Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
A649.dll
|
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8f19ee7b9cb685ec4f932734c39820e11122c2_82810a17_10163637\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8f19ee7b9cb685ec4f932734c39820e11122c2_82810a17_19a236d3\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_f0f3252944ac8494bc49a1f9f213cb75e7a9fcf9_82810a17_17da36e3\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_f0f3252944ac8494bc49a1f9f213cb75e7a9fcf9_82810a17_1bc63ea3\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1438.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 09:13:27 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1503.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 09:13:27 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15FE.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER162D.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER162E.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER166C.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A31.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 09:13:33 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B2C.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B9A.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3898.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 09:13:36 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A30.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A8E.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve.tmp
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8f19ee7b9cb685ec4f932734c39820e11122c2_82810a17_0fc75884\Report.wer
|
Unknown
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8f19ee7b9cb685ec4f932734c39820e11122c2_82810a17_160b5807\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8f19ee7b9cb685ec4f932734c39820e11122c2_82810a17_1c57599d\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_f0f3252944ac8494bc49a1f9f213cb75e7a9fcf9_82810a17_174f57b9\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A40.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:10 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2ACD.tmp.dmp
|
Unknown
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C74.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C93.tmp.WERInternalMetadata.xml
|
Unknown
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CD2.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CF2.tmp.xml
|
Unknown
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F7E.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:15 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER40E6.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4145.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D78.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed May 31 08:59:19 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F6D.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER500A.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\V262JUIP.htm
|
HTML document, ASCII text, with very long lines (15300)
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\t5[1]
|
ASCII text, with no line terminators
|
dropped
|
There are 29 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\loaddll32.exe
|
loaddll32.exe "C:\Users\user\Desktop\A649.dll"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\A649.dll",#1
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\A649.dll,mv_add_i
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",#1
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 656
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 6960 -s 660
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\A649.dll,mv_add_q
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\A649.dll,mv_add_stable
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 652
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",mv_add_i
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",mv_add_q
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",mv_add_stable
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",next
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",mvutil_license
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\A649.dll",mvutil_configuration
