Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
050_qbot.dll
|
PE32 executable (DLL) (console) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_086128fd\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_16b929a9\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_1c7d36d8\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_f72750b22a9214184114f6be25e810eecaece948_82810a17_1c1d37b3\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FD3.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:25:50 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER309E.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:25:51 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3199.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER31C9.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3264.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER32C3.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4D.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:25:41 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:25:41 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE71.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA1.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB0.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEF.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve.tmp
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_1d45f7cb\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_1d5df7cb\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_419b281e7a1c62a2cfa3b86aa4ad63773747ea5_82810a17_1e260587\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_f72750b22a9214184114f6be25e810eecaece948_82810a17_1e060623\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER171.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CF.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER77.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDBA8.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:12:34 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC44.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:12:34 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD10.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD6E.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD6F.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD9E.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFEDF.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:12:43 2023, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFD9.tmp.dmp
|
Mini DuMP crash report, 14 streams, Wed Jun 7 03:12:44 2023, 0x1205a4 type
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\national[1].htm
|
HTML document, ASCII text, with very long lines (65212)
|
dropped
|
There are 28 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\loaddll32.exe
|
loaddll32.exe "C:\Users\user\Desktop\050_qbot.dll"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",#1
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\050_qbot.dll,lcopy_block_row
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",#1
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 656
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 660
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\050_qbot.dll,lcopy_sample_rows
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\050_qbot.dll,ldiv_round_up
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",lcopy_block_row
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",lcopy_sample_rows
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",ldiv_round_up
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",next
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",lround_up
|
|
|
|
C:\Windows\SysWOW64\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\050_qbot.dll",lpeg_write_tables
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 652
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7188 -s 668
|
|
|
|
C:\Windows\SysWOW64\wermgr.exe
|
C:\Windows\SysWOW64\wermgr.exe
