Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
A649.dll
|
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
|
initial sample
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8f19ee7b9cb685ec4f932734c39820e11122c2_82810a17_0fc75884\Report.wer
|
Unknown
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8f19ee7b9cb685ec4f932734c39820e11122c2_82810a17_160b5807\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8f19ee7b9cb685ec4f932734c39820e11122c2_82810a17_1c57599d\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_f0f3252944ac8494bc49a1f9f213cb75e7a9fcf9_82810a17_174f57b9\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A40.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:10 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2ACD.tmp.dmp
|
Unknown
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C74.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C93.tmp.WERInternalMetadata.xml
|
Unknown
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CD2.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CF2.tmp.xml
|
Unknown
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F7E.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:15 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER40E6.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4145.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D78.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:19 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F6D.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER500A.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\V262JUIP.htm
|
HTML document, ASCII text, with very long lines (15300)
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\t5[1]
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve
|
Unknown
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
|
Unknown
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve.tmp
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
There are 13 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Windows\System32\loaddll32.exe
|
loaddll32.exe "C:\Users\user\Desktop\A649.dll"
|
||
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\A649.dll",#1
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\A649.dll,mv_add_i
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",#1
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 656
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 664
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\A649.dll,mv_add_q
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\A649.dll,mv_add_stable
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 652
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",mv_add_i
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",mv_add_q
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",mv_add_stable
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",next
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",mvutil_license
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",mvutil_configuration
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 652
|
||
C:\Windows\SysWOW64\wermgr.exe
|
C:\Windows\SysWOW64\wermgr.exe
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
There are 8 hidden processes, click here to show them.
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://188.28.19.84/t5
|
188.28.19.84
|
||
http://upx.sf.net
|
unknown
|
||
https://www.broadcom.cn
|
unknown
|
||
https://www.broadcom.com/media/blt4ac44e0e6c6d8341/blt476a993c2707b028/62e16f3bd3b8a5700456394e/wwwB
|
unknown
|
||
https://streams.videolan.org/upload/
|
unknown
|
||
https://broadcom.com/
|
54.68.22.26
|
||
https://www.broadcom.com
|
unknown
|
||
https://static.broadcom.com
|
unknown
|
||
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
|
unknown
|
||
https://jp.broadcom.com
|
unknown
|
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
broadcom.com
|
54.68.22.26
|
||
www.broadcom.com
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
2.82.8.80
|
unknown
|
Portugal
|
||
70.160.67.203
|
unknown
|
United States
|
||
75.143.236.149
|
unknown
|
