Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Setup.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\203120\Sparc.com
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
modified
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\203120\W
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Arise
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Craps
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Current
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Democratic
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Dodge
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Improvements
|
ASCII text, with very long lines (686), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Improvements.cmd (copy)
|
ASCII text, with very long lines (686), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Infection
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Injured
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Innovative
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Laboratories
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Las
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Lifestyle
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Modems
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Papua
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Power
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Sagem
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Technique
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Treasury
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Underground
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nhpagelo.kny.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tdajzssq.vxi.psm1
|
ASCII text, with no line terminators
|
dropped
|
There are 16 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Setup.exe
|
"C:\Users\user\Desktop\Setup.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\System32\cmd.exe" /c move Improvements Improvements.cmd & Improvements.cmd
|
|
|
|
C:\Windows\SysWOW64\findstr.exe
|
findstr /I "opssvc wrsa"
|
|
|
|
C:\Windows\SysWOW64\findstr.exe
|
findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd /c md 203120
|
|
|
|
C:\Windows\SysWOW64\findstr.exe
|
findstr /V "Cbs" Modems
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd /c copy /b ..\Treasury + ..\Laboratories + ..\Lifestyle + ..\Injured + ..\Papua + ..\Craps + ..\Arise W
|
|
|
|
C:\Users\user\AppData\Local\Temp\203120\Sparc.com
|
Sparc.com W
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
powershell -exec bypass <!DOCTYPE html> <!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]--> <!--[if
IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--> <!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US">
<![endif]--> <!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]--> <head> <title>Suspected phishing site
| Cloudflare</title> <meta charset="UTF-8" /> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta
http-equiv="X-UA-Compatible" content="IE=Edge" /> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport"
content="width=device-width,initial-scale=1" /> <link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css"
/> <!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--> <style>body{margin:0;padding:0}</style>
<!--[if gte IE 10]><!--> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function
() { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script>
<!--<![endif]--> </head> <body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert"
data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" class="cf-error-details-wrapper">
<div class="cf-section cf-wrapper" style="margin-top: 100px;margin-bottom:200px;"> <div class="cf-columns one">
<div class="cf-column"> <h4 class="cf-text-error"><i class="cf-icon-exclamation-sign" style="background-size:
18px; height: 18px; width: 18px; margin-bottom: 2px;"></i> Warning</h4>
<h2 style="margin: 16px 0;">Suspected Phishing</h2> <strong>This website has been reported for potential phishing.</strong>
<p>Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source.</p>
<div style="display: flex; align-items: center;"> <p> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/"
class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a>
<form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <input type="hidden" name="atok"
