Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SecuriteInfo.com.W32.Kryptik.LKE.gen.Eldorado.17641.17677.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\soft[1]
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\dll[1]
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\WwsefYvRAzYZN1v3frKwFA1wF8\Bunifu_UI_v1.5.3.dll
|
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\WwsefYvRAzYZN1v3frKwFA1wF8\Y-Cleaner.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_3b1ee01e6e6a552eb3f6b99786c786b0c8ec181_3aafbe1c_31263007-c9a4-4dd8-88fe-277adad8ad29\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_3b1ee01e6e6a552eb3f6b99786c786b0c8ec181_3aafbe1c_33a9eb5f-865c-4920-a1d4-504381002f3d\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_3b1ee01e6e6a552eb3f6b99786c786b0c8ec181_3aafbe1c_6235f1a8-eaa3-4c7a-a937-e0178dcf0a3f\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_3b1ee01e6e6a552eb3f6b99786c786b0c8ec181_3aafbe1c_72469813-e283-4fce-8b45-4d1ed0110b0e\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_3b1ee01e6e6a552eb3f6b99786c786b0c8ec181_3aafbe1c_e399e4df-df4b-402c-8d04-d827c46b0fdd\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_3b1ee01e6e6a552eb3f6b99786c786b0c8ec181_3aafbe1c_fd57a539-133a-4b4b-9e3d-23c4fb226572\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_4ae234de8f939132ac9416fcbaba6e3171b928a6_3aafbe1c_c0102fc4-fda2-4d08-8dc1-b11d28054b30\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_a455d2dc16ddc59dc025e53de7238c64ae79f0e5_3aafbe1c_c0fb8f11-2a05-4d8e-aa9e-c3816a9fa8f8\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_da60af89a9fee28cf7d277ee3641e37315f7f8e_3aafbe1c_00c911f6-5e77-4bda-a691-ffd6c73862b1\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER66C9.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 8 08:08:03 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6776.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6796.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6969.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 8 08:08:04 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER69C8.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A27.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C19.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 8 08:08:05 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C87.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CD6.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER70BC.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 8 08:08:06 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER712A.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER715A.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER730E.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 8 08:08:07 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER737C.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER73CB.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER75CD.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 8 08:08:07 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER767A.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER76B9.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WER76E.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 8 08:08:45 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB09.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB49.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC09C.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 8 08:09:32 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC2B1.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC30F.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD69.tmp.dmp
|
Mini DuMP crash report, 14 streams, Tue Oct 8 08:08:46 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD8.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF8.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\download[1].htm
|
very short file (no magic)
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\name[1].htm
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\key[1].htm
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\fuckingdllENCR[1].dll
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\add[1].htm
|
very short file (no magic)
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\download[1].htm
|
very short file (no magic)
|
dropped
|
||
|
C:\Users\user\Desktop\Cleaner.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon
number=0, Archive, ctime=Tue Oct 8 07:08:44 2024, mtime=Tue Oct 8 07:08:44 2024, atime=Tue Oct 8 07:08:44 2024, length=1502720,
window=hide
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
There are 39 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\SecuriteInfo.com.W32.Kryptik.LKE.gen.Eldorado.17641.17677.exe
|
"C:\Users\user\Desktop\SecuriteInfo.com.W32.Kryptik.LKE.gen.Eldorado.17641.17677.exe"
|
|
|
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 740
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 748
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 776
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 788
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 924
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1016
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1284
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1508
|
||
|
C:\Windows\SysWOW64\WerFault.exe
|
C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 1540
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://80.66.75.114/files/downloadw
|
unknown
|
||
|
http://80.66.75.114/soft/download9
|
unknown
|
||
|
http://80.66.75.114/files/downloadu
|
unknown
|
||
|
http://80.66.75.114/dll/key
|
80.66.75.114
|
||
|
http://80.66.75.114/files/download3
|
unknown
|
||
|
http://80.66.75.114/dll/downloadxA
|
unknown
|
||
|
http://80.66.75.114/files/download?
|
unknown
|
||
|
http://80.66.75.114/files/download
|
80.66.75.114
|
||
|
http://80.66.75.114/files/download4/files/download
|
unknown
|
||
|
http://80.66.75.114/files/download9
|
unknown
|
||
|
http://80.66.75.114/namem7n
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
http://80.66.75.114/files/downloadZv
|
unknown
|
||
|
http://80.66.75.114/soft/downloadE
|
unknown
|
||
|
http://80.66.75.114/soft/download
|
80.66.75.114
|
||
|
http://80.66.75.114/name
|
80.66.75.114
|
||
|
http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
|
unknown
|
||
|
http://80.66.75.114/files/download4/files/downloadE
|
unknown
|
||
|
http://80.66.75.114/nameQ?
