Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
RDM_Root_Cert_Update_Windows.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\certmgr.exe (copy)
|
PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
|
dropped
|
 |
|
|
C:\Users\user\AppData\Local\Temp\is-SC2V1.tmp\RDM_ROOTCERTIFICATE.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Program Files\Mozilla Firefox\defaults\pref\firefox-windows-truststore.js (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\Mozilla Firefox\defaults\pref\is-K76D6.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\Mozilla Firefox\defaults\pref\is-PMF5D.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\Mozilla Firefox\defaults\pref\local-settings.js (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\Mozilla Firefox\is-PGH5D.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\Mozilla Firefox\umbrella.cfg (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\901deee3b5b74cb155b513ccd57a4a2e_9e146be9-c76a-4720-bcdb-53011b87bd06
|
data
|
dropped
|
||
|
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f624068db13c5397a4560b17ec912efa_9e146be9-c76a-4720-bcdb-53011b87bd06
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-BUL6H.tmp\RDM_Root_Cert_Update_Windows.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\AddCert.bat (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\RDM.ico (copy)
|
MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\RDM_RootCA.pem (copy)
|
PEM certificate
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\certremoval.bat (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\firefox-windows-truststore.js (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\freebl3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-1QMJT.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-3KPG9.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-514DN.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-7LAUR.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-8C4S6.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-8I24T.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-AUFQA.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-G38J5.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-GIC48.tmp
|
PEM certificate
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-K24N6.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-LTALL.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-M356P.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-MK9CH.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-NCL0U.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-PBG95.tmp
|
PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-QG9HH.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-RQ7D5.tmp
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-SJL0P.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-T2GKH.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-TG1GQ.tmp
|
MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\is-U7N00.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\libnspr4.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\libplc4.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\libplds4.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\local-settings.js (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\nss3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\nssckbi.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\nssdbm3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\nssutil3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\rdm.pfx (copy)
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\smime3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\softokn3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\sqlite3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\ssl3.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\umbrella.cfg (copy)
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\_isetup\_setup64.tmp
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-SU9Q0.tmp\RDM_ROOTCERTIFICATE.exe (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-SU9Q0.tmp\_isetup\_setup64.tmp
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-SU9Q0.tmp\is-N0SQK.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
There are 48 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\AppData\Local\Temp\is-SU9Q0.tmp\RDM_ROOTCERTIFICATE.exe
|
"C:\Users\user\AppData\Local\Temp\is-SU9Q0.tmp\RDM_ROOTCERTIFICATE.exe" /VERYSILENT
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-SC2V1.tmp\RDM_ROOTCERTIFICATE.tmp
|
"C:\Users\user\AppData\Local\Temp\is-SC2V1.tmp\RDM_ROOTCERTIFICATE.tmp" /SL5="$2047A,1902883,887296,C:\Users\user\AppData\Local\Temp\is-SU9Q0.tmp\RDM_ROOTCERTIFICATE.exe"
/VERYSILENT
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp/RdmCert/certremoval.bat""
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /S /D /c" echo 1 "
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\certmgr.exe
|
CertMgr.exe -del -c -n "RDM Device Root" -s -r localMachine Root
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\certmgr.exe
|
