Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
RDM_Root_Cert_Update_Windows.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\certmgr.exe (copy)
|
PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
|
dropped
|
 |
|
|
C:\Users\user\AppData\Local\Temp\is-QJPHV.tmp\RDM_ROOTCERTIFICATE.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Program Files\Mozilla Firefox\defaults\pref\firefox-windows-truststore.js (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\Mozilla Firefox\defaults\pref\is-29CV0.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\Mozilla Firefox\defaults\pref\is-JJ6M4.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\Mozilla Firefox\defaults\pref\local-settings.js (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\Mozilla Firefox\is-HUELK.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\Mozilla Firefox\umbrella.cfg (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\06b1cdeef9f4772f6611dd106fc96ef6_9e146be9-c76a-4720-bcdb-53011b87bd06
|
data
|
dropped
|
||
|
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\12cfd0983e562ab57a8466bb808ecf42_9e146be9-c76a-4720-bcdb-53011b87bd06
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-C0CB8.tmp\RDM_ROOTCERTIFICATE.exe (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-C0CB8.tmp\_isetup\_setup64.tmp
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-C0CB8.tmp\is-E52HS.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\AddCert.bat (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\RDM.ico (copy)
|
MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\RDM_RootCA.pem (copy)
|
PEM certificate
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\certremoval.bat (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\firefox-windows-truststore.js (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\freebl3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-28PQ0.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-329QV.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-3HNSB.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-6P8G2.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-7MPF9.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-9AB3G.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-A5MEV.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-C7M5T.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-EMD50.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-FPHRG.tmp
|
PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-HQ20L.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-JDJAU.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-JS3UT.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-M1RAI.tmp
|
PEM certificate
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-MFMEG.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-N9SOU.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-NPANL.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-OK1C3.tmp
|
MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-P11BP.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-THKUV.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\is-TOSFS.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\libnspr4.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\libplc4.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\libplds4.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\local-settings.js (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\nss3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\nssckbi.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\nssdbm3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\nssutil3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\rdm.pfx (copy)
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\smime3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\softokn3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\sqlite3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\ssl3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\umbrella.cfg (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\_isetup\_setup64.tmp
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-ICJ31.tmp\RDM_Root_Cert_Update_Windows.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
There are 48 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\AppData\Local\Temp\is-C0CB8.tmp\RDM_ROOTCERTIFICATE.exe
|
"C:\Users\user\AppData\Local\Temp\is-C0CB8.tmp\RDM_ROOTCERTIFICATE.exe" /VERYSILENT
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-QJPHV.tmp\RDM_ROOTCERTIFICATE.tmp
|
"C:\Users\user\AppData\Local\Temp\is-QJPHV.tmp\RDM_ROOTCERTIFICATE.tmp" /SL5="$104B6,1902883,887296,C:\Users\user\AppData\Local\Temp\is-C0CB8.tmp\RDM_ROOTCERTIFICATE.exe"
/VERYSILENT
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp/RdmCert/certremoval.bat""
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /S /D /c" echo 1 "
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\certmgr.exe
|
CertMgr.exe -del -c -n "RDM Device Root" -s -r localMachine Root