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 652
|
|
|
|
C:\Windows\SysWOW64\wermgr.exe
|
C:\Windows\SysWOW64\wermgr.exe
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 656
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 664
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 652
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 652
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
There are 12 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://188.28.19.84/t5
|
188.28.19.84
|
|
|
|
http://upx.sf.net
|
unknown
|
||
|
https://streams.videolan.org/upload/
|
unknown
|
||
|
https://www.broadcom.cn
|
unknown
|
||
|
https://www.broadcom.com/media/blt4ac44e0e6c6d8341/blt476a993c2707b028/62e16f3bd3b8a5700456394e/wwwB
|
unknown
|
||
|
https://broadcom.com/
|
54.68.22.26
|
||
|
https://www.broadcom.com
|
unknown
|
||
|
https://static.broadcom.com
|
unknown
|
||
|
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
|
unknown
|
||
|
https://jp.broadcom.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
broadcom.com
|
54.68.22.26
|
||
|
www.broadcom.com
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
2.82.8.80
|
unknown
|
Portugal
|
|
|
|
70.160.67.203
|
unknown
|
United States
|
|
|
|
75.143.236.149
|
unknown
|
United States
|
|
|
|
83.110.223.61
|
unknown
|
United Arab Emirates
|
|
|
|
86.195.14.72
|
unknown
|
France
|
|
|
|
84.215.202.8
|
unknown
|
Norway
|
|
|
|
184.182.66.109
|
unknown
|
United States
|
|
|
|
92.186.69.229
|
unknown
|
France
|
|
|
|
174.4.89.3
|
unknown
|
Canada
|
|
|
|
161.142.103.187
|
unknown
|
Malaysia
|
|
|
|
114.143.176.236
|
unknown
|
India
|
|
|
|
14.192.241.76
|
unknown
|
Malaysia
|
|
|
|
173.88.135.179
|
unknown
|
United States
|
|
|
|
84.108.200.161
|
unknown
|
Israel
|
|
|
|
47.34.30.133
|
unknown
|
United States
|
|
|
|
183.87.163.165
|
unknown
|
India
|
|
|
|
184.181.75.148
|
unknown
|
United States
|
|
|
|
124.149.143.189
|
unknown
|
Australia
|
|
|
|
84.35.26.14
|
unknown
|
Netherlands
|
|
|
|
73.29.92.128
|
unknown
|
United States
|
|
|
|
68.203.69.96
|
unknown
|
United States
|
|
|
|
82.131.141.209
|
unknown
|
Hungary
|
|
|
|
64.121.161.102
|
unknown
|
United States
|
|
|
|
178.175.187.254
|
unknown
|
Moldova Republic of
|
|
|
|
96.56.197.26
|
unknown
|
United States
|
|
|
|
186.64.67.30
|
unknown
|
Argentina
|
|
|
|
188.28.19.84
|
unknown
|
United Kingdom
|
|
|
|
125.99.76.102
|
unknown
|
India
|
|
|
|
81.101.185.146
|
unknown
|
United Kingdom
|
|
|
|
59.28.84.65
|
unknown
|
Korea Republic of
|
|
|
|
105.186.128.181
|
unknown
|
South Africa
|
|
|
|
76.86.31.59
|
unknown
|
United States
|
|
|
|
147.147.30.126
|
unknown
|
United Kingdom
|
|
|
|
96.87.28.170
|
unknown
|
United States
|
|
|
|
75.109.111.89
|
unknown
|
United States
|
|
|
|
78.92.133.215
|
unknown
|
Hungary
|
|
|
|
124.122.47.148
|
unknown
|
Thailand
|
|
|
|
88.126.94.4
|
unknown
|
France
|
|
|
|
51.14.29.227
|
unknown
|
United Kingdom
|
|
|
|
85.57.212.13
|
unknown
|
Spain
|
|
|
|
47.205.25.170
|
unknown
|
United States
|
|
|
|
95.45.50.93
|
unknown
|
Ireland
|
|
|
|
80.12.88.148
|
unknown
|
France
|
|
|
|
69.133.162.35
|
unknown
|
United States
|
|
|
|
86.132.236.117
|
unknown
|
United Kingdom
|
|
|
|
151.62.238.176
|
unknown
|
Italy
|
|
|
|
70.112.206.5
|
unknown
|
United States
|
|
|
|
205.237.67.69
|
unknown
|
Canada
|
|
|
|
102.159.188.125
|
unknown
|
Tunisia
|
|
|
|
151.65.167.77
|
unknown
|
Italy
|
|
|
|
76.178.148.107
|
unknown
|
United States
|
|
|
|
89.36.206.69
|
unknown
|
Italy
|
|
|
|
69.242.31.249
|
unknown
|
United States
|
|
|
|
193.253.100.236
|
unknown
|
France
|
|
|
|
76.16.49.134
|
unknown
|
United States
|
|
|
|
94.207.104.225
|
unknown
|
United Arab Emirates
|
|
|
|
201.244.108.183
|
unknown
|
Colombia
|
|
|
|
103.42.86.42
|
unknown
|
India
|
|
|
|
78.18.105.11
|
unknown
|
Ireland
|
|
|
|
80.6.50.34
|
unknown
|
United Kingdom
|
|
|
|
103.144.201.56
|
unknown
|
unknown
|
|
|
|
27.0.48.233
|
unknown
|
India
|
|
|
|
70.28.50.223
|
unknown
|
Canada
|
|
|
|
98.145.23.67
|
unknown
|
United States
|
|
|
|
47.149.134.231
|
unknown
|
United States
|
|
|
|
82.125.44.236
|
unknown
|
France
|
|
|
|
81.229.117.95
|
unknown
|
Sweden
|
|
|
|
89.129.109.27
|
unknown
|
Spain
|
|
|
|
122.186.210.254
|
unknown
|
India
|
|
|
|
79.77.142.22
|
unknown
|
United Kingdom
|
|
|
|
