Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
qbot1.dll
|
PE32 executable (DLL) (console) Intel 80386, for MS Windows
|
initial sample
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_0be69799\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_13ba9799\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_1c92a005\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_f72750b22a9214184114f6be25e810eecaece948_82810a17_1d6aa12e\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER71E0.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sat Jun 3 05:59:44 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER721F.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sat Jun 3 05:59:44 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7378.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER73A7.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7415.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7445.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9641.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sat Jun 3 05:59:54 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9670.tmp.dmp
|
Mini DuMP crash report, 14 streams, Sat Jun 3 05:59:53 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER994F.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER996E.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A1B.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A2B.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 63843 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\NKLS59D5.htm
|
HTML document, Unicode text, UTF-8 text, with very long lines (1206), with CRLF, LF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\t5[1]
|
ASCII text, with no line terminators
|
modified
|
||
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve.tmp
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
There are 15 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Windows\System32\loaddll32.exe
|
loaddll32.exe "C:\Users\user\Desktop\qbot1.dll"
|
||
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\qbot1.dll",#1
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\qbot1.dll,lcopy_block_row
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\qbot1.dll",#1
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 660
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 668
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\qbot1.dll,lcopy_sample_rows
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\qbot1.dll,ldiv_round_up
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\qbot1.dll",lcopy_block_row
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\qbot1.dll",lcopy_sample_rows
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\qbot1.dll",ldiv_round_up
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\qbot1.dll",next
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\qbot1.dll",lround_up
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\qbot1.dll",lpeg_write_tables
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7292 -s 656
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7336 -s 656
|
||
C:\Windows\SysWOW64\wermgr.exe
|
C:\Windows\SysWOW64\wermgr.exe
|
||
C:\Windows\SysWOW64\ipconfig.exe
|
ipconfig /all
|
||
C:\Windows\SysWOW64\whoami.exe
|
whoami /all
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
C:\Windows\System32\msiexec.exe
|
C:\Windows\system32\msiexec.exe /V
|
There are 13 hidden processes, click here to show them.
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://www.cisco.com/c/en_eg/index.html
|
unknown
|
||
https://www.youtube.com/user/cisco
|
unknown
|
||
https://www.cisco.com/c/en/us/solutions/service-provider/routed-optical-networking/index.html?ccid=c
|
unknown
|
||
https://www.cisco.com/c/ar_ae/index.html
|
unknown
|
||
https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2023/m05/cisco-launches-program-for-customers-and-p
|
unknown
|
||
https://www.cisco.com/c/en_sg/index.html
|
unknown
|
||
https://www.cisco.com/c/en_dz/index.html
|
unknown
|
||
https://www.cisco.com/c/hu_hu/index.html
|
unknown
|
||
https://www.cisco.com/site/in/en/index.html
|
unknown
|
||
https://software.cisco.com/download/navigator.html
|
unknown
|
||
https://www.cisco.com/c/en/us/about/contact-cisco.html
|
unknown
|
||
https://www.schema.org
|
unknown
|
||
https://www.cisco.com/c/en/us/partners/connect-with-a-partner.html
|
unknown
|
||
https://www.cisco.com/c/en/us/about/sitemap.html
|
unknown
|
||
https://www.cisco.com/c/sv_se/index.html
|
unknown
|
||
https://www.cisco.com/c/ru_ru/index.html
|
unknown
|
||
https://learninglocator.cloudapps.cisco.com/#/home
|
unknown
|
||
https://www.cisco.com/c/pl_pl/index.html