CertMgr.exe -del -c -n "RDM Device Root" -s -r localMachine Root
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\certmgr.exe
|
"C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp/RdmCert/CertMgr.exe" -add -c RDM_RootCA.pem -s -r localmachine Root
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp/RdmCert/AddCert.bat" "C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\RDM_RootCA.pem""
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
C:\Windows\system32\cmd.exe /c dir /B "C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\*.default*"
|
|
|
|
C:\Windows\SysWOW64\certutil.exe
|
certutil.exe -A -n "RDM_Device" -t "TCu,TCu,TCu" -d "C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\."
-i "C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\RDM_RootCA.pem"
|
|
|
|
C:\Windows\SysWOW64\certutil.exe
|
"C:\Windows\system32/certutil.exe" f p rdm736 importpfx "C:\Users\user\AppData\Local\Temp\is-N6PB1.tmp\RdmCert\rdm.pfx"
|
|
|
|
C:\Users\user\Desktop\RDM_Root_Cert_Update_Windows.exe
|
"C:\Users\user\Desktop\RDM_Root_Cert_Update_Windows.exe"
|
||
|
C:\Users\user\AppData\Local\Temp\is-BUL6H.tmp\RDM_Root_Cert_Update_Windows.tmp
|
"C:\Users\user\AppData\Local\Temp\is-BUL6H.tmp\RDM_Root_Cert_Update_Windows.tmp" /SL5="$10476,2990719,887296,C:\Users\user\Desktop\RDM_Root_Cert_Update_Windows.exe"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\net.exe
|
"C:\Windows\system32\net.exe" stop "RDMAppweb"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\net1.exe
|
C:\Windows\system32\net1 stop "RDMAppweb"
|
||
|
C:\Windows\SysWOW64\net.exe
|
"C:\Windows\system32\net.exe" stop "Embedthis Rdmappweb"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\net1.exe
|
C:\Windows\system32\net1 stop "Embedthis Rdmappweb"
|
||
|
C:\Windows\SysWOW64\net.exe
|
"C:\Windows\system32\net.exe" start "RDMAppweb"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\net1.exe
|
C:\Windows\system32\net1 start "RDMAppweb"
|
||
|
C:\Windows\SysWOW64\net.exe
|
"C:\Windows\system32\net.exe" start "Embedthis Rdmappweb"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\net1.exe
|
C:\Windows\system32\net1 start "Embedthis Rdmappweb"
|
There are 19 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
|
unknown
|
||
|
http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
|
unknown
|
||
|
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
|
unknown
|
||
|
http://fedir.comsign.co.il/crl/ComSignCA.crl0
|
unknown
|
||
|
http://crl.chambersign.org/chambersroot.crl0
|
unknown
|
||
|
http://ocsp.entrust.net03
|
unknown
|
||
|
http://cps.chambersign.org/cps/chambersroot.html0
|
unknown
|
||
|
http://www.rdmcorp.comQ64
|
unknown
|
||
|
http://www.certifikat.dk/repository0
|
unknown
|
||
|
http://www.chambersign.org1
|
unknown
|
||
|
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
|
unknown
|
||
|
http://www.firmaprofesional.com/cps0
|
unknown
|
||
|
http://www.diginotar.nl/cps/pkioverheid0
|
unknown
|
||
|
http://www.pkioverheid.nl/policies/root-policy0
|
unknown
|
||
|
http://repository.swisssign.com/0
|
unknown
|
||
|
http://crl.securetrust.com/SGCA.crl0
|
unknown
|
||
|
http://www.phreedom.org/md5)MD5
|
unknown
|
||
|
http://crl.securetrust.com/STCA.crl0
|
unknown
|
||
|
http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
|
unknown
|
||
|
http://ca.disig.sk/ca/crl/ca_disig.crl0
|
unknown
|
||
|
http://www.certplus.com/CRL/class2.crl0
|
unknown
|
||
|
http://www.disig.sk/ca/crl/ca_disig.crl0
|
unknown
|
||
|
http://www.e-szigno.hu/RootCA.crt0
|
unknown
|
||
|
http://www.quovadisglobal.com/cps0
|
unknown
|
||
|
https://www.remobjects.com/ps
|
unknown
|
||
|
https://www.innosetup.com/
|
unknown
|
||
|
http://www.sk.ee/cps/0
|
unknown
|
||
|
http://www.valicert.com/1
|
unknown
|
||
|
http://www.e-szigno.hu/SZSZ/0
|
unknown
|
||
|
https://ocsp.quovadisoffshore.com0
|
unknown
|
||
|
http://ocsp.entrust.net0D
|
unknown
|
||
|
http://cps.chambersign.org/cps/chambersignroot.html0
|
unknown
|
||
|
http://policy.camerfirma.com0
|
unknown
|
||
|
http://ocsp.pki.gva.es0
|
unknown
|
||
|
http://www.phreedom.org/md5)
|
unknown
|
||
|
http://www.rdmcorp.com
|
unknown
|
||
|
http://crl.oces.certifikat.dk/oces.crl0
|
unknown
|
||
|
http://crl.entrust.net/server1.crl0
|
unknown
|
||
|
http://www.certicamara.com/dpc/0Z
|
unknown
|
||
|
http://crl.pki.wellsfargo.com/wsprca.crl0
|
unknown
|
||
|
https://rca.e-szigno.hu/ocsp0-
|
unknown
|
||
|
https://www.netlock.hu/docs/
|
unknown
|
||
|
http://acedicom.edicomgroup.com/doc0
|
unknown
|
||
|
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
|
unknown
|
||
|
http://www.entrust.net/CRL/net1.crl0
|
unknown
|
||
|
https://www.catcert.net/verarrel
|
unknown
|
||
|
http://www.disig.sk/ca0f
|
unknown
|
||
|
http://www.e-szigno.hu/RootCA.crl
|
unknown
|
||
|
http://www.sk.ee/juur/crl/0
|
unknown
|
||
|
http://crl.chambersign.org/chambersignroot.crl0
|
unknown
|
||
|
http://crl.xrampsecurity.com/XGCA.crl0
|
unknown
|
||
|
https://www.catcert.net/verarrel05
|
unknown
|
||
|
http://www.quovadis.bm0
|
unknown
|
||
|
http://www.trustdst.com/certificates/policy/ACES-index.html0
|
unknown
|
||
|
http://www.firmaprofesional.com0
|