United States
|
||
83.110.223.61
|
unknown
|
United Arab Emirates
|
||
86.195.14.72
|
unknown
|
France
|
||
84.215.202.8
|
unknown
|
Norway
|
||
184.182.66.109
|
unknown
|
United States
|
||
92.186.69.229
|
unknown
|
France
|
||
174.4.89.3
|
unknown
|
Canada
|
||
161.142.103.187
|
unknown
|
Malaysia
|
||
114.143.176.236
|
unknown
|
India
|
||
14.192.241.76
|
unknown
|
Malaysia
|
||
173.88.135.179
|
unknown
|
United States
|
||
84.108.200.161
|
unknown
|
Israel
|
||
47.34.30.133
|
unknown
|
United States
|
||
183.87.163.165
|
unknown
|
India
|
||
184.181.75.148
|
unknown
|
United States
|
||
124.149.143.189
|
unknown
|
Australia
|
||
84.35.26.14
|
unknown
|
Netherlands
|
||
73.29.92.128
|
unknown
|
United States
|
||
68.203.69.96
|
unknown
|
United States
|
||
82.131.141.209
|
unknown
|
Hungary
|
||
64.121.161.102
|
unknown
|
United States
|
||
178.175.187.254
|
unknown
|
Moldova Republic of
|
||
96.56.197.26
|
unknown
|
United States
|
||
188.28.19.84
|
unknown
|
United Kingdom
|
||
186.64.67.30
|
unknown
|
Argentina
|
||
125.99.76.102
|
unknown
|
India
|
||
81.101.185.146
|
unknown
|
United Kingdom
|
||
59.28.84.65
|
unknown
|
Korea Republic of
|
||
105.186.128.181
|
unknown
|
South Africa
|
||
76.86.31.59
|
unknown
|
United States
|
||
147.147.30.126
|
unknown
|
United Kingdom
|
||
96.87.28.170
|
unknown
|
United States
|
||
75.109.111.89
|
unknown
|
United States
|
||
78.92.133.215
|
unknown
|
Hungary
|
||
124.122.47.148
|
unknown
|
Thailand
|
||
88.126.94.4
|
unknown
|
France
|
||
51.14.29.227
|
unknown
|
United Kingdom
|
||
85.57.212.13
|
unknown
|
Spain
|
||
47.205.25.170
|
unknown
|
United States
|
||
95.45.50.93
|
unknown
|
Ireland
|
||
80.12.88.148
|
unknown
|
France
|
||
69.133.162.35
|
unknown
|
United States
|
||
86.132.236.117
|
unknown
|
United Kingdom
|
||
151.62.238.176
|
unknown
|
Italy
|
||
70.112.206.5
|
unknown
|
United States
|
||
102.159.188.125
|
unknown
|
Tunisia
|
||
205.237.67.69
|
unknown
|
Canada
|
||
151.65.167.77
|
unknown
|
Italy
|
||
76.178.148.107
|
unknown
|
United States
|
||
89.36.206.69
|
unknown
|
Italy
|
||
69.242.31.249
|
unknown
|
United States
|
||
193.253.100.236
|
unknown
|
France
|
||
76.16.49.134
|
unknown
|
United States
|
||
94.207.104.225
|
unknown
|
United Arab Emirates
|
||
201.244.108.183
|
unknown
|
Colombia
|
||
103.42.86.42
|
unknown
|
India
|
||
78.18.105.11
|
unknown
|
Ireland
|
||
80.6.50.34
|
unknown
|
United Kingdom
|
||
103.144.201.56
|
unknown
|
unknown
|
||
27.0.48.233
|
unknown
|
India
|
||
70.28.50.223
|
unknown
|
Canada
|
||
98.145.23.67
|
unknown
|
United States
|
||
47.149.134.231
|
unknown
|
United States
|
||
82.125.44.236
|
unknown
|
France
|
||
81.229.117.95
|
unknown
|
Sweden
|
||
89.129.109.27
|
unknown
|
Spain
|
||
122.186.210.254
|
unknown
|
India
|
||
79.77.142.22
|
unknown
|
United Kingdom
|
||
90.78.147.141
|
unknown
|
France
|
||
122.184.143.86
|
unknown
|
India
|
||
186.75.95.6
|
unknown
|
Panama
|
||
50.68.186.195
|
unknown
|
Canada
|
||
12.172.173.82
|
unknown
|
United States
|
||
213.64.33.61
|
unknown
|
Sweden
|
||
79.168.224.165
|
unknown
|
Portugal
|
||
86.97.55.89
|
unknown
|
United Arab Emirates
|
||
176.142.207.63
|
unknown
|
France
|
||
92.154.17.149
|
unknown
|
France
|
||
174.58.146.57
|
unknown
|
United States
|
||
78.160.146.127
|
unknown
|
Turkey
|
||
58.186.75.42
|
unknown
|
Viet Nam
|
||
223.166.13.95
|
unknown
|
China
|
||
65.95.141.84
|
unknown
|
Canada
|
||
50.68.204.71
|
unknown
|
Canada
|
||
71.38.155.217
|
unknown
|
United States
|
||
104.35.24.154
|
unknown
|
United States
|
||
220.240.164.182
|
unknown
|
Australia
|
||
103.123.223.133
|
unknown
|
India
|
||
24.198.114.130
|
unknown
|
United States
|
||
2.36.64.159
|
unknown
|
Italy
|
||
198.2.51.242
|
unknown
|
United States
|
||
92.9.45.20
|
unknown
|
United Kingdom
|
||
113.11.92.30
|
unknown
|
Bangladesh
|
||
69.119.123.159
|
unknown
|
United States
|
||
69.123.4.221
|
unknown
|
United States
|
||
172.115.17.50
|
unknown
|
United States
|
||
54.68.22.26
|
broadcom.com
|
United States
|
||
192.168.2.1
|
unknown
|
unknown
|
There are 90 hidden IPs, click here to show them.