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 652
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 176
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7644 -s 652
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 7716 -s 652
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
There are 12 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://upx.sf.net
|
unknown
|
||
|
https://www.xfinity.com/mobile/policies/broadband-disclosures
|
unknown
|
||
|
https://www.xfinity.com/learn/internet-service/acp
|
unknown
|
||
|
https://www.xfinity.com/networkmanagement
|
unknown
|
||
|
https://xfinity.com/
|
68.87.41.40
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
xfinity.com
|
68.87.41.40
|
||
|
www.xfinity.com
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
38.2.18.164
|
unknown
|
United States
|
|
|
|
2.82.8.80
|
unknown
|
Portugal
|
|
|
|
70.160.67.203
|
unknown
|
United States
|
|
|
|
83.110.223.61
|
unknown
|
United Arab Emirates
|
|
|
|
209.171.160.69
|
unknown
|
Canada
|
|
|
|
84.215.202.8
|
unknown
|
Norway
|
|
|
|
184.182.66.109
|
unknown
|
United States
|
|
|
|
200.84.211.255
|
unknown
|
Venezuela
|
|
|
|
125.99.69.178
|
unknown
|
India
|
|
|
|
174.4.89.3
|
unknown
|
Canada
|
|
|
|
121.121.108.120
|
unknown
|
Malaysia
|
|
|
|
161.142.103.187
|
unknown
|
Malaysia
|
|
|
|
213.64.33.92
|
unknown
|
Sweden
|
|
|
|
114.143.176.236
|
unknown
|
India
|
|
|
|
24.234.220.88
|
unknown
|
United States
|
|
|
|
67.70.120.249
|
unknown
|
Canada
|
|
|
|
73.88.173.113
|
unknown
|
United States
|
|
|
|
72.205.104.134
|
unknown
|
United States
|
|
|
|
117.195.17.148
|
unknown
|
India
|
|
|
|
69.160.121.6
|
unknown
|
Jamaica
|
|
|
|
176.133.4.230
|
unknown
|
France
|
|
|
|
183.87.163.165
|
unknown
|
India
|
|
|
|
184.181.75.148
|
unknown
|
United States
|
|
|
|
70.49.205.198
|
unknown
|
Canada
|
|
|
|
87.221.153.182
|
unknown
|
Spain
|
|
|
|
70.50.1.252
|
unknown
|
Canada
|
|
|
|
85.101.239.116
|
unknown
|
Turkey
|
|
|
|
181.4.225.225
|
unknown
|
Argentina
|
|
|
|
100.4.163.158
|
unknown
|
United States
|
|
|
|
103.141.50.43
|
unknown
|
India
|
|
|
|
70.50.83.216
|
unknown
|
Canada
|
|
|
|
92.1.170.110
|
unknown
|
United Kingdom
|
|
|
|
64.121.161.102
|
unknown
|
United States
|
|
|
|
96.56.197.26
|
unknown
|
United States
|
|
|
|
188.28.19.84
|
unknown
|
United Kingdom
|
|
|
|
125.99.76.102
|
unknown
|
India
|
|
|
|
81.101.185.146
|
unknown
|
United Kingdom
|
|
|
|
116.75.63.183
|
unknown
|
India
|
|
|
|
124.246.122.199
|
unknown
|
Singapore
|
|
|
|
147.147.30.126
|
unknown
|
United Kingdom
|
|
|
|
109.130.247.84
|
unknown
|
Belgium
|
|
|
|
75.109.111.89
|
unknown
|
United States
|
|
|
|
88.126.94.4
|
unknown
|
France
|
|
|
|
124.122.47.148
|
unknown
|
Thailand
|
|
|
|
66.241.183.99
|
unknown
|
United States
|
|
|
|
180.151.19.13
|
unknown
|
India
|
|
|
|
94.204.202.106
|
unknown
|
United Arab Emirates
|
|
|
|
47.205.25.170
|
unknown
|
United States
|
|
|
|
95.45.50.93
|
unknown
|
Ireland
|
|
|
|
103.212.19.254
|
unknown
|
India
|
|
|
|
85.61.165.153
|
unknown
|
Spain
|
|
|
|
91.160.70.68
|
unknown
|
France
|
|
|
|
201.143.215.69
|
unknown
|
Mexico
|
|
|
|
184.63.133.131
|
unknown
|
United States
|
|
|
|
203.109.44.236
|
unknown
|
India
|
|
|
|
90.104.151.37
|
unknown
|
France
|
|
|
|
201.244.108.183
|
unknown
|
Colombia
|
|
|
|
2.49.63.160
|
unknown
|
United Arab Emirates
|
|
|
|
103.42.86.42
|
unknown
|
India
|
|
|
|
80.6.50.34
|
unknown
|
United Kingdom
|
|
|
|
175.156.217.7
|
unknown
|
Singapore
|
|
|
|
103.139.242.6
|
unknown
|
India
|
|
|
|
27.0.48.233
|
unknown
|
India
|
|
|
|
70.28.50.223
|
unknown
|
Canada
|
|
|
|
173.17.45.60
|
unknown
|
United States
|
|
|
|
81.229.117.95
|
unknown
|
Sweden
|
|
|
|
70.64.77.115
|
unknown
|
Canada
|
|
|
|
87.252.106.39
|
unknown
|
Italy
|
|
|
|
79.77.142.22
|
unknown
|
United Kingdom
|
|
|
|
98.163.227.79
|
unknown
|
United States
|
|
|
|
93.187.148.45
|
unknown
|
United Kingdom
|
|
|
|
186.75.95.6
|
unknown
|
Panama
|
|
|
|
50.68.186.195
|
unknown
|
Canada
|
|
|
|
45.62.70.33
