Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
oOo.dat.dll
|
PE32 executable (DLL) (console) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_2c3030496f403a8a1c519fd5cbcbf5af4791654_82810a17_08e33b40\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_2c3030496f403a8a1c519fd5cbcbf5af4791654_82810a17_0c4f3ab3\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_2c3030496f403a8a1c519fd5cbcbf5af4791654_82810a17_14433a94\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1c0b3b4f\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER16A1.tmp.dmp
|
Mini DuMP crash report, 14 streams, Thu Jun 1 01:34:08 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER16D0.tmp.dmp
|
Mini DuMP crash report, 14 streams, Thu Jun 1 01:34:08 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER18F4.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1903.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1933.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1952.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F6B.tmp.dmp
|
Mini DuMP crash report, 14 streams, Thu Jun 1 01:34:10 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20A4.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2103.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2BAF.tmp.dmp
|
Mini DuMP crash report, 14 streams, Thu Jun 1 01:34:14 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F98.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FC8.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 63843 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ZUETP6CS.htm
|
HTML document, Unicode text, UTF-8 text, with very long lines (540)
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\t5[1]
|
ASCII text, with no line terminators
|
modified
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve.tmp
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
There are 15 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\loaddll32.exe
|
loaddll32.exe "C:\Users\user\Desktop\oOo.dat.dll"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\oOo.dat.dll",#1
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\oOo.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\oOo.dat.dll",#1
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 660
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5332 -s 652
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\oOo.dat.dll,m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 652
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\oOo.dat.dll,m?0SchedulerPolicy@Concurrency@@QAA@IZZ
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7224 -s 648
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\oOo.dat.dll",m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\oOo.dat.dll",m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\oOo.dat.dll",m?0SchedulerPolicy@Concurrency@@QAA@IZZ
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\oOo.dat.dll",next
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\oOo.dat.dll",mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\oOo.dat.dll",mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z
|
|
|
|
C:\Windows\SysWOW64\wermgr.exe
|
C:\Windows\SysWOW64\wermgr.exe
|
|
|
|
C:\Windows\SysWOW64\ipconfig.exe
|
ipconfig /all
|
|
|
|
C:\Windows\SysWOW64\whoami.exe
|
whoami /all
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\msiexec.exe
|
C:\Windows\system32\msiexec.exe /V
|
There are 13 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://www.linkedin.com/talent/post-a-job?trk=homepage-basic_talent-finder-cta
|
unknown
|
||
|
https://sg.linkedin.com/
|
unknown
|
||
|
https://nz.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/jobs/quality-assurance-jobs-h
|
unknown
|
||
|
https://www.linkedin.com/pulse/topics/marketing-s2461/
|
unknown
|
||
|
https://bo.linkedin.com/
|
unknown
|
||
|
https://cn.linkedin.com/
|
unknown
|
||
|
https://kr.linkedin.com/
|
unknown
|
||
|
https://sv.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/signup?trk=guest_homepage-basic_directory
|
unknown
|
||
|
https://www.linkedin.com/legal/copyright-policy?trk=homepage-basic_footer-copyright-policy
|
unknown
|
||
|
https://static.licdn.com/aero-v1/sc/h/e12h2cd8ac580qen9qdd0qks8
|
unknown
|
||
|
https://about.linkedin.com/?trk=homepage-basic_directory_aboutUrl
|
unknown
|
||
|
https://www.linkedin.com/jobs/search?trk=guest_homepage-basic_guest_nav_menu_jobs
|
unknown
|
||
|
https://ec.linkedin.com/
|
unknown
|
||
|
https://about.linkedin.com?trk=homepage-basic_footer-about
|
unknown
|
||
|
