IOC Report
Confirm Me.exe

loading gif

Files

File Path
Type
Category
Malicious
Confirm Me.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\.oracle_jre_usage\660d398ef7c667fa.timestamp
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\hsperfdata_user\6524
data
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\install.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\COPYRIGHT
ISO-8859 text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\LICENSE
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\README.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\THIRDPARTYLICENSEREADME.txt
Unicode text, UTF-8 text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\Welcome.html
HTML document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\asm-all.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\JAWTAccessBridge-32.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\JAWTAccessBridge.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\JavaAccessBridge-32.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\JavaAccessBridge.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\WindowsAccessBridge-32.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\WindowsAccessBridge.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\awt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\bci.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\client\Xusage.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\client\jvm.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\dcpr.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\decora_sse.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\deploy.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\dt_shmem.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\dt_socket.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\dtplugin\deployJava1.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\dtplugin\npdeployJava1.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\eula.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\fontmanager.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\fxplugins.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\glass.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\glib-lite.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\gstreamer-lite.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\hprof.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\instrument.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\j2pcsc.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\j2pkcs11.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jaas_nt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jabswitch.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\java-rmi.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\java.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\java.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\java_crw_demo.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\javacpl.cpl
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\javacpl.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\javafx_font.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\javafx_font_t2k.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\javafx_iio.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\javaw.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\javaws.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jawt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jdwp.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jfr.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jfxmedia.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jfxwebkit.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jjs.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jli.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jp2iexp.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jp2launcher.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jp2native.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jp2ssv.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jpeg.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jsdt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jsound.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\jsoundds.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\kcms.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\keytool.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\kinit.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\klist.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\ktab.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\lcms.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\management.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\mlib_image.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\msvcp120.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\msvcr100.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\msvcr120.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\net.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\nio.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\npt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\orbd.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\pack200.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\plugin2\msvcr100.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\plugin2\npjp2.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\policytool.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\prism_common.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\prism_d3d.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\prism_sw.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\resource.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\rmid.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\rmiregistry.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\servertool.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\splashscreen.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\ssv.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\ssvagent.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\sunec.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\sunmscapi.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\t2k.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\tnameserv.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\unpack.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\unpack200.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\verify.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\w2k_lsa_auth.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\wsdetect.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\zip.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\dn-compiled-module.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\dn-php-sdk.jar
Zip archive data, at least v1.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\gson.jar
Zip archive data, at least v1.0 to extract, compression method=store
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\jphp-app-framework.jar
Zip archive data, at least v1.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\jphp-core.jar
Zip archive data, at least v1.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\jphp-desktop-ext.jar
Zip archive data, at least v1.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\jphp-gui-ext.jar
Zip archive data, at least v1.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\jphp-json-ext.jar
Zip archive data, at least v1.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\jphp-runtime.jar
Zip archive data, at least v1.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\jphp-xml-ext.jar
Zip archive data, at least v1.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\jphp-zend-ext.jar
Zip archive data, at least v1.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\jphp-zip-ext.jar
Zip archive data, at least v1.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\accessibility.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\calendars.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\charsets.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\classlist
