================================================================================

Output generated by mona.py v2.0, rev 563 - Immunity Debugger

Corelan Team - https://www.corelan.be
================================================================================
OS : xp, release 5.1.2600
Process being debugged : PCManFTPD2 (pid 2804)
Current mona arguments: find -s "\xFF\xE4" -m riched20.dll
================================================================================
2015-09-24 12:12:58
================================================================================
--------------------------------------------------------------------------------------------------------------------------------Module info :
--------------------------------------------------------------------------------------------------------------------------------Base
| Top
| Size
| Rebase | SafeSEH | ASLR | NXCompat | OS
Dll | Version, Modulename & Path
--------------------------------------------------------------------------------------------------------------------------------0x76ee0000 | 0x76f07000 | 0x00027000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [DNSAPI.dll] (C:\WINDOWS\system32\DNSAPI.dll)
0x74dc0000 | 0x74e2c000 | 0x0006c000 | False | True
| False | False | Tr
ue | 5.30.23.1221 [RICHED20.dll] (C:\WINDOWS\system32\RICHED20.dll)
0x7c800000 | 0x7c901000 | 0x00101000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [kernel32.dll] (C:\WINDOWS\system32\kernel32.dll)
0x77be0000 | 0x77c38000 | 0x00058000 | False | True
| False | False | Tr
ue | 7.0.2600.2180 [msvcrt.dll] (C:\WINDOWS\system32\msvcrt.dll)
0x7c910000 | 0x7c9c6000 | 0x000b6000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [ntdll.dll] (C:\WINDOWS\system32\ntdll.dll)
0x00c10000 | 0x00c18000 | 0x00008000 | True | False | False | False | Fa
lse | -1.0- [Lang.dll] (C:\Documents and Settings\brr\Escritorio\9fceb6fefd0f3c
a1a8c36e97b6cc925d-PCMan\Lang.dll)
0x76870000 | 0x7687f000 | 0x0000f000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [pnrpnsp.dll] (C:\WINDOWS\system32\pnrpnsp.dll)
0x71a10000 | 0x71a18000 | 0x00008000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [wshtcpip.dll] (C:\WINDOWS\System32\wshtcpip.dll)
0x00400000 | 0x00448000 | 0x00048000 | False | False | False | False | Fa
lse | 2.0.0.0 [PCManFTPD2.exe] (C:\Documents and Settings\brr\Escritorio\9fceb6
fefd0f3ca1a8c36e97b6cc925d-PCMan\PCManFTPD2.exe)
0x76f80000 | 0x76f86000 | 0x00006000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [rasadhlp.dll] (C:\WINDOWS\system32\rasadhlp.dll)
0x10000000 | 0x10008000 | 0x00008000 | False | False | False | False | Fa
lse | -1.0- [Blowfish.dll] (C:\Documents and Settings\brr\Escritorio\9fceb6fefd
0f3ca1a8c36e97b6cc925d-PCMan\Blowfish.dll)
0x71a50000 | 0x71a5a000 | 0x0000a000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [WSOCK32.dll] (C:\WINDOWS\system32\WSOCK32.dll)
0x71a20000 | 0x71a28000 | 0x00008000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [WS2HELP.dll] (C:\WINDOWS\system32\WS2HELP.dll)
0x77f40000 | 0x77fb6000 | 0x00076000 | False | True
| False | False | Tr
ue | 6.00.2900.2180 [SHLWAPI.dll] (C:\WINDOWS\system32\SHLWAPI.dll)
0x66740000 | 0x66799000 | 0x00059000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [hnetcfg.dll] (C:\WINDOWS\system32\hnetcfg.dll)
0x77d10000 | 0x77da0000 | 0x00090000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [USER32.dll] (C:\WINDOWS\system32\USER32.dll)
0x76360000 | 0x763aa000 | 0x0004a000 | False | True
| False | False | Tr
ue | 6.00.2900.2180 [comdlg32.dll] (C:\WINDOWS\system32\comdlg32.dll)
0x5b150000 | 0x5b188000 | 0x00038000 | False | True
| False | False | Tr
ue | 6.00.2900.2180 [uxtheme.dll] (C:\WINDOWS\system32\uxtheme.dll)
0x7c9d0000 | 0x7d1ee000 | 0x0081e000 | False | True
| False | False | Tr
ue | 6.00.2900.2180 [SHELL32.dll] (C:\WINDOWS\system32\SHELL32.dll)