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\certmgr.exe
|
CertMgr.exe -del -c -n "RDM Device Root" -s -r localMachine Root
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\certmgr.exe
|
"C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp/RdmCert/CertMgr.exe" -add -c RDM_RootCA.pem -s -r localmachine Root
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp/RdmCert/AddCert.bat" "C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\RDM_RootCA.pem""
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c dir /B "C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\*.default*"
|
|
|
|
C:\Windows\SysWOW64\certutil.exe
|
certutil.exe -A -n "RDM_Device" -t "TCu,TCu,TCu" -d "C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\."
-i "C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\RDM_RootCA.pem"
|
|
|
|
C:\Windows\SysWOW64\certutil.exe
|
"C:\Windows\system32/certutil.exe" f p rdm736 importpfx "C:\Users\user\AppData\Local\Temp\is-F5SOP.tmp\RdmCert\rdm.pfx"
|
|
|
|
C:\Users\user\Desktop\RDM_Root_Cert_Update_Windows.exe
|
"C:\Users\user\Desktop\RDM_Root_Cert_Update_Windows.exe"
|
||
|
C:\Users\user\AppData\Local\Temp\is-ICJ31.tmp\RDM_Root_Cert_Update_Windows.tmp
|
"C:\Users\user\AppData\Local\Temp\is-ICJ31.tmp\RDM_Root_Cert_Update_Windows.tmp" /SL5="$1044E,2990719,887296,C:\Users\user\Desktop\RDM_Root_Cert_Update_Windows.exe"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\net.exe
|
"C:\Windows\system32\net.exe" stop "RDMAppweb"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\net1.exe
|
C:\Windows\system32\net1 stop "RDMAppweb"
|
||
|
C:\Windows\SysWOW64\net.exe
|
"C:\Windows\system32\net.exe" stop "Embedthis Rdmappweb"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\net1.exe
|
C:\Windows\system32\net1 stop "Embedthis Rdmappweb"
|
||
|
C:\Windows\SysWOW64\net.exe
|
"C:\Windows\system32\net.exe" start "RDMAppweb"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\net1.exe
|
C:\Windows\system32\net1 start "RDMAppweb"
|
||
|
C:\Windows\SysWOW64\net.exe
|
"C:\Windows\system32\net.exe" start "Embedthis Rdmappweb"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\net1.exe
|
C:\Windows\system32\net1 start "Embedthis Rdmappweb"
|
There are 19 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
|
unknown
|
||
|
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
|
unknown
|
||
|
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
|
unknown
|
||
|
http://fedir.comsign.co.il/crl/ComSignCA.crl0
|
unknown
|
||
|
http://crl.chambersign.org/chambersroot.crl0
|
unknown
|
||
|
http://ocsp.entrust.net03
|
unknown
|
||
|
http://cps.chambersign.org/cps/chambersroot.html0
|
unknown
|
||
|
http://www.certifikat.dk/repository0
|
unknown
|
||
|
http://www.chambersign.org1
|
unknown
|
||
|
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
|
unknown
|
||
|
http://www.firmaprofesional.com/cps0
|
unknown
|
||
|
http://www.diginotar.nl/cps/pkioverheid0
|
unknown
|
||
|
http://www.pkioverheid.nl/policies/root-policy0
|
unknown
|
||
|
http://repository.swisssign.com/0
|
unknown
|
||
|
http://crl.securetrust.com/SGCA.crl0
|
unknown
|
||
|
http://www.phreedom.org/md5)MD5
|
unknown
|
||
|
http://crl.securetrust.com/STCA.crl0
|
unknown
|
||
|
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
|
unknown
|
||
|
http://ca.disig.sk/ca/crl/ca_disig.crl0
|
unknown
|
||
|
http://www.certplus.com/CRL/class2.crl0
|
unknown
|
||
|
http://www.disig.sk/ca/crl/ca_disig.crl0
|
unknown
|
||
|
http://www.e-szigno.hu/RootCA.crt0
|
unknown
|
||
|
http://www.quovadisglobal.com/cps0
|
unknown
|
||
|
http://crl.veris
|
unknown
|
||
|
https://www.remobjects.com/ps
|
unknown
|
||
|
https://www.innosetup.com/
|
unknown
|
||
|
http://www.sk.ee/cps/0
|
unknown
|
||
|
http://www.valicert.com/1
|
unknown
|
||
|
http://www.e-szigno.hu/SZSZ/0
|
unknown
|
||
|
http://www.rdmcorp.comQ6.
|
unknown
|
||
|
https://ocsp.quovadisoffshore.com0
|
unknown
|
||
|
http://ocsp.entrust.net0D
|
unknown
|
||
|
http://www.rdmcorp.coma
|
unknown
|
||
|
http://cps.chambersign.org/cps/chambersignroot.html0
|
unknown
|
||
|
http://policy.camerfirma.com0
|
unknown
|
||
|
http://ocsp.pki.gva.es0
|
unknown
|
||
|
http://www.phreedom.org/md5)
|
unknown
|
||
|
http://www.rdmcorp.com
|
unknown
|
||
|
http://crl.oces.certifikat.dk/oces.crl0
|
unknown
|
||
|
http://crl.entrust.net/server1.crl0
|
unknown
|
||
|
http://www.certicamara.com/dpc/0Z
|
unknown
|
||
|
http://crl.pki.wellsfargo.com/wsprca.crl0
|
unknown
|
||
|
https://rca.e-szigno.hu/ocsp0-
|
unknown
|
||
|
https://www.netlock.hu/docs/
|
unknown
|
||
|
https://www.verisign.
|
unknown
|
||
|
http://acedicom.edicomgroup.com/doc0
|
unknown
|
||
|
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
|
unknown
|
||
|
http://www.entrust.net/CRL/net1.crl0
|
unknown
|
||
|
https://www.catcert.net/verarrel
|
unknown
|
||
|
http://www.disig.sk/ca0f
|
unknown
|
||
|
http://www.e-szigno.hu/RootCA.crl
|
unknown
|
||
|
http://www.sk.ee/juur/crl/0
|
unknown
|
||
|
http://crl.chambersign.org/chambersignroot.crl0
