Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
F086.dll
|
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
|
initial sample
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_92f46c7f299346a6ffcb64477668158ac3e1de1_82810a17_115c31ef\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_92f46c7f299346a6ffcb64477668158ac3e1de1_82810a17_1bf84170\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e81cd1d5139fff9fe89f63caf8b194b6696e72da_82810a17_0aac24e0\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e81cd1d5139fff9fe89f63caf8b194b6696e72da_82810a17_16cc24ef\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e81cd1d5139fff9fe89f63caf8b194b6696e72da_82810a17_1b044132\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
modified
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1714.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:10 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1763.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:10 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1909.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1929.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1939.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1959.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C42.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:15 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D9B.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E09.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER39A0.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:19 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER39CF.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:19 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B86.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B95.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3BC5.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C04.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\national[1].htm
|
HTML document, ASCII text, with very long lines (65212)
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
There are 14 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Windows\System32\loaddll32.exe
|
loaddll32.exe "C:\Users\user\Desktop\F086.dll"
|
||
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\F086.dll",#1
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\F086.dll,mv_add_i
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F086.dll",#1
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 660
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 652
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\F086.dll,mv_add_q
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\F086.dll,mv_add_stable
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 652
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F086.dll",mv_add_i
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F086.dll",mv_add_q
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F086.dll",mv_add_stable
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F086.dll",next
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F086.dll",mvutil_license
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\F086.dll",mvutil_configuration
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 652
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 652
|
||
C:\Windows\SysWOW64\wermgr.exe
|
C:\Windows\SysWOW64\wermgr.exe
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
There are 9 hidden processes, click here to show them.
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://www.xfinity.com/mobile/policies/broadband-disclosures
|
unknown
|
||
http://upx.sf.net
|
unknown
|
||
https://www.xfinity.com/learn/internet-service/acp
|
unknown
|
||
https://www.xfinity.com/networkmanagement
|
unknown
|
||
https://streams.videolan.org/upload/
|
unknown
|
||
https://xfinity.com/
|
68.87.41.40
|
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
xfinity.com
|
68.87.41.40
|
||
www.xfinity.com
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
2.82.8.80
|
unknown
|
Portugal
|
||
70.160.67.203
|
unknown
|
United States
|
||
