Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
nHOMA2CalculatorWindowsSetup.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA Calculator.url
|
MS Windows 95 Internet shortcut text (URL=<http://www.dtu.ox.ac.uk/HOMACalculator>), ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\RBGUIFramework.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\is-42761.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\is-AUQQQ.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\is-PSQK4.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\msvcp100.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator Libs\msvcr100.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator.exe (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA2Calculator Validation.xls (copy)
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Diabetes Trials Unit,
Last Saved By: vegregory, Name of Creating Application: Microsoft Macintosh Excel, Last Printed: Tue Oct 1 12:08:56 2013,
Create Time/Date: Wed May 14 10:30:17 2003, Last Saved Time/Date: Tue Dec 17 11:43:01 2013, Security: 0
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA2Calculator.xls (copy)
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Diabetes Trials Unit,
Last Saved By: vegregory, Name of Creating Application: Microsoft Macintosh Excel, Last Printed: Thu Jun 3 10:15:20 2004,
Create Time/Date: Wed May 14 10:30:17 2003, Last Saved Time/Date: Tue Dec 17 11:43:14 2013, Security: 0
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\is-47NV3.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\is-N1UTF.tmp
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Diabetes Trials Unit,
Last Saved By: vegregory, Name of Creating Application: Microsoft Macintosh Excel, Last Printed: Thu Jun 3 10:15:20 2004,
Create Time/Date: Wed May 14 10:30:17 2003, Last Saved Time/Date: Tue Dec 17 11:43:14 2013, Security: 0
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\is-TOAGV.tmp
|
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Diabetes Trials Unit,
Last Saved By: vegregory, Name of Creating Application: Microsoft Macintosh Excel, Last Printed: Tue Oct 1 12:08:56 2013,
Create Time/Date: Wed May 14 10:30:17 2003, Last Saved Time/Date: Tue Dec 17 11:43:01 2013, Security: 0
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\is-VCAJS.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\unins000.dat
|
InnoSetup Log 64-bit HOMA Calculator, version 0x418, 8059 bytes, 562258\37\user\, C:\Program Files\HOMA Calculator v2.2.3\37
|
dropped
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\unins000.exe (copy)
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator on the Web.lnk
|
MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun
Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator v2.2.3 (Excel).lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive,
ctime=Sun Oct 20 18:02:21 2024, mtime=Sun Oct 20 18:02:21 2024, atime=Tue Dec 17 14:43:14 2013, length=69120, window=hide
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator v2.2.3 Validation (Excel).lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive,
ctime=Sun Oct 20 18:02:21 2024, mtime=Sun Oct 20 18:02:21 2024, atime=Tue Dec 17 14:43:00 2013, length=484352, window=hide
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\HOMA Calculator v2.2.3.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive,
ctime=Sun Oct 20 18:02:21 2024, mtime=Sun Oct 20 18:02:21 2024, atime=Thu Dec 5 13:28:42 2013, length=2451091, window=hide
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOMA Calculator v2.2.3\Uninstall HOMA Calculator.lnk
|
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive,
ctime=Sun Oct 20 18:02:20 2024, mtime=Sun Oct 20 18:02:20 2024, atime=Sun Oct 20 18:02:01 2024, length=1481417, window=hide
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-0M8BV.tmp\_isetup\_setup64.tmp
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-0M8BV.tmp\_isetup\_shfoldr.dll
|
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\SysWOW64\HOMACore.dll (copy)
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Windows\SysWOW64\is-JO0HR.tmp
|
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
dropped
|
There are 17 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\nHOMA2CalculatorWindowsSetup.exe
|
"C:\Users\user\Desktop\nHOMA2CalculatorWindowsSetup.exe"
|
||
|
C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp
|
"C:\Users\user\AppData\Local\Temp\is-EVEH9.tmp\nHOMA2CalculatorWindowsSetup.tmp" /SL5="$203BC,1934643,407552,C:\Users\user\Desktop\nHOMA2CalculatorWindowsSetup.exe"