|
unknown
|
||
|
http://80.66.75.114/files/downloadLMEM
|
unknown
|
||
|
http://80.66.75.114/name=7
|
unknown
|
||
|
http://80.66.75.114/files/downloadQ
|
unknown
|
||
|
http://80.66.75.114/files/download4/files/downloadu
|
unknown
|
||
|
http://80.66.75.114/soft/downloadQ
|
unknown
|
||
|
http://80.66.75.114/dll/download
|
80.66.75.114
|
||
|
https://g-cleanit.hk
|
unknown
|
||
|
http://80.66.75.114/name-6.
|
unknown
|
||
|
http://80.66.75.114/files/downloadE
|
unknown
|
||
|
http://80.66.75.114/files/downloadA
|
unknown
|
||
|
http://80.66.75.114/dll/keym7n
|
unknown
|
||
|
http://80.66.75.114/soft/download14/soft/download
|
unknown
|
||
|
http://80.66.75.114/add?substr=mixnine&s=three&sub=NOSUB
|
80.66.75.114
|
||
|
http://80.66.75.114/add?substr=mixnine&s=three&sub=NOSUBK
|
unknown
|
||
|
http://80.66.75.114/files/downloadData
|
unknown
|
||
|
https://iplogger.org/1Pz8p7
|
unknown
|
||
|
http://80.66.75.114/files/downloadtem32
|
unknown
|
There are 26 hidden URLs, click here to show them.
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
80.66.75.114
|
unknown
|
Russian Federation
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
ProgramId
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
FileId
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
LongPathHash
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
Name
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
OriginalFileName
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
Publisher
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
Version
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
BinFileVersion
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
BinaryType
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
ProductName
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
ProductVersion
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
LinkDate
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
BinProductVersion
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
Size
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
Language
|
||
|
\REGISTRY\A\{2ab7939c-852b-5b99-fb83-b89fae790c56}\Root\InventoryApplicationFile\securiteinfo.com|11c77df8dfc5ad99
|
Usn
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
ClockTimeSeconds
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
|
TickCount
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
|
00180011E1F855A0
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceTicket
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
|
DeviceId
|
There are 14 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2F9F000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
2DE5000
|
heap
|
page read and write
|
||
|
2E19000
|
heap
|
page read and write
|
||
|
3061000
|
heap
|
page read and write
|
||
|
352F000
|
heap
|
page read and write
|
||
|
2A8E000
|
stack
|
page read and write
|
||
|
790000
|
heap
|
page read and write
|
||
|
35C9000
|
heap
|
page read and write
|
||
|
3465000
|
heap
|
page read and write
|
||
|
851000
|
heap
|
page read and write
|
||
|
640000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
1001A000
|
direct allocation
|
page read and write
|
||
|
36C3000
|
heap
|
page read and write
|
||
|
2DC6000
|
heap
|
page read and write
|
||
|
3608000
|
heap
|
page read and write
|
||
|
2ACD000
|
stack
|
page read and write
|
||
|
10011000
|
direct allocation
|
page readonly
|
||
|
2D30000
|
heap
|
page read and write
|
||
|
78F000
|
stack
|
page read and write
|
||
|
10001000
|
direct allocation
|
page execute read
|
||
|
10000000
|
direct allocation
|
page read and write
|
||
|
2F0B000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
7CD000
|
heap
|
page read and write
|
||
|
2E60000
|
heap
|
page read and write
|
||
|
3460000
|
heap
|
page read and write
|
||
|
883000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
2E19000
|
heap
|
page read and write
|
||
|
284E000
|
stack
|
page read and write
|
||
|
2F9E000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
68E000
|
stack
|
page read and write
|
||
|
236D000
|
stack
|
page read and write
|
||
|
3061000
|
heap
|
page read and write
|
||
|
35BC000
|
heap
|
page read and write
|
||
|
359B000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
2E19000
|
heap
|
page read and write
|
||
|
3060000
|
heap
|
page read and write
|
||
|
2DC3000
|
heap
|
page read and write
|
||
|
3462000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
357D000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
3530000
|
heap
|
page read and write
|
||
|
364D000
|
heap
|
page read and write
|
||
|
2DED000
|
heap
|
page read and write
|
||
|
35BA000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
35B2000
|
heap
|
page read and write
|
||
|
35CB000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
2E19000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
2DE5000
|
heap
|
page read and write
|
||
|
42D000
|
unkown
|
page write copy
|
||
|
371B000
|
heap