value="0vOzla7LMRjuvVvuSKNV8aR5n18Cgvqbg1x8Fa8mxQk-1734782404-0.0.1.1-/int_clp_ldr_sha.txt"> <button
type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter">Ignore
& Proceed</button> </form> </p> </div> </div>
</div> </div><!-- /.section --> <div id="ts-blocks" style="display:none;"></div> <div class="cf-error-footer
cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300">
<p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">8f57b5a98cec4252</strong></span>
<span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block
sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button>
<span class="hidden" id="cf-footer-ip">8.46.123.189</span> <span class="cf-footer-separator sm:hidden">•</span>
</span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer"
href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span> </p> <script>(function(){function
d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var
a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();</script> </div><!-- /.error-footer -->
</div><!-- /#cf-error-details --> </div><!-- /#cf-wrapper --> <script> window._cf_translation = {}; </script>
</body> </html>
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\tasklist.exe
|
tasklist
|
||
|
C:\Windows\SysWOW64\tasklist.exe
|
tasklist
|
||
|
C:\Windows\SysWOW64\choice.exe
|
choice /d y /t 5
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
There are 4 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://chillysalvagk.click/api
|
104.21.42.70
|
|
|
|
chillysalvagk.click
|
|
||
|
https://www.cloudflare.com/learning/access-management/phishing-attack/
|
unknown
|
||
|
necklacebudi.lat
|
|||
|
https://www.cloudflare.com/learning/access-management/phishing-atX)
|
unknown
|
||
|
http://www.autoitscript.com/autoit3/X
|
unknown
|
||
|
https://www.cloudflare.com/learning/access-management/phishhZ
|
unknown
|
||
|
http://nsis.sf.net/NSIS_ErrorError
|
unknown
|
||
|
aspecteirs.lat
|
|||
|
https://www.cloudflare.com/learning/access-management/phishing-attack/class=cf-btnstyle=background-c
|
unknown
|
||
|
energyaffai.lat
|
|||
|
https://www.autoitscript.com/autoit3/
|
unknown
|
||
|
https://www.cloudflare.com/learning/access-management/phishing-attack//
|
unknown
|
||
|
https://www.cloudflare.com/5xx-error-landing
|
unknown
|
||
|
https://www.cloudflare.com/5xx-error-landingid=brand_linktarget=_blank
|
unknown
|
||
|
https://kliptizq.shop/int_clp_ldr_sha.txt
|
104.21.84.113
|
||
|
https://www.cloudflare.com/learning/access-management/phish
|
unknown
|
||
|
sustainskelet.lat
|
|||
|
https://aka.ms/pscore6lBjq
|
unknown
|
||
|
https://www.cloudflare.com/5xx-error-landinghZ
|
unknown
|
||
|
crosshuaht.lat
|
|||
|
rapeflowwj.lat
|
|||
|
grannyejh.lat
|
|||
|
discokeyus.lat
|
|||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://www.cloudflare.com/5xx-error-landingmance
|
unknown
|
There are 16 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
chillysalvagk.click
|
104.21.42.70
|
|
|
|
kliptizq.shop
|
104.21.84.113
|
||
|
CKZFzmvdWkUlKnRYBQ.CKZFzmvdWkUlKnRYBQ
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
104.21.42.70
|
chillysalvagk.click
|
United States
|
|
|
|
104.21.84.113
|
kliptizq.shop
|
United States
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3832000
|
trusted library allocation
|
page read and write
|
|
|
|
515A000
|
trusted library allocation
|
page read and write
|
||
|
3B66000
|
trusted library allocation
|
page read and write
|
||
|
3AB3000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
784F000
|
stack
|
page read and write
|
||
|
3B6D000
|
trusted library allocation
|
page read and write
|
||
|
5280000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
2CB0000
|
heap
|
page read and write
|
||
|
8BE000
|
stack
|
page read and write
|
||
|
560000
|
heap
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
31E0000
|
trusted library allocation
|
page read and write
|
||
|
6EFE000
|
stack
|
page read and write
|
||
|
3BFD000
|
trusted library allocation
|
page read and write
|
||
|
39A8000
|
trusted library allocation
|
page read and write
|
||
|
34EE000
|
stack
|
page read and write
|
||
|
516B000
|
trusted library allocation
|
page read and write
|
||
|
3B89000
|
trusted library allocation
|
page read and write
|
||
|
50B1000
|
trusted library allocation
|
page read and write
|
||
|
2910000
|
heap
|
page read and write
|
||
|
D96000
|
heap
|
page read and write
|
||
|