unknown
|
||
|
http://www.pki.gva.es/cps0
|
unknown
|
||
|
http://www.pki.gva.es/cps0%
|
unknown
|
||
|
http://www.pkioverheid.nl/policies/root-policy-G20
|
unknown
|
||
|
http://www.wellsfargo.com/certpolicy0
|
unknown
|
||
|
https://secure.comodo.com/CPS0
|
unknown
|
||
|
https://www.netlock.net/docs
|
unknown
|
||
|
http://www.phreedom.org/md5)0
|
unknown
|
||
|
http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
|
unknown
|
||
|
http://crl.entrust.net/2048ca.crl0
|
unknown
|
There are 54 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CAFAC3A697F2F0A9D66F8F1DC86BEE6AD15E425C
|
Blob
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Owner
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
SessionHash
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Sequence
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
RegFiles0000
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
RegFilesHash
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.10!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.27!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.2.1.26!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.1!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.2!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.3!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.4!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.7!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.8!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.12!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.113730.1.13!6
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\CB30BC3A04C6C927CF11CC7CC64DAC76DA94E9B4
|
Blob
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\CB30BC3A04C6C927CF11CC7CC64DAC76DA94E9B4
|
Blob
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\CB30BC3A04C6C927CF11CC7CC64DAC76DA94E9B4
|
Blob
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\CB30BC3A04C6C927CF11CC7CC64DAC76DA94E9B4
|
Blob
|
There are 18 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
25A4000
|
direct allocation
|
page read and write
|
||
|
5B0000
|
heap
|
page read and write
|
||
|
A94000
|
heap
|
page read and write
|
||
|
22CE000
|
direct allocation
|
page read and write
|
||
|
AF2000
|
heap
|
page read and write
|
||
|
3774000
|
direct allocation
|
page read and write
|
||
|
3490000
|
heap
|
page read and write
|
||
|
A6B000
|
heap
|
page read and write
|
||
|
A5E000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
353E000
|
stack
|
page read and write
|
||
|
AB3000
|
heap
|
page read and write
|
||
|
AAA000
|
heap
|
page read and write
|
||
|
2E00000
|
heap
|
page read and write
|
||
|
342E000
|
stack
|
page read and write
|
||
|
A2F000
|
stack
|
page read and write
|
||
|
A60000
|
heap
|
page read and write
|
||
|
D24000
|
direct allocation
|
page read and write
|
||
|
1CD000
|
stack
|
page read and write
|
||
|
22C0000
|
direct allocation
|
page read and write
|
||
|
32F0000
|
heap
|
page read and write
|
||
|
A6F000
|
heap
|
page read and write
|
||
|
26B4000
|
direct allocation
|
page read and write
|
||
|
55E000
|
stack
|
page read and write
|
||
|
D48000
|
direct allocation
|
page read and write
|
||
|
47E000
|
stack
|
page read and write
|
||
|
A96000
|
heap
|
page read and write
|
||
|
C90000
|
direct allocation
|
page read and write
|
||
|
2275000
|
direct allocation
|
page read and write
|
||
|
6AF000
|
heap
|
page read and write
|
||
|
CE2000
|
direct allocation
|
page read and write
|
||
|
4DBA000
|
direct allocation
|
page read and write
|
||
|
2520000
|
direct allocation
|
page read and write
|
||
|
2285000
|
direct allocation
|
page read and write
|
||
|
22A9000
|
direct allocation
|
page read and write
|
||
|
22F1000
|
direct allocation
|
page read and write
|
||
|
C90000
|
direct allocation
|
page read and write
|
||
|
830000
|
heap
|
page read and write
|
||
|
130000
|
heap
|
page read and write
|
||
|
51B0000
|
heap
|
page read and write
|
||
|
54F000
|
stack
|
page read and write
|
||
|
2259000
|
direct allocation
|
page read and write
|
||
|
180000
|
heap
|
page read and write
|
||
|
D00000
|
heap
|
page read and write
|
||
|
36D0000
|
heap
|
page read and write
|
||
|
3670000
|
heap
|
page read and write
|
||
|
34EA000
|
heap
|
page read and write
|
||
|
38CF000
|
stack
|
page read and write
|
||
|
4B7000
|
unkown
|
page write copy
|
||
|
A50000
|
heap
|
page read and write
|
||
|
24ED000
|
direct allocation
|
page read and write
|
||
|
840000
|
heap
|
page read and write
|
||
|
258F000
|
direct allocation
|
page read and write
|
||
|
A67000
|
heap
|
page read and write
|
||
|
367C000
|
heap
|
page read and write
|
||
|
2588000
|
direct allocation
|
page read and write
|
||
|
31D000
|
stack
|
page read and write
|
||
|
A00000
|
direct allocation
|
page execute and read and write
|
||
|
A50000
|
heap
|
page read and write
|
||
|
A10000
|
heap
|
page read and write
|
||
|
2E9E000
|
stack
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
24FB000
|
direct allocation
|
page read and write
|
||
|
64E000
|
stack
|
page read and write
|
||
|
5324000
|
heap
|
page read and write
|
||