|
unknown
|
||
|
http://crl.xrampsecurity.com/XGCA.crl0
|
unknown
|
||
|
https://www.catcert.net/verarrel05
|
unknown
|
||
|
http://www.quovadis.bm0
|
unknown
|
||
|
http://www.trustdst.com/certificates/policy/ACES-index.html0
|
unknown
|
||
|
http://www.firmaprofesional.com0
|
unknown
|
||
|
http://www.pki.gva.es/cps0
|
unknown
|
||
|
http://www.pki.gva.es/cps0%
|
unknown
|
||
|
http://www.pkioverheid.nl/policies/root-policy-G20
|
unknown
|
||
|
http://www.wellsfargo.com/certpolicy0
|
unknown
|
||
|
https://secure.comodo.com/CPS0
|
unknown
|
||
|
https://www.netlock.net/docs
|
unknown
|
||
|
http://www.phreedom.org/md5)0
|
unknown
|
||
|
http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
|
unknown
|
||
|
http://crl.entrust.net/2048ca.crl0
|
unknown
|
There are 57 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Owner
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
SessionHash
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Sequence
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
RegFiles0000
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
RegFilesHash
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.1!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.2!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.3!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.4!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.7!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.8!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.12!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.13!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\CB30BC3A04C6C927CF11CC7CC64DAC76DA94E9B4
|
Blob
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\CB30BC3A04C6C927CF11CC7CC64DAC76DA94E9B4
|
Blob
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\CB30BC3A04C6C927CF11CC7CC64DAC76DA94E9B4
|
Blob
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\CB30BC3A04C6C927CF11CC7CC64DAC76DA94E9B4
|
Blob
|
There are 18 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
97F000
|
heap
|
page read and write
|
||
|
100A000
|
unkown
|
page read and write
|
||
|
27A0000
|
heap
|
page read and write
|
||
|
37E4000
|
direct allocation
|
page read and write
|
||
|
2EA0000
|
heap
|
page read and write
|
||
|
740000
|
heap
|
page read and write
|
||
|
B5F000
|
stack
|
page read and write
|
||
|
610000
|
heap
|
page read and write
|
||
|
362F000
|
stack
|
page read and write
|
||
|
2213000
|
direct allocation
|
page read and write
|
||
|
25A8000
|
direct allocation
|
page read and write
|
||
|
2580000
|
direct allocation
|
page read and write
|
||
|
17E000
|
stack
|
page read and write
|
||
|
3090000
|
heap
|
page read and write
|
||
|
1BF000
|
stack
|
page read and write
|
||
|
2948000
|
heap
|
page read and write
|
||
|
7FE30000
|
direct allocation
|
page read and write
|
||
|
3270000
|
heap
|
page read and write
|
||
|
2F50000
|
heap
|
page read and write
|
||
|
2489000
|
direct allocation
|
page read and write
|
||
|
24A1000
|
direct allocation
|
page read and write
|
||
|
33E8000
|
heap
|
page read and write
|
||
|
22D4000
|
direct allocation
|
page read and write
|
||
|
3408000
|
heap
|
page read and write
|
||
|
7AE000
|
stack
|
page read and write
|
||
|
2EB8000
|
heap
|
page read and write
|
||
|
2B60000
|
heap
|
page read and write
|
||
|
8C6000
|
heap
|
page read and write
|
||
|
357E000
|
stack
|
page read and write
|
||
|
2800000
|
heap
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
8D3000
|
heap
|
page read and write
|
||
|
9B2000
|
heap
|
page read and write
|
||
|
2C3D000
|
stack
|
page read and write
|
||
|
25E0000
|
heap
|
page read and write
|
||
|
25D0000
|
heap
|
page read and write
|
||
|
140000
|
heap
|
page read and write
|
||
|
54F000
|
stack
|
page read and write
|
||
|
2694000
|
direct allocation
|
page read and write
|
||
|
6D4000
|
unkown
|
page read and write
|
||
|
2266000
|
direct allocation
|
page read and write
|
||
|
327E000
|
stack
|
page read and write
|
||
|
5138000
|
direct allocation
|
page read and write
|
||
|
3370000
|
heap
|
page read and write
|
||
|
375E000
|
direct allocation
|
page read and write
|
||
|
2810000
|
heap
|
page read and write
|
||
|
2432000
|
direct allocation
|
page read and write
|
||
|
2516000
|
direct allocation
|
page read and write
|
||
|
7BE000
|
stack
|
page read and write
|
||
|
2BBF000
|
stack
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
251D000
|
direct allocation
|
page read and write
|
||
|
24D2000
|
direct allocation
|
page read and write
|
||
|
2441000
|
direct allocation
|
page read and write
|
||
|
76E000
|
stack
|
page read and write
|
||
|
6EF000
|
stack
|
page read and write
|
||
|
5254000
|
heap
|
page read and write
|
||
|
2AFE000
|
stack
|
page read and write
|
||
|
4C6000
|
unkown
|
page readonly
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
4B9000
|
unkown
|
page read and write
|
||
|
2224000
|
direct allocation
|
page read and write
|
||
|
357E000
|
stack