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\cmm\CIEXYZ.pf
Sun KCMS color profile 2.0, type KCMS, XYZ/XYZ-spac device, 51236 bytes, 2-12-1997 18:50:04, dependently, PCS X=0xf6b3 Z=0xd2f8 "XYZ to XYZ Identity Profile"
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\cmm\GRAY.pf
Sun KCMS color profile 2.0, type KCMS, GRAY/XYZ-mntr device, KODA/GRAY model, 632 bytes, 27-7-95 17:30:15, embedded, relative colorimetric, PCS Z=0xd32b "KODAK Grayscale Conversion - Gamma 1.0"
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\cmm\LINEAR_RGB.pf
color profile 2.0, type KCMS, RGB/XYZ-mntr device by KODK, 1044 bytes, 2-2-1998, PCS Z=0xd32c "linear sRGB"
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\cmm\PYCC.pf
Sun KCMS color profile 2.0, type KCMS, 3CLR/Lab-spac device, 274474 bytes, 6-11-1996 7:50:04, PCS X=0xf6b3 Z=0xd2f8 "Std Photo YCC Print"
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\cmm\sRGB.pf
Microsoft color profile 2.1, type Lino, RGB/XYZ-mntr device, IEC/sRGB model by HP, 3144 bytes, 9-2-1998 6:49:00 "sRGB IEC61966-2.1"
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\content-types.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\currency.data
data
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\ffjcext.zip
Zip archive data, at least v1.0 to extract, compression method=store
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_de.properties
ASCII text, with very long lines (1345), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_es.properties
ASCII text, with very long lines (1475), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_fr.properties
ASCII text, with very long lines (1575), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_it.properties
ASCII text, with very long lines (1392), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_ja.properties
ASCII text, with very long lines (2924), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_ko.properties
ASCII text, with very long lines (2601), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_pt_BR.properties
ASCII text, with very long lines (1319), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_sv.properties
ASCII text, with very long lines (1386), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_zh_CN.properties
ASCII text, with very long lines (1857), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_zh_HK.properties
ASCII text, with very long lines (1729), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\messages_zh_TW.properties
ASCII text, with very long lines (1729), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\splash.gif
GIF image data, version 89a, 320 x 139
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\splash@2x.gif
GIF image data, version 89a, 640 x 278
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\splash_11-lic.gif
GIF image data, version 89a, 320 x 139
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\deploy\splash_11@2x-lic.gif
GIF image data, version 89a, 640 x 278
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\access-bridge-32.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\access-bridge.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\cldrdata.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\dnsns.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\jaccess.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\jfxrt.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\localedata.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\meta-index
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\nashorn.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\sunec.jar
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\sunjce_provider.jar
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\sunmscapi.jar
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\sunpkcs11.jar
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\ext\zipfs.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\flavormap.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\fontconfig.bfc
raw G3 (Group 3) FAX
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\fontconfig.properties.src
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\fonts\LucidaBrightDemiBold.ttf
TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,422.Lucida BrightDemiboldLucida Bright Dem
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\fonts\LucidaBrightDemiItalic.ttf
TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc.Lucida BrightDemibold ItalicLucida Bright Demibold Itali
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\fonts\LucidaBrightItalic.ttf
TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,773.Lucida BrightItalicLucida Bright Itali
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\fonts\LucidaBrightRegular.ttf
TrueType Font data, 15 tables, 1st "LTSH", 16 names, Macintosh, Copyright (c) 2000 Bigelow & Holmes Inc. Pat. Des 289,421.Lucida BrightRegularLucida Bright Regu
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\fonts\LucidaSansDemiBold.ttf
TrueType Font data, 15 tables, 1st "LTSH", 19 names, Macintosh, Copyright (c) 1999, 2001 by Bigelow & Holmes Inc. Pat. Des. 289,420.Lucida SansDemiboldLucida Sa
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\fonts\LucidaSansRegular.ttf
TrueType Font data, 18 tables, 1st "GDEF", 19 names, Macintosh, Copyright (c) 1999 by Bigelow & Holmes Inc. Pat. Des. 289,420.Lucida SansRegularLucida Sans Regu
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\fonts\LucidaTypewriterBold.ttf
TrueType Font data, 13 tables, 1st "OS/2", 16 names, Macintosh, Copyright (c) 1999, 2001 by Bigelow & Holmes Inc.Lucida Sans TypewriterBoldLucida Sans Typewrite
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\fonts\LucidaTypewriterRegular.ttf
TrueType Font data, 13 tables, 1st "OS/2", 16 names, Macintosh, Copyright (c) 1999 by Bigelow & Holmes Inc.Lucida Sans TypewriterRegularLucida Sans Typewriter R
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\hijrah-config-umalqura.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\i386\jvm.cfg
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\images\cursors\cursors.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\images\cursors\invalid32x32.gif
GIF image data, version 89a, 32 x 32
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\images\cursors\win32_CopyDrop32x32.gif
GIF image data, version 89a, 31 x 32
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif
GIF image data, version 89a, 32 x 32
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\images\cursors\win32_LinkDrop32x32.gif
GIF image data, version 89a, 31 x 32
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
GIF image data, version 89a, 32 x 32
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\images\cursors\win32_MoveDrop32x32.gif
GIF image data, version 89a, 31 x 32
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
GIF image data, version 89a, 32 x 32
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\javafx.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\javaws.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\jce.jar
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\jfr.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\jfr\default.jfc
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\jfr\profile.jfc
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\jfxswt.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\jsse.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\jvm.hprof.txt
Algol 68 source, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\logging.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\management-agent.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\management\jmxremote.access
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\management\jmxremote.password.template
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\management\management.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\management\snmp.acl.template
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\meta-index