https://ie.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/business-software-and-tools?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://ae.linkedin.com/
|
unknown
|
||
|
https://uk.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/salary/?trk=homepage-basic_directory_salaryHomeUrl
|
unknown
|
||
|
https://static.licdn.com/aero-v1/sc/h/75y9ng27ydl2d46fam5nanne5
|
unknown
|
||
|
https://developer.linkedin.com/?trk=homepage-basic_directory_developerMicrositeUrl
|
unknown
|
||
|
https://www.linkedin.com/directory/posts?trk=homepage-basic_directory_postsDirectoryUrl
|
unknown
|
||
|
https://www.linkedin.com/jobs/operations-jobs-h
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/artificial-intelligence?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://www.linkedin.com/pulse/topics/healthcare-s282/
|
unknown
|
||
|
https://in.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/directory/featured?trk=homepage-basic_directory_featuredDirectoryUrl
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/audio-and-music?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/training-and-education?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://hk.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/visualization-and-real-time?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://at.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/pulse/topics/construction-management-s831/
|
unknown
|
||
|
https://www.linkedin.com/jobs/education-jobs-h
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/project-management?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://www.linkedin.com/directory/articles?trk=homepage-basic_directory_articlesDirectoryUrl
|
unknown
|
||
|
https://www.linkedin.com/pulse/topics/public-administration-s3697/
|
unknown
|
||
|
https://za.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/directory/services?trk=homepage-basic_directory_servicesDirectoryUrl
|
unknown
|
||
|
https://jm.linkedin.com/
|
unknown
|
||
|
https://no.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/directory/learning?trk=homepage-basic_directory_learningDirectoryUrl
|
unknown
|
||
|
https://www.linkedin.com/jobs/entrepreneurship-jobs-h
|
unknown
|
||
|
https://pe.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/directory/advice?trk=homepage-basic_directory_adviceDirectoryUrl
|
unknown
|
||
|
https://au.linkedin.com/
|
unknown
|
||
|
https://static.licdn.com/aero-v1/sc/h/ddi43qwelxeqjxdd45pe3fvs1
|
unknown
|
||
|
https://www.linkedin.com/jobs/administrative-assistant-jobs-h
|
unknown
|
||
|
https://www.linkedin.com/legal/professional-community-policies?trk=homepage-basic_footer-community-g
|
unknown
|
||
|
https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy
|
unknown
|
||
|
https://www.linkedin.com/signup?trk=guest_homepage-basic_nav-header-join
|
unknown
|
||
|
https://www.linkedin.com/signup?trk=homepage-basic_join-cta
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/sales-3?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://www.linkedin.com/legal/cookie-policy
|
unknown
|
||
|
https://static.licdn.com/aero-v1/sc/h/51t74mlo1ty7vakn3a80a9jcp
|
unknown
|
||
|
https://static.licdn.com/aero-v1/sc/h/8fkga714vy9b2wk5auqo5reeb
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/data-science?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://cr.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/mobile-development?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://gt.linkedin.com/
|
unknown
|
||
|
https://ph.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/leadership-and-management?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/network-and-system-administration?trk=homepage-basic_learni
|
unknown
|
||
|
https://www.linkedin.com/learning/search?trk=guest_homepage-basic_guest_nav_menu_learning
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/customer-service-3?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://www.linkedin.com/jobs/jobs-in-h
|
unknown
|
||
|
https://fr.linkedin.com/
|
unknown
|
||
|
https://mobile.linkedin.com/?trk=homepage-basic_directory_mobileMicrositeUrl
|
unknown
|
||
|
https://www.linkedin.com/jobs/purchasing-jobs-h
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/security-3?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://www.linkedin.com/learning/search?trk=homepage-basic_brand-discovery_intent-module-thirdBtn
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/it-help-desk-5?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://www.linkedin.com/jobs/arts-and-design-jobs-h
|
unknown
|
||
|
https://www.linkedin.com/directory/products?trk=homepage-basic_directory_productsDirectoryUrl
|