|
unknown
|
||
https://blogs.cisco.com/security/now-is-the-time-to-step-up-your-security?utm_medium=web-referral&ut
|
unknown
|
||
https://www.cisco.com
|
unknown
|
||
https://www.cisco.com/c/fr_dz/index.html
|
unknown
|
||
https://www.cisco.com/c/de_ch/index.html
|
unknown
|
||
http://pdx-col.eum-appdynamics.com
|
unknown
|
||
https://www.cisco.com/site/fr/fr/index.html
|
unknown
|
||
https://www.cisco.com/c/nl_nl/index.html
|
unknown
|
||
https://www.cisco.com/site/au/en/index.html
|
unknown
|
||
https://www.cisco.com/c/es_ec/index.html
|
unknown
|
||
https://www.cisco.com/c/en/us/about/legal/trademarks.html
|
unknown
|
||
https://www.cisco.com/c/en/us/about.html
|
unknown
|
||
https://www.cisco.com/c/pt_br/index.html
|
unknown
|
||
https://www.cisco.com/c/th_th/index.html
|
unknown
|
||
https://www.cisco.com/site/de/de/index.html
|
unknown
|
||
https://search.cisco.com/search?query=
|
unknown
|
||
http://schema.org/ImageObject
|
unknown
|
||
https://www.ciscolive.com/global.html?CID=cdchp&TEAM=global_events&MEDIUM=digital_direct&CAMPAIGN=bt
|
unknown
|
||
https://www.cisco.com/c/en_my/index.html
|
unknown
|
||
https://www.cisco.com/c/es_es/index.html
|
unknown
|
||
https://www.cisco.com/c/it_it/index.html
|
unknown
|
||
https://www.cisco.com/c/en_il/index.html
|
unknown
|
||
https://www.cisco.com/site/cn/zh/index.html
|
unknown
|
||
https://newsroom.cisco.com/c/r/newsroom/en/us/index.html
|
unknown
|
||
https://www.cisco.com/c/en_hk/index.html
|
unknown
|
||
https://www.cisco.com/c/de_at/index.html
|
unknown
|
||
https://www.cisco.com/c/es_pa/index.html
|
unknown
|
||
https://www.cisco.com/c/da_dk/index.html
|
unknown
|
||
https://www.cisco.com/c/ru_ua/index.html
|
unknown
|
||
https://www.instagram.com/cisco/
|
unknown
|
||
https://www.cisco.com/c/en/us/about/accessibility.html
|
unknown
|
||
https://www.cisco.com/c/es_mx/index.html
|
unknown
|
||
https://www.cisco.com/c/fr_be/index.html
|
unknown
|
||
https://www.cisco.com/c/tr_tr/index.html
|
unknown
|
||
https://ciscocx.qualtrics.com/jfe/form/SV_0Tcp9VU8pUm4lBY?Ref=/c/en/us/index.html
|
unknown
|
||
https://www.cisco.com/c/en_ph/index.html
|
unknown
|
||
https://www.cisco.com/c/es_ar/index.html
|
unknown
|
||
https://www.cisco.com/c/no_no/index.html
|
unknown
|
||
https://www.cisco.com/c/es_cr/index.html
|
unknown
|
||
https://twitter.com/Cisco/
|
unknown
|
||
https://www.cisco.com/c/ar_eg/index.html
|
unknown
|
||
https://www.cisco.com/c/ko_kr/index.html
|
unknown
|
||
https://www.cisco.com/c/ro_ro/index.html
|
unknown
|
||
https://www.cisco.com/site/ca/fr/index.html
|
unknown
|
||
https://www.cisco.com/c/nl_be/index.html
|
unknown
|
||
https://duo.com/solutions/risk-based-authentication?utm_medium=web-referral&utm_source=cisco#eyJoYXN
|
unknown
|
||
https://www.cisco.com/c/es_co/index.html
|
unknown
|
||
https://www.cisco.com/c/en/us/about/legal/terms-conditions.html
|
unknown
|
||
https://www.cisco.com/c/pt_pt/index.html
|
unknown
|
||
https://www.cisco.com/c/en/us/buy.html
|
unknown
|
||
https://www.cisco.com/c/uk_ua/index.html
|
unknown
|
||
https://cisco.com/
|
72.163.4.185
|
||
https://www.cisco.com/c/es_pe/index.html
|
unknown
|
||
https://www.cisco.com/c/m/en_us/solutions/hybrid-work/workplace-solutions/penn1-lookbook.html?ccid=c
|
unknown
|
||
https://www.cisco.com/c/en/us/training-events/training-certifications.html
|
unknown
|
||
https://www.cisco.com/c/cs_cz/index.html
|
unknown
|
||
https://www.cisco.com/web/fw/i/logo-open-graph.gif
|
unknown
|
||
https://www.cisco.com/c/en/us/about/careers.html
|
unknown
|
||
https://www.cisco.com/c/en_za/index.html
|
unknown
|
||
https://pdx-col.eum-appdynamics.com
|
unknown
|
||
https://community.cisco.com/
|
unknown
|
||
https://blogs.cisco.com/networking/it-leaders-contend-with-secure-multicloud-access-the-2023-global-
|
unknown
|
||
https://www.cisco.com/c/vi_vn/index.html
|
unknown
|
||
http://upx.sf.net
|
unknown
|
||
http://cdn.appdynamics.com
|
unknown
|
||
https://cdn.appdynamics.com
|
unknown
|
||
https://www.cisco.com/c/en/us/about/legal/privacy-full.html
|
unknown
|
||
https://www.cisco.com/c/en/us/about/help.html
|
unknown
|
||
https://www.cisco.com/site/uk/en/index.html
|
unknown
|
||
https://www.cisco.com/c/en/us/solutions/design-zone.html
|
unknown
|
||
https://www.cisco.com/c/en/us/training-events/events.html
|
unknown
|
||
https://www.cisco.com/site/jp/ja/index.html
|
unknown
|
||
https://www.cisco.com/c/es_bz/index.html
|
unknown
|
||
https://www.cisco.com/c/zh_hk/index.html
|
unknown
|
||
https://www.linkedin.com/company/cisco
|
unknown
|
||
https://www.cisco.com/
|
unknown
|
||
https://www.cisco.com/c/fr_ch/index.html
|
unknown
|
||
https://www.cisco.com/site/ca/en/index.html
