Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
050_qbot.dll
|
PE32 executable (DLL) (console) Intel 80386, for MS Windows
|
initial sample
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_1d45f7cb\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_1d5df7cb\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_1e260587\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_f72750b22a9214184114f6be25e810eecaece948_82810a17_1e060623\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER171.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CF.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER77.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBA8.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:12:34 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC44.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:12:34 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD10.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD6E.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD6F.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD9E.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEDF.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:12:43 2023, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFD9.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:12:44 2023, 0x1205a4 type
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\national[1].htm
|
HTML document, ASCII text, with very long lines (65212)
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve.tmp
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
There are 12 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Windows\System32\loaddll32.exe
|
loaddll32.exe "C:\Users\user\Desktop\050_qbot.dll"
|
||
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",#1
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\050_qbot.dll,lcopy_block_row
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",#1
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 652
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 176
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\050_qbot.dll,lcopy_sample_rows
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\050_qbot.dll,ldiv_round_up
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",lcopy_block_row
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",lcopy_sample_rows
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",ldiv_round_up
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",next
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",lround_up
|
||
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",lpeg_write_tables
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7644 -s 652
|
||
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 652
|
||
C:\Windows\SysWOW64\wermgr.exe
|
C:\Windows\SysWOW64\wermgr.exe
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
There are 8 hidden processes, click here to show them.
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://www.xfinity.com/mobile/policies/broadband-disclosures
|
unknown
|
||
http://upx.sf.net
|
unknown
|
||
https://www.xfinity.com/learn/internet-service/acp
|
unknown
|
||
https://www.xfinity.com/networkmanagement
|
unknown
|
||
https://xfinity.com/
|
68.87.41.40
|
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
xfinity.com
|
68.87.41.40
|
||
www.xfinity.com
|
unknown
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
38.2.18.164
|
unknown
|
United States
|
||
2.82.8.80
|
unknown
|
Portugal
|
||
70.160.67.203
|
unknown
|
United States
|
||
83.110.223.61
|
unknown
|
United Arab Emirates
|
||
209.171.160.69
|
unknown
|
Canada
|
||
84.215.202.8
|
unknown
|
Norway
|
||
184.182.66.109
|
unknown
|
United States
|
||
200.84.211.255
|
unknown
|
Venezuela
|
||
125.99.69.178
|