unknown
|
||
|
https://business.linkedin.com/talent-solutions?src=li-footer&utm_source=linkedin&utm_medium=
|
unknown
|
||
|
https://www.linkedin.com/directory/news?trk=homepage-basic_directory_newsDirectoryUrl
|
unknown
|
||
|
https://zw.linkedin.com/
|
unknown
|
||
|
https://co.linkedin.com/
|
unknown
|
||
|
https://ru.linkedin.com/
|
unknown
|
||
|
https://ca.linkedin.com/
|
unknown
|
||
|
https://ke.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/career-development-5?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://www.linkedin.com/mypreferences/g/guest-cookies
|
unknown
|
||
|
https://www.linkedin.com/products?trk=homepage-basic_directory_productsHomeUrl
|
unknown
|
||
|
https://static.licdn.com/aero-v1/sc/h/7kb6sn3tm4cx918cx9a5jlb0
|
unknown
|
||
|
https://static.licdn.com/aero-v1/sc/h/8wykgzgbqy0t3fnkgborvz54u
|
unknown
|
||
|
https://de.linkedin.com/
|
unknown
|
||
|
https://static.licdn.com/aero-v1/sc/h/2r8kd5zqpi905lkzsshdlvvn5
|
unknown
|
||
|
https://www.linkedin.com/jobs/retail-associate-jobs-h
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/product-and-manufacturing?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://www.linkedin.com/psettings/guest-controls?trk=homepage-basic_footer-guest-controls
|
unknown
|
||
|
https://business.linkedin.com/marketing-solutions?src=li-footer&utm_source=linkedin&utm_medi
|
unknown
|
||
|
https://www.linkedin.com/help/linkedin?lang=en&trk=homepage-basic_directory_helpCenterUrl
|
unknown
|
||
|
https://pk.linkedin.com/
|
unknown
|
||
|
https://jp.linkedin.com/
|
unknown
|
||
|
https://www.linkedin.com/learning/topics/human-resources-3?trk=homepage-basic_learning-cta
|
unknown
|
||
|
https://static.licdn.com/aero-v1/sc/h/al2o9zrvru7aqj8e1x2rzsrca
|
unknown
|
||
|
https://www.linkedin.com/jobs/real-estate-jobs-h
|
unknown
|
There are 90 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
linkedin.com
|
13.107.42.14
|
||
|
www.linkedin.com
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
91.165.188.74
|
unknown
|
France
|
|
|
|
2.82.8.80
|
unknown
|
Portugal
|
|
|
|
70.160.67.203
|
unknown
|
United States
|
|
|
|
75.143.236.149
|
unknown
|
United States
|
|
|
|
83.110.223.61
|
unknown
|
United Arab Emirates
|
|
|
|
84.215.202.8
|
unknown
|
Norway
|
|
|
|
184.182.66.109
|
unknown
|
United States
|
|
|
|
161.129.37.43
|
unknown
|
United States
|
|
|
|
92.186.69.229
|
unknown
|
France
|
|
|
|
174.4.89.3
|
unknown
|
Canada
|
|
|
|
161.142.103.187
|
unknown
|
Malaysia
|
|
|
|
116.74.164.144
|
unknown
|
India
|
|
|
|
76.185.109.16
|
unknown
|
United States
|
|
|
|
114.143.176.236
|
unknown
|
India
|
|
|
|
24.234.220.88
|
unknown
|
United States
|
|
|
|
14.192.241.76
|
unknown
|
Malaysia
|
|
|
|
123.3.240.16
|
unknown
|
Australia
|
|
|
|
173.88.135.179
|
unknown
|
United States
|
|
|
|
47.34.30.133
|
unknown
|
United States
|
|
|
|
183.87.163.165
|
unknown
|
India
|
|
|
|
70.49.205.198
|
unknown
|
Canada
|
|
|
|
184.181.75.148
|
unknown
|
United States
|
|
|
|
124.149.143.189
|
unknown
|
Australia
|
|
|
|
84.35.26.14
|
unknown
|
Netherlands
|
|
|
|
37.14.229.220
|
unknown
|
Spain
|
|
|
|
102.159.223.197
|
unknown
|
Tunisia
|
|
|
|
165.120.169.171
|
unknown
|
United States
|
|
|
|
79.92.15.6
|
unknown
|
France
|
|
|
|
68.203.69.96
|
unknown
|
United States
|
|
|
|
64.121.161.102
|
unknown
|
United States
|
|
|
|
96.56.197.26
|
unknown
|
United States
|
|
|
|
178.175.187.254
|
unknown
|
Moldova Republic of
|
|
|
|
186.64.67.30
|
unknown
|
Argentina
|
|
|
|
188.28.19.84
|
unknown
|
United Kingdom
|
|
|
|
125.99.76.102
|
unknown
|
India
|
|
|
|
103.87.128.228
|
unknown
|
India
|
|
|
|
86.248.228.57
|
unknown
|
France
|
|
|
|
59.28.84.65
|
unknown
|
Korea Republic of
|
|
|
|
76.86.31.59
|
unknown
|
United States
|
|
|
|
147.147.30.126
|
unknown
|
United Kingdom
|
|
|
|
96.87.28.170
|
unknown
|
United States
|
|
|
|
75.109.111.89
|
unknown
|
United States
|
|
|
|
78.92.133.215
|
unknown
|
Hungary
|
|
|
|
88.126.94.4
|
unknown
|
France
|
|
|
|
124.122.47.148
|
unknown
|
Thailand
|
|
|
|
85.57.212.13
|
unknown
|
Spain
|
|
|
|
47.205.25.170
|
unknown
|
United States
|
|
|
|
95.45.50.93
|
unknown
|
Ireland
|
|
|
|
80.12.88.148
|
unknown
|
France
|
|
|
|
69.133.162.35
|
unknown
|
United States
|
|
|
|
151.62.238.176
|
unknown
|
Italy
|
|
|
|
205.237.67.69
|
unknown
|
Canada
|
|
|
|
201.143.215.69
|
unknown
|
Mexico
|
|
|
|
94.30.98.134
|
unknown
|
United Kingdom
|
|
|
|
76.178.148.107
|
unknown
|
United States
|
|
|
|
69.242.31.249
|
unknown
|
United States
|
|
|
|
85.104.105.67
|
unknown
|
Turkey
|
|
|
|
92.239.81.124
|
unknown
|
United Kingdom
|
|
|
|
76.16.49.134
|
unknown