90.78.147.141
|
unknown
|
France
|
|
|
|
122.184.143.86
|
unknown
|
India
|
|
|
|
186.75.95.6
|
unknown
|
Panama
|
|
|
|
50.68.186.195
|
unknown
|
Canada
|
|
|
|
12.172.173.82
|
unknown
|
United States
|
|
|
|
213.64.33.61
|
unknown
|
Sweden
|
|
|
|
79.168.224.165
|
unknown
|
Portugal
|
|
|
|
86.97.55.89
|
unknown
|
United Arab Emirates
|
|
|
|
176.142.207.63
|
unknown
|
France
|
|
|
|
92.154.17.149
|
unknown
|
France
|
|
|
|
174.58.146.57
|
unknown
|
United States
|
|
|
|
78.160.146.127
|
unknown
|
Turkey
|
|
|
|
58.186.75.42
|
unknown
|
Viet Nam
|
|
|
|
223.166.13.95
|
unknown
|
China
|
|
|
|
65.95.141.84
|
unknown
|
Canada
|
|
|
|
50.68.204.71
|
unknown
|
Canada
|
|
|
|
71.38.155.217
|
unknown
|
United States
|
|
|
|
104.35.24.154
|
unknown
|
United States
|
|
|
|
220.240.164.182
|
unknown
|
Australia
|
|
|
|
103.123.223.133
|
unknown
|
India
|
|
|
|
24.198.114.130
|
unknown
|
United States
|
|
|
|
2.36.64.159
|
unknown
|
Italy
|
|
|
|
198.2.51.242
|
unknown
|
United States
|
|
|
|
92.9.45.20
|
unknown
|
United Kingdom
|
|
|
|
113.11.92.30
|
unknown
|
Bangladesh
|
|
|
|
69.119.123.159
|
unknown
|
United States
|
|
|
|
69.123.4.221
|
unknown
|
United States
|
|
|
|
172.115.17.50
|
unknown
|
United States
|
|
|
|
77.86.98.236
|
unknown
|
United Kingdom
|
|
|
|
147.219.4.194
|
unknown
|
United States
|
|
|
|
54.68.22.26
|
broadcom.com
|
United States
|
||
|
192.168.2.1
|
unknown
|
unknown
|
There are 92 hidden IPs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018800A5BAC6B85
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHivePermissionsCorrect
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHiveOwnerCorrect
|
||
|
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
|
PendingFileRenameOperations
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiOverridePath
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile
|
WritePermissionsCheck
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile
|
ProviderSyncId
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProgramId
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
FileId
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LongPathHash
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Name
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Publisher
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Version
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinFileVersion
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinaryType
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductName
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductVersion
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LinkDate
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinProductVersion
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Size
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Language
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsPeFile
|
||
|
\REGISTRY\A\{19f02f52-be46-6124-0de2-b63fb9c0e2c5}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsOsComponent
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018800A5BAC6B85
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceId
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
ApplicationFlags
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018800A5BAC6B85
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Efyeaazugsj
|
b790b431
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Efyeaazugsj
|
820f647f
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Efyeaazugsj
|
804e4403
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Efyeaazugsj
|
38f22366
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Efyeaazugsj
|
45fa6cec
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Efyeaazugsj
|
fd460b89
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Efyeaazugsj
|
3ab3031a
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Efyeaazugsj
|
c8d9dbc7
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Efyeaazugsj
|
ff072bf5
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Efyeaazugsj
|
b790b431
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C98DE29A7
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile
|
WritePermissionsCheck
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile
|