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\net.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\plugin.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\psfont.properties.ja
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\psfontj2d.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\resources.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\rt.jar
Java archive data (JAR)
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\security\US_export_policy.jar
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\security\blacklist
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\security\blacklisted.certs
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\security\cacerts
Java KeyStore
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\security\java.policy
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\security\java.security
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\security\javaws.policy
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\security\local_policy.jar
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\sound.properties
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\tzdb.dat
data
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\lib\tzmappings
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\release
ASCII text, with very long lines (427), with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\slf4j-api.jar
Zip archive data, at least v1.0 to extract, compression method=store
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\slf4j-simple.jar
Zip archive data, at least v1.0 to extract, compression method=store
dropped
C:\Users\user\AppData\Roaming\InstallerPDW\jre\zt-zip.jar
Zip archive data, at least v1.0 to extract, compression method=store
dropped
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06
data
dropped
There are 209 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\javaw.exe
"C:\Users\user\AppData\Roaming\InstallerPDW\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "jre\.;jre\..;jre\asm-all.jar;jre\bin;jre\COPYRIGHT;jre\dn-compiled-module.jar;jre\dn-php-sdk.jar;jre\gson.jar;jre\jphp-app-framework.jar;jre\jphp-core.jar;jre\jphp-desktop-ext.jar;jre\jphp-gui-ext.jar;jre\jphp-json-ext.jar;jre\jphp-runtime.jar;jre\jphp-xml-ext.jar;jre\jphp-zend-ext.jar;jre\jphp-zip-ext.jar;jre\lib;jre\LICENSE;jre\README.txt;jre\release;jre\slf4j-api.jar;jre\slf4j-simple.jar;jre\THIRDPARTYLICENSEREADME-JAVAFX.txt;jre\THIRDPARTYLICENSEREADME.txt;jre\Welcome.html;jre\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
malicious
C:\Users\user\Desktop\Confirm Me.exe
"C:\Users\user\Desktop\Confirm Me.exe"
C:\Users\user\AppData\Roaming\InstallerPDW\install.exe
C:\Users\user\AppData\Roaming\InstallerPDW\install.exe

URLs

Name
IP
Malicious
http://javafx.com/fxml/1
unknown
http://javax.xml.XMLConstants/property/accessExternalDTDR
unknown
http://apache.org/xml/features/validation/schema/augment-psvi
unknown
http://apache.org/xml/properties/input-buffer-size
unknown
http://repository.swisssign.com/C
unknown
http://www.chambersign.org1
unknown
http://repository.swisssign.com/0
unknown
HTTP://WWW.CHAMBERSIGN.ORG
unknown
http://apache.org/xml/properties/internal/entity-manager
unknown
http://apache.org/xml/properties/internal/document-scanner5
unknown
http://apache.org/xml/features/internal/parser-settings
unknown
http://apache.org/xml/features/dom/include-ignorable-whitespace
unknown
http://java.sun.com/xml/dom/properties/
unknown
http://apache.org/xml/properties/internal/stax-entity-resolver
unknown
http://www.oracle.com/hotspot/jvm/vm/compiler/id
unknown
http://apache.org/xml/features/xinclude/fixup-base-uris
unknown
http://apache.org/xml/properties/schema/external-noNamespaceSchemaLocation
unknown
http://apache.org/xml/properties/internal/error-reporter
unknown
http://apache.org/xml/features/validation/schema:
unknown
http://policy.camerfirma.comC
unknown
http://apache.org/xml/properties/internal/namespace-binderA
unknown
http://apache.org/xml/properties/schema/external-schemaLocationJ
unknown
http://www.oracle.com/hotspot/jvm/java/monitor/address
unknown
http://apache.org/xml/features/include-comments
unknown
http://apache.org/xml/features/scanner/notify-char-refs
unknown
http://javax.xml.transform.sax.SAXResult/feature#
unknown
http://apache.org/xml/properties/internal/symbol-table6
unknown
http://apache.org/xml/features/namespacesY
unknown
http://java.sun.com/xml/schema/features/report-ignored-element-content-whitespace3
unknown
http://policy.camerfirma.com0
unknown
http://apache.org/xml/properties/dom/current-element-node7
unknown
http://wildsau.idv.uni-linz.ac.at/mfx/upx.html
unknown
http://java.sun.com/xml/stream/properties/ignore-external-dtd
unknown
http://java.sun.com/xml/stream/properties/ignore-external-dtd9
unknown
http://apache.org/xml/features/continue-after-fatal-error
unknown
http://apache.org/xml/features/standard-uri-conformant
unknown
http://apache.org/xml/properties/internal/document-scanner
unknown
http://www.oracle.com/hotspot/jdk/
unknown
http://www.certplus.com/CRL/class2.crl
unknown
http://bugreport.sun.com/bugreport/
unknown
http://java.oracle.com/
unknown
http://apache.org/xml/features/
unknown
http://apache.org/xml/features/generate-synthetic-annotations
unknown
http://www.oracle.com/technetwork/java/javaseproducts/C:
unknown
http://www.xfree86.org/)
unknown
http://www.symauth.com/cps0(
unknown
http://xml.org/sax/features/allow-dtd-events-after-endDTD
unknown
http://cps.chambersign.org/cps/chambersroot.html
unknown
http://www.certplus.com/CRL/class3P.crl
unknown
http://www.unicode.org/cldr/data/.
unknown
http://apache.org/xml/features/internal/validation/schema/use-grammar-pool-only
unknown
http://xml.org/sax/features/string-interningfeature
unknown
http://crl.securetrust.com/STCA.crl
unknown
http://www.jclark.com/xt
unknown
http://apache.org/xml/properties/internal/namespace-binder
unknown
http://www.oracle.com/hotspot/jvm/vm/gc/id
unknown
http://www.symauth.com/rpa00
unknown
http://www.oracle.com/technetwork/java/javase/downloads/index.html
unknown
http://www.oracle.com/xml/is-standalone
unknown
http://www.oracle.com/technetwork/java/javase/overview/
unknown
http://icl.com/saxon
unknown
http://javax.xml.transform.sax.SAXTransformerFactory/feature
unknown
http://javafx.com/vp6decoderflvdemux
unknown
http://javax.xml.XMLConstants/property/accessExternalStylesheet
unknown
http://xml.org/sax/features/validation?
unknown
http://apache.org/xml/properties/security-manager
unknown
http://www.oracle.com/technetwork/java/javaseproducts/
unknown
http://java.sun.com/xml/dom/properties/ancestor-check
unknown
http://xml.apache.org/xslt
unknown
http://www.oracle.com/hotspot/jvm/
unknown
http://javax.xml.transform.stax.StAXResult/feature
unknown
http://asm.objectweb.org
unknown
http://www.linuxnet.com
unknown
http://apache.org/xml/features/dom/include-ignorable-whitespace:
unknown
http://apache.org/xml/properties/security-manager&
unknown
http://apache.org/xml/features/xinclude
unknown
http://apache.org/xml/properties/internal/xinclude-handler;
unknown
http://apache.org/xml/properties/co
unknown
http://apache.org/xml/features/validation/schema-full-checking
unknown
http://javax.xml.XMLConstants/property/
unknown
http://apache.org/xml/properties/internal/dtd-scanner7
unknown
http://apache.org/xml/features/allow-java-encodingshgo
unknown
http://openjdk.java.net/jeps/220).
unknown
http://mozilla.org/MPL/2.0/.
unknown
http://apache.org/xml/properties/internal/grammar-pool
unknown
http://apache.org/xml/properties/locale
unknown
http://java.sun.com/xml/stream/properties/reader-in-defined-state
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0
unknown
http://www.quovadisglobal.com/cps0
unknown
http://apache.org/xml/properties/localehF
unknown
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
unknown
http://relaxngcc.sf.net/).
unknown
http://apache.org/xml/features/allow-java-encodings
unknown
http://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer.
unknown
http://oss.oracle.com/projects/webkit-java-mods/
unknown
http://www.sgi.com/software/opensource/glx/license.html.