|
C60000
|
heap
|
page read and write
|
||
|
35BE000
|
stack
|
page read and write
|
||
|
37C1000
|
direct allocation
|
page read and write
|
||
|
2562000
|
direct allocation
|
page read and write
|
||
|
A6D000
|
heap
|
page read and write
|
||
|
A42000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
6C7000
|
unkown
|
page read and write
|
||
|
6BE000
|
heap
|
page read and write
|
||
|
228B000
|
direct allocation
|
page read and write
|
||
|
740000
|
heap
|
page read and write
|
||
|
A83000
|
heap
|
page read and write
|
||
|
25C1000
|
direct allocation
|
page read and write
|
||
|
AB1000
|
heap
|
page read and write
|
||
|
ABE000
|
stack
|
page read and write
|
||
|
7FE0F000
|
direct allocation
|
page read and write
|
||
|
58E000
|
stack
|
page read and write
|
||
|
9BF000
|
stack
|
page read and write
|
||
|
346E000
|
stack
|
page read and write
|
||
|
835000
|
heap
|
page read and write
|
||
|
22B8000
|
direct allocation
|
page read and write
|
||
|
39D000
|
stack
|
page read and write
|
||
|
EFD000
|
stack
|
page read and write
|
||
|
231F000
|
direct allocation
|
page read and write
|
||
|
34C8000
|
heap
|
page read and write
|
||
|
5314000
|
heap
|
page read and write
|
||
|
224B000
|
direct allocation
|
page read and write
|
||
|
24C9000
|
direct allocation
|
page read and write
|
||
|
4D9A000
|
direct allocation
|
page read and write
|
||
|
229A000
|
direct allocation
|
page read and write
|
||
|
519E000
|
stack
|
page read and write
|
||
|
4B7000
|
unkown
|
page read and write
|
||
|
2E70000
|
heap
|
page read and write
|
||
|
35FE000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
4D3000
|
unkown
|
page readonly
|
||
|
22FA000
|
direct allocation
|
page read and write
|
||
|
25A0000
|
direct allocation
|
page read and write
|
||
|
CDB000
|
direct allocation
|
page read and write
|
||
|
CE9000
|
heap
|
page read and write
|
||
|
AAE000
|
heap
|
page read and write
|
||
|
22FA000
|
direct allocation
|
page read and write
|
||
|
AA7000
|
heap
|
page read and write
|
||
|
560000
|
heap
|
page read and write
|
||
|
2318000
|
direct allocation
|
page read and write
|
||
|
2A70000
|
heap
|
page read and write
|
||
|
22A1000
|
direct allocation
|
page read and write
|
||
|
AA3000
|
heap
|
page read and write
|
||
|
A33000
|
heap
|
page read and write
|
||
|
990000
|
heap
|
page read and write
|
||
|
18E000
|
stack
|
page read and write
|
||
|
2683000
|
direct allocation
|
page read and write
|
||
|
25A0000
|
direct allocation
|
page read and write
|
||
|
2C60000
|
heap
|
page read and write
|
||
|
5320000
|
heap
|
page read and write
|
||
|
2FFD000
|
stack
|
page read and write
|
||
|
4DD000
|
stack
|
page read and write
|
||
|
356F000
|
heap
|
page read and write
|
||
|
C66000
|
direct allocation
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
19D000
|
stack
|
page read and write
|
||
|
650000
|
heap
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
22F1000
|
direct allocation
|
page read and write
|
||
|
C99000
|
direct allocation
|
page read and write
|
||
|
1EE000
|
stack
|
page read and write
|
||
|
3408000
|
heap
|
page read and write
|
||
|
58E000
|
stack
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
22A8000
|
direct allocation
|
page read and write
|
||
|
7FE000
|
stack
|
page read and write
|
||
|
60F000
|
stack
|
page read and write
|
||
|
367C000
|
heap
|
page read and write
|
||
|
D05000
|
heap
|
page read and write
|
||
|
2308000
|
direct allocation
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
C50000
|
heap
|
page read and write
|
||
|
5142000
|
direct allocation
|
page read and write
|
||
|
590000
|
heap
|
page read and write
|
||
|
2351000
|
direct allocation
|
page read and write
|
||
|
2E45000
|
heap
|
page read and write
|
||
|
2519000
|
direct allocation
|
page read and write
|
||
|
4DC4000
|
direct allocation
|
page read and write
|
||
|
33E0000
|
heap
|
page read and write
|
||
|
34D8000
|
heap
|
page read and write
|
||
|
6F8000
|
unkown
|
page readonly
|
||
|
24E5000
|
direct allocation
|
page read and write
|
||
|
A9B000
|
heap
|
page read and write
|
||
|
CE0000
|
heap
|
page read and write
|
||
|
C4A000
|
direct allocation
|
page read and write
|
||
|
4B7000
|
unkown
|
page read and write
|
||
|
910000
|
heap
|
page read and write
|
||
|
50E000
|
stack
|
page read and write
|
||
|
2497000
|
direct allocation
|
page read and write
|
||
|
25AC000
|
direct allocation
|
page read and write
|
||
|
6BF000
|
heap
|
page read and write
|
||
|
9BD000
|
stack
|
page read and write
|
||
|
100A000
|
unkown
|
page read and write
|
||
|
2358000
|
direct allocation
|
page read and write
|
||
|
C3B000
|
direct allocation
|
page read and write
|
||
|
C00000
|
heap
|
page read and write
|
||
|
2303000
|
direct allocation
|
page read and write
|
||
|
32B0000
|
heap
|
page read and write
|
||
|
1CE000
|
stack
|
page read and write
|
||
|
98F000
|
stack
|
page read and write
|
||
|
545F000
|
direct allocation
|
page read and write
|
||
|
A8D000
|
heap
|
page read and write
|
||
|
A7E000
|
heap
|
page read and write
|
||
|
840000
|
heap
|
page read and write
|
||
|
34D0000
|