0x77e50000 | 0x77ee1000 | 0x00091000 | False | True

| False | False | Tr
ue | 5.1.2600.2180 [RPCRT4.dll] (C:\WINDOWS\system32\RPCRT4.dll)
0x773a0000 | 0x774a2000 | 0x00102000 | False | True
| False | False | Tr
ue | 6.0 [COMCTL32.dll] (C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Contro
ls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\COMCTL32.dll)
0x76f70000 | 0x76f78000 | 0x00008000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [winrnr.dll] (C:\WINDOWS\System32\winrnr.dll)
0x746b0000 | 0x746fb000 | 0x0004b000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [MSCTF.dll] (C:\WINDOWS\system32\MSCTF.dll)
0x76f20000 | 0x76f4d000 | 0x0002d000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [WLDAP32.dll] (C:\WINDOWS\system32\WLDAP32.dll)
0x719d0000 | 0x71a10000 | 0x00040000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [mswsock.dll] (C:\WINDOWS\system32\mswsock.dll)
0x73260000 | 0x73265000 | 0x00005000 | False | False | False | False | Tr
ue | 5.1.2600.0 [RICHED32.DLL] (C:\WINDOWS\system32\RICHED32.DLL)
0x77ef0000 | 0x77f36000 | 0x00046000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [GDI32.dll] (C:\WINDOWS\system32\GDI32.dll)
0x72f80000 | 0x72fa6000 | 0x00026000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [WINSPOOL.DRV] (C:\WINDOWS\system32\WINSPOOL.DRV)
0x77da0000 | 0x77e4c000 | 0x000ac000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [ADVAPI32.dll] (C:\WINDOWS\system32\ADVAPI32.dll)
0x71a30000 | 0x71a47000 | 0x00017000 | False | True
| False | False | Tr
ue | 5.1.2600.2180 [WS2_32.dll] (C:\WINDOWS\system32\WS2_32.dll)
--------------------------------------------------------------------------------------------------------------------------------0x74e24c69 : "\xFF\xE4" | {PAGE_READONLY} [RICHED20.dll] ASLR: False, Rebase: F
alse, SafeSEH: True, OS: True, v5.30.23.1221 (C:\WINDOWS\system32\RICHED20.dll)
0x74e24f7a : "\xFF\xE4" | {PAGE_READONLY} [RICHED20.dll] ASLR: False, Rebase: F
alse, SafeSEH: True, OS: True, v5.30.23.1221 (C:\WINDOWS\system32\RICHED20.dll)
0x74e25ceb : "\xFF\xE4" | {PAGE_READONLY} [RICHED20.dll] ASLR: False, Rebase: F
alse, SafeSEH: True, OS: True, v5.30.23.1221 (C:\WINDOWS\system32\RICHED20.dll)
0x74e2644a : "\xFF\xE4" | {PAGE_READONLY} [RICHED20.dll] ASLR: False, Rebase: F
alse, SafeSEH: True, OS: True, v5.30.23.1221 (C:\WINDOWS\system32\RICHED20.dll)
0x74e27f43 : "\xFF\xE4" | {PAGE_READONLY} [RICHED20.dll] ASLR: False, Rebase: F
alse, SafeSEH: True, OS: True, v5.30.23.1221 (C:\WINDOWS\system32\RICHED20.dll)
0x74e0cfd7 : "\xFF\xE4" | {PAGE_EXECUTE_READ} [RICHED20.dll] ASLR: False, Rebas
e: False, SafeSEH: True, OS: True, v5.30.23.1221 (C:\WINDOWS\system32\RICHED20.d
ll)