Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
nHOMA2CalculatorWindowsSetup.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA Calculator.url
|
MS Windows 95 Internet shortcut text (URL=<http://www.dtu.ox.ac.uk/HOMACalculator>), ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\RBGUIFramework.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\is-42761.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\is-AUQQQ.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\is-PSQK4.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\msvcp100.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\msvcr100.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator.exe (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA2Calculator Validation.xls (copy)
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Diabetes Trials Unit,
Last Saved By: vegregory, Name of Creating Application: Microsoft Macintosh Excel, Last Printed: Tue Oct 1 12:08:56 2013,
Create Time/Date: Wed May 14 10:30:17 2003, Last Saved Time/Date: Tue Dec 17 11:43:01 2013, Security: 0
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA2Calculator.xls (copy)
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Diabetes Trials Unit,
Last Saved By: vegregory, Name of Creating Application: Microsoft Macintosh Excel, Last Printed: Thu Jun 3 10:15:20 2004,
Create Time/Date: Wed May 14 10:30:17 2003, Last Saved Time/Date: Tue Dec 17 11:43:14 2013, Security: 0
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\is-47NV3.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\is-N1UTF.tmp
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Diabetes Trials Unit,
Last Saved By: vegregory, Name of Creating Application: Microsoft Macintosh Excel, Last Printed: Thu Jun 3 10:15:20 2004,
Create Time/Date: Wed May 14 10:30:17 2003, Last Saved Time/Date: Tue Dec 17 11:43:14 2013, Security: 0
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\is-TOAGV.tmp
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Diabetes Trials Unit,
Last Saved By: vegregory, Name of Creating Application: Microsoft Macintosh Excel, Last Printed: Tue Oct 1 12:08:56 2013,
Create Time/Date: Wed May 14 10:30:17 2003, Last Saved Time/Date: Tue Dec 17 11:43:01 2013, Security: 0
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\is-VCAJS.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\unins000.dat
|
InnoSetup Log 64-bit HOMA Calculator, version 0x418, 8059 bytes, 562258\37\user\, C:\Program Files\HOMA Calculator v2.2.3\37
|
dropped
|
||
C:\Program Files\HOMA Calculator v2.2.3\unins000.exe (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator on the Web.lnk
|
MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun
Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator v2.2.3 (Excel).lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive,
ctime=Sun Oct 20 18:02:21 2024, mtime=Sun Oct 20 18:02:21 2024, atime=Tue Dec 17 14:43:14 2013, length=69120, window=hide
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator v2.2.3 Validation (Excel).lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive,
ctime=Sun Oct 20 18:02:21 2024, mtime=Sun Oct 20 18:02:21 2024, atime=Tue Dec 17 14:43:00 2013, length=484352, window=hide
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator v2.2.3.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive,
ctime=Sun Oct 20 18:02:21 2024, mtime=Sun Oct 20 18:02:21 2024, atime=Thu Dec 5 13:28:42 2013, length=2451091, window=hide
|
dropped
|
||
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\Uninstall HOMA Calculator.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive,
ctime=Sun Oct 20 18:02:20 2024, mtime=Sun Oct 20 18:02:20 2024, atime=Sun Oct 20 18:02:01 2024, length=1481417, window=hide
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\is-0M8BV.tmp\_isetup\_setup64.tmp
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\is-0M8BV.tmp\_isetup\_shfoldr.dll
|
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Windows\SysWOW64\HOMACore.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
C:\Windows\SysWOW64\is-JO0HR.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
There are 17 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\nHOMA2CalculatorWindowsSetup.exe
|
"C:\Users\user\Desktop\nHOMA2CalculatorWindowsSetup.exe"
|
||
C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp
|