unknown
|
India
|
||
174.4.89.3
|
unknown
|
Canada
|
||
121.121.108.120
|
unknown
|
Malaysia
|
||
161.142.103.187
|
unknown
|
Malaysia
|
||
213.64.33.92
|
unknown
|
Sweden
|
||
114.143.176.236
|
unknown
|
India
|
||
24.234.220.88
|
unknown
|
United States
|
||
67.70.120.249
|
unknown
|
Canada
|
||
73.88.173.113
|
unknown
|
United States
|
||
72.205.104.134
|
unknown
|
United States
|
||
117.195.17.148
|
unknown
|
India
|
||
69.160.121.6
|
unknown
|
Jamaica
|
||
176.133.4.230
|
unknown
|
France
|
||
183.87.163.165
|
unknown
|
India
|
||
184.181.75.148
|
unknown
|
United States
|
||
70.49.205.198
|
unknown
|
Canada
|
||
87.221.153.182
|
unknown
|
Spain
|
||
70.50.1.252
|
unknown
|
Canada
|
||
85.101.239.116
|
unknown
|
Turkey
|
||
181.4.225.225
|
unknown
|
Argentina
|
||
100.4.163.158
|
unknown
|
United States
|
||
103.141.50.43
|
unknown
|
India
|
||
70.50.83.216
|
unknown
|
Canada
|
||
92.1.170.110
|
unknown
|
United Kingdom
|
||
64.121.161.102
|
unknown
|
United States
|
||
96.56.197.26
|
unknown
|
United States
|
||
188.28.19.84
|
unknown
|
United Kingdom
|
||
125.99.76.102
|
unknown
|
India
|
||
81.101.185.146
|
unknown
|
United Kingdom
|
||
116.75.63.183
|
unknown
|
India
|
||
124.246.122.199
|
unknown
|
Singapore
|
||
147.147.30.126
|
unknown
|
United Kingdom
|
||
109.130.247.84
|
unknown
|
Belgium
|
||
75.109.111.89
|
unknown
|
United States
|
||
88.126.94.4
|
unknown
|
France
|
||
124.122.47.148
|
unknown
|
Thailand
|
||
66.241.183.99
|
unknown
|
United States
|
||
180.151.19.13
|
unknown
|
India
|
||
94.204.202.106
|
unknown
|
United Arab Emirates
|
||
47.205.25.170
|
unknown
|
United States
|
||
95.45.50.93
|
unknown
|
Ireland
|
||
103.212.19.254
|
unknown
|
India
|
||
85.61.165.153
|
unknown
|
Spain
|
||
91.160.70.68
|
unknown
|
France
|
||
201.143.215.69
|
unknown
|
Mexico
|
||
184.63.133.131
|
unknown
|
United States
|
||
203.109.44.236
|
unknown
|
India
|
||
90.104.151.37
|
unknown
|
France
|
||
201.244.108.183
|
unknown
|
Colombia
|
||
2.49.63.160
|
unknown
|
United Arab Emirates
|
||
103.42.86.42
|
unknown
|
India
|
||
80.6.50.34
|
unknown
|
United Kingdom
|
||
175.156.217.7
|
unknown
|
Singapore
|
||
103.139.242.6
|
unknown
|
India
|
||
27.0.48.233
|
unknown
|
India
|
||
70.28.50.223
|
unknown
|
Canada
|
||
173.17.45.60
|
unknown
|
United States
|
||
81.229.117.95
|
unknown
|
Sweden
|
||
70.64.77.115
|
unknown
|
Canada
|
||
87.252.106.39
|
unknown
|
Italy
|
||
79.77.142.22
|
unknown
|
United Kingdom
|
||
98.163.227.79
|
unknown
|
United States
|
||
93.187.148.45
|
unknown
|
United Kingdom
|
||
186.75.95.6
|
unknown
|
Panama
|
||
50.68.186.195
|
unknown
|
Canada
|
||
45.62.70.33
|
unknown
|
Canada
|
||
83.249.198.100
|
unknown
|
Sweden
|
||
12.172.173.82
|
unknown
|
United States
|
||
47.199.241.39
|
unknown
|
United States
|
||
79.168.224.165
|
unknown
|
Portugal
|
||
199.27.66.213
|
unknown
|
United States
|
||
200.44.198.47
|
unknown
|
Venezuela
|
||
176.142.207.63
|
unknown
|
France
|
||
86.173.2.12
|
unknown
|
United Kingdom
|
||
45.62.75.250
|
unknown
|
Canada
|
||
92.154.17.149
|
unknown
|
France
|
||
90.29.86.138
|
unknown
|
France
|
||
174.58.146.57
|
unknown
|
United States
|
||
223.166.13.95
|
unknown
|
China
|
||
5.192.141.228
|
unknown
|
United Arab Emirates
|
||
65.95.141.84
|
unknown
|
Canada
|
||
75.98.154.19
|
unknown
|
United States
|
||
77.126.99.230
|
unknown
|
Israel
|
||
103.123.223.133
|
unknown
|
India
|
||
74.12.147.139
|
unknown
|
Canada
|
||
92.9.45.20
|
unknown
|
United Kingdom
|
||
113.11.92.30
|
unknown
|
Bangladesh
|
||
77.86.98.236
|
unknown
|
United Kingdom
|
||
103.140.174.20
|
unknown
|
India
|
||
78.192.109.105
|
unknown
|
France
|
||
68.87.41.40
|
xfinity.com
|
United States
|
||
192.168.2.1
|
unknown
|
unknown
|
There are 90 hidden IPs, click here to show them.