|
unknown
|
Canada
|
|
|
|
83.249.198.100
|
unknown
|
Sweden
|
|
|
|
12.172.173.82
|
unknown
|
United States
|
|
|
|
47.199.241.39
|
unknown
|
United States
|
|
|
|
79.168.224.165
|
unknown
|
Portugal
|
|
|
|
199.27.66.213
|
unknown
|
United States
|
|
|
|
200.44.198.47
|
unknown
|
Venezuela
|
|
|
|
176.142.207.63
|
unknown
|
France
|
|
|
|
86.173.2.12
|
unknown
|
United Kingdom
|
|
|
|
45.62.75.250
|
unknown
|
Canada
|
|
|
|
92.154.17.149
|
unknown
|
France
|
|
|
|
90.29.86.138
|
unknown
|
France
|
|
|
|
174.58.146.57
|
unknown
|
United States
|
|
|
|
223.166.13.95
|
unknown
|
China
|
|
|
|
5.192.141.228
|
unknown
|
United Arab Emirates
|
|
|
|
65.95.141.84
|
unknown
|
Canada
|
|
|
|
75.98.154.19
|
unknown
|
United States
|
|
|
|
77.126.99.230
|
unknown
|
Israel
|
|
|
|
103.123.223.133
|
unknown
|
India
|
|
|
|
74.12.147.139
|
unknown
|
Canada
|
|
|
|
92.9.45.20
|
unknown
|
United Kingdom
|
|
|
|
113.11.92.30
|
unknown
|
Bangladesh
|
|
|
|
77.86.98.236
|
unknown
|
United Kingdom
|
|
|
|
103.140.174.20
|
unknown
|
India
|
|
|
|
78.192.109.105
|
unknown
|
France
|
|
|
|
78.82.143.154
|
unknown
|
Sweden
|
|
|
|
68.87.41.40
|
xfinity.com
|
United States
|
||
|
192.168.2.1
|
unknown
|
unknown
|
There are 91 hidden IPs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHivePermissionsCorrect
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiHiveOwnerCorrect
|
||
|
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
|
PendingFileRenameOperations
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
|
AmiOverridePath
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile
|
WritePermissionsCheck
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile
|
ProviderSyncId
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProgramId
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
FileId
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LongPathHash
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Name
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Publisher
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Version
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinFileVersion
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinaryType
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductName
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductVersion
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LinkDate
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinProductVersion
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Size
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Language
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsPeFile
|
||
|
\REGISTRY\A\{e23ddb9a-673d-f6c9-ce1e-c23e62bb669b}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsOsComponent
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018800A6CFCF3E8
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018800A6CFCF3E8
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceId
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
ApplicationFlags
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
|
ExceptionRecord
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Mmoqacuemo
|
9d198f8d
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Mmoqacuemo
|
a8865fc3
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Mmoqacuemo
|
aac77fbf
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Mmoqacuemo
|
127b18da
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Mmoqacuemo
|
6f735750
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Mmoqacuemo
|
d7cf3035
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Mmoqacuemo
|
103a38a6
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Mmoqacuemo
|
e250e07b
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Mmoqacuemo
|
d58e1049
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Mmoqacuemo
|
9d198f8d
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000CAA868BB9
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile
|
WritePermissionsCheck