"C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp" /SL5="$203BC,1934643,407552,C:\Users\user\Desktop\nHOMA2CalculatorWindowsSetup.exe"
|
||
C:\Windows\SysWOW64\regsvr32.exe
|
"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\HOMACore.dll"
|
||
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator.exe
|
"C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator.exe"
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
http://www.innosetup.com/
|
unknown
|
||
http://www.dtu.ox.ac.uk/homa#
|
unknown
|
||
http://www.dtu.ox.ac.uk/HOMACalculatorLhttp://www.dtu.ox.ac.uk/HOMACalculatorLhttp://www.dtu.ox.ac.u
|
unknown
|
||
http://www.dtu.ox.ac.uk/homa
|
unknown
|
||
http://www.dtu.ox.ac.uk/homa#email:
|
unknown
|
||
http://www.remobjects.com/ps
|
unknown
|
||
http://www.dtu.ox.ac.uk/HOMACalculator
|
unknown
|
||
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
|
unknown
|
||
http://www.dtu.ox.ac.uk/HOMACalculatorA
|
unknown
|
||
http://www.dtu.ox.ac.uk/homaTextAlign
|
unknown
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Owner
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
SessionHash
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Sequence
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
RegFiles0000
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
RegFilesHash
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
|
C:\Windows\system32\HOMACore.dll
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Setup Version
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: App Path
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
InstallLocation
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Icon Group
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: User
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Setup Type
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Selected Components
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Deselected Components
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Selected Tasks
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Deselected Tasks
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Language
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
DisplayName
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
UninstallString
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
QuietUninstallString
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Publisher
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
URLInfoAbout
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
HelpLink
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
URLUpdateInfo
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
NoModify
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
NoRepair
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
InstallDate
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
EstimatedSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HOMACore.HOMA.2
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HOMACore.HOMA.2\CLSID
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HOMACore.HOMA
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HOMACore.HOMA\CLSID
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HOMACore.HOMA\CurVer
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}\ProgID
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}\VersionIndependentProgID
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}\InprocServer32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}\InprocServer32
|
ThreadingModel
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D071355-A55A-422E-B1E8-3C5069F12E41}\2.1
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D071355-A55A-422E-B1E8-3C5069F12E41}\2.1\FLAGS
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D071355-A55A-422E-B1E8-3C5069F12E41}\2.1\0\win32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D071355-A55A-422E-B1E8-3C5069F12E41}\2.1\HELPDIR
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\TypeLib
|
Version
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\ProxyStubClsid32
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\TypeLib
|
NULL
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\TypeLib
|
Version
|
There are 41 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
23AD000
|
direct allocation
|
page read and write
|
||
626F000
|
direct allocation
|