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000CAA868BB9
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceId
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
ApplicationFlags
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHivePermissionsCorrect
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHiveOwnerCorrect
|
||
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
|
PendingFileRenameOperations
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiOverridePath
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile
|
WritePermissionsCheck
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile
|
ProviderSyncId
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProgramId
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
FileId
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LowerCaseLongPath
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LongPathHash
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Name
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Publisher
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Version
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinFileVersion
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinaryType
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductName
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductVersion
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LinkDate
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinProductVersion
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Size
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Language
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsPeFile
|
||
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsOsComponent
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000CAA868BB9
|
||
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
8ac2389b
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
bf5de8d5
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
bd1cc8a9
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
5a0afcc
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
78a8e046
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
c0148723
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
7e18fb0
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
f58b576d
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
8ac2389b
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
8ac2389b
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
8ac2389b
|
||
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
8ac2389b
|
There are 37 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
294A000
|
heap
|
page read and write
|
||
46D0000
|
heap
|
page read and write
|
||
4571000
|
heap
|
page read and write
|
||
2CE0000
|
heap
|
page read and write
|
||
6ADF7000
|
unkown
|
page readonly
|
||
3290000
|
heap
|
page read and write
|
||
2A40000
|
heap
|
page read and write
|
||
280A000
|
heap
|
page read and write
|
||
57DD000
|
heap
|
page read and write
|
||
2E10000
|
heap
|
page read and write
|
||
6FFF000
|
heap
|
page read and write
|
||
5738000
|
heap
|
page read and write
|
||
A368DF9000
|
stack
|
page read and write
|
||
15A5D628000
|
heap
|
page read and write
|
||
496E000
|
stack
|
page read and write
|
||
2764000
|
heap
|
page read and write
|
||
6ADF7000
|
unkown
|
page readonly
|
||
2760000
|
heap
|
page read and write
|
||
57DD000
|
heap
|
page read and write