unknown
http://apache.org/xml/properties/internal/validator/dtdD
unknown
http://tartarus.org/~martin/PorterStemmer
unknown
http://download.oracle.com/javase/7/docs/technotes/guides/plugin/
unknown
http://www.oracle.com/feature/use-service-mechanism
unknown
There are 90 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
pastebin.com
104.20.3.235
 malicious

IPs

IP
Domain
Country
Malicious
104.20.3.235
pastebin.com
United States
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
4977000
direct allocation
page read and write
19A03000
heap
page read and write
6E4B1000
unkown
page readonly
15950000
direct allocation
page read and write
6B72A000
unkown
page read and write
1974B000
heap
page read and write
E1B000
heap
page read and write
4AA5000
direct allocation
page read and write
409000
unkown
page readonly
6B700000
unkown
page readonly
15444000
heap
page read and write
2770000
heap
page read and write
19756000
heap
page read and write
4C0000
heap
page read and write
6B351000
unkown
page execute read
15590000
heap
page read and write
DFC000
heap
page read and write
277F000
heap
page read and write
6C3EE000
unkown
page write copy
6C07D000
unkown
page readonly
2772000
heap
page read and write
4A11000
direct allocation
page read and write
2600000
heap
page read and write
D94000
heap
page read and write
6ADD1000
unkown
page execute read
DCE000
heap
page read and write
6B44D000
unkown
page read and write
48ED000
direct allocation
page read and write
19763000
heap
page read and write
DC8000
heap
page read and write
9D79000
direct allocation
page read and write
DBA000
heap
page read and write
DA1000
heap
page read and write
DCF000
heap
page read and write
A112000
direct allocation
page read and write
277E000
heap
page read and write
15850000
direct allocation
page read and write
155A1000
heap
page read and write
E18000
heap
page read and write
27A7000
heap
page read and write
6C071000
unkown
page execute read
2776000
heap
page read and write
19748000
heap
page read and write
401000
unkown
page execute read
4A30000
direct allocation
page read and write
6E4A0000
unkown
page readonly
6E4A1000
unkown
page execute read
2700000
direct allocation
page execute and read and write
6E3D0000
unkown
page readonly
15456000
heap
page read and write
1522E000
unkown
page read and write
6C519000
unkown
page readonly
4800000
direct allocation
page read and write
6C090000
unkown
page readonly
19757000
heap
page read and write
9E00000
direct allocation
page read and write
4A6D000
direct allocation
page read and write
E0000
heap
page read and write
4957000
direct allocation
page read and write
19763000
heap
page read and write
B10000
heap
page read and write
15FD0000
direct allocation
page read and write
6ADF3000
unkown
page readonly
1A400000
trusted library allocation
page read and write
A7CD000
direct allocation
page read and write
277D000
heap
page read and write
48F3000
direct allocation
page read and write
277A000
heap
page read and write
4BE000
stack
page read and write
14800000
direct allocation
page read and write
4B6C000
direct allocation
page read and write
4ADC000
direct allocation
page read and write
14D51000
heap
page read and write
2772000
heap
page read and write
19756000
heap
page read and write
18F7E000
stack
page read and write
D73000
heap
page read and write
4AE2000
direct allocation
page read and write
196E6000
heap
page read and write
4A36000
direct allocation
page read and write
4A8C000
direct allocation
page read and write
4AAE000
direct allocation
page read and write
6C025000
unkown
page read and write
2778000
heap
page read and write
49DB000
direct allocation
page read and write
DAF000
heap
page read and write
4A7A000
direct allocation
page read and write
4953000
direct allocation
page read and write
48CF000
direct allocation
page read and write
14C6E000
heap
page read and write
9ED3000
direct allocation
page read and write
4967000
direct allocation
page read and write
277C000
heap
page read and write
B40000
heap
page read and write
50E000
stack
page read and write
48F0000
direct allocation
page read and write
6C3F7000
unkown
page read and write
1554E000
heap
page read and write
490C000
direct allocation
page read and write
A7C0000
direct allocation
page read and write
6C027000
unkown
page readonly
1AAC0000
direct allocation
page read and write
4B03000
direct allocation
page read and write
4AF3000
direct allocation
page read and write
427000
unkown
page read and write
E1B000
heap
page read and write
49C5000
direct allocation
page read and write
408000
unkown
page readonly
AE6000
heap
page read and write
277B000
heap
page read and write
4AC9000
direct allocation
page read and write
D30000
heap
page read and write
277B000
heap
page read and write
4C38000
direct allocation
page read and write
4BE9000
direct allocation
page read and write
161D0000
direct allocation
page read and write
49D2000
direct allocation
page read and write
5B7000
heap
page read and write
277E000
heap
page read and write
2771000
heap
page read and write
190E0000
heap
page read and write
191D0000
direct allocation
page read and write
48DF000
direct allocation
page read and write
1AB00000
direct allocation
page read and write
25D0000
heap
page read and write
2771000
heap
page read and write
4AF6000
direct allocation
page read and write
970000
unkown
page readonly
190D0000
heap
page read and write
A3A3000
direct allocation
page read and write
2794000
direct allocation
page execute and read and write
15599000
heap
page read and write
971000
unkown
page execute read
1519F000
unkown
page read and write
A7BA000
direct allocation
page read and write
4BCD000
direct allocation
page read and write
1979B000
heap
page read and write
196E5000
heap
page read and write
A0C6000
direct allocation
page read and write
4AAB000
direct allocation
page read and write
A22F000
direct allocation
page read and write
97F000
stack
page read and write
DC6000
heap
page read and write
27C8000
heap
page read and write
2774000
heap
page read and write
2777000
heap
page read and write
4A20000
direct allocation
page read and write
160D0000
direct allocation
page read and write
4B10000
direct allocation
page read and write
4A9B000
direct allocation
page read and write
D3B000
heap
page read and write
277C000
heap
page read and write
4971000
direct allocation
page read and write
4AED000
direct allocation
page read and write
DA6000
heap
page read and write
16411000
heap
page read and write
6BEBC000
unkown
page readonly
2776000
heap
page read and write
2774000
heap
page read and write
277D000
heap
page read and write
4942000
direct allocation
page read and write
DC8000
heap
page read and write
49D5000
direct allocation
page read and write