ProviderSyncId
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProgramId
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
FileId
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LongPathHash
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Name
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Publisher
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Version
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinFileVersion
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinaryType
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductName
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductVersion
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LinkDate
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinProductVersion
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Size
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Language
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsPeFile
|
||
|
\REGISTRY\A\{3cefa112-8e39-ba88-021d-f78e707a75a1}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsOsComponent
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C98DE29A7
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C98DE29A7
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C98DE29A7
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
c13aa5c
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
398c7a12
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
3bcd5a6e
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
83713d0b
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
fe797281
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
46c515e4
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
81301d77
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
735ac5aa
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
c13aa5c
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
c13aa5c
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Usnkiokpu
|
c13aa5c
|
There are 70 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
95A000
|
heap
|
page read and write
|
|
|
|
4610000
|
heap
|
page read and write
|
|
|
|
3160000
|
heap
|
page read and write
|
||
|
84F000
|
direct allocation
|
page read and write
|
||
|
70A000
|
heap
|
page read and write
|
||
|
768E000
|
heap
|
page read and write
|
||
|
4879000
|
heap
|
page read and write
|
||
|
77E000
|
stack
|
page read and write
|
||
|
4450000
|
heap
|
page read and write
|
||
|
2BA7000
|
heap
|
page read and write
|
||
|
64BD000
|
heap
|
page read and write
|
||
|
B00000
|
heap
|
page read and write
|
||
|
48AF000
|
stack
|
page read and write
|
||
|
2A9A000
|
stack
|
page read and write
|
||
|
718E000
|
heap
|
page read and write
|
||
|
1E297DE0000
|
heap
|
page readonly
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
64BB000
|
heap
|
page read and write
|
||
|
33EF000
|
stack
|
page read and write
|
||
|
648D000
|
heap
|
page read and write
|
||
|
15DA1802000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
33EA000
|
heap
|
page read and write
|
||
|
15DA1486000
|
heap
|
page read and write
|
||
|
2BA0000
|
heap
|
page read and write
|
||
|
2E60000
|
heap
|
page read and write
|
||
|
648D000
|
heap
|
page read and write
|
||
|
700000
|
heap
|
page read and write
|
||
|
6418000
|
heap
|
page read and write
|
||
|
3CB000
|
stack
|
page read and write
|
||
|
3160000
|
heap
|
page read and write
|
||
|
2F40000
|
heap
|
page read and write
|
||
|
468F000
|
heap
|
page read and write
|
||
|
2DF0000
|
heap
|
page read and write
|
||
|
2F1F000
|
stack
|
page read and write
|
||
|
2C90000
|
heap
|
page read and write
|
||
|
307C000
|
stack
|
page read and write
|
||
|
4848000
|
heap
|
page read and write
|
||
|
1E297E00000
|
trusted library allocation
|
page read and write
|
||
|
B10000
|
trusted library allocation
|
page read and write
|
||
|
2C84000
|
heap
|
page read and write
|
||
|
6744000
|
heap
|
page read and write
|
||
|
93F000
|
stack
|
page read and write
|
||
|
15DA1924000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
56F32FD000
|
stack
|
page read and write
|
||
|
9FB000
|
stack
|
page read and write
|
||
|
32BA000
|
heap
|
page read and write
|
||
|
2ADA000
|
remote allocation
|
page read and write
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