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C98DE29A7
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHivePermissionsCorrect
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHiveOwnerCorrect
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiOverridePath
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile
|
WritePermissionsCheck
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile
|
ProviderSyncId
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProgramId
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
FileId
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LowerCaseLongPath
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LongPathHash
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Name
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Publisher
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Version
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinFileVersion
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinaryType
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductName
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductVersion
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LinkDate
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinProductVersion
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Size
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Language
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsPeFile
|
||
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsOsComponent
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
||
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
|
PendingFileRenameOperations
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C98DE29A7
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C98DE29A7
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceId
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
ApplicationFlags
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C98DE29A7
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
c13aa5c
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
398c7a12
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
3bcd5a6e
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
83713d0b
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
fe797281
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
46c515e4
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
81301d77
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
735ac5aa
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
c13aa5c
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
c13aa5c
|
||
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
c13aa5c
|
There are 40 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
75A000
|
heap
|
page read and write
|
||
E20000
|
heap
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
EC1000
|
heap
|
page read and write
|
||
24F5B846000
|
heap
|
page read and write
|
||
742000
|
direct allocation
|
page readonly
|
||
100AE000
|
unkown
|
page readonly
|
||
5A4000
|
heap
|
page read and write
|
||
6EE0000
|
heap
|
page read and write
|
||
101E0000
|
unkown
|
page write copy
|
||
75A000
|
heap
|
page read and write
|
||
5EF000
|
stack
|
page read and write
|
||
14C3D224000
|
unkown
|
page read and write
|
||
240000
|
heap
|
page read and write
|
||
24F5C375000
|
heap
|
page read and write
|
||
101E3000
|
unkown
|
page write copy
|
||
7FC2000
|
heap
|
page read and write
|
||
1920000
|
heap
|
page read and write
|
||
103A000
|
heap
|
page read and write
|
||
603D000
|
heap
|
page read and write
|
||
14C3D300000
|
trusted library allocation
|
page read and write
|
||
6DA000
|
heap
|
page read and write
|
||
1555000
|
heap
|
page read and write
|
||
5A4000
|
heap
|
page read and write
|
||
120A000
|
heap
|
page read and write
|
||
72CE000
|
heap
|
page read and write
|
||
13F0000
|
heap
|
page read and write
|
||
5F9C000
|
heap
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
5F8C000
|
heap
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
10001000
|
unkown
|
page execute read
|
||
9A0000
|
heap
|
page read and write
|
||
E9F000
|
heap
|
page read and write
|
||
AA0000
|
heap
|
page read and write
|
||
CA0000
|
heap
|
page read and write
|
||
648F000
|
heap
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