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
35EC000
|
heap
|
page read and write
|
||
|
2D2E000
|
stack
|
page read and write
|
||
|
2E9D000
|
heap
|
page read and write
|
||
|
2F0B000
|
heap
|
page read and write
|
||
|
43A000
|
unkown
|
page execute and read and write
|
||
|
3463000
|
heap
|
page read and write
|
||
|
232E000
|
stack
|
page read and write
|
||
|
3468000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
2E19000
|
heap
|
page read and write
|
||
|
2F0B000
|
heap
|
page read and write
|
||
|
346F000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
2EDA000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
2FF8000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
7AA000
|
heap
|
page execute and read and write
|
||
|
883000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
373E000
|
heap
|
page read and write
|
||
|
2E19000
|
heap
|
page read and write
|
||
|
2EDA000
|
heap
|
page read and write
|
||
|
2EDA000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
3566000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page execute and read and write
|
||
|
883000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
3550000
|
heap
|
page read and write
|
||
|
346B000
|
heap
|
page read and write
|
||
|
79E000
|
heap
|
page read and write
|
||
|
35CA000
|
heap
|
page read and write
|
||
|
79A000
|
heap
|
page read and write
|
||
|
3460000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
3746000
|
heap
|
page read and write
|
||
|
883000
|
heap
|
page read and write
|
||
|
2400000
|
heap
|
page read and write
|
||
|
884000
|
heap
|
page read and write
|
||
|
3463000
|
heap
|
page read and write
|
||
|
23D0000
|
heap
|
page read and write
|
||
|
23AD000
|
stack
|
page read and write
|
||
|
3748000
|
heap
|
page read and write
|
||
|
3501000
|
heap
|
page read and write
|
||
|
36E2000
|
heap
|
page read and write
|
||
|
883000
|
heap
|
page read and write
|
||
|
2EDA000
|
heap
|
page read and write
|
||
|
2F9F000
|
heap
|
page read and write
|
||
|
3596000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
2E19000
|
heap
|
page read and write
|
||
|
9CF000
|
stack
|
page read and write
|
||
|
199000
|
stack
|
page read and write
|
||
|
2E19000
|
heap
|
page read and write
|
||
|
2F9E000
|
heap
|
page read and write
|
||
|
386D000
|
heap
|
page read and write
|
||
|
366B000
|
heap
|
page read and write
|
||
|
50B000
|
unkown
|
page readonly
|
||
|
3469000
|
heap
|
page read and write
|
||
|
2DCC000
|
heap
|
page read and write
|
||
|
2E19000
|
heap
|
page read and write
|
||
|
294E000
|
stack
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
3690000
|
heap
|
page read and write
|
||
|
298D000
|
stack
|
page read and write
|
||
|
2F0B000
|
heap
|
page read and write
|
||
|
600000
|
heap
|
page read and write
|
||
|
2C2D000
|
stack
|
page read and write
|
||
|
34FB000
|
heap
|
page read and write
|
||
|
2220000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
883000
|
heap
|
page read and write
|
||
|
2DC3000
|
heap
|
page read and write
|
||
|
346C000
|
heap
|
page read and write
|
||
|
2D36000
|
heap
|
page read and write
|
||
|
2DFA000
|
heap
|
page read and write
|
||
|
35BA000
|
heap
|
page read and write
|
||
|
2E19000
|
heap
|
page read and write
|
||
|
3696000
|
heap
|
page read and write
|
||
|
2DC3000
|
heap
|
page read and write
|
||
|
2D47000
|
heap
|
page read and write
|
||
|
2F0B000
|
heap
|
page read and write
|
||
|
2F9E000
|
heap
|
page read and write
|
||
|
883000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
21B0000
|
direct allocation
|
page read and write
|
||
|
10018000
|
direct allocation
|
page read and write
|
||
|
35C1000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
35FD000
|
heap
|
page read and write
|
||
|
42B000
|
unkown
|
page readonly
|
||
|
2FE2000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
2E9C000
|
heap
|
page read and write
|
||
|
851000
|
heap
|
page read and write
|
||
|
87D000
|
heap
|
page read and write
|
||
|
2170000
|
direct allocation
|
page execute and read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
50B000
|
unkown
|
page readonly
|
||
|
883000
|
heap
|
page read and write
|
||
|
883000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
2F9D000
|
heap
|
page read and write
|
||
|
346A000
|
heap
|
page read and write
|
||
|
2E18000
|
heap
|
page read and write
|
||
|
87D000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2E61000
|
heap
|
page read and write
|
||
|
300F000
|
heap
|
page read and write
|
||
|
2BCB000
|
stack
|
page read and write
|
||
|
8CE000
|
stack
|
page read and write
|
||
|
35A2000
|
heap
|
page read and write
|
||
|
2F9F000
|
heap
|
page read and write
|
||
|
35A7000
|
heap
|
page read and write
|
||
|
883000
|
heap
|
page read and write
|
||
|
221D000
|
stack
|
page read and write
|
||
|
3061000
|
heap
|
page read and write
|
||
|
2EDA000
|
heap
|
page read and write
|
||
|
883000
|
heap
|
page read and write
|
There are 182 hidden memdumps, click here to show them.