|
United States
|
|
|
|
201.244.108.183
|
unknown
|
Colombia
|
|
|
|
103.42.86.42
|
unknown
|
India
|
|
|
|
103.144.201.56
|
unknown
|
unknown
|
|
|
|
116.120.145.170
|
unknown
|
Korea Republic of
|
|
|
|
103.139.242.6
|
unknown
|
India
|
|
|
|
70.28.50.223
|
unknown
|
Canada
|
|
|
|
98.145.23.67
|
unknown
|
United States
|
|
|
|
81.229.117.95
|
unknown
|
Sweden
|
|
|
|
89.129.109.27
|
unknown
|
Spain
|
|
|
|
45.51.102.225
|
unknown
|
United States
|
|
|
|
27.109.19.90
|
unknown
|
India
|
|
|
|
122.186.210.254
|
unknown
|
India
|
|
|
|
79.77.142.22
|
unknown
|
United Kingdom
|
|
|
|
122.184.143.86
|
unknown
|
India
|
|
|
|
50.68.186.195
|
unknown
|
Canada
|
|
|
|
213.55.33.103
|
unknown
|
France
|
|
|
|
180.151.229.230
|
unknown
|
India
|
|
|
|
12.172.173.82
|
unknown
|
United States
|
|
|
|
47.199.241.39
|
unknown
|
United States
|
|
|
|
79.168.224.165
|
unknown
|
Portugal
|
|
|
|
199.27.66.213
|
unknown
|
United States
|
|
|
|
176.142.207.63
|
unknown
|
France
|
|
|
|
90.29.86.138
|
unknown
|
France
|
|
|
|
149.74.159.67
|
unknown
|
United States
|
|
|
|
174.58.146.57
|
unknown
|
United States
|
|
|
|
78.160.146.127
|
unknown
|
Turkey
|
|
|
|
223.166.13.95
|
unknown
|
China
|
|
|
|
58.186.75.42
|
unknown
|
Viet Nam
|
|
|
|
65.95.141.84
|
unknown
|
Canada
|
|
|
|
50.68.204.71
|
unknown
|
Canada
|
|
|
|
71.38.155.217
|
unknown
|
United States
|
|
|
|
117.195.29.126
|
unknown
|
India
|
|
|
|
220.240.164.182
|
unknown
|
Australia
|
|
|
|
103.123.223.133
|
unknown
|
India
|
|
|
|
198.2.51.242
|
unknown
|
United States
|
|
|
|
27.99.32.26
|
unknown
|
Australia
|
|
|
|
94.204.232.135
|
unknown
|
United Arab Emirates
|
|
|
|
109.50.149.241
|
unknown
|
Portugal
|
|
|
|
69.123.4.221
|
unknown
|
United States
|
|
|
|
74.136.224.98
|
unknown
|
United States
|
|
|
|
192.168.2.1
|
unknown
|
unknown
|
There are 90 hidden IPs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C9B156F66
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHivePermissionsCorrect
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHiveOwnerCorrect
|
||
|
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
|
PendingFileRenameOperations
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiOverridePath
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile
|
WritePermissionsCheck
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile
|
ProviderSyncId
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProgramId
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
FileId
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LongPathHash
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Name
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Publisher
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Version
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinFileVersion
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinaryType
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductName
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductVersion
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LinkDate
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinProductVersion
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Size
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Language
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsPeFile
|
||
|
\REGISTRY\A\{dea1b943-ce85-ce24-1c0a-a12544ea6c4b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsOsComponent
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C9B156F66
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C9B156F66
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceId
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
ApplicationFlags
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000C9B156F66
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
f0ee5158
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
c5718116
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
c730a16a
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
7f8cc60f
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
2848985
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
ba38eee0
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
7dcde673
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
8fa73eae
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
f0ee5158
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
f0ee5158
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
f0ee5158
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Dgynqjyi
|
f0ee5158
|
There are 39 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
10F0000
|
heap
|
page read and write