direct allocation
|
page read and write
|
||
|
68E000
|
stack
|
page read and write
|
||
|
6D0000
|
heap
|
page read and write
|
||
|
3490000
|
direct allocation
|
page read and write
|
||
|
848000
|
heap
|
page read and write
|
||
|
22BF000
|
direct allocation
|
page read and write
|
||
|
830000
|
heap
|
page read and write
|
||
|
CC4000
|
direct allocation
|
page read and write
|
||
|
289D000
|
stack
|
page read and write
|
||
|
D59000
|
heap
|
page read and write
|
||
|
5210000
|
heap
|
page read and write
|
||
|
7AE000
|
stack
|
page read and write
|
||
|
24D7000
|
direct allocation
|
page read and write
|
||
|
28A3000
|
heap
|
page read and write
|
||
|
3531000
|
heap
|
page read and write
|
||
|
B7E000
|
stack
|
page read and write
|
||
|
4CC000
|
unkown
|
page readonly
|
||
|
2D30000
|
trusted library allocation
|
page read and write
|
||
|
A3D000
|
stack
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
37A8000
|
direct allocation
|
page read and write
|
||
|
3798000
|
direct allocation
|
page read and write
|
||
|
2DCF000
|
stack
|
page read and write
|
||
|
378F000
|
direct allocation
|
page read and write
|
||
|
33D0000
|
heap
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
6B6000
|
heap
|
page read and write
|
||
|
5D8000
|
heap
|
page read and write
|
||
|
7FE1B000
|
direct allocation
|
page read and write
|
||
|
4FCF000
|
stack
|
page read and write
|
||
|
3008000
|
heap
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
234A000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
AFE000
|
stack
|
page read and write
|
||
|
3570000
|
heap
|
page read and write
|
||
|
285B000
|
stack
|
page read and write
|
||
|
22E9000
|
direct allocation
|
page read and write
|
||
|
D55000
|
heap
|
page read and write
|
||
|
4880000
|
heap
|
page read and write
|
||
|
2578000
|
direct allocation
|
page read and write
|
||
|
22CD000
|
direct allocation
|
page read and write
|
||
|
33A5000
|
heap
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
A91000
|
heap
|
page read and write
|
||
|
3480000
|
direct allocation
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
360F000
|
stack
|
page read and write
|
||
|
232D000
|
direct allocation
|
page read and write
|
||
|
A68000
|
heap
|
page read and write
|
||
|
AB4000
|
heap
|
page read and write
|
||
|
87E000
|
stack
|
page read and write
|
||
|
C70000
|
heap
|
page read and write
|
||
|
A5E000
|
heap
|
page read and write
|
||
|
1A0000
|
heap
|
page read and write
|
||
|
83E000
|
stack
|
page read and write
|
||
|
3000000
|
heap
|
page read and write
|
||
|
2683000
|
heap
|
page read and write
|
||
|
6B4000
|
heap
|
page read and write
|
||
|
3530000
|
direct allocation
|
page read and write
|
||
|
364E000
|
stack
|
page read and write
|
||
|
96000
|
stack
|
page read and write
|
||
|
C5F000
|
direct allocation
|
page read and write
|
||
|
A71000
|
heap
|
page read and write
|
||
|
C88000
|
direct allocation
|
page read and write
|
||
|
3740000
|
direct allocation
|
page read and write
|
||
|
A2B000
|
heap
|
page read and write
|
||
|
A9F000
|
heap
|
page read and write
|
||
|
6C8000
|
unkown
|
page read and write
|
||
|
5138000
|
direct allocation
|
page read and write
|
||
|
24BA000
|
direct allocation
|
page read and write
|
||
|
AB3000
|
heap
|
page read and write
|
||
|
2343000
|
direct allocation
|
page read and write
|
||
|
140000
|
heap
|
page read and write
|
||
|
CAF000
|
direct allocation
|
page read and write
|
||
|
25BA000
|
direct allocation
|
page read and write
|
||
|
60F000
|
stack
|
page read and write
|
||
|
6DF000
|
stack
|
page read and write
|
||
|
35B1000
|
heap
|
page read and write
|
||
|
D41000
|
direct allocation
|
page read and write
|
||
|
A9C000
|
heap
|
page read and write
|
||
|
5318000
|
heap
|
page read and write
|
||
|
350E000
|
stack
|
page read and write
|
||
|
A9F000
|
heap
|
page read and write
|
||
|
22C6000
|
direct allocation
|
page read and write
|
||
|
2326000
|
direct allocation
|
page read and write
|
||
|
33F0000
|
heap
|
page read and write
|
||
|
C0D000
|
stack
|
page read and write
|
||
|
19D000
|
stack
|
page read and write
|
||
|
2B8F000
|
stack
|
page read and write
|
||
|
34D0000
|
heap
|
page read and write
|
||
|
1C0000
|
heap
|
page read and write
|
||
|
4C1000
|
unkown
|
page read and write
|
||
|
D33000
|
direct allocation
|
page read and write
|
||
|
7D0000
|
heap
|
page read and write
|
||
|
A4C000
|
heap
|
page read and write
|
||
|
4A40000
|
heap
|
page read and write
|
||
|
28F0000
|
heap
|
page read and write
|
||
|
6C5000
|
unkown
|
page write copy
|
||
|
3650000
|
heap
|
page read and write
|
||
|
2240000
|
direct allocation
|
page read and write
|
||
|
8E0000
|
heap
|
page read and write
|
||
|
2326000
|
direct allocation
|
page read and write
|
||
|
22E1000
|
direct allocation
|
page read and write
|
||
|
24D0000
|
direct allocation
|
page read and write
|
||
|
6CF000
|
stack
|
page read and write
|
||
|
53A0000
|
direct allocation
|
page read and write
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
35B1000
|
heap
|
page read and write
|
||
|
3530000
|
heap
|
page read and write
|
||
|
6CF000
|