|
||
|
C:\Windows\SysWOW64\regsvr32.exe
|
"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\HOMACore.dll"
|
||
|
C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator.exe
|
"C:\Program Files\HOMA Calculator v2.2.3\HOMA2 Calculator.exe"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.innosetup.com/
|
unknown
|
||
|
http://www.dtu.ox.ac.uk/homa#
|
unknown
|
||
|
http://www.dtu.ox.ac.uk/HOMACalculatorLhttp://www.dtu.ox.ac.uk/HOMACalculatorLhttp://www.dtu.ox.ac.u
|
unknown
|
||
|
http://www.dtu.ox.ac.uk/homa
|
unknown
|
||
|
http://www.dtu.ox.ac.uk/homa#email:
|
unknown
|
||
|
http://www.remobjects.com/ps
|
unknown
|
||
|
http://www.dtu.ox.ac.uk/HOMACalculator
|
unknown
|
||
|
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
|
unknown
|
||
|
http://www.dtu.ox.ac.uk/HOMACalculatorA
|
unknown
|
||
|
http://www.dtu.ox.ac.uk/homaTextAlign
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Owner
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
SessionHash
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Sequence
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
RegFiles0000
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
RegFilesHash
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
|
C:\Windows\system32\HOMACore.dll
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Setup Version
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: App Path
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
InstallLocation
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Icon Group
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: User
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Setup Type
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Selected Components
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Deselected Components
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Selected Tasks
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Deselected Tasks
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Inno Setup: Language
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
DisplayName
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
UninstallString
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
QuietUninstallString
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
Publisher
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
URLInfoAbout
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
HelpLink
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
URLUpdateInfo
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
NoModify
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
NoRepair
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
InstallDate
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMA Calculator_is1
|
EstimatedSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HOMACore.HOMA.2
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HOMACore.HOMA.2\CLSID
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HOMACore.HOMA
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HOMACore.HOMA\CLSID
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HOMACore.HOMA\CurVer
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}\ProgID
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}\VersionIndependentProgID
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}\InprocServer32
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}\InprocServer32
|
ThreadingModel
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F36DB2A5-2047-4B20-8BC9-B27E3CAA7071}\TypeLib
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D071355-A55A-422E-B1E8-3C5069F12E41}\2.1
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D071355-A55A-422E-B1E8-3C5069F12E41}\2.1\FLAGS
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D071355-A55A-422E-B1E8-3C5069F12E41}\2.1\0\win32
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D071355-A55A-422E-B1E8-3C5069F12E41}\2.1\HELPDIR
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\ProxyStubClsid32
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\TypeLib
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\TypeLib
|
Version
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\ProxyStubClsid32
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\TypeLib
|
NULL
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9E533CFE-A962-45F7-AABF-CF2378EC8958}\TypeLib
|
Version
|
There are 41 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
23AD000
|
direct allocation
|
page read and write
