Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
pcre2-16.dll
|
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
initial sample
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pcr_1731c9291b48156d38e2b4f8fc44dc6afe3fb_76fbbc46_037511ff-28df-4739-9281-9d59950f9335\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pcr_1731c9291b48156d38e2b4f8fc44dc6afe3fb_76fbbc46_9d0da3c6-3573-4aad-832a-d223597dd415\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pcr_7e5183b4bd0fdc294ad553aa5ff79f7eff7cd_76fbbc46_ee145759-fa36-48dc-86ba-2b6d51b93db1\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_pcr_a85d3f61e282c6ab111541d23626a541f6483d_76fbbc46_27c8a652-5e23-4709-baa0-ace937338ba4\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AD.tmp.dmp
|
Mini DuMP crash report, 14 streams, Mon May 27 18:14:37 2024, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1ED.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20D.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB37.tmp.dmp
|
Mini DuMP crash report, 14 streams, Mon May 27 18:14:31 2024, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB47.tmp.dmp
|
Mini DuMP crash report, 14 streams, Mon May 27 18:14:31 2024, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREBF4.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC23.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC33.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC81.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF5D6.tmp.dmp
|
Mini DuMP crash report, 14 streams, Mon May 27 18:14:34 2024, 0x1205a4 type
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF616.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF636.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
There are 8 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Windows\System32\loaddll64.exe
|
loaddll64.exe "C:\Users\user\Desktop\pcre2-16.dll"
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
C:\Windows\System32\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",#1
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\pcre2-16.dll,pcre2_callout_enumerate_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",#1
|
||
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 7336 -s 332
|
||
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 7320 -s 332
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\pcre2-16.dll,pcre2_code_copy_16
|
||
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 7596 -s 324
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe C:\Users\user\Desktop\pcre2-16.dll,pcre2_code_copy_with_tables_16
|
||
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 7756 -s 324
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_callout_enumerate_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_code_copy_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_code_copy_with_tables_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_number_from_name_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_nametable_scan_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_list_get_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_list_free_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_length_bynumber_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_length_byname_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_get_bynumber_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_get_byname_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_free_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_copy_bynumber_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substring_copy_byname_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_substitute_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_substitute_callout_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_recursion_memory_management_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_recursion_limit_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_parens_nest_limit_16
|
||
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\pcre2-16.dll",pcre2_set_offset_limit_16
|
There are 21 hidden processes, click here to show them.
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://upx.sf.net
|
unknown
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
ProgramId
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
FileId
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
LowerCaseLongPath
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
LongPathHash
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Name
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
OriginalFileName
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Publisher
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Version
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
BinFileVersion
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
BinaryType
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
ProductName
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
ProductVersion
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
LinkDate
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
BinProductVersion
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
AppxPackageFullName
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
AppxPackageRelativeId
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Size
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Language
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
IsOsComponent
|
||