64BB000
|
heap
|
page read and write
|
||
|
4879000
|
heap
|
page read and write
|
||
|
2D6E000
|
stack
|
page read and write
|
||
|
32F0000
|
heap
|
page read and write
|
||
|
831000
|
direct allocation
|
page execute read
|
||
|
15DA1813000
|
heap
|
page read and write
|
||
|
4451000
|
heap
|
page read and write
|
||
|
64BB000
|
heap
|
page read and write
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
64AF000
|
heap
|
page read and write
|
||
|
15DA13B0000
|
heap
|
page read and write
|
||
|
1E296FA3000
|
heap
|
page read and write
|
||
|
D8D000
|
stack
|
page read and write
|
||
|
6744000
|
heap
|
page read and write
|
||
|
32CE000
|
stack
|
page read and write
|
||
|
8F0000
|
heap
|
page read and write
|
||
|
35A0000
|
heap
|
page read and write
|
||
|
A40000
|
heap
|
page read and write
|
||
|
7170000
|
heap
|
page read and write
|
||
|
15DA1486000
|
heap
|
page read and write
|
||
|
30BB000
|
stack
|
page read and write
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
2D2F000
|
stack
|
page read and write
|
||
|
89E000
|
stack
|
page read and write
|
||
|
492E000
|
stack
|
page read and write
|
||
|
7171000
|
heap
|
page read and write
|
||
|
303A000
|
heap
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
2BCF000
|
stack
|
page read and write
|
||
|
15DA1430000
|
heap
|
page read and write
|
||
|
2AC1000
|
remote allocation
|
page execute read
|
||
|
1E296FB2000
|
heap
|
page read and write
|
||
|
15DA1486000
|
heap
|
page read and write
|
||
|
641C000
|
heap
|
page read and write
|
||
|
2F40000
|
remote allocation
|
page read and write
|
||
|
660000
|
heap
|
page read and write
|
||
|
59E0000
|
heap
|
page read and write
|
||
|
1E297B90000
|
trusted library allocation
|
page read and write
|
||
|
95C000
|
stack
|
page read and write
|
||
|
38C000
|
stack
|
page read and write
|
||
|
1E297B10000
|
trusted library allocation
|
page read and write
|
||
|
330000
|
heap
|
page read and write
|
||
|
790000
|
heap
|
page readonly
|
||
|
15DA1800000
|
heap
|
page read and write
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
4879000
|
heap
|
page read and write
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
2FAC000
|
stack
|
page read and write
|
||
|
6C73000
|
heap
|
page read and write
|
||
|
1E296F49000
|
heap
|
page read and write
|
||
|
648C000
|
heap
|
page read and write
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
65F000
|
stack
|
page read and write
|
||
|
4814000
|
heap
|
page read and write
|
||
|
641C000
|
heap
|
page read and write
|
||
|
718A000
|
heap
|
page read and write
|
||
|
648D000
|
heap
|
page read and write
|
||
|
486F000
|
heap
|
page read and write
|
||
|
65AC000
|
heap
|
page read and write
|
||
|
64BB000
|
heap
|
page read and write
|
||
|
6C7E000
|
heap
|
page read and write
|
||
|
4879000
|
heap
|
page read and write
|
||
|
118B000
|
heap
|
page read and write
|
||
|
4E40000
|
heap
|
page read and write
|
||
|
64AF000
|
heap
|
page read and write
|
||
|
2E70000
|
heap
|
page read and write
|
||
|
6C71000
|
heap
|
page read and write
|
||
|
2EE0000
|
heap
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
1E296F60000
|
heap
|
page read and write
|
||
|
2E6E000
|
stack
|
page read and write
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
2AE2000
|
remote allocation
|
page readonly
|
||
|
64BD000
|
heap
|
page read and write
|
||
|
B50000
|
heap
|
page read and write
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
AAC000
|
stack
|
page read and write
|
||
|
3030000
|
heap
|
page read and write
|
||
|
6838A7E000
|
stack
|
page read and write
|
||
|
640C000
|
heap
|
page read and write
|
||
|
11A4000
|
heap
|
page read and write
|
||
|
68389F9000
|
stack
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
3270000
|
heap
|
page read and write
|
||
|
7EF000
|
stack
|
page read and write
|
||
|
483C000
|
heap
|
page read and write
|
||
|
64AF000
|
heap
|
page read and write
|
||
|
641C000
|
heap
|
page read and write
|
||
|
648D000
|
heap
|
page read and write
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
15DA142F000
|
heap
|
page read and write
|
||
|
15DA1350000
|
trusted library allocation
|
page read and write
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
1E297130000
|
trusted library allocation