|
||
|
626F000
|
direct allocation
|
page read and write
|
||
|
6CACC000
|
unkown
|
page read and write
|
||
|
470000
|
heap
|
page read and write
|
||
|
E70000
|
heap
|
page read and write
|
||
|
2780000
|
heap
|
page read and write
|
||
|
20DE000
|
stack
|
page read and write
|
||
|
43A0000
|
heap
|
page read and write
|
||
|
23D2000
|
direct allocation
|
page read and write
|
||
|
2646000
|
direct allocation
|
page read and write
|
||
|
770000
|
heap
|
page read and write
|
||
|
6FD01000
|
unkown
|
page execute read
|
||
|
3511000
|
heap
|
page read and write
|
||
|
710000
|
heap
|
page read and write
|
||
|
692000
|
heap
|
page read and write
|
||
|
6A6000
|
stack
|
page read and write
|
||
|
54E000
|
stack
|
page read and write
|
||
|
511000
|
unkown
|
page readonly
|
||
|
377E000
|
stack
|
page read and write
|
||
|
88E000
|
stack
|
page read and write
|
||
|
22B9000
|
direct allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
365E000
|
stack
|
page read and write
|
||
|
334E000
|
direct allocation
|
page read and write
|
||
|
2404000
|
direct allocation
|
page read and write
|
||
|
231F000
|
direct allocation
|
page read and write
|
||
|
5C6000
|
heap
|
page read and write
|
||
|
5DA000
|
heap
|
page read and write
|
||
|
23E0000
|
direct allocation
|
page read and write
|
||
|
7FE32000
|
direct allocation
|
page read and write
|
||
|
22F2000
|
direct allocation
|
page read and write
|
||
|
23D9000
|
direct allocation
|
page read and write
|
||
|
F05000
|
heap
|
page read and write
|
||
|
5A10000
|
heap
|
page read and write
|
||
|
697000
|
heap
|
page read and write
|
||
|
7FE36000
|
direct allocation
|
page read and write
|
||
|
3411000
|
heap
|
page read and write
|
||
|
65A000
|
heap
|
page read and write
|
||
|
43C0000
|
heap
|
page read and write
|
||
|
3358000
|
direct allocation
|
page read and write
|
||
|
419000
|
unkown
|
page write copy
|
||
|
68D000
|
heap
|
page read and write
|
||
|
23EF000
|
direct allocation
|
page read and write
|
||
|
2342000
|
direct allocation
|
page read and write
|
||
|
FC6000
|
unkown
|
page readonly
|
||
|
23A2000
|
direct allocation
|
page read and write
|
||
|
2393000
|
direct allocation
|
page read and write
|
||
|
A60000
|
heap
|
page read and write
|
||
|
2710000
|
heap
|
page read and write
|
||
|
6CAD3000
|
unkown
|
page read and write
|
||
|
22CE000
|
direct allocation
|
page read and write
|
||
|
630000
|
heap
|
page read and write
|
||
|
6A8000
|
heap
|
page read and write
|
||
|
FC1000
|
unkown
|
page execute read
|
||
|
3336000
|
direct allocation
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
237D000
|
direct allocation
|
page read and write
|
||
|
AD8000
|
heap
|
page read and write
|
||
|
22F0000
|
direct allocation
|
page read and write
|
||
|
6A0000
|
heap
|
page read and write
|
||
|
23BC000
|
direct allocation
|
page read and write
|
||
|
8FA000
|
stack
|
page read and write
|
||
|
2440000
|
direct allocation
|
page execute and read and write
|
||
|
FC0000
|
unkown
|
page readonly
|
||
|
295E000
|
heap
|
page read and write
|
||
|
23A1000
|
direct allocation
|
page read and write
|
||
|
2308000
|
direct allocation
|
page read and write
|
||
|
2348000
|
direct allocation
|
page read and write
|
||
|
699000
|
heap
|
page read and write
|
||
|
6C870000
|
unkown
|
page readonly
|
||
|
AB8000
|
heap
|
page read and write
|
||
|
23E8000
|
direct allocation
|
page read and write
|
||
|
2B4A000
|
heap
|
page read and write
|
||
|
FCB000
|
unkown
|
page readonly
|
||
|
31F0000
|
direct allocation
|
page read and write
|
||
|
66B000
|
stack
|
page read and write
|
||
|
22E4000
|
direct allocation
|
page read and write
|
||
|
379E000
|
stack
|
page read and write
|
||
|
651000
|
heap
|
page read and write
|
||
|
295E000
|
heap
|
page read and write
|
||
|
5C7000
|
heap
|
page read and write
|
||
|
3447000
|
heap
|
page read and write
|
||
|
2428000
|
direct allocation
|
page read and write
|
||
|
681000
|
heap
|
page read and write
|
||
|
AC8000
|
heap
|
page read and write
|
||
|
6C925000
|
unkown
|
page write copy
|
||
|
504000
|
unkown
|
page read and write
|
||
|
466000
|
unkown
|
page readonly
|
||
|
3510000
|
heap
|
page read and write
|
||
|
2334000
|
direct allocation
|
page read and write
|
||
|
93000
|
stack
|
page read and write
|
||
|
6454000
|
direct allocation
|
page read and write
|
||
|
563000
|
unkown
|
page readonly
|
||
|
308E000
|
stack
|
page read and write
|
||
|
2351000
|
direct allocation
|
page read and write
|
||
|
480000
|
heap
|
page read and write
|
||