|
||
57DB000
|
heap
|
page read and write
|
||
977000
|
heap
|
page read and write
|
||
15A5D630000
|
heap
|
page read and write
|
||
4A70000
|
heap
|
page read and write
|
||
572C000
|
heap
|
page read and write
|
||
6AF6000
|
heap
|
page read and write
|
||
1D306755000
|
heap
|
page read and write
|
||
1D3067B0000
|
heap
|
page read and write
|
||
6FF6000
|
heap
|
page read and write
|
||
15A5D689000
|
heap
|
page read and write
|
||
287F000
|
stack
|
page read and write
|
||
6ADF4000
|
unkown
|
page read and write
|
||
15A5D800000
|
heap
|
page read and write
|
||
6ADD7000
|
unkown
|
page readonly
|
||
6AD80000
|
unkown
|
page readonly
|
||
33D0000
|
heap
|
page read and write
|
||
2DC0000
|
heap
|
page read and write
|
||
22DC000
|
stack
|
page read and write
|
||
267B000
|
stack
|
page read and write
|
||
28EC000
|
stack
|
page read and write
|
||
5FF1000
|
heap
|
page read and write
|
||
15A5D613000
|
unkown
|
page read and write
|
||
15A5D715000
|
trusted library allocation
|
page read and write
|
||
2C6E000
|
stack
|
page read and write
|
||
111C000
|
heap
|
page read and write
|
||
880000
|
heap
|
page read and write
|
||
6ADF3000
|
unkown
|
page readonly
|
||
27D0000
|
heap
|
page read and write
|
||
57DB000
|
heap
|
page read and write
|
||
26A0000
|
heap
|
page read and write
|
||
57CF000
|
heap
|
page read and write
|
||
27CC000
|
stack
|
page read and write
|
||
2CA0000
|
heap
|
page read and write
|
||
23FE000
|
stack
|
page read and write
|
||
2764000
|
heap
|
page read and write
|
||
10022000
|
direct allocation
|
page readonly
|
||
2FB0000
|
heap
|
page read and write
|
||
4570000
|
heap
|
page read and write
|
||
5620000
|
trusted library allocation
|
page read and write
|
||
5738000
|
heap
|
page read and write
|
||
15A5D600000
|
unkown
|
page read and write
|
||
54A0000
|
trusted library allocation
|
page read and write
|
||
977000
|
heap
|
page read and write
|
||
6684000
|
heap
|
page read and write
|
||
57DD000
|
heap
|
page read and write
|
||
4372000
|
heap
|
page read and write
|
||
57DD000
|
heap
|
page read and write
|
||
32BA000
|
heap
|
page read and write
|
||
D50000
|
heap
|
page read and write
|
||
22B0000
|
heap
|
page read and write
|
||
57AD000
|
heap
|
page read and write
|
||
6684000
|
heap
|
page read and write
|
||
10F1000
|
heap
|
page read and write
|
||
1D3076C0000
|
trusted library allocation
|
page read and write
|
||
6ADFA000
|
unkown
|
page readonly
|
||
2764000
|
heap
|
page read and write
|
||
1D30681B000
|
heap
|
page read and write
|
||
1D3076B0000
|
trusted library allocation
|
page read and write
|
||
54A0000
|
trusted library allocation
|
page read and write
|
||
6ADF7000
|
unkown
|
page readonly
|
||
273E000
|
stack
|
page read and write
|
||
572C000
|
heap
|
page read and write
|
||
977000
|
heap
|
page read and write
|
||
A368C79000
|
stack
|
page read and write
|
||
1D30683C000
|
heap
|
page read and write
|
||
114A000
|
heap
|
page read and write
|
||
6684000
|
heap
|
page read and write
|
||
6AFA000
|
heap
|
page read and write
|
||
15A5D723000
|
heap
|
page read and write
|
||
114A000
|
heap
|
page read and write
|
||
5521000
|
heap
|
page read and write
|
||
231B000
|
stack
|
page read and write
|
||
977000
|
heap
|
page read and write
|
||
573C000
|
heap
|
page read and write
|
||
6AD80000
|
unkown
|
page readonly
|
||
54A0000
|
trusted library allocation
|
page read and write
|
||
10E4000
|
heap
|