page read and write
|
||
6CACC000
|
unkown
|
page read and write
|
||
470000
|
heap
|
page read and write
|
||
E70000
|
heap
|
page read and write
|
||
2780000
|
heap
|
page read and write
|
||
20DE000
|
stack
|
page read and write
|
||
43A0000
|
heap
|
page read and write
|
||
23D2000
|
direct allocation
|
page read and write
|
||
2646000
|
direct allocation
|
page read and write
|
||
770000
|
heap
|
page read and write
|
||
6FD01000
|
unkown
|
page execute read
|
||
3511000
|
heap
|
page read and write
|
||
710000
|
heap
|
page read and write
|
||
692000
|
heap
|
page read and write
|
||
6A6000
|
stack
|
page read and write
|
||
54E000
|
stack
|
page read and write
|
||
511000
|
unkown
|
page readonly
|
||
377E000
|
stack
|
page read and write
|
||
88E000
|
stack
|
page read and write
|
||
22B9000
|
direct allocation
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
365E000
|
stack
|
page read and write
|
||
334E000
|
direct allocation
|
page read and write
|
||
2404000
|
direct allocation
|
page read and write
|
||
231F000
|
direct allocation
|
page read and write
|
||
5C6000
|
heap
|
page read and write
|
||
5DA000
|
heap
|
page read and write
|
||
23E0000
|
direct allocation
|
page read and write
|
||
7FE32000
|
direct allocation
|
page read and write
|
||
22F2000
|
direct allocation
|
page read and write
|
||
23D9000
|
direct allocation
|
page read and write
|
||
F05000
|
heap
|
page read and write
|
||
5A10000
|
heap
|
page read and write
|
||
697000
|
heap
|
page read and write
|
||
7FE36000
|
direct allocation
|
page read and write
|
||
3411000
|
heap
|
page read and write
|
||
65A000
|
heap
|
page read and write
|
||
43C0000
|
heap
|
page read and write
|
||
3358000
|
direct allocation
|
page read and write
|
||
419000
|
unkown
|
page write copy
|
||
68D000
|
heap
|
page read and write
|
||
23EF000
|
direct allocation
|
page read and write
|
||
2342000
|
direct allocation
|
page read and write
|
||
FC6000
|
unkown
|
page readonly
|
||
23A2000
|
direct allocation
|
page read and write
|
||
2393000
|
direct allocation
|
page read and write
|
||
A60000
|
heap
|
page read and write
|
||
2710000
|
heap
|
page read and write
|
||
6CAD3000
|
unkown
|
page read and write
|
||
22CE000
|
direct allocation
|
page read and write
|
||
630000
|
heap
|
page read and write
|
||
6A8000
|
heap
|
page read and write
|
||
FC1000
|
unkown
|
page execute read
|
||
3336000
|
direct allocation
|
page read and write
|
||
720000
|
heap
|
page read and write
|
||
237D000
|
direct allocation
|
page read and write
|
||
AD8000
|
heap
|
page read and write
|
||
22F0000
|
direct allocation
|
page read and write
|
||
6A0000
|
heap
|
page read and write
|
||
23BC000
|
direct allocation
|
page read and write
|
||
8FA000
|
stack
|
page read and write
|
||
2440000
|
direct allocation
|
page execute and read and write
|
||
FC0000
|
unkown
|
page readonly
|
||
295E000
|
heap
|
page read and write
|
||
23A1000
|
direct allocation
|
page read and write
|
||
2308000
|
direct allocation
|
page read and write
|
||
2348000
|
direct allocation
|
page read and write
|
||
699000
|
heap
|
page read and write
|
||
6C870000
|
unkown
|
page readonly
|
||
AB8000
|
heap
|
page read and write
|
||
23E8000
|
direct allocation
|
page read and write
|
||
2B4A000
|
heap
|
page read and write
|
||
FCB000
|
unkown
|
page readonly
|
||
31F0000
|
direct allocation
|
page read and write
|
||
66B000
|
stack
|
page read and write
|
||
22E4000
|
direct allocation
|
page read and write
|
||
379E000
|
stack
|
page read and write
|
||
651000
|
heap
|
page read and write
|
||
295E000
|
heap
|
page read and write
|
||
5C7000
|
heap
|
page read and write
|
||
3447000
|
heap
|
page read and write
|
||
2428000
|
direct allocation
|
page read and write
|
||
681000
|
heap
|
page read and write
|
||
AC8000
|
heap
|
page read and write
|
||
6C925000
|
unkown
|
page write copy
|
||
504000
|
unkown
|
page read and write
|
||
466000
|
unkown
|
page readonly
|
||
3510000
|
heap
|
page read and write
|
||
2334000
|
direct allocation
|
page read and write
|
||
93000
|
stack
|
page read and write
|
||
6454000
|
direct allocation
|
page read and write
|
||
563000
|
unkown
|
page readonly
|
||
308E000
|
stack
|
page read and write
|
||
2351000
|
direct allocation
|
page read and write
|
||
480000
|
heap
|
page read and write
|
||
236F000
|
direct allocation
|
page read and write