75.143.236.149
|
unknown
|
United States
|
||
83.110.223.61
|
unknown
|
United Arab Emirates
|
||
86.195.14.72
|
unknown
|
France
|
||
84.215.202.8
|
unknown
|
Norway
|
||
184.182.66.109
|
unknown
|
United States
|
||
92.186.69.229
|
unknown
|
France
|
||
174.4.89.3
|
unknown
|
Canada
|
||
161.142.103.187
|
unknown
|
Malaysia
|
||
114.143.176.236
|
unknown
|
India
|
||
14.192.241.76
|
unknown
|
Malaysia
|
||
173.88.135.179
|
unknown
|
United States
|
||
84.108.200.161
|
unknown
|
Israel
|
||
47.34.30.133
|
unknown
|
United States
|
||
183.87.163.165
|
unknown
|
India
|
||
184.181.75.148
|
unknown
|
United States
|
||
124.149.143.189
|
unknown
|
Australia
|
||
84.35.26.14
|
unknown
|
Netherlands
|
||
73.29.92.128
|
unknown
|
United States
|
||
68.203.69.96
|
unknown
|
United States
|
||
82.131.141.209
|
unknown
|
Hungary
|
||
64.121.161.102
|
unknown
|
United States
|
||
178.175.187.254
|
unknown
|
Moldova Republic of
|
||
96.56.197.26
|
unknown
|
United States
|
||
186.64.67.30
|
unknown
|
Argentina
|
||
188.28.19.84
|
unknown
|
United Kingdom
|
||
125.99.76.102
|
unknown
|
India
|
||
81.101.185.146
|
unknown
|
United Kingdom
|
||
59.28.84.65
|
unknown
|
Korea Republic of
|
||
105.186.128.181
|
unknown
|
South Africa
|
||
76.86.31.59
|
unknown
|
United States
|
||
147.147.30.126
|
unknown
|
United Kingdom
|
||
96.87.28.170
|
unknown
|
United States
|
||
75.109.111.89
|
unknown
|
United States
|
||
78.92.133.215
|
unknown
|
Hungary
|
||
124.122.47.148
|
unknown
|
Thailand
|
||
88.126.94.4
|
unknown
|
France
|
||
51.14.29.227
|
unknown
|
United Kingdom
|
||
85.57.212.13
|
unknown
|
Spain
|
||
47.205.25.170
|
unknown
|
United States
|
||
95.45.50.93
|
unknown
|
Ireland
|
||
80.12.88.148
|
unknown
|
France
|
||
69.133.162.35
|
unknown
|
United States
|
||
86.132.236.117
|
unknown
|
United Kingdom
|
||
151.62.238.176
|
unknown
|
Italy
|
||
70.112.206.5
|
unknown
|
United States
|
||
205.237.67.69
|
unknown
|
Canada
|
||
102.159.188.125
|
unknown
|
Tunisia
|
||
151.65.167.77
|
unknown
|
Italy
|
||
76.178.148.107
|
unknown
|
United States
|
||
89.36.206.69
|
unknown
|
Italy
|
||
69.242.31.249
|
unknown
|
United States
|
||
193.253.100.236
|
unknown
|
France
|
||
76.16.49.134
|
unknown
|
United States
|
||
94.207.104.225
|
unknown
|
United Arab Emirates
|
||
201.244.108.183
|
unknown
|
Colombia
|
||
103.42.86.42
|
unknown
|
India
|
||
78.18.105.11
|
unknown
|
Ireland
|
||
80.6.50.34
|
unknown
|
United Kingdom
|
||
103.144.201.56
|
unknown
|
unknown
|
||
27.0.48.233
|
unknown
|
India
|
||
70.28.50.223
|
unknown
|
Canada
|
||
98.145.23.67
|
unknown
|
United States
|
||
47.149.134.231
|
unknown
|
United States
|
||
82.125.44.236
|
unknown
|
France
|
||
81.229.117.95
|
unknown
|
Sweden
|
||
89.129.109.27
|
unknown
|
Spain
|
||
122.186.210.254
|
unknown
|
India
|
||
79.77.142.22
|
unknown
|
United Kingdom
|
||
90.78.147.141
|
unknown
|
France
|
||
122.184.143.86
|
unknown
|
India
|
||
186.75.95.6
|
unknown
|
Panama
|
||
50.68.186.195
|
unknown
|
Canada
|
||
12.172.173.82
|
unknown
|
United States
|
||
213.64.33.61
|
unknown
|
Sweden
|
||
79.168.224.165
|
unknown
|
Portugal
|
||
86.97.55.89
|
unknown
|
United Arab Emirates
|
||
176.142.207.63
|
unknown
|
France
|
||
92.154.17.149
|
unknown
|
France
|
||
174.58.146.57
|
unknown
|
United States
|
||
78.160.146.127
|
unknown
|
Turkey
|
||
58.186.75.42
|
unknown
|
Viet Nam
|
||
223.166.13.95
|
unknown
|
China
|
||
65.95.141.84
|
unknown
|
Canada
|
||
50.68.204.71
|
unknown
|
Canada
|
||
71.38.155.217
|
unknown
|
United States
|
||
104.35.24.154
|
unknown
|
United States
|
||
220.240.164.182
|
unknown
|
Australia
|
||
103.123.223.133
|
unknown
|
India
|
||
24.198.114.130
|
unknown
|
United States
|
||
2.36.64.159
|
unknown
|
Italy
|
||
198.2.51.242
|
unknown
|
United States
|
||
92.9.45.20
|
unknown
|
United Kingdom
|
||
113.11.92.30
|
unknown
|
Bangladesh
|
||
69.119.123.159
|
unknown
|
United States
|
||
69.123.4.221
|
unknown
|
United States
|
||
172.115.17.50
|
unknown
|
United States
|
||
68.87.41.40
|
xfinity.com
|
United States
|
||
192.168.2.1
|
unknown
|
unknown
|
There are 90 hidden IPs, click here to show them.