24F5B760000
|
heap
|
page read and write
|
||
24F5C202000
|
heap
|
page read and write
|
||
100AE000
|
unkown
|
page readonly
|
||
603B000
|
heap
|
page read and write
|
||
7CD9000
|
heap
|
page read and write
|
||
6EE0000
|
heap
|
page read and write
|
||
E40000
|
heap
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
600D000
|
heap
|
page read and write
|
||
122F000
|
stack
|
page read and write
|
||
1200000
|
heap
|
page read and write
|
||
602F000
|
heap
|
page read and write
|
||
129F000
|
stack
|
page read and write
|
||
5DC1000
|
heap
|
page read and write
|
||
48C0000
|
heap
|
page read and write
|
||
D40000
|
heap
|
page read and write
|
||
5F98000
|
heap
|
page read and write
|
||
E2E000
|
stack
|
page read and write
|
||
720000
|
direct allocation
|
page read and write
|
||
10AB000
|
stack
|
page read and write
|
||
360000
|
heap
|
page read and write
|
||
95F000
|
stack
|
page read and write
|
||
603D000
|
heap
|
page read and write
|
||
6EE0000
|
heap
|
page read and write
|
||
602F000
|
heap
|
page read and write
|
||
4980000
|
heap
|
page read and write
|
||
34C0000
|
heap
|
page read and write
|
||
101DA000
|
unkown
|
page readonly
|
||
24F5C382000
|
heap
|
page read and write
|
||
FF0000
|
heap
|
page read and write
|
||
3E0000
|
heap
|
page readonly
|
||
24F5B800000
|
heap
|
page read and write
|
||
24F5C327000
|
heap
|
page read and write
|
||
5A4000
|
heap
|
page read and write
|
||
5F98000
|
heap
|
page read and write
|
||
BE9000
|
heap
|
page read and write
|
||
5F0000
|
heap
|
page readonly
|
||
12B0000
|
heap
|
page readonly
|
||
600D000
|
heap
|
page read and write
|
||
7AC3000
|
heap
|
page read and write
|
||
600C000
|
heap
|
page read and write
|
||
DB0000
|
heap
|
page read and write
|
||
EE0000
|
heap
|
page read and write
|
||
136F000
|
stack
|
page read and write
|
||
6F0000
|
heap
|
page read and write
|
||
14C3D500000
|
heap
|
page read and write
|
||
659B000
|
heap
|
page read and write
|
||
143E000
|
stack
|
page read and write
|
||
350000
|
heap
|
page read and write
|
||
24F5C382000
|
heap
|
page read and write
|
||
1030000
|
heap
|
page read and write
|
||
603D000
|
heap
|
page read and write
|
||
14C3D513000
|
heap
|
page read and write
|
||
14C3D010000
|
trusted library allocation
|
page read and write
|
||
750000
|
heap
|
page read and write
|
||
603B000
|
heap
|
page read and write
|
||
C3C000
|
stack
|
page read and write
|
||
24F5C372000
|
heap
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
24F5C344000
|
heap
|
page read and write
|
||
24F5D120000
|
heap
|
page read and write
|
||
101E3000
|
unkown
|
page write copy
|
||
101FE000
|
unkown
|
page readonly
|
||
12C0000
|
heap
|
page read and write
|
||
32EF000
|
heap
|
page read and write
|
||
1DB000
|
stack
|
page read and write
|
||
A20000
|
heap
|
page read and write
|
||
63B000
|
stack
|
page read and write
|
||
119E000
|
stack
|
page read and write
|
||
100AD000
|
unkown
|
page read and write
|
||
172F000
|
stack
|
page read and write
|
||
5F8C000
|
heap
|
page read and write
|
||
58E000
|
stack
|
page read and write
|
||
61723FC000
|
stack
|
page read and write
|
||
77C4000
|
heap
|
page read and write
|
||
540000
|
heap
|
page read and write
|
||
24F5B829000
|
heap
|
page read and write
|
||
E43000
|
heap
|
page read and write
|
||
6EE0000
|
heap
|
page read and write
|
||
15C000
|
stack
|
page read and write
|
||
520000
|
heap
|
page readonly
|
||
6171DCB000
|
stack
|
page read and write
|
||
5F8C000
|
heap
|
page read and write
|
||
24F5B813000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
24F5C200000
|
heap
|
page read and write
|
||
4D0000
|
heap
|
page read and write
|
||
602F000
|
heap
|
page read and write
|
||
603D000
|
heap
|
page read and write
|
||
5A0000
|
heap
|
page read and write
|
||
32C8000
|
heap
|
page read and write
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
14C3D200000
|
unkown
|
page read and write
|
||
DA0000
|
trusted library allocation
|
page read and write
|
||
6EE0000
|
heap
|
page read and write
|
||
101E3000
|
unkown
|
page write copy
|
||
6F0000
|
direct allocation
|
page execute read
|
||
14C3D2B8000
|
heap
|
page read and write
|
||
14C3D23C000
|
heap
|
page read and write
|
||
5A4000
|
heap
|
page read and write
|
||