|
|
|
|
B3A000
|
heap
|
page read and write
|
|
|
|
331A000
|
heap
|
page read and write
|
||
|
254E3E7B000
|
heap
|
page read and write
|
||
|
330F000
|
stack
|
page read and write
|
||
|
64C7000
|
heap
|
page read and write
|
||
|
1D350D00000
|
trusted library allocation
|
page read and write
|
||
|
2D1000
|
stack
|
page read and write
|
||
|
6614000
|
heap
|
page read and write
|
||
|
254E4113000
|
heap
|
page read and write
|
||
|
95F000
|
direct allocation
|
page read and write
|
||
|
F14000
|
heap
|
page read and write
|
||
|
A80000
|
heap
|
page read and write
|
||
|
55B6000
|
heap
|
page read and write
|
||
|
841000
|
stack
|
page read and write
|
||
|
F20000
|
heap
|
page read and write
|
||
|
10FA000
|
heap
|
page read and write
|
||
|
359F000
|
stack
|
page read and write
|
||
|
1030000
|
heap
|
page read and write
|
||
|
3470000
|
heap
|
page read and write
|
||
|
127B000
|
stack
|
page read and write
|
||
|
6C2B000
|
heap
|
page read and write
|
||
|
BA0000
|
heap
|
page read and write
|
||
|
FAB000
|
stack
|
page read and write
|
||
|
10033000
|
unkown
|
page read and write
|
||
|
B0F000
|
stack
|
page read and write
|
||
|
C2E000
|
stack
|
page read and write
|
||
|
B30000
|
heap
|
page read and write
|
||
|
116F000
|
heap
|
page read and write
|
||
|
2DB0000
|
heap
|
page read and write
|
||
|
9C0000
|
heap
|
page read and write
|
||
|
1070000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
254E3E13000
|
unkown
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
1D350070000
|
heap
|
page read and write
|
||
|
9A4000
|
heap
|
page read and write
|
||
|
FEF000
|
stack
|
page read and write
|
||
|
1D350D70000
|
trusted library allocation
|
page read and write
|
||
|
87EC97C000
|
stack
|
page read and write
|
||
|
1D350FE0000
|
trusted library allocation
|
page read and write
|
||
|
254E3E7A000
|
heap
|
page read and write
|
||
|
7427000
|
heap
|
page read and write
|
||
|
6C16000
|
heap
|
page read and write
|
||
|
6F1E000
|
heap
|
page read and write
|
||
|
2CEB000
|
stack
|
page read and write
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
BB1000
|
stack
|
page read and write
|
||
|
254E3E78000
|
heap
|
page read and write
|
||
|
59F9000
|
heap
|
page read and write
|
||
|
800000
|
heap
|
page read and write
|
||
|
6F1E000
|
heap
|
page read and write
|
||
|
F9E000
|
stack
|
page read and write
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
710000
|
heap
|
page read and write
|
||
|
10033000
|
unkown
|
page read and write
|
||
|
87EC77C000
|
stack
|
page read and write
|
||
|
10033000
|
unkown
|
page read and write
|
||
|
3630000
|
remote allocation
|
page read and write
|
||
|
2CC000
|
stack
|
page read and write
|
||
|
AEF000
|
unkown
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
10036000
|
unkown
|
page readonly
|
||
|
64D3000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
4E2F000
|
stack
|
page read and write
|
||
|
7122000
|
heap
|
page read and write
|
||
|
F14000
|
heap
|
page read and write
|
||
|
9A4000
|
heap
|
page read and write
|
||
|
520000
|
heap
|
page read and write
|
||
|
B2E000
|
stack
|
page read and write
|
||
|
1D350FD0000
|
heap
|
page readonly
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
FD0000
|
heap
|
page read and write
|
||
|
6513000
|
heap
|
page read and write
|
||
|
F14000
|
heap
|
page read and write
|
||
|
642F000
|
heap
|
page read and write
|
||
|
64C7000
|
heap
|
page read and write
|
||
|
9DA000
|
heap
|
page read and write
|
||
|
F2A000
|
heap
|
page read and write
|
||
|
64D3000
|
heap
|
page read and write
|
||
|
651F000
|
heap
|
page read and write
|
||
|
1D350148000
|
heap
|
page read and write
|
||
|
E8F000
|
stack
|
page read and write
|
||
|
52A000
|
heap
|
page read and write
|
||
|
2FD000
|
stack
|
page read and write
|
||
|
34F0000
|
heap
|
page read and write
|
||
|
940000
|
direct allocation
|
page read and write
|
||
|
254E3F02000
|
trusted library allocation
|
page read and write
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
1D350D80000
|
trusted library allocation
|
page read and write
|
||
|
2CAC000
|
stack
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
1D0000
|
heap
|
page read and write
|
||
|
5CFB000
|
heap
|
page read and write
|
||
|
4FB0000
|
heap
|
page read and write
|
||
|
441000
|
stack
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
F14000
|
heap
|
page read and write
|
||
|
64D3000
|
heap
|
page read and write
|
||
|
B80000
|
heap
|
page read and write
|
||
|
331A000
|
heap
|
page read and write
|
||
|
10033000
|
unkown
|
page read and write
|
||
|
65EC000
|
heap
|
page read and write