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
21E0000
|
direct allocation
|
page read and write
|
||
|
32BE000
|
stack
|
page read and write
|
||
|
9BA000
|
heap
|
page read and write
|
||
|
2CF0000
|
heap
|
page read and write
|
||
|
3665000
|
heap
|
page read and write
|
||
|
2281000
|
direct allocation
|
page read and write
|
||
|
2D20000
|
trusted library allocation
|
page read and write
|
||
|
2DAD000
|
stack
|
page read and write
|
||
|
8B0000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
1CE000
|
stack
|
page read and write
|
||
|
AFF000
|
stack
|
page read and write
|
||
|
2338000
|
direct allocation
|
page read and write
|
||
|
22F8000
|
direct allocation
|
page read and write
|
||
|
99A000
|
heap
|
page read and write
|
||
|
2B3E000
|
stack
|
page read and write
|
||
|
8CA000
|
heap
|
page read and write
|
||
|
100A000
|
unkown
|
page read and write
|
||
|
DD000
|
stack
|
page read and write
|
||
|
3720000
|
direct allocation
|
page read and write
|
||
|
25AD000
|
stack
|
page read and write
|
||
|
21F9000
|
direct allocation
|
page read and write
|
||
|
352C000
|
direct allocation
|
page read and write
|
||
|
2331000
|
direct allocation
|
page read and write
|
||
|
33BE000
|
stack
|
page read and write
|
||
|
34F0000
|
direct allocation
|
page read and write
|
||
|
4FBF000
|
stack
|
page read and write
|
||
|
30FF000
|
stack
|
page read and write
|
||
|
2239000
|
direct allocation
|
page read and write
|
||
|
69E000
|
heap
|
page read and write
|
||
|
8B6000
|
heap
|
page read and write
|
||
|
2524000
|
direct allocation
|
page read and write
|
||
|
8AB000
|
heap
|
page read and write
|
||
|
225F000
|
direct allocation
|
page read and write
|
||
|
9BE000
|
heap
|
page read and write
|
||
|
3521000
|
heap
|
page read and write
|
||
|
4B7000
|
unkown
|
page read and write
|
||
|
2478000
|
direct allocation
|
page read and write
|
||
|
2E00000
|
heap
|
page read and write
|
||
|
30B0000
|
heap
|
page read and write
|
||
|
262F000
|
direct allocation
|
page read and write
|
||
|
5442000
|
direct allocation
|
page read and write
|
||
|
6AE000
|
stack
|
page read and write
|
||
|
950000
|
direct allocation
|
page read and write
|
||
|
33A0000
|
heap
|
page read and write
|
||
|
4E4000
|
unkown
|
page readonly
|
||
|
22A1000
|
direct allocation
|
page read and write
|
||
|
2BAF000
|
stack
|
page read and write
|
||
|
24D4000
|
direct allocation
|
page read and write
|
||
|
6EC000
|
unkown
|
page readonly
|
||
|
2F80000
|
heap
|
page read and write
|
||
|
2ECF000
|
stack
|
page read and write
|
||
|
3640000
|
heap
|
page read and write
|
||
|
93000
|
stack
|
page read and write
|
||
|
22C6000
|
direct allocation
|
page read and write
|
||
|
2241000
|
direct allocation
|
page read and write
|
||
|
2B2F000
|
stack
|
page read and write
|
||
|
8F0000
|
heap
|
page read and write
|
||
|
18E000
|
stack
|
page read and write
|
||
|
4CC000
|
unkown
|
page readonly
|
||
|
27A3000
|
heap
|
page read and write
|
||
|
8B3000
|
heap
|
page read and write
|
||
|
250D000
|
direct allocation
|
page read and write
|
||
|
379F000
|
direct allocation
|
page read and write
|
||
|
22E1000
|
direct allocation
|
page read and write
|
||
|
2E8E000
|
stack
|
page read and write
|
||
|
6C5000
|
unkown
|
page write copy
|
||
|
2F57000
|
heap
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
9BF000
|
heap
|
page read and write
|
||
|
2580000
|
direct allocation
|
page read and write
|
||
|
24DA000
|
direct allocation
|
page read and write
|
||
|
825000
|
heap
|
page read and write
|
||
|
355F000
|
heap
|
page read and write
|
||
|
4CE000
|
stack
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
901000
|
heap
|
page read and write
|
||
|
2514000
|
direct allocation
|
page read and write
|
||
|
28D0000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
54F000
|
stack
|
page read and write
|
||
|
2980000
|
heap
|
page read and write
|
||
|
9A4000
|
heap
|
page read and write
|
||
|
8C7000
|
heap
|
page read and write
|
||
|
3230000
|
heap
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
2424000
|
direct allocation
|
page read and write
|
||
|
3350000
|
heap
|
page read and write
|
||
|
B5E000
|
stack
|
page read and write
|
||
|
1BF000
|
stack
|
page read and write
|
||
|
8DE000
|
heap
|
page read and write
|
||
|
28F5000
|
heap
|
page read and write
|
||
|
251C000
|
direct allocation
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
960000
|
heap
|
page read and write
|
||
|
2274000
|
direct allocation
|
page read and write
|
||
|
25F0000
|
heap
|
page read and write
|
||
|
8EF000
|
heap
|
page read and write
|
||
|
375E000
|
stack
|
page read and write
|
||
|
77F000
|
stack
|
page read and write
|
||
|
5142000
|
direct allocation
|
page read and write
|
||
|
7FB30000
|
direct allocation
|
page read and write
|
||
|
224F000
|
direct allocation
|
page read and write
|
||
|
7FE0F000
|
direct allocation
|
page read and write
|
||
|
6DE000
|
unkown
|
page readonly
|
||
|
22AE000
|
direct allocation
|
page read and write
|
||