6C0000
|
heap
|
page readonly
|
||
19C000
|
stack
|
page read and write
|
||
19B000
|
stack
|
page read and write
|
||
5F0000
|
heap
|
page read and write
|
||
14C3D070000
|
heap
|
page read and write
|
||
24F5B7F0000
|
trusted library allocation
|
page read and write
|
||
58E000
|
stack
|
page read and write
|
||
612C000
|
heap
|
page read and write
|
||
7FC8000
|
heap
|
page read and write
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
5F98000
|
heap
|
page read and write
|
||
603D000
|
heap
|
page read and write
|
||
F00000
|
heap
|
page read and write
|
||
32BC000
|
heap
|
page read and write
|
||
C20000
|
heap
|
page read and write
|
||
600D000
|
heap
|
page read and write
|
||
6F04000
|
heap
|
page read and write
|
||
6F04000
|
heap
|
page read and write
|
||
5CF000
|
stack
|
page read and write
|
||
B10000
|
heap
|
page read and write
|
||
1546000
|
heap
|
page read and write
|
||
9D0000
|
heap
|
page read and write
|
||
69AF000
|
heap
|
page read and write
|
||
1320000
|
remote allocation
|
page read and write
|
||
600D000
|
heap
|
page read and write
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
603B000
|
heap
|
page read and write
|
||
101DA000
|
unkown
|
page readonly
|
||
303F000
|
stack
|
page read and write
|
||
24F5C33C000
|
heap
|
page read and write
|
||
100AD000
|
unkown
|
page read and write
|
||
A3B000
|
stack
|
page read and write
|
||
D10000
|
heap
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
5F98000
|
heap
|
page read and write
|
||
21CDAFE000
|
stack
|
page read and write
|
||
D5E000
|
stack
|
page read and write
|
||
FBC000
|
stack
|
page read and write
|
||
2AC000
|
stack
|
page read and write
|
||
5F98000
|
heap
|
page read and write
|
||
710000
|
heap
|
page read and write
|
||
D9F000
|
stack
|
page read and write
|
||
24F5C38A000
|
heap
|
page read and write
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
A90000
|
heap
|
page read and write
|
||
11EE000
|
stack
|
page read and write
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
24F5C389000
|
heap
|
page read and write
|
||
101DA000
|
unkown
|
page readonly
|
||
77C3000
|
heap
|
page read and write
|
||
840000
|
heap
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
710000
|
heap
|
page read and write
|
||
603D000
|
heap
|
page read and write
|
||
136E000
|
stack
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
101E0000
|
unkown
|
page write copy
|
||
7FC000
|
stack
|
page read and write
|
||
24F5B902000
|
heap
|
page read and write
|
||
7FC5000
|
heap
|
page read and write
|
||
DEB000
|
stack
|
page read and write
|
||
357A000
|
heap
|
page read and write
|
||
603B000
|
heap
|
page read and write
|
||
5F8C000
|
heap
|
page read and write
|
||
5F9C000
|
heap
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
11F0000
|
heap
|
page readonly
|
||
101DA000
|
unkown
|
page readonly
|
||
14C3D20F000
|
unkown
|
page read and write
|
||
24F5C376000
|
heap
|
page read and write
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
602F000
|
heap
|
page read and write
|
||
14C3D315000
|
trusted library allocation
|
page read and write
|
||
5F98000
|
heap
|
page read and write
|
||
602F000
|
heap
|
page read and write
|
||
24F5C39F000
|
heap
|
page read and write
|
||
24F5C35A000
|
heap
|
page read and write
|
||
4E00000
|
heap
|
page read and write
|
||
21CD7F9000
|
stack
|
page read and write
|
||
6164000
|
heap
|
page read and write
|
||
24F5C35B000
|
heap
|
page read and write
|
||
24F5C36E000
|
heap
|
page read and write
|
||
101E0000
|
unkown
|
page write copy
|
||
34B0000
|
heap
|
page readonly
|
||
24F5C37C000
|
heap
|
page read and write
|
||
24F5B7C0000
|
heap
|
page read and write
|
||
24F5C37E000
|
heap
|
page read and write
|
||
100AE000
|
unkown
|
page readonly
|
||
10000000
|
unkown
|
page readonly
|
||
100AD000
|
unkown
|
page read and write
|
||
24F5C379000
|
heap
|
page read and write
|
||
11E0000
|
heap
|
page read and write
|
||
14C3D27A000
|
heap
|
page read and write
|
||
6F04000
|
heap
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
24F5C372000
|
heap
|
page read and write
|
||
510000
|
heap
|
page read and write
|
||
80E000
|
stack
|
page read and write
|
||
5F98000
|
heap
|
page read and write
|
||
602F000
|
heap
|
page read and write
|
||
1340000
|
heap