|
||
332E000
|
direct allocation
|
page read and write
|
||
89F000
|
stack
|
page read and write
|
||
3345000
|
direct allocation
|
page read and write
|
||
295E000
|
heap
|
page read and write
|
||
22F9000
|
direct allocation
|
page read and write
|
||
686000
|
heap
|
page read and write
|
||
239B000
|
direct allocation
|
page read and write
|
||
2CD0000
|
direct allocation
|
page execute and read and write
|
||
A10000
|
heap
|
page read and write
|
||
ABC000
|
heap
|
page read and write
|
||
2376000
|
direct allocation
|
page read and write
|
||
AA8000
|
heap
|
page read and write
|
||
2393000
|
direct allocation
|
page read and write
|
||
6FD5E000
|
unkown
|
page read and write
|
||
6A9000
|
heap
|
page read and write
|
||
677000
|
heap
|
page read and write
|
||
5B5000
|
stack
|
page read and write
|
||
23FD000
|
direct allocation
|
page read and write
|
||
2770000
|
heap
|
page read and write
|
||
6CAD8000
|
unkown
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
99F000
|
stack
|
page read and write
|
||
2B40000
|
heap
|
page read and write
|
||
6FD00000
|
unkown
|
page readonly
|
||
6CA8A000
|
unkown
|
page readonly
|
||
46A000
|
unkown
|
page readonly
|
||
238C000
|
direct allocation
|
page read and write
|
||
330E000
|
stack
|
page read and write
|
||
2325000
|
direct allocation
|
page read and write
|
||
23A8000
|
direct allocation
|
page read and write
|
||
A6E000
|
heap
|
page read and write
|
||
237D000
|
direct allocation
|
page read and write
|
||
FC9000
|
unkown
|
page read and write
|
||
24C0000
|
heap
|
page read and write
|
||
50B000
|
unkown
|
page write copy
|
||
5F00000
|
direct allocation
|
page read and write
|
||
6CADC000
|
unkown
|
page readonly
|
||
18D000
|
stack
|
page read and write
|
||
330E000
|
direct allocation
|
page read and write
|
||
FC6000
|
unkown
|
page readonly
|
||
3447000
|
heap
|
page read and write
|
||
19C000
|
stack
|
page read and write
|
||
A00000
|
heap
|
page read and write
|
||
3850000
|
unkown
|
page read and write
|
||
2413000
|
direct allocation
|
page read and write
|
||
ABC000
|
heap
|
page read and write
|
||
AB3000
|
heap
|
page read and write
|
||
6C923000
|
unkown
|
page read and write
|
||
F00000
|
heap
|
page read and write
|
||
31E0000
|
direct allocation
|
page read and write
|
||
412000
|
unkown
|
page write copy
|
||
232D000
|
direct allocation
|
page read and write
|
||
63E000
|
heap
|
page read and write
|
||
400000
|
unkown
|
page readonly
|
||
417000
|
unkown
|
page read and write
|
||
367E000
|
stack
|
page read and write
|
||
679000
|
heap
|
page read and write
|
||
389F000
|
stack
|
page read and write
|
||
2349000
|
direct allocation
|
page read and write
|
||
6FD62000
|
unkown
|
page readonly
|
||
FC9000
|
unkown
|
page write copy
|
||
5D0000
|
heap
|
page read and write
|
||
2360000
|
direct allocation
|
page read and write
|
||
674000
|
heap
|
page read and write
|
||
6156000
|
direct allocation
|
page read and write
|
||
6C931000
|
unkown
|
page execute read
|
||
500000
|
unkown
|
page read and write
|
||
22C0000
|
direct allocation
|
page read and write
|
||
22DC000
|
direct allocation
|
page read and write
|
||
2421000
|
direct allocation
|
page read and write
|
||
230F000
|
direct allocation
|
page read and write
|
||
670000
|
heap
|
page read and write
|
||
2430000
|
heap
|
page read and write
|
||
2300000
|
direct allocation
|
page read and write
|
||
3520000
|
heap
|
page read and write
|
||
2359000
|
direct allocation
|
page read and write
|
||
29E0000
|
trusted library allocation
|
page read and write
|
||
232D000
|
direct allocation
|
page read and write
|
||
697000
|
heap
|
page read and write
|
||
276E000
|
stack
|
page read and write
|
||
353D000
|
stack
|
page read and write
|
||
2384000
|
direct allocation
|
page read and write
|
||
22D5000
|
direct allocation
|
page read and write
|
||
665000
|
heap
|
page read and write
|
||
FC0000
|
unkown
|
page readonly
|
||
9B000
|
stack
|
page read and write
|
||
2553000
|
heap
|
page read and write
|
||
663000
|
heap
|
page read and write
|
||
3410000
|
heap
|
page read and write
|
||
68B000
|
heap
|
page read and write
|
||
A6A000
|
heap
|
page read and write
|
||
2317000
|
direct allocation
|
page read and write
|
||
241A000
|
direct allocation
|
page read and write
|
||
240C000
|
direct allocation
|
page read and write
|
||
68B000
|
heap
|