3C3B000
|
trusted library allocation
|
page read and write
|
||
|
620000
|
heap
|
page read and write
|
||
|
3AB8000
|
trusted library allocation
|
page read and write
|
||
|
6F5000
|
heap
|
page read and write
|
||
|
6E7E000
|
stack
|
page read and write
|
||
|
3ABD000
|
trusted library allocation
|
page read and write
|
||
|
7930000
|
trusted library allocation
|
page read and write
|
||
|
3A03000
|
trusted library allocation
|
page read and write
|
||
|
39A9000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
5147000
|
trusted library allocation
|
page read and write
|
||
|
4D90000
|
heap
|
page read and write
|
||
|
758B000
|
heap
|
page read and write
|
||
|
7035000
|
heap
|
page execute and read and write
|
||
|
3AB3000
|
trusted library allocation
|
page read and write
|
||
|
3B6C000
|
trusted library allocation
|
page read and write
|
||
|
345D000
|
stack
|
page read and write
|
||
|
37F0000
|
trusted library allocation
|
page read and write
|
||
|
391D000
|
trusted library allocation
|
page read and write
|
||
|
3B4D000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
5E41000
|
trusted library allocation
|
page read and write
|
||
|
7538000
|
heap
|
page read and write
|
||
|
70BB000
|
stack
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
83B0000
|
heap
|
page read and write
|
||
|
74AF000
|
stack
|
page read and write
|
||
|
4C7F000
|
stack
|
page read and write
|
||
|
382D000
|
trusted library allocation
|
page read and write
|
||
|
A26000
|
heap
|
page read and write
|
||
|
3AB3000
|
trusted library allocation
|
page read and write
|
||
|
3A25000
|
trusted library allocation
|
page read and write
|
||
|
30CC000
|
heap
|
page read and write
|
||
|
2CF5000
|
heap
|
page read and write
|
||
|
E60000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
AC3000
|
heap
|
page read and write
|
||
|
60E000
|
stack
|
page read and write
|
||
|
4C3E000
|
stack
|
page read and write
|
||
|
37ED000
|
trusted library allocation
|
page read and write
|
||
|
22C4000
|
heap
|
page read and write
|
||
|
5350000
|
heap
|
page read and write
|
||
|
D89000
|
heap
|
page read and write
|
||
|
532F000
|
stack
|
page read and write
|
||
|
52AF000
|
stack
|
page read and write
|
||
|
3ABA000
|
trusted library allocation
|
page read and write
|
||
|
21CF000
|
stack
|
page read and write
|
||
|
352E000
|
stack
|
page read and write
|
||
|
3991000
|
trusted library allocation
|
page read and write
|
||
|
3C5D000
|
trusted library allocation
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
3B63000
|
trusted library allocation
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
AD7000
|
stack
|
page read and write
|
||
|
D75000
|
heap
|
page read and write
|
||
|
3B53000
|
trusted library allocation
|
page read and write
|
||
|
39EA000
|
trusted library allocation
|
page read and write
|
||
|
3832000
|
trusted library allocation
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
3ABB000
|
trusted library allocation
|
page read and write
|
||
|
3918000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
3AB2000
|
trusted library allocation
|
page read and write
|
||
|
B50000
|
heap
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
3C3F000
|
trusted library allocation
|
page read and write
|
||
|
3B4E000
|
trusted library allocation
|
page read and write
|
||
|
723D000
|
stack
|
page read and write
|
||
|
37B1000
|
trusted library allocation
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
934000
|
heap
|
page read and write
|
||
|
40C000
|
unkown
|
page write copy
|
||
|
4D7F000
|
stack
|
page read and write
|
||
|
2CF4000
|
heap
|
page read and write
|
||
|
30CC000
|
stack
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
6FBE000
|
stack
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
3289000
|
heap
|
page read and write
|
||
|
3998000
|
trusted library allocation
|
page read and write
|
||
|
630000
|
heap
|
page read and write
|
||
|
29CC000
|
stack
|
page read and write
|
||
|
3280000
|
heap
|
page read and write
|
||
|
4E30000
|
heap
|
page execute and read and write
|
||
|
3920000
|
trusted library allocation
|
page read and write
|
||
|
72C0000
|
heap
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
30D8000
|
heap
|
page read and write
|
||
|
3240000
|
heap
|
page read and write
|
||
|
D63000
|
heap
|
page read and write
|
||
|
315E000
|
stack
|
page read and write
|
||
|
3BFB000
|