2773000
heap
page read and write
4A62000
direct allocation
page read and write
28F7000
heap
page read and write
199C1000
heap
page read and write
19756000
heap
page read and write
DA6000
heap
page read and write
4AD3000
direct allocation
page read and write
6C516000
unkown
page write copy
A8EA000
direct allocation
page read and write
15588000
heap
page read and write
6B444000
unkown
page write copy
6E4AA000
unkown
page readonly
28B9000
heap
page read and write
49B3000
direct allocation
page read and write
6C421000
unkown
page readonly
49D8000
direct allocation
page read and write
16B9B000
stack
page read and write
16360000
heap
page read and write
19A000
stack
page read and write
4A73000
direct allocation
page read and write
DBA000
heap
page read and write
A7D5000
direct allocation
page read and write
2770000
heap
page read and write
6F979000
unkown
page read and write
4ABE000
direct allocation
page read and write
4B01000
direct allocation
page read and write
16E1B000
stack
page read and write
49BA000
direct allocation
page read and write
14F2E000
stack
page read and write
D9F000
heap
page read and write
1A2C0000
direct allocation
page read and write
4913000
direct allocation
page read and write
DD0000
heap
page read and write
19761000
heap
page read and write
196CF000
stack
page read and write
6C3EC000
unkown
page write copy
4A70000
direct allocation
page read and write
7EEE3000
trusted library allocation
page execute read
6E3E3000
unkown
page readonly
14DA6000
heap
page read and write
2778000
heap
page read and write
6C026000
unkown
page write copy
4E16000
direct allocation
page read and write
273E000
direct allocation
page execute and read and write
6BEBB000
unkown
page read and write
4932000
direct allocation
page read and write
4906000
direct allocation
page read and write
6C083000
unkown
page readonly
2777000
heap
page read and write
14D87000
heap
page read and write
9EB7000
direct allocation
page read and write
830000
heap
page read and write
DD1000
heap
page read and write
2771000
heap
page read and write
4915000
direct allocation
page read and write
DAF000
heap
page read and write
2775000
heap
page read and write
DC7000
heap
page read and write
A3E000
stack
page read and write
6C022000
unkown
page write copy
493C000
direct allocation
page read and write
491F000
direct allocation
page read and write
4A1A000
direct allocation
page read and write
4A55000
direct allocation
page read and write
1A6D4000
heap
page read and write
6C3E5000
unkown
page read and write
6BEA1000
unkown
page execute read
4A33000
direct allocation
page read and write
2702000
direct allocation
page execute and read and write
14EEE000
unkown
page read and write
2776000
heap
page read and write
4A6A000
direct allocation
page read and write
1A711000
heap
page read and write
48F6000
direct allocation
page read and write
279B000
direct allocation
page execute and read and write
277B000
heap
page read and write
25F0000
heap
page read and write
15750000
direct allocation
page read and write
1A611000
heap
page read and write
19756000
heap
page read and write
4A39000
direct allocation
page read and write
D8A000
heap
page read and write
DC5000
heap
page read and write
1A4B0000
trusted library allocation
page read and write
413000
unkown
page write copy
DC3000
heap
page read and write
2775000
heap
page read and write
4936000
direct allocation
page read and write
19765000
heap
page read and write
27D0000
heap
page read and write
D94000
heap
page read and write
D94000
heap
page read and write
277F000
heap
page read and write
DE1000
heap
page read and write
14D1D000
heap
page read and write
65B000
heap
page read and write
2777000
heap
page read and write
6C3ED000
unkown
page read and write
A5E8000
direct allocation
page read and write
6B6B9000
unkown
page readonly
48A9000
direct allocation
page read and write
6C3E3000
unkown
page write copy
2770000
heap
page read and write
9B000
stack
page read and write
DCE000
heap
page read and write
4909000
direct allocation
page read and write
6E087000
unkown
page readonly
DA0000
heap
page read and write
14D69000
heap
page read and write
940000
heap
page read and write
163B0000
heap
page read and write
1A3E0000
trusted library allocation
page read and write
49C2000
direct allocation
page read and write
276F000
stack
page read and write
98C000
unkown
page readonly
277A000
heap
page read and write
4983000
direct allocation
page read and write
1555A000
heap
page read and write
4C3C000
direct allocation
page read and write
6C461000
unkown
page execute read
E18000
heap
page read and write
277D000
heap
page read and write
277B000
heap
page read and write
A18E000
direct allocation
page read and write
2510000
direct allocation
page read and write
277F000
heap
page read and write
A107000
direct allocation
page read and write
4A23000
direct allocation
page read and write
151DE000
stack
page read and write
1A4D0000
trusted library allocation
page read and write
4889000
direct allocation
page read and write
DBA000
heap
page read and write
4ACF000
direct allocation
page read and write
277A000
heap
page read and write
A2B7000
direct allocation
page read and write
277E000
heap
page read and write
1AA6E000
stack
page read and write
A8D5000
direct allocation
page read and write
1A4C0000
trusted library allocation
page read and write
E18000
heap
page read and write
196E4000
heap
page read and write
D94000
heap
page read and write
DC0000
heap
page read and write
4BBF000
direct allocation
page read and write
277C000
heap
page read and write
2775000
heap
page read and write
E1B000
heap
page read and write
4AFD000
direct allocation
page read and write
1A317000
direct allocation
page read and write
DC8000
heap
page read and write
1644C000
heap
page read and write
4991000
direct allocation
page read and write
1A930000
direct allocation
page read and write
4999000
direct allocation
page read and write
495D000
direct allocation
page read and write
277D000
heap
page read and write
1A4C0000
trusted library allocation
page read and write
1989E000
stack
page read and write
2776000
heap
page read and write
1AB10000
direct allocation
page read and write
277D000
heap
page read and write
DC8000
heap
page read and write
6E3EE000
unkown
page readonly
9DF9000
direct allocation
page read and write
9D7C000
direct allocation
page read and write
4918000
direct allocation
page read and write
B56000
heap
page read and write
DB0000
heap
page read and write
274A000
direct allocation
page execute and read and write
19761000
heap
page read and write
6C401000
unkown
page read and write
4810000
direct allocation
page read and write
994000
unkown
page read and write
49AE000
direct allocation
page read and write