|
236F000
|
direct allocation
|
page read and write
|
||
|
332E000
|
direct allocation
|
page read and write
|
||
|
89F000
|
stack
|
page read and write
|
||
|
3345000
|
direct allocation
|
page read and write
|
||
|
295E000
|
heap
|
page read and write
|
||
|
22F9000
|
direct allocation
|
page read and write
|
||
|
686000
|
heap
|
page read and write
|
||
|
239B000
|
direct allocation
|
page read and write
|
||
|
2CD0000
|
direct allocation
|
page execute and read and write
|
||
|
A10000
|
heap
|
page read and write
|
||
|
ABC000
|
heap
|
page read and write
|
||
|
2376000
|
direct allocation
|
page read and write
|
||
|
AA8000
|
heap
|
page read and write
|
||
|
2393000
|
direct allocation
|
page read and write
|
||
|
6FD5E000
|
unkown
|
page read and write
|
||
|
6A9000
|
heap
|
page read and write
|
||
|
677000
|
heap
|
page read and write
|
||
|
5B5000
|
stack
|
page read and write
|
||
|
23FD000
|
direct allocation
|
page read and write
|
||
|
2770000
|
heap
|
page read and write
|
||
|
6CAD8000
|
unkown
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
99F000
|
stack
|
page read and write
|
||
|
2B40000
|
heap
|
page read and write
|
||
|
6FD00000
|
unkown
|
page readonly
|
||
|
6CA8A000
|
unkown
|
page readonly
|
||
|
46A000
|
unkown
|
page readonly
|
||
|
238C000
|
direct allocation
|
page read and write
|
||
|
330E000
|
stack
|
page read and write
|
||
|
2325000
|
direct allocation
|
page read and write
|
||
|
23A8000
|
direct allocation
|
page read and write
|
||
|
A6E000
|
heap
|
page read and write
|
||
|
237D000
|
direct allocation
|
page read and write
|
||
|
FC9000
|
unkown
|
page read and write
|
||
|
24C0000
|
heap
|
page read and write
|
||
|
50B000
|
unkown
|
page write copy
|
||
|
5F00000
|
direct allocation
|
page read and write
|
||
|
6CADC000
|
unkown
|
page readonly
|
||
|
18D000
|
stack
|
page read and write
|
||
|
330E000
|
direct allocation
|
page read and write
|
||
|
FC6000
|
unkown
|
page readonly
|
||
|
3447000
|
heap
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
A00000
|
heap
|
page read and write
|
||
|
3850000
|
unkown
|
page read and write
|
||
|
2413000
|
direct allocation
|
page read and write
|
||
|
ABC000
|
heap
|
page read and write
|
||
|
AB3000
|
heap
|
page read and write
|
||
|
6C923000
|
unkown
|
page read and write
|
||
|
F00000
|
heap
|
page read and write
|
||
|
31E0000
|
direct allocation
|
page read and write
|
||
|
412000
|
unkown
|
page write copy
|
||
|
232D000
|
direct allocation
|
page read and write
|
||
|
63E000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
417000
|
unkown
|
page read and write
|
||
|
367E000
|
stack
|
page read and write
|
||
|
679000
|
heap
|
page read and write
|
||
|
389F000
|
stack
|
page read and write
|
||
|
2349000
|
direct allocation
|
page read and write
|
||
|
6FD62000
|
unkown
|
page readonly
|
||
|
FC9000
|
unkown
|
page write copy
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
2360000
|
direct allocation
|
page read and write
|
||
|
674000
|
heap
|
page read and write
|
||
|
6156000
|
direct allocation
|
page read and write
|
||
|
6C931000
|
unkown
|
page execute read
|
||
|
500000
|
unkown
|
page read and write
|
||
|
22C0000
|
direct allocation
|
page read and write
|
||
|
22DC000
|
direct allocation
|
page read and write
|
||
|
2421000
|
direct allocation
|
page read and write
|
||
|
230F000
|
direct allocation
|
page read and write
|
||
|
670000
|
heap
|
page read and write
|
||
|
2430000
|
heap
|
page read and write
|
||
|
2300000
|
direct allocation
|
page read and write
|
||
|
3520000
|
heap
|
page read and write
|
||
|
2359000
|
direct allocation
|
page read and write
|
||
|
29E0000
|
trusted library allocation
|
page read and write
|
||
|
232D000
|
direct allocation
|
page read and write
|
||
|
697000
|
heap
|
page read and write
|
||
|
276E000
|
stack
|
page read and write
|
||
|
353D000
|
stack
|
page read and write
|
||
|
2384000
|
direct allocation
|
page read and write
|
||
|
22D5000
|
direct allocation
|
page read and write
|
||
|
665000
|
heap
|
page read and write
|
||
|
FC0000
|
unkown
|
page readonly
|
||
|
9B000
|
stack
|
page read and write
|
||
|
2553000
|
heap
|
page read and write
|
||
|
663000
|
heap
|
page read and write
|
||
|
3410000
|
heap
|
page read and write
|
||
|
68B000
|
heap
|
page read and write
|
||
|
A6A000
|
heap
|
page read and write
|
||
|
2317000
|
direct allocation
|
page read and write
|
||
|
241A000
|
direct allocation
|
page read and write
|
||
|
240C000
|
direct allocation
|
page read and write
|
||