|
9BA000
|
heap
|
page read and write
|
||
|
2493000
|
direct allocation
|
page read and write
|
||
|
25AD000
|
stack
|
page read and write
|
||
|
85F000
|
stack
|
page read and write
|
||
|
22CD000
|
direct allocation
|
page read and write
|
||
|
7FE1B000
|
direct allocation
|
page read and write
|
||
|
29EE000
|
stack
|
page read and write
|
||
|
9B8000
|
heap
|
page read and write
|
||
|
37C8000
|
direct allocation
|
page read and write
|
||
|
1FE000
|
stack
|
page read and write
|
||
|
3460000
|
heap
|
page read and write
|
||
|
670000
|
heap
|
page read and write
|
||
|
2289000
|
direct allocation
|
page read and write
|
||
|
25A1000
|
direct allocation
|
page read and write
|
||
|
254A000
|
direct allocation
|
page read and write
|
||
|
E59000
|
heap
|
page read and write
|
||
|
9B2000
|
heap
|
page read and write
|
||
|
76E000
|
stack
|
page read and write
|
||
|
34CC000
|
direct allocation
|
page read and write
|
||
|
33E0000
|
heap
|
page read and write
|
||
|
840000
|
direct allocation
|
page execute and read and write
|
||
|
258C000
|
direct allocation
|
page read and write
|
||
|
22BF000
|
direct allocation
|
page read and write
|
||
|
8E4000
|
heap
|
page read and write
|
||
|
A03000
|
heap
|
page read and write
|
||
|
6C5000
|
unkown
|
page read and write
|
||
|
6C7000
|
unkown
|
page read and write
|
||
|
2CBD000
|
stack
|
page read and write
|
||
|
22A0000
|
direct allocation
|
page read and write
|
||
|
5456000
|
direct allocation
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
2A30000
|
heap
|
page read and write
|
||
|
898000
|
heap
|
page read and write
|
||
|
24C5000
|
direct allocation
|
page read and write
|
||
|
700000
|
heap
|
page read and write
|
||
|
2F25000
|
heap
|
page read and write
|
||
|
5264000
|
heap
|
page read and write
|
||
|
240B000
|
direct allocation
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
69A000
|
heap
|
page read and write
|
||
|
22D1000
|
direct allocation
|
page read and write
|
||
|
7FE41000
|
direct allocation
|
page read and write
|
||
|
250F000
|
direct allocation
|
page read and write
|
||
|
222B000
|
direct allocation
|
page read and write
|
||
|
9CA000
|
heap
|
page read and write
|
||
|
8F1000
|
heap
|
page read and write
|
||
|
71E000
|
unkown
|
page readonly
|
||
|
C5F000
|
stack
|
page read and write
|
||
|
2489000
|
direct allocation
|
page read and write
|
||
|
7E0000
|
heap
|
page read and write
|
||
|
95F000
|
stack
|
page read and write
|
||
|
100A000
|
unkown
|
page read and write
|
||
|
2448000
|
direct allocation
|
page read and write
|
||
|
8CE000
|
heap
|
page read and write
|
||
|
2F20000
|
heap
|
page read and write
|
||
|
6CF000
|
unkown
|
page read and write
|
||
|
28F0000
|
heap
|
page read and write
|
||
|
2950000
|
heap
|
page read and write
|
||
|
9B5000
|
heap
|
page read and write
|
||
|
22F1000
|
direct allocation
|
page read and write
|
||
|
33E0000
|
heap
|
page read and write
|
||
|
2306000
|
direct allocation
|
page read and write
|
||
|
3794000
|
direct allocation
|
page read and write
|
||
|
56E000
|
stack
|
page read and write
|
||
|
2F8D000
|
stack
|
page read and write
|
||
|
29AE000
|
stack
|
page read and write
|
||
|
438000
|
heap
|
page read and write
|
||
|
2551000
|
direct allocation
|
page read and write
|
||
|
30CF000
|
stack
|
page read and write
|
||
|
ABE000
|
stack
|
page read and write
|
||
|
2C75000
|
heap
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
259A000
|
direct allocation
|
page read and write
|
||
|
225D000
|
direct allocation
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
4DAA000
|
direct allocation
|
page read and write
|
||
|
33A5000
|
heap
|
page read and write
|
||
|
244F000
|
direct allocation
|
page read and write
|
||
|
2542000
|
direct allocation
|
page read and write
|
||
|
8DC000
|
heap
|
page read and write
|
||
|
8CA000
|
heap
|
page read and write
|
||
|
24BE000
|
direct allocation
|
page read and write
|
||
|
22C9000
|
direct allocation
|
page read and write
|
||
|
296E000
|
stack
|
page read and write
|
||
|
31C0000
|
heap
|
page read and write
|
||
|
3030000
|
heap
|
page read and write
|
||
|
24DB000
|
direct allocation
|
page read and write
|
||
|
9C1000
|
heap
|
page read and write
|
||
|
4D3000
|
unkown
|
page readonly
|
||
|
9A2000
|
heap
|
page read and write
|
||
|
9B8000
|
heap
|
page read and write
|
||
|
2456000
|
direct allocation
|
page read and write
|
||
|
97C000
|
heap
|
page read and write
|
||
|
E50000
|
heap
|
page read and write
|
||
|
24E1000
|
direct allocation
|
page read and write
|
||
|
22F8000
|
direct allocation
|
page read and write
|
||
|
4DA1000
|
direct allocation
|
page read and write
|
||
|
2465000
|
direct allocation
|
page read and write
|
||
|
229A000
|
direct allocation
|
page read and write
|
||
|
A10000
|
heap
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
9B2000
|
heap
|
page read and write
|
||
|
24FF000
|
direct allocation
|
page read and write
|
||
|
400000
|
heap
|
page read and write
|
||
|
3060000
|
heap