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile
|
ProviderSyncId
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProgramId
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
FileId
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LongPathHash
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Name
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Publisher
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Version
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinFileVersion
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinaryType
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductName
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
ProductVersion
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
LinkDate
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
BinProductVersion
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Size
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
Language
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsPeFile
|
||
|
\REGISTRY\A\{5cd36e04-f07d-40da-c658-aa07a4483f02}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
|
IsOsComponent
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
|
0018000CAA868BB9
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
8ac2389b
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
bf5de8d5
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
bd1cc8a9
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
5a0afcc
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
78a8e046
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
c0148723
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
7e18fb0
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
f58b576d
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
8ac2389b
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
8ac2389b
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
8ac2389b
|
||
|
HKEY_CURRENT_USER\Software\Microsoft\Alvurasehc
|
8ac2389b
|
There are 68 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4FC0000
|
heap
|
page read and write
|
|
|
|
34AA000
|
heap
|
page read and write
|
|
|
|
62AF000
|
heap
|
page read and write
|
||
|
2BA0000
|
heap
|
page read and write
|
||
|
80E000
|
stack
|
page read and write
|
||
|
D14000
|
heap
|
page read and write
|
||
|
3060000
|
heap
|
page read and write
|
||
|
279D0180000
|
trusted library allocation
|
page read and write
|
||
|
279CF69F000
|
heap
|
page read and write
|
||
|
33B0000
|
heap
|
page read and write
|
||
|
3320000
|
heap
|
page read and write
|
||
|
5324000
|
heap
|
page read and write
|
||
|
279CF5E0000
|
heap
|
page read and write
|
||
|
25658000000
|
unkown
|
page read and write
|
||
|
9EB000
|
heap
|
page read and write
|
||
|
5061000
|
heap
|
page read and write
|
||
|
6218000
|
heap
|
page read and write
|
||
|
32A0000
|
heap
|
page read and write
|
||
|
690000
|
heap
|
page read and write
|
||
|
62BD000
|
heap
|
page read and write
|
||
|
6ADEA000
|
unkown
|
page readonly
|
||
|
6ADF3000
|
unkown
|
page readonly
|
||
|
6AC9000
|
heap
|
page read and write
|
||
|
6B6AC7D000
|
stack
|
page read and write
|
||
|
BDF000
|
stack
|
page read and write
|
||
|
6218000
|
heap
|
page read and write
|
||
|
62AF000
|
heap
|
page read and write
|
||
|
6ADD7000
|
unkown
|
page readonly
|
||
|
279CF480000
|
heap
|
page read and write
|
||
|
279D03E0000
|
heap
|
page readonly
|
||
|
2A40000
|
heap
|
page read and write
|
||
|
6ADC7000
|
unkown
|
page readonly
|
||
|
628D000
|
heap
|
page read and write
|
||
|
628D000
|
heap
|
page read and write
|
||
|
6218000
|
heap
|
page read and write
|
||
|
62BD000
|
heap
|
page read and write
|
||
|
D48000
|
heap
|
page read and write
|
||
|
4AB0000
|
heap
|
page read and write
|
||
|
2565808D000
|
heap
|
page read and write
|
||
|
279D0190000
|
trusted library allocation
|
page read and write
|
||
|
4C00000
|
heap
|
page read and write
|
||
|
36C000
|
stack
|
page read and write
|
||
|
6ADFA000
|
unkown
|
page readonly