stack
|
page read and write
|
||
|
CB6000
|
direct allocation
|
page read and write
|
||
|
18D000
|
stack
|
page read and write
|
||
|
600000
|
heap
|
page read and write
|
||
|
2890000
|
direct allocation
|
page read and write
|
||
|
54E000
|
stack
|
page read and write
|
||
|
CA0000
|
direct allocation
|
page read and write
|
||
|
18C000
|
stack
|
page read and write
|
||
|
54F000
|
stack
|
page read and write
|
||
|
2260000
|
direct allocation
|
page read and write
|
||
|
A63000
|
heap
|
page read and write
|
||
|
A31000
|
heap
|
page read and write
|
||
|
916000
|
heap
|
page read and write
|
||
|
3490000
|
direct allocation
|
page read and write
|
||
|
D16000
|
direct allocation
|
page read and write
|
||
|
CBD000
|
direct allocation
|
page read and write
|
||
|
2596000
|
direct allocation
|
page read and write
|
||
|
7FE30000
|
direct allocation
|
page read and write
|
||
|
5318000
|
heap
|
page read and write
|
||
|
6D0000
|
heap
|
page read and write
|
||
|
A4C000
|
heap
|
page read and write
|
||
|
2268000
|
direct allocation
|
page read and write
|
||
|
7FB30000
|
direct allocation
|
page read and write
|
||
|
51D000
|
stack
|
page read and write
|
||
|
A50000
|
heap
|
page read and write
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
A37000
|
heap
|
page read and write
|
||
|
3210000
|
heap
|
page read and write
|
||
|
2299000
|
direct allocation
|
page read and write
|
||
|
2261000
|
direct allocation
|
page read and write
|
||
|
6D7000
|
unkown
|
page write copy
|
||
|
C6D000
|
direct allocation
|
page read and write
|
||
|
C51000
|
direct allocation
|
page read and write
|
||
|
93000
|
stack
|
page read and write
|
||
|
AA7000
|
heap
|
page read and write
|
||
|
A83000
|
heap
|
page read and write
|
||
|
35CE000
|
stack
|
page read and write
|
||
|
CE5000
|
heap
|
page read and write
|
||
|
1D0000
|
heap
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
AAD000
|
heap
|
page read and write
|
||
|
255B000
|
direct allocation
|
page read and write
|
||
|
880000
|
heap
|
page read and write
|
||
|
226E000
|
direct allocation
|
page read and write
|
||
|
14D000
|
stack
|
page read and write
|
||
|
29F0000
|
heap
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
22A1000
|
direct allocation
|
page read and write
|
||
|
4C6000
|
unkown
|
page readonly
|
||
|
3820000
|
heap
|
page read and write
|
||
|
2F60000
|
heap
|
page read and write
|
||
|
37C4000
|
direct allocation
|
page read and write
|
||
|
690000
|
heap
|
page read and write
|
||
|
7FE41000
|
direct allocation
|
page read and write
|
||
|
6F0000
|
heap
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
32BE000
|
stack
|
page read and write
|
||
|
C4E000
|
stack
|
page read and write
|
||
|
B25000
|
heap
|
page read and write
|
||
|
A49000
|
heap
|
page read and write
|
||
|
C34000
|
direct allocation
|
page read and write
|
||
|
2554000
|
direct allocation
|
page read and write
|
||
|
233C000
|
direct allocation
|
page read and write
|
||
|
82F000
|
stack
|
page read and write
|
||
|
8F0000
|
direct allocation
|
page execute and read and write
|
||
|
367F000
|
stack
|
page read and write
|
||
|
430000
|
heap
|
page read and write
|
||
|
4C4000
|
unkown
|
page readonly
|
||
|
2301000
|
direct allocation
|
page read and write
|
||
|
6BC000
|
heap
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
83E000
|
stack
|
page read and write
|
||
|
A8D000
|
heap
|
page read and write
|
||
|
A76000
|
heap
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
C75000
|
direct allocation
|
page read and write
|
||
|
64E000
|
stack
|
page read and write
|
||
|
22E9000
|
direct allocation
|
page read and write
|
||
|
3390000
|
heap
|
page read and write
|
||
|
327C000
|
stack
|
page read and write
|
||
|
3825000
|
heap
|
page read and write
|
||
|
231F000
|
direct allocation
|
page read and write
|
||
|
A5B000
|
heap
|
page read and write
|
||
|
5CE000
|
stack
|
page read and write
|
||
|
25C8000
|
direct allocation
|
page read and write
|
||
|
2502000
|
direct allocation
|
page read and write
|
||
|
33EE000
|
stack
|
page read and write
|
||
|
748000
|
heap
|
page read and write
|
||
|
3498000
|
heap
|
page read and write
|
||
|
2A40000
|
heap
|
page read and write
|
||
|
331E000
|
stack
|
page read and write
|
||
|
2293000
|
direct allocation
|
page read and write
|
||
|
640000
|
heap
|
page read and write
|
||
|
C7E000
|
stack
|
page read and write
|
||
|
253D000
|
direct allocation
|
page read and write
|
||
|
50E000
|
stack
|
page read and write
|
||
|
2358000
|
direct allocation
|
page read and write
|
||
|
3400000
|
heap
|
page read and write
|
||
|
349D000
|
direct allocation
|
page read and write
|
||
|
CD4000
|
direct allocation
|
page read and write
|
||
|
33B0000
|
heap
|
page read and write
|
||
|
4F0000
|
heap
|
page read and write
|
||
|
24DE000
|
direct allocation
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
1AD000
|
stack
|
page read and write
|
||
|
3530000
|
direct allocation
|
page read and write
|
||
|
2318000
|
direct allocation
|
page read and write
|
||
|
22C7000
|
direct allocation
|
page read and write
|
||
|
5320000
|
heap