|
68B000
|
heap
|
page read and write
|
||
|
2984000
|
heap
|
page read and write
|
||
|
2316000
|
direct allocation
|
page read and write
|
||
|
67F000
|
heap
|
page read and write
|
||
|
4C40000
|
trusted library allocation
|
page read and write
|
||
|
363E000
|
stack
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
24F0000
|
direct allocation
|
page read and write
|
||
|
3610000
|
direct allocation
|
page read and write
|
||
|
2300000
|
direct allocation
|
page read and write
|
||
|
23F6000
|
direct allocation
|
page read and write
|
||
|
66D000
|
heap
|
page read and write
|
||
|
FC1000
|
unkown
|
page execute read
|
||
|
2550000
|
heap
|
page read and write
|
||
|
50B000
|
unkown
|
page read and write
|
||
|
2360000
|
direct allocation
|
page read and write
|
||
|
643C000
|
direct allocation
|
page read and write
|
||
|
3360000
|
direct allocation
|
page read and write
|
||
|
654000
|
heap
|
page read and write
|
||
|
320E000
|
stack
|
page read and write
|
||
|
412000
|
unkown
|
page read and write
|
||
|
8FF000
|
stack
|
page read and write
|
||
|
2326000
|
direct allocation
|
page read and write
|
||
|
2334000
|
direct allocation
|
page read and write
|
||
|
66C000
|
heap
|
page read and write
|
||
|
239A000
|
direct allocation
|
page read and write
|
||
|
6C930000
|
unkown
|
page readonly
|
||
|
6A2000
|
heap
|
page read and write
|
||
|
22EB000
|
direct allocation
|
page read and write
|
||
|
69B000
|
heap
|
page read and write
|
||
|
34D0000
|
heap
|
page read and write
|
||
|
60E000
|
stack
|
page read and write
|
||
|
670000
|
heap
|
page read and write
|
||
|
AE0000
|
heap
|
page read and write
|
||
|
2980000
|
heap
|
page read and write
|
||
|
31E0000
|
heap
|
page read and write
|
||
|
23CB000
|
direct allocation
|
page read and write
|
||
|
95F000
|
stack
|
page read and write
|
||
|
2880000
|
heap
|
page read and write
|
||
|
22E9000
|
heap
|
page read and write
|
||
|
233B000
|
direct allocation
|
page read and write
|
||
|
500000
|
heap
|
page read and write
|
||
|
22C7000
|
direct allocation
|
page read and write
|
||
|
5C7000
|
heap
|
page read and write
|
||
|
8CF000
|
stack
|
page read and write
|
||
|
22A0000
|
direct allocation
|
page read and write
|
||
|
6C928000
|
unkown
|
page readonly
|
||
|
694000
|
heap
|
page read and write
|
||
|
333D000
|
direct allocation
|
page read and write
|
||
|
23B5000
|
direct allocation
|
page read and write
|
||
|
271B000
|
heap
|
page read and write
|
||
|
2308000
|
direct allocation
|
page read and write
|
||
|
2351000
|
direct allocation
|
page read and write
|
||
|
FCB000
|
unkown
|
page readonly
|
||
|
90E000
|
stack
|
page read and write
|
||
|
7FCE0000
|
direct allocation
|
page read and write
|
||
|
2376000
|
direct allocation
|
page read and write
|
||
|
31F0000
|
direct allocation
|
page read and write
|
||
|
236F000
|
direct allocation
|
page read and write
|
||
|
641C000
|
direct allocation
|
page read and write
|
||
|
22E0000
|
heap
|
page read and write
|
||
|
2368000
|
direct allocation
|
page read and write
|
||
|
668000
|
heap
|
page read and write
|
||
|
65E000
|
heap
|
page read and write
|
||
|
375F000
|
stack
|
page read and write
|
||
|
699000
|
heap
|
page read and write
|
||
|
22E5000
|
heap
|
page read and write
|
||
|
21DF000
|
stack
|
page read and write
|
||
|
6C871000
|
unkown
|
page execute read
|
||
|
580000
|
heap
|
page read and write
|
||
|
684000
|
heap
|
page read and write
|
||
|
AC0000
|
heap
|
page read and write
|
||
|
4CE000
|
stack
|
page read and write
|
||
|
31E0000
|
direct allocation
|
page read and write
|
||
|
2341000
|
direct allocation
|
page read and write
|
||
|
920000
|
heap
|
page read and write
|
||
|
590000
|
heap
|
page read and write
|
||
|
3338000
|
direct allocation
|
page read and write
|
||
|
AC6000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
AC3000
|
heap
|
page read and write
|
||
|
2359000
|
direct allocation
|
page read and write
|
||
|
41C000
|
unkown
|
page readonly
|
||
|
500000
|
unkown
|
page write copy
|
||
|
28D8000
|
heap
|
page read and write
|
||
|
910000
|
heap
|
page read and write
|
||
|
2715000
|
heap
|
page read and write
|
||
|
6AB000
|
heap
|
page read and write
|
||
|
AC2000
|
heap
|
page read and write
|
||
|
24F0000
|
direct allocation
|
page read and write
|
||
|
AA0000
|
heap
|
page read and write
|
||
|
264A000
|
direct allocation
|
page read and write
|
||
|
5DE000
|
heap
|
page read and write
|
||
|
508000
|
unkown
|
page read and write
|
There are 275 hidden memdumps, click here to show them.