page read and write
|
||
2984000
|
heap
|
page read and write
|
||
2316000
|
direct allocation
|
page read and write
|
||
67F000
|
heap
|
page read and write
|
||
4C40000
|
trusted library allocation
|
page read and write
|
||
363E000
|
stack
|
page read and write
|
||
5C0000
|
heap
|
page read and write
|
||
24F0000
|
direct allocation
|
page read and write
|
||
3610000
|
direct allocation
|
page read and write
|
||
2300000
|
direct allocation
|
page read and write
|
||
23F6000
|
direct allocation
|
page read and write
|
||
66D000
|
heap
|
page read and write
|
||
FC1000
|
unkown
|
page execute read
|
||
2550000
|
heap
|
page read and write
|
||
50B000
|
unkown
|
page read and write
|
||
2360000
|
direct allocation
|
page read and write
|
||
643C000
|
direct allocation
|
page read and write
|
||
3360000
|
direct allocation
|
page read and write
|
||
654000
|
heap
|
page read and write
|
||
320E000
|
stack
|
page read and write
|
||
412000
|
unkown
|
page read and write
|
||
8FF000
|
stack
|
page read and write
|
||
2326000
|
direct allocation
|
page read and write
|
||
2334000
|
direct allocation
|
page read and write
|
||
66C000
|
heap
|
page read and write
|
||
239A000
|
direct allocation
|
page read and write
|
||
6C930000
|
unkown
|
page readonly
|
||
6A2000
|
heap
|
page read and write
|
||
22EB000
|
direct allocation
|
page read and write
|
||
69B000
|
heap
|
page read and write
|
||
34D0000
|
heap
|
page read and write
|
||
60E000
|
stack
|
page read and write
|
||
670000
|
heap
|
page read and write
|
||
AE0000
|
heap
|
page read and write
|
||
2980000
|
heap
|
page read and write
|
||
31E0000
|
heap
|
page read and write
|
||
23CB000
|
direct allocation
|
page read and write
|
||
95F000
|
stack
|
page read and write
|
||
2880000
|
heap
|
page read and write
|
||
22E9000
|
heap
|
page read and write
|
||
233B000
|
direct allocation
|
page read and write
|
||
500000
|
heap
|
page read and write
|
||
22C7000
|
direct allocation
|
page read and write
|
||
5C7000
|
heap
|
page read and write
|
||
8CF000
|
stack
|
page read and write
|
||
22A0000
|
direct allocation
|
page read and write
|
||
6C928000
|
unkown
|
page readonly
|
||
694000
|
heap
|
page read and write
|
||
333D000
|
direct allocation
|
page read and write
|
||
23B5000
|
direct allocation
|
page read and write
|
||
271B000
|
heap
|
page read and write
|
||
2308000
|
direct allocation
|
page read and write
|
||
2351000
|
direct allocation
|
page read and write
|
||
FCB000
|
unkown
|
page readonly
|
||
90E000
|
stack
|
page read and write
|
||
7FCE0000
|
direct allocation
|
page read and write
|
||
2376000
|
direct allocation
|
page read and write
|
||
31F0000
|
direct allocation
|
page read and write
|
||
236F000
|
direct allocation
|
page read and write
|
||
641C000
|
direct allocation
|
page read and write
|
||
22E0000
|
heap
|
page read and write
|
||
2368000
|
direct allocation
|
page read and write
|
||
668000
|
heap
|
page read and write
|
||
65E000
|
heap
|
page read and write
|
||
375F000
|
stack
|
page read and write
|
||
699000
|
heap
|
page read and write
|
||
22E5000
|
heap
|
page read and write
|
||
21DF000
|
stack
|
page read and write
|
||
6C871000
|
unkown
|
page execute read
|
||
580000
|
heap
|
page read and write
|
||
684000
|
heap
|
page read and write
|
||
AC0000
|
heap
|
page read and write
|
||
4CE000
|
stack
|
page read and write
|
||
31E0000
|
direct allocation
|
page read and write
|
||
2341000
|
direct allocation
|
page read and write
|
||
920000
|
heap
|
page read and write
|
||
590000
|
heap
|
page read and write
|
||
3338000
|
direct allocation
|
page read and write
|
||
AC6000
|
heap
|
page read and write
|
||
401000
|
unkown
|
page execute read
|
||
AC3000
|
heap
|
page read and write
|
||
2359000
|
direct allocation
|
page read and write
|
||
41C000
|
unkown
|
page readonly
|
||
500000
|
unkown
|
page write copy
|
||
28D8000
|
heap
|
page read and write
|
||
910000
|
heap
|
page read and write
|
||
2715000
|
heap
|
page read and write
|
||
6AB000
|
heap
|
page read and write
|
||
AC2000
|
heap
|
page read and write
|
||
24F0000
|
direct allocation
|
page read and write
|
||
AA0000
|
heap
|
page read and write
|
||
264A000
|
direct allocation
|
page read and write
|
||
5DE000
|
heap
|
page read and write
|
||
508000
|
unkown
|
page read and write
|
There are 275 hidden memdumps, click here to show them.