write
|
||
|
675C000
|
heap
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
2045D402000
|
heap
|
page read and write
|
||
|
3160000
|
heap
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
49A3000
|
heap
|
page read and write
|
||
|
5DA0000
|
trusted library allocation
|
page read and write
|
||
|
DEE000
|
stack
|
page read and write
|
||
|
29C000
|
stack
|
page read and write
|
||
|
94C000
|
stack
|
page read and write
|
||
|
2DB4000
|
heap
|
page read and write
|
||
|
346F000
|
stack
|
page read and write
|
||
|
5840000
|
heap
|
page read and write
|
||
|
30AB000
|
stack
|
page read and write
|
||
|
11B0000
|
heap
|
page read and write
|
||
|
48BC000
|
heap
|
page read and write
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
67FB000
|
heap
|
page read and write
|
||
|
2F6A000
|
heap
|
page read and write
|
||
|
5840000
|
heap
|
page read and write
|
||
|
48FB000
|
heap
|
page read and write
|
||
|
67FD000
|
heap
|
page read and write
|
||
|
2EC0000
|
heap
|
page read and write
|
||
|
690000
|
heap
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
48CC000
|
heap
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
2EF0000
|
heap
|
page read and write
|
||
|
4DD0000
|
heap
|
page read and write
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
674C000
|
heap
|
page read and write
|
||
|
5864000
|
heap
|
page read and write
|
||
|
2FA0000
|
heap
|
page read and write
|
||
|
675C000
|
heap
|
page read and write
|
||
|
7A0000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
4100000
|
heap
|
page read and write
|
||
|
47FA000
|
heap
|
page read and write
|
||
|
2A90000
|
heap
|
page read and write
|
||
|
2045D302000
|
trusted library allocation
|
page read and write
|
||
|
7813000
|
heap
|
page read and write
|
||
|
2FEF000
|
stack
|
page read and write
|
||
|
48FB000
|
heap
|
page read and write
|
||
|
5C20000
|
trusted library allocation
|
page read and write
|
||
|
67EF000
|
heap
|
page read and write
|
||
|
580000
|
heap
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
123B000
|
heap
|
page read and write
|
||
|
4894000
|
heap
|
page read and write
|
||
|
67FD000
|
heap
|
page read and write
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
31E0000
|
heap
|
page read and write
|
||
|
67EF000
|
heap
|
page read and write
|
||
|
7815000
|
heap
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
67EF000
|
heap
|
page read and write
|
||
|
48C8000
|
heap
|
page read and write
|
||
|
48EF000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
6B03000
|
heap
|
page read and write
|
||
|
342E000
|
stack
|
page read and write
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
2EF0000
|
heap
|
page read and write
|
||
|
2045D285000
|
heap
|
page read and write
|
||
|
46B0000
|
direct allocation
|
page execute read
|
||
|
2E3E000
|
stack
|
page read and write
|
||
|
32DF000
|
stack
|
page read and write
|
||
|
31EE000
|
stack
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
7009000
|
heap
|
page read and write
|
||
|
CD0000
|
heap
|
page read and write
|
||
|
2D5F000
|
stack
|
page read and write
|
||
|
5731000
|
heap
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
67EF000
|
heap
|
page read and write
|
||
|
29F0000
|
heap
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
5DA0000
|
trusted library allocation
|
page read and write
|
||
|
674C000
|
heap
|
page read and write
|
||
|
7516000
|
heap
|
page read and write
|
||
|
6758000
|
heap
|
page read and write
|
||
|
5864000
|
heap
|
page read and write
|
||
|
5840000
|
heap
|
page read and write
|
||
|
48FB000
|
heap
|
page read and write
|
||
|
67FD000
|
heap
|
page read and write
|
||
|
67FD000
|
heap
|
page read and write
|
||
|
67FB000
|
heap
|
page read and write
|
||
|
675C000
|
heap
|
page read and write
|
||
|
4941000
|
direct allocation
|
page execute read
|
||
|
49FF000
|
heap
|
page read and write
|
||
|
2045D24A000
|
heap
|
page read and write
|
||
|
46B0000
|
heap
|
page read and write
|
||
|
33B0000
|
heap
|
page read and write
|
||
|
113E000
|
stack
|
page read and write
|
||
|
2BB0000
|
heap
|
page read and write
|
||
|
2045D248000
|
heap
|
page read and write
|
||
|
5864000
|
heap
|
page read and write
|
||
|
2F6E000
|
stack
|
page read and write
|
||
|
5DA0000
|
trusted library allocation
|
page read and write
|
||
|
2045D24D000
|
heap
|
page read and write
|
||
|
2C3B000
|
stack
|
page read and write
|
||
|
2DB4000
|
heap
|
page read and write
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
32B0000
|
heap
|
page read and write