trusted library allocation
|
page read and write
|
||
|
2DBE000
|
stack
|
page read and write
|
||
|
3262000
|
heap
|
page read and write
|
||
|
727D000
|
stack
|
page read and write
|
||
|
5CE000
|
stack
|
page read and write
|
||
|
77BE000
|
stack
|
page read and write
|
||
|
3986000
|
trusted library allocation
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
3501000
|
heap
|
page read and write
|
||
|
3ABE000
|
trusted library allocation
|
page read and write
|
||
|
3280000
|
heap
|
page read and write
|
||
|
328D000
|
heap
|
page read and write
|
||
|
31F0000
|
heap
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
39A3000
|
trusted library allocation
|
page read and write
|
||
|
3B8C000
|
trusted library allocation
|
page read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
349E000
|
stack
|
page read and write
|
||
|
7530000
|
heap
|
page read and write
|
||
|
3075000
|
trusted library allocation
|
page execute and read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
362E000
|
stack
|
page read and write
|
||
|
92B000
|
heap
|
page read and write
|
||
|
399C000
|
trusted library allocation
|
page read and write
|
||
|
22C0000
|
heap
|
page read and write
|
||
|
68E000
|
stack
|
page read and write
|
||
|
3287000
|
heap
|
page read and write
|
||
|
D95000
|
heap
|
page read and write
|
||
|
D82000
|
heap
|
page read and write
|
||
|
3B67000
|
trusted library allocation
|
page read and write
|
||
|
F15000
|
unkown
|
page readonly
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
6F7E000
|
stack
|
page read and write
|
||
|
70FE000
|
stack
|
page read and write
|
||
|
6BA000
|
heap
|
page read and write
|
||
|
7960000
|
trusted library allocation
|
page read and write
|
||
|
3B6E000
|
trusted library allocation
|
page read and write
|
||
|
5136000
|
trusted library allocation
|
page read and write
|
||
|
6EE000
|
heap
|
page read and write
|
||
|
4560000
|
trusted library allocation
|
page read and write
|
||
|
3B59000
|
trusted library allocation
|
page read and write
|
||
|
E40000
|
heap
|
page read and write
|
||
|
2CB8000
|
heap
|
page read and write
|
||
|
2CD2000
|
heap
|
page read and write
|
||
|
3B7F000
|
trusted library allocation
|
page read and write
|
||
|
3020000
|
trusted library allocation
|
page read and write
|
||
|
3AB3000
|
trusted library allocation
|
page read and write
|
||
|
3AB1000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
7591000
|
heap
|
page read and write
|
||
|
2CEA000
|
heap
|
page read and write
|
||
|
3280000
|
heap
|
page read and write
|
||
|
3C47000
|
trusted library allocation
|
page read and write
|
||
|
3AB4000
|
trusted library allocation
|
page read and write
|
||
|
79C0000
|
trusted library allocation
|
page read and write
|
||
|
3B7B000
|
trusted library allocation
|
page read and write
|
||
|
5380000
|
heap
|
page read and write
|
||
|
A9C000
|
stack
|
page read and write
|
||
|
3A0C000
|
trusted library allocation
|
page read and write
|
||
|
3BEE000
|
trusted library allocation
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
2FCC000
|
stack
|
page read and write
|
||
|
328D000
|
heap
|
page read and write
|
||
|
6F5000
|
heap
|
page read and write
|
||
|
23CF000
|
stack
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
4DEE000
|
stack
|
page read and write
|
||
|
3090000
|
trusted library allocation
|
page read and write
|
||
|
3B65000
|
trusted library allocation
|
page read and write
|
||
|
3B50000
|
trusted library allocation
|
page read and write
|
||
|
78D0000
|
trusted library allocation
|
page read and write
|
||
|
51AC000
|
trusted library allocation
|
page read and write
|
||
|
78F0000
|
trusted library allocation
|
page read and write
|
||
|
327E000
|
stack
|
page read and write
|
||
|
3153000
|
heap
|
page read and write
|
||
|
3168000
|
heap
|
page read and write
|
||
|
2E8E000
|
stack
|
page read and write
|
||
|
3987000
|
trusted library allocation
|
page read and write
|
||
|
500000
|
unkown
|
page readonly
|
||
|
3B72000
|
trusted library allocation
|
page read and write
|
||
|
3832000
|
trusted library allocation
|
page read and write
|
||
|
5099000
|
trusted library allocation
|
page read and write
|
||
|
3220000
|
heap
|
page read and write
|
||
|
3049000
|
trusted library allocation
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
7950000
|
trusted library allocation
|
page read and write
|
||
|