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHivePermissionsCorrect
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHiveOwnerCorrect
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
001840064172BCE4
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProgramId
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
FileId
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LowerCaseLongPath
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LongPathHash
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Name
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Publisher
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Version
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinFileVersion
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinaryType
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductName
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductVersion
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LinkDate
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinProductVersion
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Size
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Language
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsPeFile
|
||
\REGISTRY\A\{d736e1ae-b7fc-e967-4116-d0056ebfda58}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsOsComponent
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceId
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
ApplicationFlags
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
001840064172BCE4
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
3c3af57a
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
9a52534
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
be40548
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
b358622d
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
ce502da7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
76ec4ac2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
b1194251
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
43739a8c
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
3c3af57a
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
3c3af57a
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
3c3af57a
|
||
HKEY_CURRENT_USER\Software\Microsoft\Ebyawxoonc
|
3c3af57a
|
There are 33 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
26A000
|
heap
|
page read and write
|
||
4320000
|
heap
|
page read and write
|
||
100AE000
|
unkown
|
page readonly
|
||
23A0000
|
heap
|
page read and write
|
||
42CF000
|
stack
|
page read and write
|
||
19A3A637000
|
heap
|
page read and write
|
||
5FE1000
|
heap
|
page read and write
|
||
2D0E000
|
stack
|
page read and write
|
||
101E0000
|
unkown
|
page write copy
|
||
101E3000
|
unkown
|
page write copy
|
||
19A3A902000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
652E000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
7060000
|
heap
|
page read and write
|
||
1DC000
|
stack
|
page read and write
|
||
70BF000
|
heap
|
page read and write
|
||
19A3A902000
|
heap
|
page read and write
|
||
2774000
|
heap
|
page read and write
|
||
3040000
|
heap
|
page read and write
|
||
7154000
|
heap
|
page read and write
|
||
19A3A638000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
7AE5000
|
heap
|
page read and write
|
||
75D1000
|
heap
|
page read and write
|
||
5550000
|
trusted library allocation
|
page read and write
|
||
2EE000
|
stack
|
page read and write
|
||
19A3A800000
|
heap
|
page read and write
|
||
291C000
|
stack
|
page read and write
|
||
2690000
|
heap
|
page read and write
|
||
41A0000
|
heap
|
page read and write
|
||
1704AF9000
|
stack
|
page read and write
|
||
2EE0000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
2ABE000
|
stack
|
page read and write
|
||
440000
|
heap
|
page read and write
|
||
5BE000
|
stack
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
301E000
|
stack
|
page read and write
|
||
65E0000
|
heap
|
page read and write
|
||
42E0000
|
trusted library allocation
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
701C000
|
heap
|
page read and write
|
||
7154000
|
heap
|
page read and write
|
||
5FE1000
|
heap
|
page read and write
|
||
702C000
|
heap
|
page read and write
|
||
34A0000
|
trusted library allocation
|
page read and write
|
||
3000000
|
heap
|
page readonly
|
||
19A3A702000
|
trusted library allocation
|
page read and write
|
||
5560000
|
trusted library allocation
|
page read and write
|
||
101DA000
|
unkown
|
page readonly
|
||
101DA000
|
unkown
|
page readonly
|
||
275E000
|
stack
|
page read and write
|
||
19A3AA02000
|
heap
|
page read and write
|
||
441E000
|
stack
|
page read and write
|
||
19A3A440000
|
heap
|
page read and write
|
||