|
unknown
|
||
https://www.cisco.com/c/dam/en_us/about/supply-chain/cisco-modern-slavery-statement.pdf
|
unknown
|
||
https://www.cisco.com/c/en_ae/index.html
|
unknown
|
||
https://www.cisco.com/c/en_id/index.html
|
unknown
|
||
https://www.cisco.com/c/en_be/index.html
|
unknown
|
||
https://www.cisco.com/c/zh_tw/index.html
|
unknown
|
There are 90 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
c-0001.c-msedge.net
|
13.107.4.50
|
||
cisco.com
|
72.163.4.185
|
||
www.cisco.com
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
38.2.18.164
|
unknown
|
United States
|
||
2.82.8.80
|
unknown
|
Portugal
|
||
70.160.67.203
|
unknown
|
United States
|
||
83.110.223.61
|
unknown
|
United Arab Emirates
|
||
209.171.160.69
|
unknown
|
Canada
|
||
84.215.202.8
|
unknown
|
Norway
|
||
184.182.66.109
|
unknown
|
United States
|
||
200.84.211.255
|
unknown
|
Venezuela
|
||
125.99.69.178
|
unknown
|
India
|
||
174.4.89.3
|
unknown
|
Canada
|
||
121.121.108.120
|
unknown
|
Malaysia
|
||
161.142.103.187
|
unknown
|
Malaysia
|
||
213.64.33.92
|
unknown
|
Sweden
|
||
114.143.176.236
|
unknown
|
India
|
||
24.234.220.88
|
unknown
|
United States
|
||
67.70.120.249
|
unknown
|
Canada
|
||
73.88.173.113
|
unknown
|
United States
|
||
72.205.104.134
|
unknown
|
United States
|
||
117.195.17.148
|
unknown
|
India
|
||
69.160.121.6
|
unknown
|
Jamaica
|
||
176.133.4.230
|
unknown
|
France
|
||
183.87.163.165
|
unknown
|
India
|
||
184.181.75.148
|
unknown
|
United States
|
||
70.49.205.198
|
unknown
|
Canada
|
||
87.221.153.182
|
unknown
|
Spain
|
||
70.50.1.252
|
unknown
|
Canada
|
||
85.101.239.116
|
unknown
|
Turkey
|
||
181.4.225.225
|
unknown
|
Argentina
|
||
100.4.163.158
|
unknown
|
United States
|
||
103.141.50.43
|
unknown
|
India
|
||
70.50.83.216
|
unknown
|
Canada
|
||
92.1.170.110
|
unknown
|
United Kingdom
|
||
64.121.161.102
|
unknown
|
United States
|
||
96.56.197.26
|
unknown
|
United States
|
||
188.28.19.84
|
unknown
|
United Kingdom
|
||
125.99.76.102
|
unknown
|
India
|
||
81.101.185.146
|
unknown
|
United Kingdom
|
||
116.75.63.183
|
unknown
|
India
|
||
124.246.122.199
|
unknown
|
Singapore
|
||
147.147.30.126
|
unknown
|
United Kingdom
|
||
109.130.247.84
|
unknown
|
Belgium
|
||
75.109.111.89
|
unknown
|
United States
|
||
88.126.94.4
|
unknown
|
France
|
||
124.122.47.148
|
unknown
|
Thailand
|
||
66.241.183.99
|
unknown
|
United States
|
||
180.151.19.13
|
unknown
|
India
|
||
94.204.202.106
|
unknown
|
United Arab Emirates
|
||
47.205.25.170
|
unknown
|
United States
|
||
95.45.50.93
|
unknown
|
Ireland
|
||
103.212.19.254
|
unknown
|
India
|
||
85.61.165.153
|
unknown
|
Spain
|
||
91.160.70.68
|
unknown
|
France
|
||
201.143.215.69
|
unknown
|
Mexico
|
||
184.63.133.131
|
unknown
|
United States
|
||
203.109.44.236
|
unknown
|
India
|
||
90.104.151.37
|
unknown
|
France
|
||
201.244.108.183
|
unknown
|
Colombia
|
||
2.49.63.160
|
unknown
|
United Arab Emirates
|
||
103.42.86.42
|
unknown
|
India
|
||
80.6.50.34
|
unknown
|
United Kingdom
|
||
175.156.217.7
|
unknown
|
Singapore
|
||
103.139.242.6
|
unknown
|
India
|
||
27.0.48.233
|
unknown
|
India
|
||
70.28.50.223
|
unknown
|
Canada
|
||
173.17.45.60
|
unknown
|
United States
|
||
81.229.117.95
|
unknown
|
Sweden
|
||
70.64.77.115
|
unknown
|
Canada
|
||
87.252.106.39
|
unknown
|
Italy
|
||
79.77.142.22
|
unknown
|
United Kingdom
|
||
98.163.227.79
|
unknown
|
United States
|
||
93.187.148.45
|
unknown
|
United Kingdom
|
||
186.75.95.6
|
unknown
|
Panama
|
||
50.68.186.195
|
unknown
|
Canada
|
||
45.62.70.33
|
unknown
|
Canada
|
||
83.249.198.100
|
unknown
|
Sweden
|
||
12.172.173.82
|
unknown
|
United States
|
||
47.199.241.39
|
unknown
|
United States
|
||
79.168.224.165
|
unknown
|
Portugal
|
||
199.27.66.213
|
unknown
|
United States
|
||
200.44.198.47
|
unknown
|
Venezuela
|
||
176.142.207.63
|
unknown
|
France
|
||
86.173.2.12
|
unknown
|
United Kingdom
|
||
45.62.75.250
|
unknown
|
Canada
|
||
92.154.17.149
|
unknown
|
France
|
||
90.29.86.138
|
unknown
|
France
|
||
174.58.146.57
|
unknown
|
United States
|
||
223.166.13.95
|
unknown
|
China
|
||
5.192.141.228
|
unknown
|
United Arab Emirates
|
||
65.95.141.84
|
unknown
|
Canada
|
||
75.98.154.19
|
unknown
|
United States
|
||
77.126.99.230
|
unknown
|
Israel
|
||
103.123.223.133
|
unknown
|
India
|
||
74.12.147.139
|
unknown
|
Canada
|
||
92.9.45.20
|
unknown
|
United Kingdom
|
||
113.11.92.30
|
unknown
|
Bangladesh
|
||
77.86.98.236
|
unknown
|
United Kingdom
|
||
103.140.174.20
|
unknown
|
India
|
||
78.192.109.105
|
unknown
|
France
|
||
72.163.4.185
|
cisco.com
|
United States
|
||
192.168.2.1
|
unknown
|
unknown
|
There are 90 hidden IPs, click here to show them.