|
||
|
2DEC000
|
stack
|
page read and write
|
||
|
230000
|
heap
|
page read and write
|
||
|
2DB0000
|
heap
|
page read and write
|
||
|
305F000
|
stack
|
page read and write
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
5731000
|
heap
|
page read and write
|
||
|
3470000
|
heap
|
page read and write
|
||
|
2F60000
|
heap
|
page read and write
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
2AFC000
|
stack
|
page read and write
|
||
|
1D0000
|
heap
|
page readonly
|
||
|
4940000
|
direct allocation
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
48EF000
|
heap
|
page read and write
|
||
|
2DB4000
|
heap
|
page read and write
|
||
|
7307000
|
heap
|
page read and write
|
||
|
30D0000
|
heap
|
page read and write
|
||
|
970000
|
heap
|
page read and write
|
||
|
2045D213000
|
unkown
|
page read and write
|
||
|
2EC0000
|
heap
|
page read and write
|
||
|
48F5000
|
heap
|
page read and write
|
||
|
45F0000
|
heap
|
page read and write
|
||
|
30DA000
|
heap
|
page read and write
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
2B3B000
|
stack
|
page read and write
|
||
|
2BB0000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
3180000
|
heap
|
page read and write
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
68EC000
|
heap
|
page read and write
|
||
|
67CD000
|
heap
|
page read and write
|
||
|
2D9F000
|
stack
|
page read and write
|
||
|
2045D20D000
|
unkown
|
page read and write
|
||
|
4A21000
|
heap
|
page read and write
|
||
|
3290000
|
heap
|
page read and write
|
||
|
1246000
|
heap
|
page read and write
|
||
|
10FC000
|
stack
|
page read and write
|
||
|
7D0000
|
heap
|
page read and write
|
||
|
2045D24A000
|
heap
|
page read and write
|
||
|
6924000
|
heap
|
page read and write
|
||
|
322F000
|
stack
|
page read and write
|
||
|
5840000
|
heap
|
page read and write
|
||
|
67FB000
|
heap
|
page read and write
|
||
|
469F000
|
stack
|
page read and write
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
48FB000
|
heap
|
page read and write
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
67FB000
|
heap
|
page read and write
|
||
|
4B20000
|
heap
|
page read and write
|
||
|
612C000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
520000
|
heap
|
page read and write
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
5D27000
|
heap
|
page read and write
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
3360000
|
heap
|
page read and write
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
3270000
|
heap
|
page readonly
|
||
|
301E000
|
stack
|
page read and write
|
||
|
2C30000
|
heap
|
page read and write
|
||
|
6B03000
|
heap
|
page read and write
|
||
|
2045D24A000
|
heap
|
page read and write
|
||
|
2D60000
|
heap
|
page read and write
|
||
|
67FD000
|
heap
|
page read and write
|
||
|
3240000
|
heap
|
page readonly
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
5731000
|
heap
|
page read and write
|
||
|
3070000
|
heap
|
page readonly
|
||
|
6B0D000
|
heap
|
page read and write
|
||
|
2D00000
|
heap
|
page read and write
|
||
|
674C000
|
heap
|
page read and write
|
||
|
11B000
|
stack
|
page read and write
|
||
|
67FB000
|
heap
|
page read and write
|
||
|
3F54579000
|
stack
|
page read and write
|
||
|
2045D513000
|
heap
|
page read and write
|
||
|
6B0F000
|
heap
|
page read and write
|
||
|
70000
|
heap
|
page read and write
|
||
|
8E0000
|
heap
|
page read and write
|
||
|
2045D200000
|
unkown
|
page read and write
|
||
|
5864000
|
heap
|
page read and write
|
||
|
2045D296000
|
heap
|
page read and write
|
||
|
2045D400000
|
heap
|
page read and write
|
||
|
67EF000
|
heap
|
page read and write
|
||
|
97E000
|
stack
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
2EA0000
|
heap
|
page read and write
|
||
|
2B30000
|
heap
|
page read and write
|
||
|
2045D285000
|
heap
|
page read and write
|
||
|
2DB000
|
stack
|
page read and write
|
||
|
2045D323000
|
heap
|
page read and write
|
||
|
3090000
|
heap
|
page read and write
|
||
|
5DA0000
|
trusted library allocation
|
page read and write
|
||
|
4490000
|
heap
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
6B06000
|
heap
|
page read and write
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
623D000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
2E50000
|
heap
|
page readonly
|
||
|
32BA000
|
heap
|
page read and write
|
||
|
2045D500000
|
heap
|
page read and write
|
||
|
29FC000
|
stack
|
page read and write
|
||
|
67EF000
|
heap
|
page read and write
|
||
|
730E000
|
heap
|