|
||
|
279CF829000
|
heap
|
page read and write
|
||
|
5300000
|
heap
|
page read and write
|
||
|
D3C000
|
heap
|
page read and write
|
||
|
D79000
|
heap
|
page read and write
|
||
|
D79000
|
heap
|
page read and write
|
||
|
6218000
|
heap
|
page read and write
|
||
|
25658300000
|
heap
|
page read and write
|
||
|
621C000
|
heap
|
page read and write
|
||
|
32E0000
|
heap
|
page read and write
|
||
|
3220000
|
heap
|
page read and write
|
||
|
3220000
|
heap
|
page read and write
|
||
|
32C4000
|
heap
|
page read and write
|
||
|
5324000
|
heap
|
page read and write
|
||
|
621C000
|
heap
|
page read and write
|
||
|
6ADF4000
|
unkown
|
page read and write
|
||
|
2B50000
|
heap
|
page read and write
|
||
|
5324000
|
heap
|
page read and write
|
||
|
358F000
|
stack
|
page read and write
|
||
|
D3E937B000
|
stack
|
page read and write
|
||
|
2E90000
|
heap
|
page read and write
|
||
|
32C4000
|
heap
|
page read and write
|
||
|
6AD80000
|
unkown
|
page readonly
|
||
|
4D56000
|
heap
|
page read and write
|
||
|
2565807B000
|
heap
|
page read and write
|
||
|
3AB000
|
stack
|
page read and write
|
||
|
6ADF3000
|
unkown
|
page readonly
|
||
|
3040000
|
heap
|
page read and write
|
||
|
256580BC000
|
heap
|
page read and write
|
||
|
326F000
|
stack
|
page read and write
|
||
|
620C000
|
heap
|
page read and write
|
||
|
6AC9000
|
heap
|
page read and write
|
||
|
628D000
|
heap
|
page read and write
|
||
|
D3E9879000
|
stack
|
page read and write
|
||
|
4C8F000
|
stack
|
page read and write
|
||
|
327E000
|
stack
|
page read and write
|
||
|
307B000
|
stack
|
page read and write
|
||
|
6AD81000
|
unkown
|
page execute read
|
||
|
62BB000
|
heap
|
page read and write
|
||
|
5060000
|
heap
|
page read and write
|
||
|
2AEB000
|
stack
|
page read and write
|
||
|
62AF000
|
heap
|
page read and write
|
||
|
62BB000
|
heap
|
page read and write
|
||
|
D79000
|
heap
|
page read and write
|
||
|
5300000
|
heap
|
page read and write
|
||
|
840000
|
heap
|
page read and write
|
||
|
256580EC000
|
heap
|
page read and write
|
||
|
2FB0000
|
heap
|
page read and write
|
||
|
6218000
|
heap
|
page read and write
|
||
|
30F0000
|
heap
|
page read and write
|
||
|
1220000
|
trusted library allocation
|
page read and write
|
||
|
6ADEA000
|
unkown
|
page readonly
|
||
|
320E000
|
stack
|
page read and write
|
||
|
3410000
|
heap
|
page read and write
|
||
|
6AC2000
|
heap
|
page read and write
|
||
|
32AA000
|
heap
|
page read and write
|
||
|
5CF2000
|
heap
|
page read and write
|
||
|
279D03D0000
|
trusted library allocation
|
page read and write
|
||
|
317F000
|
stack
|
page read and write
|
||
|
4D0E000
|
stack
|
page read and write
|
||
|
25657EA0000
|
trusted library allocation
|
page read and write
|
||
|
6ADEA000
|
unkown
|
page readonly
|
||
|
2BCE000
|
stack
|
page read and write
|
||
|
5300000
|
heap
|
page read and write
|
||
|
D79000
|
heap
|
page read and write
|
||
|
279CF678000
|
heap
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
6AD81000
|
unkown
|
page execute read
|
||
|
6AD80000
|
unkown
|
page readonly
|
||
|
10001000
|
direct allocation
|
page execute read
|
||
|
5324000
|
heap
|
page read and write
|
||
|
2E0000
|
heap
|
page read and write
|
||
|
279CF5C0000
|
heap
|
page read and write
|
||
|
6AD80000
|
unkown
|
page readonly
|
||
|
2BFB000
|
stack
|
page read and write
|
||
|
256580EC000
|
heap
|
page read and write
|
||
|
25658115000
|
trusted library allocation
|
page read and write
|
||
|
3080000
|
heap
|
page read and write
|
||
|
620C000
|
heap
|
page read and write
|
||
|
62AF000
|
heap
|
page read and write
|
||
|
6AC6000
|
heap
|
page read and write
|
||
|
621C000
|
heap
|
page read and write
|
||
|
279CF630000
|
heap
|
page read and write
|
||
|
9E0000
|
heap
|
page read and write
|
||
|
34D000
|
stack
|
page read and write
|
||
|
303C000
|
stack
|
page read and write
|
||
|
12A1000
|
heap
|
page read and write
|
||
|
680000
|
heap
|
page read and write
|
||
|
2DA0000
|
heap
|
page read and write