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000CA191BAA0
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceId
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
ApplicationFlags
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHivePermissionsCorrect
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHiveOwnerCorrect
|
||
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
|
PendingFileRenameOperations
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiOverridePath
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile
|
WritePermissionsCheck
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile
|
ProviderSyncId
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProgramId
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
FileId
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LowerCaseLongPath
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LongPathHash
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Name
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Publisher
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Version
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinFileVersion
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinaryType
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductName
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductVersion
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LinkDate
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinProductVersion
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Size
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Language
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsPeFile
|
||
\REGISTRY\A\{85ef12b6-232d-ecf1-b797-5cc4ee7b0214}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsOsComponent
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000CA191BAA0
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
4e7f040a
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
7be0d444
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
79a1f438
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
c11d935d
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
bc15dcd7
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
4a9bbb2
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
c35cb321
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
31366bfc
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
4e7f040a
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
4e7f040a
|
||
HKEY_CURRENT_USER\Software\Microsoft\Yqolmgiyseypc
|
4e7f040a
|
There are 36 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
60A000
|
heap
|
page read and write
|
||
E70000
|
heap
|
page read and write
|
||
6ADF4000
|
unkown
|
page read and write
|
||
2DB0000
|
heap
|
page read and write
|
||
65FC000
|
heap
|
page read and write
|
||
657C000
|
heap
|
page read and write
|
||
30EA000
|
heap
|
page read and write
|
||
930000
|
heap
|
page read and write
|
||
1001F000
|
direct allocation
|
page read and write
|
||
4F9F000
|
heap
|
page read and write
|
||
7350000
|
heap
|
page read and write
|
||
30BB000
|
stack
|
page read and write
|
||
4F78000
|
heap
|
page read and write
|
||
6ADF4000
|
unkown
|
page read and write
|
||
29D0000
|
heap
|
page read and write
|
||
1BCE4813000
|
unkown
|
page read and write
|
||
7C42000
|
heap
|
page read and write
|
||
98E000
|
unkown
|
page read and write
|
||
4FAA000
|
heap
|
page read and write
|
||
10001000
|
direct allocation
|
page execute read
|
||
E93000
|
heap
|
page read and write
|
||
10022000
|
direct allocation
|
page readonly
|
||
6B21000
|
heap
|
page read and write
|
||
600000
|
heap
|
page read and write
|
||
350F000
|
stack
|
page read and write
|
||
D30000
|
heap
|
page read and write
|
||
2B4BA820000
|
heap
|
page read and write
|
||
6ADC7000
|
unkown
|
page readonly
|
||
4F6C000
|
heap
|
page read and write
|
||
4F9F000
|
heap
|
page read and write
|
||
327F000
|
stack
|
page read and write
|
||
1BCE4A00000
|
heap
|
page read and write
|
||
1BCE4640000
|
trusted library allocation
|
page read and write
|
||
661F000
|
heap
|
page read and write
|
||
840000
|
heap
|
page read and write
|
||
BC0000
|
heap
|
page read and write
|
||
662B000
|
heap
|
page read and write
|
||
6CF000
|
stack
|
page read and write
|
||
7C4B000
|
heap
|
page read and write
|
||
6ADF4000
|
unkown