page read and write
|
||
|
4A20000
|
heap
|
page read and write
|
||
|
48F9000
|
heap
|
page read and write
|
||
|
69A000
|
heap
|
page read and write
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
2045D502000
|
heap
|
page read and write
|
||
|
1230000
|
heap
|
page read and write
|
||
|
675C000
|
heap
|
page read and write
|
||
|
48A1000
|
heap
|
page read and write
|
||
|
3040000
|
heap
|
page read and write
|
||
|
3F541FD000
|
stack
|
page read and write
|
||
|
2045D300000
|
trusted library allocation
|
page read and write
|
||
|
67CD000
|
heap
|
page read and write
|
||
|
2045D516000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
674C000
|
heap
|
page read and write
|
||
|
4720000
|
heap
|
page read and write
|
||
|
7012000
|
heap
|
page read and write
|
||
|
2045D315000
|
trusted library allocation
|
page read and write
|
||
|
5840000
|
heap
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
306C000
|
stack
|
page read and write
|
||
|
3000000
|
heap
|
page read and write
|
||
|
2E3B000
|
stack
|
page read and write
|
||
|
2045D090000
|
heap
|
page read and write
|
||
|
2045D24A000
|
heap
|
page read and write
|
||
|
50E000
|
stack
|
page read and write
|
||
|
4871000
|
heap
|
page read and write
|
||
|
3270000
|
heap
|
page read and write
|
||
|
2045D228000
|
heap
|
page read and write
|
||
|
7014000
|
heap
|
page read and write
|
||
|
1140000
|
heap
|
page read and write
|
||
|
2DA0000
|
heap
|
page readonly
|
||
|
489F000
|
heap
|
page read and write
|
||
|
3170000
|
heap
|
page read and write
|
||
|
2CBF000
|
stack
|
page read and write
|
||
|
2045D285000
|
heap
|
page read and write
|
||
|
3200000
|
heap
|
page read and write
|
||
|
67FD000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
3BE000
|
stack
|
page read and write
|
||
|
67FD000
|
heap
|
page read and write
|
||
|
67CD000
|
heap
|
page read and write
|
||
|
2BAE000
|
stack
|
page read and write
|
||
|
67CD000
|
heap
|
page read and write
|
||
|
2B10000
|
heap
|
page read and write
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
337E000
|
stack
|
page read and write
|
||
|
30B0000
|
heap
|
page read and write
|
||
|
2DB4000
|
heap
|
page read and write
|
||
|
67CC000
|
heap
|
page read and write
|
||
|
67FD000
|
heap
|
page read and write
|
||
|
2045D502000
|
heap
|
page read and write
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
6B07000
|
heap
|
page read and write
|
||
|
2BBB000
|
stack
|
page read and write
|
||
|
495F000
|
direct allocation
|
page read and write
|
||
|
303B000
|
stack
|
page read and write
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
2045D285000
|
heap
|
page read and write
|
||
|
2F80000
|
heap
|
page readonly
|
||
|
6758000
|
heap
|
page read and write
|
||
|
2A70000
|
heap
|
page read and write
|
||
|
2DB4000
|
heap
|
page read and write
|
||
|
67EF000
|
heap
|
page read and write
|
||
|
30BA000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
2E7B000
|
stack
|
page read and write
|
||
|
67EF000
|
heap
|
page read and write
|
||
|
2045D413000
|
heap
|
page read and write
|
||
|
58C000
|
stack
|
page read and write
|
||
|
4AAF000
|
stack
|
page read and write
|
||
|
67CD000
|
heap
|
page read and write
|
||
|
6758000
|
heap
|
page read and write
|
||
|
5C20000
|
trusted library allocation
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
2B7C000
|
stack
|
page read and write
|
||
|
610000
|
heap
|
page readonly
|
||
|
5820000
|
trusted library allocation
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
48F9000
|
heap
|
page read and write
|
||
|
2045D24A000
|
heap
|
page read and write
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
2D80000
|
heap
|
page read and write
|
||
|
49FF000
|
heap
|
page read and write
|
||
|
2D8E000
|
stack
|
page read and write
|
||
|
4C00000
|
heap
|
page read and write
|
||
|
2DB4000
|
heap
|
page read and write
|
||
|
67FB000
|
heap
|
page read and write
|
||
|
493F000
|
stack
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
990000
|
heap
|
page readonly
|
||
|
DB000
|
stack
|
page read and write
|
||
|
6B08000
|
heap
|
page read and write
|
||
|
48FB000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
58A000
|
heap
|
page read and write
|
||
|
7022000
|
heap
|
page read and write
|
||
|
67FB000
|
heap
|
page read and write
|
||
|
2ECA000
|
heap
|
page read and write
|
||
|
325E000
|
stack
|
page read and write
|
||
|
14FF000
|
stack
|
page read and write
|
||
|
2DB4000
|
heap
|
page read and write
|
There are 361 hidden memdumps, click here to show them.