|
page read and write
|
||
|
15DA1902000
|
heap
|
page read and write
|
||
|
2F7A000
|
heap
|
page read and write
|
||
|
468F000
|
heap
|
page read and write
|
||
|
4633000
|
heap
|
page read and write
|
||
|
2BA5000
|
heap
|
page read and write
|
||
|
64BB000
|
heap
|
page read and write
|
||
|
1E297E50000
|
trusted library allocation
|
page read and write
|
||
|
15DA1475000
|
heap
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
7A0000
|
heap
|
page read and write
|
||
|
64BB000
|
heap
|
page read and write
|
||
|
320000
|
heap
|
page read and write
|
||
|
32E0000
|
heap
|
page readonly
|
||
|
27E0000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
15DA1902000
|
heap
|
page read and write
|
||
|
1180000
|
heap
|
page read and write
|
||
|
6418000
|
heap
|
page read and write
|
||
|
15DA1502000
|
trusted library allocation
|
page read and write
|
||
|
64BD000
|
heap
|
page read and write
|
||
|
820000
|
direct allocation
|
page execute read
|
||
|
6418000
|
heap
|
page read and write
|
||
|
1E297B20000
|
trusted library allocation
|
page read and write
|
||
|
640C000
|
heap
|
page read and write
|
||
|
318F000
|
stack
|
page read and write
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
1E296F91000
|
heap
|
page read and write
|
||
|
6418000
|
heap
|
page read and write
|
||
|
3410000
|
heap
|
page read and write
|
||
|
4821000
|
heap
|
page read and write
|
||
|
500000
|
heap
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
710000
|
heap
|
page read and write
|
||
|
1E296F10000
|
heap
|
page read and write
|
||
|
15DA1913000
|
heap
|
page read and write
|
||
|
A1C000
|
stack
|
page read and write
|
||
|
2DB1000
|
heap
|
page read and write
|
||
|
6838AF9000
|
stack
|
page read and write
|
||
|
648D000
|
heap
|
page read and write
|
||
|
2F60000
|
heap
|
page read and write
|
||
|
4879000
|
heap
|
page read and write
|
||
|
486F000
|
heap
|
page read and write
|
||
|
640C000
|
heap
|
page read and write
|
||
|
32B0000
|
heap
|
page read and write
|
||
|
84A000
|
direct allocation
|
page readonly
|
||
|
6744000
|
heap
|
page read and write
|
||
|
2FEB000
|
stack
|
page read and write
|
||
|
2E70000
|
heap
|
page read and write
|
||
|
A5B000
|
stack
|
page read and write
|
||
|
2BCE000
|
stack
|
page read and write
|
||
|
7A4000
|
heap
|
page read and write
|
||
|
484C000
|
heap
|
page read and write
|
||
|
5EF5000
|
heap
|
page read and write
|
||
|
7BE000
|
stack
|
page read and write
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
AEB000
|
stack
|
page read and write
|
||
|
6418000
|
heap
|
page read and write
|
||
|
1130000
|
heap
|
page read and write
|
||
|
4B0000
|
heap
|
page read and write
|
||
|
7A4000
|
heap
|
page read and write
|
||
|
15DA1903000
|
heap
|
page read and write
|
||
|
1E296FB2000
|
heap
|
page read and write
|
||
|
7A4000
|
heap
|
page read and write
|
||
|
4879000
|
heap
|
page read and write
|
||
|
56F39F9000
|
stack
|
page read and write
|
||
|
1E296E80000
|
heap
|
page read and write
|
||
|
2DA0000
|
heap
|
page read and write
|
||
|
2FB0000
|
heap
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
64BB000
|
heap
|
page read and write
|
||
|
15DA1818000
|
heap
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
3450000
|
heap
|
page read and write
|
||
|
68385DB000
|
stack
|
page read and write
|
||
|
6720000
|
heap
|
page read and write
|
||
|
30AF000
|
stack
|
page read and write
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
2F70000
|
heap
|
page read and write
|
||
|
2D88000
|
heap
|
page read and write
|
||
|
1E296E90000
|
trusted library allocation
|
page read and write
|
||
|
34B0000
|
heap
|
page read and write
|
||
|
2F20000
|
heap
|
page readonly
|
||
|
B30000
|
heap
|
page read and write
|
||
|
15DA140F000
|
unkown
|
page read and write
|
||
|
64AF000
|
heap
|
page read and write
|
||
|
6744000
|
heap
|
page read and write
|
||
|
15DA1340000
|
heap
|
page read and write
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
6720000
|
heap
|
page read and write
|
||
|
83E000
|
stack
|
page read and write
|
||
|
316A000
|
heap
|
page read and write
|
||
|
64BD000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
7A4000
|
heap
|
page read and write
|
||
|
2BEE000
|
stack
|
page read and write
|
||
|