|
page read and write
|
||
1BCE4B02000
|
heap
|
page read and write
|
||
BCE000
|
stack
|
page read and write
|
||
658C000
|
heap
|
page read and write
|
||
661F000
|
heap
|
page read and write
|
||
658C000
|
heap
|
page read and write
|
||
606D000
|
heap
|
page read and write
|
||
7350000
|
heap
|
page read and write
|
||
661F000
|
heap
|
page read and write
|
||
347A000
|
heap
|
page read and write
|
||
65FD000
|
heap
|
page read and write
|
||
8148000
|
heap
|
page read and write
|
||
2B4BAA99000
|
heap
|
page read and write
|
||
BC0000
|
heap
|
page read and write
|
||
5FB000
|
stack
|
page read and write
|
||
5AF000
|
stack
|
page read and write
|
||
564000
|
heap
|
page read and write
|
||
4FAA000
|
heap
|
page read and write
|
||
2B4BA740000
|
heap
|
page read and write
|
||
7374000
|
heap
|
page read and write
|
||
300E000
|
stack
|
page read and write
|
||
F39CCF9000
|
stack
|
page read and write
|
||
317AFF9000
|
stack
|
page read and write
|
||
4DC000
|
stack
|
page read and write
|
||
6588000
|
heap
|
page read and write
|
||
564000
|
heap
|
page read and write
|
||
4FAA000
|
heap
|
page read and write
|
||
650000
|
heap
|
page read and write
|
||
662D000
|
heap
|
page read and write
|
||
2F0E000
|
stack
|
page read and write
|
||
5E0000
|
direct allocation
|
page execute read
|
||
550000
|
heap
|
page read and write
|
||
661F000
|
heap
|
page read and write
|
||
2CBF000
|
stack
|
page read and write
|
||
7374000
|
heap
|
page read and write
|
||
2B4BAAA0000
|
trusted library allocation
|
page read and write
|
||
C80000
|
heap
|
page read and write
|
||
4F44000
|
heap
|
page read and write
|
||
661F000
|
heap
|
page read and write
|
||
5F61000
|
heap
|
page read and write
|
||
950000
|
heap
|
page read and write
|
||
4F51000
|
heap
|
page read and write
|
||
65FD000
|
heap
|
page read and write
|
||
8EC000
|
stack
|
page read and write
|
||
7350000
|
heap
|
page read and write
|
||
C60000
|
heap
|
page read and write
|
||
6ADFA000
|
unkown
|
page readonly
|
||
661F000
|
heap
|
page read and write
|
||
15C000
|
stack
|
page read and write
|
||
662D000
|
heap
|
page read and write
|
||
1BCE4877000
|
heap
|
page read and write
|
||
658C000
|
heap
|
page read and write
|
||
19B000
|
stack
|
page read and write
|
||
7739000
|
heap
|
page read and write
|
||
8445000
|
heap
|
page read and write
|
||
F11000
|
heap
|
page read and write
|
||
6ADFA000
|
unkown
|
page readonly
|
||
51B000
|
stack
|
page read and write
|
||
7736000
|
heap
|
page read and write
|
||
7374000
|
heap
|
page read and write
|
||
773B000
|
heap
|
page read and write
|
||
6AD81000
|
unkown
|
page execute read
|
||
5F20000
|
trusted library allocation
|
page read and write
|
||
376F000
|
stack
|
page read and write
|
||
3D0000
|
heap
|
page read and write
|
||
1BCE487A000
|
heap
|
page read and write
|
||
7C44000
|
heap
|
page read and write
|
||
4FAA000
|
heap
|
page read and write
|
||
E00000
|
heap
|
page read and write
|
||
E90000
|
heap
|
page read and write
|
||
2C3F000
|
unkown
|
page read and write
|
||
A20000
|
heap
|
page read and write
|
||
8E0000
|
heap
|
page read and write
|
||
6AD80000
|
unkown
|
page readonly
|
||
7374000
|
heap
|
page read and write
|
||
1BCE4838000
|
heap
|
page read and write
|
||
343E000
|
stack
|
page read and write
|
||
4F21000
|
heap
|
page read and write
|
||
5D0000
|
heap
|
page read and write
|
||
EEF000
|
heap
|
page read and write
|
||
1BCE4630000
|
heap
|
page read and write
|
||
2B4BB550000
|
trusted library allocation
|
page read and write
|
||
F39CE79000
|
stack
|
page read and write
|
||
C4F000
|
stack
|
page read and write
|
||
5FE000
|
stack
|
page read and write
|
||
960000
|
heap
|
page read and write
|
||
658C000
|
heap
|
page read and write
|
||
65FD000
|
heap
|
page read and write
|
||
661F000
|
heap
|
page read and write
|
||
1BCE46A0000
|
heap
|
page read and write
|
||
3116000
|
heap
|
page read and write
|
||
B60000
|
heap
|
page read and write
|
||
6AD81000
|
unkown
|
page execute read
|
||
564000
|
heap
|
page read and write
|
||
657C000
|
heap
|
page read and write
|
||
662D000
|
heap
|
page read and write
|
||
6ADC7000
|
unkown
|
page readonly
|
||
5F20000
|
trusted library allocation
|
page read and write
|
||
3470000
|
heap
|
page read and write
|
||
470000
|
heap
|
page read and write
|
||
EEF000
|
heap
|
page read and write