\REGISTRY\A\{708ab013-54ef-2dd4-d336-56c6996200e2}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41
|
Usn
|
There are 10 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
FAA1D7F000
|
stack
|
page read and write
|
||
19B18170000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
1B511650000
|
heap
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
29248EE0000
|
heap
|
page read and write
|
||
1E4D3CF000
|
stack
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
19B182F8000
|
heap
|
page read and write
|
||
21501380000
|
heap
|
page read and write
|
||
266FC930000
|
heap
|
page read and write
|
||
173DED60000
|
remote allocation
|
page read and write
|
||
23812BF0000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
1AFC8B20000
|
heap
|
page read and write
|
||
D76390F000
|
stack
|
page read and write
|
||
1AC998B8000
|
heap
|
page read and write
|
||
A389B7E000
|
stack
|
page read and write
|
||
652C8FF000
|
stack
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
16B52995000
|
heap
|
page read and write
|
||
1144B8B0000
|
remote allocation
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
173DD210000
|
heap
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
1AFC7060000
|
heap
|
page read and write
|
||
16102725000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
F98EA7F000
|
stack
|
page read and write
|
||
1AC99830000
|
heap
|
page read and write
|
||
1A71D620000
|
heap
|
page read and write
|
||
1B511640000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
23812DA0000
|
remote allocation
|
page read and write
|
||
33DC17F000
|
stack
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
47C56FF000
|
stack
|
page read and write
|
||
1B5116B0000
|
heap
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
16B52990000
|
heap
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
266FC6C0000
|
heap
|
page read and write
|
||
2C3B5B40000
|
heap
|
page read and write
|
||
266FC6F0000
|
heap
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
F842D1C000
|
stack
|
page read and write
|
||
F98E7BC000
|
stack
|
page read and write
|
||
29AF6870000
|
remote allocation
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
FAA1CFE000
|
stack
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
25F0A250000
|
heap
|
page read and write
|
||
652C5AC000
|
stack
|
page read and write
|
||
1DA21010000
|
remote allocation
|
page read and write
|
||
D1F79EF000
|
stack
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
1144B640000
|
heap
|
page read and write
|
||
23812AF0000
|
heap
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
78DF7FF000
|
stack
|
page read and write
|
||
16B54310000
|
heap
|
page read and write
|
||
2924AA00000
|
heap
|
page read and write
|
||
1FBB05C0000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
190ABD70000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
25F086C0000
|
heap
|
page read and write
|
||
1A085E60000
|
heap
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
266FC6F8000
|
heap
|
page read and write
|
||
16B52760000
|
heap
|
page read and write
|
||
1A71D628000
|
heap
|
page read and write
|
||
7AFC4BC000
|
stack
|
page read and write
|
||
F842D9E000
|
stack
|
page read and write
|
||
1DA20D70000
|
heap
|
page read and write
|
||
F98EAFF000
|
stack
|
page read and write
|
||
1A087BB0000
|
heap
|
page read and write
|
||
19B18290000
|
heap
|
page read and write
|
||
29AF65C0000
|
heap
|
page read and write
|
||
1DA21115000
|
heap
|
page read and write
|
||
230168E0000
|
heap
|
page read and write
|
||
25F08728000
|
heap
|
page read and write
|
||
1A71D730000
|
heap
|
page read and write
|
||
960ADDF000
|
stack
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
23812C50000
|
heap
|
page read and write
|
||
190ABCC0000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
173DD2B0000
|
heap
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
1A71D62F000
|
heap
|
page read and write
|
||
2C3B3F50000
|
heap
|
page read and write
|
||
33DC0FF000
|
stack
|
page read and write
|
||
29AF6975000
|
heap
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
16102700000
|
heap
|
page read and write
|
||
21501460000
|
heap
|
page read and write
|
||
F53447F000
|
stack
|
page read and write
|
||
25F086F0000
|
heap
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
1A71D830000
|
heap
|
page read and write
|
||
270E9A80000
|
heap
|
page read and write
|
||
FDD07F000
|
stack
|
page read and write
|
||
47C567C000
|
stack
|
page read and write
|
||
1CD4BFD8000
|
heap
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
1E4D67F000
|
stack
|
page read and write
|
||
29AF68C0000
|
heap
|
page read and write
|
||
190ABCE0000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
270E9B40000
|
heap
|
page read and write
|
||
6CB4B7F000
|
stack
|
page read and write
|
||
A389AFF000
|
stack
|
page read and write
|
||
1FBB0825000
|
heap
|
page read and write
|
||
1CD4C385000
|
heap
|
page read and write
|
||
1D95A040000
|
heap
|
page read and write
|
||
215011B8000
|
heap
|
page read and write
|
||
2C3B4210000
|
remote allocation
|
page read and write
|
||
1DA20D78000
|
heap
|
page read and write
|
||
270E9B48000
|
heap
|
page read and write
|
||
1A086200000
|
remote allocation
|
page read and write
|
||
1CD4BF50000
|
heap
|
page read and write
|
||
29248E40000
|
heap
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
FDD0FF000
|
stack
|
page read and write
|
||
1AC998B0000
|
heap
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
955F67F000
|
stack
|
page read and write
|
||
2C3B4028000
|
heap
|
page read and write