|
||
|
1D351040000
|
trusted library allocation
|
page read and write
|
||
|
E4E000
|
stack
|
page read and write
|
||
|
F20000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
306D000
|
heap
|
page read and write
|
||
|
254E4002000
|
heap
|
page read and write
|
||
|
64C7000
|
heap
|
page read and write
|
||
|
B40000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
10033000
|
unkown
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
6511000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
3486000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
64D3000
|
heap
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
C86000
|
heap
|
page read and write
|
||
|
9A4000
|
heap
|
page read and write
|
||
|
930000
|
heap
|
page read and write
|
||
|
6411000
|
heap
|
page read and write
|
||
|
254E4113000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
3300000
|
heap
|
page read and write
|
||
|
1113000
|
heap
|
page read and write
|
||
|
6C17000
|
heap
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
A90000
|
heap
|
page read and write
|
||
|
9A4000
|
heap
|
page read and write
|
||
|
10034000
|
unkown
|
page write copy
|
||
|
4AC0000
|
heap
|
page read and write
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
F14000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
254E4102000
|
heap
|
page read and write
|
||
|
1D350D10000
|
trusted library allocation
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
FD0000
|
heap
|
page read and write
|
||
|
610000
|
heap
|
page read and write
|
||
|
10033000
|
unkown
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
48F1000
|
heap
|
page read and write
|
||
|
F14000
|
heap
|
page read and write
|
||
|
BAE000
|
stack
|
page read and write
|
||
|
10036000
|
unkown
|
page readonly
|
||
|
1D350FF0000
|
trusted library allocation
|
page read and write
|
||
|
E30000
|
heap
|
page read and write
|
||
|
65EC000
|
heap
|
page read and write
|
||
|
BEE000
|
stack
|
page read and write
|
||
|
64B7000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
1290000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
9A0000
|
heap
|
page read and write
|
||
|
9A4000
|
heap
|
page read and write
|
||
|
C60000
|
remote allocation
|
page read and write
|
||
|
254E4102000
|
heap
|
page read and write
|
||
|
64D3000
|
heap
|
page read and write
|
||
|
254E4102000
|
heap
|
page read and write
|
||
|
64B5000
|
heap
|
page read and write
|
||
|
1D3504C5000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
1D35014C000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
B6F000
|
stack
|
page read and write
|
||
|
5BD000
|
stack
|
page read and write
|
||
|
F00000
|
heap
|
page read and write
|
||
|
64C7000
|
heap
|
page read and write
|
||
|
64C7000
|
heap
|
page read and write
|
||
|
74F000
|
stack
|
page read and write
|
||
|
FC5000
|
heap
|
page read and write
|
||
|
F50000
|
remote allocation
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
CAC3B1B000
|
stack
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
10036000
|
unkown
|
page readonly
|
||
|
7123000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
362E000
|
stack
|
page read and write
|
||
|
9B8000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
254E3D10000
|
heap
|
page read and write
|
||
|
334F000
|
stack
|
page read and write
|
||
|
129E000
|
stack
|
page read and write
|
||
|
5F0C000
|
heap
|
page read and write
|
||
|
32DF000
|
stack
|
page read and write
|
||
|
3640000
|
heap
|
page read and write
|
||
|
254E3E3A000
|
heap
|
page read and write
|
||
|
104E000
|
stack
|
page read and write
|
||
|
254E3E00000
|
unkown
|
page read and write
|
||
|
65FC000
|
heap
|
page read and write
|
||
|
F14000
|
heap
|
page read and write
|
||
|
860000
|
heap
|
page read and write
|
||
|
E9B000
|
stack
|
page read and write
|
||
|
950000
|
heap
|
page read and write
|
||
|
E3A000
|
heap
|
page read and write
|
||
|
87EC679000
|
stack
|
page read and write
|
||
|
C80000
|
heap
|
page read and write
|
||
|
325F000
|
stack
|
page read and write
|
||
|
980000
|
heap
|
page read and write
|
||
|
10033000
|
unkown
|
page read and write
|
||
|
8E0000
|
heap
|
page read and write
|
||
|
10D0000
|
heap
|
page read and write
|
||
|
D30000
|
heap
|
page read and write
|
||
|
2D90000
|
heap
|
page read and write
|
||
|
64B4000
|
heap
|
page read and write
|
||
|
355E000
|
stack
|
page read and write
|
||
|
651F000
|
heap
|
page read and write
|
||
|
4F10000
|
heap
|
page read and write
|
||
|
3480000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
10034000
|
unkown
|
page write copy
|
||
|
10034000
|
unkown
|