D87000
|
heap
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
E3E000
|
stack
|
page read and write
|
||
|
9C0000
|
trusted library allocation
|
page read and write
|
||
|
7910000
|
trusted library allocation
|
page read and write
|
||
|
6B0000
|
heap
|
page read and write
|
||
|
3B87000
|
trusted library allocation
|
page read and write
|
||
|
3288000
|
heap
|
page read and write
|
||
|
3B58000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
2F8F000
|
stack
|
page read and write
|
||
|
3824000
|
trusted library allocation
|
page read and write
|
||
|
311E000
|
stack
|
page read and write
|
||
|
713E000
|
stack
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
315F000
|
heap
|
page read and write
|
||
|
D97000
|
heap
|
page read and write
|
||
|
78CD000
|
stack
|
page read and write
|
||
|
79B0000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
7920000
|
trusted library allocation
|
page read and write
|
||
|
F0D000
|
unkown
|
page write copy
|
||
|
D31000
|
heap
|
page read and write
|
||
|
328D000
|
heap
|
page read and write
|
||
|
625000
|
heap
|
page read and write
|
||
|
9C0000
|
trusted library allocation
|
page read and write
|
||
|
3AB2000
|
trusted library allocation
|
page read and write
|
||
|
3101000
|
heap
|
page read and write
|
||
|
37B1000
|
trusted library allocation
|
page read and write
|
||
|
E41000
|
unkown
|
page execute read
|
||
|
D7E000
|
heap
|
page read and write
|
||
|
F03000
|
unkown
|
page readonly
|
||
|
6F9000
|
heap
|
page read and write
|
||
|
75C4000
|
heap
|
page read and write
|
||
|
3B88000
|
trusted library allocation
|
page read and write
|
||
|
3B53000
|
trusted library allocation
|
page read and write
|
||
|
3B64000
|
trusted library allocation
|
page read and write
|
||
|
37E4000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
7641000
|
heap
|
page read and write
|
||
|
5EA3000
|
trusted library allocation
|
page read and write
|
||
|
3B7C000
|
trusted library allocation
|
page read and write
|
||
|
4EA1000
|
trusted library allocation
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
39A2000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
326B000
|
heap
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
CAD000
|
stack
|
page read and write
|
||
|
7990000
|
trusted library allocation
|
page read and write
|
||
|
3AB2000
|
trusted library allocation
|
page read and write
|
||
|
3BEA000
|
trusted library allocation
|
page read and write
|
||
|
2F8C000
|
stack
|
page read and write
|
||
|
2CDD000
|
heap
|
page read and write
|
||
|
3ABA000
|
trusted library allocation
|
page read and write
|
||
|
4DAC000
|
stack
|
page read and write
|
||
|
CC8000
|
heap
|
page read and write
|
||
|
3AB2000
|
trusted library allocation
|
page read and write
|
||
|
3C0B000
|
trusted library allocation
|
page read and write
|
||
|
D7C000
|
heap
|
page read and write
|
||
|
19A000
|
stack
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
4CBE000
|
stack
|
page read and write
|
||
|
83D0000
|
trusted library allocation
|
page read and write
|
||
|
2E2F000
|
stack
|
page read and write
|
||
|
934000
|
heap
|
page read and write
|
||
|
3A1D000
|
trusted library allocation
|
page read and write
|
||
|
2C70000
|
heap
|
page read and write
|
||
|
3AB2000
|
trusted library allocation
|
page read and write
|
||
|
3AB6000
|
trusted library allocation
|
page read and write
|
||
|
328F000
|
heap
|
page read and write
|
||
|
3AB6000
|
trusted library allocation
|
page read and write
|
||
|
517D000
|
trusted library allocation
|
page read and write
|
||
|
2E36000
|
heap
|
page read and write
|
||
|
717000
|
heap
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
3B69000
|
trusted library allocation
|
page read and write
|
||
|
5E69000
|
trusted library allocation
|
page read and write
|
||
|
3B42000
|
trusted library allocation
|
page read and write
|
||
|
328D000
|
heap
|
page read and write
|
||
|
220E000
|
stack
|
page read and write
|
||
|
37B1000
|
trusted library allocation
|
page read and write
|
||
|
4DC0000
|
heap
|
page read and write
|
||
|
35EF000
|
stack
|
page read and write
|
||
|
757E000
|
heap
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
EDD000
|
unkown
|
page readonly
|
||
|
31A7000
|
heap
|
page read and write
|
||
|
420000
|
unkown
|
page read and write
|
||
|
3B80000
|
trusted library allocation
|
page read and write
|
||
|
570000
|
heap