|
||
173DD245000
|
heap
|
page read and write
|
||
230169A8000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
1A71F190000
|
heap
|
page read and write
|
||
1AFC7068000
|
heap
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
1A086220000
|
heap
|
page read and write
|
||
2C3B4235000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
19B19BC0000
|
heap
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
29248E30000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
190ABBC0000
|
heap
|
page read and write
|
||
4C80F2F000
|
stack
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
F84307E000
|
stack
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
1AC99810000
|
heap
|
page read and write
|
||
270E9E05000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
190ABAD0000
|
heap
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
240C1180000
|
heap
|
page read and write
|
||
161027C0000
|
remote allocation
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
29AF6970000
|
heap
|
page read and write
|
||
B180FC000
|
stack
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
25F086D0000
|
heap
|
page read and write
|
||
1FBB04C0000
|
heap
|
page read and write
|
||
2924A980000
|
remote allocation
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
161027D0000
|
heap
|
page read and write
|
||
173DEC60000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
173DD200000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
21501465000
|
heap
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
1AFC7215000
|
heap
|
page read and write
|
||
78DF77E000
|
stack
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
173DD250000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
608DAEC000
|
stack
|
page read and write
|
||
190AD530000
|
remote allocation
|
page read and write
|
||
4C80FAF000
|
stack
|
page read and write
|
||
1AFC6FE0000
|
heap
|
page read and write
|
||
4B9147F000
|
stack
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
1FBB0820000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
240C0F48000
|
heap
|
page read and write
|
||
16E80FF000
|
stack
|
page read and write
|
||
955F39C000
|
stack
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
29AF66A0000
|
heap
|
page read and write
|
||
1A71D810000
|
heap
|
page read and write
|
||
190ABD75000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
266FE2D0000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
2C3B3E70000
|
heap
|
page read and write
|
||
1AFC7190000
|
remote allocation
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
1AFC6EE0000
|
heap
|
page read and write
|
||
1A085F60000
|
heap
|
page read and write
|
||
19B18250000
|
heap
|
page read and write
|
||
1AC99BA0000
|
heap
|
page read and write
|
||
2C3B3F70000
|
heap
|
page read and write
|
||
161027D8000
|
heap
|
page read and write
|
||
FAA1C7C000
|
stack
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
16B52880000
|
heap
|
page read and write
|
||
1A086060000
|
heap
|
page read and write
|
||
16102720000
|
heap
|
page read and write
|
||
1FBB2110000
|
heap
|
page read and write
|
||
16B52780000
|
heap
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
C66087E000
|
stack
|
page read and write
|
||
1DA20D60000
|
heap
|
page read and write
|
||
21502D00000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
7AFC5BF000
|
stack
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
1D95A060000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
1D95A030000
|
heap
|
page read and write
|
||
29AF67D0000
|
heap
|
page read and write
|
||
23016C40000
|
remote allocation
|
page read and write
|
||
190ABBC8000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
D76388C000
|
stack
|
page read and write
|
||
D76398E000
|
stack
|
page read and write
|
||
240C0F40000
|
heap
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
266FC935000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
D1F796F000
|
stack
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
1144B600000
|
heap
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
1144B8D0000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
23812BD0000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
960ACDC000
|
stack
|
page read and write
|
||
16E817F000
|
stack
|
page read and write
|
||
270E9AA0000
|
heap
|
page read and write
|
||
23812C58000
|
heap
|
page read and write
|
||
1AFC6FC0000
|
heap
|
page read and write
|
||
23018390000
|
heap
|
page read and write
|
||
1A086225000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
1AC99AE0000
|
heap
|
page read and write
|
||
33DC07C000
|
stack
|
page read and write
|
||
78DF6FC000
|
stack
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
23812E05000
|
heap
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
1CD4DB10000
|
heap
|
page read and write
|
||
270E9B20000
|
heap
|
page read and write
|
||
1AFC7210000
|
heap
|
page read and write
|
||
29248ED0000
|
heap
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
474531C000
|
stack
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
215013A0000
|
heap
|
page read and write
|
||
1FBB0770000
|
remote allocation
|
page read and write
|
||
2C3B4020000
|
heap
|
page read and write
|
||
4B911EF000
|
stack
|
page read and write
|
||
1FBB0640000
|
heap
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
23812E00000
|
heap
|
page read and write
|
||
1FBB05A0000
|
heap
|
page read and write
|
||
960AD5F000
|
stack
|
page read and write
|
||
240C0E50000
|
heap
|
page read and write
|
||