|
||
|
628D000
|
heap
|
page read and write
|
||
|
6AD80000
|
unkown
|
page readonly
|
||
|
2E3B000
|
stack
|
page read and write
|
||
|
3010000
|
heap
|
page read and write
|
||
|
63B000
|
stack
|
page read and write
|
||
|
95F000
|
stack
|
page read and write
|
||
|
30B0000
|
heap
|
page read and write
|
||
|
670000
|
heap
|
page read and write
|
||
|
5324000
|
heap
|
page read and write
|
||
|
32C4000
|
heap
|
page read and write
|
||
|
327B000
|
stack
|
page read and write
|
||
|
4E50000
|
heap
|
page read and write
|
||
|
5300000
|
heap
|
page read and write
|
||
|
25657F00000
|
heap
|
page read and write
|
||
|
6ADF3000
|
unkown
|
page readonly
|
||
|
2565807C000
|
heap
|
page read and write
|
||
|
6ADF3000
|
unkown
|
page readonly
|
||
|
2C90000
|
heap
|
page read and write
|
||
|
6ACF000
|
heap
|
page read and write
|
||
|
628D000
|
heap
|
page read and write
|
||
|
6FD000
|
stack
|
page read and write
|
||
|
4F30000
|
heap
|
page read and write
|
||
|
6B6B1F9000
|
stack
|
page read and write
|
||
|
6ADFA000
|
unkown
|
page readonly
|
||
|
2F20000
|
heap
|
page read and write
|
||
|
313E000
|
stack
|
page read and write
|
||
|
6ADFA000
|
unkown
|
page readonly
|
||
|
279CF820000
|
heap
|
page read and write
|
||
|
32C4000
|
heap
|
page read and write
|
||
|
3FE000
|
stack
|
page read and write
|
||
|
5300000
|
heap
|
page read and write
|
||
|
2FF0000
|
heap
|
page read and write
|
||
|
33FA000
|
heap
|
page read and write
|
||
|
2B50000
|
heap
|
page read and write
|
||
|
25658213000
|
heap
|
page read and write
|
||
|
62BD000
|
heap
|
page read and write
|
||
|
621C000
|
heap
|
page read and write
|
||
|
2E7A000
|
heap
|
page read and write
|
||
|
5324000
|
heap
|
page read and write
|
||
|
256580CB000
|
heap
|
page read and write
|
||
|
621C000
|
heap
|
page read and write
|
||
|
279D0110000
|
trusted library allocation
|
page read and write
|
||
|
6AD81000
|
unkown
|
page execute read
|
||
|
4270000
|
heap
|
page read and write
|
||
|
279CF67E000
|
heap
|
page read and write
|
||
|
628D000
|
heap
|
page read and write
|
||
|
D3E977D000
|
stack
|
page read and write
|
||
|
628D000
|
heap
|
page read and write
|
||
|
36B0000
|
heap
|
page read and write
|
||
|
6AD81000
|
unkown
|
page execute read
|
||
|
D79000
|
heap
|
page read and write
|
||
|
12A1000
|
heap
|
page read and write
|
||
|
65B4000
|
heap
|
page read and write
|
||
|
D79000
|
heap
|
page read and write
|
||
|
D3E97FE000
|
stack
|
page read and write
|
||
|
3230000
|
heap
|
page read and write
|
||
|
62AF000
|
heap
|
page read and write
|
||
|
6ADC7000
|
unkown
|
page readonly
|
||
|
25658028000
|
heap
|
page read and write
|
||
|
D4C000
|
heap
|
page read and write
|
||
|
6ADEA000
|
unkown
|
page readonly
|
||
|
7CF000
|
stack
|
page read and write
|
||
|
62BB000
|
heap
|
page read and write
|
||
|
2FFC000
|
stack
|
page read and write
|
||
|
CF1000
|
heap
|
page read and write
|
||
|
3290000
|
heap
|
page read and write
|
||
|
6ADF4000
|
unkown
|
page read and write
|
||
|
62BB000
|
heap
|
page read and write
|
||
|
65B6000
|
heap
|
page read and write
|
||
|
621C000
|
heap
|
page read and write
|
||
|
323C000
|
stack
|
page read and write
|
||
|
256580D3000
|
heap
|
page read and write
|
||
|
628D000
|
heap
|
page read and write
|
||
|
300E000
|
stack
|
page read and write
|
||
|
2F90000
|
heap
|
page read and write
|
||
|
5060000
|
heap
|
page read and write
|
||
|
2565807B000
|
heap
|
page read and write
|
||
|
5324000
|
heap
|
page read and write
|
||
|
6B6AE79000
|
stack
|
page read and write
|
||
|
32BE000
|
stack
|
page read and write
|
||
|
5324000
|
heap
|
page read and write
|
||
|
62BB000
|
heap
|
page read and write
|
||
|
62BD000
|
heap
|
page read and write
|
||
|
2CFC000
|
stack
|
page read and write
|
||
|
32C0000
|
heap
|
page read and write
|
||
|
279CF830000
|
trusted library allocation
|
page read and write
|
||
|
32C0000
|
heap
|
page read and write
|
||
|
25657E90000
|
heap
|
page read and write
|
||
|
6ADD7000
|
unkown
|