page read and write
|
||
6AD80000
|
unkown
|
page readonly
|
||
977000
|
heap
|
page read and write
|
||
29DF000
|
stack
|
page read and write
|
||
2BE0000
|
heap
|
page read and write
|
||
2A90000
|
heap
|
page read and write
|
||
280A000
|
heap
|
page read and write
|
||
2B7B000
|
stack
|
page read and write
|
||
2AD0000
|
heap
|
page read and write
|
||
15A5D648000
|
heap
|
page read and write
|
||
6ADFA000
|
unkown
|
page readonly
|
||
1D306740000
|
heap
|
page read and write
|
||
5AE7000
|
heap
|
page read and write
|
||
298E000
|
stack
|
page read and write
|
||
46F3000
|
heap
|
page read and write
|
||
15A5D689000
|
heap
|
page read and write
|
||
57DB000
|
heap
|
page read and write
|
||
7006000
|
heap
|
page read and write
|
||
2FAF000
|
stack
|
page read and write
|
||
572C000
|
heap
|
page read and write
|
||
1D3073E0000
|
trusted library allocation
|
page read and write
|
||
6AF1000
|
heap
|
page read and write
|
||
474F000
|
heap
|
page read and write
|
||
15A5D648000
|
heap
|
page read and write
|
||
57AD000
|
heap
|
page read and write
|
||
1001F000
|
direct allocation
|
page read and write
|
||
57DD000
|
heap
|
page read and write
|
||
259C000
|
stack
|
page read and write
|
||
572C000
|
heap
|
page read and write
|
||
2BF0000
|
heap
|
page read and write
|
||
113F000
|
heap
|
page read and write
|
||
60B2000
|
heap
|
page read and write
|
||
15A5D4A0000
|
heap
|
page read and write
|
||
572C000
|
heap
|
page read and write
|
||
2BB0000
|
heap
|
page read and write
|
||
23B0000
|
heap
|
page read and write
|
||
6AD81000
|
unkown
|
page execute read
|
||
2B3C000
|
stack
|
page read and write
|
||
57CF000
|
heap
|
page read and write
|
||
28EE000
|
stack
|
page read and write
|
||
3020000
|
heap
|
page read and write
|
||
57CF000
|
heap
|
page read and write
|
||
573C000
|
heap
|
page read and write
|
||
15A5D700000
|
trusted library allocation
|
page read and write
|
||
572C000
|
heap
|
page read and write
|
||
57DD000
|
heap
|
page read and write
|
||
2DDA000
|
heap
|
page read and write
|
||
573C000
|
heap
|
page read and write
|
||
6ADFA000
|
unkown
|
page readonly
|
||
2764000
|
heap
|
page read and write
|
||
573C000
|
heap
|
page read and write
|
||
8ED000
|
stack
|
page read and write
|
||
114A000
|
heap
|
page read and write
|
||
2A3C000
|
stack
|
page read and write
|
||
2DA0000
|
heap
|
page read and write
|
||
5738000
|
heap
|
page read and write
|
||
309F000
|
stack
|
page read and write
|
||
4230000
|
heap
|
page read and write
|
||
7801000
|
heap
|
page read and write
|
||
7009000
|
heap
|
page read and write
|
||
114A000
|
heap
|
page read and write
|
||
573C000
|
heap
|
page read and write
|
||
57AD000
|
heap
|
page read and write
|
||
4571000
|
heap
|
page read and write
|
||
2B7B000
|
stack
|
page read and write
|
||
2DD0000
|
heap
|
page read and write
|
||
572C000
|
heap
|
page read and write
|
||
2BBE000
|
stack
|
page read and write
|
||
6AD81000
|
unkown
|
page execute read
|
||
1D3069C0000
|
trusted library allocation
|
page read and write
|
||
6ADF7000
|
unkown
|
page readonly
|
||
6ADC7000
|
unkown
|
page readonly
|
||
2764000
|
heap
|
page read and write
|
||
2D2E000
|
stack
|
page read and write
|
||
2F1B000
|
stack
|
page read and write
|
||
15A5D913000
|
heap
|
page read and write
|
||
6ADF4000
|
unkown
|
page read and write
|
||
2910000
|
heap
|
page read and write
|
||
6AD81000
|
unkown
|
page execute read
|
||
57DD000
|
heap