29C0000
|
heap
|
page read and write
|
||
100AE000
|
unkown
|
page readonly
|
||
7060000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
260000
|
heap
|
page read and write
|
||
2780000
|
heap
|
page read and write
|
||
50A0000
|
heap
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
7060000
|
heap
|
page read and write
|
||
2710000
|
heap
|
page read and write
|
||
1C0000
|
heap
|
page read and write
|
||
267B000
|
stack
|
page read and write
|
||
19A3A675000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
2774000
|
heap
|
page read and write
|
||
702C000
|
heap
|
page read and write
|
||
7130000
|
heap
|
page read and write
|
||
6A38000
|
heap
|
page read and write
|
||
6AFF000
|
heap
|
page read and write
|
||
70CD000
|
heap
|
page read and write
|
||
2B50000
|
heap
|
page read and write
|
||
3400000
|
heap
|
page read and write
|
||
281A000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
2FAE000
|
stack
|
page read and write
|
||
5FE1000
|
heap
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
295B000
|
stack
|
page read and write
|
||
17047F9000
|
stack
|
page read and write
|
||
19A3A630000
|
heap
|
page read and write
|
||
709D000
|
heap
|
page read and write
|
||
34A0000
|
trusted library allocation
|
page read and write
|
||
7AD7000
|
heap
|
page read and write
|
||
19A3A686000
|
heap
|
page read and write
|
||
2774000
|
heap
|
page read and write
|
||
7028000
|
heap
|
page read and write
|
||
61C4000
|
heap
|
page read and write
|
||
28A0000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
19A3A813000
|
heap
|
page read and write
|
||
ACF000
|
stack
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
4300000
|
heap
|
page read and write
|
||
7130000
|
heap
|
page read and write
|
||
23BE000
|
stack
|
page read and write
|
||
80F000
|
stack
|
page read and write
|
||
2780000
|
heap
|
page read and write
|
||
2D5F000
|
stack
|
page read and write
|
||
2AC0000
|
heap
|
page readonly
|
||
9C0000
|
heap
|
page read and write
|
||
19A3A3E0000
|
trusted library allocation
|
page read and write
|
||
50F9000
|
heap
|
page read and write
|
||
2D0000
|
heap
|
page read and write
|
||
34A0000
|
trusted library allocation
|
page read and write
|
||
320000
|
heap
|
page read and write
|
||
2F30000
|
heap
|
page read and write
|
||
100AE000
|
unkown
|
page readonly
|
||
100AE000
|
unkown
|
page readonly
|
||
19A3A802000
|
heap
|
page read and write
|
||
70CD000
|
heap
|
page read and write
|
||
19A3A6B3000
|
heap
|
page read and write
|
||
70BF000
|
heap
|
page read and write
|
||
70CD000
|
heap
|
page read and write
|
||
2DEA000
|
heap
|
page read and write
|
||
2B40000
|
heap
|
page read and write
|
||
100AE000
|
unkown
|
page readonly
|
||
50EF000
|
heap
|
page read and write
|
||
101E3000
|
unkown
|
page write copy
|
||
7060000
|
heap
|
page read and write
|
||
1FB000
|
stack
|
page read and write
|
||
5FE1000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
1BC000
|
stack
|
page read and write
|
||
82D5000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
6525000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
260000
|
heap
|
page read and write
|
||
6966000
|
heap
|
page read and write
|
||
62C000
|
heap
|
page read and write
|
||
5560000
|
trusted library allocation
|
page read and write
|
||
70CB000
|
heap
|
page read and write
|
||
35E000
|
stack
|
page read and write
|
||
2610000
|
heap
|
page read and write
|
||
2BF0000
|
heap
|
page read and write
|
||
50FB000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
48E000
|
stack
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
70CD000
|
heap
|
page read and write
|
||
618C000
|
heap
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
22C000
|
stack
|
page read and write
|
||
439F000
|
heap
|
page read and write
|
||
19A3A904000
|
heap
|
page read and write
|
||
2774000
|
heap
|
page read and write
|
||
2BC0000
|
heap
|
page read and write
|
||
2AB0000
|
heap
|
page read and write
|
||
19A3A913000
|
heap
|
page read and write
|
||
7028000
|
heap
|
page read and write
|
||
23D0000
|
heap
|
page read and write
|
||
30B0000
|
heap
|
page read and write
|
||
28B0000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
702C000
|
heap
|
page read and write
|
||
41CA000
|
direct allocation
|
page readonly
|
||
41B1000
|
direct allocation
|
page execute read
|
||
19A3A628000
|
heap
|
page read and write
|
||
70BF000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
23FE000
|
stack
|
page read and write
|
||
19A3A902000
|
heap
|
page read and write
|
||
2DE0000
|
heap
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
701C000
|
heap
|
page read and write
|
||
2EEA000
|
heap
|
page read and write
|
||
61B000
|
heap
|
page read and write
|
||
2850000
|
heap