|
page read and write
|
||
|
24A6000
|
direct allocation
|
page read and write
|
||
|
35AC000
|
heap
|
page read and write
|
||
|
2290000
|
direct allocation
|
page read and write
|
||
|
130000
|
heap
|
page read and write
|
||
|
9BE000
|
heap
|
page read and write
|
||
|
9CB000
|
heap
|
page read and write
|
||
|
70D000
|
unkown
|
page readonly
|
||
|
35FF000
|
stack
|
page read and write
|
||
|
252D000
|
stack
|
page read and write
|
||
|
5258000
|
heap
|
page read and write
|
||
|
2400000
|
direct allocation
|
page read and write
|
||
|
2576000
|
direct allocation
|
page read and write
|
||
|
2813000
|
heap
|
page read and write
|
||
|
580000
|
heap
|
page read and write
|
||
|
222B000
|
direct allocation
|
page read and write
|
||
|
3620000
|
heap
|
page read and write
|
||
|
3400000
|
heap
|
page read and write
|
||
|
28FF000
|
stack
|
page read and write
|
||
|
50E000
|
stack
|
page read and write
|
||
|
3621000
|
heap
|
page read and write
|
||
|
2E0E000
|
stack
|
page read and write
|
||
|
9AF000
|
heap
|
page read and write
|
||
|
2F88000
|
heap
|
page read and write
|
||
|
2291000
|
direct allocation
|
page read and write
|
||
|
9C4000
|
heap
|
page read and write
|
||
|
993000
|
heap
|
page read and write
|
||
|
35AC000
|
heap
|
page read and write
|
||
|
2256000
|
direct allocation
|
page read and write
|
||
|
3278000
|
heap
|
page read and write
|
||
|
38EF000
|
stack
|
page read and write
|
||
|
249C000
|
direct allocation
|
page read and write
|
||
|
231C000
|
direct allocation
|
page read and write
|
||
|
22C1000
|
direct allocation
|
page read and write
|
||
|
880000
|
heap
|
page read and write
|
||
|
22E3000
|
direct allocation
|
page read and write
|
||
|
22B8000
|
direct allocation
|
page read and write
|
||
|
2644000
|
direct allocation
|
page read and write
|
||
|
5FF000
|
stack
|
page read and write
|
||
|
5260000
|
heap
|
page read and write
|
||
|
7E6000
|
heap
|
page read and write
|
||
|
2B68000
|
heap
|
page read and write
|
||
|
2523000
|
direct allocation
|
page read and write
|
||
|
4F0000
|
heap
|
page read and write
|
||
|
6CF000
|
unkown
|
page read and write
|
||
|
4DF000
|
unkown
|
page readonly
|
||
|
2240000
|
direct allocation
|
page read and write
|
||
|
3260000
|
heap
|
page read and write
|
||
|
227A000
|
direct allocation
|
page read and write
|
||
|
2930000
|
heap
|
page read and write
|
||
|
24A9000
|
direct allocation
|
page read and write
|
||
|
2531000
|
direct allocation
|
page read and write
|
||
|
22DA000
|
direct allocation
|
page read and write
|
||
|
8EA000
|
heap
|
page read and write
|
||
|
DD000
|
stack
|
page read and write
|
||
|
430000
|
heap
|
page read and write
|
||
|
900000
|
direct allocation
|
page execute and read and write
|
||
|
2568000
|
direct allocation
|
page read and write
|
||
|
4B7000
|
unkown
|
page read and write
|
||
|
6CC000
|
unkown
|
page read and write
|
||
|
2F0E000
|
stack
|
page read and write
|
||
|
7D0000
|
heap
|
page read and write
|
||
|
2500000
|
direct allocation
|
page read and write
|
||
|
243A000
|
direct allocation
|
page read and write
|
||
|
34FE000
|
stack
|
page read and write
|
||
|
99E000
|
heap
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
50E000
|
stack
|
page read and write
|
||
|
24AD000
|
direct allocation
|
page read and write
|
||
|
2CF0000
|
heap
|
page read and write
|
||
|
6CC000
|
unkown
|
page read and write
|
||
|
24C4000
|
direct allocation
|
page read and write
|
||
|
18C000
|
stack
|
page read and write
|
||
|
590000
|
heap
|
page read and write
|
||
|
2534000
|
direct allocation
|
page read and write
|
||
|
2E10000
|
heap
|
page read and write
|
||
|
4D8A000
|
direct allocation
|
page read and write
|
||
|
27B0000
|
heap
|
page read and write
|
||
|
6C5000
|
unkown
|
page read and write
|
||
|
37E1000
|
direct allocation
|
page read and write
|
||
|
2810000
|
heap
|
page read and write
|
||
|
355E000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
242B000
|
direct allocation
|
page read and write
|
||
|
3010000
|
heap
|
page read and write
|
||
|
3645000
|
heap
|
page read and write
|
||
|
3035000
|
heap
|
page read and write
|
||
|
2FBB000
|
stack
|
page read and write
|
||
|
2E90000
|
heap
|
page read and write
|
||
|
37AF000
|
direct allocation
|
page read and write
|
||
|
6F8000
|
unkown
|
page readonly
|
||
|
5462000
|
direct allocation
|
page read and write
|
||
|
25F0000
|
heap
|
page read and write
|
||
|
5260000
|
heap
|
page read and write
|
||
|
2940000
|
heap
|
page read and write
|
||
|
1C0000
|
heap
|
page read and write
|
||
|
2830000
|
heap
|
page read and write
|
||
|
249A000
|
direct allocation
|
page read and write
|
||
|
2F7D000
|
stack
|
page read and write
|
||
|
2623000
|
direct allocation
|
page read and write
|
||
|
37B8000
|
direct allocation
|
page read and write
|
||
|
5BE000
|
stack
|
page read and write
|
||
|
9AD000
|
heap
|
page read and write
|
||
|
19D000
|
stack
|
page read and write
|
||
|
2CBE000
|
stack
|
page read and write
|
||
|
3520000
|