|
page read and write
|
||
|
328F000
|
heap
|
page read and write
|
||
|
98000
|
stack
|
page read and write
|
||
|
7980000
|
trusted library allocation
|
page read and write
|
||
|
391B000
|
trusted library allocation
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
A37000
|
heap
|
page read and write
|
||
|
3B87000
|
trusted library allocation
|
page read and write
|
||
|
398C000
|
trusted library allocation
|
page read and write
|
||
|
2F8F000
|
stack
|
page read and write
|
||
|
399D000
|
trusted library allocation
|
page read and write
|
||
|
3B50000
|
trusted library allocation
|
page read and write
|
||
|
3030000
|
trusted library allocation
|
page read and write
|
||
|
3AB9000
|
trusted library allocation
|
page read and write
|
||
|
4C7000
|
unkown
|
page read and write
|
||
|
3AB5000
|
trusted library allocation
|
page read and write
|
||
|
3C2E000
|
trusted library allocation
|
page read and write
|
||
|
2CED000
|
heap
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
780E000
|
stack
|
page read and write
|
||
|
2DED000
|
stack
|
page read and write
|
||
|
398B000
|
trusted library allocation
|
page read and write
|
||
|
D91000
|
heap
|
page read and write
|
||
|
327C000
|
heap
|
page read and write
|
||
|
39FB000
|
trusted library allocation
|
page read and write
|
||
|
3155000
|
heap
|
page read and write
|
||
|
4CFF000
|
stack
|
page read and write
|
||
|
3AB0000
|
trusted library allocation
|
page read and write
|
||
|
3034000
|
trusted library allocation
|
page read and write
|
||
|
2240000
|
heap
|
page read and write
|
||
|
3B6C000
|
trusted library allocation
|
page read and write
|
||
|
3072000
|
trusted library allocation
|
page read and write
|
||
|
D97000
|
heap
|
page read and write
|
||
|
3AB8000
|
trusted library allocation
|
page read and write
|
||
|
777E000
|
stack
|
page read and write
|
||
|
3AB3000
|
trusted library allocation
|
page read and write
|
||
|
3929000
|
trusted library allocation
|
page read and write
|
||
|
3AB8000
|
trusted library allocation
|
page read and write
|
||
|
2E30000
|
heap
|
page read and write
|
||
|
2CEE000
|
heap
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
3B74000
|
trusted library allocation
|
page read and write
|
||
|
3B8D000
|
trusted library allocation
|
page read and write
|
||
|
8520000
|
heap
|
page read and write
|
||
|
707D000
|
stack
|
page read and write
|
||
|
3AB2000
|
trusted library allocation
|
page read and write
|
||
|
4E41000
|
trusted library allocation
|
page read and write
|
||
|
3B88000
|
trusted library allocation
|
page read and write
|
||
|
D0E000
|
stack
|
page read and write
|
||
|
3832000
|
trusted library allocation
|
page read and write
|
||
|
3829000
|
trusted library allocation
|
page read and write
|
||
|
3B63000
|
trusted library allocation
|
page read and write
|
||
|
75B1000
|
heap
|
page read and write
|
||
|
2CEA000
|
heap
|
page read and write
|
||
|
3926000
|
trusted library allocation
|
page read and write
|
||
|
71BA000
|
stack
|
page read and write
|
||
|
2CDC000
|
heap
|
page read and write
|
||
|
327C000
|
heap
|
page read and write
|
||
|
3AB6000
|
trusted library allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
3AB3000
|
trusted library allocation
|
page read and write
|
||
|
3B5E000
|
trusted library allocation
|
page read and write
|
||
|
2C80000
|
heap
|
page read and write
|
||
|
37EC000
|
trusted library allocation
|
page read and write
|
||
|
34A0000
|
heap
|
page read and write
|
||
|
3AB8000
|
trusted library allocation
|
page read and write
|
||
|
3981000
|
trusted library allocation
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
409000
|
unkown
|
page readonly
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
920000
|
heap
|
page read and write
|
||
|
3B43000
|
trusted library allocation
|
page read and write
|
||
|
3226000
|
heap
|
page read and write
|
||
|
752F000
|
stack
|
page read and write
|
||
|
3AB0000
|
trusted library allocation
|
page read and write
|
||
|
AA4000
|
heap
|
page read and write
|
||
|
31C8000
|
trusted library allocation
|
page read and write
|
||
|
3033000
|
trusted library allocation
|
page execute and read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
35AE000
|
stack
|
page read and write
|
||
|
51A1000
|
trusted library allocation
|
page read and write
|
||
|
327C000
|
heap
|
page read and write
|
||
|
290F000
|
stack
|