page readonly
|
||
|
32C4000
|
heap
|
page read and write
|
||
|
25658100000
|
trusted library allocation
|
page read and write
|
||
|
2BEC000
|
stack
|
page read and write
|
||
|
65BC000
|
heap
|
page read and write
|
||
|
25658313000
|
heap
|
page read and write
|
||
|
32C4000
|
heap
|
page read and write
|
||
|
7F0000
|
heap
|
page read and write
|
||
|
78E000
|
stack
|
page read and write
|
||
|
6FDA000
|
heap
|
page read and write
|
||
|
2FDE000
|
stack
|
page read and write
|
||
|
57E3000
|
heap
|
page read and write
|
||
|
4D4F000
|
stack
|
page read and write
|
||
|
10000000
|
direct allocation
|
page read and write
|
||
|
4370000
|
heap
|
page read and write
|
||
|
620C000
|
heap
|
page read and write
|
||
|
279CF677000
|
heap
|
page read and write
|
||
|
6AD80000
|
unkown
|
page readonly
|
||
|
25658102000
|
trusted library allocation
|
page read and write
|
||
|
256580CD000
|
heap
|
page read and write
|
||
|
1001A000
|
direct allocation
|
page readonly
|
||
|
6ADFA000
|
unkown
|
page readonly
|
||
|
256580EB000
|
heap
|
page read and write
|
||
|
2F8B000
|
stack
|
page read and write
|
||
|
32C4000
|
heap
|
page read and write
|
||
|
62AF000
|
heap
|
page read and write
|
||
|
6ADF7000
|
unkown
|
page readonly
|
||
|
25658123000
|
heap
|
page read and write
|
||
|
2565803C000
|
heap
|
page read and write
|
||
|
5300000
|
heap
|
page read and write
|
||
|
6ADF4000
|
unkown
|
page read and write
|
||
|
30E0000
|
heap
|
page read and write
|
||
|
65B2000
|
heap
|
page read and write
|
||
|
6ADFA000
|
unkown
|
page readonly
|
||
|
6ADC7000
|
unkown
|
page readonly
|
||
|
2565807C000
|
heap
|
page read and write
|
||
|
5BE4000
|
heap
|
page read and write
|
||
|
7FA000
|
heap
|
page read and write
|
||
|
6ABF000
|
heap
|
page read and write
|
||
|
6ADF7000
|
unkown
|
page readonly
|
||
|
503F000
|
heap
|
page read and write
|
||
|
48EF000
|
stack
|
page read and write
|
||
|
65B9000
|
heap
|
page read and write
|
||
|
25658302000
|
heap
|
page read and write
|
||
|
279D03F0000
|
trusted library allocation
|
page read and write
|
||
|
2E70000
|
heap
|
page read and write
|
||
|
503F000
|
heap
|
page read and write
|
||
|
D20000
|
heap
|
page read and write
|
||
|
621C000
|
heap
|
page read and write
|
||
|
62AF000
|
heap
|
page read and write
|
||
|
4C4E000
|
stack
|
page read and write
|
||
|
279CF638000
|
heap
|
page read and write
|
||
|
62BD000
|
heap
|
page read and write
|
||
|
65BE000
|
heap
|
page read and write
|
||
|
620C000
|
heap
|
page read and write
|
||
|
4E60000
|
trusted library allocation
|
page read and write
|
||
|
5061000
|
heap
|
page read and write
|
||
|
256580E8000
|
heap
|
page read and write
|
||
|
2E60000
|
heap
|
page read and write
|
||
|
279D0400000
|
trusted library allocation
|
page read and write
|
||
|
65B7000
|
heap
|
page read and write
|
||
|
256580E4000
|
heap
|
page read and write
|
||
|
279CF825000
|
heap
|
page read and write
|
||
|
25658302000
|
heap
|
page read and write
|
||
|
36C0000
|
heap
|
page read and write
|
||
|
256580D2000
|
heap
|
page read and write
|
||
|
63E4000
|
heap
|
page read and write
|
||
|
2EE0000
|
heap
|
page read and write
|
||
|
620C000
|
heap
|
page read and write
|
||
|
5300000
|
heap
|
page read and write
|
||
|
620C000
|
heap
|
page read and write
|
||
|
25658313000
|
heap
|
page read and write
|
||
|
304E000
|
stack
|
page read and write
|
||
|
256580D2000
|
heap
|
page read and write
|
||
|
308A000
|
heap
|
page read and write
|
||
|
4FE3000
|
heap
|
page read and write
|
||
|
370000
|
heap
|
page read and write
|
||
|
620C000
|
heap
|
page read and write
|
||
|
4AC0000
|
heap
|
page read and write
|
||
|
2DA0000
|
heap
|
page read and write
|
||
|
62AF000
|
heap
|
page read and write
|
||
|
6ADF4000
|
unkown
|
page read and write
|
||
|
6ADD7000
|
unkown
|
page readonly
|
||
|
33F0000
|
heap
|
page read and write
|
||
|
300000
|
heap
|
page read and write
|
||
|
D3E96F9000
|
stack
|
page read and write
|
||
|
D79000
|
heap
|
page read and write
|