|
page read and write
|
||
1530000
|
heap
|
page read and write
|
||
32A1000
|
heap
|
page read and write
|
||
378F000
|
stack
|
page read and write
|
||
602F000
|
heap
|
page read and write
|
||
5F9C000
|
heap
|
page read and write
|
||
14C3D502000
|
heap
|
page read and write
|
||
F0000
|
heap
|
page read and write
|
||
5DC1000
|
heap
|
page read and write
|
||
72CB000
|
heap
|
page read and write
|
||
21CD3DD000
|
stack
|
page read and write
|
||
5F9C000
|
heap
|
page read and write
|
||
3500000
|
heap
|
page read and write
|
||
24F5C312000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
100AE000
|
unkown
|
page readonly
|
||
CAA000
|
heap
|
page read and write
|
||
6F04000
|
heap
|
page read and write
|
||
C2E000
|
stack
|
page read and write
|
||
11DF000
|
stack
|
page read and write
|
||
E20000
|
heap
|
page read and write
|
||
24F5C39A000
|
heap
|
page read and write
|
||
603B000
|
heap
|
page read and write
|
||
6F04000
|
heap
|
page read and write
|
||
A70000
|
heap
|
page readonly
|
||
1360000
|
heap
|
page read and write
|
||
14C3D402000
|
heap
|
page read and write
|
||
670000
|
heap
|
page read and write
|
||
2EB000
|
stack
|
page read and write
|
||
14C3D302000
|
trusted library allocation
|
page read and write
|
||
348E000
|
stack
|
page read and write
|
||
14C3D513000
|
heap
|
page read and write
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
14C3D23C000
|
heap
|
page read and write
|
||
24F5C39F000
|
heap
|
page read and write
|
||
1558000
|
heap
|
page read and write
|
||
1240000
|
heap
|
page read and write
|
||
61722FA000
|
stack
|
page read and write
|
||
14C3D000000
|
heap
|
page read and write
|
||
72C8000
|
heap
|
page read and write
|
||
5FA000
|
heap
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
100AD000
|
unkown
|
page read and write
|
||
1000000
|
heap
|
page read and write
|
||
600D000
|
heap
|
page read and write
|
||
24F5C302000
|
heap
|
page read and write
|
||
7FC6000
|
heap
|
page read and write
|
||
106C000
|
stack
|
page read and write
|
||
7FC8000
|
heap
|
page read and write
|
||
24F5B879000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
603B000
|
heap
|
page read and write
|
||
125E000
|
stack
|
page read and write
|
||
100AD000
|
unkown
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
3CC000
|
stack
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
BAE000
|
stack
|
page read and write
|
||
3510000
|
heap
|
page read and write
|
||
6F04000
|
heap
|
page read and write
|
||
10E0000
|
heap
|
page read and write
|
||
6F04000
|
heap
|
page read and write
|
||
5F8C000
|
heap
|
page read and write
|
||
EB0000
|
heap
|
page read and write
|
||
721000
|
direct allocation
|
page execute read
|
||
32EF000
|
heap
|
page read and write
|
||
E9F000
|
heap
|
page read and write
|
||
24F5C37E000
|
heap
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
24F5C372000
|
heap
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
72C2000
|
heap
|
page read and write
|
||
600D000
|
heap
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
5F9C000
|
heap
|
page read and write
|
||
FE0000
|
heap
|
page readonly
|
||
1000000
|
heap
|
page read and write
|
||
F50000
|
heap
|
page read and write
|
||
5F9C000
|
heap
|
page read and write
|
||
7BB000
|
stack
|
page read and write
|
||
349F000
|
stack
|
page read and write
|
||
5F9C000
|
heap
|
page read and write
|
||
D40000
|
heap
|
page read and write
|
||
1310000
|
heap
|
page read and write
|
||
101E3000
|
unkown
|
page write copy
|
||
600D000
|
heap
|
page read and write
|
||
32CC000
|
heap
|
page read and write
|
||
DAC000
|
stack
|
page read and write
|
||
32A0000
|
heap
|
page read and write
|
||
EC1000
|
heap
|
page read and write
|
||
77C000
|
stack
|
page read and write
|
||
24F5C35C000
|
heap
|
page read and write
|
||
BEF000
|
stack
|
page read and write
|
||
101E3000
|
unkown
|
page write copy
|
||
149E000
|
stack
|
page read and write
|
||
100AD000
|
unkown
|
page read and write
|
||
24F5C36C000
|
heap
|
page read and write
|
||
14C3D323000
|
heap
|
page read and write
|
||
12FC000
|
stack
|
page read and write
|
||
6EE0000
|
heap
|
page read and write
|
||
24F5B83E000
|
heap
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
24F5C802000
|
heap
|
page read and write
|
||
77C8000
|
heap