718F000
|
heap
|
page read and write
|
||
|
3150000
|
heap
|
page read and write
|
||
|
670000
|
heap
|
page readonly
|
||
|
6720000
|
heap
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
64BB000
|
heap
|
page read and write
|
||
|
39C000
|
stack
|
page read and write
|
||
|
6C7F000
|
heap
|
page read and write
|
||
|
64BD000
|
heap
|
page read and write
|
||
|
7A4000
|
heap
|
page read and write
|
||
|
3DB000
|
stack
|
page read and write
|
||
|
310E000
|
stack
|
page read and write
|
||
|
830000
|
direct allocation
|
page read and write
|
||
|
768D000
|
heap
|
page read and write
|
||
|
15DA1429000
|
heap
|
page read and write
|
||
|
7A4000
|
heap
|
page read and write
|
||
|
1E296FCF000
|
heap
|
page read and write
|
||
|
6418000
|
heap
|
page read and write
|
||
|
64AF000
|
heap
|
page read and write
|
||
|
64AF000
|
heap
|
page read and write
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
760000
|
heap
|
page readonly
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
2E81000
|
heap
|
page read and write
|
||
|
2ED0000
|
heap
|
page read and write
|
||
|
144F000
|
stack
|
page read and write
|
||
|
4A20000
|
heap
|
page read and write
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
433F000
|
heap
|
page read and write
|
||
|
640C000
|
heap
|
page read and write
|
||
|
1E296FAA000
|
heap
|
page read and write
|
||
|
64AF000
|
heap
|
page read and write
|
||
|
1196000
|
heap
|
page read and write
|
||
|
6744000
|
heap
|
page read and write
|
||
|
6744000
|
heap
|
page read and write
|
||
|
15DA1523000
|
heap
|
page read and write
|
||
|
6C7E000
|
heap
|
page read and write
|
||
|
3120000
|
heap
|
page read and write
|
||
|
683897E000
|
stack
|
page read and write
|
||
|
6720000
|
heap
|
page read and write
|
||
|
15DA1400000
|
unkown
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
3250000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
15DA143A000
|
heap
|
page read and write
|
||
|
2A5C000
|
stack
|
page read and write
|
||
|
4879000
|
heap
|
page read and write
|
||
|
2E6F000
|
stack
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
99B000
|
stack
|
page read and write
|
||
|
64AF000
|
heap
|
page read and write
|
||
|
64BD000
|
heap
|
page read and write
|
||
|
15DA1902000
|
heap
|
page read and write
|
||
|
648D000
|
heap
|
page read and write
|
||
|
9BC000
|
stack
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
2FAE000
|
stack
|
page read and write
|
||
|
950000
|
heap
|
page read and write
|
||
|
4879000
|
heap
|
page read and write
|
||
|
6720000
|
heap
|
page read and write
|
||
|
119C000
|
heap
|
page read and write
|
||
|
950000
|
heap
|
page read and write
|
||
|
15DA1900000
|
heap
|
page read and write
|
||
|
96A000
|
heap
|
page read and write
|
||
|
6720000
|
heap
|
page read and write
|
||
|
2BCF000
|
stack
|
page read and write
|
||
|
1E296F40000
|
heap
|
page read and write
|
||
|
640C000
|
heap
|
page read and write
|
||
|
960000
|
heap
|
page read and write
|
||
|
648D000
|
heap
|
page read and write
|
||
|
2BD0000
|
heap
|
page readonly
|
||
|
5920000
|
trusted library allocation
|
page read and write
|
||
|
2D3B000
|
stack
|
page read and write
|
||
|
641C000
|
heap
|
page read and write
|
||
|
641C000
|
heap
|
page read and write
|
||
|
640C000
|
heap
|
page read and write
|
||
|
100AE000
|
unkown
|
page readonly
|
||
|
65E4000
|
heap
|
page read and write
|
||
|
15DA142E000
|
heap
|
page read and write
|
||
|
1E297DF0000
|
trusted library allocation
|
page read and write
|
||
|
1E296FB2000
|
heap
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
2F60000
|
heap
|
page read and write
|
||
|
43C000
|
stack
|
page read and write
|
||
|
2CFC000
|
stack
|
page read and write
|
||
|
351F000
|
stack
|
page read and write
|
||
|
770000
|
heap
|
page read and write
|
||
|
3200000
|
heap
|
page read and write
|
||
|
31F0000
|
heap
|
page read and write
|
||
|
640C000
|
heap
|
page read and write
|
||
|
117E000
|
stack
|
page read and write
|
||
|
3290000
|
heap
|
page readonly
|
||
|
AD0000
|
heap
|
page read and write
|
||
|
1A0000
|
heap
|
page read and write
|
||
|
6418000
|
heap
|
page read and write
|
||
|
641C000
|
heap
|
page read and write
|
||
|
2AF0000
|
remote allocation
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