|
page read and write
|
||
6ADEA000
|
unkown
|
page readonly
|
||
2E70000
|
heap
|
page read and write
|
||
6684000
|
heap
|
page read and write
|
||
1D30681B000
|
heap
|
page read and write
|
||
6ADD7000
|
unkown
|
page readonly
|
||
1D3069A0000
|
heap
|
page read and write
|
||
6660000
|
heap
|
page read and write
|
||
57AD000
|
heap
|
page read and write
|
||
263F000
|
stack
|
page read and write
|
||
4230000
|
heap
|
page read and write
|
||
57AD000
|
heap
|
page read and write
|
||
54A0000
|
trusted library allocation
|
page read and write
|
||
5521000
|
heap
|
page read and write
|
||
6ADFA000
|
unkown
|
page readonly
|
||
1D30681B000
|
heap
|
page read and write
|
||
57AD000
|
heap
|
page read and write
|
||
57DB000
|
heap
|
page read and write
|
||
72FA000
|
heap
|
page read and write
|
||
988F79000
|
stack
|
page read and write
|
||
6ADF4000
|
unkown
|
page read and write
|
||
1D307690000
|
trusted library allocation
|
page read and write
|
||
113F000
|
heap
|
page read and write
|
||
114A000
|
heap
|
page read and write
|
||
1D307440000
|
trusted library allocation
|
page read and write
|
||
2880000
|
heap
|
page read and write
|
||
988C79000
|
stack
|
page read and write
|
||
2A7B000
|
stack
|
page read and write
|
||
15A5D802000
|
heap
|
page read and write
|
||
54A0000
|
trusted library allocation
|
page read and write
|
||
15A5D430000
|
heap
|
page read and write
|
||
57AC000
|
heap
|
page read and write
|
||
2B00000
|
trusted library allocation
|
page read and write
|
||
54A0000
|
trusted library allocation
|
page read and write
|
||
57AD000
|
heap
|
page read and write
|
||
1290000
|
heap
|
page read and write
|
||
323E000
|
stack
|
page read and write
|
||
263C000
|
stack
|
page read and write
|
||
6660000
|
heap
|
page read and write
|
||
28A0000
|
heap
|
page read and write
|
||
15A5D62F000
|
heap
|
page read and write
|
||
573C000
|
heap
|
page read and write
|
||
6684000
|
heap
|
page read and write
|
||
6660000
|
heap
|
page read and write
|
||
5904000
|
heap
|
page read and write
|
||
2800000
|
heap
|
page read and write
|
||
1D307710000
|
trusted library allocation
|
page read and write
|
||
49AF000
|
stack
|
page read and write
|
||
77F2000
|
heap
|
page read and write
|
||
EC0000
|
heap
|
page read and write
|
||
1001A000
|
direct allocation
|
page readonly
|
||
6ADFA000
|
unkown
|
page readonly
|
||
6ADF3000
|
unkown
|
page readonly
|
||
5738000
|
heap
|
page read and write
|
||
57CF000
|
heap
|
page read and write
|
||
1D306759000
|
heap
|
page read and write
|
||
6684000
|
heap
|
page read and write
|
||
2990000
|
heap
|
page read and write
|
||
6ADC7000
|
unkown
|
page readonly
|
||
235B000
|
stack
|
page read and write
|
||
573C000
|
heap
|
page read and write
|
||
2800000
|
heap
|
page read and write
|
||
5738000
|
heap
|
page read and write
|
||
114A000
|
heap
|
page read and write
|
||
292F000
|
stack
|
page read and write
|
||
10C1000
|
heap
|
page read and write
|
||
6ADF3000
|
unkown
|
page readonly
|
||
6AD81000
|
unkown
|
page execute read
|
||
54A0000
|
trusted library allocation
|
page read and write
|
||
6ADF3000
|
unkown
|
page readonly
|
||
114A000
|
heap
|
page read and write
|
||
6ADD7000
|
unkown
|
page readonly
|
||
15A5D900000
|
heap
|
page read and write
|
||
6AD81000
|
unkown
|
page execute read
|
||
32B0000
|
heap
|
page read and write
|
||
10EF000
|
heap
|
page read and write
|
||
6ADEA000
|
unkown
|
page readonly
|