|
page read and write
|
||
709D000
|
heap
|
page read and write
|
||
101E0000
|
unkown
|
page write copy
|
||
10000000
|
unkown
|
page readonly
|
||
5560000
|
trusted library allocation
|
page read and write
|
||
4343000
|
heap
|
page read and write
|
||
50EF000
|
heap
|
page read and write
|
||
100AD000
|
unkown
|
page read and write
|
||
101DA000
|
unkown
|
page readonly
|
||
5560000
|
trusted library allocation
|
page read and write
|
||
2B5B000
|
stack
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
709D000
|
heap
|
page read and write
|
||
3070000
|
heap
|
page readonly
|
||
2D70000
|
heap
|
page readonly
|
||
101E3000
|
unkown
|
page write copy
|
||
70CD000
|
heap
|
page read and write
|
||
7130000
|
heap
|
page read and write
|
||
70BF000
|
heap
|
page read and write
|
||
263C000
|
stack
|
page read and write
|
||
23BF000
|
stack
|
page read and write
|
||
7FE7000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
19A3AA00000
|
heap
|
page read and write
|
||
B50000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
19A3A675000
|
heap
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
282E000
|
stack
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
19A3A913000
|
heap
|
page read and write
|
||
19A3A675000
|
heap
|
page read and write
|
||
70CD000
|
heap
|
page read and write
|
||
75D3000
|
heap
|
page read and write
|
||
70CB000
|
heap
|
page read and write
|
||
709D000
|
heap
|
page read and write
|
||
2540000
|
heap
|
page read and write
|
||
42E0000
|
heap
|
page read and write
|
||
19A3A900000
|
heap
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
70CB000
|
heap
|
page read and write
|
||
7028000
|
heap
|
page read and write
|
||
2760000
|
heap
|
page read and write
|
||
709C000
|
heap
|
page read and write
|
||
100AD000
|
unkown
|
page read and write
|
||
70BF000
|
heap
|
page read and write
|
||
19A3A3D0000
|
heap
|
page read and write
|
||
23D0000
|
heap
|
page readonly
|
||
7060000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
701C000
|
heap
|
page read and write
|
||
70BF000
|
heap
|
page read and write
|
||
2720000
|
heap
|
page readonly
|
||
2774000
|
heap
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
80000
|
heap
|
page read and write
|
||
70CB000
|
heap
|
page read and write
|
||
34A0000
|
trusted library allocation
|
page read and write
|
||
17043DD000
|
stack
|
page read and write
|
||
101DA000
|
unkown
|
page readonly
|
||
19A3A6B3000
|
heap
|
page read and write
|
||
3010000
|
heap
|
page read and write
|
||
101DA000
|
unkown
|
page readonly
|
||
7060000
|
heap
|
page read and write
|
||
286F000
|
stack
|
page read and write
|
||
7154000
|
heap
|
page read and write
|
||
41CF000
|
direct allocation
|
page read and write
|
||
7AE9000
|
heap
|
page read and write
|
||
2630000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
10000000
|
unkown
|
page readonly
|
||
2DC000
|
stack
|
page read and write
|
||
7DD5000
|
heap
|
page read and write
|
||
40A4000
|
heap
|
page read and write
|
||
5FE1000
|
heap
|
page read and write
|
||
701C000
|
heap
|
page read and write
|
||
28B0000
|
heap
|
page read and write
|
||
280F000
|
stack
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
31B000
|
stack
|
page read and write
|
||
288A000
|
heap
|
page read and write
|
||
101E0000
|
unkown
|
page write copy
|
||
305F000
|
stack
|
page read and write
|
||
19A3A715000
|
trusted library allocation
|
page read and write
|
||
100AD000
|
unkown
|
page read and write
|
||
2760000
|
heap
|
page read and write
|
||
2780000
|
direct allocation
|
page execute read
|
||
DC000
|
stack
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
270F000
|
stack
|
page read and write
|
||
7028000
|
heap
|
page read and write
|
||
2830000
|
heap
|
page read and write
|
||
2774000
|
heap
|
page read and write
|
||
2BFB000
|
stack
|
page read and write
|
||
19A3A631000
|
heap
|
page read and write
|
||
66AC000
|
heap
|
page read and write
|
||
340000
|
heap
|
page readonly
|
||
7060000
|
heap
|
page read and write
|
||
7154000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
709D000
|
heap
|
page read and write
|
||
41B0000
|
direct allocation
|
page read and write
|
||
25AC000
|
stack
|
page read and write
|
||
70000
|
heap
|
page read and write
|
||
101E3000
|
unkown
|
page write copy
|
||
2810000
|
heap
|
page read and write
|
||
319A000
|
heap
|
page read and write
|
||
210000
|
heap
|
page read and write
|
||
100AD000
|
unkown
|
page read and write
|
||
19A3A610000
|
unkown
|
page read and write
|
||
41E0000
|
heap
|
page read and write
|
||
5560000
|
trusted library allocation
|
page read and write
|
||
490000
|
heap
|
page read and write
|
||
445F000
|
stack
|
page read and write
|
||
270000
|
heap
|
page read and write