2752000
direct allocation
page execute and read and write
414000
unkown
page write copy
4A1C000
direct allocation
page read and write
196F5000
heap
page read and write
DAF000
heap
page read and write
4A90000
direct allocation
page read and write
DBD000
heap
page read and write
1A45E000
stack
page read and write
DAC000
heap
page read and write
6C514000
unkown
page read and write
6B6B0000
unkown
page readonly
16BE7000
unkown
page read and write
1A657000
heap
page read and write
2775000
heap
page read and write
4A0E000
direct allocation
page read and write
DA7000
heap
page read and write
626000
stack
page read and write
4C46000
direct allocation
page read and write
4AF0000
direct allocation
page read and write
219E000
stack
page read and write
2776000
heap
page read and write
196D0000
heap
page read and write
A39A000
direct allocation
page read and write
6C351000
unkown
page readonly
4A2A000
direct allocation
page read and write
1A744000
heap
page read and write
DCE000
heap
page read and write
4A04000
direct allocation
page read and write
48A2000
direct allocation
page read and write
6B72D000
unkown
page readonly
A0B4000
direct allocation
page read and write
AF0000
heap
page read and write
DB5000
heap
page read and write
616000
stack
page read and write
4A0A000
direct allocation
page read and write
1545E000
heap
page read and write
A8E4000
direct allocation
page read and write
16E6A000
unkown
page read and write
6ADFD000
unkown
page readonly
4AC5000
direct allocation
page read and write
7EEE1000
trusted library allocation
page execute read
4A48000
direct allocation
page read and write
DFC000
heap
page read and write
A0A3000
direct allocation
page read and write
2770000
heap
page read and write
4BC7000
direct allocation
page read and write
D9E000
heap
page read and write
48A6000
direct allocation
page read and write
4944000
direct allocation
page read and write
495A000
direct allocation
page read and write
D90000
heap
page read and write
6C3FB000
unkown
page write copy
6B350000
unkown
page readonly
16E6C000
unkown
page read and write
493F000
direct allocation
page read and write
1975A000
heap
page read and write
166A9000
heap
page read and write
1A6E0000
heap
page read and write
2490000
direct allocation
page read and write
48E2000
direct allocation
page read and write
492D000
direct allocation
page read and write
9D94000
direct allocation
page read and write
1979B000
heap
page read and write
4B20000
direct allocation
page read and write
15D90000
direct allocation
page read and write
1A410000
trusted library allocation
page read and write
25F5000
heap
page read and write
7EEE4000
trusted library allocation
page readonly
2779000
heap
page read and write
49F2000
direct allocation
page read and write
2773000
heap
page read and write
971000
unkown
page execute read
4974000
direct allocation
page read and write
2771000
heap
page read and write
6BEAA000
unkown
page readonly
4A01000
direct allocation
page read and write
19763000
heap
page read and write
14F7E000
unkown
page read and write
6BF41000
unkown
page execute read
2585000
heap
page read and write
DBA000
heap
page read and write
D8A000
heap
page read and write
1980E000
stack
page read and write
DBA000
heap
page read and write
5CC000
stack
page read and write
16667000
heap
page read and write
6E08D000
unkown
page readonly
49FC000
direct allocation
page read and write
19752000
heap
page read and write
4926000
direct allocation
page read and write
4B06000
direct allocation
page read and write
DA6000
heap
page read and write
49FE000
direct allocation
page read and write
DCE000
heap
page read and write
27CE000
heap
page read and write
196F1000
heap
page read and write
910000
heap
page read and write
2772000
heap
page read and write
9DA4000
direct allocation
page read and write
943000
heap
page read and write
4A17000
direct allocation
page read and write
16BF0000
direct allocation
page read and write
A7B1000
direct allocation
page read and write
14E9E000
stack
page read and write
E18000
heap
page read and write
6C01F000
unkown
page read and write
A1F1000
direct allocation
page read and write
19757000
heap
page read and write
530000
heap
page read and write
6B448000
unkown
page read and write
48C8000
direct allocation
page read and write
6E3EC000
unkown
page read and write
2775000
heap
page read and write
47F0000
heap
page read and write
40A000
unkown
page write copy
401000
unkown
page execute read
488B000
direct allocation
page read and write
277C000
heap
page read and write
6C3E1000
unkown
page read and write
496D000
direct allocation
page read and write
A675000
direct allocation
page read and write
DAB000
heap
page read and write
DB5000
heap
page read and write
4A42000
direct allocation
page read and write
4A66000
direct allocation
page read and write
4A26000
direct allocation
page read and write
9DA6000
direct allocation
page read and write
6ADE1000
unkown
page execute read
196EB000
heap
page read and write
14C85000
heap
page read and write
4A7E000
direct allocation
page read and write
DFC000
heap
page read and write
A15C000
direct allocation
page read and write
DCE000
heap
page read and write
273A000
direct allocation
page execute and read and write
4ABB000
direct allocation
page read and write
277F000
heap
page read and write
4A85000
direct allocation
page read and write
14D2B000
heap
page read and write
1AA2B000
direct allocation
page read and write
DCE000
heap
page read and write
49AB000
direct allocation
page read and write
E29000
heap
page read and write
2777000
heap
page read and write
4986000
direct allocation
page read and write
D99000
heap
page read and write
AED000
heap
page read and write
49C8000
direct allocation
page read and write
1997B000
heap
page read and write
DE1000
heap
page read and write
DBA000
heap
page read and write
5B0000
heap
page read and write
496A000
direct allocation
page read and write
2772000
heap
page read and write
400000
unkown
page readonly
49E5000
direct allocation
page read and write
9D50000
direct allocation
page read and write
9D6A000
direct allocation
page read and write
4AC2000
direct allocation
page read and write
A8F9000
direct allocation
page read and write
A068000
direct allocation
page read and write
2770000
heap
page read and write
277D000
heap
page read and write
DA0000
heap
page read and write
470000
heap
page read and write
408000
unkown
page readonly
7C0000
heap
page read and write
E1B000
heap
page read and write
489C000
direct allocation
page read and write
DAB000
heap
page read and write
E1B000
heap
page read and write
DCE000
heap
page read and write
4AE5000
direct allocation
page read and write
48B8000
direct allocation
page read and write
7EEE0000