6418000
|
heap
|
page read and write
|
||
|
8F0000
|
heap
|
page read and write
|
||
|
641C000
|
heap
|
page read and write
|
||
|
6418000
|
heap
|
page read and write
|
||
|
7686000
|
heap
|
page read and write
|
||
|
101DA000
|
unkown
|
page readonly
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
700000
|
heap
|
page read and write
|
||
|
2E3F000
|
stack
|
page read and write
|
||
|
718A000
|
heap
|
page read and write
|
||
|
DF0000
|
heap
|
page read and write
|
||
|
64BD000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
2DF0000
|
heap
|
page readonly
|
||
|
15DA1475000
|
heap
|
page read and write
|
||
|
641C000
|
heap
|
page read and write
|
||
|
2AC0000
|
remote allocation
|
page read and write
|
||
|
7A4000
|
heap
|
page read and write
|
||
|
101FE000
|
unkown
|
page readonly
|
||
|
5EEE000
|
heap
|
page read and write
|
||
|
852000
|
direct allocation
|
page readonly
|
||
|
5821000
|
heap
|
page read and write
|
||
|
15DA1914000
|
heap
|
page read and write
|
||
|
717D000
|
heap
|
page read and write
|
||
|
B4E000
|
stack
|
page read and write
|
||
|
2B70000
|
heap
|
page read and write
|
||
|
15DA1431000
|
heap
|
page read and write
|
||
|
8C0000
|
heap
|
page read and write
|
||
|
B50000
|
heap
|
page read and write
|
||
|
641C000
|
heap
|
page read and write
|
||
|
101E0000
|
unkown
|
page write copy
|
||
|
47F1000
|
heap
|
page read and write
|
||
|
15DA1917000
|
heap
|
page read and write
|
||
|
15DA1500000
|
trusted library allocation
|
page read and write
|
||
|
7F0000
|
heap
|
page read and write
|
||
|
2E60000
|
heap
|
page read and write
|
||
|
15DA1913000
|
heap
|
page read and write
|
||
|
6720000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
64BD000
|
heap
|
page read and write
|
||
|
100AD000
|
unkown
|
page read and write
|
||
|
2DB3000
|
heap
|
page read and write
|
||
|
1E297DD0000
|
trusted library allocation
|
page read and write
|
||
|
3140000
|
heap
|
page read and write
|
||
|
1100000
|
heap
|
page read and write
|
||
|
33E0000
|
heap
|
page read and write
|
||
|
2C2E000
|
stack
|
page read and write
|
||
|
2E7A000
|
heap
|
page read and write
|
||
|
2B90000
|
heap
|
page read and write
|
||
|
B60000
|
heap
|
page readonly
|
||
|
6720000
|
heap
|
page read and write
|
||
|
640C000
|
heap
|
page read and write
|
||
|
640C000
|
heap
|
page read and write
|
||
|
496F000
|
stack
|
page read and write
|
||
|
D20000
|
heap
|
page read and write
|
||
|
64BD000
|
heap
|
page read and write
|
||
|
56F36F9000
|
stack
|
page read and write
|
||
|
4820000
|
heap
|
page read and write
|
||
|
7180000
|
heap
|
page read and write
|
||
|
6744000
|
heap
|
page read and write
|
||
|
4879000
|
heap
|
page read and write
|
||
|
648D000
|
heap
|
page read and write
|
||
|
15DA1913000
|
heap
|
page read and write
|
||
|
101DF000
|
unkown
|
page read and write
|
||
|
1E296EF0000
|
heap
|
page read and write
|
||
|
820000
|
heap
|
page read and write
|
||
|
64BB000
|
heap
|
page read and write
|
||
|
7A4000
|
heap
|
page read and write
|
||
|
64AF000
|
heap
|
page read and write
|
||
|
6720000
|
heap
|
page read and write
|
||
|
15DA1916000
|
heap
|
page read and write
|
||
|
1E296F69000
|
heap
|
page read and write
|
||
|
4451000
|
heap
|
page read and write
|
||
|
47B000
|
stack
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
101E3000
|
unkown
|
page write copy
|
||
|
6744000
|
heap
|
page read and write
|
||
|
15DA1413000
|
unkown
|
page read and write
|
||
|
AC0000
|
heap
|
page read and write
|
||
|
2BE0000
|
heap
|
page readonly
|
||
|
1E297B80000
|
trusted library allocation
|
page read and write
|
||
|
15DA1515000
|
trusted library allocation
|
page read and write
|
||
|
880000
|
heap
|
page read and write
|
||
|
1E296F45000
|
heap
|
page read and write
|
||
|
61E000
|
stack
|
page read and write
|
||
|
2D80000
|
heap
|
page read and write
|
||
|
327E000
|
stack
|
page read and write
|
||
|
10FC000
|
stack
|
page read and write
|
||
|
6C79000
|
heap
|
page read and write
|
||
|
4879000
|
heap
|
page read and write
|
||
|
327A000
|
heap
|
page read and write
|
||
|
B4E000
|
stack
|
page read and write
|
||
|
648D000
|
heap
|
page read and write
|
||
|
6744000
|
heap
|
page read and write
|
There are 430 hidden memdumps, click here to show them.