|
||
26E0000
|
heap
|
page readonly
|
||
2810000
|
heap
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
2F20000
|
heap
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
101DA000
|
unkown
|
page readonly
|
||
41E1000
|
heap
|
page read and write
|
||
2B1C000
|
stack
|
page read and write
|
||
27B0000
|
heap
|
page read and write
|
||
2FEF000
|
stack
|
page read and write
|
||
709D000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
2880000
|
heap
|
page read and write
|
||
26B000
|
stack
|
page read and write
|
||
28BA000
|
heap
|
page read and write
|
||
2774000
|
heap
|
page read and write
|
||
19A3A700000
|
trusted library allocation
|
page read and write
|
||
5FE1000
|
heap
|
page read and write
|
||
50F9000
|
heap
|
page read and write
|
||
5071000
|
heap
|
page read and write
|
||
610000
|
heap
|
page read and write
|
||
702C000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
3150000
|
heap
|
page read and write
|
||
70CB000
|
heap
|
page read and write
|
||
50FB000
|
heap
|
page read and write
|
||
2680000
|
heap
|
page read and write
|
||
100AD000
|
unkown
|
page read and write
|
||
2990000
|
heap
|
page read and write
|
||
263A000
|
heap
|
page read and write
|
||
70CD000
|
heap
|
page read and write
|
||
34A0000
|
trusted library allocation
|
page read and write
|
||
26E0000
|
heap
|
page read and write
|
||
28A0000
|
heap
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
23FF000
|
stack
|
page read and write
|
||
2BBC000
|
stack
|
page read and write
|
||
7DD0000
|
heap
|
page read and write
|
||
270000
|
heap
|
page read and write
|
||
2D10000
|
heap
|
page read and write
|
||
269A000
|
heap
|
page read and write
|
||
50FB000
|
heap
|
page read and write
|
||
101E3000
|
unkown
|
page write copy
|
||
19A3A62F000
|
heap
|
page read and write
|
||
23F0000
|
heap
|
page readonly
|
||
101E0000
|
unkown
|
page write copy
|
||
6A24000
|
heap
|
page read and write
|
||
7130000
|
heap
|
page read and write
|
||
50FB000
|
heap
|
page read and write
|
||
75D4000
|
heap
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
4AD0000
|
heap
|
page read and write
|
||
70CB000
|
heap
|
page read and write
|
||
19A3A723000
|
heap
|
page read and write
|
||
2774000
|
heap
|
page read and write
|
||
7519000
|
heap
|
page read and write
|
||
50BC000
|
heap
|
page read and write
|
||
32F000
|
stack
|
page read and write
|
||
2770000
|
heap
|
page read and write
|
||
12B000
|
stack
|
page read and write
|
||
2380000
|
heap
|
page read and write
|
||
50C8000
|
heap
|
page read and write
|
||
19A3A613000
|
unkown
|
page read and write
|
||
7060000
|
heap
|
page read and write
|
||
19A3A600000
|
unkown
|
page read and write
|
||
50F5000
|
heap
|
page read and write
|
||
19A3A917000
|
heap
|
page read and write
|
||
261A000
|
heap
|
page read and write
|
||
439F000
|
heap
|
page read and write
|
||
50FB000
|
heap
|
page read and write
|
||
5560000
|
trusted library allocation
|
page read and write
|
||
EB000
|
stack
|
page read and write
|
||
41D2000
|
direct allocation
|
page readonly
|
||
27CE000
|
stack
|
page read and write
|
||
5560000
|
trusted library allocation
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
101E0000
|
unkown
|
page write copy
|
||
50FB000
|
heap
|
page read and write
|
||
5510000
|
trusted library allocation
|
page read and write
|
||
101E0000
|
unkown
|
page write copy
|
||
101E3000
|
unkown
|
page write copy
|
||
41E1000
|
heap
|
page read and write
|
||
70BF000
|
heap
|
page read and write
|
||
2770000
|
heap
|
page readonly
|
||
7060000
|
heap
|
page read and write
|
||
5094000
|
heap
|
page read and write
|
||
632000
|
heap
|
page read and write
|
||
5560000
|
trusted library allocation
|
page read and write
|
||
626000
|
heap
|
page read and write
|
||
5FE1000
|
heap
|
page read and write
|
||
709D000
|
heap
|
page read and write
|
||
310000
|
heap
|
page read and write
|
||
2AE0000
|
heap
|
page read and write
|
||
5FE1000
|
heap
|
page read and write
|
||
5FE1000
|
heap
|
page read and write
|
||
70CB000
|
heap
|
page read and write
|
||
6A3D000
|
heap
|
page read and write
|
||
2B60000
|
heap
|
page read and write
|
||
3190000
|
heap
|
page read and write
|
||
150000
|
heap
|
page read and write
|
||
27CE000
|
stack
|
page read and write
|
||
19A3A675000
|
heap
|
page read and write
|
||
100AE000
|
unkown
|
page readonly
|
||
2BB000
|
stack
|
page read and write
|
||
25EB000
|
stack
|
page read and write
|
||
50A1000
|
heap
|
page read and write
|
||
50CC000
|
heap
|
page read and write
|
||
27C000
|
stack
|
page read and write
|
||
2390000
|
heap
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
100AD000
|
unkown
|
page read and write
|
There are 395 hidden memdumps, click here to show them.