direct allocation
|
page read and write
|
||
|
940000
|
heap
|
page read and write
|
||
|
9C1000
|
heap
|
page read and write
|
||
|
4C0000
|
unkown
|
page read and write
|
||
|
60E000
|
stack
|
page read and write
|
||
|
31C5000
|
heap
|
page read and write
|
||
|
820000
|
heap
|
page read and write
|
||
|
33D0000
|
heap
|
page read and write
|
||
|
440000
|
heap
|
page read and write
|
||
|
968000
|
heap
|
page read and write
|
||
|
3760000
|
direct allocation
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
9B000
|
stack
|
page read and write
|
||
|
2DF0000
|
heap
|
page read and write
|
||
|
9C2000
|
heap
|
page read and write
|
||
|
3270000
|
heap
|
page read and write
|
||
|
2FF0000
|
heap
|
page read and write
|
||
|
2540000
|
direct allocation
|
page read and write
|
||
|
3360000
|
heap
|
page read and write
|
||
|
24B0000
|
direct allocation
|
page read and write
|
||
|
19D000
|
stack
|
page read and write
|
||
|
224F000
|
direct allocation
|
page read and write
|
||
|
2838000
|
heap
|
page read and write
|
||
|
3660000
|
heap
|
page read and write
|
||
|
130000
|
heap
|
page read and write
|
||
|
249F000
|
direct allocation
|
page read and write
|
||
|
2770000
|
direct allocation
|
page read and write
|
||
|
287F000
|
stack
|
page read and write
|
||
|
99E000
|
heap
|
page read and write
|
||
|
950000
|
direct allocation
|
page read and write
|
||
|
8C0000
|
heap
|
page read and write
|
||
|
2540000
|
direct allocation
|
page read and write
|
||
|
5240000
|
heap
|
page read and write
|
||
|
3DD000
|
stack
|
page read and write
|
||
|
2248000
|
direct allocation
|
page read and write
|
||
|
C5F000
|
stack
|
page read and write
|
||
|
2E4E000
|
stack
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
2207000
|
direct allocation
|
page read and write
|
||
|
2FFC000
|
stack
|
page read and write
|
||
|
2506000
|
direct allocation
|
page read and write
|
||
|
2F1E000
|
stack
|
page read and write
|
||
|
9CD000
|
heap
|
page read and write
|
||
|
4C0000
|
unkown
|
page read and write
|
||
|
8E4000
|
heap
|
page read and write
|
||
|
2C3D000
|
stack
|
page read and write
|
||
|
34B0000
|
direct allocation
|
page read and write
|
||
|
2248000
|
direct allocation
|
page read and write
|
||
|
538F000
|
stack
|
page read and write
|
||
|
51E0000
|
heap
|
page read and write
|
||
|
9B8000
|
heap
|
page read and write
|
||
|
24B4000
|
direct allocation
|
page read and write
|
||
|
34B0000
|
direct allocation
|
page read and write
|
||
|
9C2000
|
heap
|
page read and write
|
||
|
2258000
|
direct allocation
|
page read and write
|
||
|
788000
|
heap
|
page read and write
|
||
|
2558000
|
direct allocation
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
2E20000
|
heap
|
page read and write
|
||
|
18D000
|
stack
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
830000
|
heap
|
page read and write
|
||
|
22A7000
|
direct allocation
|
page read and write
|
||
|
48E000
|
stack
|
page read and write
|
||
|
829000
|
heap
|
page read and write
|
||
|
2584000
|
direct allocation
|
page read and write
|
||
|
4DB4000
|
direct allocation
|
page read and write
|
||
|
2477000
|
direct allocation
|
page read and write
|
||
|
2EDF000
|
stack
|
page read and write
|
||
|
6D4000
|
unkown
|
page read and write
|
||
|
2289000
|
direct allocation
|
page read and write
|
||
|
6E5000
|
unkown
|
page readonly
|
||
|
E55000
|
heap
|
page read and write
|
||
|
230D000
|
direct allocation
|
page read and write
|
||
|
2A7D000
|
stack
|
page read and write
|
||
|
35A0000
|
heap
|
page read and write
|
||
|
7E7000
|
heap
|
page read and write
|
||
|
2273000
|
direct allocation
|
page read and write
|
||
|
256F000
|
direct allocation
|
page read and write
|
||
|
DD000
|
stack
|
page read and write
|
||
|
361E000
|
stack
|
page read and write
|
||
|
7AE000
|
stack
|
page read and write
|
||
|
C2B000
|
stack
|
page read and write
|
||
|
250C000
|
direct allocation
|
page read and write
|
||
|
2C70000
|
heap
|
page read and write
|
||
|
252D000
|
stack
|
page read and write
|
||
|
3520000
|
direct allocation
|
page read and write
|
||
|
570000
|
heap
|
page read and write
|
||
|
220E000
|
direct allocation
|
page read and write
|
||
|
4C2000
|
unkown
|
page write copy
|
||
|
30B8000
|
heap
|
page read and write
|
||
|
590000
|
heap
|
page read and write
|
||
|
226C000
|
direct allocation
|
page read and write
|
||
|
7B0000
|
heap
|
page read and write
|
||
|
A5F000
|
stack
|
page read and write
|
||
|
353E000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2FFE000
|
stack
|
page read and write
|
||
|
9A3000
|
heap
|
page read and write
|
||
|
333D000
|
stack
|
page read and write
|
||
|
2200000
|
direct allocation
|
page read and write
|
||
|
29D0000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2314000
|
direct allocation
|
page read and write
|
||
|
2CEF000
|
stack
|
page read and write
|
||
|
4EBF000
|
stack
|
page read and write
|
||
|
22A8000
|
direct allocation
|
page read and write
|
||
|
226D000
|
direct allocation
|