||
6AD80000
|
unkown
|
page readonly
|
||
5521000
|
heap
|
page read and write
|
||
5C22000
|
heap
|
page read and write
|
||
1D306750000
|
heap
|
page read and write
|
||
15A5D69A000
|
heap
|
page read and write
|
||
2E20000
|
heap
|
page read and write
|
||
57DA000
|
heap
|
page read and write
|
||
274F000
|
stack
|
page read and write
|
||
5738000
|
heap
|
page read and write
|
||
2AC0000
|
heap
|
page read and write
|
||
57CF000
|
heap
|
page read and write
|
||
15A5D702000
|
trusted library allocation
|
page read and write
|
||
2B40000
|
heap
|
page read and write
|
||
2764000
|
heap
|
page read and write
|
||
6660000
|
heap
|
page read and write
|
||
A36889B000
|
stack
|
page read and write
|
||
573C000
|
heap
|
page read and write
|
||
2E90000
|
heap
|
page read and write
|
||
6AF9000
|
heap
|
page read and write
|
||
15A5D813000
|
heap
|
page read and write
|
||
57DB000
|
heap
|
page read and write
|
||
6ADD7000
|
unkown
|
page readonly
|
||
2CEF000
|
stack
|
page read and write
|
||
7003000
|
heap
|
page read and write
|
||
ECB000
|
heap
|
page read and write
|
||
57DB000
|
heap
|
page read and write
|
||
2F80000
|
heap
|
page read and write
|
||
2DD0000
|
heap
|
page read and write
|
||
2B30000
|
heap
|
page read and write
|
||
6660000
|
heap
|
page read and write
|
||
15A5D902000
|
heap
|
page read and write
|
||
EDA000
|
heap
|
page read and write
|
||
2F6A000
|
heap
|
page read and write
|
||
1D3067D0000
|
heap
|
page read and write
|
||
A368D7E000
|
stack
|
page read and write
|
||
57DA000
|
heap
|
page read and write
|
||
2AD0000
|
heap
|
page read and write
|
||
6660000
|
heap
|
page read and write
|
||
57AD000
|
heap
|
page read and write
|
||
6ADC7000
|
unkown
|
page readonly
|
||
2D6F000
|
stack
|
page read and write
|
||
57DD000
|
heap
|
page read and write
|
||
6684000
|
heap
|
page read and write
|
||
D20000
|
heap
|
page read and write
|
||
2380000
|
heap
|
page read and write
|
||
2270000
|
heap
|
page read and write
|
||
15A5D440000
|
trusted library allocation
|
page read and write
|
||
57AD000
|
heap
|
page read and write
|
||
6133000
|
heap
|
page read and write
|
||
5738000
|
heap
|
page read and write
|
||
2764000
|
heap
|
page read and write
|
||
57DD000
|
heap
|
page read and write
|
||
2EDC000
|
stack
|
page read and write
|
||
2BC0000
|
heap
|
page read and write
|
||
2660000
|
heap
|
page read and write
|
||
25DB000
|
stack
|
page read and write
|
||
231C000
|
stack
|
page read and write
|
||
1D3069D0000
|
trusted library allocation
|
page read and write
|
||
10001000
|
direct allocation
|
page execute read
|
||
15A5D902000
|
heap
|
page read and write
|
||
2BE0000
|
heap
|
page read and write
|
||
6AD80000
|
unkown
|
page readonly
|
||
2A3B000
|
stack
|
page read and write
|
||
1D30681D000
|
heap
|
page read and write
|
||
1D307450000
|
trusted library allocation
|
page read and write
|
||
57CF000
|
heap
|
page read and write
|
||
4560000
|
heap
|
page read and write
|
||
114A000
|
heap
|
page read and write
|
||
15A5D647000
|
heap
|
page read and write
|
||
988A7D000
|
stack
|
page read and write
|
||
10000000
|
direct allocation
|
page read and write
|
||
23C0000
|
heap
|
page read and write
|
||
3180000
|
heap
|
page read and write
|
||
2B3A000
|
heap
|
page read and write
|
||
ED6000
|
heap
|
page read and write
|
||
1118000
|
heap
|
page read and write
|
||
2990000
|
heap
|
page read and write
|
||
57CF000
|
heap
|
page read and write