161026E0000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
1A71D860000
|
heap
|
page read and write
|
||
1DA20F40000
|
heap
|
page read and write
|
||
173DD240000
|
heap
|
page read and write
|
||
1144B648000
|
heap
|
page read and write
|
||
47C577F000
|
stack
|
page read and write
|
||
23016C65000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
29248E60000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
F5341BC000
|
stack
|
page read and write
|
||
25F08720000
|
heap
|
page read and write
|
||
1A71D865000
|
heap
|
page read and write
|
||
1B5116BD000
|
heap
|
page read and write
|
||
1144B610000
|
heap
|
page read and write
|
||
1CD4DA90000
|
remote allocation
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
1CD4BF70000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
266FE200000
|
remote allocation
|
page read and write
|
||
4B9116C000
|
stack
|
page read and write
|
||
1DA20F60000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
25F08970000
|
remote allocation
|
page read and write
|
||
266FC8C0000
|
heap
|
page read and write
|
||
19B18295000
|
heap
|
page read and write
|
||
1144D1C0000
|
heap
|
page read and write
|
||
1CD4BF40000
|
heap
|
page read and write
|
||
1D95A420000
|
heap
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
1FBB0648000
|
heap
|
page read and write
|
||
1D95A0AF000
|
heap
|
page read and write
|
||
270E9E00000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
2C3B4230000
|
heap
|
page read and write
|
||
1D95BBC0000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
25F089C5000
|
heap
|
page read and write
|
||
215011B0000
|
heap
|
page read and write
|
||
240C1060000
|
heap
|
page read and write
|
||
1AC99800000
|
heap
|
page read and write
|
||
25F089C0000
|
heap
|
page read and write
|
||
240C2AB0000
|
heap
|
page read and write
|
||
29AF66D8000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
C66053C000
|
stack
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
474539F000
|
stack
|
page read and write
|
||
1DA21090000
|
heap
|
page read and write
|
||
1D95A425000
|
heap
|
page read and write
|
||
19B19CD0000
|
remote allocation
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
955F6FF000
|
stack
|
page read and write
|
||
29248EE8000
|
heap
|
page read and write
|
||
6CB4A7C000
|
stack
|
page read and write
|
||
1144B8D5000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
7AFC53F000
|
stack
|
page read and write
|
||
21501190000
|
heap
|
page read and write
|
||
266FC6B0000
|
heap
|
page read and write
|
||
161040E0000
|
heap
|
page read and write
|
||
1AC99BA5000
|
heap
|
page read and write
|
||
C6605BE000
|
stack
|
page read and write
|
||
1D95A0A7000
|
heap
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
29248ED5000
|
heap
|
page read and write
|
||
AC479EF000
|
stack
|
page read and write
|
||
240C0F4E000
|
heap
|
page read and write
|
||
4C80EAC000
|
stack
|
page read and write
|
||
D1F78EC000
|
stack
|
page read and write
|
||
19B18270000
|
heap
|
page read and write
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
16B52680000
|
heap
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
238146C0000
|
heap
|
page read and write
|
||
190AD590000
|
heap
|
page read and write
|
||
1CD4C380000
|
heap
|
page read and write
|
||
1AC99AB0000
|
remote allocation
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
270E9A70000
|
heap
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
1CD4BFD0000
|
heap
|
page read and write
|
||
1DA21110000
|
heap
|
page read and write
|
||
23016900000
|
heap
|
page read and write
|
||
AC47C7F000
|
stack
|
page read and write
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
16102600000
|
heap
|
page read and write
|
||
19B182F0000
|
heap
|
page read and write
|
||
1A085F40000
|
heap
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
7FFE004F1000
|
unkown
|
page execute read
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
16B52930000
|
remote allocation
|
page read and write
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
23016C60000
|
heap
|
page read and write
|
||
1E4D34C000
|
stack
|
page read and write
|
||
1144B810000
|
heap
|
page read and write
|
||
FDCD9C000
|
stack
|
page read and write
|
||
173DD2B8000
|
heap
|
page read and write
|
||
23016800000
|
heap
|
page read and write
|
||
608DBEF000
|
stack
|
page read and write
|
||
7FFE0056A000
|
unkown
|
page readonly
|
||
16B52788000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
1D95A0A0000
|
heap
|
page read and write
|
||
240C1185000
|
heap
|
page read and write
|
||
652C87F000
|
stack
|
page read and write
|
||
A389A7C000
|
stack
|
page read and write
|
||
474567F000
|
stack
|
page read and write
|
||
29AF66D0000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
7FFE00552000
|
unkown
|
page readonly
|
||
230169A0000
|
heap
|
page read and write
|
||
F5344FF000
|
stack
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
AC4796C000
|
stack
|
page read and write
|
||
1B5116CA000
|
heap
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
7FFE00569000
|
unkown
|
page read and write
|
||
240C1040000
|
heap
|
page read and write
|
||
1B5116CD000
|
heap
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
||
6CB4AFF000
|
stack
|
page read and write
|
||
608DB6F000
|
stack
|
page read and write
|
||
7FFE00545000
|
unkown
|
page readonly
|
||
1A085F68000
|
heap
|
page read and write
|
||
16E807C000
|
stack
|
page read and write
|
||
7FFE004F0000
|
unkown
|
page readonly
|
There are 427 hidden memdumps, click here to show them.