page write copy
|
||
|
10F0000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
10036000
|
unkown
|
page readonly
|
||
|
48F1000
|
heap
|
page read and write
|
||
|
46E0000
|
trusted library allocation
|
page read and write
|
||
|
370000
|
heap
|
page read and write
|
||
|
CAC4079000
|
stack
|
page read and write
|
||
|
FAF000
|
stack
|
page read and write
|
||
|
10036000
|
unkown
|
page readonly
|
||
|
F34000
|
heap
|
page read and write
|
||
|
1D350FC0000
|
trusted library allocation
|
page read and write
|
||
|
254E3F15000
|
trusted library allocation
|
page read and write
|
||
|
10036000
|
unkown
|
page readonly
|
||
|
73E000
|
stack
|
page read and write
|
||
|
65EC000
|
heap
|
page read and write
|
||
|
254E3F23000
|
heap
|
page read and write
|
||
|
450000
|
heap
|
page read and write
|
||
|
10034000
|
unkown
|
page write copy
|
||
|
F34000
|
heap
|
page read and write
|
||
|
64B5000
|
heap
|
page read and write
|
||
|
B6F000
|
stack
|
page read and write
|
||
|
6718000
|
heap
|
page read and write
|
||
|
254E3E7F000
|
heap
|
page read and write
|
||
|
3057000
|
heap
|
page read and write
|
||
|
10034000
|
unkown
|
page write copy
|
||
|
671D000
|
heap
|
page read and write
|
||
|
955000
|
heap
|
page read and write
|
||
|
3050000
|
heap
|
page read and write
|
||
|
3460000
|
heap
|
page read and write
|
||
|
1D35012D000
|
heap
|
page read and write
|
||
|
4FB000
|
stack
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
65EC000
|
heap
|
page read and write
|
||
|
330E000
|
stack
|
page read and write
|
||
|
560000
|
heap
|
page read and write
|
||
|
7424000
|
heap
|
page read and write
|
||
|
10034000
|
unkown
|
page write copy
|
||
|
254E3F00000
|
trusted library allocation
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
C70000
|
heap
|
page read and write
|
||
|
254E3E3A000
|
heap
|
page read and write
|
||
|
876000
|
heap
|
page read and write
|
||
|
F14000
|
heap
|
page read and write
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
2DFE000
|
stack
|
page read and write
|
||
|
90F000
|
stack
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
C6F000
|
stack
|
page read and write
|
||
|
E5C000
|
stack
|
page read and write
|
||
|
254E3E29000
|
heap
|
page read and write
|
||
|
CAC3FFE000
|
stack
|
page read and write
|
||
|
9A4000
|
heap
|
page read and write
|
||
|
F14000
|
heap
|
page read and write
|
||
|
940000
|
heap
|
page read and write
|
||
|
65F4000
|
heap
|
page read and write
|
||
|
3670000
|
heap
|
page read and write
|
||
|
B3B000
|
stack
|
page read and write
|
||
|
6513000
|
heap
|
page read and write
|
||
|
1D3504C9000
|
heap
|
page read and write
|
||
|
1D3504D0000
|
trusted library allocation
|
page read and write
|
||
|
254E4113000
|
heap
|
page read and write
|
||
|
6423000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
10033000
|
unkown
|
page read and write
|
||
|
123C000
|
stack
|
page read and write
|
||
|
1D3500E9000
|
heap
|
page read and write
|
||
|
CD0000
|
heap
|
page read and write
|
||
|
6C2D000
|
heap
|
page read and write
|
||
|
10034000
|
unkown
|
page write copy
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
254E4102000
|
heap
|
page read and write
|
||
|
5DE000
|
stack
|
page read and write
|
||
|
F6E000
|
stack
|
page read and write
|
||
|
116F000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
64B5000
|
heap
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
1D3502B0000
|
heap
|
page read and write
|
||
|
9A4000
|
heap
|
page read and write
|
||
|
941000
|
direct allocation
|
page execute read
|
||
|
5FC000
|
stack
|
page read and write
|
||
|
4BC000
|
stack
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
F6C000
|
stack
|
page read and write
|
||
|
4E0000
|
heap
|
page read and write
|
||
|
9A4000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
3310000
|
heap
|
page read and write
|
||
|
254E4013000
|
heap
|
page read and write
|
||
|
9C0000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
260000
|
heap
|
page read and write
|
||
|
3310000
|
heap
|
page read and write
|
||
|
6411000
|
heap
|
page read and write
|
||
|
4F0000
|
heap
|
page read and write
|
||
|
10036000
|
unkown
|
page readonly
|
||
|
BAC000
|
stack
|
page read and write
|
||
|
83C000
|
stack
|
page read and write
|
||
|
1190000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
3380000
|
heap
|
page read and write
|
||
|
10033000
|
unkown
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
6714000
|
heap
|
page read and write
|
||
|
64B5000
|
heap
|
page read and write
|
||
|
10F0000
|
heap
|
page read and write
|
||
|
B2E000
|
stack
|
page read and write