|
page read and write
|
||
|
2A3E000
|
stack
|
page read and write
|
||
|
4ECF000
|
stack
|
page read and write
|
||
|
CAC000
|
direct allocation
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
3200000
|
heap
|
page read and write
|
||
|
54F000
|
stack
|
page read and write
|
||
|
25B3000
|
direct allocation
|
page read and write
|
||
|
252F000
|
direct allocation
|
page read and write
|
||
|
A68000
|
heap
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
B20000
|
heap
|
page read and write
|
||
|
28A0000
|
heap
|
page read and write
|
||
|
234A000
|
direct allocation
|
page read and write
|
||
|
A3E000
|
stack
|
page read and write
|
||
|
DD000
|
stack
|
page read and write
|
||
|
A58000
|
heap
|
page read and write
|
||
|
2334000
|
direct allocation
|
page read and write
|
||
|
7B0000
|
heap
|
page read and write
|
||
|
A67000
|
heap
|
page read and write
|
||
|
2233000
|
direct allocation
|
page read and write
|
||
|
268F000
|
direct allocation
|
page read and write
|
||
|
60E000
|
stack
|
page read and write
|
||
|
A40000
|
heap
|
page read and write
|
||
|
17E000
|
stack
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
D3A000
|
direct allocation
|
page read and write
|
||
|
488000
|
heap
|
page read and write
|
||
|
6CF000
|
unkown
|
page read and write
|
||
|
6E5000
|
unkown
|
page readonly
|
||
|
35B1000
|
heap
|
page read and write
|
||
|
838000
|
heap
|
page read and write
|
||
|
A6D000
|
heap
|
page read and write
|
||
|
227D000
|
direct allocation
|
page read and write
|
||
|
4F60000
|
direct allocation
|
page read and write
|
||
|
4DB1000
|
direct allocation
|
page read and write
|
||
|
810000
|
heap
|
page read and write
|
||
|
580000
|
heap
|
page read and write
|
||
|
26A4000
|
direct allocation
|
page read and write
|
||
|
34AC000
|
direct allocation
|
page read and write
|
||
|
50E000
|
stack
|
page read and write
|
||
|
47D000
|
stack
|
page read and write
|
||
|
89E000
|
stack
|
page read and write
|
||
|
2343000
|
direct allocation
|
page read and write
|
||
|
A1F000
|
stack
|
page read and write
|
||
|
AA1000
|
heap
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
256A000
|
direct allocation
|
page read and write
|
||
|
AB0000
|
heap
|
page read and write
|
||
|
C58000
|
direct allocation
|
page read and write
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
36D5000
|
heap
|
page read and write
|
||
|
22D4000
|
direct allocation
|
page read and write
|
||
|
353C000
|
direct allocation
|
page read and write
|
||
|
5D7000
|
heap
|
page read and write
|
||
|
4C0000
|
unkown
|
page read and write
|
||
|
6CF000
|
unkown
|
page read and write
|
||
|
354B000
|
direct allocation
|
page read and write
|
||
|
ABD000
|
stack
|
page read and write
|
||
|
AB7000
|
heap
|
page read and write
|
||
|
AA7000
|
heap
|
page read and write
|
||
|
AC3000
|
heap
|
page read and write
|
||
|
323D000
|
stack
|
page read and write
|
||
|
348F000
|
stack
|
page read and write
|
||
|
D0F000
|
direct allocation
|
page read and write
|
||
|
C0F000
|
stack
|
page read and write
|
||
|
232D000
|
direct allocation
|
page read and write
|
||
|
22B6000
|
direct allocation
|
page read and write
|
||
|
2544000
|
direct allocation
|
page read and write
|
||
|
2BCE000
|
stack
|
page read and write
|
||
|
2276000
|
direct allocation
|
page read and write
|
||
|
81F000
|
stack
|
page read and write
|
||
|
DD000
|
stack
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
1000000
|
unkown
|
page readonly
|
||
|
2334000
|
direct allocation
|
page read and write
|
||
|
A5B000
|
heap
|
page read and write
|
||
|
28F8000
|
heap
|
page read and write
|
||
|
3631000
|
heap
|
page read and write
|
||
|
59D000
|
stack
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
2267000
|
direct allocation
|
page read and write
|
||
|
29F0000
|
heap
|
page read and write
|
||
|
800000
|
heap
|
page read and write
|
||
|
C4E000
|
stack
|
page read and write
|
||
|
6CC000
|
unkown
|
page read and write
|
||
|
6CC000
|
unkown
|
page read and write
|
||
|
228C000
|
direct allocation
|
page read and write
|
||
|
C10000
|
direct allocation
|
page read and write
|
||
|
5452000
|
direct allocation
|
page read and write
|
||
|
2491000
|
direct allocation
|
page read and write
|
||
|
2259000
|
direct allocation
|
page read and write
|
||
|
130000
|
heap
|
page read and write
|
||
|
7DE000
|
stack
|
page read and write
|
||
|
17E000
|
stack
|
page read and write
|
||
|
AA1000
|
heap
|
page read and write
|
||
|
4BA000
|
unkown
|
page read and write
|
||
|
2C80000
|
trusted library allocation
|
page read and write
|
||
|
4C2000
|
unkown
|
page write copy
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2DFE000
|
stack
|
page read and write
|
||
|
2680000
|
heap
|
page read and write
|
||
|
22AF000
|
direct allocation
|
page read and write
|
||
|
A18000
|
heap
|
page read and write
|
||
|
C42000
|
direct allocation
|
page read and write
|
||
|
33A0000
|
heap
|
page read and write
|
||
|
B80000
|
heap
|
page read and write
|
||
|
233C000
|
direct allocation
|
page read and write
|
||
|
AB0000
|
heap
|
page read and write
|
||
|
69A000
|
heap
|