trusted library allocation
page readonly
49B8000
direct allocation
page read and write
A5A6000
direct allocation
page read and write
DFC000
heap
page read and write
2770000
heap
page read and write
D86000
heap
page read and write
DBA000
heap
page read and write
DFC000
heap
page read and write
DFC000
heap
page read and write
4950000
direct allocation
page read and write
DB5000
heap
page read and write
2771000
heap
page read and write
A082000
direct allocation
page read and write
48FA000
direct allocation
page read and write
DC3000
heap
page read and write
4B5F000
direct allocation
page read and write
A563000
direct allocation
page read and write
48E5000
direct allocation
page read and write
62E000
stack
page read and write
DBD000
heap
page read and write
48D6000
direct allocation
page read and write
9D9C000
direct allocation
page read and write
2770000
heap
page read and write
1A4AD000
stack
page read and write
19706000
heap
page read and write
AE0000
heap
page read and write
1526E000
stack
page read and write
48FD000
direct allocation
page read and write
9DB6000
direct allocation
page read and write
4B19000
direct allocation
page read and write
6BF25000
unkown
page read and write
2000000
heap
page read and write
DC3000
heap
page read and write
4AE8000
direct allocation
page read and write
49E9000
direct allocation
page read and write
19761000
heap
page read and write
4B0D000
direct allocation
page read and write
DCF000
heap
page read and write
4A94000
direct allocation
page read and write
1E0000
heap
page read and write
E18000
heap
page read and write
1A92E000
stack
page read and write
6C3EB000
unkown
page read and write
4965000
direct allocation
page read and write
2683000
heap
page read and write
277C000
heap
page read and write
1A3C0000
trusted library allocation
page read and write
277A000
heap
page read and write
DAF000
heap
page read and write
1AB08000
direct allocation
page read and write
49B0000
direct allocation
page read and write
9C000
stack
page read and write
494B000
direct allocation
page read and write
2773000
heap
page read and write
401000
unkown
page execute read
165B3000
heap
page read and write
491B000
direct allocation
page read and write
2771000
heap
page read and write
400000
unkown
page readonly
1967E000
stack
page read and write
A7E000
stack
page read and write
A8F1000
direct allocation
page read and write
A7C6000
direct allocation
page read and write
2778000
heap
page read and write
6B6B1000
unkown
page execute read
DBD000
heap
page read and write
DA0000
heap
page read and write
994000
unkown
page write copy
DCE000
heap
page read and write
4A52000
direct allocation
page read and write
4930000
direct allocation
page read and write
19707000
heap
page read and write
14C60000
heap
page read and write
4961000
direct allocation
page read and write
6BF29000
unkown
page readonly
2778000
heap
page read and write
6B71F000
unkown
page readonly
4B0A000
direct allocation
page read and write
277F000
heap
page read and write
49A4000
direct allocation
page read and write
49CC000
direct allocation
page read and write
6B446000
unkown
page read and write
9D66000
direct allocation
page read and write
19A0D000
heap
page read and write
6B6BF000
unkown
page readonly
4A3C000
direct allocation
page read and write
2778000
heap
page read and write
27C6000
heap
page read and write
1974F000
heap
page read and write
497A000
direct allocation
page read and write
998000
unkown
page readonly
1AABE000
stack
page read and write
4A9F000
direct allocation
page read and write
2775000
heap
page read and write
19748000
heap
page read and write
9DAE000
direct allocation
page read and write
4995000
direct allocation
page read and write
14D34000
heap
page read and write
1979B000
heap
page read and write
49E2000
direct allocation
page read and write
9E5F000
direct allocation
page read and write
DC8000
heap
page read and write
277E000
heap
page read and write
1975C000
heap
page read and write
DBA000
heap
page read and write
1552F000
heap
page read and write
196F1000
heap
page read and write
DE1000
heap
page read and write
40C000
unkown
page read and write
2774000
heap
page read and write
6B447000
unkown
page write copy
49EF000
direct allocation
page read and write
6C460000
unkown
page readonly
277F000
heap
page read and write
6F97A000
unkown
page readonly
14C9B000
heap
page read and write
4BDA000
direct allocation
page read and write
2770000
heap
page read and write
2773000
heap
page read and write
DC3000
heap
page read and write
6ADFC000
unkown
page read and write
6C406000
unkown
page read and write
1A3BB000
direct allocation
page read and write
59E000
stack
page read and write
2687000
heap
page read and write
48AC000
direct allocation
page read and write
14A72000
direct allocation
page read and write
A46F000
direct allocation
page read and write
2742000
direct allocation
page execute and read and write
19761000
heap
page read and write
6C082000
unkown
page read and write
DC6000
heap
page read and write
9EE000
stack
page read and write
4A82000
direct allocation
page read and write
4ACC000
direct allocation
page read and write
1985C000
stack
page read and write
DB5000
heap
page read and write
28C0000
heap
page read and write
DCE000
heap
page read and write
412000
unkown
page read and write
6BEC0000
unkown
page readonly
266F000
stack
page read and write
4900000
direct allocation
page read and write
49A2000
direct allocation
page read and write
4899000
direct allocation
page read and write
66D000
heap
page read and write
27EA000
heap
page read and write
D74000
heap
page read and write
DAF000
heap
page read and write
6B409000
unkown
page readonly
277D000
heap
page read and write
4822000
direct allocation
page read and write
48D9000
direct allocation
page read and write
2777000
heap
page read and write
196F1000
heap
page read and write
196F1000
heap
page read and write
4AA1000
direct allocation
page read and write
1659D000
heap
page read and write
277C000
heap
page read and write
1514E000
stack
page read and write
2779000
heap
page read and write
E2A000
heap
page read and write
B50000
heap
page read and write
6E080000
unkown
page readonly
434000
unkown
page read and write
6BF23000
unkown
page read and write
5F1000
heap
page read and write
1A743000
heap
page read and write
49DE000
direct allocation
page read and write
4948000
direct allocation
page read and write
6E081000
unkown
page execute read
48A0000
direct allocation
page read and write
60E000
stack
page read and write
49BE000
direct allocation
page read and write
40A000
unkown
page read and write
4923000
direct allocation
page read and write
DAF000
heap
page read and write
198EC000
stack
page read and write
9DC3000
direct allocation