page read and write
|
||
|
2900000
|
heap
|
page read and write
|
||
|
2281000
|
direct allocation
|
page read and write
|
||
|
24F9000
|
direct allocation
|
page read and write
|
||
|
232A000
|
direct allocation
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
296D000
|
stack
|
page read and write
|
||
|
34BD000
|
stack
|
page read and write
|
||
|
2D10000
|
heap
|
page read and write
|
||
|
53E000
|
stack
|
page read and write
|
||
|
9C8000
|
heap
|
page read and write
|
||
|
8BD000
|
heap
|
page read and write
|
||
|
24CD000
|
direct allocation
|
page read and write
|
||
|
24F8000
|
direct allocation
|
page read and write
|
||
|
379E000
|
stack
|
page read and write
|
||
|
2471000
|
direct allocation
|
page read and write
|
||
|
32BD000
|
heap
|
page read and write
|
||
|
3370000
|
heap
|
page read and write
|
||
|
598000
|
heap
|
page read and write
|
||
|
245D000
|
direct allocation
|
page read and write
|
||
|
9AD000
|
heap
|
page read and write
|
||
|
6DC000
|
unkown
|
page readonly
|
||
|
6D7000
|
unkown
|
page write copy
|
||
|
33CE000
|
stack
|
page read and write
|
||
|
4BA000
|
unkown
|
page read and write
|
||
|
22E8000
|
direct allocation
|
page read and write
|
||
|
17E000
|
stack
|
page read and write
|
||
|
960000
|
heap
|
page read and write
|
||
|
50F0000
|
heap
|
page read and write
|
||
|
8D9000
|
heap
|
page read and write
|
||
|
580000
|
heap
|
page read and write
|
||
|
4B7000
|
unkown
|
page write copy
|
||
|
24B7000
|
direct allocation
|
page read and write
|
||
|
890000
|
heap
|
page read and write
|
||
|
2239000
|
direct allocation
|
page read and write
|
||
|
630000
|
heap
|
page read and write
|
||
|
3770000
|
direct allocation
|
page read and write
|
||
|
2215000
|
direct allocation
|
page read and write
|
||
|
8DE000
|
heap
|
page read and write
|
||
|
9D5000
|
heap
|
page read and write
|
||
|
780000
|
heap
|
page read and write
|
||
|
4F0000
|
heap
|
page read and write
|
||
|
130000
|
heap
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
352E000
|
stack
|
page read and write
|
||
|
25C0000
|
heap
|
page read and write
|
||
|
2C6E000
|
stack
|
page read and write
|
||
|
544F000
|
direct allocation
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
2323000
|
direct allocation
|
page read and write
|
||
|
5390000
|
direct allocation
|
page read and write
|
||
|
2593000
|
direct allocation
|
page read and write
|
||
|
2232000
|
direct allocation
|
page read and write
|
||
|
359E000
|
stack
|
page read and write
|
||
|
22FF000
|
direct allocation
|
page read and write
|
||
|
2C20000
|
heap
|
page read and write
|
||
|
860000
|
heap
|
page read and write
|
||
|
2935000
|
heap
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
96000
|
stack
|
page read and write
|
||
|
2298000
|
direct allocation
|
page read and write
|
||
|
2CB0000
|
trusted library allocation
|
page read and write
|
||
|
257D000
|
direct allocation
|
page read and write
|
||
|
650000
|
heap
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
2E0E000
|
stack
|
page read and write
|
||
|
993000
|
heap
|
page read and write
|
||
|
353B000
|
direct allocation
|
page read and write
|
||
|
2538000
|
direct allocation
|
page read and write
|
||
|
24CB000
|
direct allocation
|
page read and write
|
||
|
5410000
|
heap
|
page read and write
|
||
|
24E2000
|
direct allocation
|
page read and write
|
||
|
22EA000
|
direct allocation
|
page read and write
|
||
|
2490000
|
direct allocation
|
page read and write
|
||
|
2770000
|
direct allocation
|
page read and write
|
||
|
5260000
|
heap
|
page read and write
|
||
|
523E000
|
stack
|
page read and write
|
||
|
305E000
|
stack
|
page read and write
|
||
|
690000
|
heap
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
7B0000
|
heap
|
page read and write
|
||
|
2F10000
|
heap
|
page read and write
|
||
|
5040000
|
heap
|
page read and write
|
||
|
2265000
|
direct allocation
|
page read and write
|
||
|
4C4000
|
unkown
|
page readonly
|
||
|
57E000
|
stack
|
page read and write
|
||
|
9B2000
|
heap
|
page read and write
|
||
|
252A000
|
direct allocation
|
page read and write
|
||
|
3520000
|
heap
|
page read and write
|
||
|
35D000
|
stack
|
page read and write
|
||
|
2EB0000
|
heap
|
page read and write
|
||
|
5258000
|
heap
|
page read and write
|
||
|
22DC000
|
direct allocation
|
page read and write
|
||
|
4F60000
|
direct allocation
|
page read and write
|
||
|
221D000
|
direct allocation
|
page read and write
|
||
|
2E50000
|
heap
|
page read and write
|
||
|
338E000
|
stack
|
page read and write
|
||
|
366E000
|
stack
|
page read and write
|
||
|
6C8000
|
unkown
|
page read and write
|
||
|
2232000
|
direct allocation
|
page read and write
|
||
|
868000
|
heap
|
page read and write
|
||
|
34BD000
|
direct allocation
|
page read and write
|
||
|
32FD000
|
stack
|
page read and write
|
||
|
37CE000
|
direct allocation
|
page read and write
|
||
|
253B000
|
direct allocation
|
page read and write
|
There are 582 hidden memdumps, click here to show them.