page read and write
|
||
|
3215000
|
heap
|
page read and write
|
||
|
2571000
|
direct allocation
|
page read and write
|
||
|
22B0000
|
direct allocation
|
page read and write
|
||
|
339E000
|
stack
|
page read and write
|
||
|
51FF000
|
stack
|
page read and write
|
||
|
A6C000
|
heap
|
page read and write
|
||
|
2E10000
|
heap
|
page read and write
|
||
|
558000
|
heap
|
page read and write
|
||
|
2D4E000
|
stack
|
page read and write
|
||
|
2292000
|
direct allocation
|
page read and write
|
||
|
25A0000
|
direct allocation
|
page read and write
|
||
|
ABC000
|
heap
|
page read and write
|
||
|
35B1000
|
heap
|
page read and write
|
||
|
AF0000
|
heap
|
page read and write
|
||
|
37AE000
|
direct allocation
|
page read and write
|
||
|
2E40000
|
heap
|
page read and write
|
||
|
2E78000
|
heap
|
page read and write
|
||
|
AA1000
|
heap
|
page read and write
|
||
|
71E000
|
unkown
|
page readonly
|
||
|
5472000
|
direct allocation
|
page read and write
|
||
|
490000
|
heap
|
page read and write
|
||
|
908000
|
heap
|
page read and write
|
||
|
33A0000
|
heap
|
page read and write
|
||
|
6C5000
|
unkown
|
page read and write
|
||
|
CF1000
|
direct allocation
|
page read and write
|
||
|
226F000
|
direct allocation
|
page read and write
|
||
|
3480000
|
direct allocation
|
page read and write
|
||
|
6EC000
|
unkown
|
page readonly
|
||
|
24A9000
|
direct allocation
|
page read and write
|
||
|
5AE000
|
stack
|
page read and write
|
||
|
917000
|
heap
|
page read and write
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
227D000
|
direct allocation
|
page read and write
|
||
|
6B5000
|
heap
|
page read and write
|
||
|
99F000
|
stack
|
page read and write
|
||
|
C1B000
|
direct allocation
|
page read and write
|
||
|
D08000
|
direct allocation
|
page read and write
|
||
|
2840000
|
heap
|
page read and write
|
||
|
3750000
|
direct allocation
|
page read and write
|
||
|
2252000
|
direct allocation
|
page read and write
|
||
|
130000
|
heap
|
page read and write
|
||
|
340E000
|
stack
|
page read and write
|
||
|
6DC000
|
unkown
|
page readonly
|
||
|
4E4000
|
unkown
|
page readonly
|
||
|
550000
|
heap
|
page read and write
|
||
|
1BE000
|
stack
|
page read and write
|
||
|
580000
|
heap
|
page read and write
|
||
|
2536000
|
direct allocation
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
6DE000
|
unkown
|
page readonly
|
||
|
2284000
|
direct allocation
|
page read and write
|
||
|
2670000
|
heap
|
page read and write
|
||
|
2351000
|
direct allocation
|
page read and write
|
||
|
22E1000
|
direct allocation
|
page read and write
|
||
|
100A000
|
unkown
|
page read and write
|
||
|
A92000
|
heap
|
page read and write
|
||
|
A9F000
|
heap
|
page read and write
|
||
|
2CE0000
|
heap
|
page read and write
|
||
|
24B3000
|
direct allocation
|
page read and write
|
||
|
25A0000
|
direct allocation
|
page read and write
|
||
|
6D4000
|
unkown
|
page read and write
|
||
|
500000
|
heap
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
D50000
|
heap
|
page read and write
|
||
|
33C0000
|
heap
|
page read and write
|
||
|
D1D000
|
direct allocation
|
page read and write
|
||
|
AB0000
|
heap
|
page read and write
|
||
|
24F4000
|
direct allocation
|
page read and write
|
||
|
252C000
|
direct allocation
|
page read and write
|
||
|
2C0F000
|
stack
|
page read and write
|
||
|
D2C000
|
direct allocation
|
page read and write
|
||
|
A73000
|
heap
|
page read and write
|
||
|
A60000
|
heap
|
page read and write
|
||
|
725000
|
heap
|
page read and write
|
||
|
6C5000
|
unkown
|
page read and write
|
||
|
9F0000
|
heap
|
page read and write
|
||
|
DD000
|
stack
|
page read and write
|
||
|
88E000
|
stack
|
page read and write
|
||
|
100C000
|
unkown
|
page readonly
|
||
|
6B0000
|
heap
|
page read and write
|
||
|
A55000
|
heap
|
page read and write
|
||
|
6D4000
|
unkown
|
page read and write
|
||
|
A6A000
|
heap
|
page read and write
|
||
|
3630000
|
heap
|
page read and write
|
||
|
8F0000
|
heap
|
page read and write
|
||
|
2F5F000
|
stack
|
page read and write
|
||
|
5320000
|
heap
|
page read and write
|
||
|
69E000
|
heap
|
page read and write
|
||
|
A47000
|
heap
|
page read and write
|
||
|
4DF000
|
unkown
|
page readonly
|
||
|
9C000
|
stack
|
page read and write
|
||
|
24C1000
|
direct allocation
|
page read and write
|
||
|
6E0000
|
heap
|
page read and write
|
||
|
CEA000
|
direct allocation
|
page read and write
|
||
|
259D000
|
direct allocation
|
page read and write
|
||
|
480000
|
heap
|
page read and write
|
||
|
70D000
|
unkown
|
page readonly
|
||
|
5466000
|
direct allocation
|
page read and write
|
||
|
376E000
|
stack
|
page read and write
|
||
|
A31000
|
heap
|
page read and write
|
||
|
A3E000
|
heap
|
page read and write
|
||
|
377F000
|
direct allocation
|
page read and write
|
||
|
1001000
|
unkown
|
page execute read
|
||
|
4B9000
|
unkown
|
page read and write
|
||
|
323B000
|
stack
|
page read and write
|
||
|
37AE000
|
stack
|
page read and write
|
||
|
2EDE000
|
stack
|
page read and write
|
||
|
100A000
|
unkown
|
page read and write
|
There are 602 hidden memdumps, click here to show them.