|
||
E9F000
|
stack
|
page read and write
|
||
6ADF4000
|
unkown
|
page read and write
|
||
57CF000
|
heap
|
page read and write
|
||
15A5D648000
|
heap
|
page read and write
|
||
2B3C000
|
stack
|
page read and write
|
||
54A0000
|
trusted library allocation
|
page read and write
|
||
2764000
|
heap
|
page read and write
|
||
15A5D913000
|
heap
|
page read and write
|
||
6684000
|
heap
|
page read and write
|
||
6ADF3000
|
unkown
|
page readonly
|
||
977000
|
heap
|
page read and write
|
||
6ADEA000
|
unkown
|
page readonly
|
||
302A000
|
heap
|
page read and write
|
||
572C000
|
heap
|
page read and write
|
||
2760000
|
heap
|
page read and write
|
||
2E6E000
|
stack
|
page read and write
|
||
1D306813000
|
heap
|
page read and write
|
||
2C20000
|
heap
|
page read and write
|
||
6ADD7000
|
unkown
|
page readonly
|
||
57CF000
|
heap
|
page read and write
|
||
2FF0000
|
heap
|
page read and write
|
||
7D02000
|
heap
|
page read and write
|
||
57DB000
|
heap
|
page read and write
|
||
A368CF9000
|
stack
|
page read and write
|
||
451F000
|
stack
|
page read and write
|
||
6660000
|
heap
|
page read and write
|
||
9EC000
|
stack
|
page read and write
|
||
5AEE000
|
heap
|
page read and write
|
||
D9E000
|
stack
|
page read and write
|
||
15A5D620000
|
unkown
|
page read and write
|
||
6ADEA000
|
unkown
|
page readonly
|
||
2D80000
|
heap
|
page read and write
|
||
58CC000
|
heap
|
page read and write
|
||
5521000
|
heap
|
page read and write
|
||
6660000
|
heap
|
page read and write
|
||
270E000
|
stack
|
page read and write
|
||
573C000
|
heap
|
page read and write
|
||
474F000
|
heap
|
page read and write
|
||
327F000
|
stack
|
page read and write
|
||
A368E7F000
|
stack
|
page read and write
|
||
15A5D62E000
|
heap
|
page read and write
|
||
1D3076A0000
|
heap
|
page readonly
|
||
15A5D689000
|
heap
|
page read and write
|
||
2760000
|
heap
|
page read and write
|
||
54A0000
|
trusted library allocation
|
page read and write
|
||
5738000
|
heap
|
page read and write
|
||
6ADC7000
|
unkown
|
page readonly
|
||
6ADF4000
|
unkown
|
page read and write
|
||
54A0000
|
trusted library allocation
|
page read and write
|
||
15A5D689000
|
heap
|
page read and write
|
||
2530000
|
heap
|
page read and write
|
||
2F3E000
|
stack
|
page read and write
|
||
6ADEA000
|
unkown
|
page readonly
|
||
26C0000
|
heap
|
page read and write
|
||
4790000
|
heap
|
page read and write
|
||
4660000
|
heap
|
page read and write
|
||
5521000
|
heap
|
page read and write
|
||
2DDA000
|
heap
|
page read and write
|
||
2F60000
|
heap
|
page read and write
|
||
6684000
|
heap
|
page read and write
|
||
3080000
|
heap
|
page read and write
|
||
15A5D689000
|
heap
|
page read and write
|
||
6ADC7000
|
unkown
|
page readonly
|
||
2D8A000
|
heap
|
page read and write
|
||
110C000
|
heap
|
page read and write
|
||
5521000
|
heap
|
page read and write
|
||
5738000
|
heap
|
page read and write
|
||
6660000
|
heap
|
page read and write
|
||
292B000
|
stack
|
page read and write
|
||
114A000
|
heap
|
page read and write
|
||
2940000
|
heap
|
page read and write
|
||
1D3073D0000
|
trusted library allocation
|
page read and write
|
||
572C000
|
heap
|
page read and write
|
||
1130000
|
heap
|
page read and write
|
||
28A0000
|
direct allocation
|
page execute read
|
||
114A000
|
heap
|
page read and write
|
||
6ADF7000
|
unkown
|
page readonly
|
There are 396 hidden memdumps, click here to show them.