|
||
105B000
|
heap
|
page read and write
|
||
6ADEA000
|
unkown
|
page readonly
|
||
1BCE487A000
|
heap
|
page read and write
|
||
662D000
|
heap
|
page read and write
|
||
560000
|
heap
|
page read and write
|
||
1BCE4800000
|
unkown
|
page read and write
|
||
2ECD000
|
stack
|
page read and write
|
||
4FA6000
|
heap
|
page read and write
|
||
990000
|
heap
|
page read and write
|
||
6ADEA000
|
unkown
|
page readonly
|
||
6ADD7000
|
unkown
|
page readonly
|
||
7374000
|
heap
|
page read and write
|
||
6ADF7000
|
unkown
|
page readonly
|
||
9EF000
|
stack
|
page read and write
|
||
6ADF3000
|
unkown
|
page readonly
|
||
5F20000
|
trusted library allocation
|
page read and write
|
||
6ADC7000
|
unkown
|
page readonly
|
||
C0F000
|
stack
|
page read and write
|
||
662D000
|
heap
|
page read and write
|
||
A5C000
|
stack
|
page read and write
|
||
9AD000
|
stack
|
page read and write
|
||
1010000
|
heap
|
page read and write
|
||
1BCE4A13000
|
heap
|
page read and write
|
||
6ADC7000
|
unkown
|
page readonly
|
||
6588000
|
heap
|
page read and write
|
||
2C0000
|
heap
|
page read and write
|
||
3190000
|
heap
|
page read and write
|
||
4FAA000
|
heap
|
page read and write
|
||
6C0000
|
heap
|
page read and write
|
||
F39CEFF000
|
stack
|
page read and write
|
||
658C000
|
heap
|
page read and write
|
||
662B000
|
heap
|
page read and write
|
||
564000
|
heap
|
page read and write
|
||
D7F000
|
stack
|
page read and write
|
||
4E90000
|
heap
|
page read and write
|
||
2B4BA5E0000
|
heap
|
page read and write
|
||
D1A000
|
heap
|
page read and write
|
||
8AD000
|
stack
|
page read and write
|
||
64E000
|
stack
|
page read and write
|
||
5F71000
|
heap
|
page read and write
|
||
6588000
|
heap
|
page read and write
|
||
7F37000
|
heap
|
page read and write
|
||
2B4BAA95000
|
heap
|
page read and write
|
||
1BCE4B13000
|
heap
|
page read and write
|
||
4D0000
|
heap
|
page read and write
|
||
3540000
|
heap
|
page read and write
|
||
6ADFA000
|
unkown
|
page readonly
|
||
658C000
|
heap
|
page read and write
|
||
1BCE4923000
|
heap
|
page read and write
|
||
2B4BB310000
|
trusted library allocation
|
page read and write
|
||
FAB000
|
stack
|
page read and write
|
||
D90000
|
heap
|
page read and write
|
||
2FE6000
|
heap
|
page read and write
|
||
6ADF7000
|
unkown
|
page readonly
|
||
69F000
|
stack
|
page read and write
|
||
1050000
|
heap
|
page read and write
|
||
7350000
|
heap
|
page read and write
|
||
2B4BA7B0000
|
trusted library allocation
|
page read and write
|
||
657C000
|
heap
|
page read and write
|
||
7C44000
|
heap
|
page read and write
|
||
6588000
|
heap
|
page read and write
|
||
323E000
|
stack
|
page read and write
|
||
72C000
|
stack
|
page read and write
|
||
6588000
|
heap
|
page read and write
|
||
7374000
|
heap
|
page read and write
|
||
9AE000
|
stack
|
page read and write
|
||
2B4BAA60000
|
trusted library allocation
|
page read and write
|
||
5E0000
|
heap
|
page read and write
|
||
5F20000
|
trusted library allocation
|
page read and write
|
||
65FD000
|
heap
|
page read and write
|
||
4FAA000
|
heap
|
page read and write
|
||
6AD81000
|
unkown
|
page execute read
|
||
E30000
|
heap
|
page read and write
|
||
103C000
|
stack
|
page read and write
|
||
6AD80000
|
unkown
|
page readonly
|
||
662D000
|
heap
|
page read and write
|
||
2B4BB5B0000
|
trusted library allocation
|
page read and write
|
||
1BCE48B6000
|
heap
|
page read and write
|
||
7374000
|
heap
|
page read and write
|
||
6ADD7000
|
unkown
|
page readonly
|
||
4F7C000
|
heap
|
page read and write
|
||
1020000
|
heap
|
page read and write
|
||
AA0000
|
heap
|
page read and write
|
||
5F20000
|
trusted library allocation
|
page read and write
|
||
CB0000
|
heap
|
page read and write
|
||
5F71000
|
heap
|
page read and write
|
||
4F90000
|
heap
|
page read and write
|
||
F00000
|
heap
|
page read and write
|
||
7E0000
|
heap
|
page read and write
|
||
4FAA000
|
heap
|
page read and write
|
||
1001A000
|
direct allocation
|
page readonly
|
||
6ADC7000
|
unkown
|
page readonly
|
||
6AD80000
|
unkown
|
page readonly
|
||
F39CDFF000
|
stack
|
page read and write
|
||
662D000
|
heap
|
page read and write
|
||
2F8E000
|
stack
|
page read and write
|
||
C80000
|
heap
|
page read and write
|
||
E7A000
|
heap
|
page read and write
|
||
7350000
|
heap
|
page read and write
|
||
564000