|
page read and write
|
||
602F000
|
heap
|
page read and write
|
||
603B000
|
heap
|
page read and write
|
||
24F5C802000
|
heap
|
page read and write
|
||
14C3D23C000
|
heap
|
page read and write
|
||
34CA000
|
heap
|
page read and write
|
||
1120000
|
heap
|
page read and write
|
||
5A4000
|
heap
|
page read and write
|
||
6856000
|
heap
|
page read and write
|
||
1450000
|
heap
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
101E3000
|
unkown
|
page write copy
|
||
21CDAF9000
|
stack
|
page read and write
|
||
5F98000
|
heap
|
page read and write
|
||
3570000
|
heap
|
page read and write
|
||
530000
|
heap
|
page read and write
|
||
101DA000
|
unkown
|
page readonly
|
||
31B0000
|
heap
|
page read and write
|
||
24F5B8F4000
|
heap
|
page read and write
|
||
100AE000
|
unkown
|
page readonly
|
||
603B000
|
heap
|
page read and write
|
||
750000
|
heap
|
page read and write
|
||
F4C000
|
stack
|
page read and write
|
||
6EE0000
|
heap
|
page read and write
|
||
37A0000
|
heap
|
page read and write
|
||
24F5C37E000
|
heap
|
page read and write
|
||
24F5C35C000
|
heap
|
page read and write
|
||
101DF000
|
unkown
|
page read and write
|
||
6EE0000
|
heap
|
page read and write
|
||
603D000
|
heap
|
page read and write
|
||
6D0000
|
heap
|
page read and write
|
||
EC0000
|
heap
|
page read and write
|
||
10000000
|
unkown
|
page readonly
|
||
101DF000
|
unkown
|
page read and write
|
||
101E0000
|
unkown
|
page write copy
|
||
700000
|
heap
|
page read and write
|
||
5F8C000
|
heap
|
page read and write
|
||
F8B000
|
stack
|
page read and write
|
||
24F5B770000
|
heap
|
page read and write
|
||
AF0000
|
heap
|
page readonly
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
5F98000
|
heap
|
page read and write
|
||
100AE000
|
unkown
|
page readonly
|
||
24F5C215000
|
heap
|
page read and write
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
603D000
|
heap
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
73F000
|
direct allocation
|
page read and write
|
||
24F5C362000
|
heap
|
page read and write
|
||
5F8C000
|
heap
|
page read and write
|
||
600D000
|
heap
|
page read and write
|
||
6EE0000
|
heap
|
page read and write
|
||
24F5C365000
|
heap
|
page read and write
|
||
C2A000
|
heap
|
page read and write
|
||
130000
|
heap
|
page read and write
|
||
14C3D400000
|
heap
|
page read and write
|
||
C7B000
|
stack
|
page read and write
|
||
101DA000
|
unkown
|
page readonly
|
||
603B000
|
heap
|
page read and write
|
||
5F8C000
|
heap
|
page read and write
|
||
AE0000
|
heap
|
page read and write
|
||
5A4000
|
heap
|
page read and write
|
||
5F8C000
|
heap
|
page read and write
|
||
8E0000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
14C3D502000
|
heap
|
page read and write
|
||
600D000
|
heap
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
5A4000
|
heap
|
page read and write
|
||
14C3D213000
|
unkown
|
page read and write
|
||
3271000
|
heap
|
page read and write
|
||
C6E000
|
stack
|
page read and write
|
||
24F5C371000
|
heap
|
page read and write
|
||
10001000
|
unkown
|
page execute read
|
||
74F000
|
stack
|
page read and write
|
||
3CE000
|
stack
|
page read and write
|
||
602F000
|
heap
|
page read and write
|
||
603D000
|
heap
|
page read and write
|
||
3294000
|
heap
|
page read and write
|
||
14C3D413000
|
heap
|
page read and write
|
||
5F9C000
|
heap
|
page read and write
|
||
101FE000
|
unkown
|
page readonly
|
||
101E0000
|
unkown
|
page write copy
|
||
14C3D2B8000
|
heap
|
page read and write
|
||
6F04000
|
heap
|
page read and write
|
||
5F9C000
|
heap
|
page read and write
|
||
73A000
|
direct allocation
|
page readonly
|
||
790000
|
heap
|
page read and write
|
||
24F5C37E000
|
heap
|
page read and write
|
||
24F5D010000
|
heap
|
page read and write
|
||
24F5C802000
|
heap
|
page read and write
|
||
7CD8000
|
heap
|
page read and write
|
||
24F5B883000
|
heap
|
page read and write
|
||
153B000
|
heap
|
page read and write
|
||
5A4000
|
heap
|
page read and write
|
||
6F04000
|
heap
|
page read and write
|
||
5D40000
|
trusted library allocation
|
page read and write
|
||
101E0000
|
unkown
|
page write copy
|
||
24F5C37C000
|
heap
|
page read and write
|
||
24F5C300000
|
heap
|
page read and write
|
There are 433 hidden memdumps, click here to show them.