page read and write
|
||
|
3C2F000
|
trusted library allocation
|
page read and write
|
||
|
75BD000
|
heap
|
page read and write
|
||
|
50BF000
|
trusted library allocation
|
page read and write
|
||
|
3B7A000
|
trusted library allocation
|
page read and write
|
||
|
83F0000
|
trusted library allocation
|
page read and write
|
||
|
323E000
|
stack
|
page read and write
|
||
|
75E0000
|
heap
|
page read and write
|
||
|
327C000
|
heap
|
page read and write
|
||
|
746E000
|
stack
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
328D000
|
heap
|
page read and write
|
||
|
2210000
|
heap
|
page read and write
|
||
|
40C000
|
unkown
|
page read and write
|
||
|
D61000
|
heap
|
page read and write
|
||
|
3832000
|
trusted library allocation
|
page read and write
|
||
|
328D000
|
heap
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
3997000
|
trusted library allocation
|
page read and write
|
||
|
3640000
|
heap
|
page read and write
|
||
|
3B6E000
|
trusted library allocation
|
page read and write
|
||
|
3B52000
|
trusted library allocation
|
page read and write
|
||
|
2CCF000
|
heap
|
page read and write
|
||
|
3AB6000
|
trusted library allocation
|
page read and write
|
||
|
2DE0000
|
heap
|
page read and write
|
||
|
72BA000
|
stack
|
page read and write
|
||
|
500000
|
unkown
|
page readonly
|
||
|
D79000
|
heap
|
page read and write
|
||
|
37B1000
|
trusted library allocation
|
page read and write
|
||
|
3B53000
|
trusted library allocation
|
page read and write
|
||
|
B4C000
|
stack
|
page read and write
|
||
|
37B1000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
3B43000
|
trusted library allocation
|
page read and write
|
||
|
3157000
|
heap
|
page read and write
|
||
|
7940000
|
trusted library allocation
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
533A000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
3AB0000
|
trusted library allocation
|
page read and write
|
||
|
D65000
|
heap
|
page read and write
|
||
|
2CEA000
|
heap
|
page read and write
|
||
|
3248000
|
heap
|
page read and write
|
||
|
3AB7000
|
trusted library allocation
|
page read and write
|
||
|
925000
|
heap
|
page read and write
|
||
|
77C0000
|
heap
|
page execute and read and write
|
||
|
52EE000
|
stack
|
page read and write
|
||
|
3B7E000
|
trusted library allocation
|
page read and write
|
||
|
30A0000
|
heap
|
page readonly
|
||
|
3B62000
|
trusted library allocation
|
page read and write
|
||
|
83C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
318E000
|
heap
|
page read and write
|
||
|
717000
|
heap
|
page read and write
|
||
|
3ABA000
|
trusted library allocation
|
page read and write
|
||
|
3AB0000
|
trusted library allocation
|
page read and write
|
||
|
D93000
|
heap
|
page read and write
|
||
|
280E000
|
stack
|
page read and write
|
||
|
72D0000
|
heap
|
page read and write
|
||
|
37E5000
|
trusted library allocation
|
page read and write
|
||
|
434000
|
unkown
|
page read and write
|
||
|
326D000
|
heap
|
page read and write
|
||
|
3AB5000
|
trusted library allocation
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
3AB5000
|
trusted library allocation
|
page read and write
|
||
|
303D000
|
trusted library allocation
|
page execute and read and write
|
||
|
3B6F000
|
trusted library allocation
|
page read and write
|
||
|
3923000
|
trusted library allocation
|
page read and write
|
||
|
6C9000
|
heap
|
page read and write
|
||
|
83E0000
|
trusted library allocation
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
B8C000
|
stack
|
page read and write
|
||
|
6F3E000
|
stack
|
page read and write
|
||
|
75D3000
|
heap
|
page read and write
|
||
|
3AB3000
|
trusted library allocation
|
page read and write
|
||
|
37EE000
|
trusted library allocation
|
page read and write
|
||
|
3864000
|
trusted library allocation
|
page read and write
|
||
|
392C000
|
trusted library allocation
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
3992000
|
trusted library allocation
|
page read and write
|
||
|
71FD000
|
stack
|
page read and write
|
||
|
2CFA000
|
heap
|
page read and write
|
||
|
79D0000
|
trusted library allocation
|
page read and write
|
||
|
6F9000
|
heap
|
page read and write
|
||
|
325E000
|
heap
|
page read and write
|
||
|
51EB000
|
trusted library allocation
|
page read and write
|
||
|
3194000
|
heap
|
page read and write
|
||
|
3ABF000
|
trusted library allocation