page read and write
4A45000
direct allocation
page read and write
4BC3000
direct allocation
page read and write
970000
unkown
page readonly
2580000
heap
page read and write
166AC000
heap
page read and write
57C000
stack
page read and write
6B449000
unkown
page write copy
6C41A000
unkown
page read and write
400000
unkown
page readonly
192D0000
direct allocation
page read and write
27A2000
direct allocation
page execute and read and write
4A07000
direct allocation
page read and write
152BF000
unkown
page read and write
DBD000
heap
page read and write
19706000
heap
page read and write
196E6000
heap
page read and write
4903000
direct allocation
page read and write
6BF24000
unkown
page write copy
4AB5000
direct allocation
page read and write
15350000
heap
page read and write
998000
unkown
page readonly
1A711000
heap
page read and write
19A7E000
stack
page read and write
ACE000
stack
page read and write
49F5000
direct allocation
page read and write
48B1000
direct allocation
page read and write
6B470000
unkown
page readonly
4AFA000
direct allocation
page read and write
446000
unkown
page readonly
2778000
heap
page read and write
15542000
heap
page read and write
E1B000
heap
page read and write
2772000
heap
page read and write
2773000
heap
page read and write
49EC000
direct allocation
page read and write
4AA8000
direct allocation
page read and write
400000
unkown
page readonly
2772000
heap
page read and write
48D3000
direct allocation
page read and write
9E06000
direct allocation
page read and write
9E61000
direct allocation
page read and write
48C5000
direct allocation
page read and write
4A2D000
direct allocation
page read and write
9EA8000
direct allocation
page read and write
6C3E9000
unkown
page write copy
DE1000
heap
page read and write
1975A000
heap
page read and write
27C0000
heap
page read and write
2778000
heap
page read and write
DA6000
heap
page read and write
19AA0000
heap
page read and write
DAC000
heap
page read and write
19749000
heap
page read and write
1A3F0000
trusted library allocation
page read and write
DC0000
heap
page read and write
4A89000
direct allocation
page read and write
6C070000
unkown
page readonly
2770000
heap
page read and write
6BF40000
unkown
page readonly
196D3000
heap
page read and write
499F000
direct allocation
page read and write
48DC000
direct allocation
page read and write
4939000
direct allocation
page read and write
401000
unkown
page execute read
6E3D1000
unkown
page execute read
9D81000
direct allocation
page read and write
A0CA000
direct allocation
page read and write
DE1000
heap
page read and write
6ADD0000
unkown
page readonly
6BEA0000
unkown
page readonly
4A4C000
direct allocation
page read and write
4A5F000
direct allocation
page read and write
2220000
heap
page read and write
4A4F000
direct allocation
page read and write
277B000
heap
page read and write
87F000
stack
page read and write
9E1C000
direct allocation
page read and write
DC5000
heap
page read and write
9FFE000
direct allocation
page read and write
19A3E000
heap
page read and write
7EEE5000
trusted library allocation
page execute read
535000
heap
page read and write
4DE5000
direct allocation
page read and write
4DF7000
direct allocation
page read and write
A6AC000
direct allocation
page read and write
4A77000
direct allocation
page read and write
6B701000
unkown
page execute read
4B13000
direct allocation
page read and write
494E000
direct allocation
page read and write
4A58000
direct allocation
page read and write
DBD000
heap
page read and write
DC3000
heap
page read and write
98C000
unkown
page readonly
15355000
heap
page read and write
4AEB000
direct allocation
page read and write
1A6A3000
heap
page read and write
4AB2000
direct allocation
page read and write
6ADE0000
unkown
page readonly
2770000
heap
page read and write
DBA000
heap
page read and write
2779000
heap
page read and write
19744000
heap
page read and write
19AC0000
trusted library allocation
page read and write
446000
unkown
page readonly
409000
unkown
page readonly
AD0000
heap
page read and write
49F9000
direct allocation
page read and write
4B1C000
direct allocation
page read and write
277E000
heap
page read and write
D90000
heap
page read and write
48AF000
direct allocation
page read and write
2779000
heap
page read and write
19748000
heap
page read and write
196FD000
heap
page read and write
6ADD7000
unkown
page readonly
2772000
heap
page read and write
165BC000
heap
page read and write
6F970000
unkown
page readonly
2773000
heap
page read and write
DA0000
heap
page read and write
48E8000
direct allocation
page read and write
196FD000
heap
page read and write
D9B000
heap
page read and write
15564000
heap
page read and write
1A3D0000
trusted library allocation
page read and write
9D5B000
direct allocation
page read and write
4ADE000
direct allocation
page read and write
18FCF000
unkown
page read and write
4B16000
direct allocation
page read and write
1A699000
heap
page read and write
9E16000
direct allocation
page read and write
650000
heap
page read and write
6B6BE000
unkown
page read and write
6F971000
unkown
page execute read
A8DE000
direct allocation
page read and write
277E000
heap
page read and write
153C9000
heap
page read and write
277B000
heap
page read and write
DC3000
heap
page read and write
6F976000
unkown
page readonly
1669C000
heap
page read and write
E1B000
heap
page read and write
6ADD4000
unkown
page readonly
27AD000
heap
page read and write
4AD6000
direct allocation
page read and write
4A97000
direct allocation
page read and write
48CB000
direct allocation
page read and write
4AD9000
direct allocation
page read and write
19751000
heap
page read and write
15555000
heap
page read and write
1974E000
heap
page read and write
2779000
heap
page read and write
4A14000
direct allocation
page read and write
100000
heap
page read and write
6B44A000
unkown
page read and write
4A5B000
direct allocation
page read and write
40A000
unkown
page read and write
D20000
unkown
page read and write
2773000
heap
page read and write
6BEC1000
unkown
page execute read
277B000
heap
page read and write
18FD0000
direct allocation
page read and write
498C000
direct allocation
page read and write
277C000
heap
page read and write
497D000
direct allocation
page read and write
2775000
heap
page read and write
277B000
heap
page read and write
4AB8000
direct allocation
page read and write
196F6000
heap
page read and write
48BB000
direct allocation
page read and write
D00000
heap
page read and write
48C1000
direct allocation
page read and write
4DF1000
direct allocation
page read and write
2778000
heap
page read and write
6C091000
unkown
page execute read
There are 855 hidden memdumps, click here to show them.