|
heap
|
page read and write
|
||
49B000
|
stack
|
page read and write
|
||
1BCE488B000
|
heap
|
page read and write
|
||
7D0000
|
heap
|
page read and write
|
||
2B4BA820000
|
heap
|
page read and write
|
||
32C000
|
stack
|
page read and write
|
||
65FD000
|
heap
|
page read and write
|
||
5F20000
|
trusted library allocation
|
page read and write
|
||
662B000
|
heap
|
page read and write
|
||
6ADF7000
|
unkown
|
page readonly
|
||
662B000
|
heap
|
page read and write
|
||
2B4BAA90000
|
heap
|
page read and write
|
||
B9F000
|
stack
|
page read and write
|
||
F10000
|
heap
|
page read and write
|
||
580000
|
heap
|
page read and write
|
||
1BCE4A02000
|
heap
|
page read and write
|
||
2FE0000
|
heap
|
page read and write
|
||
658C000
|
heap
|
page read and write
|
||
1BCE4B19000
|
heap
|
page read and write
|
||
6ADF3000
|
unkown
|
page readonly
|
||
8C0000
|
heap
|
page read and write
|
||
657C000
|
heap
|
page read and write
|
||
E4E000
|
stack
|
page read and write
|
||
3590000
|
heap
|
page read and write
|
||
3100000
|
heap
|
page read and write
|
||
2B4BA841000
|
heap
|
page read and write
|
||
2CC5000
|
heap
|
page read and write
|
||
7350000
|
heap
|
page read and write
|
||
6588000
|
heap
|
page read and write
|
||
2B4BA7C0000
|
trusted library allocation
|
page read and write
|
||
5EF0000
|
trusted library allocation
|
page read and write
|
||
1BCE4900000
|
trusted library allocation
|
page read and write
|
||
1BCE4828000
|
heap
|
page read and write
|
||
EE0000
|
heap
|
page read and write
|
||
657C000
|
heap
|
page read and write
|
||
658C000
|
heap
|
page read and write
|
||
C87000
|
heap
|
page read and write
|
||
2C7E000
|
stack
|
page read and write
|
||
6ADEA000
|
unkown
|
page readonly
|
||
3110000
|
heap
|
page read and write
|
||
FEF000
|
stack
|
page read and write
|
||
7350000
|
heap
|
page read and write
|
||
C91000
|
heap
|
page read and write
|
||
7350000
|
heap
|
page read and write
|
||
2FAF000
|
stack
|
page read and write
|
||
65FD000
|
heap
|
page read and write
|
||
5BC000
|
stack
|
page read and write
|
||
C99000
|
heap
|
page read and write
|
||
6ADEA000
|
unkown
|
page readonly
|
||
4FAC000
|
heap
|
page read and write
|
||
35A0000
|
heap
|
page read and write
|
||
6AD81000
|
unkown
|
page execute read
|
||
92F000
|
stack
|
page read and write
|
||
30E0000
|
heap
|
page read and write
|
||
F39C95B000
|
stack
|
page read and write
|
||
6A04000
|
heap
|
page read and write
|
||
7C46000
|
heap
|
page read and write
|
||
564000
|
heap
|
page read and write
|
||
FFC000
|
stack
|
page read and write
|
||
2B4BB560000
|
trusted library allocation
|
page read and write
|
||
6AD80000
|
unkown
|
page readonly
|
||
5F20000
|
trusted library allocation
|
page read and write
|
||
F6B000
|
stack
|
page read and write
|
||
C0E000
|
stack
|
page read and write
|
||
2EEE000
|
stack
|
page read and write
|
||
DB0000
|
heap
|
page read and write
|
||
A9B000
|
stack
|
page read and write
|
||
6ADF7000
|
unkown
|
page readonly
|
||
6588000
|
heap
|
page read and write
|
||
7C38000
|
heap
|
page read and write
|
||
32EA000
|
heap
|
page read and write
|
||
6ADFA000
|
unkown
|
page readonly
|
||
2DB7000
|
heap
|
page read and write
|
||
106A000
|
heap
|
page read and write
|
||
6060000
|
trusted library allocation
|
page read and write
|
||
C50000
|
heap
|
page read and write
|
||
103B000
|
stack
|
page read and write
|
||
95A000
|
heap
|
page read and write
|
||
5F20000
|
trusted library allocation
|
page read and write
|
||
C7F000
|
stack
|
page read and write
|
||
76B000
|
stack
|
page read and write
|
||
658C000
|
heap
|
page read and write
|
||
2B4BAA80000
|
trusted library allocation
|
page read and write
|
||
7374000
|
heap
|
page read and write
|
||
773C000
|
heap
|
page read and write
|
||
9A0000
|
heap
|
page read and write
|
||
6588000
|
heap
|
page read and write
|
||
657C000
|
heap
|
page read and write
|
||
6ADF3000
|
unkown
|
page readonly
|
||
32E0000
|
heap
|
page read and write
|
||
662B000
|
heap
|
page read and write
|
||
1BCE4A18000
|
heap
|
page read and write
|
||
657C000
|
heap
|
page read and write
|
||
6ADD7000
|
unkown
|
page readonly
|
||
2B4BA7D0000
|
heap
|
page read and write
|
||
657C000
|
heap
|
page read and write
|
||
2B4BA818000
|
heap
|
page read and write
|
||
6ADEA000
|
unkown
|
page readonly
|
||
2B4BA837000