|
||
|
99E000
|
unkown
|
page read and write
|
||
|
660000
|
heap
|
page read and write
|
||
|
87EC2F9000
|
stack
|
page read and write
|
||
|
64B5000
|
heap
|
page read and write
|
||
|
254E4100000
|
heap
|
page read and write
|
||
|
64C7000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
10034000
|
unkown
|
page write copy
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
AFC000
|
stack
|
page read and write
|
||
|
10033000
|
unkown
|
page read and write
|
||
|
61A000
|
heap
|
page read and write
|
||
|
1D350080000
|
trusted library allocation
|
page read and write
|
||
|
254E3E78000
|
heap
|
page read and write
|
||
|
87ECA7C000
|
stack
|
page read and write
|
||
|
77F000
|
stack
|
page read and write
|
||
|
6521000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
F3A000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
ACE000
|
stack
|
page read and write
|
||
|
254E4116000
|
heap
|
page read and write
|
||
|
CAC3EF9000
|
stack
|
page read and write
|
||
|
1D350145000
|
heap
|
page read and write
|
||
|
550000
|
heap
|
page read and write
|
||
|
2D8E000
|
stack
|
page read and write
|
||
|
254E3E89000
|
heap
|
page read and write
|
||
|
1D3502D0000
|
heap
|
page read and write
|
||
|
1040000
|
remote allocation
|
page read and write
|
||
|
1191000
|
heap
|
page read and write
|
||
|
1191000
|
heap
|
page read and write
|
||
|
254E3E3B000
|
heap
|
page read and write
|
||
|
10034000
|
unkown
|
page write copy
|
||
|
FB0000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
10036000
|
unkown
|
page readonly
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
1190000
|
heap
|
page read and write
|
||
|
FD0000
|
heap
|
page read and write
|
||
|
671D000
|
heap
|
page read and write
|
||
|
10036000
|
unkown
|
page readonly
|
||
|
2C40000
|
heap
|
page read and write
|
||
|
10034000
|
unkown
|
page write copy
|
||
|
4C40000
|
heap
|
page read and write
|
||
|
64B5000
|
heap
|
page read and write
|
||
|
F34000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
8D0000
|
heap
|
page read and write
|
||
|
3EE000
|
stack
|
page read and write
|
||
|
962000
|
direct allocation
|
page readonly
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
254E4202000
|
heap
|
page read and write
|
||
|
1D350124000
|
heap
|
page read and write
|
||
|
254E3E3B000
|
heap
|
page read and write
|
||
|
254E4000000
|
heap
|
page read and write
|
||
|
1D35012B000
|
heap
|
page read and write
|
||
|
6411000
|
heap
|
page read and write
|
||
|
254E3E7A000
|
heap
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
1230000
|
heap
|
page read and write
|
||
|
6C12000
|
heap
|
page read and write
|
||
|
303E000
|
stack
|
page read and write
|
||
|
87EBE8D000
|
stack
|
page read and write
|
||
|
254E3CB0000
|
trusted library allocation
|
page read and write
|
||
|
10000000
|
unkown
|
page readonly
|
||
|
65EC000
|
heap
|
page read and write
|
||
|
C3C000
|
stack
|
page read and write
|
||
|
95A000
|
direct allocation
|
page readonly
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
1080000
|
heap
|
page read and write
|
||
|
CAC3F7F000
|
stack
|
page read and write
|
||
|
10036000
|
unkown
|
page readonly
|
||
|
1D3500F1000
|
heap
|
page read and write
|
||
|
65E4000
|
heap
|
page read and write
|
||
|
F2F000
|
heap
|
page read and write
|
||
|
86B000
|
heap
|
page read and write
|
||
|
1D35012B000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
770000
|
heap
|
page read and write
|
||
|
64D3000
|
heap
|
page read and write
|
||
|
254E3CA0000
|
heap
|
page read and write
|
||
|
87EC87C000
|
stack
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
930000
|
heap
|
page read and write
|
||
|
12A0000
|
remote allocation
|
page read and write
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
10CF000
|
stack
|
page read and write
|
||
|
329E000
|
stack
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
346A000
|
heap
|
page read and write
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
C7B000
|
stack
|
page read and write
|
||
|
1D3500E0000
|
heap
|
page read and write
|
||
|
64C3000
|
heap
|
page read and write
|
||
|
10001000
|
unkown
|
page execute read
|
||
|
1D35012B000
|
heap
|
page read and write
|
||
|
930000
|
direct allocation
|
page execute read
|
||
|
65EC000
|
heap
|
page read and write
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
1D3504C0000
|
heap
|
page read and write
|
||
|
3FD000
|
stack
|
page read and write
|
||
|
290000
|
heap
|
page read and write
|
||
|
43C000
|
stack
|
page read and write
|
||
|
F14000
|
heap
|
page read and write
|
There are 431 hidden memdumps, click here to show them.