||
|
2F10000
|
heap
|
page read and write
|
||
|
2D3B000
|
stack
|
page read and write
|
||
|
322A000
|
heap
|
page read and write
|
||
|
304A000
|
heap
|
page read and write
|
||
|
628D000
|
heap
|
page read and write
|
||
|
D50000
|
heap
|
page read and write
|
||
|
D79000
|
heap
|
page read and write
|
||
|
6ADF3000
|
unkown
|
page readonly
|
||
|
25658013000
|
unkown
|
page read and write
|
||
|
2B80000
|
heap
|
page read and write
|
||
|
279D0120000
|
trusted library allocation
|
page read and write
|
||
|
6ABB000
|
heap
|
page read and write
|
||
|
6218000
|
heap
|
page read and write
|
||
|
5300000
|
heap
|
page read and write
|
||
|
6ADC7000
|
unkown
|
page readonly
|
||
|
3DC000
|
stack
|
page read and write
|
||
|
3470000
|
heap
|
page read and write
|
||
|
10022000
|
direct allocation
|
page readonly
|
||
|
279CF67F000
|
heap
|
page read and write
|
||
|
3B0000
|
heap
|
page read and write
|
||
|
62BB000
|
heap
|
page read and write
|
||
|
62BD000
|
heap
|
page read and write
|
||
|
3F0000
|
heap
|
page read and write
|
||
|
256580FD000
|
heap
|
page read and write
|
||
|
2BBC000
|
stack
|
page read and write
|
||
|
2565803A000
|
heap
|
page read and write
|
||
|
2AAC000
|
stack
|
page read and write
|
||
|
279D0450000
|
trusted library allocation
|
page read and write
|
||
|
25658202000
|
heap
|
page read and write
|
||
|
84A000
|
heap
|
page read and write
|
||
|
2EF0000
|
heap
|
page read and write
|
||
|
9FA000
|
heap
|
page read and write
|
||
|
D21000
|
heap
|
page read and write
|
||
|
620C000
|
heap
|
page read and write
|
||
|
6AD81000
|
unkown
|
page execute read
|
||
|
D6F000
|
heap
|
page read and write
|
||
|
62BB000
|
heap
|
page read and write
|
||
|
5324000
|
heap
|
page read and write
|
||
|
6ADF7000
|
unkown
|
page readonly
|
||
|
621C000
|
heap
|
page read and write
|
||
|
6FC4000
|
heap
|
page read and write
|
||
|
6ADF4000
|
unkown
|
page read and write
|
||
|
62BB000
|
heap
|
page read and write
|
||
|
6ADF7000
|
unkown
|
page readonly
|
||
|
4D40000
|
direct allocation
|
page execute read
|
||
|
9F6000
|
heap
|
page read and write
|
||
|
6218000
|
heap
|
page read and write
|
||
|
345A000
|
heap
|
page read and write
|
||
|
2F0F000
|
stack
|
page read and write
|
||
|
62AF000
|
heap
|
page read and write
|
||
|
6ADD7000
|
unkown
|
page readonly
|
||
|
3450000
|
heap
|
page read and write
|
||
|
32C4000
|
heap
|
page read and write
|
||
|
62BD000
|
heap
|
page read and write
|
||
|
1001F000
|
direct allocation
|
page read and write
|
||
|
2F4C000
|
stack
|
page read and write
|
||
|
840000
|
heap
|
page read and write
|
||
|
620C000
|
heap
|
page read and write
|
||
|
D79000
|
heap
|
page read and write
|
||
|
D79000
|
heap
|
page read and write
|
||
|
628C000
|
heap
|
page read and write
|
||
|
621C000
|
heap
|
page read and write
|
||
|
6218000
|
heap
|
page read and write
|
||
|
62BD000
|
heap
|
page read and write
|
||
|
62BB000
|
heap
|
page read and write
|
||
|
6ADEA000
|
unkown
|
page readonly
|
||
|
92F000
|
stack
|
page read and write
|
||
|
341E000
|
stack
|
page read and write
|
||
|
25658200000
|
heap
|
page read and write
|
||
|
279CF490000
|
trusted library allocation
|
page read and write
|
||
|
34A0000
|
heap
|
page read and write
|
||
|
62BD000
|
heap
|
page read and write
|
||
|
6ACF000
|
heap
|
page read and write
|
||
|
850000
|
heap
|
page read and write
|
||
|
6ADF7000
|
unkown
|
page readonly
|
||
|
279CF67E000
|
heap
|
page read and write
|
||
|
6ADC7000
|
unkown
|
page readonly
|
||
|
7DE000
|
stack
|
page read and write
|
||
|
323B000
|
stack
|
page read and write
|
||
|
6218000
|
heap
|
page read and write
|
||
|
D6F000
|
heap
|
page read and write
|
||
|
6ADD7000
|
unkown
|
page readonly
|
||
|
5300000
|
heap
|
page read and write
|
||
|
2565803A000
|
heap
|
page read and write
|
||
|
3370000
|
heap
|
page read and write
|
||
|
63AC000
|
heap
|
page read and write
|
||
|
4D40000
|
heap
|
page read and write
|
There are 383 hidden memdumps, click here to show them.