|
heap
|
page read and write
|
||
6ADD7000
|
unkown
|
page readonly
|
||
2B4BB540000
|
heap
|
page readonly
|
||
54E000
|
stack
|
page read and write
|
||
D2E000
|
stack
|
page read and write
|
||
69CC000
|
heap
|
page read and write
|
||
662B000
|
heap
|
page read and write
|
||
2F6E000
|
stack
|
page read and write
|
||
F11000
|
heap
|
page read and write
|
||
CC0000
|
heap
|
page read and write
|
||
45C000
|
stack
|
page read and write
|
||
3540000
|
heap
|
page read and write
|
||
317A88D000
|
stack
|
page read and write
|
||
4FAA000
|
heap
|
page read and write
|
||
E10000
|
heap
|
page read and write
|
||
A70000
|
heap
|
page read and write
|
||
DF0000
|
heap
|
page read and write
|
||
2B4BA5F0000
|
trusted library allocation
|
page read and write
|
||
2CC0000
|
heap
|
page read and write
|
||
F39CD79000
|
stack
|
page read and write
|
||
564000
|
heap
|
page read and write
|
||
65FD000
|
heap
|
page read and write
|
||
6ADF3000
|
unkown
|
page readonly
|
||
5F61000
|
heap
|
page read and write
|
||
317ACF9000
|
stack
|
page read and write
|
||
B50000
|
heap
|
page read and write
|
||
1F0000
|
heap
|
page read and write
|
||
C10000
|
trusted library allocation
|
page read and write
|
||
F90000
|
heap
|
page read and write
|
||
1BCE4B13000
|
heap
|
page read and write
|
||
6ADD7000
|
unkown
|
page readonly
|
||
2B4BA820000
|
heap
|
page read and write
|
||
6AD81000
|
unkown
|
page execute read
|
||
6AD80000
|
unkown
|
page readonly
|
||
6ADF4000
|
unkown
|
page read and write
|
||
30E0000
|
heap
|
page read and write
|
||
E70000
|
heap
|
page read and write
|
||
1BCE4915000
|
trusted library allocation
|
page read and write
|
||
65FD000
|
heap
|
page read and write
|
||
940000
|
heap
|
page read and write
|
||
30BE000
|
stack
|
page read and write
|
||
5F20000
|
trusted library allocation
|
page read and write
|
||
662B000
|
heap
|
page read and write
|
||
7D0000
|
heap
|
page read and write
|
||
65FD000
|
heap
|
page read and write
|
||
564000
|
heap
|
page read and write
|
||
F0000
|
heap
|
page read and write
|
||
6C0000
|
heap
|
page read and write
|
||
773D000
|
heap
|
page read and write
|
||
6ADF7000
|
unkown
|
page readonly
|
||
6ADF3000
|
unkown
|
page readonly
|
||
82A000
|
heap
|
page read and write
|
||
C3E000
|
stack
|
page read and write
|
||
680000
|
heap
|
page read and write
|
||
BCA000
|
heap
|
page read and write
|
||
12C0000
|
heap
|
page read and write
|
||
3780000
|
heap
|
page read and write
|
||
700000
|
heap
|
page read and write
|
||
662D000
|
heap
|
page read and write
|
||
1BCE483B000
|
heap
|
page read and write
|
||
70A000
|
heap
|
page read and write
|
||
657C000
|
heap
|
page read and write
|
||
4FAA000
|
heap
|
page read and write
|
||
662B000
|
heap
|
page read and write
|
||
662B000
|
heap
|
page read and write
|
||
9EC000
|
stack
|
page read and write
|
||
662D000
|
heap
|
page read and write
|
||
6ADFA000
|
unkown
|
page readonly
|
||
2FCE000
|
stack
|
page read and write
|
||
4F4F000
|
heap
|
page read and write
|
||
6588000
|
heap
|
page read and write
|
||
C50000
|
heap
|
page read and write
|
||
1BCE4877000
|
heap
|
page read and write
|
||
C9C000
|
heap
|
page read and write
|
||
820000
|
heap
|
page read and write
|
||
7C49000
|
heap
|
page read and write
|
||
6ADF4000
|
unkown
|
page read and write
|
||
7731000
|
heap
|
page read and write
|
||
B1E000
|
stack
|
page read and write
|
||
6E2D000
|
heap
|
page read and write
|
||
36B000
|
stack
|
page read and write
|
||
1BCE4B00000
|
heap
|
page read and write
|
||
CFC000
|
stack
|
page read and write
|
||
1BCE4902000
|
trusted library allocation
|
page read and write
|
||
1BCE4B02000
|
heap
|
page read and write
|
||
661F000
|
heap
|
page read and write
|
||
EA0000
|
heap
|
page read and write
|
||
7374000
|
heap
|
page read and write
|
||
7739000
|
heap
|
page read and write
|
||
2F4E000
|
stack
|
page read and write
|
||
2F2F000
|
stack
|
page read and write
|
||
64E000
|
stack
|
page read and write
|
||
1BCE48B6000
|
heap
|
page read and write
|
||
D10000
|
heap
|
page read and write
|
||
661F000
|
heap
|
page read and write
|
||
10000000
|
direct allocation
|
page read and write
|
||
9CD000
|
stack
|
page read and write
|
||
2B4BA720000
|
heap
|
page read and write
|
||
7350000
|
heap
|
page read and write
|
There are 426 hidden memdumps, click here to show them.