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
3C2B000
|
trusted library allocation
|
page read and write
|
||
|
3B8A000
|
trusted library allocation
|
page read and write
|
||
|
30B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
CB0000
|
heap
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
74EE000
|
stack
|
page read and write
|
||
|
3501000
|
heap
|
page read and write
|
||
|
2FE0000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
3AB1000
|
trusted library allocation
|
page read and write
|
||
|
4D3E000
|
stack
|
page read and write
|
||
|
3AB3000
|
trusted library allocation
|
page read and write
|
||
|
E40000
|
unkown
|
page readonly
|
||
|
D31000
|
heap
|
page read and write
|
||
|
3B7A000
|
trusted library allocation
|
page read and write
|
||
|
7030000
|
heap
|
page execute and read and write
|
||
|
3050000
|
heap
|
page read and write
|
||
|
3B4C000
|
trusted library allocation
|
page read and write
|
||
|
30C0000
|
heap
|
page read and write
|
||
|
3502000
|
heap
|
page read and write
|
||
|
3ABA000
|
trusted library allocation
|
page read and write
|
||
|
306A000
|
trusted library allocation
|
page execute and read and write
|
||
|
3340000
|
heap
|
page read and write
|
||
|
2FAF000
|
stack
|
page read and write
|
||
|
3172000
|
heap
|
page read and write
|
||
|
3ABE000
|
trusted library allocation
|
page read and write
|
||
|
2CFD000
|
heap
|
page read and write
|
||
|
3070000
|
trusted library allocation
|
page read and write
|
||
|
328F000
|
heap
|
page read and write
|
||
|
D95000
|
heap
|
page read and write
|
||
|
9C0000
|
trusted library allocation
|
page read and write
|
||
|
2B0F000
|
stack
|
page read and write
|
||
|
327F000
|
heap
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
30F5000
|
heap
|
page read and write
|
||
|
2CFD000
|
heap
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
75DA000
|
heap
|
page read and write
|
||
|
3C1A000
|
trusted library allocation
|
page read and write
|
||
|
37B1000
|
trusted library allocation
|
page read and write
|
||
|
4F9E000
|
trusted library allocation
|
page read and write
|
||
|
8400000
|
trusted library allocation
|
page execute and read and write
|
||
|
3AB6000
|
trusted library allocation
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
910000
|
heap
|
page read and write
|
||
|
3040000
|
trusted library allocation
|
page read and write
|
||
|
3160000
|
heap
|
page read and write
|
||
|
3980000
|
trusted library allocation
|
page read and write
|
||
|
2FCC000
|
stack
|
page read and write
|
||
|
788E000
|
stack
|
page read and write
|
||
|
5E49000
|
trusted library allocation
|
page read and write
|
||
|
70D000
|
heap
|
page read and write
|
||
|
F11000
|
unkown
|
page write copy
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
7900000
|
trusted library allocation
|
page execute and read and write
|
||
|
2C3C000
|
stack
|
page read and write
|
||
|
D8E000
|
heap
|
page read and write
|
||
|
2CFD000
|
heap
|
page read and write
|
||
|
3648000
|
heap
|
page read and write
|
||
|
3060000
|
trusted library allocation
|
page read and write
|
||
|
37F3000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
D8C000
|
heap
|
page read and write
|
||
|
319A000
|
heap
|
page read and write
|
||
|
C6E000
|
stack
|
page read and write
|
||
|
7970000
|
trusted library allocation
|
page read and write
|
||
|
50BB000
|
trusted library allocation
|
page read and write
|
||
|
38B1000
|
trusted library allocation
|
page read and write
|
||
|
3AB6000
|
trusted library allocation
|
page read and write
|
||
|
3ABD000
|
trusted library allocation
|
page read and write
|
||
|
46B000
|
unkown
|
page read and write
|
||
|
6EBE000
|
stack
|
page read and write
|
||
|
3A14000
|
trusted library allocation
|
page read and write
|
||
|
409000
|
unkown
|
page readonly
|
||
|
37B1000
|
trusted library allocation
|
page read and write
|
||
|
392E000
|
trusted library allocation
|
page read and write
|
||
|
79A0000
|
trusted library allocation
|
page read and write
|
||
|
4BF000
|
unkown
|
page read and write
|
||
|
D31000
|
heap
|
page read and write
|
||
|
717E000
|
stack
|
page read and write
|
||
|
2FE8000
|
heap
|
page read and write
|
||
|
3262000
|
heap
|
page read and write
|
||
|
2F4E000
|
stack
|
page read and write
|
||
|
39F2000
|
trusted library allocation
|
page read and write
|
There are 539 hidden memdumps, click here to show them.